| LIBNPF(3) | Library Functions Manual | LIBNPF(3) | 
libnpf —
#include <npf.h>
nl_config_t *
  
  npf_config_create(void);
int
  
  npf_config_submit(nl_config_t
    *ncf, int fd,
    npf_error_t
  *errinfo);
nl_config_t *
  
  npf_config_retrieve(int
    fd);
int
  
  npf_config_flush(int
    fd);
void
  
  npf_config_export(nl_config_t
    *ncf, size_t
  *len);
nl_config_t *
  
  npf_config_import(const
    void *blob, size_t
    len);
bool
  
  npf_config_active_p(nl_config_t
    *ncf);
bool
  
  npf_config_loaded_p(nl_config_t
    *ncf);
void
  
  npf_config_destroy(nl_config_t
    *ncf);
nl_rule_t *
  
  npf_rule_create(const
    char *name, uint32_t
    attr, const char
    *ifname);
int
  
  npf_rule_setcode(nl_rule_t
    *rl, int type,
    const void *code,
    size_t len);
int
  
  npf_rule_setkey(nl_rule_t
    *rl, const void
    *key, size_t
  len);
int
  
  npf_rule_setinfo(nl_rule_t
    *rl, const void
    *info, size_t
  len);
int
  
  npf_rule_setprio(nl_rule_t
    *rl, int pri);
int
  
  npf_rule_setproc(nl_rule_t
    *rl, const char
    *name);
int
  
  npf_rule_insert(nl_config_t
    *ncf, nl_rule_t
    *parent, nl_rule_t
    *rl);
bool
  
  npf_rule_exists_p(nl_config_t
    *ncf, const char
    *name);
void *
  
  npf_rule_export(nl_rule_t
    *rl, size_t
    *length);
void
  
  npf_rule_destroy(nl_rule_t
    *rl);
nl_rproc_t *
  
  npf_rproc_create(const
    char *name);
int
  
  npf_rproc_extcall(nl_rproc_t
    *rp, nl_ext_t
    *ext);
bool
  
  npf_rproc_exists_p(nl_config_t
    *ncf, const char
    *name);
int
  
  npf_rproc_insert(nl_config_t
    *ncf, nl_rproc_t
    *rp);
nl_nat_t *
  
  npf_nat_create(int
    type, unsigned
    flags, const char
    *ifname);
int
  
  npf_nat_setaddr(nl_nat_t
    *nt, int af,
    npf_addr_t *addr,
    npf_netmask_t mask);
int
  
  npf_nat_setport(nl_nat_t
    *nt, in_port_t
    port);
int
  
  npf_nat_insert(nl_config_t
    *ncf, nl_nat_t
    *nt);
nl_table_t *
  
  npf_table_create(const
    char *name, unsigned
    id, int type);
int
  
  npf_table_add_entry(nl_table_t
    *tl, int af,
    const npf_addr_t *addr,
    const npf_netmask_t
    mask);
int
  
  npf_table_insert(nl_config_t
    *ncf, nl_table_t
    *tl);
int
  
  npf_table_replace(int
    fd, nl_table_t *tl,
    npf_error_t
  *errinfo);
void
  
  npf_table_destroy(nl_table_t
    *tl);
int
  
  npf_ruleset_add(int
    fd, const char
    *name, nl_rule_t
    *rl, uint64_t
  *id);
int
  
  npf_ruleset_remove(int
    fd, const char
    *name, uint64_t
    id);
int
  
  npf_ruleset_remkey(int
    fd, const char
    *name, const void
    *key, size_t
  len);
int
  
