pf_rs/

pf.rs

/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2021 Aleksandr Morozov, RELKOM s.r.o
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *    - Redistributions of source code must retain the above copyright
 *      notice, this list of conditions and the following disclaimer.
 *    - Redistributions in binary form must reproduce the above
 *      copyright notice, this list of conditions and the following
 *      disclaimer in the documentation and/or other materials provided
 *      with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 */
 

use std::fs::{File, OpenOptions};
use std::os::fd::AsFd;
use std::os::unix::fs::OpenOptionsExt;
use std::path::Path;

use nix::fcntl::{open, OFlag};
use nix::sys::stat::Mode;
use nix::libc;

use crate::ioctl::pfioc_state_kill;
use crate::pfr_buffer::{PfrBuffer, Pfrb};
use crate::pfr_table::pfr_table;
use crate::common;
use crate::{error_coded, map_error_coded, runtime_exception::*};

/*
unsafe fn any_as_u8_slice<T: Sized>(p: &T) -> &[u8] {
    ::core::slice::from_raw_parts(
        (p as *const T) as *const u8,
        ::core::mem::size_of::<T>(),
    )
}
*/



pub enum PfCmd
{
    /// Adds a host/hostname to table
    Add{ hosts: Vec<String> }, 

    /// Removes a host/hostname from table
    Delete{ hosts: Vec<String> }, 

    /// Checks if host/hostname presents in table
    Test{ hosts: Vec<String> },

    /// Flushes the 
    Flush,
}

pub enum PfCmdFile<'p>
{
    /// Adds a host/hostname to table
    Add{ file_path: &'p Path }, 

    /// Removes a host/hostname from table
    Delete{ file_path: &'p Path }, 

    /// Checks if host/hostname presents in table
    Test{ file_path: &'p Path },

    /// Flushes the 
    Flush,
}


pub struct Pf
{
    fd: File,
    test: bool
}

impl Pf
{
    const DEFAULT_PF_DEVICE: &'static str = "/dev/pf";

    /// Creates new instance. Opens the pf device in dev.
    /// 
    /// The file descriptor for the opened PF device will be closed on 
    /// drop of this instance, so don't keep it.
    pub 
    fn new(pf_dev_path: Option<&str>) -> PfResult<Self>
    {
        let path = Path::new(pf_dev_path.unwrap_or(Self::DEFAULT_PF_DEVICE));

        if path.exists() == false
        {
            error_coded!(PfErrCode::IOErr, "file: '{}' does not exist!", path.display());
        }
        else if path.is_dir() == true
        {
            error_coded!(PfErrCode::IOErr, "file: '{}' is directory!", path.display());
        }

        let file = 
            OpenOptions::new()
                .custom_flags(libc::O_NONBLOCK | libc::O_RDWR)
                .open(path)
                .map_err(|e|
                    map_error_coded!(PfErrCode::IOErr, "open() failed path {} err: {}", Self::DEFAULT_PF_DEVICE, e)
                )?;

        /*let fd = 
            open(path, OFlag::O_NONBLOCK | OFlag::O_RDWR, Mode::empty())
                .map_err(|e| 
                    map_error_coded!(PfErrCode::IOErr, "open() failed path {} err: {}", Self::DEFAULT_PF_DEVICE, e)
                )?;*/

        return Ok(Self{ fd: file, test: false });
    }

    #[cfg(test)]
    pub 
    fn new_test() -> PfResult<Self>
    {
        use std::os::fd::FromRawFd;

        let file = unsafe { File::from_raw_fd(1) };

        return Ok(Self{ fd: file, test: true });
    }

    // internal functions to be called from public interface
    // https://github.com/freebsd/freebsd-src/blob/373ffc62c158e52cde86a5b934ab4a51307f9f2e/sbin/pfctl/pfctl.c#L638
    
    /// Kills the state from the state table of the firewall. When host address
    /// is added to the table, it is not purged from the state table automatically
    /// and the connection will stay alive until the state is not killed.
    /// 
    /// # Arguments
    /// 
    /// * `src` - a host IP address to be killed.
    /// 
    /// * `dest` - a destination IP address to match if any.
    pub 
    fn pfctl_kill_state<H: AsRef<str>>(&self, src: H, dest: Option<H>) -> PfResult<()>
    {
        return unsafe { pfioc_state_kill::new(self.fd.as_fd(), self.test, src, dest) };
    }

