19758b77fSLuigi Rizzo /* 2571f8c1bSLuigi Rizzo * Copyright (c) 2002-2003 Luigi Rizzo 39758b77fSLuigi Rizzo * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 49758b77fSLuigi Rizzo * Copyright (c) 1994 Ugen J.S.Antsilevich 59758b77fSLuigi Rizzo * 69758b77fSLuigi Rizzo * Idea and grammar partially left from: 79758b77fSLuigi Rizzo * Copyright (c) 1993 Daniel Boulet 89758b77fSLuigi Rizzo * 99758b77fSLuigi Rizzo * Redistribution and use in source forms, with and without modification, 109758b77fSLuigi Rizzo * are permitted provided that this entire comment appears intact. 119758b77fSLuigi Rizzo * 129758b77fSLuigi Rizzo * Redistribution in binary form may occur without any restrictions. 139758b77fSLuigi Rizzo * Obviously, it would be nice if you gave credit where credit is due 149758b77fSLuigi Rizzo * but requiring it would be too onerous. 159758b77fSLuigi Rizzo * 169758b77fSLuigi Rizzo * This software is provided ``AS IS'' without any warranties of any kind. 179758b77fSLuigi Rizzo * 189758b77fSLuigi Rizzo * NEW command line interface for IP firewall facility 199758b77fSLuigi Rizzo * 209758b77fSLuigi Rizzo * $FreeBSD$ 219758b77fSLuigi Rizzo */ 229758b77fSLuigi Rizzo 239758b77fSLuigi Rizzo #include <sys/param.h> 249758b77fSLuigi Rizzo #include <sys/mbuf.h> 259758b77fSLuigi Rizzo #include <sys/socket.h> 269758b77fSLuigi Rizzo #include <sys/sockio.h> 279758b77fSLuigi Rizzo #include <sys/sysctl.h> 289758b77fSLuigi Rizzo #include <sys/time.h> 299758b77fSLuigi Rizzo #include <sys/wait.h> 30974dfe30SBrian Feldman #include <sys/queue.h> 319758b77fSLuigi Rizzo 329758b77fSLuigi Rizzo #include <ctype.h> 339758b77fSLuigi Rizzo #include <err.h> 349758b77fSLuigi Rizzo #include <errno.h> 359758b77fSLuigi Rizzo #include <grp.h> 369758b77fSLuigi Rizzo #include <limits.h> 379758b77fSLuigi Rizzo #include <netdb.h> 389758b77fSLuigi Rizzo #include <pwd.h> 399758b77fSLuigi Rizzo #include <signal.h> 409758b77fSLuigi Rizzo #include <stdio.h> 419758b77fSLuigi Rizzo #include <stdlib.h> 429758b77fSLuigi Rizzo #include <stdarg.h> 439758b77fSLuigi Rizzo #include <string.h> 4462ff38aeSLuigi Rizzo #include <timeconv.h> /* XXX do we need this ? */ 459758b77fSLuigi Rizzo #include <unistd.h> 469758b77fSLuigi Rizzo #include <sysexits.h> 47974dfe30SBrian Feldman #include <unistd.h> 48974dfe30SBrian Feldman #include <fcntl.h> 499758b77fSLuigi Rizzo 509758b77fSLuigi Rizzo #include <net/if.h> 51974dfe30SBrian Feldman #include <net/pfvar.h> 528195404bSBrooks Davis #include <net/route.h> /* def. of struct route */ 539758b77fSLuigi Rizzo #include <netinet/in.h> 549758b77fSLuigi Rizzo #include <netinet/in_systm.h> 559758b77fSLuigi Rizzo #include <netinet/ip.h> 569758b77fSLuigi Rizzo #include <netinet/ip_icmp.h> 578195404bSBrooks Davis #include <netinet/icmp6.h> 589758b77fSLuigi Rizzo #include <netinet/ip_fw.h> 599758b77fSLuigi Rizzo #include <netinet/ip_dummynet.h> 609758b77fSLuigi Rizzo #include <netinet/tcp.h> 619758b77fSLuigi Rizzo #include <arpa/inet.h> 629758b77fSLuigi Rizzo 63571f8c1bSLuigi Rizzo int 649758b77fSLuigi Rizzo do_resolv, /* Would try to resolve all */ 659758b77fSLuigi Rizzo do_time, /* Show time stamps */ 669758b77fSLuigi Rizzo do_quiet, /* Be quiet in add and flush */ 679758b77fSLuigi Rizzo do_pipe, /* this cmd refers to a pipe */ 689758b77fSLuigi Rizzo do_sort, /* field to sort results (0 = no) */ 699758b77fSLuigi Rizzo do_dynamic, /* display dynamic rules */ 709758b77fSLuigi Rizzo do_expired, /* display expired dynamic rules */ 715a155b40SLuigi Rizzo do_compact, /* show rules in compact mode */ 72cec4ab6aSMaxim Konovalov do_force, /* do not ask for confirmation */ 7343405724SLuigi Rizzo show_sets, /* display rule sets */ 74571f8c1bSLuigi Rizzo test_only, /* only check syntax */ 75ac6cec51SLuigi Rizzo comment_only, /* only print action and comment */ 769758b77fSLuigi Rizzo verbose; 779758b77fSLuigi Rizzo 789758b77fSLuigi Rizzo #define IP_MASK_ALL 0xffffffff 7904f70834SChristian S.J. Peron /* 8004f70834SChristian S.J. Peron * the following macro returns an error message if we run out of 8104f70834SChristian S.J. Peron * arguments. 8204f70834SChristian S.J. Peron */ 8304f70834SChristian S.J. Peron #define NEED1(msg) {if (!ac) errx(EX_USAGE, msg);} 849758b77fSLuigi Rizzo 859758b77fSLuigi Rizzo /* 86571f8c1bSLuigi Rizzo * _s_x is a structure that stores a string <-> token pairs, used in 87571f8c1bSLuigi Rizzo * various places in the parser. Entries are stored in arrays, 88571f8c1bSLuigi Rizzo * with an entry with s=NULL as terminator. 89571f8c1bSLuigi Rizzo * The search routines are match_token() and match_value(). 90571f8c1bSLuigi Rizzo * Often, an element with x=0 contains an error string. 919758b77fSLuigi Rizzo * 929758b77fSLuigi Rizzo */ 939758b77fSLuigi Rizzo struct _s_x { 9462ff38aeSLuigi Rizzo char const *s; 959758b77fSLuigi Rizzo int x; 969758b77fSLuigi Rizzo }; 979758b77fSLuigi Rizzo 989758b77fSLuigi Rizzo static struct _s_x f_tcpflags[] = { 999758b77fSLuigi Rizzo { "syn", TH_SYN }, 1009758b77fSLuigi Rizzo { "fin", TH_FIN }, 1019758b77fSLuigi Rizzo { "ack", TH_ACK }, 1029758b77fSLuigi Rizzo { "psh", TH_PUSH }, 1039758b77fSLuigi Rizzo { "rst", TH_RST }, 1049758b77fSLuigi Rizzo { "urg", TH_URG }, 1059758b77fSLuigi Rizzo { "tcp flag", 0 }, 1069758b77fSLuigi Rizzo { NULL, 0 } 1079758b77fSLuigi Rizzo }; 1089758b77fSLuigi Rizzo 1099758b77fSLuigi Rizzo static struct _s_x f_tcpopts[] = { 1109758b77fSLuigi Rizzo { "mss", IP_FW_TCPOPT_MSS }, 1119758b77fSLuigi Rizzo { "maxseg", IP_FW_TCPOPT_MSS }, 1129758b77fSLuigi Rizzo { "window", IP_FW_TCPOPT_WINDOW }, 1139758b77fSLuigi Rizzo { "sack", IP_FW_TCPOPT_SACK }, 1149758b77fSLuigi Rizzo { "ts", IP_FW_TCPOPT_TS }, 1159758b77fSLuigi Rizzo { "timestamp", IP_FW_TCPOPT_TS }, 1169758b77fSLuigi Rizzo { "cc", IP_FW_TCPOPT_CC }, 1179758b77fSLuigi Rizzo { "tcp option", 0 }, 1189758b77fSLuigi Rizzo { NULL, 0 } 1199758b77fSLuigi Rizzo }; 1209758b77fSLuigi Rizzo 1219758b77fSLuigi Rizzo /* 1229758b77fSLuigi Rizzo * IP options span the range 0 to 255 so we need to remap them 1239758b77fSLuigi Rizzo * (though in fact only the low 5 bits are significant). 1249758b77fSLuigi Rizzo */ 1259758b77fSLuigi Rizzo static struct _s_x f_ipopts[] = { 1269758b77fSLuigi Rizzo { "ssrr", IP_FW_IPOPT_SSRR}, 1279758b77fSLuigi Rizzo { "lsrr", IP_FW_IPOPT_LSRR}, 1289758b77fSLuigi Rizzo { "rr", IP_FW_IPOPT_RR}, 1299758b77fSLuigi Rizzo { "ts", IP_FW_IPOPT_TS}, 1309758b77fSLuigi Rizzo { "ip option", 0 }, 1319758b77fSLuigi Rizzo { NULL, 0 } 1329758b77fSLuigi Rizzo }; 1339758b77fSLuigi Rizzo 1349758b77fSLuigi Rizzo static struct _s_x f_iptos[] = { 1359758b77fSLuigi Rizzo { "lowdelay", IPTOS_LOWDELAY}, 1369758b77fSLuigi Rizzo { "throughput", IPTOS_THROUGHPUT}, 1379758b77fSLuigi Rizzo { "reliability", IPTOS_RELIABILITY}, 1389758b77fSLuigi Rizzo { "mincost", IPTOS_MINCOST}, 1399758b77fSLuigi Rizzo { "congestion", IPTOS_CE}, 1409758b77fSLuigi Rizzo { "ecntransport", IPTOS_ECT}, 1419758b77fSLuigi Rizzo { "ip tos option", 0}, 1429758b77fSLuigi Rizzo { NULL, 0 } 1439758b77fSLuigi Rizzo }; 1449758b77fSLuigi Rizzo 1459758b77fSLuigi Rizzo static struct _s_x limit_masks[] = { 1469758b77fSLuigi Rizzo {"all", DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT}, 1479758b77fSLuigi Rizzo {"src-addr", DYN_SRC_ADDR}, 1489758b77fSLuigi Rizzo {"src-port", DYN_SRC_PORT}, 1499758b77fSLuigi Rizzo {"dst-addr", DYN_DST_ADDR}, 1509758b77fSLuigi Rizzo {"dst-port", DYN_DST_PORT}, 1519758b77fSLuigi Rizzo {NULL, 0} 1529758b77fSLuigi Rizzo }; 1539758b77fSLuigi Rizzo 1549758b77fSLuigi Rizzo /* 1559758b77fSLuigi Rizzo * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines 1569758b77fSLuigi Rizzo * This is only used in this code. 1579758b77fSLuigi Rizzo */ 1589758b77fSLuigi Rizzo #define IPPROTO_ETHERTYPE 0x1000 1599758b77fSLuigi Rizzo static struct _s_x ether_types[] = { 1609758b77fSLuigi Rizzo /* 1619758b77fSLuigi Rizzo * Note, we cannot use "-:&/" in the names because they are field 1629758b77fSLuigi Rizzo * separators in the type specifications. Also, we use s = NULL as 1639758b77fSLuigi Rizzo * end-delimiter, because a type of 0 can be legal. 1649758b77fSLuigi Rizzo */ 1659758b77fSLuigi Rizzo { "ip", 0x0800 }, 1669758b77fSLuigi Rizzo { "ipv4", 0x0800 }, 1679758b77fSLuigi Rizzo { "ipv6", 0x86dd }, 1689758b77fSLuigi Rizzo { "arp", 0x0806 }, 1699758b77fSLuigi Rizzo { "rarp", 0x8035 }, 1709758b77fSLuigi Rizzo { "vlan", 0x8100 }, 1719758b77fSLuigi Rizzo { "loop", 0x9000 }, 1729758b77fSLuigi Rizzo { "trail", 0x1000 }, 1739758b77fSLuigi Rizzo { "at", 0x809b }, 1749758b77fSLuigi Rizzo { "atalk", 0x809b }, 1759758b77fSLuigi Rizzo { "aarp", 0x80f3 }, 1769758b77fSLuigi Rizzo { "pppoe_disc", 0x8863 }, 1779758b77fSLuigi Rizzo { "pppoe_sess", 0x8864 }, 1789758b77fSLuigi Rizzo { "ipx_8022", 0x00E0 }, 1799758b77fSLuigi Rizzo { "ipx_8023", 0x0000 }, 1809758b77fSLuigi Rizzo { "ipx_ii", 0x8137 }, 1819758b77fSLuigi Rizzo { "ipx_snap", 0x8137 }, 1829758b77fSLuigi Rizzo { "ipx", 0x8137 }, 1839758b77fSLuigi Rizzo { "ns", 0x0600 }, 1849758b77fSLuigi Rizzo { NULL, 0 } 1859758b77fSLuigi Rizzo }; 1869758b77fSLuigi Rizzo 1879758b77fSLuigi Rizzo static void show_usage(void); 1889758b77fSLuigi Rizzo 1899758b77fSLuigi Rizzo enum tokens { 1909758b77fSLuigi Rizzo TOK_NULL=0, 1919758b77fSLuigi Rizzo 1929758b77fSLuigi Rizzo TOK_OR, 1939758b77fSLuigi Rizzo TOK_NOT, 1948ed2d749SLuigi Rizzo TOK_STARTBRACE, 1958ed2d749SLuigi Rizzo TOK_ENDBRACE, 1969758b77fSLuigi Rizzo 1979758b77fSLuigi Rizzo TOK_ACCEPT, 1989758b77fSLuigi Rizzo TOK_COUNT, 1999758b77fSLuigi Rizzo TOK_PIPE, 2009758b77fSLuigi Rizzo TOK_QUEUE, 2019758b77fSLuigi Rizzo TOK_DIVERT, 2029758b77fSLuigi Rizzo TOK_TEE, 203670742a1SGleb Smirnoff TOK_NETGRAPH, 204670742a1SGleb Smirnoff TOK_NGTEE, 2059758b77fSLuigi Rizzo TOK_FORWARD, 2069758b77fSLuigi Rizzo TOK_SKIPTO, 2079758b77fSLuigi Rizzo TOK_DENY, 2089758b77fSLuigi Rizzo TOK_REJECT, 2099758b77fSLuigi Rizzo TOK_RESET, 2109758b77fSLuigi Rizzo TOK_UNREACH, 2119758b77fSLuigi Rizzo TOK_CHECKSTATE, 2129758b77fSLuigi Rizzo 213974dfe30SBrian Feldman TOK_ALTQ, 214974dfe30SBrian Feldman TOK_LOG, 215974dfe30SBrian Feldman 2169758b77fSLuigi Rizzo TOK_UID, 2179758b77fSLuigi Rizzo TOK_GID, 21831c88a30SChristian S.J. Peron TOK_JAIL, 2199758b77fSLuigi Rizzo TOK_IN, 2209758b77fSLuigi Rizzo TOK_LIMIT, 2219758b77fSLuigi Rizzo TOK_KEEPSTATE, 2229758b77fSLuigi Rizzo TOK_LAYER2, 2239758b77fSLuigi Rizzo TOK_OUT, 2246daf7ebdSBrian Feldman TOK_DIVERTED, 2256daf7ebdSBrian Feldman TOK_DIVERTEDLOOPBACK, 2266daf7ebdSBrian Feldman TOK_DIVERTEDOUTPUT, 2279758b77fSLuigi Rizzo TOK_XMIT, 2289758b77fSLuigi Rizzo TOK_RECV, 2299758b77fSLuigi Rizzo TOK_VIA, 2309758b77fSLuigi Rizzo TOK_FRAG, 2319758b77fSLuigi Rizzo TOK_IPOPTS, 2329758b77fSLuigi Rizzo TOK_IPLEN, 2339758b77fSLuigi Rizzo TOK_IPID, 2349758b77fSLuigi Rizzo TOK_IPPRECEDENCE, 2359758b77fSLuigi Rizzo TOK_IPTOS, 2369758b77fSLuigi Rizzo TOK_IPTTL, 2379758b77fSLuigi Rizzo TOK_IPVER, 2389758b77fSLuigi Rizzo TOK_ESTAB, 2399758b77fSLuigi Rizzo TOK_SETUP, 240c99ee9e0SBrian Feldman TOK_TCPDATALEN, 2419758b77fSLuigi Rizzo TOK_TCPFLAGS, 2429758b77fSLuigi Rizzo TOK_TCPOPTS, 2439758b77fSLuigi Rizzo TOK_TCPSEQ, 2449758b77fSLuigi Rizzo TOK_TCPACK, 2459758b77fSLuigi Rizzo TOK_TCPWIN, 2469758b77fSLuigi Rizzo TOK_ICMPTYPES, 247e706181bSLuigi Rizzo TOK_MAC, 248e706181bSLuigi Rizzo TOK_MACTYPE, 249010dabb0SCrist J. Clark TOK_VERREVPATH, 25022b5770bSAndre Oppermann TOK_VERSRCREACH, 2515f9541ecSAndre Oppermann TOK_ANTISPOOF, 252c3e5b9f1SLuigi Rizzo TOK_IPSEC, 25362ff38aeSLuigi Rizzo TOK_COMMENT, 2549758b77fSLuigi Rizzo 2559758b77fSLuigi Rizzo TOK_PLR, 25699e5e645SLuigi Rizzo TOK_NOERROR, 2579758b77fSLuigi Rizzo TOK_BUCKETS, 2589758b77fSLuigi Rizzo TOK_DSTIP, 2599758b77fSLuigi Rizzo TOK_SRCIP, 2609758b77fSLuigi Rizzo TOK_DSTPORT, 2619758b77fSLuigi Rizzo TOK_SRCPORT, 2629758b77fSLuigi Rizzo TOK_ALL, 2639758b77fSLuigi Rizzo TOK_MASK, 2649758b77fSLuigi Rizzo TOK_BW, 2659758b77fSLuigi Rizzo TOK_DELAY, 2669758b77fSLuigi Rizzo TOK_RED, 2679758b77fSLuigi Rizzo TOK_GRED, 2689758b77fSLuigi Rizzo TOK_DROPTAIL, 2699758b77fSLuigi Rizzo TOK_PROTO, 2709758b77fSLuigi Rizzo TOK_WEIGHT, 2718195404bSBrooks Davis 2728195404bSBrooks Davis TOK_IPV6, 2738195404bSBrooks Davis TOK_FLOWID, 2748195404bSBrooks Davis TOK_ICMP6TYPES, 2758195404bSBrooks Davis TOK_EXT6HDR, 2768195404bSBrooks Davis TOK_DSTIP6, 2778195404bSBrooks Davis TOK_SRCIP6, 27857cd6d26SMax Laier 27957cd6d26SMax Laier TOK_IPV4, 2809066356bSBjoern A. Zeeb TOK_UNREACH6, 2819066356bSBjoern A. Zeeb TOK_RESET6, 2829758b77fSLuigi Rizzo }; 2839758b77fSLuigi Rizzo 2849758b77fSLuigi Rizzo struct _s_x dummynet_params[] = { 2859758b77fSLuigi Rizzo { "plr", TOK_PLR }, 28699e5e645SLuigi Rizzo { "noerror", TOK_NOERROR }, 2879758b77fSLuigi Rizzo { "buckets", TOK_BUCKETS }, 2889758b77fSLuigi Rizzo { "dst-ip", TOK_DSTIP }, 2899758b77fSLuigi Rizzo { "src-ip", TOK_SRCIP }, 2909758b77fSLuigi Rizzo { "dst-port", TOK_DSTPORT }, 2919758b77fSLuigi Rizzo { "src-port", TOK_SRCPORT }, 2929758b77fSLuigi Rizzo { "proto", TOK_PROTO }, 2939758b77fSLuigi Rizzo { "weight", TOK_WEIGHT }, 2949758b77fSLuigi Rizzo { "all", TOK_ALL }, 2959758b77fSLuigi Rizzo { "mask", TOK_MASK }, 2969758b77fSLuigi Rizzo { "droptail", TOK_DROPTAIL }, 2979758b77fSLuigi Rizzo { "red", TOK_RED }, 2989758b77fSLuigi Rizzo { "gred", TOK_GRED }, 2999758b77fSLuigi Rizzo { "bw", TOK_BW }, 3009758b77fSLuigi Rizzo { "bandwidth", TOK_BW }, 3019758b77fSLuigi Rizzo { "delay", TOK_DELAY }, 3025e43aef8SLuigi Rizzo { "pipe", TOK_PIPE }, 3039758b77fSLuigi Rizzo { "queue", TOK_QUEUE }, 3048195404bSBrooks Davis { "flow-id", TOK_FLOWID}, 3058195404bSBrooks Davis { "dst-ipv6", TOK_DSTIP6}, 3068195404bSBrooks Davis { "dst-ip6", TOK_DSTIP6}, 3078195404bSBrooks Davis { "src-ipv6", TOK_SRCIP6}, 3088195404bSBrooks Davis { "src-ip6", TOK_SRCIP6}, 3099758b77fSLuigi Rizzo { "dummynet-params", TOK_NULL }, 310571f8c1bSLuigi Rizzo { NULL, 0 } /* terminator */ 3119758b77fSLuigi Rizzo }; 3129758b77fSLuigi Rizzo 3139758b77fSLuigi Rizzo struct _s_x rule_actions[] = { 3149758b77fSLuigi Rizzo { "accept", TOK_ACCEPT }, 3159758b77fSLuigi Rizzo { "pass", TOK_ACCEPT }, 3169758b77fSLuigi Rizzo { "allow", TOK_ACCEPT }, 3179758b77fSLuigi Rizzo { "permit", TOK_ACCEPT }, 3189758b77fSLuigi Rizzo { "count", TOK_COUNT }, 3199758b77fSLuigi Rizzo { "pipe", TOK_PIPE }, 3209758b77fSLuigi Rizzo { "queue", TOK_QUEUE }, 3219758b77fSLuigi Rizzo { "divert", TOK_DIVERT }, 3229758b77fSLuigi Rizzo { "tee", TOK_TEE }, 323670742a1SGleb Smirnoff { "netgraph", TOK_NETGRAPH }, 324670742a1SGleb Smirnoff { "ngtee", TOK_NGTEE }, 3259758b77fSLuigi Rizzo { "fwd", TOK_FORWARD }, 3269758b77fSLuigi Rizzo { "forward", TOK_FORWARD }, 3279758b77fSLuigi Rizzo { "skipto", TOK_SKIPTO }, 3289758b77fSLuigi Rizzo { "deny", TOK_DENY }, 3299758b77fSLuigi Rizzo { "drop", TOK_DENY }, 3309758b77fSLuigi Rizzo { "reject", TOK_REJECT }, 3319066356bSBjoern A. Zeeb { "reset6", TOK_RESET6 }, 3329758b77fSLuigi Rizzo { "reset", TOK_RESET }, 3339066356bSBjoern A. Zeeb { "unreach6", TOK_UNREACH6 }, 3345e43aef8SLuigi Rizzo { "unreach", TOK_UNREACH }, 3359758b77fSLuigi Rizzo { "check-state", TOK_CHECKSTATE }, 33662ff38aeSLuigi Rizzo { "//", TOK_COMMENT }, 337571f8c1bSLuigi Rizzo { NULL, 0 } /* terminator */ 3389758b77fSLuigi Rizzo }; 3399758b77fSLuigi Rizzo 340974dfe30SBrian Feldman struct _s_x rule_action_params[] = { 341974dfe30SBrian Feldman { "altq", TOK_ALTQ }, 342974dfe30SBrian Feldman { "log", TOK_LOG }, 343974dfe30SBrian Feldman { NULL, 0 } /* terminator */ 344974dfe30SBrian Feldman }; 345974dfe30SBrian Feldman 3469758b77fSLuigi Rizzo struct _s_x rule_options[] = { 3479758b77fSLuigi Rizzo { "uid", TOK_UID }, 3489758b77fSLuigi Rizzo { "gid", TOK_GID }, 34931c88a30SChristian S.J. Peron { "jail", TOK_JAIL }, 3509758b77fSLuigi Rizzo { "in", TOK_IN }, 3519758b77fSLuigi Rizzo { "limit", TOK_LIMIT }, 3529758b77fSLuigi Rizzo { "keep-state", TOK_KEEPSTATE }, 3539758b77fSLuigi Rizzo { "bridged", TOK_LAYER2 }, 3549758b77fSLuigi Rizzo { "layer2", TOK_LAYER2 }, 3559758b77fSLuigi Rizzo { "out", TOK_OUT }, 3566daf7ebdSBrian Feldman { "diverted", TOK_DIVERTED }, 3576daf7ebdSBrian Feldman { "diverted-loopback", TOK_DIVERTEDLOOPBACK }, 3586daf7ebdSBrian Feldman { "diverted-output", TOK_DIVERTEDOUTPUT }, 3599758b77fSLuigi Rizzo { "xmit", TOK_XMIT }, 3609758b77fSLuigi Rizzo { "recv", TOK_RECV }, 3619758b77fSLuigi Rizzo { "via", TOK_VIA }, 3629758b77fSLuigi Rizzo { "fragment", TOK_FRAG }, 3639758b77fSLuigi Rizzo { "frag", TOK_FRAG }, 3649758b77fSLuigi Rizzo { "ipoptions", TOK_IPOPTS }, 3659758b77fSLuigi Rizzo { "ipopts", TOK_IPOPTS }, 3669758b77fSLuigi Rizzo { "iplen", TOK_IPLEN }, 3679758b77fSLuigi Rizzo { "ipid", TOK_IPID }, 3689758b77fSLuigi Rizzo { "ipprecedence", TOK_IPPRECEDENCE }, 3699758b77fSLuigi Rizzo { "iptos", TOK_IPTOS }, 3709758b77fSLuigi Rizzo { "ipttl", TOK_IPTTL }, 3719758b77fSLuigi Rizzo { "ipversion", TOK_IPVER }, 3729758b77fSLuigi Rizzo { "ipver", TOK_IPVER }, 3739758b77fSLuigi Rizzo { "estab", TOK_ESTAB }, 3749758b77fSLuigi Rizzo { "established", TOK_ESTAB }, 3759758b77fSLuigi Rizzo { "setup", TOK_SETUP }, 376c99ee9e0SBrian Feldman { "tcpdatalen", TOK_TCPDATALEN }, 3779758b77fSLuigi Rizzo { "tcpflags", TOK_TCPFLAGS }, 3789758b77fSLuigi Rizzo { "tcpflgs", TOK_TCPFLAGS }, 3799758b77fSLuigi Rizzo { "tcpoptions", TOK_TCPOPTS }, 3809758b77fSLuigi Rizzo { "tcpopts", TOK_TCPOPTS }, 3819758b77fSLuigi Rizzo { "tcpseq", TOK_TCPSEQ }, 3829758b77fSLuigi Rizzo { "tcpack", TOK_TCPACK }, 3839758b77fSLuigi Rizzo { "tcpwin", TOK_TCPWIN }, 3840a7197a8SLuigi Rizzo { "icmptype", TOK_ICMPTYPES }, 3859758b77fSLuigi Rizzo { "icmptypes", TOK_ICMPTYPES }, 386e706181bSLuigi Rizzo { "dst-ip", TOK_DSTIP }, 387e706181bSLuigi Rizzo { "src-ip", TOK_SRCIP }, 388e706181bSLuigi Rizzo { "dst-port", TOK_DSTPORT }, 389e706181bSLuigi Rizzo { "src-port", TOK_SRCPORT }, 390e706181bSLuigi Rizzo { "proto", TOK_PROTO }, 391e706181bSLuigi Rizzo { "MAC", TOK_MAC }, 392e706181bSLuigi Rizzo { "mac", TOK_MAC }, 393e706181bSLuigi Rizzo { "mac-type", TOK_MACTYPE }, 394010dabb0SCrist J. Clark { "verrevpath", TOK_VERREVPATH }, 39522b5770bSAndre Oppermann { "versrcreach", TOK_VERSRCREACH }, 3965f9541ecSAndre Oppermann { "antispoof", TOK_ANTISPOOF }, 397c3e5b9f1SLuigi Rizzo { "ipsec", TOK_IPSEC }, 3988195404bSBrooks Davis { "icmp6type", TOK_ICMP6TYPES }, 3998195404bSBrooks Davis { "icmp6types", TOK_ICMP6TYPES }, 4008195404bSBrooks Davis { "ext6hdr", TOK_EXT6HDR}, 4018195404bSBrooks Davis { "flow-id", TOK_FLOWID}, 4028195404bSBrooks Davis { "ipv6", TOK_IPV6}, 4038195404bSBrooks Davis { "ip6", TOK_IPV6}, 40457cd6d26SMax Laier { "ipv4", TOK_IPV4}, 40557cd6d26SMax Laier { "ip4", TOK_IPV4}, 4068195404bSBrooks Davis { "dst-ipv6", TOK_DSTIP6}, 4078195404bSBrooks Davis { "dst-ip6", TOK_DSTIP6}, 4088195404bSBrooks Davis { "src-ipv6", TOK_SRCIP6}, 4098195404bSBrooks Davis { "src-ip6", TOK_SRCIP6}, 41062ff38aeSLuigi Rizzo { "//", TOK_COMMENT }, 4119758b77fSLuigi Rizzo 4129758b77fSLuigi Rizzo { "not", TOK_NOT }, /* pseudo option */ 4139758b77fSLuigi Rizzo { "!", /* escape ? */ TOK_NOT }, /* pseudo option */ 4149758b77fSLuigi Rizzo { "or", TOK_OR }, /* pseudo option */ 4159758b77fSLuigi Rizzo { "|", /* escape */ TOK_OR }, /* pseudo option */ 4168ed2d749SLuigi Rizzo { "{", TOK_STARTBRACE }, /* pseudo option */ 4178ed2d749SLuigi Rizzo { "(", TOK_STARTBRACE }, /* pseudo option */ 4188ed2d749SLuigi Rizzo { "}", TOK_ENDBRACE }, /* pseudo option */ 4198ed2d749SLuigi Rizzo { ")", TOK_ENDBRACE }, /* pseudo option */ 420571f8c1bSLuigi Rizzo { NULL, 0 } /* terminator */ 4219758b77fSLuigi Rizzo }; 4229758b77fSLuigi Rizzo 42340b1ae9eSGleb Smirnoff #define TABLEARG "tablearg" 42440b1ae9eSGleb Smirnoff 425571f8c1bSLuigi Rizzo static __inline uint64_t 426571f8c1bSLuigi Rizzo align_uint64(uint64_t *pll) { 427571f8c1bSLuigi Rizzo uint64_t ret; 428330462a3SBernd Walter 429330462a3SBernd Walter bcopy (pll, &ret, sizeof(ret)); 430330462a3SBernd Walter return ret; 431c85c1d27SStefan Farfeleder } 432330462a3SBernd Walter 433571f8c1bSLuigi Rizzo /* 434571f8c1bSLuigi Rizzo * conditionally runs the command. 435571f8c1bSLuigi Rizzo */ 43662ff38aeSLuigi Rizzo static int 437884be75cSThomas Moestl do_cmd(int optname, void *optval, uintptr_t optlen) 438571f8c1bSLuigi Rizzo { 439571f8c1bSLuigi Rizzo static int s = -1; /* the socket */ 440571f8c1bSLuigi Rizzo int i; 441571f8c1bSLuigi Rizzo 442571f8c1bSLuigi Rizzo if (test_only) 443571f8c1bSLuigi Rizzo return 0; 444571f8c1bSLuigi Rizzo 445571f8c1bSLuigi Rizzo if (s == -1) 446571f8c1bSLuigi Rizzo s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 447571f8c1bSLuigi Rizzo if (s < 0) 448571f8c1bSLuigi Rizzo err(EX_UNAVAILABLE, "socket"); 449571f8c1bSLuigi Rizzo 450571f8c1bSLuigi Rizzo if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET || 451cd8b5ae0SRuslan Ermilov optname == IP_FW_ADD || optname == IP_FW_TABLE_LIST || 452cd8b5ae0SRuslan Ermilov optname == IP_FW_TABLE_GETSIZE) 453571f8c1bSLuigi Rizzo i = getsockopt(s, IPPROTO_IP, optname, optval, 454571f8c1bSLuigi Rizzo (socklen_t *)optlen); 455571f8c1bSLuigi Rizzo else 456571f8c1bSLuigi Rizzo i = setsockopt(s, IPPROTO_IP, optname, optval, optlen); 457571f8c1bSLuigi Rizzo return i; 458571f8c1bSLuigi Rizzo } 459571f8c1bSLuigi Rizzo 4609758b77fSLuigi Rizzo /** 4619758b77fSLuigi Rizzo * match_token takes a table and a string, returns the value associated 462571f8c1bSLuigi Rizzo * with the string (-1 in case of failure). 4639758b77fSLuigi Rizzo */ 4649758b77fSLuigi Rizzo static int 4659758b77fSLuigi Rizzo match_token(struct _s_x *table, char *string) 4669758b77fSLuigi Rizzo { 4679758b77fSLuigi Rizzo struct _s_x *pt; 46862ff38aeSLuigi Rizzo uint i = strlen(string); 4699758b77fSLuigi Rizzo 4709758b77fSLuigi Rizzo for (pt = table ; i && pt->s != NULL ; pt++) 4719758b77fSLuigi Rizzo if (strlen(pt->s) == i && !bcmp(string, pt->s, i)) 4729758b77fSLuigi Rizzo return pt->x; 4739758b77fSLuigi Rizzo return -1; 474c85c1d27SStefan Farfeleder } 4759758b77fSLuigi Rizzo 476571f8c1bSLuigi Rizzo /** 477571f8c1bSLuigi Rizzo * match_value takes a table and a value, returns the string associated 478571f8c1bSLuigi Rizzo * with the value (NULL in case of failure). 479571f8c1bSLuigi Rizzo */ 48062ff38aeSLuigi Rizzo static char const * 48162ff38aeSLuigi Rizzo match_value(struct _s_x *p, int value) 4829758b77fSLuigi Rizzo { 4839758b77fSLuigi Rizzo for (; p->s != NULL; p++) 4849758b77fSLuigi Rizzo if (p->x == value) 4859758b77fSLuigi Rizzo return p->s; 4869758b77fSLuigi Rizzo return NULL; 4879758b77fSLuigi Rizzo } 4889758b77fSLuigi Rizzo 4899758b77fSLuigi Rizzo /* 49001750186SBrooks Davis * _substrcmp takes two strings and returns 1 if they do not match, 49101750186SBrooks Davis * and 0 if they match exactly or the first string is a sub-string 49201750186SBrooks Davis * of the second. A warning is printed to stderr in the case that the 49301750186SBrooks Davis * first string is a sub-string of the second. 49401750186SBrooks Davis * 49501750186SBrooks Davis * This function will be removed in the future through the usual 49601750186SBrooks Davis * deprecation process. 49701750186SBrooks Davis */ 49801750186SBrooks Davis static int 49901750186SBrooks Davis _substrcmp(const char *str1, const char* str2) 50001750186SBrooks Davis { 50101750186SBrooks Davis 50201750186SBrooks Davis if (strncmp(str1, str2, strlen(str1)) != 0) 50301750186SBrooks Davis return 1; 50401750186SBrooks Davis 50501750186SBrooks Davis if (strlen(str1) != strlen(str2)) 50601750186SBrooks Davis warnx("DEPRECATED: '%s' matched '%s' as a sub-string", 50701750186SBrooks Davis str1, str2); 50801750186SBrooks Davis return 0; 50901750186SBrooks Davis } 51001750186SBrooks Davis 51101750186SBrooks Davis /* 51201750186SBrooks Davis * _substrcmp2 takes three strings and returns 1 if the first two do not match, 51301750186SBrooks Davis * and 0 if they match exactly or the second string is a sub-string 51401750186SBrooks Davis * of the first. A warning is printed to stderr in the case that the 51501750186SBrooks Davis * first string does not match the third. 51601750186SBrooks Davis * 51701750186SBrooks Davis * This function exists to warn about the bizzare construction 51801750186SBrooks Davis * strncmp(str, "by", 2) which is used to allow people to use a shotcut 51901750186SBrooks Davis * for "bytes". The problem is that in addition to accepting "by", 52001750186SBrooks Davis * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any 52101750186SBrooks Davis * other string beginning with "by". 52201750186SBrooks Davis * 52301750186SBrooks Davis * This function will be removed in the future through the usual 52401750186SBrooks Davis * deprecation process. 52501750186SBrooks Davis */ 52601750186SBrooks Davis static int 52701750186SBrooks Davis _substrcmp2(const char *str1, const char* str2, const char* str3) 52801750186SBrooks Davis { 52901750186SBrooks Davis 53001750186SBrooks Davis if (strncmp(str1, str2, strlen(str2)) != 0) 53101750186SBrooks Davis return 1; 53201750186SBrooks Davis 53301750186SBrooks Davis if (strcmp(str1, str3) != 0) 53401750186SBrooks Davis warnx("DEPRECATED: '%s' matched '%s'", 53501750186SBrooks Davis str1, str3); 53601750186SBrooks Davis return 0; 53701750186SBrooks Davis } 53801750186SBrooks Davis 53901750186SBrooks Davis /* 5409758b77fSLuigi Rizzo * prints one port, symbolic or numeric 5419758b77fSLuigi Rizzo */ 5429758b77fSLuigi Rizzo static void 543571f8c1bSLuigi Rizzo print_port(int proto, uint16_t port) 5449758b77fSLuigi Rizzo { 5459758b77fSLuigi Rizzo 5469758b77fSLuigi Rizzo if (proto == IPPROTO_ETHERTYPE) { 54762ff38aeSLuigi Rizzo char const *s; 5489758b77fSLuigi Rizzo 5499758b77fSLuigi Rizzo if (do_resolv && (s = match_value(ether_types, port)) ) 5509758b77fSLuigi Rizzo printf("%s", s); 5519758b77fSLuigi Rizzo else 5529758b77fSLuigi Rizzo printf("0x%04x", port); 5539758b77fSLuigi Rizzo } else { 5549758b77fSLuigi Rizzo struct servent *se = NULL; 5559758b77fSLuigi Rizzo if (do_resolv) { 5569758b77fSLuigi Rizzo struct protoent *pe = getprotobynumber(proto); 5579758b77fSLuigi Rizzo 5589758b77fSLuigi Rizzo se = getservbyport(htons(port), pe ? pe->p_name : NULL); 5599758b77fSLuigi Rizzo } 5609758b77fSLuigi Rizzo if (se) 5619758b77fSLuigi Rizzo printf("%s", se->s_name); 5629758b77fSLuigi Rizzo else 5639758b77fSLuigi Rizzo printf("%d", port); 5649758b77fSLuigi Rizzo } 5659758b77fSLuigi Rizzo } 5669758b77fSLuigi Rizzo 567571f8c1bSLuigi Rizzo struct _s_x _port_name[] = { 568571f8c1bSLuigi Rizzo {"dst-port", O_IP_DSTPORT}, 569571f8c1bSLuigi Rizzo {"src-port", O_IP_SRCPORT}, 570571f8c1bSLuigi Rizzo {"ipid", O_IPID}, 571571f8c1bSLuigi Rizzo {"iplen", O_IPLEN}, 572571f8c1bSLuigi Rizzo {"ipttl", O_IPTTL}, 573571f8c1bSLuigi Rizzo {"mac-type", O_MAC_TYPE}, 574c99ee9e0SBrian Feldman {"tcpdatalen", O_TCPDATALEN}, 575571f8c1bSLuigi Rizzo {NULL, 0} 576571f8c1bSLuigi Rizzo }; 577571f8c1bSLuigi Rizzo 5789758b77fSLuigi Rizzo /* 579571f8c1bSLuigi Rizzo * Print the values in a list 16-bit items of the types above. 