  npf_ruleset_flush(int
    fd, const char
    *name);
libnpf library provides an interface to create an
  NPF configuration having rules, tables, procedures, or translation policies.
  The configuration can be submitted to the kernel.
npf_config_create()npf_config_submit(ncf,
    fd, errinfo)npf_config_export(ncf,
    len)npf_config_import(blob,
    len)npf_config_flush(fd)npf_config_retrieve(fd)npf_config_active_p(ncf)npf_config_loaded_p(ncf)npf_config_destroy(ncf)npf_rule_create(name,
    attr, ifname)NULL, in which case the
      rule will have no identifier. The following attributes, which can be ORed,
      are available:
    NPF_RULE_PASSNPF_RULE_INNPF_RULE_OUTNPF_RULE_FINALNPF_RULE_STATEFULNPF_RULE_GSTATEFULNPF_RULE_RETRSTNPF_RULE_RETICMPNPF_RULE_GROUPNPF_RULE_DYNAMIC flag set, then it is a
          dynamic group. The sub-rules can be added dynamically to a dynamic
          group, also meaning that the sub-rules must have the
          NPF_RULE_DYNAMIC flag set. Otherwise rules
          must be added statically i.e. created with the configuration.NPF_RULE_DYNAMICThe interface is specified by the ifname
        string. NULL indicates any interface.
npf_rule_setcode(rl,
    type, code,
    len)NPF_CODE_BPF constant should be
      passed.npf_rule_setkey(rl,
    key, len)NPF_RULE_MAXKEYLEN. The kernel does not check
      whether key is unique, therefore it is the responsibility of the
    caller.npf_rule_setinfo(rl,
    info, len)npf_rule_setprio(rl,
    pri)The priority is the order of the rule in the ruleset. The lower value means first to process, the higher value - last to process. If multiple rules are inserted with the same priority, then the order is unspecified.
The special constants NPF_PRI_FIRST
        and NPF_PRI_LAST can be passed to indicate that
        the rule should be inserted into the beginning or the end of the
        priority level 0 in the ruleset. All rules inserted using these
        constants will have the priority 0 assigned and will share this level in
        the ordered way.
npf_rule_setproc(rl,
    name)npf_rule_insert(ncf,
    parent, rl)NULL, then insert into the main ruleset. The
      rule will be consumed (the relevant resourced will be freed) and it must
      not be referenced after insertion.npf_rule_exists_p(ncf,
    name)npf_rule_export(rl,
    length)npf_rule_destroy(rl)npf_rproc_create(name)npf_rproc_insert(ncf,
    rp)npf_nat_create(type,
    flags, ifname)NPF_NATINNPF_NATOUTA bi-directional NAT is obtained by combining two policies. The following flags are supported:
NPF_NAT_STATICNPF_NAT_PORTSNPF_NAT_PORTMAPNPF_NAT_PORTS flag is set.The network interface on which the policy will be applicable is specified by ifname.
npf_nat_setaddr(nt,
    af, addr,
    mask)AF_INET for IPv4 or
      AF_INET6 for IPv6 address. Additionally,
      mask may be specified to indicate the translation
      network; otherwise, it should be set to
      NPF_NO_NETMASK.
    In order to use the translation network, a custom algorithm
        may need to be specified using the
        npf_nat_setalgo() function.
npf_nat_setport(nt,
    port)npf_nat_setalgo(nt,
    algo)NPF_ALGO_IPHASHNPF_ALGO_RRNPF_ALGO_NETMAPThe following are support with static NAT:
NPF_ALGO_NETMAPNPF_ALGO_NPT66npf_nat_insert(ncf,
    nt)npf_table_create(name,
    index, type)NPF_MAX_TABLES.
    The following types are supported:
NPF_TABLE_IPSETNPF_TABLE_LPMNPF_TABLE_CONSTnpf_table_add_entry(tl,
    af, addr,
    mask)AF_INET
      for IPv4 or AF_INET6 for IPv6 address. If there is
      no mask, then mask should be set to
      NPF_NO_NETMASK.npf_table_insert(ncf,
    tl)npf_table_replace(fd,
    tl, errinfo)npf_table_destroy(tl)npf_ruleset_add(fd,
    name, rl,
    id)npf_ruleset_remove(fd,
    name, id)npf_ruleset_remkey(fd,
    name, key,
    len)npf_rule_setkey() routine.npf_ruleset_flush(fd,
    name)| May 30, 2020 | NetBSD 9.3 |