    /// Performs the operation on a specific table from the file.
    /// 
    /// # Arguments
    /// 
    /// * `table_name` - a reference to a name of the table on which the operation
    ///     should be performed.
    /// 
    /// * `cmd` - a [PfCmd] operation to be performed with the payload data.
    /// 
    /// # Returns
    /// 
    /// A [PfResult] is returned.
    /// 
    /// * [Result::Ok] is returned with the amound of the successfully performed
    ///     operations (pedends on the amount of the data in payload).
    /// 
    /// * [Result::Err] is returned with error description.
    pub 
    fn pfctl_table_file<'p, T: AsRef<str>>(&self, table_name: T, cmd: PfCmdFile<'p>) -> PfResult<i32>
    {
        let tname = table_name.as_ref();

        let mut table: pfr_table = unsafe { pfr_table::new(tname)? };
        //let mut b: PfrBuffer = PfrBuffer::new();
        //let mut b2: PfrBuffer = PfrBuffer::new();

        if tname.len() >= common::PF_TABLE_NAME_SIZE
        {
            error_coded!(PfErrCode::Einval, "table name: '{}' is too long!", tname);
        }

        // verify that onlu ASCII chars are in tname
        if tname.chars().all(|c| c.is_ascii()) == false
        {
            error_coded!(PfErrCode::Einval, "non ascii character in table_name: {}", tname);
        }

        //table.pfrt_name.copy_from_slice(tname.as_bytes());

        // https://github.com/freebsd/freebsd-src/blob/373ffc62c158e52cde86a5b934ab4a51307f9f2e/sbin/pfctl/pfctl_table.c :201
        let ret_val = 
            match cmd
            {
                PfCmdFile::Add{ file_path } =>
                {
                    let mut b: PfrBuffer = PfrBuffer::new(Pfrb::PFRB_ADDRS);
                    
                    unsafe
                    {
                        b.load_addr_from_file(file_path, 0)?;

                        table.create_table(self.fd.as_fd(), self.test)?;

                        table.add_addrs(self.fd.as_fd(), b, self.test)?
                    }
                },
                PfCmdFile::Delete{ file_path } => 
                {
                    let mut b: PfrBuffer = PfrBuffer::new(Pfrb::PFRB_ADDRS);

                    unsafe 
                    {
                        b.load_addr_from_file(file_path, 0)?;

                        table.del_addrs(self.fd.as_fd(), b)? 
                    }
                },
                PfCmdFile::Test{ file_path } => 
                {
                    let mut b: PfrBuffer = PfrBuffer::new(Pfrb::PFRB_ADDRS);

                    unsafe 
                    {
                        b.load_addr_from_file(file_path, 0)?;

                        table.tst_addrs(self.fd.as_fd(), b)?
                    }
                },
                PfCmdFile::Flush => 
                {
                    unsafe { table.fls_addrs(self.fd.as_fd())? }
                }
            }; // match

        return Ok(ret_val);
    }

    /// Performs the operation on a specific table.
    /// 
    /// # Arguments
    /// 
    /// * `table_name` - a reference to a name of the table on which the operation
    ///     should be performed.
    /// 
    /// * `cmd` - a [PfCmd] operation to be performed with the payload data.
    /// 
    /// # Returns
    /// 
    /// A [PfResult] is returned.
    /// 
    /// * [Result::Ok] is returned with the amound of the successfully performed
    ///     operations (pedends on the amount of the data in payload).
    /// 
    /// * [Result::Err] is returned with error description.
    pub  
    fn pfctl_table<T: AsRef<str>>(&self, table_name: T, cmd: PfCmd) -> PfResult<i32>
    {
        let tname = table_name.as_ref();

        let mut table: pfr_table = unsafe { pfr_table::new(tname)? };
        //let mut b: PfrBuffer = PfrBuffer::new();
        //let mut b2: PfrBuffer = PfrBuffer::new();

        if tname.len() >= common::PF_TABLE_NAME_SIZE
        {
            error_coded!(PfErrCode::Einval, "table name: '{}' is too long!", tname);
        }

        // verify that onlu ASCII chars are in tname
        if tname.chars().all(|c| c.is_ascii()) == false
        {
            error_coded!(PfErrCode::Einval, "non ascii character in table_name: {}", tname);
        }

        //table.pfrt_name.copy_from_slice(tname.as_bytes());