5809758b77fSLuigi Rizzo * XXX todo: add support for mask. 5819758b77fSLuigi Rizzo */ 5829758b77fSLuigi Rizzo static void 583e706181bSLuigi Rizzo print_newports(ipfw_insn_u16 *cmd, int proto, int opcode) 5849758b77fSLuigi Rizzo { 585571f8c1bSLuigi Rizzo uint16_t *p = cmd->ports; 5869758b77fSLuigi Rizzo int i; 58762ff38aeSLuigi Rizzo char const *sep; 5889758b77fSLuigi Rizzo 5899758b77fSLuigi Rizzo if (cmd->o.len & F_NOT) 5909758b77fSLuigi Rizzo printf(" not"); 59144c884e1SLuigi Rizzo if (opcode != 0) { 592571f8c1bSLuigi Rizzo sep = match_value(_port_name, opcode); 593571f8c1bSLuigi Rizzo if (sep == NULL) 59444c884e1SLuigi Rizzo sep = "???"; 59544c884e1SLuigi Rizzo printf (" %s", sep); 59644c884e1SLuigi Rizzo } 59744c884e1SLuigi Rizzo sep = " "; 5989758b77fSLuigi Rizzo for (i = F_LEN((ipfw_insn *)cmd) - 1; i > 0; i--, p += 2) { 5999758b77fSLuigi Rizzo printf(sep); 6009758b77fSLuigi Rizzo print_port(proto, p[0]); 6019758b77fSLuigi Rizzo if (p[0] != p[1]) { 6029758b77fSLuigi Rizzo printf("-"); 6039758b77fSLuigi Rizzo print_port(proto, p[1]); 6049758b77fSLuigi Rizzo } 6059758b77fSLuigi Rizzo sep = ","; 6069758b77fSLuigi Rizzo } 6079758b77fSLuigi Rizzo } 6089758b77fSLuigi Rizzo 6099758b77fSLuigi Rizzo /* 6109758b77fSLuigi Rizzo * Like strtol, but also translates service names into port numbers 6119758b77fSLuigi Rizzo * for some protocols. 6129758b77fSLuigi Rizzo * In particular: 6139758b77fSLuigi Rizzo * proto == -1 disables the protocol check; 6149758b77fSLuigi Rizzo * proto == IPPROTO_ETHERTYPE looks up an internal table 6159758b77fSLuigi Rizzo * proto == <some value in /etc/protocols> matches the values there. 61643405724SLuigi Rizzo * Returns *end == s in case the parameter is not found. 6179758b77fSLuigi Rizzo */ 6189758b77fSLuigi Rizzo static int 6199758b77fSLuigi Rizzo strtoport(char *s, char **end, int base, int proto) 6209758b77fSLuigi Rizzo { 62143405724SLuigi Rizzo char *p, *buf; 62243405724SLuigi Rizzo char *s1; 6239758b77fSLuigi Rizzo int i; 6249758b77fSLuigi Rizzo 62543405724SLuigi Rizzo *end = s; /* default - not found */ 6269758b77fSLuigi Rizzo if (*s == '\0') 62743405724SLuigi Rizzo return 0; /* not found */ 6289758b77fSLuigi Rizzo 6299758b77fSLuigi Rizzo if (isdigit(*s)) 6309758b77fSLuigi Rizzo return strtol(s, end, base); 6319758b77fSLuigi Rizzo 6329758b77fSLuigi Rizzo /* 63343405724SLuigi Rizzo * find separator. '\\' escapes the next char. 6349758b77fSLuigi Rizzo */ 63543405724SLuigi Rizzo for (s1 = s; *s1 && (isalnum(*s1) || *s1 == '\\') ; s1++) 63643405724SLuigi Rizzo if (*s1 == '\\' && s1[1] != '\0') 63743405724SLuigi Rizzo s1++; 63843405724SLuigi Rizzo 63943405724SLuigi Rizzo buf = malloc(s1 - s + 1); 64043405724SLuigi Rizzo if (buf == NULL) 64143405724SLuigi Rizzo return 0; 64243405724SLuigi Rizzo 64343405724SLuigi Rizzo /* 64443405724SLuigi Rizzo * copy into a buffer skipping backslashes 64543405724SLuigi Rizzo */ 64643405724SLuigi Rizzo for (p = s, i = 0; p != s1 ; p++) 64743405724SLuigi Rizzo if (*p != '\\') 64843405724SLuigi Rizzo buf[i++] = *p; 64943405724SLuigi Rizzo buf[i++] = '\0'; 6509758b77fSLuigi Rizzo 6519758b77fSLuigi Rizzo if (proto == IPPROTO_ETHERTYPE) { 65243405724SLuigi Rizzo i = match_token(ether_types, buf); 65343405724SLuigi Rizzo free(buf); 65443405724SLuigi Rizzo if (i != -1) { /* found */ 6559758b77fSLuigi Rizzo *end = s1; 6569758b77fSLuigi Rizzo return i; 6579758b77fSLuigi Rizzo } 6589758b77fSLuigi Rizzo } else { 6599758b77fSLuigi Rizzo struct protoent *pe = NULL; 6609758b77fSLuigi Rizzo struct servent *se; 6619758b77fSLuigi Rizzo 6629758b77fSLuigi Rizzo if (proto != 0) 6639758b77fSLuigi Rizzo pe = getprotobynumber(proto); 6649758b77fSLuigi Rizzo setservent(1); 66543405724SLuigi Rizzo se = getservbyname(buf, pe ? pe->p_name : NULL); 66643405724SLuigi Rizzo free(buf); 6679758b77fSLuigi Rizzo if (se != NULL) { 6689758b77fSLuigi Rizzo *end = s1; 6699758b77fSLuigi Rizzo return ntohs(se->s_port); 6709758b77fSLuigi Rizzo } 6719758b77fSLuigi Rizzo } 67243405724SLuigi Rizzo return 0; /* not found */ 6739758b77fSLuigi Rizzo } 6749758b77fSLuigi Rizzo 6759758b77fSLuigi Rizzo /* 676974dfe30SBrian Feldman * Map between current altq queue id numbers and names. 677974dfe30SBrian Feldman */ 678974dfe30SBrian Feldman static int altq_fetched = 0; 679974dfe30SBrian Feldman static TAILQ_HEAD(, pf_altq) altq_entries = 680974dfe30SBrian Feldman TAILQ_HEAD_INITIALIZER(altq_entries); 681974dfe30SBrian Feldman 682974dfe30SBrian Feldman static void 683974dfe30SBrian Feldman altq_set_enabled(int enabled) 684974dfe30SBrian Feldman { 685974dfe30SBrian Feldman int pffd; 686974dfe30SBrian Feldman 687974dfe30SBrian Feldman pffd = open("/dev/pf", O_RDWR); 688974dfe30SBrian Feldman if (pffd == -1) 689974dfe30SBrian Feldman err(EX_UNAVAILABLE, 690974dfe30SBrian Feldman "altq support opening pf(4) control device"); 691974dfe30SBrian Feldman if (enabled) { 692974dfe30SBrian Feldman if (ioctl(pffd, DIOCSTARTALTQ) != 0 && errno != EEXIST) 693974dfe30SBrian Feldman err(EX_UNAVAILABLE, "enabling altq"); 694974dfe30SBrian Feldman } else { 695974dfe30SBrian Feldman if (ioctl(pffd, DIOCSTOPALTQ) != 0 && errno != ENOENT) 696974dfe30SBrian Feldman err(EX_UNAVAILABLE, "disabling altq"); 697974dfe30SBrian Feldman } 698974dfe30SBrian Feldman close(pffd); 699974dfe30SBrian Feldman } 700974dfe30SBrian Feldman 701974dfe30SBrian Feldman static void 702974dfe30SBrian Feldman altq_fetch() 703974dfe30SBrian Feldman { 704974dfe30SBrian Feldman struct pfioc_altq pfioc; 705974dfe30SBrian Feldman struct pf_altq *altq; 706974dfe30SBrian Feldman int pffd, mnr; 707974dfe30SBrian Feldman 708974dfe30SBrian Feldman if (altq_fetched) 709974dfe30SBrian Feldman return; 710974dfe30SBrian Feldman altq_fetched = 1; 711974dfe30SBrian Feldman pffd = open("/dev/pf", O_RDONLY); 712974dfe30SBrian Feldman if (pffd == -1) { 713974dfe30SBrian Feldman warn("altq support opening pf(4) control device"); 714974dfe30SBrian Feldman return; 715974dfe30SBrian Feldman } 716974dfe30SBrian Feldman bzero(&pfioc, sizeof(pfioc)); 717974dfe30SBrian Feldman if (ioctl(pffd, DIOCGETALTQS, &pfioc) != 0) { 718974dfe30SBrian Feldman warn("altq support getting queue list"); 719974dfe30SBrian Feldman close(pffd); 720974dfe30SBrian Feldman return; 721974dfe30SBrian Feldman } 722974dfe30SBrian Feldman mnr = pfioc.nr; 723974dfe30SBrian Feldman for (pfioc.nr = 0; pfioc.nr < mnr; pfioc.nr++) { 724974dfe30SBrian Feldman if (ioctl(pffd, DIOCGETALTQ, &pfioc) != 0) { 725974dfe30SBrian Feldman if (errno == EBUSY) 726974dfe30SBrian Feldman break; 727974dfe30SBrian Feldman warn("altq support getting queue list"); 728974dfe30SBrian Feldman close(pffd); 729974dfe30SBrian Feldman return; 730974dfe30SBrian Feldman } 731974dfe30SBrian Feldman if (pfioc.altq.qid == 0) 732974dfe30SBrian Feldman continue; 733974dfe30SBrian Feldman altq = malloc(sizeof(*altq)); 734974dfe30SBrian Feldman if (altq == NULL) 735974dfe30SBrian Feldman err(EX_OSERR, "malloc"); 736974dfe30SBrian Feldman *altq = pfioc.altq; 737974dfe30SBrian Feldman TAILQ_INSERT_TAIL(&altq_entries, altq, entries); 738974dfe30SBrian Feldman } 739974dfe30SBrian Feldman close(pffd); 740974dfe30SBrian Feldman } 741974dfe30SBrian Feldman 742974dfe30SBrian Feldman static u_int32_t 743974dfe30SBrian Feldman altq_name_to_qid(const char *name) 744974dfe30SBrian Feldman { 745974dfe30SBrian Feldman struct pf_altq *altq; 746974dfe30SBrian Feldman 747974dfe30SBrian Feldman altq_fetch(); 748974dfe30SBrian Feldman TAILQ_FOREACH(altq, &altq_entries, entries) 749974dfe30SBrian Feldman if (strcmp(name, altq->qname) == 0) 750974dfe30SBrian Feldman break; 751974dfe30SBrian Feldman if (altq == NULL) 752974dfe30SBrian Feldman errx(EX_DATAERR, "altq has no queue named `%s'", name); 753974dfe30SBrian Feldman return altq->qid; 754974dfe30SBrian Feldman } 755974dfe30SBrian Feldman 756974dfe30SBrian Feldman static const char * 757974dfe30SBrian Feldman altq_qid_to_name(u_int32_t qid) 758974dfe30SBrian Feldman { 759974dfe30SBrian Feldman struct pf_altq *altq; 760974dfe30SBrian Feldman 761974dfe30SBrian Feldman altq_fetch(); 762974dfe30SBrian Feldman TAILQ_FOREACH(altq, &altq_entries, entries) 763974dfe30SBrian Feldman if (qid == altq->qid) 764974dfe30SBrian Feldman break; 765974dfe30SBrian Feldman if (altq == NULL) 766974dfe30SBrian Feldman return NULL; 767974dfe30SBrian Feldman return altq->qname; 768974dfe30SBrian Feldman } 769974dfe30SBrian Feldman 770974dfe30SBrian Feldman static void 771974dfe30SBrian Feldman fill_altq_qid(u_int32_t *qid, const char *av) 772974dfe30SBrian Feldman { 773974dfe30SBrian Feldman *qid = altq_name_to_qid(av); 774974dfe30SBrian Feldman } 775974dfe30SBrian Feldman 776974dfe30SBrian Feldman /* 777571f8c1bSLuigi Rizzo * Fill the body of the command with the list of port ranges. 7789758b77fSLuigi Rizzo */ 7799758b77fSLuigi Rizzo static int 7809758b77fSLuigi Rizzo fill_newports(ipfw_insn_u16 *cmd, char *av, int proto) 7819758b77fSLuigi Rizzo { 782571f8c1bSLuigi Rizzo uint16_t a, b, *p = cmd->ports; 7839758b77fSLuigi Rizzo int i = 0; 784e706181bSLuigi Rizzo char *s = av; 7859758b77fSLuigi Rizzo 786e706181bSLuigi Rizzo while (*s) { 7879758b77fSLuigi Rizzo a = strtoport(av, &s, 0, proto); 7889758b77fSLuigi Rizzo if (s == av) /* no parameter */ 7899758b77fSLuigi Rizzo break; 7909758b77fSLuigi Rizzo if (*s == '-') { /* a range */ 7919758b77fSLuigi Rizzo av = s+1; 7929758b77fSLuigi Rizzo b = strtoport(av, &s, 0, proto); 7939758b77fSLuigi Rizzo if (s == av) /* no parameter */ 7949758b77fSLuigi Rizzo break; 7959758b77fSLuigi Rizzo p[0] = a; 7969758b77fSLuigi Rizzo p[1] = b; 797571f8c1bSLuigi Rizzo } else if (*s == ',' || *s == '\0' ) 7989758b77fSLuigi Rizzo p[0] = p[1] = a; 799571f8c1bSLuigi Rizzo else /* invalid separator */ 80099e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid separator <%c> in <%s>\n", 80199e5e645SLuigi Rizzo *s, av); 802e706181bSLuigi Rizzo i++; 803e706181bSLuigi Rizzo p += 2; 8049758b77fSLuigi Rizzo av = s+1; 8059758b77fSLuigi Rizzo } 8069758b77fSLuigi Rizzo if (i > 0) { 8079758b77fSLuigi Rizzo if (i+1 > F_LEN_MASK) 808e706181bSLuigi Rizzo errx(EX_DATAERR, "too many ports/ranges\n"); 8099758b77fSLuigi Rizzo cmd->o.len |= i+1; /* leave F_NOT and F_OR untouched */ 8109758b77fSLuigi Rizzo } 8119758b77fSLuigi Rizzo return i; 8129758b77fSLuigi Rizzo } 8139758b77fSLuigi Rizzo 8149758b77fSLuigi Rizzo static struct _s_x icmpcodes[] = { 8159758b77fSLuigi Rizzo { "net", ICMP_UNREACH_NET }, 8169758b77fSLuigi Rizzo { "host", ICMP_UNREACH_HOST }, 8179758b77fSLuigi Rizzo { "protocol", ICMP_UNREACH_PROTOCOL }, 8189758b77fSLuigi Rizzo { "port", ICMP_UNREACH_PORT }, 8199758b77fSLuigi Rizzo { "needfrag", ICMP_UNREACH_NEEDFRAG }, 8209758b77fSLuigi Rizzo { "srcfail", ICMP_UNREACH_SRCFAIL }, 8219758b77fSLuigi Rizzo { "net-unknown", ICMP_UNREACH_NET_UNKNOWN }, 8229758b77fSLuigi Rizzo { "host-unknown", ICMP_UNREACH_HOST_UNKNOWN }, 8239758b77fSLuigi Rizzo { "isolated", ICMP_UNREACH_ISOLATED }, 8249758b77fSLuigi Rizzo { "net-prohib", ICMP_UNREACH_NET_PROHIB }, 8259758b77fSLuigi Rizzo { "host-prohib", ICMP_UNREACH_HOST_PROHIB }, 8269758b77fSLuigi Rizzo { "tosnet", ICMP_UNREACH_TOSNET }, 8279758b77fSLuigi Rizzo { "toshost", ICMP_UNREACH_TOSHOST }, 8289758b77fSLuigi Rizzo { "filter-prohib", ICMP_UNREACH_FILTER_PROHIB }, 8299758b77fSLuigi Rizzo { "host-precedence", ICMP_UNREACH_HOST_PRECEDENCE }, 8309758b77fSLuigi Rizzo { "precedence-cutoff", ICMP_UNREACH_PRECEDENCE_CUTOFF }, 8319758b77fSLuigi Rizzo { NULL, 0 } 8329758b77fSLuigi Rizzo }; 8339758b77fSLuigi Rizzo 8349758b77fSLuigi Rizzo static void 8359758b77fSLuigi Rizzo fill_reject_code(u_short *codep, char *str) 8369758b77fSLuigi Rizzo { 8379758b77fSLuigi Rizzo int val; 8389758b77fSLuigi Rizzo char *s; 8399758b77fSLuigi Rizzo 8409758b77fSLuigi Rizzo val = strtoul(str, &s, 0); 8419758b77fSLuigi Rizzo if (s == str || *s != '\0' || val >= 0x100) 8429758b77fSLuigi Rizzo val = match_token(icmpcodes, str); 843e706181bSLuigi Rizzo if (val < 0) 8449758b77fSLuigi Rizzo errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str); 8459758b77fSLuigi Rizzo *codep = val; 8469758b77fSLuigi Rizzo return; 8479758b77fSLuigi Rizzo } 8489758b77fSLuigi Rizzo 8499758b77fSLuigi Rizzo static void 850571f8c1bSLuigi Rizzo print_reject_code(uint16_t code) 8519758b77fSLuigi Rizzo { 85262ff38aeSLuigi Rizzo char const *s = match_value(icmpcodes, code); 8539758b77fSLuigi Rizzo 8549758b77fSLuigi Rizzo if (s != NULL) 8555e43aef8SLuigi Rizzo printf("unreach %s", s); 8569758b77fSLuigi Rizzo else 8575e43aef8SLuigi Rizzo printf("unreach %u", code); 8589758b77fSLuigi Rizzo } 8599758b77fSLuigi Rizzo 8609066356bSBjoern A. Zeeb static struct _s_x icmp6codes[] = { 8619066356bSBjoern A. Zeeb { "no-route", ICMP6_DST_UNREACH_NOROUTE }, 8629066356bSBjoern A. Zeeb { "admin-prohib", ICMP6_DST_UNREACH_ADMIN }, 8639066356bSBjoern A. Zeeb { "address", ICMP6_DST_UNREACH_ADDR }, 8649066356bSBjoern A. Zeeb { "port", ICMP6_DST_UNREACH_NOPORT }, 8659066356bSBjoern A. Zeeb { NULL, 0 } 8669066356bSBjoern A. Zeeb }; 8679066356bSBjoern A. Zeeb 8689066356bSBjoern A. Zeeb static void 8699066356bSBjoern A. Zeeb fill_unreach6_code(u_short *codep, char *str) 8709066356bSBjoern A. Zeeb { 8719066356bSBjoern A. Zeeb int val; 8729066356bSBjoern A. Zeeb char *s; 8739066356bSBjoern A. Zeeb 8749066356bSBjoern A. Zeeb val = strtoul(str, &s, 0); 8759066356bSBjoern A. Zeeb if (s == str || *s != '\0' || val >= 0x100) 8769066356bSBjoern A. Zeeb val = match_token(icmp6codes, str); 8779066356bSBjoern A. Zeeb if (val < 0) 8789066356bSBjoern A. Zeeb errx(EX_DATAERR, "unknown ICMPv6 unreachable code ``%s''", str); 8799066356bSBjoern A. Zeeb *codep = val; 8809066356bSBjoern A. Zeeb return; 8819066356bSBjoern A. Zeeb } 8829066356bSBjoern A. Zeeb 8839066356bSBjoern A. Zeeb static void 8849066356bSBjoern A. Zeeb print_unreach6_code(uint16_t code) 8859066356bSBjoern A. Zeeb { 8869066356bSBjoern A. Zeeb char const *s = match_value(icmp6codes, code); 8879066356bSBjoern A. Zeeb 8889066356bSBjoern A. Zeeb if (s != NULL) 8899066356bSBjoern A. Zeeb printf("unreach6 %s", s); 8909066356bSBjoern A. Zeeb else 8919066356bSBjoern A. Zeeb printf("unreach6 %u", code); 8929066356bSBjoern A. Zeeb } 8939066356bSBjoern A. Zeeb 8949758b77fSLuigi Rizzo /* 8959758b77fSLuigi Rizzo * Returns the number of bits set (from left) in a contiguous bitmask, 8969758b77fSLuigi Rizzo * or -1 if the mask is not contiguous. 8979758b77fSLuigi Rizzo * XXX this needs a proper fix. 8989758b77fSLuigi Rizzo * This effectively works on masks in big-endian (network) format. 8999758b77fSLuigi Rizzo * when compiled on little endian architectures. 9009758b77fSLuigi Rizzo * 9019758b77fSLuigi Rizzo * First bit is bit 7 of the first byte -- note, for MAC addresses, 9029758b77fSLuigi Rizzo * the first bit on the wire is bit 0 of the first byte. 9039758b77fSLuigi Rizzo * len is the max length in bits. 9049758b77fSLuigi Rizzo */ 9059758b77fSLuigi Rizzo static int 906f3a126d3SLuigi Rizzo contigmask(uint8_t *p, int len) 9079758b77fSLuigi Rizzo { 9089758b77fSLuigi Rizzo int i, n; 909f3a126d3SLuigi Rizzo 9109758b77fSLuigi Rizzo for (i=0; i<len ; i++) 9119758b77fSLuigi Rizzo if ( (p[i/8] & (1 << (7 - (i%8)))) == 0) /* first bit unset */ 9129758b77fSLuigi Rizzo break; 9139758b77fSLuigi Rizzo for (n=i+1; n < len; n++) 9149758b77fSLuigi Rizzo if ( (p[n/8] & (1 << (7 - (n%8)))) != 0) 9159758b77fSLuigi Rizzo return -1; /* mask not contiguous */ 9169758b77fSLuigi Rizzo return i; 9179758b77fSLuigi Rizzo } 9189758b77fSLuigi Rizzo 9199758b77fSLuigi Rizzo /* 9209758b77fSLuigi Rizzo * print flags set/clear in the two bitmasks passed as parameters. 9219758b77fSLuigi Rizzo * There is a specialized check for f_tcpflags. 9229758b77fSLuigi Rizzo */ 9239758b77fSLuigi Rizzo static void 92462ff38aeSLuigi Rizzo print_flags(char const *name, ipfw_insn *cmd, struct _s_x *list) 9259758b77fSLuigi Rizzo { 92662ff38aeSLuigi Rizzo char const *comma = ""; 9279758b77fSLuigi Rizzo int i; 928f3a126d3SLuigi Rizzo uint8_t set = cmd->arg1 & 0xff; 929f3a126d3SLuigi Rizzo uint8_t clear = (cmd->arg1 >> 8) & 0xff; 9309758b77fSLuigi Rizzo 9319758b77fSLuigi Rizzo if (list == f_tcpflags && set == TH_SYN && clear == TH_ACK) { 9329758b77fSLuigi Rizzo printf(" setup"); 9339758b77fSLuigi Rizzo return; 9349758b77fSLuigi Rizzo } 9359758b77fSLuigi Rizzo 9369758b77fSLuigi Rizzo printf(" %s ", name); 9379758b77fSLuigi Rizzo for (i=0; list[i].x != 0; i++) { 9389758b77fSLuigi Rizzo if (set & list[i].x) { 9399758b77fSLuigi Rizzo set &= ~list[i].x; 9409758b77fSLuigi Rizzo printf("%s%s", comma, list[i].s); 9419758b77fSLuigi Rizzo comma = ","; 9429758b77fSLuigi Rizzo } 9439758b77fSLuigi Rizzo if (clear & list[i].x) { 9449758b77fSLuigi Rizzo clear &= ~list[i].x; 9459758b77fSLuigi Rizzo printf("%s!%s", comma, list[i].s); 9469758b77fSLuigi Rizzo comma = ","; 9479758b77fSLuigi Rizzo } 9489758b77fSLuigi Rizzo } 9499758b77fSLuigi Rizzo } 9509758b77fSLuigi Rizzo 9519758b77fSLuigi Rizzo /* 9529758b77fSLuigi Rizzo * Print the ip address contained in a command. 9539758b77fSLuigi Rizzo */ 9549758b77fSLuigi Rizzo static void 95562ff38aeSLuigi Rizzo print_ip(ipfw_insn_ip *cmd, char const *s) 9569758b77fSLuigi Rizzo { 9579758b77fSLuigi Rizzo struct hostent *he = NULL; 958571f8c1bSLuigi Rizzo int len = F_LEN((ipfw_insn *)cmd); 959571f8c1bSLuigi Rizzo uint32_t *a = ((ipfw_insn_u32 *)cmd)->d; 9609758b77fSLuigi Rizzo 961e706181bSLuigi Rizzo printf("%s%s ", cmd->o.len & F_NOT ? " not": "", s); 9629758b77fSLuigi Rizzo 9639758b77fSLuigi Rizzo if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) { 9649758b77fSLuigi Rizzo printf("me"); 9659758b77fSLuigi Rizzo return; 9669758b77fSLuigi Rizzo } 967cd8b5ae0SRuslan Ermilov if (cmd->o.opcode == O_IP_SRC_LOOKUP || 968cd8b5ae0SRuslan Ermilov cmd->o.opcode == O_IP_DST_LOOKUP) { 969cd8b5ae0SRuslan Ermilov printf("table(%u", ((ipfw_insn *)cmd)->arg1); 970cd8b5ae0SRuslan Ermilov if (len == F_INSN_SIZE(ipfw_insn_u32)) 971cd8b5ae0SRuslan Ermilov printf(",%u", *a); 972cd8b5ae0SRuslan Ermilov printf(")"); 973cd8b5ae0SRuslan Ermilov return; 974cd8b5ae0SRuslan Ermilov } 9759758b77fSLuigi Rizzo if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) { 976571f8c1bSLuigi Rizzo uint32_t x, *map = (uint32_t *)&(cmd->mask); 9779ef3f16dSLuigi Rizzo int i, j; 9789758b77fSLuigi Rizzo char comma = '{'; 9799758b77fSLuigi Rizzo 9809758b77fSLuigi Rizzo x = cmd->o.arg1 - 1; 9819758b77fSLuigi Rizzo x = htonl( ~x ); 9829758b77fSLuigi Rizzo cmd->addr.s_addr = htonl(cmd->addr.s_addr); 9839758b77fSLuigi Rizzo printf("%s/%d", inet_ntoa(cmd->addr), 984f3a126d3SLuigi Rizzo contigmask((uint8_t *)&x, 32)); 9859758b77fSLuigi Rizzo x = cmd->addr.s_addr = htonl(cmd->addr.s_addr); 9869758b77fSLuigi Rizzo x &= 0xff; /* base */ 9879ef3f16dSLuigi Rizzo /* 9889ef3f16dSLuigi Rizzo * Print bits and ranges. 9899ef3f16dSLuigi Rizzo * Locate first bit set (i), then locate first bit unset (j). 9909ef3f16dSLuigi Rizzo * If we have 3+ consecutive bits set, then print them as a 9919ef3f16dSLuigi Rizzo * range, otherwise only print the initial bit and rescan. 9929ef3f16dSLuigi Rizzo */ 9939758b77fSLuigi Rizzo for (i=0; i < cmd->o.arg1; i++) 994571f8c1bSLuigi Rizzo if (map[i/32] & (1<<(i & 31))) { 9959ef3f16dSLuigi Rizzo for (j=i+1; j < cmd->o.arg1; j++) 996571f8c1bSLuigi Rizzo if (!(map[ j/32] & (1<<(j & 31)))) 9979ef3f16dSLuigi Rizzo break; 9989758b77fSLuigi Rizzo printf("%c%d", comma, i+x); 9999ef3f16dSLuigi Rizzo if (j>i+2) { /* range has at least 3 elements */ 10009ef3f16dSLuigi Rizzo printf("-%d", j-1+x); 10019ef3f16dSLuigi Rizzo i = j-1; 10029ef3f16dSLuigi Rizzo } 10039758b77fSLuigi Rizzo comma = ','; 10049758b77fSLuigi Rizzo } 10059758b77fSLuigi Rizzo printf("}"); 10069758b77fSLuigi Rizzo return; 10079758b77fSLuigi Rizzo } 1008571f8c1bSLuigi Rizzo /* 1009571f8c1bSLuigi Rizzo * len == 2 indicates a single IP, whereas lists of 1 or more 1010571f8c1bSLuigi Rizzo * addr/mask pairs have len = (2n+1). We convert len to n so we 1011571f8c1bSLuigi Rizzo * use that to count the number of entries. 1012571f8c1bSLuigi Rizzo */ 1013571f8c1bSLuigi Rizzo for (len = len / 2; len > 0; len--, a += 2) { 1014571f8c1bSLuigi Rizzo int mb = /* mask length */ 1015571f8c1bSLuigi Rizzo (cmd->o.opcode == O_IP_SRC || cmd->o.opcode == O_IP_DST) ? 1016f3a126d3SLuigi Rizzo 32 : contigmask((uint8_t *)&(a[1]), 32); 10179758b77fSLuigi Rizzo if (mb == 32 && do_resolv) 1018571f8c1bSLuigi Rizzo he = gethostbyaddr((char *)&(a[0]), sizeof(u_long), AF_INET); 10199758b77fSLuigi Rizzo if (he != NULL) /* resolved to name */ 10209758b77fSLuigi Rizzo printf("%s", he->h_name); 10219758b77fSLuigi Rizzo else if (mb == 0) /* any */ 10229758b77fSLuigi Rizzo printf("any"); 10239758b77fSLuigi Rizzo else { /* numeric IP followed by some kind of mask */ 1024571f8c1bSLuigi Rizzo printf("%s", inet_ntoa( *((struct in_addr *)&a[0]) ) ); 10259758b77fSLuigi Rizzo if (mb < 0) 1026571f8c1bSLuigi Rizzo printf(":%s", inet_ntoa( *((struct in_addr *)&a[1]) ) ); 10279758b77fSLuigi Rizzo else if (mb < 32) 10289758b77fSLuigi Rizzo printf("/%d", mb); 10299758b77fSLuigi Rizzo } 1030571f8c1bSLuigi Rizzo if (len > 1) 1031571f8c1bSLuigi Rizzo printf(","); 1032571f8c1bSLuigi Rizzo } 10339758b77fSLuigi Rizzo } 10349758b77fSLuigi Rizzo 10359758b77fSLuigi Rizzo /* 10369758b77fSLuigi Rizzo * prints a MAC address/mask pair 10379758b77fSLuigi Rizzo */ 10389758b77fSLuigi Rizzo static void 1039f3a126d3SLuigi Rizzo print_mac(uint8_t *addr, uint8_t *mask) 10409758b77fSLuigi Rizzo { 10419758b77fSLuigi Rizzo int l = contigmask(mask, 48); 10429758b77fSLuigi Rizzo 10439758b77fSLuigi Rizzo if (l == 0) 10449758b77fSLuigi Rizzo printf(" any"); 10459758b77fSLuigi Rizzo else { 10469758b77fSLuigi Rizzo printf(" %02x:%02x:%02x:%02x:%02x:%02x", 10479758b77fSLuigi Rizzo addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); 10489758b77fSLuigi Rizzo if (l == -1) 10499758b77fSLuigi Rizzo printf("&%02x:%02x:%02x:%02x:%02x:%02x", 10509758b77fSLuigi Rizzo mask[0], mask[1], mask[2], 10519758b77fSLuigi Rizzo mask[3], mask[4], mask[5]); 10529758b77fSLuigi Rizzo else if (l < 48) 10539758b77fSLuigi Rizzo printf("/%d", l); 10549758b77fSLuigi Rizzo } 10559758b77fSLuigi Rizzo } 10569758b77fSLuigi Rizzo 10575e43aef8SLuigi Rizzo static void 10585e43aef8SLuigi Rizzo fill_icmptypes(ipfw_insn_u32 *cmd, char *av) 10595e43aef8SLuigi Rizzo { 1060571f8c1bSLuigi Rizzo uint8_t type; 10615e43aef8SLuigi Rizzo 10625e43aef8SLuigi Rizzo cmd->d[0] = 0; 10635e43aef8SLuigi Rizzo while (*av) { 10645e43aef8SLuigi Rizzo if (*av == ',') 10655e43aef8SLuigi Rizzo av++; 10665e43aef8SLuigi Rizzo 10675e43aef8SLuigi Rizzo type = strtoul(av, &av, 0); 10685e43aef8SLuigi Rizzo 10695e43aef8SLuigi Rizzo if (*av != ',' && *av != '\0') 10705e43aef8SLuigi Rizzo errx(EX_DATAERR, "invalid ICMP type"); 10715e43aef8SLuigi Rizzo 10725e43aef8SLuigi Rizzo if (type > 31) 10735e43aef8SLuigi Rizzo errx(EX_DATAERR, "ICMP type out of range"); 10745e43aef8SLuigi Rizzo 10755e43aef8SLuigi Rizzo cmd->d[0] |= 1 << type; 10765e43aef8SLuigi Rizzo } 10775e43aef8SLuigi Rizzo cmd->o.opcode = O_ICMPTYPE; 10785e43aef8SLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 10795e43aef8SLuigi Rizzo } 10805e43aef8SLuigi Rizzo 10815e43aef8SLuigi Rizzo static void 10825e43aef8SLuigi Rizzo print_icmptypes(ipfw_insn_u32 *cmd) 10835e43aef8SLuigi Rizzo { 10845e43aef8SLuigi Rizzo int i; 10855e43aef8SLuigi Rizzo char sep= ' '; 10865e43aef8SLuigi Rizzo 10875e43aef8SLuigi Rizzo printf(" icmptypes"); 10885e43aef8SLuigi Rizzo for (i = 0; i < 32; i++) { 10895e43aef8SLuigi Rizzo if ( (cmd->d[0] & (1 << (i))) == 0) 10905e43aef8SLuigi Rizzo continue; 10915e43aef8SLuigi Rizzo printf("%c%d", sep, i); 10925e43aef8SLuigi Rizzo sep = ','; 10935e43aef8SLuigi Rizzo } 10945e43aef8SLuigi Rizzo } 10959758b77fSLuigi Rizzo 10969758b77fSLuigi Rizzo /* 10978195404bSBrooks Davis * Print the ip address contained in a command. 10988195404bSBrooks Davis */ 10998195404bSBrooks Davis static void 11008195404bSBrooks Davis print_ip6(ipfw_insn_ip6 *cmd, char const *s) 11018195404bSBrooks Davis { 11028195404bSBrooks Davis struct hostent *he = NULL; 11038195404bSBrooks Davis int len = F_LEN((ipfw_insn *) cmd) - 1; 11048195404bSBrooks Davis struct in6_addr *a = &(cmd->addr6); 11058195404bSBrooks Davis char trad[255]; 11068195404bSBrooks Davis 11078195404bSBrooks Davis printf("%s%s ", cmd->o.len & F_NOT ? " not": "", s); 11088195404bSBrooks Davis 11098195404bSBrooks Davis if (cmd->o.opcode == O_IP6_SRC_ME || cmd->o.opcode == O_IP6_DST_ME) { 11108195404bSBrooks Davis printf("me6"); 11118195404bSBrooks Davis return; 11128195404bSBrooks Davis } 11138195404bSBrooks Davis if (cmd->o.opcode == O_IP6) { 111436c263ccSHajimu UMEMOTO printf(" ip6"); 11158195404bSBrooks Davis return; 11168195404bSBrooks Davis } 11178195404bSBrooks Davis 11188195404bSBrooks Davis /* 11198195404bSBrooks Davis * len == 4 indicates a single IP, whereas lists of 1 or more 11208195404bSBrooks Davis * addr/mask pairs have len = (2n+1). We convert len to n so we 11218195404bSBrooks Davis * use that to count the number of entries. 11228195404bSBrooks Davis */ 11238195404bSBrooks Davis 11248195404bSBrooks Davis for (len = len / 4; len > 0; len -= 2, a += 2) { 11258195404bSBrooks Davis int mb = /* mask length */ 11268195404bSBrooks Davis (cmd->o.opcode == O_IP6_SRC || cmd->o.opcode == O_IP6_DST) ? 