        // https://github.com/freebsd/freebsd-src/blob/373ffc62c158e52cde86a5b934ab4a51307f9f2e/sbin/pfctl/pfctl_table.c :201
        let ret_val = 
            match cmd
            {
                PfCmd::Add{ hosts } =>
                {
                    let mut b: PfrBuffer = PfrBuffer::new(Pfrb::PFRB_ADDRS);
                    //b.pfrb_type = Pfrb::PFRB_ADDRS as libc::c_int; //C b.pfrb_type = PFRB_ADDRS;

                    for host in hosts
                    {
                        unsafe { b.load_addr_from_str(host, 0)? }; //C if (load_addr(&b, argc, argv, file, 0))
                    }

                    unsafe
                    {
                        table.create_table(self.fd.as_fd(), self.test)?;

                        table.add_addrs(self.fd.as_fd(), b, self.test)?
                    }
                },
                PfCmd::Delete{ hosts } => 
                {
                    let mut b: PfrBuffer = PfrBuffer::new(Pfrb::PFRB_ADDRS);
                    //b.pfrb_type = Pfrb::PFRB_ADDRS as libc::c_int; //C b.pfrb_type = PFRB_ADDRS;

                    for host in hosts
                    {
                        unsafe { b.load_addr_from_str(host, 0)? }; //C if (load_addr(&b, argc, argv, file, 0))
                    }

                    unsafe { table.del_addrs(self.fd.as_fd(), b)? }
                },
                PfCmd::Test{ hosts } => 
                {
                    let mut b: PfrBuffer = PfrBuffer::new(Pfrb::PFRB_ADDRS);
                    //b.pfrb_type = Pfrb::PFRB_ADDRS as libc::c_int; //C b.pfrb_type = PFRB_ADDRS;
                    //b2.pfrb_type = Pfrb::PFRB_ADDRS as libc::c_int; //C b.pfrb_type = PFRB_ADDRS;

                    for host in hosts
                    {
                        unsafe { b.load_addr_from_str(host, 1)? }; //C if (load_addr(&b, argc, argv, file, 1))
                    }

                    unsafe 
                    {
                        table.tst_addrs(self.fd.as_fd(), b)?
                    }
                },
                PfCmd::Flush => 
                {
                    unsafe { table.fls_addrs(self.fd.as_fd())? }
                }
            }; // match

        return Ok(ret_val);
    }

    
}

#[cfg(test)]
mod tests
{
    use crate::{ioctl::pfioc_table, pfr_addr::pf_addr};

    use super::*;
    
    #[test]
    fn test_real_add()
    {
        let pf = Pf::new_test().unwrap();

        pf.pfctl_table("test", PfCmd::Add{ hosts: vec!["192.168.2.1".to_string()] }).unwrap();
    }

    #[test]
    fn test_real_check()
    {
        let pf = Pf::new_test().unwrap();

        pf.pfctl_table("test", PfCmd::Test{ hosts: vec!["192.168.2.1".to_string()] }).unwrap();
    }

    #[test]
    fn test_real_del() 
    {
        let pf = Pf::new_test().unwrap();

        pf.pfctl_table("test", PfCmd::Delete{ hosts: vec!["192.168.2.1".to_string()] }).unwrap();
    }

    #[test]
    fn test_kill_state()
    {
        let pf = Pf::new_test().unwrap();

         pf.pfctl_kill_state("192.168.2.104", None).unwrap();
    }

    #[test]
    fn fake_test_real_kill_state()
    {
        let pf = Pf::new_test().unwrap();

        pf.pfctl_kill_state("192.168.2.1", None).unwrap();
    }

    #[test]
    fn fake_test_add()
    {
        let pf = Pf::new_test().unwrap();

        pf.pfctl_table("test", PfCmd::Add{ hosts: vec!["192.168.2.1".to_string()] }).unwrap();
    }

    #[test]
    fn fake_test2_add()
    {
        let pf = Pf::new_test().unwrap();

        pf.pfctl_table("test", PfCmd::Add{ hosts: vec!["192.168.2.0/24".to_string()] }).unwrap();
    }