11278195404bSBrooks Davis 128 : contigmask((uint8_t *)&(a[1]), 128); 11288195404bSBrooks Davis 11298195404bSBrooks Davis if (mb == 128 && do_resolv) 11308195404bSBrooks Davis he = gethostbyaddr((char *)a, sizeof(*a), AF_INET6); 11318195404bSBrooks Davis if (he != NULL) /* resolved to name */ 11328195404bSBrooks Davis printf("%s", he->h_name); 11338195404bSBrooks Davis else if (mb == 0) /* any */ 11348195404bSBrooks Davis printf("any"); 11358195404bSBrooks Davis else { /* numeric IP followed by some kind of mask */ 11368195404bSBrooks Davis if (inet_ntop(AF_INET6, a, trad, sizeof( trad ) ) == NULL) 11378195404bSBrooks Davis printf("Error ntop in print_ip6\n"); 11388195404bSBrooks Davis printf("%s", trad ); 11398195404bSBrooks Davis if (mb < 0) /* XXX not really legal... */ 11408195404bSBrooks Davis printf(":%s", 11418195404bSBrooks Davis inet_ntop(AF_INET6, &a[1], trad, sizeof(trad))); 11428195404bSBrooks Davis else if (mb < 128) 11438195404bSBrooks Davis printf("/%d", mb); 11448195404bSBrooks Davis } 11458195404bSBrooks Davis if (len > 2) 11468195404bSBrooks Davis printf(","); 11478195404bSBrooks Davis } 11488195404bSBrooks Davis } 11498195404bSBrooks Davis 11508195404bSBrooks Davis static void 11518195404bSBrooks Davis fill_icmp6types(ipfw_insn_icmp6 *cmd, char *av) 11528195404bSBrooks Davis { 11538195404bSBrooks Davis uint8_t type; 11548195404bSBrooks Davis 11558195404bSBrooks Davis cmd->d[0] = 0; 11568195404bSBrooks Davis while (*av) { 11578195404bSBrooks Davis if (*av == ',') 11588195404bSBrooks Davis av++; 11598195404bSBrooks Davis type = strtoul(av, &av, 0); 11608195404bSBrooks Davis if (*av != ',' && *av != '\0') 11618195404bSBrooks Davis errx(EX_DATAERR, "invalid ICMP6 type"); 11628195404bSBrooks Davis /* 11638195404bSBrooks Davis * XXX: shouldn't this be 0xFF? I can't see any reason why 11648195404bSBrooks Davis * we shouldn't be able to filter all possiable values 11658195404bSBrooks Davis * regardless of the ability of the rest of the kernel to do 11668195404bSBrooks Davis * anything useful with them. 11678195404bSBrooks Davis */ 11688195404bSBrooks Davis if (type > ICMP6_MAXTYPE) 11698195404bSBrooks Davis errx(EX_DATAERR, "ICMP6 type out of range"); 11708195404bSBrooks Davis cmd->d[type / 32] |= ( 1 << (type % 32)); 11718195404bSBrooks Davis } 11728195404bSBrooks Davis cmd->o.opcode = O_ICMP6TYPE; 11738195404bSBrooks Davis cmd->o.len |= F_INSN_SIZE(ipfw_insn_icmp6); 11748195404bSBrooks Davis } 11758195404bSBrooks Davis 11768195404bSBrooks Davis 11778195404bSBrooks Davis static void 11788195404bSBrooks Davis print_icmp6types(ipfw_insn_u32 *cmd) 11798195404bSBrooks Davis { 11808195404bSBrooks Davis int i, j; 11818195404bSBrooks Davis char sep= ' '; 11828195404bSBrooks Davis 118336c263ccSHajimu UMEMOTO printf(" ip6 icmp6types"); 11848195404bSBrooks Davis for (i = 0; i < 7; i++) 11858195404bSBrooks Davis for (j=0; j < 32; ++j) { 11868195404bSBrooks Davis if ( (cmd->d[i] & (1 << (j))) == 0) 11878195404bSBrooks Davis continue; 11888195404bSBrooks Davis printf("%c%d", sep, (i*32 + j)); 11898195404bSBrooks Davis sep = ','; 11908195404bSBrooks Davis } 11918195404bSBrooks Davis } 11928195404bSBrooks Davis 11938195404bSBrooks Davis static void 11948195404bSBrooks Davis print_flow6id( ipfw_insn_u32 *cmd) 11958195404bSBrooks Davis { 11968195404bSBrooks Davis uint16_t i, limit = cmd->o.arg1; 11978195404bSBrooks Davis char sep = ','; 11988195404bSBrooks Davis 11998195404bSBrooks Davis printf(" flow-id "); 12008195404bSBrooks Davis for( i=0; i < limit; ++i) { 12018195404bSBrooks Davis if (i == limit - 1) 12028195404bSBrooks Davis sep = ' '; 12038195404bSBrooks Davis printf("%d%c", cmd->d[i], sep); 12048195404bSBrooks Davis } 12058195404bSBrooks Davis } 12068195404bSBrooks Davis 12078195404bSBrooks Davis /* structure and define for the extension header in ipv6 */ 12088195404bSBrooks Davis static struct _s_x ext6hdrcodes[] = { 12098195404bSBrooks Davis { "frag", EXT_FRAGMENT }, 12108195404bSBrooks Davis { "hopopt", EXT_HOPOPTS }, 12118195404bSBrooks Davis { "route", EXT_ROUTING }, 12129066356bSBjoern A. Zeeb { "dstopt", EXT_DSTOPTS }, 12138195404bSBrooks Davis { "ah", EXT_AH }, 12148195404bSBrooks Davis { "esp", EXT_ESP }, 12158195404bSBrooks Davis { NULL, 0 } 12168195404bSBrooks Davis }; 12178195404bSBrooks Davis 12188195404bSBrooks Davis /* fills command for the extension header filtering */ 12198195404bSBrooks Davis int 12208195404bSBrooks Davis fill_ext6hdr( ipfw_insn *cmd, char *av) 12218195404bSBrooks Davis { 12228195404bSBrooks Davis int tok; 12238195404bSBrooks Davis char *s = av; 12248195404bSBrooks Davis 12258195404bSBrooks Davis cmd->arg1 = 0; 12268195404bSBrooks Davis 12278195404bSBrooks Davis while(s) { 12288195404bSBrooks Davis av = strsep( &s, ",") ; 12298195404bSBrooks Davis tok = match_token(ext6hdrcodes, av); 12308195404bSBrooks Davis switch (tok) { 12318195404bSBrooks Davis case EXT_FRAGMENT: 12328195404bSBrooks Davis cmd->arg1 |= EXT_FRAGMENT; 12338195404bSBrooks Davis break; 12348195404bSBrooks Davis 12358195404bSBrooks Davis case EXT_HOPOPTS: 12368195404bSBrooks Davis cmd->arg1 |= EXT_HOPOPTS; 12378195404bSBrooks Davis break; 12388195404bSBrooks Davis 12398195404bSBrooks Davis case EXT_ROUTING: 12408195404bSBrooks Davis cmd->arg1 |= EXT_ROUTING; 12418195404bSBrooks Davis break; 12428195404bSBrooks Davis 12439066356bSBjoern A. Zeeb case EXT_DSTOPTS: 12449066356bSBjoern A. Zeeb cmd->arg1 |= EXT_DSTOPTS; 12459066356bSBjoern A. Zeeb break; 12469066356bSBjoern A. Zeeb 12478195404bSBrooks Davis case EXT_AH: 12488195404bSBrooks Davis cmd->arg1 |= EXT_AH; 12498195404bSBrooks Davis break; 12508195404bSBrooks Davis 12518195404bSBrooks Davis case EXT_ESP: 12528195404bSBrooks Davis cmd->arg1 |= EXT_ESP; 12538195404bSBrooks Davis break; 12548195404bSBrooks Davis 12558195404bSBrooks Davis default: 12568195404bSBrooks Davis errx( EX_DATAERR, "invalid option for ipv6 exten header" ); 12578195404bSBrooks Davis break; 12588195404bSBrooks Davis } 12598195404bSBrooks Davis } 12608195404bSBrooks Davis if (cmd->arg1 == 0 ) 12618195404bSBrooks Davis return 0; 12628195404bSBrooks Davis cmd->opcode = O_EXT_HDR; 12638195404bSBrooks Davis cmd->len |= F_INSN_SIZE( ipfw_insn ); 12648195404bSBrooks Davis return 1; 12658195404bSBrooks Davis } 12668195404bSBrooks Davis 12678195404bSBrooks Davis void 12688195404bSBrooks Davis print_ext6hdr( ipfw_insn *cmd ) 12698195404bSBrooks Davis { 12708195404bSBrooks Davis char sep = ' '; 12718195404bSBrooks Davis 12728195404bSBrooks Davis printf(" extension header:"); 12738195404bSBrooks Davis if (cmd->arg1 & EXT_FRAGMENT ) { 12748195404bSBrooks Davis printf("%cfragmentation", sep); 12758195404bSBrooks Davis sep = ','; 12768195404bSBrooks Davis } 12778195404bSBrooks Davis if (cmd->arg1 & EXT_HOPOPTS ) { 12788195404bSBrooks Davis printf("%chop options", sep); 12798195404bSBrooks Davis sep = ','; 12808195404bSBrooks Davis } 12818195404bSBrooks Davis if (cmd->arg1 & EXT_ROUTING ) { 12828195404bSBrooks Davis printf("%crouting options", sep); 12838195404bSBrooks Davis sep = ','; 12848195404bSBrooks Davis } 12859066356bSBjoern A. Zeeb if (cmd->arg1 & EXT_DSTOPTS ) { 12869066356bSBjoern A. Zeeb printf("%cdestination options", sep); 12879066356bSBjoern A. Zeeb sep = ','; 12889066356bSBjoern A. Zeeb } 12898195404bSBrooks Davis if (cmd->arg1 & EXT_AH ) { 12908195404bSBrooks Davis printf("%cauthentication header", sep); 12918195404bSBrooks Davis sep = ','; 12928195404bSBrooks Davis } 12938195404bSBrooks Davis if (cmd->arg1 & EXT_ESP ) { 12948195404bSBrooks Davis printf("%cencapsulated security payload", sep); 12958195404bSBrooks Davis } 12968195404bSBrooks Davis } 12978195404bSBrooks Davis 12988195404bSBrooks Davis /* 12999758b77fSLuigi Rizzo * show_ipfw() prints the body of an ipfw rule. 13009758b77fSLuigi Rizzo * Because the standard rule has at least proto src_ip dst_ip, we use 13019758b77fSLuigi Rizzo * a helper function to produce these entries if not provided explicitly. 1302e706181bSLuigi Rizzo * The first argument is the list of fields we have, the second is 1303e706181bSLuigi Rizzo * the list of fields we want to be printed. 130499e5e645SLuigi Rizzo * 1305e706181bSLuigi Rizzo * Special cases if we have provided a MAC header: 1306e706181bSLuigi Rizzo * + if the rule does not contain IP addresses/ports, do not print them; 1307e706181bSLuigi Rizzo * + if the rule does not contain an IP proto, print "all" instead of "ip"; 1308e706181bSLuigi Rizzo * 1309e706181bSLuigi Rizzo * Once we have 'have_options', IP header fields are printed as options. 13109758b77fSLuigi Rizzo */ 131199e5e645SLuigi Rizzo #define HAVE_PROTO 0x0001 131299e5e645SLuigi Rizzo #define HAVE_SRCIP 0x0002 131399e5e645SLuigi Rizzo #define HAVE_DSTIP 0x0004 131499e5e645SLuigi Rizzo #define HAVE_MAC 0x0008 131599e5e645SLuigi Rizzo #define HAVE_MACTYPE 0x0010 131657cd6d26SMax Laier #define HAVE_PROTO4 0x0040 13178195404bSBrooks Davis #define HAVE_PROTO6 0x0080 1318e706181bSLuigi Rizzo #define HAVE_OPTIONS 0x8000 13199758b77fSLuigi Rizzo 132099e5e645SLuigi Rizzo #define HAVE_IP (HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP) 13219758b77fSLuigi Rizzo static void 1322e706181bSLuigi Rizzo show_prerequisites(int *flags, int want, int cmd) 13239758b77fSLuigi Rizzo { 1324ac6cec51SLuigi Rizzo if (comment_only) 1325ac6cec51SLuigi Rizzo return; 1326e706181bSLuigi Rizzo if ( (*flags & HAVE_IP) == HAVE_IP) 1327e706181bSLuigi Rizzo *flags |= HAVE_OPTIONS; 132899e5e645SLuigi Rizzo 1329e706181bSLuigi Rizzo if ( (*flags & (HAVE_MAC|HAVE_MACTYPE|HAVE_OPTIONS)) == HAVE_MAC && 1330e706181bSLuigi Rizzo cmd != O_MAC_TYPE) { 1331e706181bSLuigi Rizzo /* 1332e706181bSLuigi Rizzo * mac-type was optimized out by the compiler, 1333e706181bSLuigi Rizzo * restore it 1334e706181bSLuigi Rizzo */ 1335e706181bSLuigi Rizzo printf(" any"); 1336e706181bSLuigi Rizzo *flags |= HAVE_MACTYPE | HAVE_OPTIONS; 1337e706181bSLuigi Rizzo return; 1338e706181bSLuigi Rizzo } 1339e706181bSLuigi Rizzo if ( !(*flags & HAVE_OPTIONS)) { 13409758b77fSLuigi Rizzo if ( !(*flags & HAVE_PROTO) && (want & HAVE_PROTO)) 134157cd6d26SMax Laier if ( (*flags & HAVE_PROTO4)) 134257cd6d26SMax Laier printf(" ip4"); 134357cd6d26SMax Laier else if ( (*flags & HAVE_PROTO6)) 134457cd6d26SMax Laier printf(" ip6"); 134557cd6d26SMax Laier else 1346e706181bSLuigi Rizzo printf(" ip"); 134757cd6d26SMax Laier 13489758b77fSLuigi Rizzo if ( !(*flags & HAVE_SRCIP) && (want & HAVE_SRCIP)) 13499758b77fSLuigi Rizzo printf(" from any"); 13509758b77fSLuigi Rizzo if ( !(*flags & HAVE_DSTIP) && (want & HAVE_DSTIP)) 13519758b77fSLuigi Rizzo printf(" to any"); 1352e706181bSLuigi Rizzo } 13539758b77fSLuigi Rizzo *flags |= want; 13549758b77fSLuigi Rizzo } 13559758b77fSLuigi Rizzo 13569758b77fSLuigi Rizzo static void 135745f61351SMaxim Konovalov show_ipfw(struct ip_fw *rule, int pcwidth, int bcwidth) 13589758b77fSLuigi Rizzo { 13593d2209aeSGiorgos Keramidas static int twidth = 0; 13609758b77fSLuigi Rizzo int l; 13619758b77fSLuigi Rizzo ipfw_insn *cmd; 1362bbc39c83SLuigi Rizzo char *comment = NULL; /* ptr to comment if we have one */ 13639758b77fSLuigi Rizzo int proto = 0; /* default */ 13649758b77fSLuigi Rizzo int flags = 0; /* prerequisites */ 13659758b77fSLuigi Rizzo ipfw_insn_log *logptr = NULL; /* set if we find an O_LOG */ 1366974dfe30SBrian Feldman ipfw_insn_altq *altqptr = NULL; /* set if we find an O_ALTQ */ 13679758b77fSLuigi Rizzo int or_block = 0; /* we are in an or block */ 1368571f8c1bSLuigi Rizzo uint32_t set_disable; 13699758b77fSLuigi Rizzo 1370330462a3SBernd Walter bcopy(&rule->next_rule, &set_disable, sizeof(set_disable)); 137143405724SLuigi Rizzo 137243405724SLuigi Rizzo if (set_disable & (1 << rule->set)) { /* disabled */ 137343405724SLuigi Rizzo if (!show_sets) 137443405724SLuigi Rizzo return; 137543405724SLuigi Rizzo else 137643405724SLuigi Rizzo printf("# DISABLED "); 137743405724SLuigi Rizzo } 13789758b77fSLuigi Rizzo printf("%05u ", rule->rulenum); 13799758b77fSLuigi Rizzo 138062ff38aeSLuigi Rizzo if (pcwidth>0 || bcwidth>0) 1381330462a3SBernd Walter printf("%*llu %*llu ", pcwidth, align_uint64(&rule->pcnt), 1382330462a3SBernd Walter bcwidth, align_uint64(&rule->bcnt)); 13839758b77fSLuigi Rizzo 13841b43a426SLuigi Rizzo if (do_time == 2) 13851b43a426SLuigi Rizzo printf("%10u ", rule->timestamp); 13861b43a426SLuigi Rizzo else if (do_time == 1) { 13879758b77fSLuigi Rizzo char timestr[30]; 13883d2209aeSGiorgos Keramidas time_t t = (time_t)0; 13893d2209aeSGiorgos Keramidas 13903d2209aeSGiorgos Keramidas if (twidth == 0) { 13913d2209aeSGiorgos Keramidas strcpy(timestr, ctime(&t)); 13923d2209aeSGiorgos Keramidas *strchr(timestr, '\n') = '\0'; 13933d2209aeSGiorgos Keramidas twidth = strlen(timestr); 13943d2209aeSGiorgos Keramidas } 13953d2209aeSGiorgos Keramidas if (rule->timestamp) { 13963d2209aeSGiorgos Keramidas t = _long_to_time(rule->timestamp); 13979758b77fSLuigi Rizzo 13989758b77fSLuigi Rizzo strcpy(timestr, ctime(&t)); 13999758b77fSLuigi Rizzo *strchr(timestr, '\n') = '\0'; 14009758b77fSLuigi Rizzo printf("%s ", timestr); 14019758b77fSLuigi Rizzo } else { 14023d2209aeSGiorgos Keramidas printf("%*s", twidth, " "); 14039758b77fSLuigi Rizzo } 14049758b77fSLuigi Rizzo } 14059758b77fSLuigi Rizzo 140643405724SLuigi Rizzo if (show_sets) 140743405724SLuigi Rizzo printf("set %d ", rule->set); 140843405724SLuigi Rizzo 14099758b77fSLuigi Rizzo /* 141012b5dc6aSLuigi Rizzo * print the optional "match probability" 141112b5dc6aSLuigi Rizzo */ 141212b5dc6aSLuigi Rizzo if (rule->cmd_len > 0) { 141312b5dc6aSLuigi Rizzo cmd = rule->cmd ; 141412b5dc6aSLuigi Rizzo if (cmd->opcode == O_PROB) { 141512b5dc6aSLuigi Rizzo ipfw_insn_u32 *p = (ipfw_insn_u32 *)cmd; 141612b5dc6aSLuigi Rizzo double d = 1.0 * p->d[0]; 141712b5dc6aSLuigi Rizzo 141812b5dc6aSLuigi Rizzo d = (d / 0x7fffffff); 141912b5dc6aSLuigi Rizzo printf("prob %f ", d); 142012b5dc6aSLuigi Rizzo } 142112b5dc6aSLuigi Rizzo } 142212b5dc6aSLuigi Rizzo 142312b5dc6aSLuigi Rizzo /* 14249758b77fSLuigi Rizzo * first print actions 14259758b77fSLuigi Rizzo */ 14269758b77fSLuigi Rizzo for (l = rule->cmd_len - rule->act_ofs, cmd = ACTION_PTR(rule); 14279758b77fSLuigi Rizzo l > 0 ; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 14289758b77fSLuigi Rizzo switch(cmd->opcode) { 14299758b77fSLuigi Rizzo case O_CHECK_STATE: 14309758b77fSLuigi Rizzo printf("check-state"); 1431e706181bSLuigi Rizzo flags = HAVE_IP; /* avoid printing anything else */ 14329758b77fSLuigi Rizzo break; 14339758b77fSLuigi Rizzo 14349758b77fSLuigi Rizzo case O_ACCEPT: 14359758b77fSLuigi Rizzo printf("allow"); 14369758b77fSLuigi Rizzo break; 14379758b77fSLuigi Rizzo 14389758b77fSLuigi Rizzo case O_COUNT: 14399758b77fSLuigi Rizzo printf("count"); 14409758b77fSLuigi Rizzo break; 14419758b77fSLuigi Rizzo 14429758b77fSLuigi Rizzo case O_DENY: 14439758b77fSLuigi Rizzo printf("deny"); 14449758b77fSLuigi Rizzo break; 14459758b77fSLuigi Rizzo 14465e43aef8SLuigi Rizzo case O_REJECT: 14475e43aef8SLuigi Rizzo if (cmd->arg1 == ICMP_REJECT_RST) 14485e43aef8SLuigi Rizzo printf("reset"); 14495e43aef8SLuigi Rizzo else if (cmd->arg1 == ICMP_UNREACH_HOST) 14505e43aef8SLuigi Rizzo printf("reject"); 14515e43aef8SLuigi Rizzo else 14525e43aef8SLuigi Rizzo print_reject_code(cmd->arg1); 14535e43aef8SLuigi Rizzo break; 14545e43aef8SLuigi Rizzo 14559066356bSBjoern A. Zeeb case O_UNREACH6: 14569066356bSBjoern A. Zeeb if (cmd->arg1 == ICMP6_UNREACH_RST) 14579066356bSBjoern A. Zeeb printf("reset6"); 14589066356bSBjoern A. Zeeb else 14599066356bSBjoern A. Zeeb print_unreach6_code(cmd->arg1); 14609066356bSBjoern A. Zeeb break; 14619066356bSBjoern A. Zeeb 146240b1ae9eSGleb Smirnoff #define PRINT_WITH_ARG(o) \ 146340b1ae9eSGleb Smirnoff if (cmd->arg1 == IP_FW_TABLEARG) \ 146440b1ae9eSGleb Smirnoff printf("%s tablearg", (o)); \ 146540b1ae9eSGleb Smirnoff else \ 146640b1ae9eSGleb Smirnoff printf("%s %u", (o), cmd->arg1); \ 146740b1ae9eSGleb Smirnoff break; 146840b1ae9eSGleb Smirnoff 14699758b77fSLuigi Rizzo case O_SKIPTO: 147040b1ae9eSGleb Smirnoff PRINT_WITH_ARG("skipto"); 14719758b77fSLuigi Rizzo case O_PIPE: 147240b1ae9eSGleb Smirnoff PRINT_WITH_ARG("pipe"); 14739758b77fSLuigi Rizzo case O_QUEUE: 147440b1ae9eSGleb Smirnoff PRINT_WITH_ARG("queue"); 14759758b77fSLuigi Rizzo case O_DIVERT: 147640b1ae9eSGleb Smirnoff PRINT_WITH_ARG("divert"); 14779758b77fSLuigi Rizzo case O_TEE: 147840b1ae9eSGleb Smirnoff PRINT_WITH_ARG("tee"); 1479670742a1SGleb Smirnoff case O_NETGRAPH: 148040b1ae9eSGleb Smirnoff PRINT_WITH_ARG("netgraph"); 1481670742a1SGleb Smirnoff case O_NGTEE: 148240b1ae9eSGleb Smirnoff PRINT_WITH_ARG("ngtee"); 148340b1ae9eSGleb Smirnoff #undef PRINT_WITH_ARG 1484670742a1SGleb Smirnoff 14859758b77fSLuigi Rizzo case O_FORWARD_IP: 14869758b77fSLuigi Rizzo { 14879758b77fSLuigi Rizzo ipfw_insn_sa *s = (ipfw_insn_sa *)cmd; 14889758b77fSLuigi Rizzo 14899758b77fSLuigi Rizzo printf("fwd %s", inet_ntoa(s->sa.sin_addr)); 14909758b77fSLuigi Rizzo if (s->sa.sin_port) 14914f531a53SLuigi Rizzo printf(",%d", s->sa.sin_port); 14929758b77fSLuigi Rizzo } 14939758b77fSLuigi Rizzo break; 14949758b77fSLuigi Rizzo 14959758b77fSLuigi Rizzo case O_LOG: /* O_LOG is printed last */ 14969758b77fSLuigi Rizzo logptr = (ipfw_insn_log *)cmd; 14979758b77fSLuigi Rizzo break; 14989758b77fSLuigi Rizzo 1499974dfe30SBrian Feldman case O_ALTQ: /* O_ALTQ is printed after O_LOG */ 1500974dfe30SBrian Feldman altqptr = (ipfw_insn_altq *)cmd; 1501974dfe30SBrian Feldman break; 1502974dfe30SBrian Feldman 15039758b77fSLuigi Rizzo default: 15049758b77fSLuigi Rizzo printf("** unrecognized action %d len %d ", 15059758b77fSLuigi Rizzo cmd->opcode, cmd->len); 15069758b77fSLuigi Rizzo } 15079758b77fSLuigi Rizzo } 15089758b77fSLuigi Rizzo if (logptr) { 15099758b77fSLuigi Rizzo if (logptr->max_log > 0) 15109758b77fSLuigi Rizzo printf(" log logamount %d", logptr->max_log); 15119758b77fSLuigi Rizzo else 15129758b77fSLuigi Rizzo printf(" log"); 15139758b77fSLuigi Rizzo } 1514974dfe30SBrian Feldman if (altqptr) { 1515974dfe30SBrian Feldman const char *qname; 1516974dfe30SBrian Feldman 1517974dfe30SBrian Feldman qname = altq_qid_to_name(altqptr->qid); 1518974dfe30SBrian Feldman if (qname == NULL) 1519974dfe30SBrian Feldman printf(" altq ?<%u>", altqptr->qid); 1520974dfe30SBrian Feldman else 1521974dfe30SBrian Feldman printf(" altq %s", qname); 1522974dfe30SBrian Feldman } 1523e706181bSLuigi Rizzo 15249758b77fSLuigi Rizzo /* 1525e706181bSLuigi Rizzo * then print the body. 15269758b77fSLuigi Rizzo */ 152757cd6d26SMax Laier for (l = rule->act_ofs, cmd = rule->cmd ; 152857cd6d26SMax Laier l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) { 152957cd6d26SMax Laier if ((cmd->len & F_OR) || (cmd->len & F_NOT)) 153057cd6d26SMax Laier continue; 153157cd6d26SMax Laier if (cmd->opcode == O_IP4) { 153257cd6d26SMax Laier flags |= HAVE_PROTO4; 153357cd6d26SMax Laier break; 153457cd6d26SMax Laier } else if (cmd->opcode == O_IP6) { 153557cd6d26SMax Laier flags |= HAVE_PROTO6; 153657cd6d26SMax Laier break; 153757cd6d26SMax Laier } 153857cd6d26SMax Laier } 1539e706181bSLuigi Rizzo if (rule->_pad & 1) { /* empty rules before options */ 154057cd6d26SMax Laier if (!do_compact) { 154157cd6d26SMax Laier show_prerequisites(&flags, HAVE_PROTO, 0); 154257cd6d26SMax Laier printf(" from any to any"); 154357cd6d26SMax Laier } 1544e706181bSLuigi Rizzo flags |= HAVE_IP | HAVE_OPTIONS; 1545e706181bSLuigi Rizzo } 1546e706181bSLuigi Rizzo 1547ac6cec51SLuigi Rizzo if (comment_only) 1548ac6cec51SLuigi Rizzo comment = "..."; 1549ac6cec51SLuigi Rizzo 15509758b77fSLuigi Rizzo for (l = rule->act_ofs, cmd = rule->cmd ; 15519758b77fSLuigi Rizzo l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) { 15525e43aef8SLuigi Rizzo /* useful alias */ 15535e43aef8SLuigi Rizzo ipfw_insn_u32 *cmd32 = (ipfw_insn_u32 *)cmd; 15549758b77fSLuigi Rizzo 1555ac6cec51SLuigi Rizzo if (comment_only) { 1556ac6cec51SLuigi Rizzo if (cmd->opcode != O_NOP) 1557ac6cec51SLuigi Rizzo continue; 1558ac6cec51SLuigi Rizzo printf(" // %s\n", (char *)(cmd + 1)); 1559ac6cec51SLuigi Rizzo return; 1560ac6cec51SLuigi Rizzo } 1561ac6cec51SLuigi Rizzo 1562e706181bSLuigi Rizzo show_prerequisites(&flags, 0, cmd->opcode); 1563e706181bSLuigi Rizzo 15649758b77fSLuigi Rizzo switch(cmd->opcode) { 156512b5dc6aSLuigi Rizzo case O_PROB: 156612b5dc6aSLuigi Rizzo break; /* done already */ 156712b5dc6aSLuigi Rizzo 15689758b77fSLuigi Rizzo case O_PROBE_STATE: 15699758b77fSLuigi Rizzo break; /* no need to print anything here */ 15709758b77fSLuigi Rizzo 15719758b77fSLuigi Rizzo case O_MACADDR2: { 15729758b77fSLuigi Rizzo ipfw_insn_mac *m = (ipfw_insn_mac *)cmd; 1573e706181bSLuigi Rizzo 1574e706181bSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 1575e706181bSLuigi Rizzo printf(" {"); 15769758b77fSLuigi Rizzo if (cmd->len & F_NOT) 15779758b77fSLuigi Rizzo printf(" not"); 1578e706181bSLuigi Rizzo printf(" MAC"); 1579e706181bSLuigi Rizzo flags |= HAVE_MAC; 15809758b77fSLuigi Rizzo print_mac(m->addr, m->mask); 15819758b77fSLuigi Rizzo print_mac(m->addr + 6, m->mask + 6); 15829758b77fSLuigi Rizzo } 15839758b77fSLuigi Rizzo break; 15849758b77fSLuigi Rizzo 15859758b77fSLuigi Rizzo case O_MAC_TYPE: 1586e706181bSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 1587e706181bSLuigi Rizzo printf(" {"); 1588e706181bSLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, IPPROTO_ETHERTYPE, 1589e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? cmd->opcode : 0); 1590e706181bSLuigi Rizzo flags |= HAVE_MAC | HAVE_MACTYPE | HAVE_OPTIONS; 15919758b77fSLuigi Rizzo break; 15929758b77fSLuigi Rizzo 15939758b77fSLuigi Rizzo case O_IP_SRC: 1594cd8b5ae0SRuslan Ermilov case O_IP_SRC_LOOKUP: 15959758b77fSLuigi Rizzo case O_IP_SRC_MASK: 15969758b77fSLuigi Rizzo case O_IP_SRC_ME: 15979758b77fSLuigi Rizzo case O_IP_SRC_SET: 1598e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO, 0); 15999758b77fSLuigi Rizzo if (!(flags & HAVE_SRCIP)) 16009758b77fSLuigi Rizzo printf(" from"); 16019758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 16029758b77fSLuigi Rizzo printf(" {"); 1603e706181bSLuigi Rizzo print_ip((ipfw_insn_ip *)cmd, 1604e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? " src-ip" : ""); 16059758b77fSLuigi Rizzo flags |= HAVE_SRCIP; 16069758b77fSLuigi Rizzo break; 16079758b77fSLuigi Rizzo 16089758b77fSLuigi Rizzo case O_IP_DST: 1609cd8b5ae0SRuslan Ermilov case O_IP_DST_LOOKUP: 16109758b77fSLuigi Rizzo case O_IP_DST_MASK: 16119758b77fSLuigi Rizzo case O_IP_DST_ME: 16129758b77fSLuigi Rizzo case O_IP_DST_SET: 1613e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0); 16149758b77fSLuigi Rizzo if (!(flags & HAVE_DSTIP)) 16159758b77fSLuigi Rizzo printf(" to"); 16169758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 16179758b77fSLuigi Rizzo printf(" {"); 1618e706181bSLuigi Rizzo print_ip((ipfw_insn_ip *)cmd, 1619e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? " dst-ip" : ""); 16209758b77fSLuigi Rizzo flags |= HAVE_DSTIP; 16219758b77fSLuigi Rizzo break; 16229758b77fSLuigi Rizzo 16238195404bSBrooks Davis case O_IP6_SRC: 16248195404bSBrooks Davis case O_IP6_SRC_MASK: 16258195404bSBrooks Davis case O_IP6_SRC_ME: 1626b730879fSMax Laier show_prerequisites(&flags, HAVE_PROTO, 0); 16278195404bSBrooks Davis if (!(flags & HAVE_SRCIP)) 16288195404bSBrooks Davis printf(" from"); 16298195404bSBrooks Davis if ((cmd->len & F_OR) && !or_block) 16308195404bSBrooks Davis printf(" {"); 16318195404bSBrooks Davis print_ip6((ipfw_insn_ip6 *)cmd, 16328195404bSBrooks Davis (flags & HAVE_OPTIONS) ? " src-ip6" : ""); 16338195404bSBrooks Davis flags |= HAVE_SRCIP | HAVE_PROTO; 16348195404bSBrooks Davis break; 16358195404bSBrooks Davis 16368195404bSBrooks Davis case O_IP6_DST: 16378195404bSBrooks Davis case O_IP6_DST_MASK: 16388195404bSBrooks Davis case O_IP6_DST_ME: 16398195404bSBrooks Davis show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0); 16408195404bSBrooks Davis if (!(flags & HAVE_DSTIP)) 16418195404bSBrooks Davis printf(" to"); 16428195404bSBrooks Davis if ((cmd->len & F_OR) && !or_block) 16438195404bSBrooks Davis printf(" {"); 16448195404bSBrooks Davis print_ip6((ipfw_insn_ip6 *)cmd, 16458195404bSBrooks Davis (flags & HAVE_OPTIONS) ? " dst-ip6" : ""); 16468195404bSBrooks Davis flags |= HAVE_DSTIP; 16478195404bSBrooks Davis break; 16488195404bSBrooks Davis 16498195404bSBrooks Davis case O_FLOW6ID: 16508195404bSBrooks Davis print_flow6id( (ipfw_insn_u32 *) cmd ); 16518195404bSBrooks Davis flags |= HAVE_OPTIONS; 16528195404bSBrooks Davis break; 16538195404bSBrooks Davis 16549758b77fSLuigi Rizzo case O_IP_DSTPORT: 1655e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_IP, 0); 16569758b77fSLuigi Rizzo case O_IP_SRCPORT: 1657e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0); 16588ed2d749SLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 16598ed2d749SLuigi Rizzo printf(" {"); 1660e706181bSLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, proto, 1661e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? cmd->opcode : 0); 16629758b77fSLuigi Rizzo break; 16639758b77fSLuigi Rizzo 16649758b77fSLuigi Rizzo case O_PROTO: { 16658195404bSBrooks Davis struct protoent *pe = NULL; 16669758b77fSLuigi Rizzo 16679758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 16689758b77fSLuigi Rizzo printf(" {"); 16699758b77fSLuigi Rizzo if (cmd->len & F_NOT) 16709758b77fSLuigi Rizzo printf(" not"); 16719758b77fSLuigi Rizzo proto = cmd->arg1; 1672d360073bSBrooks Davis pe = getprotobynumber(cmd->arg1); 167357cd6d26SMax Laier if ((flags & (HAVE_PROTO4 | HAVE_PROTO6)) && 167457cd6d26SMax Laier !(flags & HAVE_PROTO)) 167557cd6d26SMax Laier show_prerequisites(&flags, 167657cd6d26SMax Laier HAVE_IP | HAVE_OPTIONS, 0); 1677e706181bSLuigi Rizzo if (flags & HAVE_OPTIONS) 1678e706181bSLuigi Rizzo printf(" proto"); 16799758b77fSLuigi Rizzo if (pe) 16809758b77fSLuigi Rizzo printf(" %s", pe->p_name); 16819758b77fSLuigi Rizzo else 16829758b77fSLuigi Rizzo printf(" %u", cmd->arg1); 16839758b77fSLuigi Rizzo } 16849758b77fSLuigi Rizzo flags |= HAVE_PROTO; 16859758b77fSLuigi Rizzo break; 16869758b77fSLuigi Rizzo 16879758b77fSLuigi Rizzo default: /*options ... */ 168857cd6d26SMax Laier if (!(cmd->len & (F_OR|F_NOT))) 168957cd6d26SMax Laier if (((cmd->opcode == O_IP6) && 169057cd6d26SMax Laier (flags & HAVE_PROTO6)) || 169157cd6d26SMax Laier ((cmd->opcode == O_IP4) && 169257cd6d26SMax Laier (flags & HAVE_PROTO4))) 169357cd6d26SMax Laier break; 1694e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_IP | HAVE_OPTIONS, 0); 16959758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 16969758b77fSLuigi Rizzo printf(" {"); 16979758b77fSLuigi Rizzo if (cmd->len & F_NOT && cmd->opcode != O_IN) 16989758b77fSLuigi Rizzo printf(" not"); 16999758b77fSLuigi Rizzo switch(cmd->opcode) { 17009758b77fSLuigi Rizzo case O_FRAG: 17019758b77fSLuigi Rizzo printf(" frag"); 17029758b77fSLuigi Rizzo break; 17039758b77fSLuigi Rizzo 17049758b77fSLuigi Rizzo case O_IN: 17059758b77fSLuigi Rizzo printf(cmd->len & F_NOT ? " out" : " in"); 17069758b77fSLuigi Rizzo break; 17079758b77fSLuigi Rizzo 17086daf7ebdSBrian Feldman case O_DIVERTED: 17096daf7ebdSBrian Feldman switch (cmd->arg1) { 17106daf7ebdSBrian Feldman case 3: 17116daf7ebdSBrian Feldman printf(" diverted"); 17126daf7ebdSBrian Feldman break; 17136daf7ebdSBrian Feldman case 1: 17146daf7ebdSBrian Feldman printf(" diverted-loopback"); 17156daf7ebdSBrian Feldman break; 17166daf7ebdSBrian Feldman case 2: 17176daf7ebdSBrian Feldman printf(" diverted-output"); 17186daf7ebdSBrian Feldman break; 17196daf7ebdSBrian Feldman default: 17206daf7ebdSBrian Feldman printf(" diverted-?<%u>", cmd->arg1); 17216daf7ebdSBrian Feldman break; 17226daf7ebdSBrian Feldman } 17236daf7ebdSBrian Feldman break; 17246daf7ebdSBrian Feldman 17259758b77fSLuigi Rizzo case O_LAYER2: 17269758b77fSLuigi Rizzo printf(" layer2"); 17279758b77fSLuigi Rizzo break; 17289758b77fSLuigi Rizzo case O_XMIT: 17299758b77fSLuigi Rizzo case O_RECV: 1730bd528823SGleb Smirnoff case O_VIA: 1731bd528823SGleb Smirnoff { 173262ff38aeSLuigi Rizzo char const *s; 17339758b77fSLuigi Rizzo ipfw_insn_if *cmdif = (ipfw_insn_if *)cmd; 17349758b77fSLuigi Rizzo 17359758b77fSLuigi Rizzo if (cmd->opcode == O_XMIT) 17369758b77fSLuigi Rizzo s = "xmit"; 17379758b77fSLuigi Rizzo else if (cmd->opcode == O_RECV) 17389758b77fSLuigi Rizzo s = "recv"; 173962ff38aeSLuigi Rizzo else /* if (cmd->opcode == O_VIA) */ 17409758b77fSLuigi Rizzo s = "via"; 17419758b77fSLuigi Rizzo if (cmdif->name[0] == '\0') 17425e43aef8SLuigi Rizzo printf(" %s %s", s, 17435e43aef8SLuigi Rizzo inet_ntoa(cmdif->p.ip)); 1744bd528823SGleb Smirnoff else 17459bf40edeSBrooks Davis printf(" %s %s", s, cmdif->name); 17469758b77fSLuigi Rizzo 1747bd528823SGleb Smirnoff break; 1748bd528823SGleb Smirnoff } 17499758b77fSLuigi Rizzo case O_IPID: 175044c884e1SLuigi Rizzo if (F_LEN(cmd) == 1) 17519758b77fSLuigi Rizzo printf(" ipid %u", cmd->arg1 ); 175244c884e1SLuigi Rizzo else 175344c884e1SLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, 0, 175444c884e1SLuigi Rizzo O_IPID); 17559758b77fSLuigi Rizzo break; 17569758b77fSLuigi Rizzo 17579758b77fSLuigi Rizzo case O_IPTTL: 175844c884e1SLuigi Rizzo if (F_LEN(cmd) == 1) 17599758b77fSLuigi Rizzo printf(" ipttl %u", cmd->arg1 ); 176044c884e1SLuigi Rizzo else 176144c884e1SLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, 0, 176244c884e1SLuigi Rizzo O_IPTTL); 17639758b77fSLuigi Rizzo break; 17649758b77fSLuigi Rizzo 17659758b77fSLuigi Rizzo case O_IPVER: 17669758b77fSLuigi Rizzo printf(" ipver %u", cmd->arg1 ); 17679758b77fSLuigi Rizzo break; 17689758b77fSLuigi Rizzo 17695e43aef8SLuigi Rizzo case O_IPPRECEDENCE: 17705e43aef8SLuigi Rizzo printf(" ipprecedence %u", (cmd->arg1) >> 5 ); 17715e43aef8SLuigi Rizzo break; 17725e43aef8SLuigi Rizzo 17739758b77fSLuigi Rizzo case O_IPLEN: 177444c884e1SLuigi Rizzo if (F_LEN(cmd) == 1) 17759758b77fSLuigi Rizzo printf(" iplen %u", cmd->arg1 ); 177644c884e1SLuigi Rizzo else 177744c884e1SLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, 0, 177844c884e1SLuigi Rizzo O_IPLEN); 17799758b77fSLuigi Rizzo break; 17809758b77fSLuigi Rizzo 178152bc23abSLuigi Rizzo case O_IPOPT: 17829758b77fSLuigi Rizzo print_flags("ipoptions", cmd, f_ipopts); 17839758b77fSLuigi Rizzo break; 17849758b77fSLuigi Rizzo 17855e43aef8SLuigi Rizzo case O_IPTOS: 17865e43aef8SLuigi Rizzo print_flags("iptos", cmd, f_iptos); 17875e43aef8SLuigi Rizzo break; 17885e43aef8SLuigi Rizzo 17895e43aef8SLuigi Rizzo case O_ICMPTYPE: 17905e43aef8SLuigi Rizzo print_icmptypes((ipfw_insn_u32 *)cmd); 17915e43aef8SLuigi Rizzo break; 17925e43aef8SLuigi Rizzo 17939758b77fSLuigi Rizzo case O_ESTAB: 17949758b77fSLuigi Rizzo printf(" established"); 17959758b77fSLuigi Rizzo break; 17969758b77fSLuigi Rizzo 1797c99ee9e0SBrian Feldman case O_TCPDATALEN: 1798c99ee9e0SBrian Feldman if (F_LEN(cmd) == 1) 1799c99ee9e0SBrian Feldman printf(" tcpdatalen %u", cmd->arg1 ); 1800c99ee9e0SBrian Feldman else 1801c99ee9e0SBrian Feldman print_newports((ipfw_insn_u16 *)cmd, 0, 1802c99ee9e0SBrian Feldman O_TCPDATALEN); 1803c99ee9e0SBrian Feldman break; 1804c99ee9e0SBrian Feldman 18059758b77fSLuigi Rizzo case O_TCPFLAGS: 18069758b77fSLuigi Rizzo print_flags("tcpflags", cmd, f_tcpflags); 18079758b77fSLuigi Rizzo break; 18089758b77fSLuigi Rizzo 18099758b77fSLuigi Rizzo case O_TCPOPTS: 18109758b77fSLuigi Rizzo print_flags("tcpoptions", cmd, f_tcpopts); 18119758b77fSLuigi Rizzo break; 18129758b77fSLuigi Rizzo 18139758b77fSLuigi Rizzo case O_TCPWIN: 18149758b77fSLuigi Rizzo printf(" tcpwin %d", ntohs(cmd->arg1)); 18159758b77fSLuigi Rizzo break; 18169758b77fSLuigi Rizzo 18179758b77fSLuigi Rizzo case O_TCPACK: 18189758b77fSLuigi Rizzo printf(" tcpack %d", ntohl(cmd32->d[0])); 18199758b77fSLuigi Rizzo break; 18209758b77fSLuigi Rizzo 18219758b77fSLuigi Rizzo case O_TCPSEQ: 18229758b77fSLuigi Rizzo printf(" tcpseq %d", ntohl(cmd32->d[0])); 18239758b77fSLuigi Rizzo break; 18249758b77fSLuigi Rizzo 18259758b77fSLuigi Rizzo case O_UID: 18269758b77fSLuigi Rizzo { 18279758b77fSLuigi Rizzo struct passwd *pwd = getpwuid(cmd32->d[0]); 18289758b77fSLuigi Rizzo 18299758b77fSLuigi Rizzo if (pwd) 18309758b77fSLuigi Rizzo printf(" uid %s", pwd->pw_name); 18319758b77fSLuigi Rizzo else 18329758b77fSLuigi Rizzo printf(" uid %u", cmd32->d[0]); 18339758b77fSLuigi Rizzo } 18349758b77fSLuigi Rizzo break; 18359758b77fSLuigi Rizzo 18369758b77fSLuigi Rizzo case O_GID: 18379758b77fSLuigi Rizzo { 18389758b77fSLuigi Rizzo struct group *grp = getgrgid(cmd32->d[0]); 18399758b77fSLuigi Rizzo 18409758b77fSLuigi Rizzo if (grp) 18419758b77fSLuigi Rizzo printf(" gid %s", grp->gr_name); 18429758b77fSLuigi Rizzo else 18439758b77fSLuigi Rizzo printf(" gid %u", cmd32->d[0]); 18449758b77fSLuigi Rizzo } 18459758b77fSLuigi Rizzo break; 18469758b77fSLuigi Rizzo 184731c88a30SChristian S.J. Peron case O_JAIL: 184831c88a30SChristian S.J. Peron printf(" jail %d", cmd32->d[0]); 184931c88a30SChristian S.J. Peron break; 185031c88a30SChristian S.J. Peron 1851010dabb0SCrist J. Clark case O_VERREVPATH: 1852010dabb0SCrist J. Clark printf(" verrevpath"); 1853010dabb0SCrist J. Clark break; 1854010dabb0SCrist J. Clark 185522b5770bSAndre Oppermann case O_VERSRCREACH: 185622b5770bSAndre Oppermann printf(" versrcreach"); 185722b5770bSAndre Oppermann break; 185822b5770bSAndre Oppermann 18595f9541ecSAndre Oppermann case O_ANTISPOOF: 18605f9541ecSAndre Oppermann printf(" antispoof"); 18615f9541ecSAndre Oppermann break; 18625f9541ecSAndre Oppermann 1863c3e5b9f1SLuigi Rizzo case O_IPSEC: 1864c3e5b9f1SLuigi Rizzo printf(" ipsec"); 1865c3e5b9f1SLuigi Rizzo break; 1866c3e5b9f1SLuigi Rizzo 186762ff38aeSLuigi Rizzo case O_NOP: 1868bbc39c83SLuigi Rizzo comment = (char *)(cmd + 1); 186962ff38aeSLuigi Rizzo break; 187062ff38aeSLuigi Rizzo 18719758b77fSLuigi Rizzo case O_KEEP_STATE: 18729758b77fSLuigi Rizzo printf(" keep-state"); 18739758b77fSLuigi Rizzo break; 18749758b77fSLuigi Rizzo 18759758b77fSLuigi Rizzo case O_LIMIT: 18769758b77fSLuigi Rizzo { 18779758b77fSLuigi Rizzo struct _s_x *p = limit_masks; 18789758b77fSLuigi Rizzo ipfw_insn_limit *c = (ipfw_insn_limit *)cmd; 1879571f8c1bSLuigi Rizzo uint8_t x = c->limit_mask; 188062ff38aeSLuigi Rizzo char const *comma = " "; 18819758b77fSLuigi Rizzo 18829758b77fSLuigi Rizzo printf(" limit"); 18839758b77fSLuigi Rizzo for (; p->x != 0 ; p++) 18840a7197a8SLuigi Rizzo if ((x & p->x) == p->x) { 18859758b77fSLuigi Rizzo x &= ~p->x; 18869758b77fSLuigi Rizzo printf("%s%s", comma, p->s); 18879758b77fSLuigi Rizzo comma = ","; 18889758b77fSLuigi Rizzo } 18899758b77fSLuigi Rizzo printf(" %d", c->conn_limit); 18909758b77fSLuigi Rizzo } 18919758b77fSLuigi Rizzo break; 18929758b77fSLuigi Rizzo 18938195404bSBrooks Davis case O_IP6: 189436c263ccSHajimu UMEMOTO printf(" ip6"); 18958195404bSBrooks Davis break; 18968195404bSBrooks Davis 189757cd6d26SMax Laier case O_IP4: 189836c263ccSHajimu UMEMOTO printf(" ip4"); 189957cd6d26SMax Laier break; 190057cd6d26SMax Laier 19018195404bSBrooks Davis case O_ICMP6TYPE: 19028195404bSBrooks Davis print_icmp6types((ipfw_insn_u32 *)cmd); 19038195404bSBrooks Davis break; 19048195404bSBrooks Davis 19058195404bSBrooks Davis case O_EXT_HDR: 19068195404bSBrooks Davis print_ext6hdr( (ipfw_insn *) cmd ); 19078195404bSBrooks Davis break; 19088195404bSBrooks Davis 19099758b77fSLuigi Rizzo default: 19109758b77fSLuigi Rizzo printf(" [opcode %d len %d]", 19119758b77fSLuigi Rizzo cmd->opcode, cmd->len); 19129758b77fSLuigi Rizzo } 19139758b77fSLuigi Rizzo } 19149758b77fSLuigi Rizzo if (cmd->len & F_OR) { 19159758b77fSLuigi Rizzo printf(" or"); 19169758b77fSLuigi Rizzo or_block = 1; 19179758b77fSLuigi Rizzo } else if (or_block) { 19189758b77fSLuigi Rizzo printf(" }"); 19199758b77fSLuigi Rizzo or_block = 0; 19209758b77fSLuigi Rizzo } 19219758b77fSLuigi Rizzo } 1922e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_IP, 0); 1923bbc39c83SLuigi Rizzo if (comment) 1924bbc39c83SLuigi Rizzo printf(" // %s", comment); 19259758b77fSLuigi Rizzo printf("\n"); 19269758b77fSLuigi Rizzo } 19279758b77fSLuigi Rizzo 19289758b77fSLuigi Rizzo static void 192945f61351SMaxim Konovalov show_dyn_ipfw(ipfw_dyn_rule *d, int pcwidth, int bcwidth) 19309758b77fSLuigi Rizzo { 19319758b77fSLuigi Rizzo struct protoent *pe; 19329758b77fSLuigi Rizzo struct in_addr a; 1933330462a3SBernd Walter uint16_t rulenum; 19349758b77fSLuigi Rizzo 19359758b77fSLuigi Rizzo if (!do_expired) { 19369758b77fSLuigi Rizzo if (!d->expire && !(d->dyn_type == O_LIMIT_PARENT)) 19379758b77fSLuigi Rizzo return; 19389758b77fSLuigi Rizzo } 1939330462a3SBernd Walter bcopy(&d->rule, &rulenum, sizeof(rulenum)); 1940571f8c1bSLuigi Rizzo printf("%05d", rulenum); 194162ff38aeSLuigi Rizzo if (pcwidth>0 || bcwidth>0) 1942571f8c1bSLuigi Rizzo printf(" %*llu %*llu (%ds)", pcwidth, 1943330462a3SBernd Walter align_uint64(&d->pcnt), bcwidth, 1944330462a3SBernd Walter align_uint64(&d->bcnt), d->expire); 19459758b77fSLuigi Rizzo switch (d->dyn_type) { 19469758b77fSLuigi Rizzo case O_LIMIT_PARENT: 19479758b77fSLuigi Rizzo printf(" PARENT %d", d->count); 19489758b77fSLuigi Rizzo break; 19499758b77fSLuigi Rizzo case O_LIMIT: 19509758b77fSLuigi Rizzo printf(" LIMIT"); 19519758b77fSLuigi Rizzo break; 19529758b77fSLuigi Rizzo case O_KEEP_STATE: /* bidir, no mask */ 19539758b77fSLuigi Rizzo printf(" STATE"); 19549758b77fSLuigi Rizzo break; 19559758b77fSLuigi Rizzo } 19569758b77fSLuigi Rizzo 19579758b77fSLuigi Rizzo if ((pe = getprotobynumber(d->id.proto)) != NULL) 19589758b77fSLuigi Rizzo printf(" %s", pe->p_name); 19599758b77fSLuigi Rizzo else 19609758b77fSLuigi Rizzo printf(" proto %u", d->id.proto); 19619758b77fSLuigi Rizzo 19629758b77fSLuigi Rizzo a.s_addr = htonl(d->id.src_ip); 19639758b77fSLuigi Rizzo printf(" %s %d", inet_ntoa(a), d->id.src_port); 19649758b77fSLuigi Rizzo 19659758b77fSLuigi Rizzo a.s_addr = htonl(d->id.dst_ip); 19669758b77fSLuigi Rizzo printf(" <-> %s %d", inet_ntoa(a), d->id.dst_port); 19679758b77fSLuigi Rizzo printf("\n"); 19689758b77fSLuigi Rizzo } 19699758b77fSLuigi Rizzo 197062ff38aeSLuigi Rizzo static int 19719758b77fSLuigi Rizzo sort_q(const void *pa, const void *pb) 19729758b77fSLuigi Rizzo { 19739758b77fSLuigi Rizzo int rev = (do_sort < 0); 19749758b77fSLuigi Rizzo int field = rev ? -do_sort : do_sort; 19759758b77fSLuigi Rizzo long long res = 0; 19769758b77fSLuigi Rizzo const struct dn_flow_queue *a = pa; 19779758b77fSLuigi Rizzo const struct dn_flow_queue *b = pb; 19789758b77fSLuigi Rizzo 19799758b77fSLuigi Rizzo switch (field) { 19809758b77fSLuigi Rizzo case 1: /* pkts */ 19819758b77fSLuigi Rizzo res = a->len - b->len; 19829758b77fSLuigi Rizzo break; 19839758b77fSLuigi Rizzo case 2: /* bytes */ 19849758b77fSLuigi Rizzo res = a->len_bytes - b->len_bytes; 19859758b77fSLuigi Rizzo break; 19869758b77fSLuigi Rizzo 19879758b77fSLuigi Rizzo case 3: /* tot pkts */ 19889758b77fSLuigi Rizzo res = a->tot_pkts - b->tot_pkts; 19899758b77fSLuigi Rizzo break; 19909758b77fSLuigi Rizzo 19919758b77fSLuigi Rizzo case 4: /* tot bytes */ 19929758b77fSLuigi Rizzo res = a->tot_bytes - b->tot_bytes; 19939758b77fSLuigi Rizzo break; 19949758b77fSLuigi Rizzo } 19959758b77fSLuigi Rizzo if (res < 0) 19969758b77fSLuigi Rizzo res = -1; 19979758b77fSLuigi Rizzo if (res > 0) 19989758b77fSLuigi Rizzo res = 1; 19999758b77fSLuigi Rizzo return (int)(rev ? res : -res); 20009758b77fSLuigi Rizzo } 20019758b77fSLuigi Rizzo 20029758b77fSLuigi Rizzo static void 20039758b77fSLuigi Rizzo list_queues(struct dn_flow_set *fs, struct dn_flow_queue *q) 20049758b77fSLuigi Rizzo { 20059758b77fSLuigi Rizzo int l; 20068195404bSBrooks Davis int index_printed, indexes = 0; 20078195404bSBrooks Davis char buff[255]; 20088195404bSBrooks Davis struct protoent *pe; 20099758b77fSLuigi Rizzo 20109758b77fSLuigi Rizzo if (fs->rq_elements == 0) 20119758b77fSLuigi Rizzo return; 20129758b77fSLuigi Rizzo 20139758b77fSLuigi Rizzo if (do_sort != 0) 20149758b77fSLuigi Rizzo heapsort(q, fs->rq_elements, sizeof *q, sort_q); 20158195404bSBrooks Davis 20168195404bSBrooks Davis /* Print IPv4 flows */ 20178195404bSBrooks Davis index_printed = 0; 20189758b77fSLuigi Rizzo for (l = 0; l < fs->rq_elements; l++) { 20199758b77fSLuigi Rizzo struct in_addr ina; 20209758b77fSLuigi Rizzo 20218195404bSBrooks Davis /* XXX: Should check for IPv4 flows */ 20228195404bSBrooks Davis if (IS_IP6_FLOW_ID(&(q[l].id))) 20238195404bSBrooks Davis continue; 20248195404bSBrooks Davis 20258195404bSBrooks Davis if (!index_printed) { 20268195404bSBrooks Davis index_printed = 1; 20278195404bSBrooks Davis if (indexes > 0) /* currently a no-op */ 20288195404bSBrooks Davis printf("\n"); 20298195404bSBrooks Davis indexes++; 20308195404bSBrooks Davis printf(" " 20318195404bSBrooks Davis "mask: 0x%02x 0x%08x/0x%04x -> 0x%08x/0x%04x\n", 20328195404bSBrooks Davis fs->flow_mask.proto, 20338195404bSBrooks Davis fs->flow_mask.src_ip, fs->flow_mask.src_port, 20348195404bSBrooks Davis fs->flow_mask.dst_ip, fs->flow_mask.dst_port); 20358195404bSBrooks Davis 20368195404bSBrooks Davis printf("BKT Prot ___Source IP/port____ " 20378195404bSBrooks Davis "____Dest. IP/port____ " 20388195404bSBrooks Davis "Tot_pkt/bytes Pkt/Byte Drp\n"); 20398195404bSBrooks Davis } 20408195404bSBrooks Davis 20419758b77fSLuigi Rizzo printf("%3d ", q[l].hash_slot); 20429758b77fSLuigi Rizzo pe = getprotobynumber(q[l].id.proto); 20439758b77fSLuigi Rizzo if (pe) 20449758b77fSLuigi Rizzo printf("%-4s ", pe->p_name); 20459758b77fSLuigi Rizzo else 20469758b77fSLuigi Rizzo printf("%4u ", q[l].id.proto); 20478195404bSBrooks Davis ina.s_addr = htonl(q[l].id.src_ip); 20489758b77fSLuigi Rizzo printf("%15s/%-5d ", 20499758b77fSLuigi Rizzo inet_ntoa(ina), q[l].id.src_port); 20509758b77fSLuigi Rizzo ina.s_addr = htonl(q[l].id.dst_ip); 20519758b77fSLuigi Rizzo printf("%15s/%-5d ", 20529758b77fSLuigi Rizzo inet_ntoa(ina), q[l].id.dst_port); 20539758b77fSLuigi Rizzo printf("%4qu %8qu %2u %4u %3u\n", 20549758b77fSLuigi Rizzo q[l].tot_pkts, q[l].tot_bytes, 20559758b77fSLuigi Rizzo q[l].len, q[l].len_bytes, q[l].drops); 20569758b77fSLuigi Rizzo if (verbose) 20579758b77fSLuigi Rizzo printf(" S %20qd F %20qd\n", 20589758b77fSLuigi Rizzo q[l].S, q[l].F); 20599758b77fSLuigi Rizzo } 20608195404bSBrooks Davis 20618195404bSBrooks Davis /* Print IPv6 flows */ 20628195404bSBrooks Davis index_printed = 0; 20638195404bSBrooks Davis for (l = 0; l < fs->rq_elements; l++) { 20648195404bSBrooks Davis if (!IS_IP6_FLOW_ID(&(q[l].id))) 20658195404bSBrooks Davis continue; 20668195404bSBrooks Davis 20678195404bSBrooks Davis if (!index_printed) { 20688195404bSBrooks Davis index_printed = 1; 20698195404bSBrooks Davis if (indexes > 0) 20708195404bSBrooks Davis printf("\n"); 20718195404bSBrooks Davis indexes++; 20728195404bSBrooks Davis printf("\n mask: proto: 0x%02x, flow_id: 0x%08x, ", 20738195404bSBrooks Davis fs->flow_mask.proto, fs->flow_mask.flow_id6); 20748195404bSBrooks Davis inet_ntop(AF_INET6, &(fs->flow_mask.src_ip6), 20758195404bSBrooks Davis buff, sizeof(buff)); 20768195404bSBrooks Davis printf("%s/0x%04x -> ", buff, fs->flow_mask.src_port); 20778195404bSBrooks Davis inet_ntop( AF_INET6, &(fs->flow_mask.dst_ip6), 20788195404bSBrooks Davis buff, sizeof(buff) ); 20798195404bSBrooks Davis printf("%s/0x%04x\n", buff, fs->flow_mask.dst_port); 20808195404bSBrooks Davis 20818195404bSBrooks Davis printf("BKT ___Prot___ _flow-id_ " 20828195404bSBrooks Davis "______________Source IPv6/port_______________ " 20838195404bSBrooks Davis "_______________Dest. IPv6/port_______________ " 20848195404bSBrooks Davis "Tot_pkt/bytes Pkt/Byte Drp\n"); 20858195404bSBrooks Davis } 20868195404bSBrooks Davis printf("%3d ", q[l].hash_slot); 20878195404bSBrooks Davis pe = getprotobynumber(q[l].id.proto); 20888195404bSBrooks Davis if (pe != NULL) 20898195404bSBrooks Davis printf("%9s ", pe->p_name); 20908195404bSBrooks Davis else 20918195404bSBrooks Davis printf("%9u ", q[l].id.proto); 20928195404bSBrooks Davis printf("%7d %39s/%-5d ", q[l].id.flow_id6, 20938195404bSBrooks Davis inet_ntop(AF_INET6, &(q[l].id.src_ip6), buff, sizeof(buff)), 20948195404bSBrooks Davis q[l].id.src_port); 20958195404bSBrooks Davis printf(" %39s/%-5d ", 20968195404bSBrooks Davis inet_ntop(AF_INET6, &(q[l].id.dst_ip6), buff, sizeof(buff)), 20978195404bSBrooks Davis q[l].id.dst_port); 20988195404bSBrooks Davis printf(" %4qu %8qu %2u %4u %3u\n", 20998195404bSBrooks Davis q[l].tot_pkts, q[l].tot_bytes, 21008195404bSBrooks Davis q[l].len, q[l].len_bytes, q[l].drops); 21018195404bSBrooks Davis if (verbose) 21028195404bSBrooks Davis printf(" S %20qd F %20qd\n", q[l].S, q[l].F); 21038195404bSBrooks Davis } 21049758b77fSLuigi Rizzo } 21059758b77fSLuigi Rizzo 21069758b77fSLuigi Rizzo static void 21079758b77fSLuigi Rizzo print_flowset_parms(struct dn_flow_set *fs, char *prefix) 21089758b77fSLuigi Rizzo { 21099758b77fSLuigi Rizzo int l; 21109758b77fSLuigi Rizzo char qs[30]; 21119758b77fSLuigi Rizzo char plr[30]; 21129758b77fSLuigi Rizzo char red[90]; /* Display RED parameters */ 21139758b77fSLuigi Rizzo 21149758b77fSLuigi Rizzo l = fs->qsize; 21159758b77fSLuigi Rizzo if (fs->flags_fs & DN_QSIZE_IS_BYTES) { 21169758b77fSLuigi Rizzo if (l >= 8192) 21179758b77fSLuigi Rizzo sprintf(qs, "%d KB", l / 1024); 21189758b77fSLuigi Rizzo else 21199758b77fSLuigi Rizzo sprintf(qs, "%d B", l); 21209758b77fSLuigi Rizzo } else 21219758b77fSLuigi Rizzo sprintf(qs, "%3d sl.", l); 21229758b77fSLuigi Rizzo if (fs->plr) 21239758b77fSLuigi Rizzo sprintf(plr, "plr %f", 1.0 * fs->plr / (double)(0x7fffffff)); 21249758b77fSLuigi Rizzo else 21259758b77fSLuigi Rizzo plr[0] = '\0'; 21269758b77fSLuigi Rizzo if (fs->flags_fs & DN_IS_RED) /* RED parameters */ 21279758b77fSLuigi Rizzo sprintf(red, 21289758b77fSLuigi Rizzo "\n\t %cRED w_q %f min_th %d max_th %d max_p %f", 21299758b77fSLuigi Rizzo (fs->flags_fs & DN_IS_GENTLE_RED) ? 'G' : ' ', 21309758b77fSLuigi Rizzo 1.0 * fs->w_q / (double)(1 << SCALE_RED), 21319758b77fSLuigi Rizzo SCALE_VAL(fs->min_th), 21329758b77fSLuigi Rizzo SCALE_VAL(fs->max_th), 21339758b77fSLuigi Rizzo 1.0 * fs->max_p / (double)(1 << SCALE_RED)); 21349758b77fSLuigi Rizzo else 21359758b77fSLuigi Rizzo sprintf(red, "droptail"); 21369758b77fSLuigi Rizzo 21379758b77fSLuigi Rizzo printf("%s %s%s %d queues (%d buckets) %s\n", 21389758b77fSLuigi Rizzo prefix, qs, plr, fs->rq_elements, fs->rq_size, red); 21399758b77fSLuigi Rizzo } 21409758b77fSLuigi Rizzo 21419758b77fSLuigi Rizzo static void 214262ff38aeSLuigi Rizzo list_pipes(void *data, uint nbytes, int ac, char *av[]) 21439758b77fSLuigi Rizzo { 214462ff38aeSLuigi Rizzo int rulenum; 21459758b77fSLuigi Rizzo void *next = data; 21469758b77fSLuigi Rizzo struct dn_pipe *p = (struct dn_pipe *) data; 21479758b77fSLuigi Rizzo struct dn_flow_set *fs; 21489758b77fSLuigi Rizzo struct dn_flow_queue *q; 21499758b77fSLuigi Rizzo int l; 21509758b77fSLuigi Rizzo 21519758b77fSLuigi Rizzo if (ac > 0) 21529758b77fSLuigi Rizzo rulenum = strtoul(*av++, NULL, 10); 21539758b77fSLuigi Rizzo else 21549758b77fSLuigi Rizzo rulenum = 0; 21559758b77fSLuigi Rizzo for (; nbytes >= sizeof *p; p = (struct dn_pipe *)next) { 21569758b77fSLuigi Rizzo double b = p->bandwidth; 21579758b77fSLuigi Rizzo char buf[30]; 21589758b77fSLuigi Rizzo char prefix[80]; 21599758b77fSLuigi Rizzo 2160e36ffd3bSGleb Smirnoff if (p->next.sle_next != (struct dn_pipe *)DN_IS_PIPE) 21619758b77fSLuigi Rizzo break; /* done with pipes, now queues */ 21629758b77fSLuigi Rizzo 21639758b77fSLuigi Rizzo /* 21649758b77fSLuigi Rizzo * compute length, as pipe have variable size 21659758b77fSLuigi Rizzo */ 21669758b77fSLuigi Rizzo l = sizeof(*p) + p->fs.rq_elements * sizeof(*q); 216762ff38aeSLuigi Rizzo next = (char *)p + l; 21689758b77fSLuigi Rizzo nbytes -= l; 21699758b77fSLuigi Rizzo 2170c3d6fe74SPawel Jakub Dawidek if ((rulenum != 0 && rulenum != p->pipe_nr) || do_pipe == 2) 21719758b77fSLuigi Rizzo continue; 21729758b77fSLuigi Rizzo 21739758b77fSLuigi Rizzo /* 21749758b77fSLuigi Rizzo * Print rate (or clocking interface) 21759758b77fSLuigi Rizzo */ 21769758b77fSLuigi Rizzo if (p->if_name[0] != '\0') 21779758b77fSLuigi Rizzo sprintf(buf, "%s", p->if_name); 21789758b77fSLuigi Rizzo else if (b == 0) 21799758b77fSLuigi Rizzo sprintf(buf, "unlimited"); 21809758b77fSLuigi Rizzo else if (b >= 1000000) 21819758b77fSLuigi Rizzo sprintf(buf, "%7.3f Mbit/s", b/1000000); 21829758b77fSLuigi Rizzo else if (b >= 1000) 21839758b77fSLuigi Rizzo sprintf(buf, "%7.3f Kbit/s", b/1000); 21849758b77fSLuigi Rizzo else 21859758b77fSLuigi Rizzo sprintf(buf, "%7.3f bit/s ", b); 21869758b77fSLuigi Rizzo 21879758b77fSLuigi Rizzo sprintf(prefix, "%05d: %s %4d ms ", 21889758b77fSLuigi Rizzo p->pipe_nr, buf, p->delay); 21899758b77fSLuigi Rizzo print_flowset_parms(&(p->fs), prefix); 21909758b77fSLuigi Rizzo if (verbose) 21919758b77fSLuigi Rizzo printf(" V %20qd\n", p->V >> MY_M); 21929758b77fSLuigi Rizzo 21939758b77fSLuigi Rizzo q = (struct dn_flow_queue *)(p+1); 21949758b77fSLuigi Rizzo list_queues(&(p->fs), q); 21959758b77fSLuigi Rizzo } 21969758b77fSLuigi Rizzo for (fs = next; nbytes >= sizeof *fs; fs = next) { 21979758b77fSLuigi Rizzo char prefix[80]; 21989758b77fSLuigi Rizzo 2199e36ffd3bSGleb Smirnoff if (fs->next.sle_next != (struct dn_flow_set *)DN_IS_QUEUE) 22009758b77fSLuigi Rizzo break; 22019758b77fSLuigi Rizzo l = sizeof(*fs) + fs->rq_elements * sizeof(*q); 220262ff38aeSLuigi Rizzo next = (char *)fs + l; 22039758b77fSLuigi Rizzo nbytes -= l; 2204c3d6fe74SPawel Jakub Dawidek 2205c3d6fe74SPawel Jakub Dawidek if (rulenum != 0 && ((rulenum != fs->fs_nr && do_pipe == 2) || 2206c3d6fe74SPawel Jakub Dawidek (rulenum != fs->parent_nr && do_pipe == 1))) { 2207c3d6fe74SPawel Jakub Dawidek continue; 2208c3d6fe74SPawel Jakub Dawidek } 2209c3d6fe74SPawel Jakub Dawidek 22109758b77fSLuigi Rizzo q = (struct dn_flow_queue *)(fs+1); 22119758b77fSLuigi Rizzo sprintf(prefix, "q%05d: weight %d pipe %d ", 22129758b77fSLuigi Rizzo fs->fs_nr, fs->weight, fs->parent_nr); 22139758b77fSLuigi Rizzo print_flowset_parms(fs, prefix); 22149758b77fSLuigi Rizzo list_queues(fs, q); 22159758b77fSLuigi Rizzo } 22169758b77fSLuigi Rizzo } 22179758b77fSLuigi Rizzo 221899e5e645SLuigi Rizzo /* 221999e5e645SLuigi Rizzo * This one handles all set-related commands 222099e5e645SLuigi Rizzo * ipfw set { show | enable | disable } 222199e5e645SLuigi Rizzo * ipfw set swap X Y 222299e5e645SLuigi Rizzo * ipfw set move X to Y 222399e5e645SLuigi Rizzo * ipfw set move rule X to Y 222499e5e645SLuigi Rizzo */ 222599e5e645SLuigi Rizzo static void 222699e5e645SLuigi Rizzo sets_handler(int ac, char *av[]) 222799e5e645SLuigi Rizzo { 2228571f8c1bSLuigi Rizzo uint32_t set_disable, masks[2]; 222999e5e645SLuigi Rizzo int i, nbytes; 2230571f8c1bSLuigi Rizzo uint16_t rulenum; 2231571f8c1bSLuigi Rizzo uint8_t cmd, new_set; 223299e5e645SLuigi Rizzo 223399e5e645SLuigi Rizzo ac--; 223499e5e645SLuigi Rizzo av++; 223599e5e645SLuigi Rizzo 223699e5e645SLuigi Rizzo if (!ac) 223799e5e645SLuigi Rizzo errx(EX_USAGE, "set needs command"); 223801750186SBrooks Davis if (_substrcmp(*av, "show") == 0) { 223999e5e645SLuigi Rizzo void *data; 224062ff38aeSLuigi Rizzo char const *msg; 224199e5e645SLuigi Rizzo 224299e5e645SLuigi Rizzo nbytes = sizeof(struct ip_fw); 2243571f8c1bSLuigi Rizzo if ((data = calloc(1, nbytes)) == NULL) 2244571f8c1bSLuigi Rizzo err(EX_OSERR, "calloc"); 2245884be75cSThomas Moestl if (do_cmd(IP_FW_GET, data, (uintptr_t)&nbytes) < 0) 224699e5e645SLuigi Rizzo err(EX_OSERR, "getsockopt(IP_FW_GET)"); 2247330462a3SBernd Walter bcopy(&((struct ip_fw *)data)->next_rule, 2248330462a3SBernd Walter &set_disable, sizeof(set_disable)); 2249330462a3SBernd Walter 22503004afcaSLuigi Rizzo for (i = 0, msg = "disable" ; i < RESVD_SET; i++) 225199e5e645SLuigi Rizzo if ((set_disable & (1<<i))) { 225299e5e645SLuigi Rizzo printf("%s %d", msg, i); 225399e5e645SLuigi Rizzo msg = ""; 225499e5e645SLuigi Rizzo } 225599e5e645SLuigi Rizzo msg = (set_disable) ? " enable" : "enable"; 22563004afcaSLuigi Rizzo for (i = 0; i < RESVD_SET; i++) 225799e5e645SLuigi Rizzo if (!(set_disable & (1<<i))) { 225899e5e645SLuigi Rizzo printf("%s %d", msg, i); 225999e5e645SLuigi Rizzo msg = ""; 226099e5e645SLuigi Rizzo } 226199e5e645SLuigi Rizzo printf("\n"); 226201750186SBrooks Davis } else if (_substrcmp(*av, "swap") == 0) { 226399e5e645SLuigi Rizzo ac--; av++; 226499e5e645SLuigi Rizzo if (ac != 2) 226599e5e645SLuigi Rizzo errx(EX_USAGE, "set swap needs 2 set numbers\n"); 226699e5e645SLuigi Rizzo rulenum = atoi(av[0]); 226799e5e645SLuigi Rizzo new_set = atoi(av[1]); 22683004afcaSLuigi Rizzo if (!isdigit(*(av[0])) || rulenum > RESVD_SET) 226999e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid set number %s\n", av[0]); 22703004afcaSLuigi Rizzo if (!isdigit(*(av[1])) || new_set > RESVD_SET) 227199e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid set number %s\n", av[1]); 227299e5e645SLuigi Rizzo masks[0] = (4 << 24) | (new_set << 16) | (rulenum); 2273571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, masks, sizeof(uint32_t)); 227401750186SBrooks Davis } else if (_substrcmp(*av, "move") == 0) { 227599e5e645SLuigi Rizzo ac--; av++; 227601750186SBrooks Davis if (ac && _substrcmp(*av, "rule") == 0) { 227799e5e645SLuigi Rizzo cmd = 2; 227899e5e645SLuigi Rizzo ac--; av++; 227999e5e645SLuigi Rizzo } else 228099e5e645SLuigi Rizzo cmd = 3; 228101750186SBrooks Davis if (ac != 3 || _substrcmp(av[1], "to") != 0) 228299e5e645SLuigi Rizzo errx(EX_USAGE, "syntax: set move [rule] X to Y\n"); 228399e5e645SLuigi Rizzo rulenum = atoi(av[0]); 228499e5e645SLuigi Rizzo new_set = atoi(av[2]); 22853004afcaSLuigi Rizzo if (!isdigit(*(av[0])) || (cmd == 3 && rulenum > RESVD_SET) || 228699e5e645SLuigi Rizzo (cmd == 2 && rulenum == 65535) ) 228799e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid source number %s\n", av[0]); 22883004afcaSLuigi Rizzo if (!isdigit(*(av[2])) || new_set > RESVD_SET) 228999e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid dest. set %s\n", av[1]); 229099e5e645SLuigi Rizzo masks[0] = (cmd << 24) | (new_set << 16) | (rulenum); 2291571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, masks, sizeof(uint32_t)); 229201750186SBrooks Davis } else if (_substrcmp(*av, "disable") == 0 || 229301750186SBrooks Davis _substrcmp(*av, "enable") == 0 ) { 229401750186SBrooks Davis int which = _substrcmp(*av, "enable") == 0 ? 