    #[test]
    fn test_struct_sizes()
    {
        let s = std::mem::size_of::<pfioc_table>();
        println!("sizeof(struct pfioc_table = 1104) ?= {}", s);
        assert_eq!(1104, s);

        let s = std::mem::size_of::<pfr_table>();
        println!("sizeof(struct pfr_table = 1064) ?= {}", s);
        assert_eq!(1064, s);

        let s = std::mem::size_of::<pfioc_state_kill>();
        println!("sizeof(struct pfioc_state_kill = 224) ?= {}", s);
        assert_eq!(224, s);
        
        let psk: pfioc_state_kill = unsafe {std::mem::zeroed()};
        let s = std::mem::size_of_val(&psk.psk_af);
        println!("sizeof(psk.psk_af) = {}", s);
        assert_eq!(1, s);

        let s = std::mem::size_of_val(&psk.psk_src);
        println!("sizeof(psk.psk_src) = {}", s);
        assert_eq!(56, s);

        let s = std::mem::size_of_val(&psk.psk_dst);
        println!("sizeof(psk.psk_dst) = {}", std::mem::size_of_val(&psk.psk_dst));
        assert_eq!(56, s);

        let s = std::mem::size_of_val(&psk.psk_ifname);
        println!("sizeof(psk.psk_ifname) = {}", std::mem::size_of_val(&psk.psk_ifname));
        assert_eq!(16, s);

        let s = std::mem::size_of_val(&psk.psk_label);
        println!("sizeof(psk.psk_label) = {}", std::mem::size_of_val(&psk.psk_label));
        assert_eq!(64, s);

        let s = std::mem::size_of_val(&psk.psk_killed);
        println!("sizeof(psk.psk_killed) = {}", std::mem::size_of_val(&psk.psk_killed));
        assert_eq!(4, s);

        let s = std::mem::size_of_val(&psk.psk_proto);
        println!("sizeof(psk.psk_proto) = {}", std::mem::size_of_val(&psk.psk_proto));
        assert_eq!(4, s);

        let s = std::mem::size_of_val(&psk.psk_pfcmp);
        println!("sizeof(psk.psk_pfcmp) = {}", std::mem::size_of_val(&psk.psk_pfcmp));
        assert_eq!(16, s);

        let s = std::mem::size_of_val(&psk.psk_src.addr);
        println!("sizeof(psk.psk_src.addr) = {}", std::mem::size_of_val(&psk.psk_src.addr));
        assert_eq!(48, s);

        let s = std::mem::size_of_val(&psk.psk_src.addr.v);
        println!("sizeof(psk.psk_src.addr.v) = {}", std::mem::size_of_val(&psk.psk_src.addr.v));
        assert_eq!(32, s);

        let s = std::mem::size_of_val(&psk.psk_src.addr.p);
        println!("sizeof(psk.psk_src.addr.p) = {}", std::mem::size_of_val(&psk.psk_src.addr.p));
        assert_eq!(8, s);

        let s = std::mem::size_of_val(&psk.psk_src.addr.tp);
        println!("sizeof(psk.psk_src.addr.tp) = {}", std::mem::size_of_val(&psk.psk_src.addr.tp));
        assert_eq!(1, s);

        let s = std::mem::size_of_val(&psk.psk_src.addr.iflags);
        println!("sizeof(psk.psk_src.addr.iflags) = {}", std::mem::size_of_val(&psk.psk_src.addr.iflags));
        assert_eq!(1, s);
    }

    /*
    DIOCKILLSTATES: 3235922985 sizeof(224)
    psk.psk_af size: 1
    psk.psk_src size: 56
    psk.psk_dst size: 56
    psk.psk_ifname size: 16
    psk.psk_label size: 64
    psk.psk_killed size: 4
    psk.psk_proto size: 4
    psk.psk_pfcmp size: 16
    psk.psk_src.addr size: 48
    psk.psk_src.addr size: 48

    psk.psk_src.addr.v size: 32
    psk.psk_src.addr.p size: 8
    psk.psk_src.addr.type size: 1
    psk.psk_src.addr.iflags size: 1

    */
    #[test]
    fn test_unmask()
    {
        use std::net::Ipv4Addr;

        fn create(ip: &'static str) -> libc::c_int
        {
            let ipv4: Ipv4Addr = ip.parse().unwrap();

            let ip = pf_addr::from(ipv4.octets());

            return ip.unmask(0);
        }


        assert_eq!(create("255.255.255.255"), 32);
        assert_eq!(create("192.168.1.1"), 2);
        assert_eq!(create("10.0.0.0"), 0);
        assert_eq!(create("10.5.6.3"), 0);
        assert_eq!(create("134.156.43.230"), 1);
        assert_eq!(create("8.8.8.8"), 0);
        assert_eq!(create("244.255.255.255"), 4);
        assert_eq!(create("0.0.0.0"), 0);
        assert_eq!(create("100.200.255.255"), 0);
    }
 

   
}