1 : 0; 229599e5e645SLuigi Rizzo 229699e5e645SLuigi Rizzo ac--; av++; 229799e5e645SLuigi Rizzo masks[0] = masks[1] = 0; 229899e5e645SLuigi Rizzo 229999e5e645SLuigi Rizzo while (ac) { 230099e5e645SLuigi Rizzo if (isdigit(**av)) { 230199e5e645SLuigi Rizzo i = atoi(*av); 23023004afcaSLuigi Rizzo if (i < 0 || i > RESVD_SET) 230399e5e645SLuigi Rizzo errx(EX_DATAERR, 230499e5e645SLuigi Rizzo "invalid set number %d\n", i); 230599e5e645SLuigi Rizzo masks[which] |= (1<<i); 230601750186SBrooks Davis } else if (_substrcmp(*av, "disable") == 0) 230799e5e645SLuigi Rizzo which = 0; 230801750186SBrooks Davis else if (_substrcmp(*av, "enable") == 0) 230999e5e645SLuigi Rizzo which = 1; 231099e5e645SLuigi Rizzo else 231199e5e645SLuigi Rizzo errx(EX_DATAERR, 231299e5e645SLuigi Rizzo "invalid set command %s\n", *av); 231399e5e645SLuigi Rizzo av++; ac--; 231499e5e645SLuigi Rizzo } 231599e5e645SLuigi Rizzo if ( (masks[0] & masks[1]) != 0 ) 231699e5e645SLuigi Rizzo errx(EX_DATAERR, 231799e5e645SLuigi Rizzo "cannot enable and disable the same set\n"); 231899e5e645SLuigi Rizzo 2319571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, masks, sizeof(masks)); 232099e5e645SLuigi Rizzo if (i) 232199e5e645SLuigi Rizzo warn("set enable/disable: setsockopt(IP_FW_DEL)"); 232299e5e645SLuigi Rizzo } else 232399e5e645SLuigi Rizzo errx(EX_USAGE, "invalid set command %s\n", *av); 232499e5e645SLuigi Rizzo } 232599e5e645SLuigi Rizzo 23269758b77fSLuigi Rizzo static void 23276690be9eSMatthew Dillon sysctl_handler(int ac, char *av[], int which) 23286690be9eSMatthew Dillon { 23296690be9eSMatthew Dillon ac--; 23306690be9eSMatthew Dillon av++; 23316690be9eSMatthew Dillon 23321c56ad9bSMaxim Konovalov if (ac == 0) { 23336690be9eSMatthew Dillon warnx("missing keyword to enable/disable\n"); 233401750186SBrooks Davis } else if (_substrcmp(*av, "firewall") == 0) { 233529c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.enable", NULL, 0, 233629c1402aSLuigi Rizzo &which, sizeof(which)); 233701750186SBrooks Davis } else if (_substrcmp(*av, "one_pass") == 0) { 233829c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.one_pass", NULL, 0, 233929c1402aSLuigi Rizzo &which, sizeof(which)); 234001750186SBrooks Davis } else if (_substrcmp(*av, "debug") == 0) { 234129c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.debug", NULL, 0, 234229c1402aSLuigi Rizzo &which, sizeof(which)); 234301750186SBrooks Davis } else if (_substrcmp(*av, "verbose") == 0) { 234429c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.verbose", NULL, 0, 234529c1402aSLuigi Rizzo &which, sizeof(which)); 234601750186SBrooks Davis } else if (_substrcmp(*av, "dyn_keepalive") == 0) { 234729c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0, 234829c1402aSLuigi Rizzo &which, sizeof(which)); 234901750186SBrooks Davis } else if (_substrcmp(*av, "altq") == 0) { 2350974dfe30SBrian Feldman altq_set_enabled(which); 23516690be9eSMatthew Dillon } else { 23526690be9eSMatthew Dillon warnx("unrecognize enable/disable keyword: %s\n", *av); 23536690be9eSMatthew Dillon } 23546690be9eSMatthew Dillon } 23556690be9eSMatthew Dillon 23566690be9eSMatthew Dillon static void 235762ff38aeSLuigi Rizzo list(int ac, char *av[], int show_counters) 23589758b77fSLuigi Rizzo { 23599758b77fSLuigi Rizzo struct ip_fw *r; 23609758b77fSLuigi Rizzo ipfw_dyn_rule *dynrules, *d; 23619758b77fSLuigi Rizzo 236262ff38aeSLuigi Rizzo #define NEXT(r) ((struct ip_fw *)((char *)r + RULESIZE(r))) 236362ff38aeSLuigi Rizzo char *lim; 236462ff38aeSLuigi Rizzo void *data = NULL; 236545f61351SMaxim Konovalov int bcwidth, n, nbytes, nstat, ndyn, pcwidth, width; 23669758b77fSLuigi Rizzo int exitval = EX_OK; 23679758b77fSLuigi Rizzo int lac; 23689758b77fSLuigi Rizzo char **lav; 236962ff38aeSLuigi Rizzo u_long rnum, last; 23709758b77fSLuigi Rizzo char *endptr; 23719758b77fSLuigi Rizzo int seen = 0; 23729758b77fSLuigi Rizzo 23739758b77fSLuigi Rizzo const int ocmd = do_pipe ? IP_DUMMYNET_GET : IP_FW_GET; 23749758b77fSLuigi Rizzo int nalloc = 1024; /* start somewhere... */ 23759758b77fSLuigi Rizzo 237600ed6609SMaxim Konovalov last = 0; 237700ed6609SMaxim Konovalov 2378571f8c1bSLuigi Rizzo if (test_only) { 2379571f8c1bSLuigi Rizzo fprintf(stderr, "Testing only, list disabled\n"); 2380571f8c1bSLuigi Rizzo return; 2381571f8c1bSLuigi Rizzo } 2382571f8c1bSLuigi Rizzo 23839758b77fSLuigi Rizzo ac--; 23849758b77fSLuigi Rizzo av++; 23859758b77fSLuigi Rizzo 23869758b77fSLuigi Rizzo /* get rules or pipes from kernel, resizing array as necessary */ 23879758b77fSLuigi Rizzo nbytes = nalloc; 23889758b77fSLuigi Rizzo 23899758b77fSLuigi Rizzo while (nbytes >= nalloc) { 23909758b77fSLuigi Rizzo nalloc = nalloc * 2 + 200; 23919758b77fSLuigi Rizzo nbytes = nalloc; 23929758b77fSLuigi Rizzo if ((data = realloc(data, nbytes)) == NULL) 23939758b77fSLuigi Rizzo err(EX_OSERR, "realloc"); 2394884be75cSThomas Moestl if (do_cmd(ocmd, data, (uintptr_t)&nbytes) < 0) 23959758b77fSLuigi Rizzo err(EX_OSERR, "getsockopt(IP_%s_GET)", 23969758b77fSLuigi Rizzo do_pipe ? "DUMMYNET" : "FW"); 23979758b77fSLuigi Rizzo } 23989758b77fSLuigi Rizzo 23999758b77fSLuigi Rizzo if (do_pipe) { 24009758b77fSLuigi Rizzo list_pipes(data, nbytes, ac, av); 24019758b77fSLuigi Rizzo goto done; 24029758b77fSLuigi Rizzo } 24039758b77fSLuigi Rizzo 24049758b77fSLuigi Rizzo /* 24059758b77fSLuigi Rizzo * Count static rules. They have variable size so we 24069758b77fSLuigi Rizzo * need to scan the list to count them. 24079758b77fSLuigi Rizzo */ 240862ff38aeSLuigi Rizzo for (nstat = 1, r = data, lim = (char *)data + nbytes; 240962ff38aeSLuigi Rizzo r->rulenum < 65535 && (char *)r < lim; 241062ff38aeSLuigi Rizzo ++nstat, r = NEXT(r) ) 24119758b77fSLuigi Rizzo ; /* nothing */ 24129758b77fSLuigi Rizzo 24139758b77fSLuigi Rizzo /* 24149758b77fSLuigi Rizzo * Count dynamic rules. This is easier as they have 24159758b77fSLuigi Rizzo * fixed size. 24169758b77fSLuigi Rizzo */ 241762ff38aeSLuigi Rizzo r = NEXT(r); 24189758b77fSLuigi Rizzo dynrules = (ipfw_dyn_rule *)r ; 241962ff38aeSLuigi Rizzo n = (char *)r - (char *)data; 24209758b77fSLuigi Rizzo ndyn = (nbytes - n) / sizeof *dynrules; 24219758b77fSLuigi Rizzo 242245f61351SMaxim Konovalov /* if showing stats, figure out column widths ahead of time */ 242345f61351SMaxim Konovalov bcwidth = pcwidth = 0; 242462ff38aeSLuigi Rizzo if (show_counters) { 242562ff38aeSLuigi Rizzo for (n = 0, r = data; n < nstat; n++, r = NEXT(r)) { 242645f61351SMaxim Konovalov /* packet counter */ 2427330462a3SBernd Walter width = snprintf(NULL, 0, "%llu", 2428330462a3SBernd Walter align_uint64(&r->pcnt)); 242945f61351SMaxim Konovalov if (width > pcwidth) 243045f61351SMaxim Konovalov pcwidth = width; 243145f61351SMaxim Konovalov 243245f61351SMaxim Konovalov /* byte counter */ 2433330462a3SBernd Walter width = snprintf(NULL, 0, "%llu", 2434330462a3SBernd Walter align_uint64(&r->bcnt)); 243545f61351SMaxim Konovalov if (width > bcwidth) 243645f61351SMaxim Konovalov bcwidth = width; 243745f61351SMaxim Konovalov } 243845f61351SMaxim Konovalov } 243945f61351SMaxim Konovalov if (do_dynamic && ndyn) { 244045f61351SMaxim Konovalov for (n = 0, d = dynrules; n < ndyn; n++, d++) { 2441330462a3SBernd Walter width = snprintf(NULL, 0, "%llu", 2442330462a3SBernd Walter align_uint64(&d->pcnt)); 244345f61351SMaxim Konovalov if (width > pcwidth) 244445f61351SMaxim Konovalov pcwidth = width; 244545f61351SMaxim Konovalov 2446330462a3SBernd Walter width = snprintf(NULL, 0, "%llu", 2447330462a3SBernd Walter align_uint64(&d->bcnt)); 244845f61351SMaxim Konovalov if (width > bcwidth) 244945f61351SMaxim Konovalov bcwidth = width; 245045f61351SMaxim Konovalov } 245145f61351SMaxim Konovalov } 24529758b77fSLuigi Rizzo /* if no rule numbers were specified, list all rules */ 24539758b77fSLuigi Rizzo if (ac == 0) { 245462ff38aeSLuigi Rizzo for (n = 0, r = data; n < nstat; n++, r = NEXT(r) ) 245545f61351SMaxim Konovalov show_ipfw(r, pcwidth, bcwidth); 24569758b77fSLuigi Rizzo 24579758b77fSLuigi Rizzo if (do_dynamic && ndyn) { 24589758b77fSLuigi Rizzo printf("## Dynamic rules (%d):\n", ndyn); 24599758b77fSLuigi Rizzo for (n = 0, d = dynrules; n < ndyn; n++, d++) 246045f61351SMaxim Konovalov show_dyn_ipfw(d, pcwidth, bcwidth); 24619758b77fSLuigi Rizzo } 24629758b77fSLuigi Rizzo goto done; 24639758b77fSLuigi Rizzo } 24649758b77fSLuigi Rizzo 24659758b77fSLuigi Rizzo /* display specific rules requested on command line */ 24669758b77fSLuigi Rizzo 24679758b77fSLuigi Rizzo for (lac = ac, lav = av; lac != 0; lac--) { 24689758b77fSLuigi Rizzo /* convert command line rule # */ 246962ff38aeSLuigi Rizzo last = rnum = strtoul(*lav++, &endptr, 10); 247062ff38aeSLuigi Rizzo if (*endptr == '-') 247162ff38aeSLuigi Rizzo last = strtoul(endptr+1, &endptr, 10); 24729758b77fSLuigi Rizzo if (*endptr) { 24739758b77fSLuigi Rizzo exitval = EX_USAGE; 24749758b77fSLuigi Rizzo warnx("invalid rule number: %s", *(lav - 1)); 24759758b77fSLuigi Rizzo continue; 24769758b77fSLuigi Rizzo } 247762ff38aeSLuigi Rizzo for (n = seen = 0, r = data; n < nstat; n++, r = NEXT(r) ) { 247862ff38aeSLuigi Rizzo if (r->rulenum > last) 24799758b77fSLuigi Rizzo break; 248062ff38aeSLuigi Rizzo if (r->rulenum >= rnum && r->rulenum <= last) { 248145f61351SMaxim Konovalov show_ipfw(r, pcwidth, bcwidth); 24829758b77fSLuigi Rizzo seen = 1; 24839758b77fSLuigi Rizzo } 24849758b77fSLuigi Rizzo } 24859758b77fSLuigi Rizzo if (!seen) { 24869758b77fSLuigi Rizzo /* give precedence to other error(s) */ 24879758b77fSLuigi Rizzo if (exitval == EX_OK) 24889758b77fSLuigi Rizzo exitval = EX_UNAVAILABLE; 24899758b77fSLuigi Rizzo warnx("rule %lu does not exist", rnum); 24909758b77fSLuigi Rizzo } 24919758b77fSLuigi Rizzo } 24929758b77fSLuigi Rizzo 24939758b77fSLuigi Rizzo if (do_dynamic && ndyn) { 24949758b77fSLuigi Rizzo printf("## Dynamic rules:\n"); 24959758b77fSLuigi Rizzo for (lac = ac, lav = av; lac != 0; lac--) { 24968195404bSBrooks Davis last = rnum = strtoul(*lav++, &endptr, 10); 249762ff38aeSLuigi Rizzo if (*endptr == '-') 249862ff38aeSLuigi Rizzo last = strtoul(endptr+1, &endptr, 10); 24999758b77fSLuigi Rizzo if (*endptr) 25009758b77fSLuigi Rizzo /* already warned */ 25019758b77fSLuigi Rizzo continue; 25029758b77fSLuigi Rizzo for (n = 0, d = dynrules; n < ndyn; n++, d++) { 2503330462a3SBernd Walter uint16_t rulenum; 2504330462a3SBernd Walter 2505330462a3SBernd Walter bcopy(&d->rule, &rulenum, sizeof(rulenum)); 2506330462a3SBernd Walter if (rulenum > rnum) 25079758b77fSLuigi Rizzo break; 250862ff38aeSLuigi Rizzo if (r->rulenum >= rnum && r->rulenum <= last) 250945f61351SMaxim Konovalov show_dyn_ipfw(d, pcwidth, bcwidth); 25109758b77fSLuigi Rizzo } 25119758b77fSLuigi Rizzo } 25129758b77fSLuigi Rizzo } 25139758b77fSLuigi Rizzo 25149758b77fSLuigi Rizzo ac = 0; 25159758b77fSLuigi Rizzo 25169758b77fSLuigi Rizzo done: 25179758b77fSLuigi Rizzo free(data); 25189758b77fSLuigi Rizzo 25199758b77fSLuigi Rizzo if (exitval != EX_OK) 25209758b77fSLuigi Rizzo exit(exitval); 252162ff38aeSLuigi Rizzo #undef NEXT 25229758b77fSLuigi Rizzo } 25239758b77fSLuigi Rizzo 25249758b77fSLuigi Rizzo static void 25259758b77fSLuigi Rizzo show_usage(void) 25269758b77fSLuigi Rizzo { 25279758b77fSLuigi Rizzo fprintf(stderr, "usage: ipfw [options]\n" 25289758b77fSLuigi Rizzo "do \"ipfw -h\" or see ipfw manpage for details\n" 25299758b77fSLuigi Rizzo ); 25309758b77fSLuigi Rizzo exit(EX_USAGE); 25319758b77fSLuigi Rizzo } 25329758b77fSLuigi Rizzo 25339758b77fSLuigi Rizzo static void 25349758b77fSLuigi Rizzo help(void) 25359758b77fSLuigi Rizzo { 2536571f8c1bSLuigi Rizzo fprintf(stderr, 2537571f8c1bSLuigi Rizzo "ipfw syntax summary (but please do read the ipfw(8) manpage):\n" 2538ac6cec51SLuigi Rizzo "ipfw [-abcdefhnNqStTv] <command> where <command> is one of:\n" 2539571f8c1bSLuigi Rizzo "add [num] [set N] [prob x] RULE-BODY\n" 2540571f8c1bSLuigi Rizzo "{pipe|queue} N config PIPE-BODY\n" 2541571f8c1bSLuigi Rizzo "[pipe|queue] {zero|delete|show} [N{,N}]\n" 2542571f8c1bSLuigi Rizzo "set [disable N... enable N...] | move [rule] X to Y | swap X Y | show\n" 2543cd8b5ae0SRuslan Ermilov "table N {add ip[/bits] [value] | delete ip[/bits] | flush | list}\n" 25449758b77fSLuigi Rizzo "\n" 2545974dfe30SBrian Feldman "RULE-BODY: check-state [PARAMS] | ACTION [PARAMS] ADDR [OPTION_LIST]\n" 25469066356bSBjoern A. Zeeb "ACTION: check-state | allow | count | deny | unreach{,6} CODE |\n" 25479066356bSBjoern A. Zeeb " skipto N | {divert|tee} PORT | forward ADDR |\n" 25489066356bSBjoern A. Zeeb " pipe N | queue N\n" 2549974dfe30SBrian Feldman "PARAMS: [log [logamount LOGLIMIT]] [altq QUEUE_NAME]\n" 25509758b77fSLuigi Rizzo "ADDR: [ MAC dst src ether_type ] \n" 25518195404bSBrooks Davis " [ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]\n" 25528195404bSBrooks Davis " [ ipv6|ip6 from IP6ADDR [ PORT ] to IP6ADDR [ PORTLIST ] ]\n" 2553cd8b5ae0SRuslan Ermilov "IPADDR: [not] { any | me | ip/bits{x,y,z} | table(t[,v]) | IPLIST }\n" 25548195404bSBrooks Davis "IP6ADDR: [not] { any | me | me6 | ip6/bits | IP6LIST }\n" 25558195404bSBrooks Davis "IP6LIST: { ip6 | ip6/bits }[,IP6LIST]\n" 255626bf4d78SLuigi Rizzo "IPLIST: { ip | ip/bits | ip:mask }[,IPLIST]\n" 255726bf4d78SLuigi Rizzo "OPTION_LIST: OPTION [OPTION_LIST]\n" 255817db1a04SBrian Feldman "OPTION: bridged | diverted | diverted-loopback | diverted-output |\n" 25598195404bSBrooks Davis " {dst-ip|src-ip} IPADDR | {dst-ip6|src-ip6|dst-ipv6|src-ipv6} IP6ADDR |\n" 25608195404bSBrooks Davis " {dst-port|src-port} LIST |\n" 2561571f8c1bSLuigi Rizzo " estab | frag | {gid|uid} N | icmptypes LIST | in | out | ipid LIST |\n" 2562571f8c1bSLuigi Rizzo " iplen LIST | ipoptions SPEC | ipprecedence | ipsec | iptos SPEC |\n" 2563571f8c1bSLuigi Rizzo " ipttl LIST | ipversion VER | keep-state | layer2 | limit ... |\n" 25648195404bSBrooks Davis " icmp6types LIST | ext6hdr LIST | flow-id N[,N] |\n" 2565571f8c1bSLuigi Rizzo " mac ... | mac-type LIST | proto LIST | {recv|xmit|via} {IF|IPADDR} |\n" 2566571f8c1bSLuigi Rizzo " setup | {tcpack|tcpseq|tcpwin} NN | tcpflags SPEC | tcpoptions SPEC |\n" 2567c99ee9e0SBrian Feldman " tcpdatalen LIST | verrevpath | versrcreach | antispoof\n" 25689758b77fSLuigi Rizzo ); 25699758b77fSLuigi Rizzo exit(0); 25709758b77fSLuigi Rizzo } 25719758b77fSLuigi Rizzo 25729758b77fSLuigi Rizzo 25739758b77fSLuigi Rizzo static int 25749758b77fSLuigi Rizzo lookup_host (char *host, struct in_addr *ipaddr) 25759758b77fSLuigi Rizzo { 25769758b77fSLuigi Rizzo struct hostent *he; 25779758b77fSLuigi Rizzo 25789758b77fSLuigi Rizzo if (!inet_aton(host, ipaddr)) { 25799758b77fSLuigi Rizzo if ((he = gethostbyname(host)) == NULL) 25809758b77fSLuigi Rizzo return(-1); 25819758b77fSLuigi Rizzo *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 25829758b77fSLuigi Rizzo } 25839758b77fSLuigi Rizzo return(0); 25849758b77fSLuigi Rizzo } 25859758b77fSLuigi Rizzo 25869758b77fSLuigi Rizzo /* 25879758b77fSLuigi Rizzo * fills the addr and mask fields in the instruction as appropriate from av. 25889758b77fSLuigi Rizzo * Update length as appropriate. 25899758b77fSLuigi Rizzo * The following formats are allowed: 25909758b77fSLuigi Rizzo * me returns O_IP_*_ME 25919758b77fSLuigi Rizzo * 1.2.3.4 single IP address 25929758b77fSLuigi Rizzo * 1.2.3.4:5.6.7.8 address:mask 25939758b77fSLuigi Rizzo * 1.2.3.4/24 address/mask 25949758b77fSLuigi Rizzo * 1.2.3.4/26{1,6,5,4,23} set of addresses in a subnet 2595571f8c1bSLuigi Rizzo * We can have multiple comma-separated address/mask entries. 25969758b77fSLuigi Rizzo */ 25979758b77fSLuigi Rizzo static void 25989758b77fSLuigi Rizzo fill_ip(ipfw_insn_ip *cmd, char *av) 25999758b77fSLuigi Rizzo { 2600571f8c1bSLuigi Rizzo int len = 0; 2601571f8c1bSLuigi Rizzo uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; 26029758b77fSLuigi Rizzo 26039758b77fSLuigi Rizzo cmd->o.len &= ~F_LEN_MASK; /* zero len */ 26049758b77fSLuigi Rizzo 260501750186SBrooks Davis if (_substrcmp(av, "any") == 0) 26069758b77fSLuigi Rizzo return; 26079758b77fSLuigi Rizzo 260801750186SBrooks Davis if (_substrcmp(av, "me") == 0) { 26099758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn); 26109758b77fSLuigi Rizzo return; 26119758b77fSLuigi Rizzo } 26129758b77fSLuigi Rizzo 261301750186SBrooks Davis if (strncmp(av, "table(", 6) == 0) { 2614cd8b5ae0SRuslan Ermilov char *p = strchr(av + 6, ','); 2615cd8b5ae0SRuslan Ermilov 2616cd8b5ae0SRuslan Ermilov if (p) 2617cd8b5ae0SRuslan Ermilov *p++ = '\0'; 2618cd8b5ae0SRuslan Ermilov cmd->o.opcode = O_IP_DST_LOOKUP; 2619cd8b5ae0SRuslan Ermilov cmd->o.arg1 = strtoul(av + 6, NULL, 0); 2620cd8b5ae0SRuslan Ermilov if (p) { 2621cd8b5ae0SRuslan Ermilov cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 2622cd8b5ae0SRuslan Ermilov d[0] = strtoul(p, NULL, 0); 2623cd8b5ae0SRuslan Ermilov } else 2624cd8b5ae0SRuslan Ermilov cmd->o.len |= F_INSN_SIZE(ipfw_insn); 2625cd8b5ae0SRuslan Ermilov return; 2626cd8b5ae0SRuslan Ermilov } 2627cd8b5ae0SRuslan Ermilov 2628571f8c1bSLuigi Rizzo while (av) { 2629571f8c1bSLuigi Rizzo /* 2630571f8c1bSLuigi Rizzo * After the address we can have '/' or ':' indicating a mask, 2631571f8c1bSLuigi Rizzo * ',' indicating another address follows, '{' indicating a 2632571f8c1bSLuigi Rizzo * set of addresses of unspecified size. 2633571f8c1bSLuigi Rizzo */ 2634571f8c1bSLuigi Rizzo char *p = strpbrk(av, "/:,{"); 2635571f8c1bSLuigi Rizzo int masklen; 2636571f8c1bSLuigi Rizzo char md; 2637571f8c1bSLuigi Rizzo 26389758b77fSLuigi Rizzo if (p) { 26399758b77fSLuigi Rizzo md = *p; 26409758b77fSLuigi Rizzo *p++ = '\0'; 2641571f8c1bSLuigi Rizzo } else 2642571f8c1bSLuigi Rizzo md = '\0'; 26439758b77fSLuigi Rizzo 2644571f8c1bSLuigi Rizzo if (lookup_host(av, (struct in_addr *)&d[0]) != 0) 26459758b77fSLuigi Rizzo errx(EX_NOHOST, "hostname ``%s'' unknown", av); 26469758b77fSLuigi Rizzo switch (md) { 26479758b77fSLuigi Rizzo case ':': 2648571f8c1bSLuigi Rizzo if (!inet_aton(p, (struct in_addr *)&d[1])) 26499758b77fSLuigi Rizzo errx(EX_DATAERR, "bad netmask ``%s''", p); 26509758b77fSLuigi Rizzo break; 26519758b77fSLuigi Rizzo case '/': 2652571f8c1bSLuigi Rizzo masklen = atoi(p); 2653571f8c1bSLuigi Rizzo if (masklen == 0) 2654571f8c1bSLuigi Rizzo d[1] = htonl(0); /* mask */ 2655571f8c1bSLuigi Rizzo else if (masklen > 32) 26569758b77fSLuigi Rizzo errx(EX_DATAERR, "bad width ``%s''", p); 26579758b77fSLuigi Rizzo else 2658571f8c1bSLuigi Rizzo d[1] = htonl(~0 << (32 - masklen)); 26599758b77fSLuigi Rizzo break; 2660571f8c1bSLuigi Rizzo case '{': /* no mask, assume /24 and put back the '{' */ 2661571f8c1bSLuigi Rizzo d[1] = htonl(~0 << (32 - 24)); 2662571f8c1bSLuigi Rizzo *(--p) = md; 2663571f8c1bSLuigi Rizzo break; 2664571f8c1bSLuigi Rizzo 2665571f8c1bSLuigi Rizzo case ',': /* single address plus continuation */ 2666571f8c1bSLuigi Rizzo *(--p) = md; 2667571f8c1bSLuigi Rizzo /* FALLTHROUGH */ 2668571f8c1bSLuigi Rizzo case 0: /* initialization value */ 26699758b77fSLuigi Rizzo default: 2670571f8c1bSLuigi Rizzo d[1] = htonl(~0); /* force /32 */ 26719758b77fSLuigi Rizzo break; 26729758b77fSLuigi Rizzo } 2673571f8c1bSLuigi Rizzo d[0] &= d[1]; /* mask base address with mask */ 2674571f8c1bSLuigi Rizzo /* find next separator */ 2675571f8c1bSLuigi Rizzo if (p) 2676571f8c1bSLuigi Rizzo p = strpbrk(p, ",{"); 2677571f8c1bSLuigi Rizzo if (p && *p == '{') { 26789758b77fSLuigi Rizzo /* 2679571f8c1bSLuigi Rizzo * We have a set of addresses. They are stored as follows: 26809758b77fSLuigi Rizzo * arg1 is the set size (powers of 2, 2..256) 26819758b77fSLuigi Rizzo * addr is the base address IN HOST FORMAT 2682571f8c1bSLuigi Rizzo * mask.. is an array of arg1 bits (rounded up to 2683571f8c1bSLuigi Rizzo * the next multiple of 32) with bits set 2684571f8c1bSLuigi Rizzo * for each host in the map. 26859758b77fSLuigi Rizzo */ 2686571f8c1bSLuigi Rizzo uint32_t *map = (uint32_t *)&cmd->mask; 26879758b77fSLuigi Rizzo int low, high; 2688f3a126d3SLuigi Rizzo int i = contigmask((uint8_t *)&(d[1]), 32); 26899758b77fSLuigi Rizzo 2690571f8c1bSLuigi Rizzo if (len > 0) 2691571f8c1bSLuigi Rizzo errx(EX_DATAERR, "address set cannot be in a list"); 2692571f8c1bSLuigi Rizzo if (i < 24 || i > 31) 2693571f8c1bSLuigi Rizzo errx(EX_DATAERR, "invalid set with mask %d\n", i); 2694571f8c1bSLuigi Rizzo cmd->o.arg1 = 1<<(32-i); /* map length */ 2695571f8c1bSLuigi Rizzo d[0] = ntohl(d[0]); /* base addr in host format */ 26969758b77fSLuigi Rizzo cmd->o.opcode = O_IP_DST_SET; /* default */ 26979758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + (cmd->o.arg1+31)/32; 269861360012SLuigi Rizzo for (i = 0; i < (cmd->o.arg1+31)/32 ; i++) 2699571f8c1bSLuigi Rizzo map[i] = 0; /* clear map */ 27009758b77fSLuigi Rizzo 27019758b77fSLuigi Rizzo av = p + 1; 2702571f8c1bSLuigi Rizzo low = d[0] & 0xff; 27039758b77fSLuigi Rizzo high = low + cmd->o.arg1 - 1; 2704571f8c1bSLuigi Rizzo /* 2705571f8c1bSLuigi Rizzo * Here, i stores the previous value when we specify a range 2706571f8c1bSLuigi Rizzo * of addresses within a mask, e.g. 45-63. i = -1 means we 2707571f8c1bSLuigi Rizzo * have no previous value. 2708571f8c1bSLuigi Rizzo */ 27099ef3f16dSLuigi Rizzo i = -1; /* previous value in a range */ 27109758b77fSLuigi Rizzo while (isdigit(*av)) { 27119758b77fSLuigi Rizzo char *s; 2712571f8c1bSLuigi Rizzo int a = strtol(av, &s, 0); 27139758b77fSLuigi Rizzo 2714571f8c1bSLuigi Rizzo if (s == av) { /* no parameter */ 2715571f8c1bSLuigi Rizzo if (*av != '}') 2716571f8c1bSLuigi Rizzo errx(EX_DATAERR, "set not closed\n"); 2717571f8c1bSLuigi Rizzo if (i != -1) 2718571f8c1bSLuigi Rizzo errx(EX_DATAERR, "incomplete range %d-", i); 27199758b77fSLuigi Rizzo break; 27209758b77fSLuigi Rizzo } 2721571f8c1bSLuigi Rizzo if (a < low || a > high) 2722571f8c1bSLuigi Rizzo errx(EX_DATAERR, "addr %d out of range [%d-%d]\n", 2723571f8c1bSLuigi Rizzo a, low, high); 27249758b77fSLuigi Rizzo a -= low; 27259ef3f16dSLuigi Rizzo if (i == -1) /* no previous in range */ 27269ef3f16dSLuigi Rizzo i = a; 27279ef3f16dSLuigi Rizzo else { /* check that range is valid */ 27289ef3f16dSLuigi Rizzo if (i > a) 27299ef3f16dSLuigi Rizzo errx(EX_DATAERR, "invalid range %d-%d", 27309ef3f16dSLuigi Rizzo i+low, a+low); 27319ef3f16dSLuigi Rizzo if (*s == '-') 27329ef3f16dSLuigi Rizzo errx(EX_DATAERR, "double '-' in range"); 27339ef3f16dSLuigi Rizzo } 27349ef3f16dSLuigi Rizzo for (; i <= a; i++) 2735571f8c1bSLuigi Rizzo map[i/32] |= 1<<(i & 31); 27369ef3f16dSLuigi Rizzo i = -1; 27379ef3f16dSLuigi Rizzo if (*s == '-') 27389ef3f16dSLuigi Rizzo i = a; 2739571f8c1bSLuigi Rizzo else if (*s == '}') 27409758b77fSLuigi Rizzo break; 27419758b77fSLuigi Rizzo av = s+1; 27429758b77fSLuigi Rizzo } 27439758b77fSLuigi Rizzo return; 27449758b77fSLuigi Rizzo } 2745571f8c1bSLuigi Rizzo av = p; 2746571f8c1bSLuigi Rizzo if (av) /* then *av must be a ',' */ 2747571f8c1bSLuigi Rizzo av++; 27489758b77fSLuigi Rizzo 2749571f8c1bSLuigi Rizzo /* Check this entry */ 2750571f8c1bSLuigi Rizzo if (d[1] == 0) { /* "any", specified as x.x.x.x/0 */ 2751571f8c1bSLuigi Rizzo /* 2752571f8c1bSLuigi Rizzo * 'any' turns the entire list into a NOP. 2753571f8c1bSLuigi Rizzo * 'not any' never matches, so it is removed from the 2754571f8c1bSLuigi Rizzo * list unless it is the only item, in which case we 2755571f8c1bSLuigi Rizzo * report an error. 2756571f8c1bSLuigi Rizzo */ 2757571f8c1bSLuigi Rizzo if (cmd->o.len & F_NOT) { /* "not any" never matches */ 2758571f8c1bSLuigi Rizzo if (av == NULL && len == 0) /* only this entry */ 27599758b77fSLuigi Rizzo errx(EX_DATAERR, "not any never matches"); 2760571f8c1bSLuigi Rizzo } 2761571f8c1bSLuigi Rizzo /* else do nothing and skip this entry */ 276214533a98SMaxim Konovalov return; 2763571f8c1bSLuigi Rizzo } 2764571f8c1bSLuigi Rizzo /* A single IP can be stored in an optimized format */ 2765571f8c1bSLuigi Rizzo if (d[1] == IP_MASK_ALL && av == NULL && len == 0) { 27669758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 2767571f8c1bSLuigi Rizzo return; 2768571f8c1bSLuigi Rizzo } 2769571f8c1bSLuigi Rizzo len += 2; /* two words... */ 2770571f8c1bSLuigi Rizzo d += 2; 2771571f8c1bSLuigi Rizzo } /* end while */ 2772571f8c1bSLuigi Rizzo cmd->o.len |= len+1; 27739758b77fSLuigi Rizzo } 27749758b77fSLuigi Rizzo 27759758b77fSLuigi Rizzo 27768195404bSBrooks Davis /* Try to find ipv6 address by hostname */ 27778195404bSBrooks Davis static int 27788195404bSBrooks Davis lookup_host6 (char *host, struct in6_addr *ip6addr) 27798195404bSBrooks Davis { 27808195404bSBrooks Davis struct hostent *he; 27818195404bSBrooks Davis 27828195404bSBrooks Davis if (!inet_pton(AF_INET6, host, ip6addr)) { 27838195404bSBrooks Davis if ((he = gethostbyname2(host, AF_INET6)) == NULL) 27848195404bSBrooks Davis return(-1); 27858195404bSBrooks Davis memcpy(ip6addr, he->h_addr_list[0], sizeof( struct in6_addr)); 27868195404bSBrooks Davis } 27878195404bSBrooks Davis return(0); 27888195404bSBrooks Davis } 27898195404bSBrooks Davis 27908195404bSBrooks Davis 27918195404bSBrooks Davis /* n2mask sets n bits of the mask */ 27928195404bSBrooks Davis static void 27938195404bSBrooks Davis n2mask(struct in6_addr *mask, int n) 27948195404bSBrooks Davis { 27958195404bSBrooks Davis static int minimask[9] = 27968195404bSBrooks Davis { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff }; 27978195404bSBrooks Davis u_char *p; 27988195404bSBrooks Davis 27998195404bSBrooks Davis memset(mask, 0, sizeof(struct in6_addr)); 28008195404bSBrooks Davis p = (u_char *) mask; 28018195404bSBrooks Davis for (; n > 0; p++, n -= 8) { 28028195404bSBrooks Davis if (n >= 8) 28038195404bSBrooks Davis *p = 0xff; 28048195404bSBrooks Davis else 28058195404bSBrooks Davis *p = minimask[n]; 28068195404bSBrooks Davis } 28078195404bSBrooks Davis return; 28088195404bSBrooks Davis } 28098195404bSBrooks Davis 28108195404bSBrooks Davis 28118195404bSBrooks Davis /* 28128195404bSBrooks Davis * fill the addr and mask fields in the instruction as appropriate from av. 28138195404bSBrooks Davis * Update length as appropriate. 28148195404bSBrooks Davis * The following formats are allowed: 28158195404bSBrooks Davis * any matches any IP6. Actually returns an empty instruction. 28168195404bSBrooks Davis * me returns O_IP6_*_ME 28178195404bSBrooks Davis * 28188195404bSBrooks Davis * 03f1::234:123:0342 single IP6 addres 28198195404bSBrooks Davis * 03f1::234:123:0342/24 address/mask 28208195404bSBrooks Davis * 03f1::234:123:0342/24,03f1::234:123:0343/ List of address 28218195404bSBrooks Davis * 28228195404bSBrooks Davis * Set of address (as in ipv6) not supported because ipv6 address 28238195404bSBrooks Davis * are typically random past the initial prefix. 28248195404bSBrooks Davis * Return 1 on success, 0 on failure. 28258195404bSBrooks Davis */ 28268195404bSBrooks Davis static int 28278195404bSBrooks Davis fill_ip6(ipfw_insn_ip6 *cmd, char *av) 28288195404bSBrooks Davis { 28298195404bSBrooks Davis int len = 0; 28308195404bSBrooks Davis struct in6_addr *d = &(cmd->addr6); 28318195404bSBrooks Davis /* 28328195404bSBrooks Davis * Needed for multiple address. 28338195404bSBrooks Davis * Note d[1] points to struct in6_add r mask6 of cmd 28348195404bSBrooks Davis */ 28358195404bSBrooks Davis 28368195404bSBrooks Davis cmd->o.len &= ~F_LEN_MASK; /* zero len */ 28378195404bSBrooks Davis 28388195404bSBrooks Davis if (strcmp(av, "any") == 0) 28398195404bSBrooks Davis return (1); 28408195404bSBrooks Davis 28418195404bSBrooks Davis 28428195404bSBrooks Davis if (strcmp(av, "me") == 0) { /* Set the data for "me" opt*/ 28438195404bSBrooks Davis cmd->o.len |= F_INSN_SIZE(ipfw_insn); 28448195404bSBrooks Davis return (1); 28458195404bSBrooks Davis } 28468195404bSBrooks Davis 28478195404bSBrooks Davis if (strcmp(av, "me6") == 0) { /* Set the data for "me" opt*/ 28488195404bSBrooks Davis cmd->o.len |= F_INSN_SIZE(ipfw_insn); 28498195404bSBrooks Davis return (1); 28508195404bSBrooks Davis } 28518195404bSBrooks Davis 28528195404bSBrooks Davis av = strdup(av); 28538195404bSBrooks Davis while (av) { 28548195404bSBrooks Davis /* 28558195404bSBrooks Davis * After the address we can have '/' indicating a mask, 28568195404bSBrooks Davis * or ',' indicating another address follows. 28578195404bSBrooks Davis */ 28588195404bSBrooks Davis 28598195404bSBrooks Davis char *p; 28608195404bSBrooks Davis int masklen; 28618195404bSBrooks Davis char md = '\0'; 28628195404bSBrooks Davis 28638195404bSBrooks Davis if ((p = strpbrk(av, "/,")) ) { 28648195404bSBrooks Davis md = *p; /* save the separator */ 28658195404bSBrooks Davis *p = '\0'; /* terminate address string */ 28668195404bSBrooks Davis p++; /* and skip past it */ 28678195404bSBrooks Davis } 28688195404bSBrooks Davis /* now p points to NULL, mask or next entry */ 28698195404bSBrooks Davis 28708195404bSBrooks Davis /* lookup stores address in *d as a side effect */ 28718195404bSBrooks Davis if (lookup_host6(av, d) != 0) { 28728195404bSBrooks Davis /* XXX: failed. Free memory and go */ 28738195404bSBrooks Davis errx(EX_DATAERR, "bad address \"%s\"", av); 28748195404bSBrooks Davis } 28758195404bSBrooks Davis /* next, look at the mask, if any */ 28768195404bSBrooks Davis masklen = (md == '/') ? atoi(p) : 128; 28778195404bSBrooks Davis if (masklen > 128 || masklen < 0) 28788195404bSBrooks Davis errx(EX_DATAERR, "bad width \"%s\''", p); 28798195404bSBrooks Davis else 28808195404bSBrooks Davis n2mask(&d[1], masklen); 28818195404bSBrooks Davis 28828195404bSBrooks Davis APPLY_MASK(d, &d[1]) /* mask base address with mask */ 28838195404bSBrooks Davis 28848195404bSBrooks Davis /* find next separator */ 28858195404bSBrooks Davis 28868195404bSBrooks Davis if (md == '/') { /* find separator past the mask */ 28878195404bSBrooks Davis p = strpbrk(p, ","); 28888195404bSBrooks Davis if (p != NULL) 28898195404bSBrooks Davis p++; 28908195404bSBrooks Davis } 28918195404bSBrooks Davis av = p; 28928195404bSBrooks Davis 28938195404bSBrooks Davis /* Check this entry */ 28948195404bSBrooks Davis if (masklen == 0) { 28958195404bSBrooks Davis /* 28968195404bSBrooks Davis * 'any' turns the entire list into a NOP. 28978195404bSBrooks Davis * 'not any' never matches, so it is removed from the 28988195404bSBrooks Davis * list unless it is the only item, in which case we 28998195404bSBrooks Davis * report an error. 29008195404bSBrooks Davis */ 29018195404bSBrooks Davis if (cmd->o.len & F_NOT && av == NULL && len == 0) 29028195404bSBrooks Davis errx(EX_DATAERR, "not any never matches"); 29038195404bSBrooks Davis continue; 29048195404bSBrooks Davis } 29058195404bSBrooks Davis 29068195404bSBrooks Davis /* 29078195404bSBrooks Davis * A single IP can be stored alone 29088195404bSBrooks Davis */ 29098195404bSBrooks Davis if (masklen == 128 && av == NULL && len == 0) { 29108195404bSBrooks Davis len = F_INSN_SIZE(struct in6_addr); 29118195404bSBrooks Davis break; 29128195404bSBrooks Davis } 29138195404bSBrooks Davis 29148195404bSBrooks Davis /* Update length and pointer to arguments */ 29158195404bSBrooks Davis len += F_INSN_SIZE(struct in6_addr)*2; 29168195404bSBrooks Davis d += 2; 29178195404bSBrooks Davis } /* end while */ 29188195404bSBrooks Davis 29198195404bSBrooks Davis /* 29208195404bSBrooks Davis * Total length of the command, remember that 1 is the size of 29218195404bSBrooks Davis * the base command. 29228195404bSBrooks Davis */ 29238195404bSBrooks Davis cmd->o.len |= len+1; 29248195404bSBrooks Davis free(av); 29258195404bSBrooks Davis return (1); 29268195404bSBrooks Davis } 29278195404bSBrooks Davis 29288195404bSBrooks Davis /* 29298195404bSBrooks Davis * fills command for ipv6 flow-id filtering 29308195404bSBrooks Davis * note that the 20 bit flow number is stored in a array of u_int32_t 29318195404bSBrooks Davis * it's supported lists of flow-id, so in the o.arg1 we store how many 29328195404bSBrooks Davis * additional flow-id we want to filter, the basic is 1 29338195404bSBrooks Davis */ 29348195404bSBrooks Davis void 29358195404bSBrooks Davis fill_flow6( ipfw_insn_u32 *cmd, char *av ) 29368195404bSBrooks Davis { 29378195404bSBrooks Davis u_int32_t type; /* Current flow number */ 29388195404bSBrooks Davis u_int16_t nflow = 0; /* Current flow index */ 29398195404bSBrooks Davis char *s = av; 29408195404bSBrooks Davis cmd->d[0] = 0; /* Initializing the base number*/ 29418195404bSBrooks Davis 29428195404bSBrooks Davis while (s) { 29438195404bSBrooks Davis av = strsep( &s, ",") ; 29448195404bSBrooks Davis type = strtoul(av, &av, 0); 29458195404bSBrooks Davis if (*av != ',' && *av != '\0') 29468195404bSBrooks Davis errx(EX_DATAERR, "invalid ipv6 flow number %s", av); 29478195404bSBrooks Davis if (type > 0xfffff) 29488195404bSBrooks Davis errx(EX_DATAERR, "flow number out of range %s", av); 29498195404bSBrooks Davis cmd->d[nflow] |= type; 29508195404bSBrooks Davis nflow++; 29518195404bSBrooks Davis } 29528195404bSBrooks Davis if( nflow > 0 ) { 29538195404bSBrooks Davis cmd->o.opcode = O_FLOW6ID; 29548195404bSBrooks Davis cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + nflow; 29558195404bSBrooks Davis cmd->o.arg1 = nflow; 29568195404bSBrooks Davis } 29578195404bSBrooks Davis else { 29588195404bSBrooks Davis errx(EX_DATAERR, "invalid ipv6 flow number %s", av); 29598195404bSBrooks Davis } 29608195404bSBrooks Davis } 29618195404bSBrooks Davis 29628195404bSBrooks Davis static ipfw_insn * 29638195404bSBrooks Davis add_srcip6(ipfw_insn *cmd, char *av) 29648195404bSBrooks Davis { 29658195404bSBrooks Davis 29668195404bSBrooks Davis fill_ip6((ipfw_insn_ip6 *)cmd, av); 29678195404bSBrooks Davis if (F_LEN(cmd) == 0) /* any */ 29688195404bSBrooks Davis ; 29698195404bSBrooks Davis if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) { /* "me" */ 29708195404bSBrooks Davis cmd->opcode = O_IP6_SRC_ME; 29718195404bSBrooks Davis } else if (F_LEN(cmd) == 29728195404bSBrooks Davis (F_INSN_SIZE(struct in6_addr) + F_INSN_SIZE(ipfw_insn))) { 29738195404bSBrooks Davis /* single IP, no mask*/ 29748195404bSBrooks Davis cmd->opcode = O_IP6_SRC; 29758195404bSBrooks Davis } else { /* addr/mask opt */ 29768195404bSBrooks Davis cmd->opcode = O_IP6_SRC_MASK; 29778195404bSBrooks Davis } 29788195404bSBrooks Davis return cmd; 29798195404bSBrooks Davis } 29808195404bSBrooks Davis 29818195404bSBrooks Davis static ipfw_insn * 29828195404bSBrooks Davis add_dstip6(ipfw_insn *cmd, char *av) 29838195404bSBrooks Davis { 29848195404bSBrooks Davis 29858195404bSBrooks Davis fill_ip6((ipfw_insn_ip6 *)cmd, av); 29868195404bSBrooks Davis if (F_LEN(cmd) == 0) /* any */ 29878195404bSBrooks Davis ; 29888195404bSBrooks Davis if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) { /* "me" */ 29898195404bSBrooks Davis cmd->opcode = O_IP6_DST_ME; 29908195404bSBrooks Davis } else if (F_LEN(cmd) == 29918195404bSBrooks Davis (F_INSN_SIZE(struct in6_addr) + F_INSN_SIZE(ipfw_insn))) { 29928195404bSBrooks Davis /* single IP, no mask*/ 29938195404bSBrooks Davis cmd->opcode = O_IP6_DST; 29948195404bSBrooks Davis } else { /* addr/mask opt */ 29958195404bSBrooks Davis cmd->opcode = O_IP6_DST_MASK; 29968195404bSBrooks Davis } 29978195404bSBrooks Davis return cmd; 29988195404bSBrooks Davis } 29998195404bSBrooks Davis 30008195404bSBrooks Davis 30019758b77fSLuigi Rizzo /* 30029758b77fSLuigi Rizzo * helper function to process a set of flags and set bits in the 30039758b77fSLuigi Rizzo * appropriate masks. 30049758b77fSLuigi Rizzo */ 30059758b77fSLuigi Rizzo static void 30069758b77fSLuigi Rizzo fill_flags(ipfw_insn *cmd, enum ipfw_opcodes opcode, 30079758b77fSLuigi Rizzo struct _s_x *flags, char *p) 30089758b77fSLuigi Rizzo { 3009571f8c1bSLuigi Rizzo uint8_t set=0, clear=0; 30109758b77fSLuigi Rizzo 30119758b77fSLuigi Rizzo while (p && *p) { 30129758b77fSLuigi Rizzo char *q; /* points to the separator */ 30139758b77fSLuigi Rizzo int val; 3014571f8c1bSLuigi Rizzo uint8_t *which; /* mask we are working on */ 30159758b77fSLuigi Rizzo 30169758b77fSLuigi Rizzo if (*p == '!') { 30179758b77fSLuigi Rizzo p++; 30189758b77fSLuigi Rizzo which = &clear; 30199758b77fSLuigi Rizzo } else 30209758b77fSLuigi Rizzo which = &set; 30219758b77fSLuigi Rizzo q = strchr(p, ','); 30229758b77fSLuigi Rizzo if (q) 30239758b77fSLuigi Rizzo *q++ = '\0'; 30249758b77fSLuigi Rizzo val = match_token(flags, p); 30259758b77fSLuigi Rizzo if (val <= 0) 30269758b77fSLuigi Rizzo errx(EX_DATAERR, "invalid flag %s", p); 3027571f8c1bSLuigi Rizzo *which |= (uint8_t)val; 30289758b77fSLuigi Rizzo p = q; 30299758b77fSLuigi Rizzo } 30309758b77fSLuigi Rizzo cmd->opcode = opcode; 30319758b77fSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)) | 1; 30329758b77fSLuigi Rizzo cmd->arg1 = (set & 0xff) | ( (clear & 0xff) << 8); 30339758b77fSLuigi Rizzo } 30349758b77fSLuigi Rizzo 30359758b77fSLuigi Rizzo 30369758b77fSLuigi Rizzo static void 30379758b77fSLuigi Rizzo delete(int ac, char *av[]) 30389758b77fSLuigi Rizzo { 3039571f8c1bSLuigi Rizzo uint32_t rulenum; 304062ff38aeSLuigi Rizzo struct dn_pipe p; 30419758b77fSLuigi Rizzo int i; 30429758b77fSLuigi Rizzo int exitval = EX_OK; 304343405724SLuigi Rizzo int do_set = 0; 30449758b77fSLuigi Rizzo 304562ff38aeSLuigi Rizzo memset(&p, 0, sizeof p); 30469758b77fSLuigi Rizzo 30479758b77fSLuigi Rizzo av++; ac--; 304804f70834SChristian S.J. Peron NEED1("missing rule specification"); 304901750186SBrooks Davis if (ac > 0 && _substrcmp(*av, "set") == 0) { 305043405724SLuigi Rizzo do_set = 1; /* delete set */ 305143405724SLuigi Rizzo ac--; av++; 305299e5e645SLuigi Rizzo } 30539758b77fSLuigi Rizzo 30549758b77fSLuigi Rizzo /* Rule number */ 30559758b77fSLuigi Rizzo while (ac && isdigit(**av)) { 30569758b77fSLuigi Rizzo i = atoi(*av); av++; ac--; 30579758b77fSLuigi Rizzo if (do_pipe) { 30589758b77fSLuigi Rizzo if (do_pipe == 1) 305962ff38aeSLuigi Rizzo p.pipe_nr = i; 30609758b77fSLuigi Rizzo else 306162ff38aeSLuigi Rizzo p.fs.fs_nr = i; 306262ff38aeSLuigi Rizzo i = do_cmd(IP_DUMMYNET_DEL, &p, sizeof p); 30639758b77fSLuigi Rizzo if (i) { 30649758b77fSLuigi Rizzo exitval = 1; 30659758b77fSLuigi Rizzo warn("rule %u: setsockopt(IP_DUMMYNET_DEL)", 306662ff38aeSLuigi Rizzo do_pipe == 1 ? p.pipe_nr : p.fs.fs_nr); 30679758b77fSLuigi Rizzo } 30689758b77fSLuigi Rizzo } else { 306999e5e645SLuigi Rizzo rulenum = (i & 0xffff) | (do_set << 24); 3070571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, &rulenum, sizeof rulenum); 30719758b77fSLuigi Rizzo if (i) { 30729758b77fSLuigi Rizzo exitval = EX_UNAVAILABLE; 30739758b77fSLuigi Rizzo warn("rule %u: setsockopt(IP_FW_DEL)", 30749758b77fSLuigi Rizzo rulenum); 30759758b77fSLuigi Rizzo } 30769758b77fSLuigi Rizzo } 30779758b77fSLuigi Rizzo } 30789758b77fSLuigi Rizzo if (exitval != EX_OK) 30799758b77fSLuigi Rizzo exit(exitval); 30809758b77fSLuigi Rizzo } 30819758b77fSLuigi Rizzo 30829758b77fSLuigi Rizzo 30839758b77fSLuigi Rizzo /* 30849758b77fSLuigi Rizzo * fill the interface structure. We do not check the name as we can 30859758b77fSLuigi Rizzo * create interfaces dynamically, so checking them at insert time 30869758b77fSLuigi Rizzo * makes relatively little sense. 30879bf40edeSBrooks Davis * Interface names containing '*', '?', or '[' are assumed to be shell 30889bf40edeSBrooks Davis * patterns which match interfaces. 30899758b77fSLuigi Rizzo */ 30909758b77fSLuigi Rizzo static void 30919758b77fSLuigi Rizzo fill_iface(ipfw_insn_if *cmd, char *arg) 30929758b77fSLuigi Rizzo { 30939758b77fSLuigi Rizzo cmd->name[0] = '\0'; 30949758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_if); 30959758b77fSLuigi Rizzo 30969758b77fSLuigi Rizzo /* Parse the interface or address */ 309701750186SBrooks Davis if (strcmp(arg, "any") == 0) 30989758b77fSLuigi Rizzo cmd->o.len = 0; /* effectively ignore this command */ 30999758b77fSLuigi Rizzo else if (!isdigit(*arg)) { 31009bf40edeSBrooks Davis strlcpy(cmd->name, arg, sizeof(cmd->name)); 31019bf40edeSBrooks Davis cmd->p.glob = strpbrk(arg, "*?[") != NULL ? 1 : 0; 31029758b77fSLuigi Rizzo } else if (!inet_aton(arg, &cmd->p.ip)) 31039758b77fSLuigi Rizzo errx(EX_DATAERR, "bad ip address ``%s''", arg); 31049758b77fSLuigi Rizzo } 31059758b77fSLuigi Rizzo 31069758b77fSLuigi Rizzo static void 31079758b77fSLuigi Rizzo config_pipe(int ac, char **av) 31089758b77fSLuigi Rizzo { 310962ff38aeSLuigi Rizzo struct dn_pipe p; 31109758b77fSLuigi Rizzo int i; 31119758b77fSLuigi Rizzo char *end; 31129758b77fSLuigi Rizzo void *par = NULL; 31139758b77fSLuigi Rizzo 311462ff38aeSLuigi Rizzo memset(&p, 0, sizeof p); 31159758b77fSLuigi Rizzo 31169758b77fSLuigi Rizzo av++; ac--; 31179758b77fSLuigi Rizzo /* Pipe number */ 31189758b77fSLuigi Rizzo if (ac && isdigit(**av)) { 31199758b77fSLuigi Rizzo i = atoi(*av); av++; ac--; 31209758b77fSLuigi Rizzo if (do_pipe == 1) 312162ff38aeSLuigi Rizzo p.pipe_nr = i; 31229758b77fSLuigi Rizzo else 312362ff38aeSLuigi Rizzo p.fs.fs_nr = i; 31249758b77fSLuigi Rizzo } 31255e43aef8SLuigi Rizzo while (ac > 0) { 31269758b77fSLuigi Rizzo double d; 31279758b77fSLuigi Rizzo int tok = match_token(dummynet_params, *av); 31289758b77fSLuigi Rizzo ac--; av++; 31299758b77fSLuigi Rizzo 31309758b77fSLuigi Rizzo switch(tok) { 313199e5e645SLuigi Rizzo case TOK_NOERROR: 313262ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_NOERROR; 313399e5e645SLuigi Rizzo break; 313499e5e645SLuigi Rizzo 31359758b77fSLuigi Rizzo case TOK_PLR: 31369758b77fSLuigi Rizzo NEED1("plr needs argument 0..1\n"); 31379758b77fSLuigi Rizzo d = strtod(av[0], NULL); 31389758b77fSLuigi Rizzo if (d > 1) 31399758b77fSLuigi Rizzo d = 1; 31409758b77fSLuigi Rizzo else if (d < 0) 31419758b77fSLuigi Rizzo d = 0; 314262ff38aeSLuigi Rizzo p.fs.plr = (int)(d*0x7fffffff); 31439758b77fSLuigi Rizzo ac--; av++; 31449758b77fSLuigi Rizzo break; 31459758b77fSLuigi Rizzo 31469758b77fSLuigi Rizzo case TOK_QUEUE: 31479758b77fSLuigi Rizzo NEED1("queue needs queue size\n"); 31489758b77fSLuigi Rizzo end = NULL; 314962ff38aeSLuigi Rizzo p.fs.qsize = strtoul(av[0], &end, 0); 31509758b77fSLuigi Rizzo if (*end == 'K' || *end == 'k') { 315162ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_QSIZE_IS_BYTES; 315262ff38aeSLuigi Rizzo p.fs.qsize *= 1024; 315301750186SBrooks Davis } else if (*end == 'B' || 315401750186SBrooks Davis _substrcmp2(end, "by", "bytes") == 0) { 315562ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_QSIZE_IS_BYTES; 31569758b77fSLuigi Rizzo } 31579758b77fSLuigi Rizzo ac--; av++; 31589758b77fSLuigi Rizzo break; 31599758b77fSLuigi Rizzo 31609758b77fSLuigi Rizzo case TOK_BUCKETS: 31619758b77fSLuigi Rizzo NEED1("buckets needs argument\n"); 316262ff38aeSLuigi Rizzo p.fs.rq_size = strtoul(av[0], NULL, 0); 31639758b77fSLuigi Rizzo ac--; av++; 31649758b77fSLuigi Rizzo break; 31659758b77fSLuigi Rizzo 31669758b77fSLuigi Rizzo case TOK_MASK: 31679758b77fSLuigi Rizzo NEED1("mask needs mask specifier\n"); 31689758b77fSLuigi Rizzo /* 31699758b77fSLuigi Rizzo * per-flow queue, mask is dst_ip, dst_port, 31709758b77fSLuigi Rizzo * src_ip, src_port, proto measured in bits 31719758b77fSLuigi Rizzo */ 31729758b77fSLuigi Rizzo par = NULL; 31739758b77fSLuigi Rizzo 31748195404bSBrooks Davis bzero(&p.fs.flow_mask, sizeof(p.fs.flow_mask)); 31759758b77fSLuigi Rizzo end = NULL; 31769758b77fSLuigi Rizzo 31779758b77fSLuigi Rizzo while (ac >= 1) { 3178571f8c1bSLuigi Rizzo uint32_t *p32 = NULL; 3179571f8c1bSLuigi Rizzo uint16_t *p16 = NULL; 31808195404bSBrooks Davis uint32_t *p20 = NULL; 31818195404bSBrooks Davis struct in6_addr *pa6 = NULL; 31828195404bSBrooks Davis uint32_t a; 31839758b77fSLuigi Rizzo 31849758b77fSLuigi Rizzo tok = match_token(dummynet_params, *av); 31859758b77fSLuigi Rizzo ac--; av++; 31869758b77fSLuigi Rizzo switch(tok) { 31879758b77fSLuigi Rizzo case TOK_ALL: 31889758b77fSLuigi Rizzo /* 31899758b77fSLuigi Rizzo * special case, all bits significant 31909758b77fSLuigi Rizzo */ 319162ff38aeSLuigi Rizzo p.fs.flow_mask.dst_ip = ~0; 319262ff38aeSLuigi Rizzo p.fs.flow_mask.src_ip = ~0; 319362ff38aeSLuigi Rizzo p.fs.flow_mask.dst_port = ~0; 319462ff38aeSLuigi Rizzo p.fs.flow_mask.src_port = ~0; 319562ff38aeSLuigi Rizzo p.fs.flow_mask.proto = ~0; 31968195404bSBrooks Davis n2mask(&(p.fs.flow_mask.dst_ip6), 128); 31978195404bSBrooks Davis n2mask(&(p.fs.flow_mask.src_ip6), 128); 31988195404bSBrooks Davis p.fs.flow_mask.flow_id6 = ~0; 319962ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_HAVE_FLOW_MASK; 32009758b77fSLuigi Rizzo goto end_mask; 32019758b77fSLuigi Rizzo 32029758b77fSLuigi Rizzo case TOK_DSTIP: 320362ff38aeSLuigi Rizzo p32 = &p.fs.flow_mask.dst_ip; 32049758b77fSLuigi Rizzo break; 32059758b77fSLuigi Rizzo 32069758b77fSLuigi Rizzo case TOK_SRCIP: 320762ff38aeSLuigi Rizzo p32 = &p.fs.flow_mask.src_ip; 32089758b77fSLuigi Rizzo break; 32099758b77fSLuigi Rizzo 32108195404bSBrooks Davis case TOK_DSTIP6: 32118195404bSBrooks Davis pa6 = &(p.fs.flow_mask.dst_ip6); 32128195404bSBrooks Davis break; 32138195404bSBrooks Davis 32148195404bSBrooks Davis case TOK_SRCIP6: 32158195404bSBrooks Davis pa6 = &(p.fs.flow_mask.src_ip6); 32168195404bSBrooks Davis break; 32178195404bSBrooks Davis 32188195404bSBrooks Davis case TOK_FLOWID: 32198195404bSBrooks Davis p20 = &p.fs.flow_mask.flow_id6; 32208195404bSBrooks Davis break; 32218195404bSBrooks Davis 32229758b77fSLuigi Rizzo case TOK_DSTPORT: 322362ff38aeSLuigi Rizzo p16 = &p.fs.flow_mask.dst_port; 32249758b77fSLuigi Rizzo break; 32259758b77fSLuigi Rizzo 32269758b77fSLuigi Rizzo case TOK_SRCPORT: 322762ff38aeSLuigi Rizzo p16 = &p.fs.flow_mask.src_port; 32289758b77fSLuigi Rizzo break; 32299758b77fSLuigi Rizzo 32309758b77fSLuigi Rizzo case TOK_PROTO: 32319758b77fSLuigi Rizzo break; 32329758b77fSLuigi Rizzo 32339758b77fSLuigi Rizzo default: 32349758b77fSLuigi Rizzo ac++; av--; /* backtrack */ 32359758b77fSLuigi Rizzo goto end_mask; 32369758b77fSLuigi Rizzo } 32379758b77fSLuigi Rizzo if (ac < 1) 32389758b77fSLuigi Rizzo errx(EX_USAGE, "mask: value missing"); 32399758b77fSLuigi Rizzo if (*av[0] == '/') { 32409758b77fSLuigi Rizzo a = strtoul(av[0]+1, &end, 0); 32418195404bSBrooks Davis if (pa6 == NULL) 32429758b77fSLuigi Rizzo a = (a == 32) ? ~0 : (1 << a) - 1; 32439758b77fSLuigi Rizzo } else 32440a7197a8SLuigi Rizzo a = strtoul(av[0], &end, 0); 32459758b77fSLuigi Rizzo if (p32 != NULL) 32469758b77fSLuigi Rizzo *p32 = a; 32479758b77fSLuigi Rizzo else if (p16 != NULL) { 3248610055c9SBrooks Davis if (a > 0xFFFF) 32499758b77fSLuigi Rizzo errx(EX_DATAERR, 3250776c1005SBrooks Davis "port mask must be 16 bit"); 3251571f8c1bSLuigi Rizzo *p16 = (uint16_t)a; 32528195404bSBrooks Davis } else if (p20 != NULL) { 32538195404bSBrooks Davis if (a > 0xfffff) 32548195404bSBrooks Davis errx(EX_DATAERR, 32558195404bSBrooks Davis "flow_id mask must be 20 bit"); 32568195404bSBrooks Davis *p20 = (uint32_t)a; 32578195404bSBrooks Davis } else if (pa6 != NULL) { 32588195404bSBrooks Davis if (a < 0 || a > 128) 32598195404bSBrooks Davis errx(EX_DATAERR, 32608195404bSBrooks Davis "in6addr invalid mask len"); 32618195404bSBrooks Davis else 32628195404bSBrooks Davis n2mask(pa6, a); 32639758b77fSLuigi Rizzo } else { 3264610055c9SBrooks Davis if (a > 0xFF) 32659758b77fSLuigi Rizzo errx(EX_DATAERR, 3266776c1005SBrooks Davis "proto mask must be 8 bit"); 326762ff38aeSLuigi Rizzo p.fs.flow_mask.proto = (uint8_t)a; 32689758b77fSLuigi Rizzo } 32699758b77fSLuigi Rizzo if (a != 0) 327062ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_HAVE_FLOW_MASK; 32719758b77fSLuigi Rizzo ac--; av++; 32729758b77fSLuigi Rizzo } /* end while, config masks */ 32739758b77fSLuigi Rizzo end_mask: 32749758b77fSLuigi Rizzo break; 32759758b77fSLuigi Rizzo 32769758b77fSLuigi Rizzo case TOK_RED: 32779758b77fSLuigi Rizzo case TOK_GRED: 32789758b77fSLuigi Rizzo NEED1("red/gred needs w_q/min_th/max_th/max_p\n"); 327962ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_IS_RED; 32809758b77fSLuigi Rizzo if (tok == TOK_GRED) 328162ff38aeSLuigi Rizzo p.fs.flags_fs |= DN_IS_GENTLE_RED; 32829758b77fSLuigi Rizzo /* 32839758b77fSLuigi Rizzo * the format for parameters is w_q/min_th/max_th/max_p 32849758b77fSLuigi Rizzo */ 32859758b77fSLuigi Rizzo if ((end = strsep(&av[0], "/"))) { 32869758b77fSLuigi Rizzo double w_q = strtod(end, NULL); 32879758b77fSLuigi Rizzo if (w_q > 1 || w_q <= 0) 32889758b77fSLuigi Rizzo errx(EX_DATAERR, "0 < w_q <= 1"); 328962ff38aeSLuigi Rizzo p.fs.w_q = (int) (w_q * (1 << SCALE_RED)); 32909758b77fSLuigi Rizzo } 32919758b77fSLuigi Rizzo if ((end = strsep(&av[0], "/"))) { 329262ff38aeSLuigi Rizzo p.fs.min_th = strtoul(end, &end, 0); 32939758b77fSLuigi Rizzo if (*end == 'K' || *end == 'k') 329462ff38aeSLuigi Rizzo p.fs.min_th *= 1024; 32959758b77fSLuigi Rizzo } 32969758b77fSLuigi Rizzo if ((end = strsep(&av[0], "/"))) { 329762ff38aeSLuigi Rizzo p.fs.max_th = strtoul(end, &end, 0); 32989758b77fSLuigi Rizzo if (*end == 'K' || *end == 'k') 329962ff38aeSLuigi Rizzo p.fs.max_th *= 1024; 33009758b77fSLuigi Rizzo } 33019758b77fSLuigi Rizzo if ((end = strsep(&av[0], "/"))) { 33029758b77fSLuigi Rizzo double max_p = strtod(end, NULL); 33039758b77fSLuigi Rizzo if (max_p > 1 || max_p <= 0) 33049758b77fSLuigi Rizzo errx(EX_DATAERR, "0 < max_p <= 1"); 330562ff38aeSLuigi Rizzo p.fs.max_p = (int)(max_p * (1 << SCALE_RED)); 33069758b77fSLuigi Rizzo } 33079758b77fSLuigi Rizzo ac--; av++; 33089758b77fSLuigi Rizzo break; 33099758b77fSLuigi Rizzo 33109758b77fSLuigi Rizzo case TOK_DROPTAIL: 331162ff38aeSLuigi Rizzo p.fs.flags_fs &= ~(DN_IS_RED|DN_IS_GENTLE_RED); 33129758b77fSLuigi Rizzo break; 33139758b77fSLuigi Rizzo 33149758b77fSLuigi Rizzo case TOK_BW: 33159758b77fSLuigi Rizzo NEED1("bw needs bandwidth or interface\n"); 33169758b77fSLuigi Rizzo if (do_pipe != 1) 33179758b77fSLuigi Rizzo errx(EX_DATAERR, "bandwidth only valid for pipes"); 33189758b77fSLuigi Rizzo /* 33199758b77fSLuigi Rizzo * set clocking interface or bandwidth value 33209758b77fSLuigi Rizzo */ 33219758b77fSLuigi Rizzo if (av[0][0] >= 'a' && av[0][0] <= 'z') { 332262ff38aeSLuigi Rizzo int l = sizeof(p.if_name)-1; 33239758b77fSLuigi Rizzo /* interface name */ 332462ff38aeSLuigi Rizzo strncpy(p.if_name, av[0], l); 332562ff38aeSLuigi Rizzo p.if_name[l] = '\0'; 332662ff38aeSLuigi Rizzo p.bandwidth = 0; 33279758b77fSLuigi Rizzo } else { 332862ff38aeSLuigi Rizzo p.if_name[0] = '\0'; 332962ff38aeSLuigi Rizzo p.bandwidth = strtoul(av[0], &end, 0); 33309758b77fSLuigi Rizzo if (*end == 'K' || *end == 'k') { 33319758b77fSLuigi Rizzo end++; 333262ff38aeSLuigi Rizzo p.bandwidth *= 1000; 33339758b77fSLuigi Rizzo } else if (*end == 'M') { 33349758b77fSLuigi Rizzo end++; 333562ff38aeSLuigi Rizzo p.bandwidth *= 1000000; 33369758b77fSLuigi Rizzo } 333701750186SBrooks Davis if (*end == 'B' || 333801750186SBrooks Davis _substrcmp2(end, "by", "bytes") == 0) 333962ff38aeSLuigi Rizzo p.bandwidth *= 8; 334062ff38aeSLuigi Rizzo if (p.bandwidth < 0) 33419758b77fSLuigi Rizzo errx(EX_DATAERR, "bandwidth too large"); 33429758b77fSLuigi Rizzo } 33439758b77fSLuigi Rizzo ac--; av++; 33449758b77fSLuigi Rizzo break; 33459758b77fSLuigi Rizzo 33469758b77fSLuigi Rizzo case TOK_DELAY: 33479758b77fSLuigi Rizzo if (do_pipe != 1) 33489758b77fSLuigi Rizzo errx(EX_DATAERR, "delay only valid for pipes"); 33499758b77fSLuigi Rizzo NEED1("delay needs argument 0..10000ms\n"); 335062ff38aeSLuigi Rizzo p.delay = strtoul(av[0], NULL, 0); 33519758b77fSLuigi Rizzo ac--; av++; 33529758b77fSLuigi Rizzo break; 33539758b77fSLuigi Rizzo 33549758b77fSLuigi Rizzo case TOK_WEIGHT: 33559758b77fSLuigi Rizzo if (do_pipe == 1) 33569758b77fSLuigi Rizzo errx(EX_DATAERR,"weight only valid for queues"); 33579758b77fSLuigi Rizzo NEED1("weight needs argument 0..100\n"); 335862ff38aeSLuigi Rizzo p.fs.weight = strtoul(av[0], &end, 0); 33599758b77fSLuigi Rizzo ac--; av++; 33609758b77fSLuigi Rizzo break; 33619758b77fSLuigi Rizzo 33629758b77fSLuigi Rizzo case TOK_PIPE: 33639758b77fSLuigi Rizzo if (do_pipe == 1) 33649758b77fSLuigi Rizzo errx(EX_DATAERR,"pipe only valid for queues"); 33659758b77fSLuigi Rizzo NEED1("pipe needs pipe_number\n"); 336662ff38aeSLuigi Rizzo p.fs.parent_nr = strtoul(av[0], &end, 0); 33679758b77fSLuigi Rizzo ac--; av++; 33689758b77fSLuigi Rizzo break; 33699758b77fSLuigi Rizzo 33709758b77fSLuigi Rizzo default: 337166d217f8SMaxim Konovalov errx(EX_DATAERR, "unrecognised option ``%s''", av[-1]); 33729758b77fSLuigi Rizzo } 33739758b77fSLuigi Rizzo } 33749758b77fSLuigi Rizzo if (do_pipe == 1) { 337562ff38aeSLuigi Rizzo if (p.pipe_nr == 0) 33769758b77fSLuigi Rizzo errx(EX_DATAERR, "pipe_nr must be > 0"); 337762ff38aeSLuigi Rizzo if (p.delay > 10000) 33789758b77fSLuigi Rizzo errx(EX_DATAERR, "delay must be < 10000"); 33799758b77fSLuigi Rizzo } else { /* do_pipe == 2, queue */ 338062ff38aeSLuigi Rizzo if (p.fs.parent_nr == 0) 33819758b77fSLuigi Rizzo errx(EX_DATAERR, "pipe must be > 0"); 338262ff38aeSLuigi Rizzo if (p.fs.weight >100) 33839758b77fSLuigi Rizzo errx(EX_DATAERR, "weight must be <= 100"); 33849758b77fSLuigi Rizzo } 338562ff38aeSLuigi Rizzo if (p.fs.flags_fs & DN_QSIZE_IS_BYTES) { 338662ff38aeSLuigi Rizzo if (p.fs.qsize > 1024*1024) 33879758b77fSLuigi Rizzo errx(EX_DATAERR, "queue size must be < 1MB"); 33889758b77fSLuigi Rizzo } else { 338962ff38aeSLuigi Rizzo if (p.fs.qsize > 100) 33909758b77fSLuigi Rizzo errx(EX_DATAERR, "2 <= queue size <= 100"); 33919758b77fSLuigi Rizzo } 339262ff38aeSLuigi Rizzo if (p.fs.flags_fs & DN_IS_RED) { 33939758b77fSLuigi Rizzo size_t len; 33949758b77fSLuigi Rizzo int lookup_depth, avg_pkt_size; 33959758b77fSLuigi Rizzo double s, idle, weight, w_q; 339662ff38aeSLuigi Rizzo struct clockinfo ck; 33979758b77fSLuigi Rizzo int t; 33989758b77fSLuigi Rizzo 339962ff38aeSLuigi Rizzo if (p.fs.min_th >= p.fs.max_th) 34009758b77fSLuigi Rizzo errx(EX_DATAERR, "min_th %d must be < than max_th %d", 340162ff38aeSLuigi Rizzo p.fs.min_th, p.fs.max_th); 340262ff38aeSLuigi Rizzo if (p.fs.max_th == 0) 34039758b77fSLuigi Rizzo errx(EX_DATAERR, "max_th must be > 0"); 34049758b77fSLuigi Rizzo 34059758b77fSLuigi Rizzo len = sizeof(int); 34069758b77fSLuigi Rizzo if (sysctlbyname("net.inet.ip.dummynet.red_lookup_depth", 34079758b77fSLuigi Rizzo &lookup_depth, &len, NULL, 0) == -1) 34089758b77fSLuigi Rizzo 34099758b77fSLuigi Rizzo errx(1, "sysctlbyname(\"%s\")", 34109758b77fSLuigi Rizzo "net.inet.ip.dummynet.red_lookup_depth"); 34119758b77fSLuigi Rizzo if (lookup_depth == 0) 34129758b77fSLuigi Rizzo errx(EX_DATAERR, "net.inet.ip.dummynet.red_lookup_depth" 34139758b77fSLuigi Rizzo " must be greater than zero"); 34149758b77fSLuigi Rizzo 34159758b77fSLuigi Rizzo len = sizeof(int); 34169758b77fSLuigi Rizzo if (sysctlbyname("net.inet.ip.dummynet.red_avg_pkt_size", 34179758b77fSLuigi Rizzo &avg_pkt_size, &len, NULL, 0) == -1) 34189758b77fSLuigi Rizzo 34199758b77fSLuigi Rizzo errx(1, "sysctlbyname(\"%s\")", 34209758b77fSLuigi Rizzo "net.inet.ip.dummynet.red_avg_pkt_size"); 34219758b77fSLuigi Rizzo if (avg_pkt_size == 0) 34229758b77fSLuigi Rizzo errx(EX_DATAERR, 34239758b77fSLuigi Rizzo "net.inet.ip.dummynet.red_avg_pkt_size must" 34249758b77fSLuigi Rizzo " be greater than zero"); 34259758b77fSLuigi Rizzo 34269758b77fSLuigi Rizzo len = sizeof(struct clockinfo); 342762ff38aeSLuigi Rizzo if (sysctlbyname("kern.clockrate", &ck, &len, NULL, 0) == -1) 34289758b77fSLuigi Rizzo errx(1, "sysctlbyname(\"%s\")", "kern.clockrate"); 34299758b77fSLuigi Rizzo 34309758b77fSLuigi Rizzo /* 34319758b77fSLuigi Rizzo * Ticks needed for sending a medium-sized packet. 34329758b77fSLuigi Rizzo * Unfortunately, when we are configuring a WF2Q+ queue, we 34339758b77fSLuigi Rizzo * do not have bandwidth information, because that is stored 34349758b77fSLuigi Rizzo * in the parent pipe, and also we have multiple queues 34359758b77fSLuigi Rizzo * competing for it. So we set s=0, which is not very 34369758b77fSLuigi Rizzo * correct. But on the other hand, why do we want RED with 34379758b77fSLuigi Rizzo * WF2Q+ ? 34389758b77fSLuigi Rizzo */ 343962ff38aeSLuigi Rizzo if (p.bandwidth==0) /* this is a WF2Q+ queue */ 34409758b77fSLuigi Rizzo s = 0; 34419758b77fSLuigi Rizzo else 344262ff38aeSLuigi Rizzo s = ck.hz * avg_pkt_size * 8 / p.bandwidth; 34439758b77fSLuigi Rizzo 34449758b77fSLuigi Rizzo /* 34459758b77fSLuigi Rizzo * max idle time (in ticks) before avg queue size becomes 0. 34469758b77fSLuigi Rizzo * NOTA: (3/w_q) is approx the value x so that 34479758b77fSLuigi Rizzo * (1-w_q)^x < 10^-3. 34489758b77fSLuigi Rizzo */ 344962ff38aeSLuigi Rizzo w_q = ((double)p.fs.w_q) / (1 << SCALE_RED); 34509758b77fSLuigi Rizzo idle = s * 3. / w_q; 345162ff38aeSLuigi Rizzo p.fs.lookup_step = (int)idle / lookup_depth; 345262ff38aeSLuigi Rizzo if (!p.fs.lookup_step) 345362ff38aeSLuigi Rizzo p.fs.lookup_step = 1; 34549758b77fSLuigi Rizzo weight = 1 - w_q; 345562ff38aeSLuigi Rizzo for (t = p.fs.lookup_step; t > 0; --t) 34569758b77fSLuigi Rizzo weight *= weight; 345762ff38aeSLuigi Rizzo p.fs.lookup_weight = (int)(weight * (1 << SCALE_RED)); 34589758b77fSLuigi Rizzo } 345962ff38aeSLuigi Rizzo i = do_cmd(IP_DUMMYNET_CONFIGURE, &p, sizeof p); 34609758b77fSLuigi Rizzo if (i) 34619758b77fSLuigi Rizzo err(1, "setsockopt(%s)", "IP_DUMMYNET_CONFIGURE"); 34629758b77fSLuigi Rizzo } 34639758b77fSLuigi Rizzo 34649758b77fSLuigi Rizzo static void 3465f3a126d3SLuigi Rizzo get_mac_addr_mask(char *p, uint8_t *addr, uint8_t *mask) 34669758b77fSLuigi Rizzo { 34679758b77fSLuigi Rizzo int i, l; 34689758b77fSLuigi Rizzo 34699758b77fSLuigi Rizzo for (i=0; i<6; i++) 34709758b77fSLuigi Rizzo addr[i] = mask[i] = 0; 347101750186SBrooks Davis if (strcmp(p, "any") == 0) 34729758b77fSLuigi Rizzo return; 34739758b77fSLuigi Rizzo 34749758b77fSLuigi Rizzo for (i=0; *p && i<6;i++, p++) { 34759758b77fSLuigi Rizzo addr[i] = strtol(p, &p, 16); 34769758b77fSLuigi Rizzo if (*p != ':') /* we start with the mask */ 34779758b77fSLuigi Rizzo break; 34789758b77fSLuigi Rizzo } 34799758b77fSLuigi Rizzo if (*p == '/') { /* mask len */ 34809758b77fSLuigi Rizzo l = strtol(p+1, &p, 0); 34819758b77fSLuigi Rizzo for (i=0; l>0; l -=8, i++) 34829758b77fSLuigi Rizzo mask[i] = (l >=8) ? 0xff : (~0) << (8-l); 34839758b77fSLuigi Rizzo } else if (*p == '&') { /* mask */ 34849758b77fSLuigi Rizzo for (i=0, p++; *p && i<6;i++, p++) { 34859758b77fSLuigi Rizzo mask[i] = strtol(p, &p, 16); 34869758b77fSLuigi Rizzo if (*p != ':') 34879758b77fSLuigi Rizzo break; 34889758b77fSLuigi Rizzo } 34899758b77fSLuigi Rizzo } else if (*p == '\0') { 34909758b77fSLuigi Rizzo for (i=0; i<6; i++) 34919758b77fSLuigi Rizzo mask[i] = 0xff; 34929758b77fSLuigi Rizzo } 34939758b77fSLuigi Rizzo for (i=0; i<6; i++) 34949758b77fSLuigi Rizzo addr[i] &= mask[i]; 34959758b77fSLuigi Rizzo } 34969758b77fSLuigi Rizzo 34979758b77fSLuigi Rizzo /* 34989758b77fSLuigi Rizzo * helper function, updates the pointer to cmd with the length 34999758b77fSLuigi Rizzo * of the current command, and also cleans up the first word of 35009758b77fSLuigi Rizzo * the new command in case it has been clobbered before. 35019758b77fSLuigi Rizzo */ 35029758b77fSLuigi Rizzo static ipfw_insn * 35039758b77fSLuigi Rizzo next_cmd(ipfw_insn *cmd) 35049758b77fSLuigi Rizzo { 35059758b77fSLuigi Rizzo cmd += F_LEN(cmd); 35069758b77fSLuigi Rizzo bzero(cmd, sizeof(*cmd)); 35079758b77fSLuigi Rizzo return cmd; 35089758b77fSLuigi Rizzo } 35099758b77fSLuigi Rizzo 35109758b77fSLuigi Rizzo /* 351162ff38aeSLuigi Rizzo * Takes arguments and copies them into a comment 351262ff38aeSLuigi Rizzo */ 351362ff38aeSLuigi Rizzo static void 351462ff38aeSLuigi Rizzo fill_comment(ipfw_insn *cmd, int ac, char **av) 351562ff38aeSLuigi Rizzo { 351662ff38aeSLuigi Rizzo int i, l; 351762ff38aeSLuigi Rizzo char *p = (char *)(cmd + 1); 351862ff38aeSLuigi Rizzo 351962ff38aeSLuigi Rizzo cmd->opcode = O_NOP; 352062ff38aeSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)); 352162ff38aeSLuigi Rizzo 352262ff38aeSLuigi Rizzo /* Compute length of comment string. */ 352362ff38aeSLuigi Rizzo for (i = 0, l = 0; i < ac; i++) 352462ff38aeSLuigi Rizzo l += strlen(av[i]) + 1; 352562ff38aeSLuigi Rizzo if (l == 0) 352662ff38aeSLuigi Rizzo return; 352762ff38aeSLuigi Rizzo if (l > 84) 352862ff38aeSLuigi Rizzo errx(EX_DATAERR, 352962ff38aeSLuigi Rizzo "comment too long (max 80 chars)"); 353062ff38aeSLuigi Rizzo l = 1 + (l+3)/4; 353162ff38aeSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)) | l; 353262ff38aeSLuigi Rizzo for (i = 0; i < ac; i++) { 353362ff38aeSLuigi Rizzo strcpy(p, av[i]); 353462ff38aeSLuigi Rizzo p += strlen(av[i]); 353562ff38aeSLuigi Rizzo *p++ = ' '; 353662ff38aeSLuigi Rizzo } 353762ff38aeSLuigi Rizzo *(--p) = '\0'; 353862ff38aeSLuigi Rizzo } 353962ff38aeSLuigi Rizzo 354062ff38aeSLuigi Rizzo /* 35419758b77fSLuigi Rizzo * A function to fill simple commands of size 1. 35429758b77fSLuigi Rizzo * Existing flags are preserved. 35439758b77fSLuigi Rizzo */ 35449758b77fSLuigi Rizzo static void 3545571f8c1bSLuigi Rizzo fill_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, int flags, uint16_t arg) 35469758b77fSLuigi Rizzo { 35479758b77fSLuigi Rizzo cmd->opcode = opcode; 35489758b77fSLuigi Rizzo cmd->len = ((cmd->len | flags) & (F_NOT | F_OR)) | 1; 35499758b77fSLuigi Rizzo cmd->arg1 = arg; 35509758b77fSLuigi Rizzo } 35519758b77fSLuigi Rizzo 35529758b77fSLuigi Rizzo /* 35539758b77fSLuigi Rizzo * Fetch and add the MAC address and type, with masks. This generates one or 35549758b77fSLuigi Rizzo * two microinstructions, and returns the pointer to the last one. 35559758b77fSLuigi Rizzo */ 35569758b77fSLuigi Rizzo static ipfw_insn * 35579758b77fSLuigi Rizzo add_mac(ipfw_insn *cmd, int ac, char *av[]) 35589758b77fSLuigi Rizzo { 3559e706181bSLuigi Rizzo ipfw_insn_mac *mac; 35609758b77fSLuigi Rizzo 356199e5e645SLuigi Rizzo if (ac < 2) 35625a155b40SLuigi Rizzo errx(EX_DATAERR, "MAC dst src"); 35639758b77fSLuigi Rizzo 35649758b77fSLuigi Rizzo cmd->opcode = O_MACADDR2; 35659758b77fSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)) | F_INSN_SIZE(ipfw_insn_mac); 35669758b77fSLuigi Rizzo 35679758b77fSLuigi Rizzo mac = (ipfw_insn_mac *)cmd; 35689758b77fSLuigi Rizzo get_mac_addr_mask(av[0], mac->addr, mac->mask); /* dst */ 35699758b77fSLuigi Rizzo get_mac_addr_mask(av[1], &(mac->addr[6]), &(mac->mask[6])); /* src */ 3570e706181bSLuigi Rizzo return cmd; 35719758b77fSLuigi Rizzo } 35729758b77fSLuigi Rizzo 3573e706181bSLuigi Rizzo static ipfw_insn * 3574e706181bSLuigi Rizzo add_mactype(ipfw_insn *cmd, int ac, char *av) 3575e706181bSLuigi Rizzo { 3576e706181bSLuigi Rizzo if (ac < 1) 3577e706181bSLuigi Rizzo errx(EX_DATAERR, "missing MAC type"); 3578e706181bSLuigi Rizzo if (strcmp(av, "any") != 0) { /* we have a non-null type */ 3579e706181bSLuigi Rizzo fill_newports((ipfw_insn_u16 *)cmd, av, IPPROTO_ETHERTYPE); 3580e706181bSLuigi Rizzo cmd->opcode = O_MAC_TYPE; 35819758b77fSLuigi Rizzo return cmd; 3582e706181bSLuigi Rizzo } else 3583e706181bSLuigi Rizzo return NULL; 3584e706181bSLuigi Rizzo } 3585e706181bSLuigi Rizzo 3586e706181bSLuigi Rizzo static ipfw_insn * 358736c263ccSHajimu UMEMOTO add_proto0(ipfw_insn *cmd, char *av, u_char *protop) 3588e706181bSLuigi Rizzo { 3589e706181bSLuigi Rizzo struct protoent *pe; 359036c263ccSHajimu UMEMOTO char *ep; 359136c263ccSHajimu UMEMOTO int proto; 35928195404bSBrooks Davis 359336c263ccSHajimu UMEMOTO proto = strtol(av, &ep, 0); 359436c263ccSHajimu UMEMOTO if (*ep != '\0' || proto < 0) { 359536c263ccSHajimu UMEMOTO if ((pe = getprotobyname(av)) == NULL) 359636c263ccSHajimu UMEMOTO return NULL; 359736c263ccSHajimu UMEMOTO proto = pe->p_proto; 359836c263ccSHajimu UMEMOTO } 359936c263ccSHajimu UMEMOTO 360036c263ccSHajimu UMEMOTO fill_cmd(cmd, O_PROTO, 0, proto); 360136c263ccSHajimu UMEMOTO *protop = proto; 360236c263ccSHajimu UMEMOTO return cmd; 360336c263ccSHajimu UMEMOTO } 360436c263ccSHajimu UMEMOTO 360536c263ccSHajimu UMEMOTO static ipfw_insn * 360636c263ccSHajimu UMEMOTO add_proto(ipfw_insn *cmd, char *av, u_char *protop) 360736c263ccSHajimu UMEMOTO { 360836c263ccSHajimu UMEMOTO u_char proto = IPPROTO_IP; 3609e706181bSLuigi Rizzo 361001750186SBrooks Davis if (_substrcmp(av, "all") == 0) 361157cd6d26SMax Laier ; /* do not set O_IP4 nor O_IP6 */ 361236c263ccSHajimu UMEMOTO else if (strcmp(av, "ip4") == 0) 361336c263ccSHajimu UMEMOTO /* explicit "just IPv4" rule */ 361436c263ccSHajimu UMEMOTO fill_cmd(cmd, O_IP4, 0, 0); 361536c263ccSHajimu UMEMOTO else if (strcmp(av, "ip6") == 0) { 361636c263ccSHajimu UMEMOTO /* explicit "just IPv6" rule */ 361736c263ccSHajimu UMEMOTO proto = IPPROTO_IPV6; 361836c263ccSHajimu UMEMOTO fill_cmd(cmd, O_IP6, 0, 0); 361936c263ccSHajimu UMEMOTO } else 362036c263ccSHajimu UMEMOTO return add_proto0(cmd, av, protop); 362136c263ccSHajimu UMEMOTO 362236c263ccSHajimu UMEMOTO *protop = proto; 362336c263ccSHajimu UMEMOTO return cmd; 362436c263ccSHajimu UMEMOTO } 362536c263ccSHajimu UMEMOTO 362636c263ccSHajimu UMEMOTO static ipfw_insn * 362736c263ccSHajimu UMEMOTO add_proto_compat(ipfw_insn *cmd, char *av, u_char *protop) 362836c263ccSHajimu UMEMOTO { 362936c263ccSHajimu UMEMOTO u_char proto = IPPROTO_IP; 363036c263ccSHajimu UMEMOTO 363136c263ccSHajimu UMEMOTO if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 363236c263ccSHajimu UMEMOTO ; /* do not set O_IP4 nor O_IP6 */ 363357cd6d26SMax Laier else if (strcmp(av, "ipv4") == 0 || strcmp(av, "ip4") == 0) 363457cd6d26SMax Laier /* explicit "just IPv4" rule */ 363557cd6d26SMax Laier fill_cmd(cmd, O_IP4, 0, 0); 363657cd6d26SMax Laier else if (strcmp(av, "ipv6") == 0 || strcmp(av, "ip6") == 0) { 363757cd6d26SMax Laier /* explicit "just IPv6" rule */ 363836c263ccSHajimu UMEMOTO proto = IPPROTO_IPV6; 363957cd6d26SMax Laier fill_cmd(cmd, O_IP6, 0, 0); 364036c263ccSHajimu UMEMOTO } else 364136c263ccSHajimu UMEMOTO return add_proto0(cmd, av, protop); 36428195404bSBrooks Davis 364336c263ccSHajimu UMEMOTO *protop = proto; 3644e706181bSLuigi Rizzo return cmd; 3645e706181bSLuigi Rizzo } 3646e706181bSLuigi Rizzo 3647e706181bSLuigi Rizzo static ipfw_insn * 3648e706181bSLuigi Rizzo add_srcip(ipfw_insn *cmd, char *av) 3649e706181bSLuigi Rizzo { 3650e706181bSLuigi Rizzo fill_ip((ipfw_insn_ip *)cmd, av); 3651e706181bSLuigi Rizzo if (cmd->opcode == O_IP_DST_SET) /* set */ 3652e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC_SET; 3653cd8b5ae0SRuslan Ermilov else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 3654cd8b5ae0SRuslan Ermilov cmd->opcode = O_IP_SRC_LOOKUP; 3655e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 3656e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC_ME; 3657e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 3658e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC; 3659571f8c1bSLuigi Rizzo else /* addr/mask */ 3660e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC_MASK; 3661e706181bSLuigi Rizzo return cmd; 3662e706181bSLuigi Rizzo } 3663e706181bSLuigi Rizzo 3664e706181bSLuigi Rizzo static ipfw_insn * 3665e706181bSLuigi Rizzo add_dstip(ipfw_insn *cmd, char *av) 3666e706181bSLuigi Rizzo { 3667e706181bSLuigi Rizzo fill_ip((ipfw_insn_ip *)cmd, av); 3668e706181bSLuigi Rizzo if (cmd->opcode == O_IP_DST_SET) /* set */ 3669e706181bSLuigi Rizzo ; 3670cd8b5ae0SRuslan Ermilov else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 3671cd8b5ae0SRuslan Ermilov ; 3672e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 3673e706181bSLuigi Rizzo cmd->opcode = O_IP_DST_ME; 3674e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 3675e706181bSLuigi Rizzo cmd->opcode = O_IP_DST; 3676571f8c1bSLuigi Rizzo else /* addr/mask */ 3677e706181bSLuigi Rizzo cmd->opcode = O_IP_DST_MASK; 3678e706181bSLuigi Rizzo return cmd; 3679e706181bSLuigi Rizzo } 3680e706181bSLuigi Rizzo 3681e706181bSLuigi Rizzo static ipfw_insn * 3682e706181bSLuigi Rizzo add_ports(ipfw_insn *cmd, char *av, u_char proto, int opcode) 3683e706181bSLuigi Rizzo { 368401750186SBrooks Davis if (_substrcmp(av, "any") == 0) { 3685e706181bSLuigi Rizzo return NULL; 3686e706181bSLuigi Rizzo } else if (fill_newports((ipfw_insn_u16 *)cmd, av, proto)) { 3687e706181bSLuigi Rizzo /* XXX todo: check that we have a protocol with ports */ 3688e706181bSLuigi Rizzo cmd->opcode = opcode; 3689e706181bSLuigi Rizzo return cmd; 3690e706181bSLuigi Rizzo } 3691e706181bSLuigi Rizzo return NULL; 36929758b77fSLuigi Rizzo } 36939758b77fSLuigi Rizzo 36948195404bSBrooks Davis static ipfw_insn * 36958195404bSBrooks Davis add_src(ipfw_insn *cmd, char *av, u_char proto) 36968195404bSBrooks Davis { 36978195404bSBrooks Davis struct in6_addr a; 36988195404bSBrooks Davis 36998195404bSBrooks Davis if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 37008195404bSBrooks Davis inet_pton(AF_INET6, av, &a)) 37018195404bSBrooks Davis return add_srcip6(cmd, av); 37028195404bSBrooks Davis /* XXX: should check for IPv4, not !IPv6 */ 37038195404bSBrooks Davis if (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 37048195404bSBrooks Davis !inet_pton(AF_INET6, av, &a)) 37058195404bSBrooks Davis return add_srcip(cmd, av); 37068195404bSBrooks Davis if (strcmp(av, "any") != 0) 37078195404bSBrooks Davis return cmd; 37088195404bSBrooks Davis 37098195404bSBrooks Davis return NULL; 37108195404bSBrooks Davis } 37118195404bSBrooks Davis 37128195404bSBrooks Davis static ipfw_insn * 37138195404bSBrooks Davis add_dst(ipfw_insn *cmd, char *av, u_char proto) 37148195404bSBrooks Davis { 37158195404bSBrooks Davis struct in6_addr a; 37168195404bSBrooks Davis 37178195404bSBrooks Davis if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 37188195404bSBrooks Davis inet_pton(AF_INET6, av, &a)) 37198195404bSBrooks Davis return add_dstip6(cmd, av); 37208195404bSBrooks Davis /* XXX: should check for IPv4, not !IPv6 */ 37218195404bSBrooks Davis if (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 37228195404bSBrooks Davis !inet_pton(AF_INET6, av, &a)) 37238195404bSBrooks Davis return add_dstip(cmd, av); 37248195404bSBrooks Davis if (strcmp(av, "any") != 0) 37258195404bSBrooks Davis return cmd; 37268195404bSBrooks Davis 37278195404bSBrooks Davis return NULL; 37288195404bSBrooks Davis } 37298195404bSBrooks Davis 37309758b77fSLuigi Rizzo /* 37319758b77fSLuigi Rizzo * Parse arguments and assemble the microinstructions which make up a rule. 37329758b77fSLuigi Rizzo * Rules are added into the 'rulebuf' and then copied in the correct order 37339758b77fSLuigi Rizzo * into the actual rule. 37349758b77fSLuigi Rizzo * 3735974dfe30SBrian Feldman * The syntax for a rule starts with the action, followed by 3736974dfe30SBrian Feldman * optional action parameters, and the various match patterns. 37379d5abbddSJens Schweikhardt * In the assembled microcode, the first opcode must be an O_PROBE_STATE 37389758b77fSLuigi Rizzo * (generated if the rule includes a keep-state option), then the 3739974dfe30SBrian Feldman * various match patterns, log/altq actions, and the actual action. 37409758b77fSLuigi Rizzo * 37419758b77fSLuigi Rizzo */ 37429758b77fSLuigi Rizzo static void 37439758b77fSLuigi Rizzo add(int ac, char *av[]) 37449758b77fSLuigi Rizzo { 37459758b77fSLuigi Rizzo /* 37469758b77fSLuigi Rizzo * rules are added into the 'rulebuf' and then copied in 37479758b77fSLuigi Rizzo * the correct order into the actual rule. 37489758b77fSLuigi Rizzo * Some things that need to go out of order (prob, action etc.) 37499758b77fSLuigi Rizzo * go into actbuf[]. 37509758b77fSLuigi Rizzo */ 3751571f8c1bSLuigi Rizzo static uint32_t rulebuf[255], actbuf[255], cmdbuf[255]; 37529758b77fSLuigi Rizzo 375362ff38aeSLuigi Rizzo ipfw_insn *src, *dst, *cmd, *action, *prev=NULL; 3754e706181bSLuigi Rizzo ipfw_insn *first_cmd; /* first match pattern */ 37559758b77fSLuigi Rizzo 37569758b77fSLuigi Rizzo struct ip_fw *rule; 37579758b77fSLuigi Rizzo 37589758b77fSLuigi Rizzo /* 37599758b77fSLuigi Rizzo * various flags used to record that we entered some fields. 37609758b77fSLuigi Rizzo */ 376152bc23abSLuigi Rizzo ipfw_insn *have_state = NULL; /* check-state or keep-state */ 3762974dfe30SBrian Feldman ipfw_insn *have_log = NULL, *have_altq = NULL; 37639ec4f2e1SMaxim Konovalov size_t len; 37649758b77fSLuigi Rizzo 37659758b77fSLuigi Rizzo int i; 37669758b77fSLuigi Rizzo 37679758b77fSLuigi Rizzo int open_par = 0; /* open parenthesis ( */ 37689758b77fSLuigi Rizzo 37699758b77fSLuigi Rizzo /* proto is here because it is used to fetch ports */ 37709758b77fSLuigi Rizzo u_char proto = IPPROTO_IP; /* default protocol */ 37719758b77fSLuigi Rizzo 377212b5dc6aSLuigi Rizzo double match_prob = 1; /* match probability, default is always match */ 377312b5dc6aSLuigi Rizzo 37749758b77fSLuigi Rizzo bzero(actbuf, sizeof(actbuf)); /* actions go here */ 37759758b77fSLuigi Rizzo bzero(cmdbuf, sizeof(cmdbuf)); 37769758b77fSLuigi Rizzo bzero(rulebuf, sizeof(rulebuf)); 37779758b77fSLuigi Rizzo 37789758b77fSLuigi Rizzo rule = (struct ip_fw *)rulebuf; 37799758b77fSLuigi Rizzo cmd = (ipfw_insn *)cmdbuf; 37809758b77fSLuigi Rizzo action = (ipfw_insn *)actbuf; 37819758b77fSLuigi Rizzo 37829758b77fSLuigi Rizzo av++; ac--; 37839758b77fSLuigi Rizzo 37849758b77fSLuigi Rizzo /* [rule N] -- Rule number optional */ 37859758b77fSLuigi Rizzo if (ac && isdigit(**av)) { 37869758b77fSLuigi Rizzo rule->rulenum = atoi(*av); 37879758b77fSLuigi Rizzo av++; 37889758b77fSLuigi Rizzo ac--; 37899758b77fSLuigi Rizzo } 37909758b77fSLuigi Rizzo 37913004afcaSLuigi Rizzo /* [set N] -- set number (0..RESVD_SET), optional */ 379201750186SBrooks Davis if (ac > 1 && _substrcmp(*av, "set") == 0) { 379343405724SLuigi Rizzo int set = strtoul(av[1], NULL, 10); 37943004afcaSLuigi Rizzo if (set < 0 || set > RESVD_SET) 379543405724SLuigi Rizzo errx(EX_DATAERR, "illegal set %s", av[1]); 379643405724SLuigi Rizzo rule->set = set; 379743405724SLuigi Rizzo av += 2; ac -= 2; 379843405724SLuigi Rizzo } 379943405724SLuigi Rizzo 38009758b77fSLuigi Rizzo /* [prob D] -- match probability, optional */ 380101750186SBrooks Davis if (ac > 1 && _substrcmp(*av, "prob") == 0) { 380212b5dc6aSLuigi Rizzo match_prob = strtod(av[1], NULL); 38039758b77fSLuigi Rizzo 380412b5dc6aSLuigi Rizzo if (match_prob <= 0 || match_prob > 1) 38059758b77fSLuigi Rizzo errx(EX_DATAERR, "illegal match prob. %s", av[1]); 38069758b77fSLuigi Rizzo av += 2; ac -= 2; 38079758b77fSLuigi Rizzo } 38089758b77fSLuigi Rizzo 38099758b77fSLuigi Rizzo /* action -- mandatory */ 38109758b77fSLuigi Rizzo NEED1("missing action"); 38119758b77fSLuigi Rizzo i = match_token(rule_actions, *av); 38129758b77fSLuigi Rizzo ac--; av++; 38139758b77fSLuigi Rizzo action->len = 1; /* default */ 38149758b77fSLuigi Rizzo switch(i) { 38159758b77fSLuigi Rizzo case TOK_CHECKSTATE: 381652bc23abSLuigi Rizzo have_state = action; 38179758b77fSLuigi Rizzo action->opcode = O_CHECK_STATE; 38189758b77fSLuigi Rizzo break; 38199758b77fSLuigi Rizzo 38209758b77fSLuigi Rizzo case TOK_ACCEPT: 38219758b77fSLuigi Rizzo action->opcode = O_ACCEPT; 38229758b77fSLuigi Rizzo break; 38239758b77fSLuigi Rizzo 38249758b77fSLuigi Rizzo case TOK_DENY: 38259758b77fSLuigi Rizzo action->opcode = O_DENY; 38265e43aef8SLuigi Rizzo action->arg1 = 0; 38275e43aef8SLuigi Rizzo break; 38285e43aef8SLuigi Rizzo 38295e43aef8SLuigi Rizzo case TOK_REJECT: 38305e43aef8SLuigi Rizzo action->opcode = O_REJECT; 38315e43aef8SLuigi Rizzo action->arg1 = ICMP_UNREACH_HOST; 38325e43aef8SLuigi Rizzo break; 38335e43aef8SLuigi Rizzo 38345e43aef8SLuigi Rizzo case TOK_RESET: 38355e43aef8SLuigi Rizzo action->opcode = O_REJECT; 38365e43aef8SLuigi Rizzo action->arg1 = ICMP_REJECT_RST; 38375e43aef8SLuigi Rizzo break; 38385e43aef8SLuigi Rizzo 38399066356bSBjoern A. Zeeb case TOK_RESET6: 38409066356bSBjoern A. Zeeb action->opcode = O_UNREACH6; 38419066356bSBjoern A. Zeeb action->arg1 = ICMP6_UNREACH_RST; 38429066356bSBjoern A. Zeeb break; 38439066356bSBjoern A. Zeeb 38445e43aef8SLuigi Rizzo case TOK_UNREACH: 38455e43aef8SLuigi Rizzo action->opcode = O_REJECT; 38465e43aef8SLuigi Rizzo NEED1("missing reject code"); 38475e43aef8SLuigi Rizzo fill_reject_code(&action->arg1, *av); 38485e43aef8SLuigi Rizzo ac--; av++; 38499758b77fSLuigi Rizzo break; 38509758b77fSLuigi Rizzo 38519066356bSBjoern A. Zeeb case TOK_UNREACH6: 38529066356bSBjoern A. Zeeb action->opcode = O_UNREACH6; 38539066356bSBjoern A. Zeeb NEED1("missing unreach code"); 38549066356bSBjoern A. Zeeb fill_unreach6_code(&action->arg1, *av); 38559066356bSBjoern A. Zeeb ac--; av++; 38569066356bSBjoern A. Zeeb break; 38579066356bSBjoern A. Zeeb 38589758b77fSLuigi Rizzo case TOK_COUNT: 38599758b77fSLuigi Rizzo action->opcode = O_COUNT; 38609758b77fSLuigi Rizzo break; 38619758b77fSLuigi Rizzo 38629758b77fSLuigi Rizzo case TOK_QUEUE: 38639758b77fSLuigi Rizzo action->opcode = O_QUEUE; 386440b1ae9eSGleb Smirnoff goto chkarg; 386540b1ae9eSGleb Smirnoff case TOK_PIPE: 38669758b77fSLuigi Rizzo action->opcode = O_PIPE; 386740b1ae9eSGleb Smirnoff goto chkarg; 386840b1ae9eSGleb Smirnoff case TOK_SKIPTO: 38699758b77fSLuigi Rizzo action->opcode = O_SKIPTO; 387040b1ae9eSGleb Smirnoff goto chkarg; 387140b1ae9eSGleb Smirnoff case TOK_NETGRAPH: 387240b1ae9eSGleb Smirnoff action->opcode = O_NETGRAPH; 387340b1ae9eSGleb Smirnoff goto chkarg; 387440b1ae9eSGleb Smirnoff case TOK_NGTEE: 387540b1ae9eSGleb Smirnoff action->opcode = O_NGTEE; 387640b1ae9eSGleb Smirnoff goto chkarg; 38779758b77fSLuigi Rizzo case TOK_DIVERT: 387840b1ae9eSGleb Smirnoff action->opcode = O_DIVERT; 387940b1ae9eSGleb Smirnoff goto chkarg; 38809758b77fSLuigi Rizzo case TOK_TEE: 388140b1ae9eSGleb Smirnoff action->opcode = O_TEE; 388240b1ae9eSGleb Smirnoff chkarg: 388340b1ae9eSGleb Smirnoff if (!ac) 388440b1ae9eSGleb Smirnoff errx(EX_USAGE, "missing argument for %s", *(av - 1)); 388540b1ae9eSGleb Smirnoff if (isdigit(**av)) { 388640b1ae9eSGleb Smirnoff action->arg1 = strtoul(*av, NULL, 10); 388740b1ae9eSGleb Smirnoff if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG) 388840b1ae9eSGleb Smirnoff errx(EX_DATAERR, "illegal argument for %s", 388940b1ae9eSGleb Smirnoff *(av - 1)); 389040b1ae9eSGleb Smirnoff } else if (_substrcmp(*av, TABLEARG) == 0) { 389140b1ae9eSGleb Smirnoff action->arg1 = IP_FW_TABLEARG; 389240b1ae9eSGleb Smirnoff } else if (i == TOK_DIVERT || i == TOK_TEE) { 38939758b77fSLuigi Rizzo struct servent *s; 38949758b77fSLuigi Rizzo setservent(1); 38959758b77fSLuigi Rizzo s = getservbyname(av[0], "divert"); 38969758b77fSLuigi Rizzo if (s != NULL) 38979758b77fSLuigi Rizzo action->arg1 = ntohs(s->s_port); 38989758b77fSLuigi Rizzo else 38999758b77fSLuigi Rizzo errx(EX_DATAERR, "illegal divert/tee port"); 390040b1ae9eSGleb Smirnoff } else 390140b1ae9eSGleb Smirnoff errx(EX_DATAERR, "illegal argument for %s", *(av - 1)); 3902670742a1SGleb Smirnoff ac--; av++; 3903670742a1SGleb Smirnoff break; 3904670742a1SGleb Smirnoff 39059758b77fSLuigi Rizzo case TOK_FORWARD: { 39069758b77fSLuigi Rizzo ipfw_insn_sa *p = (ipfw_insn_sa *)action; 39079758b77fSLuigi Rizzo char *s, *end; 39089758b77fSLuigi Rizzo 39099758b77fSLuigi Rizzo NEED1("missing forward address[:port]"); 39109758b77fSLuigi Rizzo 39119758b77fSLuigi Rizzo action->opcode = O_FORWARD_IP; 39129758b77fSLuigi Rizzo action->len = F_INSN_SIZE(ipfw_insn_sa); 39139758b77fSLuigi Rizzo 39149758b77fSLuigi Rizzo p->sa.sin_len = sizeof(struct sockaddr_in); 39159758b77fSLuigi Rizzo p->sa.sin_family = AF_INET; 39169758b77fSLuigi Rizzo p->sa.sin_port = 0; 39179758b77fSLuigi Rizzo /* 39189758b77fSLuigi Rizzo * locate the address-port separator (':' or ',') 39199758b77fSLuigi Rizzo */ 39209758b77fSLuigi Rizzo s = strchr(*av, ':'); 39219758b77fSLuigi Rizzo if (s == NULL) 39229758b77fSLuigi Rizzo s = strchr(*av, ','); 39239758b77fSLuigi Rizzo if (s != NULL) { 39249758b77fSLuigi Rizzo *(s++) = '\0'; 39259758b77fSLuigi Rizzo i = strtoport(s, &end, 0 /* base */, 0 /* proto */); 39269758b77fSLuigi Rizzo if (s == end) 39279758b77fSLuigi Rizzo errx(EX_DATAERR, 39289758b77fSLuigi Rizzo "illegal forwarding port ``%s''", s); 39294f531a53SLuigi Rizzo p->sa.sin_port = (u_short)i; 39309758b77fSLuigi Rizzo } 39319758b77fSLuigi Rizzo lookup_host(*av, &(p->sa.sin_addr)); 39329758b77fSLuigi Rizzo } 39339758b77fSLuigi Rizzo ac--; av++; 39349758b77fSLuigi Rizzo break; 39359758b77fSLuigi Rizzo 393662ff38aeSLuigi Rizzo case TOK_COMMENT: 393762ff38aeSLuigi Rizzo /* pretend it is a 'count' rule followed by the comment */ 393862ff38aeSLuigi Rizzo action->opcode = O_COUNT; 393962ff38aeSLuigi Rizzo ac++; av--; /* go back... */ 394062ff38aeSLuigi Rizzo break; 394162ff38aeSLuigi Rizzo 39429758b77fSLuigi Rizzo default: 3943e706181bSLuigi Rizzo errx(EX_DATAERR, "invalid action %s\n", av[-1]); 39449758b77fSLuigi Rizzo } 39459758b77fSLuigi Rizzo action = next_cmd(action); 39469758b77fSLuigi Rizzo 39479758b77fSLuigi Rizzo /* 3948974dfe30SBrian Feldman * [altq queuename] -- altq tag, optional 39499758b77fSLuigi Rizzo * [log [logamount N]] -- log, optional 39509758b77fSLuigi Rizzo * 3951974dfe30SBrian Feldman * If they exist, it go first in the cmdbuf, but then it is 39529758b77fSLuigi Rizzo * skipped in the copy section to the end of the buffer. 39539758b77fSLuigi Rizzo */ 3954974dfe30SBrian Feldman while (ac != 0 && (i = match_token(rule_action_params, *av)) != -1) { 3955974dfe30SBrian Feldman ac--; av++; 3956974dfe30SBrian Feldman switch (i) { 3957974dfe30SBrian Feldman case TOK_LOG: 3958974dfe30SBrian Feldman { 39599758b77fSLuigi Rizzo ipfw_insn_log *c = (ipfw_insn_log *)cmd; 396062ff38aeSLuigi Rizzo int l; 39619758b77fSLuigi Rizzo 3962974dfe30SBrian Feldman if (have_log) 3963974dfe30SBrian Feldman errx(EX_DATAERR, 3964974dfe30SBrian Feldman "log cannot be specified more than once"); 3965974dfe30SBrian Feldman have_log = (ipfw_insn *)c; 39669758b77fSLuigi Rizzo cmd->len = F_INSN_SIZE(ipfw_insn_log); 39679758b77fSLuigi Rizzo cmd->opcode = O_LOG; 396801750186SBrooks Davis if (ac && _substrcmp(*av, "logamount") == 0) { 39699758b77fSLuigi Rizzo ac--; av++; 39709758b77fSLuigi Rizzo NEED1("logamount requires argument"); 397162ff38aeSLuigi Rizzo l = atoi(*av); 397262ff38aeSLuigi Rizzo if (l < 0) 3973974dfe30SBrian Feldman errx(EX_DATAERR, 3974974dfe30SBrian Feldman "logamount must be positive"); 397562ff38aeSLuigi Rizzo c->max_log = l; 39769758b77fSLuigi Rizzo ac--; av++; 39779ec4f2e1SMaxim Konovalov } else { 39789ec4f2e1SMaxim Konovalov len = sizeof(c->max_log); 39799ec4f2e1SMaxim Konovalov if (sysctlbyname("net.inet.ip.fw.verbose_limit", 39809ec4f2e1SMaxim Konovalov &c->max_log, &len, NULL, 0) == -1) 39819ec4f2e1SMaxim Konovalov errx(1, "sysctlbyname(\"%s\")", 39829ec4f2e1SMaxim Konovalov "net.inet.ip.fw.verbose_limit"); 39839758b77fSLuigi Rizzo } 3984974dfe30SBrian Feldman } 3985974dfe30SBrian Feldman break; 3986974dfe30SBrian Feldman 3987974dfe30SBrian Feldman case TOK_ALTQ: 3988974dfe30SBrian Feldman { 3989974dfe30SBrian Feldman ipfw_insn_altq *a = (ipfw_insn_altq *)cmd; 3990974dfe30SBrian Feldman 3991974dfe30SBrian Feldman NEED1("missing altq queue name"); 3992974dfe30SBrian Feldman if (have_altq) 3993974dfe30SBrian Feldman errx(EX_DATAERR, 3994974dfe30SBrian Feldman "altq cannot be specified more than once"); 3995974dfe30SBrian Feldman have_altq = (ipfw_insn *)a; 3996974dfe30SBrian Feldman cmd->len = F_INSN_SIZE(ipfw_insn_altq); 3997974dfe30SBrian Feldman cmd->opcode = O_ALTQ; 3998974dfe30SBrian Feldman fill_altq_qid(&a->qid, *av); 3999974dfe30SBrian Feldman ac--; av++; 4000974dfe30SBrian Feldman } 4001974dfe30SBrian Feldman break; 4002974dfe30SBrian Feldman 4003974dfe30SBrian Feldman default: 4004974dfe30SBrian Feldman abort(); 4005974dfe30SBrian Feldman } 40069758b77fSLuigi Rizzo cmd = next_cmd(cmd); 40079758b77fSLuigi Rizzo } 40089758b77fSLuigi Rizzo 400952bc23abSLuigi Rizzo if (have_state) /* must be a check-state, we are done */ 40109758b77fSLuigi Rizzo goto done; 40119758b77fSLuigi Rizzo 40129758b77fSLuigi Rizzo #define OR_START(target) \ 40139758b77fSLuigi Rizzo if (ac && (*av[0] == '(' || *av[0] == '{')) { \ 40149758b77fSLuigi Rizzo if (open_par) \ 40159758b77fSLuigi Rizzo errx(EX_USAGE, "nested \"(\" not allowed\n"); \ 40168ed2d749SLuigi Rizzo prev = NULL; \ 40179758b77fSLuigi Rizzo open_par = 1; \ 40189758b77fSLuigi Rizzo if ( (av[0])[1] == '\0') { \ 40199758b77fSLuigi Rizzo ac--; av++; \ 40209758b77fSLuigi Rizzo } else \ 40219758b77fSLuigi Rizzo (*av)++; \ 40229758b77fSLuigi Rizzo } \ 40239758b77fSLuigi Rizzo target: \ 40249758b77fSLuigi Rizzo 40259758b77fSLuigi Rizzo 40269758b77fSLuigi Rizzo #define CLOSE_PAR \ 40279758b77fSLuigi Rizzo if (open_par) { \ 40289758b77fSLuigi Rizzo if (ac && ( \ 402901750186SBrooks Davis strcmp(*av, ")") == 0 || \ 403001750186SBrooks Davis strcmp(*av, "}") == 0)) { \ 40318ed2d749SLuigi Rizzo prev = NULL; \ 40329758b77fSLuigi Rizzo open_par = 0; \ 40339758b77fSLuigi Rizzo ac--; av++; \ 40349758b77fSLuigi Rizzo } else \ 40359758b77fSLuigi Rizzo errx(EX_USAGE, "missing \")\"\n"); \ 40369758b77fSLuigi Rizzo } 40379758b77fSLuigi Rizzo 40389758b77fSLuigi Rizzo #define NOT_BLOCK \ 403901750186SBrooks Davis if (ac && _substrcmp(*av, "not") == 0) { \ 40409758b77fSLuigi Rizzo if (cmd->len & F_NOT) \ 40419758b77fSLuigi Rizzo errx(EX_USAGE, "double \"not\" not allowed\n"); \ 40429758b77fSLuigi Rizzo cmd->len |= F_NOT; \ 40439758b77fSLuigi Rizzo ac--; av++; \ 40449758b77fSLuigi Rizzo } 40459758b77fSLuigi Rizzo 40469758b77fSLuigi Rizzo #define OR_BLOCK(target) \ 404701750186SBrooks Davis if (ac && _substrcmp(*av, "or") == 0) { \ 40489758b77fSLuigi Rizzo if (prev == NULL || open_par == 0) \ 40499758b77fSLuigi Rizzo errx(EX_DATAERR, "invalid OR block"); \ 40509758b77fSLuigi Rizzo prev->len |= F_OR; \ 40519758b77fSLuigi Rizzo ac--; av++; \ 40529758b77fSLuigi Rizzo goto target; \ 40539758b77fSLuigi Rizzo } \ 40549758b77fSLuigi Rizzo CLOSE_PAR; 40559758b77fSLuigi Rizzo 4056e706181bSLuigi Rizzo first_cmd = cmd; 40575a155b40SLuigi Rizzo 40585a155b40SLuigi Rizzo #if 0 4059e706181bSLuigi Rizzo /* 4060e706181bSLuigi Rizzo * MAC addresses, optional. 4061e706181bSLuigi Rizzo * If we have this, we skip the part "proto from src to dst" 4062e706181bSLuigi Rizzo * and jump straight to the option parsing. 4063e706181bSLuigi Rizzo */ 4064e706181bSLuigi Rizzo NOT_BLOCK; 4065e706181bSLuigi Rizzo NEED1("missing protocol"); 406601750186SBrooks Davis if (_substrcmp(*av, "MAC") == 0 || 406701750186SBrooks Davis _substrcmp(*av, "mac") == 0) { 4068e706181bSLuigi Rizzo ac--; av++; /* the "MAC" keyword */ 4069e706181bSLuigi Rizzo add_mac(cmd, ac, av); /* exits in case of errors */ 4070e706181bSLuigi Rizzo cmd = next_cmd(cmd); 4071e706181bSLuigi Rizzo ac -= 2; av += 2; /* dst-mac and src-mac */ 4072e706181bSLuigi Rizzo NOT_BLOCK; 4073e706181bSLuigi Rizzo NEED1("missing mac type"); 4074e706181bSLuigi Rizzo if (add_mactype(cmd, ac, av[0])) 4075e706181bSLuigi Rizzo cmd = next_cmd(cmd); 4076e706181bSLuigi Rizzo ac--; av++; /* any or mac-type */ 4077e706181bSLuigi Rizzo goto read_options; 4078e706181bSLuigi Rizzo } 40795a155b40SLuigi Rizzo #endif 4080e706181bSLuigi Rizzo 40819758b77fSLuigi Rizzo /* 40829758b77fSLuigi Rizzo * protocol, mandatory 40839758b77fSLuigi Rizzo */ 40849758b77fSLuigi Rizzo OR_START(get_proto); 40859758b77fSLuigi Rizzo NOT_BLOCK; 40869758b77fSLuigi Rizzo NEED1("missing protocol"); 408736c263ccSHajimu UMEMOTO if (add_proto_compat(cmd, *av, &proto)) { 40889758b77fSLuigi Rizzo av++; ac--; 4089b730879fSMax Laier if (F_LEN(cmd) != 0) { 4090e706181bSLuigi Rizzo prev = cmd; 40919758b77fSLuigi Rizzo cmd = next_cmd(cmd); 4092e706181bSLuigi Rizzo } 40935a155b40SLuigi Rizzo } else if (first_cmd != cmd) { 4094c82b8dceSMaxim Konovalov errx(EX_DATAERR, "invalid protocol ``%s''", *av); 40955a155b40SLuigi Rizzo } else 40965a155b40SLuigi Rizzo goto read_options; 40979758b77fSLuigi Rizzo OR_BLOCK(get_proto); 40989758b77fSLuigi Rizzo 40999758b77fSLuigi Rizzo /* 4100e706181bSLuigi Rizzo * "from", mandatory 41019758b77fSLuigi Rizzo */ 410201750186SBrooks Davis if (!ac || _substrcmp(*av, "from") != 0) 41039758b77fSLuigi Rizzo errx(EX_USAGE, "missing ``from''"); 41049758b77fSLuigi Rizzo ac--; av++; 41059758b77fSLuigi Rizzo 41069758b77fSLuigi Rizzo /* 41079758b77fSLuigi Rizzo * source IP, mandatory 41089758b77fSLuigi Rizzo */ 41099758b77fSLuigi Rizzo OR_START(source_ip); 41109758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 41119758b77fSLuigi Rizzo NEED1("missing source address"); 41128195404bSBrooks Davis if (add_src(cmd, *av, proto)) { 41139758b77fSLuigi Rizzo ac--; av++; 4114e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) { /* ! any */ 4115e706181bSLuigi Rizzo prev = cmd; 41169758b77fSLuigi Rizzo cmd = next_cmd(cmd); 4117e706181bSLuigi Rizzo } 41188195404bSBrooks Davis } else 41198195404bSBrooks Davis errx(EX_USAGE, "bad source address %s", *av); 41209758b77fSLuigi Rizzo OR_BLOCK(source_ip); 41219758b77fSLuigi Rizzo 41229758b77fSLuigi Rizzo /* 41239758b77fSLuigi Rizzo * source ports, optional 41249758b77fSLuigi Rizzo */ 41259758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 41268ed2d749SLuigi Rizzo if (ac) { 412701750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 4128e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_SRCPORT)) { 4129e706181bSLuigi Rizzo ac--; av++; 4130e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) 41319758b77fSLuigi Rizzo cmd = next_cmd(cmd); 41329758b77fSLuigi Rizzo } 41338ed2d749SLuigi Rizzo } 41349758b77fSLuigi Rizzo 41359758b77fSLuigi Rizzo /* 4136e706181bSLuigi Rizzo * "to", mandatory 41379758b77fSLuigi Rizzo */ 413801750186SBrooks Davis if (!ac || _substrcmp(*av, "to") != 0) 41399758b77fSLuigi Rizzo errx(EX_USAGE, "missing ``to''"); 41409758b77fSLuigi Rizzo av++; ac--; 41419758b77fSLuigi Rizzo 41429758b77fSLuigi Rizzo /* 41439758b77fSLuigi Rizzo * destination, mandatory 41449758b77fSLuigi Rizzo */ 41459758b77fSLuigi Rizzo OR_START(dest_ip); 41469758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 41479758b77fSLuigi Rizzo NEED1("missing dst address"); 41488195404bSBrooks Davis if (add_dst(cmd, *av, proto)) { 4149e706181bSLuigi Rizzo ac--; av++; 4150e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) { /* ! any */ 41519758b77fSLuigi Rizzo prev = cmd; 41529758b77fSLuigi Rizzo cmd = next_cmd(cmd); 4153e706181bSLuigi Rizzo } 41548195404bSBrooks Davis } else 41558195404bSBrooks Davis errx( EX_USAGE, "bad destination address %s", *av); 41569758b77fSLuigi Rizzo OR_BLOCK(dest_ip); 41579758b77fSLuigi Rizzo 41589758b77fSLuigi Rizzo /* 41599758b77fSLuigi Rizzo * dest. ports, optional 41609758b77fSLuigi Rizzo */ 41619758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 41628ed2d749SLuigi Rizzo if (ac) { 416301750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 4164e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_DSTPORT)) { 4165e706181bSLuigi Rizzo ac--; av++; 4166e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) 4167e706181bSLuigi Rizzo cmd = next_cmd(cmd); 41689758b77fSLuigi Rizzo } 41698ed2d749SLuigi Rizzo } 41709758b77fSLuigi Rizzo 41719758b77fSLuigi Rizzo read_options: 4172e706181bSLuigi Rizzo if (ac && first_cmd == cmd) { 4173e706181bSLuigi Rizzo /* 4174e706181bSLuigi Rizzo * nothing specified so far, store in the rule to ease 4175e706181bSLuigi Rizzo * printout later. 4176e706181bSLuigi Rizzo */ 4177e706181bSLuigi Rizzo rule->_pad = 1; 4178e706181bSLuigi Rizzo } 41799758b77fSLuigi Rizzo prev = NULL; 41809758b77fSLuigi Rizzo while (ac) { 41818ed2d749SLuigi Rizzo char *s; 41828ed2d749SLuigi Rizzo ipfw_insn_u32 *cmd32; /* alias for cmd */ 41838ed2d749SLuigi Rizzo 41848ed2d749SLuigi Rizzo s = *av; 41858ed2d749SLuigi Rizzo cmd32 = (ipfw_insn_u32 *)cmd; 41869758b77fSLuigi Rizzo 41879758b77fSLuigi Rizzo if (*s == '!') { /* alternate syntax for NOT */ 41889758b77fSLuigi Rizzo if (cmd->len & F_NOT) 41899758b77fSLuigi Rizzo errx(EX_USAGE, "double \"not\" not allowed\n"); 41909758b77fSLuigi Rizzo cmd->len = F_NOT; 41919758b77fSLuigi Rizzo s++; 41929758b77fSLuigi Rizzo } 41939758b77fSLuigi Rizzo i = match_token(rule_options, s); 41949758b77fSLuigi Rizzo ac--; av++; 41959758b77fSLuigi Rizzo switch(i) { 41969758b77fSLuigi Rizzo case TOK_NOT: 41979758b77fSLuigi Rizzo if (cmd->len & F_NOT) 41989758b77fSLuigi Rizzo errx(EX_USAGE, "double \"not\" not allowed\n"); 41999758b77fSLuigi Rizzo cmd->len = F_NOT; 42009758b77fSLuigi Rizzo break; 42019758b77fSLuigi Rizzo 42029758b77fSLuigi Rizzo case TOK_OR: 42038ed2d749SLuigi Rizzo if (open_par == 0 || prev == NULL) 42049758b77fSLuigi Rizzo errx(EX_USAGE, "invalid \"or\" block\n"); 42059758b77fSLuigi Rizzo prev->len |= F_OR; 42069758b77fSLuigi Rizzo break; 42079758b77fSLuigi Rizzo 42088ed2d749SLuigi Rizzo case TOK_STARTBRACE: 42098ed2d749SLuigi Rizzo if (open_par) 42108ed2d749SLuigi Rizzo errx(EX_USAGE, "+nested \"(\" not allowed\n"); 42118ed2d749SLuigi Rizzo open_par = 1; 42128ed2d749SLuigi Rizzo break; 42138ed2d749SLuigi Rizzo 42148ed2d749SLuigi Rizzo case TOK_ENDBRACE: 42158ed2d749SLuigi Rizzo if (!open_par) 42168ed2d749SLuigi Rizzo errx(EX_USAGE, "+missing \")\"\n"); 42178ed2d749SLuigi Rizzo open_par = 0; 4218e706181bSLuigi Rizzo prev = NULL; 42198ed2d749SLuigi Rizzo break; 42208ed2d749SLuigi Rizzo 42219758b77fSLuigi Rizzo case TOK_IN: 42229758b77fSLuigi Rizzo fill_cmd(cmd, O_IN, 0, 0); 42239758b77fSLuigi Rizzo break; 42249758b77fSLuigi Rizzo 42259758b77fSLuigi Rizzo case TOK_OUT: 42269758b77fSLuigi Rizzo cmd->len ^= F_NOT; /* toggle F_NOT */ 42279758b77fSLuigi Rizzo fill_cmd(cmd, O_IN, 0, 0); 42289758b77fSLuigi Rizzo break; 42299758b77fSLuigi Rizzo 42306daf7ebdSBrian Feldman case TOK_DIVERTED: 42316daf7ebdSBrian Feldman fill_cmd(cmd, O_DIVERTED, 0, 3); 42326daf7ebdSBrian Feldman break; 42336daf7ebdSBrian Feldman 42346daf7ebdSBrian Feldman case TOK_DIVERTEDLOOPBACK: 42356daf7ebdSBrian Feldman fill_cmd(cmd, O_DIVERTED, 0, 1); 42366daf7ebdSBrian Feldman break; 42376daf7ebdSBrian Feldman 42386daf7ebdSBrian Feldman case TOK_DIVERTEDOUTPUT: 42396daf7ebdSBrian Feldman fill_cmd(cmd, O_DIVERTED, 0, 2); 42406daf7ebdSBrian Feldman break; 42416daf7ebdSBrian Feldman 42429758b77fSLuigi Rizzo case TOK_FRAG: 42439758b77fSLuigi Rizzo fill_cmd(cmd, O_FRAG, 0, 0); 42449758b77fSLuigi Rizzo break; 42459758b77fSLuigi Rizzo 42469758b77fSLuigi Rizzo case TOK_LAYER2: 42479758b77fSLuigi Rizzo fill_cmd(cmd, O_LAYER2, 0, 0); 42489758b77fSLuigi Rizzo break; 42499758b77fSLuigi Rizzo 42509758b77fSLuigi Rizzo case TOK_XMIT: 42519758b77fSLuigi Rizzo case TOK_RECV: 42529758b77fSLuigi Rizzo case TOK_VIA: 42539758b77fSLuigi Rizzo NEED1("recv, xmit, via require interface name" 42549758b77fSLuigi Rizzo " or address"); 42559758b77fSLuigi Rizzo fill_iface((ipfw_insn_if *)cmd, av[0]); 42569758b77fSLuigi Rizzo ac--; av++; 42579758b77fSLuigi Rizzo if (F_LEN(cmd) == 0) /* not a valid address */ 42589758b77fSLuigi Rizzo break; 42599758b77fSLuigi Rizzo if (i == TOK_XMIT) 42609758b77fSLuigi Rizzo cmd->opcode = O_XMIT; 42619758b77fSLuigi Rizzo else if (i == TOK_RECV) 42629758b77fSLuigi Rizzo cmd->opcode = O_RECV; 42639758b77fSLuigi Rizzo else if (i == TOK_VIA) 42649758b77fSLuigi Rizzo cmd->opcode = O_VIA; 42659758b77fSLuigi Rizzo break; 42669758b77fSLuigi Rizzo 42675e43aef8SLuigi Rizzo case TOK_ICMPTYPES: 42685e43aef8SLuigi Rizzo NEED1("icmptypes requires list of types"); 42695e43aef8SLuigi Rizzo fill_icmptypes((ipfw_insn_u32 *)cmd, *av); 42705e43aef8SLuigi Rizzo av++; ac--; 42715e43aef8SLuigi Rizzo break; 42725e43aef8SLuigi Rizzo 42738195404bSBrooks Davis case TOK_ICMP6TYPES: 42748195404bSBrooks Davis NEED1("icmptypes requires list of types"); 42758195404bSBrooks Davis fill_icmp6types((ipfw_insn_icmp6 *)cmd, *av); 42768195404bSBrooks Davis av++; ac--; 42778195404bSBrooks Davis break; 42788195404bSBrooks Davis 42799758b77fSLuigi Rizzo case TOK_IPTTL: 42809758b77fSLuigi Rizzo NEED1("ipttl requires TTL"); 428144c884e1SLuigi Rizzo if (strpbrk(*av, "-,")) { 428244c884e1SLuigi Rizzo if (!add_ports(cmd, *av, 0, O_IPTTL)) 428344c884e1SLuigi Rizzo errx(EX_DATAERR, "invalid ipttl %s", *av); 428444c884e1SLuigi Rizzo } else 42859758b77fSLuigi Rizzo fill_cmd(cmd, O_IPTTL, 0, strtoul(*av, NULL, 0)); 42869758b77fSLuigi Rizzo ac--; av++; 42879758b77fSLuigi Rizzo break; 42889758b77fSLuigi Rizzo 42899758b77fSLuigi Rizzo case TOK_IPID: 429044c884e1SLuigi Rizzo NEED1("ipid requires id"); 429144c884e1SLuigi Rizzo if (strpbrk(*av, "-,")) { 429244c884e1SLuigi Rizzo if (!add_ports(cmd, *av, 0, O_IPID)) 429344c884e1SLuigi Rizzo errx(EX_DATAERR, "invalid ipid %s", *av); 429444c884e1SLuigi Rizzo } else 42959758b77fSLuigi Rizzo fill_cmd(cmd, O_IPID, 0, strtoul(*av, NULL, 0)); 42969758b77fSLuigi Rizzo ac--; av++; 42979758b77fSLuigi Rizzo break; 42989758b77fSLuigi Rizzo 42999758b77fSLuigi Rizzo case TOK_IPLEN: 43009758b77fSLuigi Rizzo NEED1("iplen requires length"); 430144c884e1SLuigi Rizzo if (strpbrk(*av, "-,")) { 430244c884e1SLuigi Rizzo if (!add_ports(cmd, *av, 0, O_IPLEN)) 430344c884e1SLuigi Rizzo errx(EX_DATAERR, "invalid ip len %s", *av); 430444c884e1SLuigi Rizzo } else 43059758b77fSLuigi Rizzo fill_cmd(cmd, O_IPLEN, 0, strtoul(*av, NULL, 0)); 43069758b77fSLuigi Rizzo ac--; av++; 43079758b77fSLuigi Rizzo break; 43089758b77fSLuigi Rizzo 43099758b77fSLuigi Rizzo case TOK_IPVER: 43109758b77fSLuigi Rizzo NEED1("ipver requires version"); 43119758b77fSLuigi Rizzo fill_cmd(cmd, O_IPVER, 0, strtoul(*av, NULL, 0)); 43129758b77fSLuigi Rizzo ac--; av++; 43139758b77fSLuigi Rizzo break; 43149758b77fSLuigi Rizzo 43155e43aef8SLuigi Rizzo case TOK_IPPRECEDENCE: 43165e43aef8SLuigi Rizzo NEED1("ipprecedence requires value"); 43175e43aef8SLuigi Rizzo fill_cmd(cmd, O_IPPRECEDENCE, 0, 43185e43aef8SLuigi Rizzo (strtoul(*av, NULL, 0) & 7) << 5); 43195e43aef8SLuigi Rizzo ac--; av++; 43205e43aef8SLuigi Rizzo break; 43215e43aef8SLuigi Rizzo 43229758b77fSLuigi Rizzo case TOK_IPOPTS: 43239758b77fSLuigi Rizzo NEED1("missing argument for ipoptions"); 432452bc23abSLuigi Rizzo fill_flags(cmd, O_IPOPT, f_ipopts, *av); 43259758b77fSLuigi Rizzo ac--; av++; 43269758b77fSLuigi Rizzo break; 43279758b77fSLuigi Rizzo 43285e43aef8SLuigi Rizzo case TOK_IPTOS: 43295e43aef8SLuigi Rizzo NEED1("missing argument for iptos"); 433052bc23abSLuigi Rizzo fill_flags(cmd, O_IPTOS, f_iptos, *av); 43315e43aef8SLuigi Rizzo ac--; av++; 43325e43aef8SLuigi Rizzo break; 43335e43aef8SLuigi Rizzo 43349758b77fSLuigi Rizzo case TOK_UID: 43359758b77fSLuigi Rizzo NEED1("uid requires argument"); 43369758b77fSLuigi Rizzo { 43379758b77fSLuigi Rizzo char *end; 43389758b77fSLuigi Rizzo uid_t uid; 43399758b77fSLuigi Rizzo struct passwd *pwd; 43409758b77fSLuigi Rizzo 43419758b77fSLuigi Rizzo cmd->opcode = O_UID; 43429758b77fSLuigi Rizzo uid = strtoul(*av, &end, 0); 43439758b77fSLuigi Rizzo pwd = (*end == '\0') ? getpwuid(uid) : getpwnam(*av); 43449758b77fSLuigi Rizzo if (pwd == NULL) 43459758b77fSLuigi Rizzo errx(EX_DATAERR, "uid \"%s\" nonexistent", *av); 4346d6abaeebSMaxim Konovalov cmd32->d[0] = pwd->pw_uid; 43473a27af0dSChristian S.J. Peron cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 43489758b77fSLuigi Rizzo ac--; av++; 43499758b77fSLuigi Rizzo } 43509758b77fSLuigi Rizzo break; 43519758b77fSLuigi Rizzo 43529758b77fSLuigi Rizzo case TOK_GID: 43539758b77fSLuigi Rizzo NEED1("gid requires argument"); 43549758b77fSLuigi Rizzo { 43559758b77fSLuigi Rizzo char *end; 43569758b77fSLuigi Rizzo gid_t gid; 43579758b77fSLuigi Rizzo struct group *grp; 43589758b77fSLuigi Rizzo 43599758b77fSLuigi Rizzo cmd->opcode = O_GID; 43609758b77fSLuigi Rizzo gid = strtoul(*av, &end, 0); 43619758b77fSLuigi Rizzo grp = (*end == '\0') ? getgrgid(gid) : getgrnam(*av); 43629758b77fSLuigi Rizzo if (grp == NULL) 43639758b77fSLuigi Rizzo errx(EX_DATAERR, "gid \"%s\" nonexistent", *av); 4364d6abaeebSMaxim Konovalov cmd32->d[0] = grp->gr_gid; 43653a27af0dSChristian S.J. Peron cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 43669758b77fSLuigi Rizzo ac--; av++; 43679758b77fSLuigi Rizzo } 43689758b77fSLuigi Rizzo break; 43699758b77fSLuigi Rizzo 437031c88a30SChristian S.J. Peron case TOK_JAIL: 437131c88a30SChristian S.J. Peron NEED1("jail requires argument"); 437231c88a30SChristian S.J. Peron { 437331c88a30SChristian S.J. Peron char *end; 437431c88a30SChristian S.J. Peron int jid; 437531c88a30SChristian S.J. Peron 437631c88a30SChristian S.J. Peron cmd->opcode = O_JAIL; 437731c88a30SChristian S.J. Peron jid = (int)strtol(*av, &end, 0); 437831c88a30SChristian S.J. Peron if (jid < 0 || *end != '\0') 437931c88a30SChristian S.J. Peron errx(EX_DATAERR, "jail requires prison ID"); 4380d413c2e4SChristian S.J. Peron cmd32->d[0] = (uint32_t)jid; 43813a27af0dSChristian S.J. Peron cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 438231c88a30SChristian S.J. Peron ac--; av++; 438331c88a30SChristian S.J. Peron } 438431c88a30SChristian S.J. Peron break; 438531c88a30SChristian S.J. Peron 43869758b77fSLuigi Rizzo case TOK_ESTAB: 43879758b77fSLuigi Rizzo fill_cmd(cmd, O_ESTAB, 0, 0); 43889758b77fSLuigi Rizzo break; 43899758b77fSLuigi Rizzo 43909758b77fSLuigi Rizzo case TOK_SETUP: 43919758b77fSLuigi Rizzo fill_cmd(cmd, O_TCPFLAGS, 0, 43929758b77fSLuigi Rizzo (TH_SYN) | ( (TH_ACK) & 0xff) <<8 ); 43939758b77fSLuigi Rizzo break; 43949758b77fSLuigi Rizzo 4395c99ee9e0SBrian Feldman case TOK_TCPDATALEN: 4396c99ee9e0SBrian Feldman NEED1("tcpdatalen requires length"); 4397c99ee9e0SBrian Feldman if (strpbrk(*av, "-,")) { 4398c99ee9e0SBrian Feldman if (!add_ports(cmd, *av, 0, O_TCPDATALEN)) 4399c99ee9e0SBrian Feldman errx(EX_DATAERR, "invalid tcpdata len %s", *av); 4400c99ee9e0SBrian Feldman } else 4401c99ee9e0SBrian Feldman fill_cmd(cmd, O_TCPDATALEN, 0, 4402c99ee9e0SBrian Feldman strtoul(*av, NULL, 0)); 4403c99ee9e0SBrian Feldman ac--; av++; 4404c99ee9e0SBrian Feldman break; 4405c99ee9e0SBrian Feldman 44069758b77fSLuigi Rizzo case TOK_TCPOPTS: 44079758b77fSLuigi Rizzo NEED1("missing argument for tcpoptions"); 44089758b77fSLuigi Rizzo fill_flags(cmd, O_TCPOPTS, f_tcpopts, *av); 44099758b77fSLuigi Rizzo ac--; av++; 44109758b77fSLuigi Rizzo break; 44119758b77fSLuigi Rizzo 44129758b77fSLuigi Rizzo case TOK_TCPSEQ: 44139758b77fSLuigi Rizzo case TOK_TCPACK: 44149758b77fSLuigi Rizzo NEED1("tcpseq/tcpack requires argument"); 44159758b77fSLuigi Rizzo cmd->len = F_INSN_SIZE(ipfw_insn_u32); 44169758b77fSLuigi Rizzo cmd->opcode = (i == TOK_TCPSEQ) ? O_TCPSEQ : O_TCPACK; 44179758b77fSLuigi Rizzo cmd32->d[0] = htonl(strtoul(*av, NULL, 0)); 44189758b77fSLuigi Rizzo ac--; av++; 44199758b77fSLuigi Rizzo break; 44209758b77fSLuigi Rizzo 44219758b77fSLuigi Rizzo case TOK_TCPWIN: 44229758b77fSLuigi Rizzo NEED1("tcpwin requires length"); 44239758b77fSLuigi Rizzo fill_cmd(cmd, O_TCPWIN, 0, 44249758b77fSLuigi Rizzo htons(strtoul(*av, NULL, 0))); 44259758b77fSLuigi Rizzo ac--; av++; 44269758b77fSLuigi Rizzo break; 44279758b77fSLuigi Rizzo 44289758b77fSLuigi Rizzo case TOK_TCPFLAGS: 44299758b77fSLuigi Rizzo NEED1("missing argument for tcpflags"); 44309758b77fSLuigi Rizzo cmd->opcode = O_TCPFLAGS; 44319758b77fSLuigi Rizzo fill_flags(cmd, O_TCPFLAGS, f_tcpflags, *av); 44329758b77fSLuigi Rizzo ac--; av++; 44339758b77fSLuigi Rizzo break; 44349758b77fSLuigi Rizzo 44359758b77fSLuigi Rizzo case TOK_KEEPSTATE: 44368ed2d749SLuigi Rizzo if (open_par) 44378ed2d749SLuigi Rizzo errx(EX_USAGE, "keep-state cannot be part " 44388ed2d749SLuigi Rizzo "of an or block"); 44390a7197a8SLuigi Rizzo if (have_state) 444052bc23abSLuigi Rizzo errx(EX_USAGE, "only one of keep-state " 44410a7197a8SLuigi Rizzo "and limit is allowed"); 444252bc23abSLuigi Rizzo have_state = cmd; 44439758b77fSLuigi Rizzo fill_cmd(cmd, O_KEEP_STATE, 0, 0); 44449758b77fSLuigi Rizzo break; 44459758b77fSLuigi Rizzo 44469758b77fSLuigi Rizzo case TOK_LIMIT: 44478ed2d749SLuigi Rizzo if (open_par) 44488ed2d749SLuigi Rizzo errx(EX_USAGE, "limit cannot be part " 44498ed2d749SLuigi Rizzo "of an or block"); 44500a7197a8SLuigi Rizzo if (have_state) 445152bc23abSLuigi Rizzo errx(EX_USAGE, "only one of keep-state " 44520a7197a8SLuigi Rizzo "and limit is allowed"); 44538ed2d749SLuigi Rizzo NEED1("limit needs mask and # of connections"); 445452bc23abSLuigi Rizzo have_state = cmd; 44559758b77fSLuigi Rizzo { 44569758b77fSLuigi Rizzo ipfw_insn_limit *c = (ipfw_insn_limit *)cmd; 44579758b77fSLuigi Rizzo 44589758b77fSLuigi Rizzo cmd->len = F_INSN_SIZE(ipfw_insn_limit); 44599758b77fSLuigi Rizzo cmd->opcode = O_LIMIT; 44609758b77fSLuigi Rizzo c->limit_mask = 0; 44619758b77fSLuigi Rizzo c->conn_limit = 0; 44629758b77fSLuigi Rizzo for (; ac >1 ;) { 44639758b77fSLuigi Rizzo int val; 44649758b77fSLuigi Rizzo 44659758b77fSLuigi Rizzo val = match_token(limit_masks, *av); 44669758b77fSLuigi Rizzo if (val <= 0) 44679758b77fSLuigi Rizzo break; 44689758b77fSLuigi Rizzo c->limit_mask |= val; 44699758b77fSLuigi Rizzo ac--; av++; 44709758b77fSLuigi Rizzo } 44719758b77fSLuigi Rizzo c->conn_limit = atoi(*av); 44729758b77fSLuigi Rizzo if (c->conn_limit == 0) 44739758b77fSLuigi Rizzo errx(EX_USAGE, "limit: limit must be >0"); 44749758b77fSLuigi Rizzo if (c->limit_mask == 0) 44759758b77fSLuigi Rizzo errx(EX_USAGE, "missing limit mask"); 44769758b77fSLuigi Rizzo ac--; av++; 44779758b77fSLuigi Rizzo } 44789758b77fSLuigi Rizzo break; 44799758b77fSLuigi Rizzo 4480e706181bSLuigi Rizzo case TOK_PROTO: 4481e706181bSLuigi Rizzo NEED1("missing protocol"); 44828195404bSBrooks Davis if (add_proto(cmd, *av, &proto)) { 4483e706181bSLuigi Rizzo ac--; av++; 44845a155b40SLuigi Rizzo } else 4485c82b8dceSMaxim Konovalov errx(EX_DATAERR, "invalid protocol ``%s''", 4486c82b8dceSMaxim Konovalov *av); 4487e706181bSLuigi Rizzo break; 4488e706181bSLuigi Rizzo 4489e706181bSLuigi Rizzo case TOK_SRCIP: 4490e706181bSLuigi Rizzo NEED1("missing source IP"); 4491e706181bSLuigi Rizzo if (add_srcip(cmd, *av)) { 4492e706181bSLuigi Rizzo ac--; av++; 4493e706181bSLuigi Rizzo } 4494e706181bSLuigi Rizzo break; 4495e706181bSLuigi Rizzo 4496e706181bSLuigi Rizzo case TOK_DSTIP: 4497e706181bSLuigi Rizzo NEED1("missing destination IP"); 4498e706181bSLuigi Rizzo if (add_dstip(cmd, *av)) { 4499e706181bSLuigi Rizzo ac--; av++; 4500e706181bSLuigi Rizzo } 4501e706181bSLuigi Rizzo break; 4502e706181bSLuigi Rizzo 45038195404bSBrooks Davis case TOK_SRCIP6: 45048195404bSBrooks Davis NEED1("missing source IP6"); 45058195404bSBrooks Davis if (add_srcip6(cmd, *av)) { 45068195404bSBrooks Davis ac--; av++; 45078195404bSBrooks Davis } 45088195404bSBrooks Davis break; 45098195404bSBrooks Davis 45108195404bSBrooks Davis case TOK_DSTIP6: 45118195404bSBrooks Davis NEED1("missing destination IP6"); 45128195404bSBrooks Davis if (add_dstip6(cmd, *av)) { 45138195404bSBrooks Davis ac--; av++; 45148195404bSBrooks Davis } 45158195404bSBrooks Davis break; 45168195404bSBrooks Davis 4517e706181bSLuigi Rizzo case TOK_SRCPORT: 4518e706181bSLuigi Rizzo NEED1("missing source port"); 451901750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 4520e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_SRCPORT)) { 4521e706181bSLuigi Rizzo ac--; av++; 4522e706181bSLuigi Rizzo } else 4523e706181bSLuigi Rizzo errx(EX_DATAERR, "invalid source port %s", *av); 4524e706181bSLuigi Rizzo break; 4525e706181bSLuigi Rizzo 4526e706181bSLuigi Rizzo case TOK_DSTPORT: 4527e706181bSLuigi Rizzo NEED1("missing destination port"); 452801750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 4529e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_DSTPORT)) { 4530e706181bSLuigi Rizzo ac--; av++; 4531e706181bSLuigi Rizzo } else 4532e706181bSLuigi Rizzo errx(EX_DATAERR, "invalid destination port %s", 4533e706181bSLuigi Rizzo *av); 4534e706181bSLuigi Rizzo break; 4535e706181bSLuigi Rizzo 4536e706181bSLuigi Rizzo case TOK_MAC: 4537e706181bSLuigi Rizzo if (add_mac(cmd, ac, av)) { 4538e706181bSLuigi Rizzo ac -= 2; av += 2; 4539e706181bSLuigi Rizzo } 4540e706181bSLuigi Rizzo break; 4541e706181bSLuigi Rizzo 4542e706181bSLuigi Rizzo case TOK_MACTYPE: 4543e706181bSLuigi Rizzo NEED1("missing mac type"); 4544e706181bSLuigi Rizzo if (!add_mactype(cmd, ac, *av)) 4545c82b8dceSMaxim Konovalov errx(EX_DATAERR, "invalid mac type %s", *av); 4546e706181bSLuigi Rizzo ac--; av++; 4547e706181bSLuigi Rizzo break; 4548e706181bSLuigi Rizzo 4549010dabb0SCrist J. Clark case TOK_VERREVPATH: 4550010dabb0SCrist J. Clark fill_cmd(cmd, O_VERREVPATH, 0, 0); 4551010dabb0SCrist J. Clark break; 4552010dabb0SCrist J. Clark 455322b5770bSAndre Oppermann case TOK_VERSRCREACH: 455422b5770bSAndre Oppermann fill_cmd(cmd, O_VERSRCREACH, 0, 0); 455522b5770bSAndre Oppermann break; 455622b5770bSAndre Oppermann 45575f9541ecSAndre Oppermann case TOK_ANTISPOOF: 45585f9541ecSAndre Oppermann fill_cmd(cmd, O_ANTISPOOF, 0, 0); 45595f9541ecSAndre Oppermann break; 45605f9541ecSAndre Oppermann 4561c3e5b9f1SLuigi Rizzo case TOK_IPSEC: 4562c3e5b9f1SLuigi Rizzo fill_cmd(cmd, O_IPSEC, 0, 0); 4563c3e5b9f1SLuigi Rizzo break; 4564c3e5b9f1SLuigi Rizzo 45658195404bSBrooks Davis case TOK_IPV6: 45668195404bSBrooks Davis fill_cmd(cmd, O_IP6, 0, 0); 45678195404bSBrooks Davis break; 45688195404bSBrooks Davis 456957cd6d26SMax Laier case TOK_IPV4: 457057cd6d26SMax Laier fill_cmd(cmd, O_IP4, 0, 0); 457157cd6d26SMax Laier break; 457257cd6d26SMax Laier 45738195404bSBrooks Davis case TOK_EXT6HDR: 45748195404bSBrooks Davis fill_ext6hdr( cmd, *av ); 45758195404bSBrooks Davis ac--; av++; 45768195404bSBrooks Davis break; 45778195404bSBrooks Davis 45788195404bSBrooks Davis case TOK_FLOWID: 45798195404bSBrooks Davis if (proto != IPPROTO_IPV6 ) 45808195404bSBrooks Davis errx( EX_USAGE, "flow-id filter is active " 45818195404bSBrooks Davis "only for ipv6 protocol\n"); 45828195404bSBrooks Davis fill_flow6( (ipfw_insn_u32 *) cmd, *av ); 45838195404bSBrooks Davis ac--; av++; 45848195404bSBrooks Davis break; 45858195404bSBrooks Davis 458662ff38aeSLuigi Rizzo case TOK_COMMENT: 458762ff38aeSLuigi Rizzo fill_comment(cmd, ac, av); 458862ff38aeSLuigi Rizzo av += ac; 458962ff38aeSLuigi Rizzo ac = 0; 459062ff38aeSLuigi Rizzo break; 459162ff38aeSLuigi Rizzo 45929758b77fSLuigi Rizzo default: 45939758b77fSLuigi Rizzo errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s); 45949758b77fSLuigi Rizzo } 45959758b77fSLuigi Rizzo if (F_LEN(cmd) > 0) { /* prepare to advance */ 45969758b77fSLuigi Rizzo prev = cmd; 45979758b77fSLuigi Rizzo cmd = next_cmd(cmd); 45989758b77fSLuigi Rizzo } 45999758b77fSLuigi Rizzo } 46009758b77fSLuigi Rizzo 46019758b77fSLuigi Rizzo done: 46029758b77fSLuigi Rizzo /* 46039758b77fSLuigi Rizzo * Now copy stuff into the rule. 46049758b77fSLuigi Rizzo * If we have a keep-state option, the first instruction 46059758b77fSLuigi Rizzo * must be a PROBE_STATE (which is generated here). 46069758b77fSLuigi Rizzo * If we have a LOG option, it was stored as the first command, 46079758b77fSLuigi Rizzo * and now must be moved to the top of the action part. 46089758b77fSLuigi Rizzo */ 46099758b77fSLuigi Rizzo dst = (ipfw_insn *)rule->cmd; 46109758b77fSLuigi Rizzo 46119758b77fSLuigi Rizzo /* 461212b5dc6aSLuigi Rizzo * First thing to write into the command stream is the match probability. 461312b5dc6aSLuigi Rizzo */ 461412b5dc6aSLuigi Rizzo if (match_prob != 1) { /* 1 means always match */ 461512b5dc6aSLuigi Rizzo dst->opcode = O_PROB; 461612b5dc6aSLuigi Rizzo dst->len = 2; 461712b5dc6aSLuigi Rizzo *((int32_t *)(dst+1)) = (int32_t)(match_prob * 0x7fffffff); 461812b5dc6aSLuigi Rizzo dst += dst->len; 461912b5dc6aSLuigi Rizzo } 462012b5dc6aSLuigi Rizzo 462112b5dc6aSLuigi Rizzo /* 46229758b77fSLuigi Rizzo * generate O_PROBE_STATE if necessary 46239758b77fSLuigi Rizzo */ 462452bc23abSLuigi Rizzo if (have_state && have_state->opcode != O_CHECK_STATE) { 46259758b77fSLuigi Rizzo fill_cmd(dst, O_PROBE_STATE, 0, 0); 46269758b77fSLuigi Rizzo dst = next_cmd(dst); 46279758b77fSLuigi Rizzo } 46289758b77fSLuigi Rizzo /* 4629974dfe30SBrian Feldman * copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT, O_ALTQ 46309758b77fSLuigi Rizzo */ 46319758b77fSLuigi Rizzo for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) { 46329758b77fSLuigi Rizzo i = F_LEN(src); 46339758b77fSLuigi Rizzo 463452bc23abSLuigi Rizzo switch (src->opcode) { 463552bc23abSLuigi Rizzo case O_LOG: 463652bc23abSLuigi Rizzo case O_KEEP_STATE: 463752bc23abSLuigi Rizzo case O_LIMIT: 4638974dfe30SBrian Feldman case O_ALTQ: 463952bc23abSLuigi Rizzo break; 464052bc23abSLuigi Rizzo default: 4641571f8c1bSLuigi Rizzo bcopy(src, dst, i * sizeof(uint32_t)); 46429758b77fSLuigi Rizzo dst += i; 46439758b77fSLuigi Rizzo } 46449758b77fSLuigi Rizzo } 46459758b77fSLuigi Rizzo 46469758b77fSLuigi Rizzo /* 464752bc23abSLuigi Rizzo * put back the have_state command as last opcode 464852bc23abSLuigi Rizzo */ 4649b985a624SLuigi Rizzo if (have_state && have_state->opcode != O_CHECK_STATE) { 465052bc23abSLuigi Rizzo i = F_LEN(have_state); 4651571f8c1bSLuigi Rizzo bcopy(have_state, dst, i * sizeof(uint32_t)); 465252bc23abSLuigi Rizzo dst += i; 465352bc23abSLuigi Rizzo } 465452bc23abSLuigi Rizzo /* 46559758b77fSLuigi Rizzo * start action section 46569758b77fSLuigi Rizzo */ 46579758b77fSLuigi Rizzo rule->act_ofs = dst - rule->cmd; 46589758b77fSLuigi Rizzo 46599758b77fSLuigi Rizzo /* 4660974dfe30SBrian Feldman * put back O_LOG, O_ALTQ if necessary 46619758b77fSLuigi Rizzo */ 4662974dfe30SBrian Feldman if (have_log) { 4663974dfe30SBrian Feldman i = F_LEN(have_log); 4664974dfe30SBrian Feldman bcopy(have_log, dst, i * sizeof(uint32_t)); 4665974dfe30SBrian Feldman dst += i; 4666974dfe30SBrian Feldman } 4667974dfe30SBrian Feldman if (have_altq) { 4668974dfe30SBrian Feldman i = F_LEN(have_altq); 4669974dfe30SBrian Feldman bcopy(have_altq, dst, i * sizeof(uint32_t)); 46709758b77fSLuigi Rizzo dst += i; 46719758b77fSLuigi Rizzo } 46729758b77fSLuigi Rizzo /* 46739758b77fSLuigi Rizzo * copy all other actions 46749758b77fSLuigi Rizzo */ 46759758b77fSLuigi Rizzo for (src = (ipfw_insn *)actbuf; src != action; src += i) { 46769758b77fSLuigi Rizzo i = F_LEN(src); 4677571f8c1bSLuigi Rizzo bcopy(src, dst, i * sizeof(uint32_t)); 46789758b77fSLuigi Rizzo dst += i; 46799758b77fSLuigi Rizzo } 46809758b77fSLuigi Rizzo 4681571f8c1bSLuigi Rizzo rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd); 468262ff38aeSLuigi Rizzo i = (char *)dst - (char *)rule; 4683884be75cSThomas Moestl if (do_cmd(IP_FW_ADD, rule, (uintptr_t)&i) == -1) 46849758b77fSLuigi Rizzo err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD"); 46859758b77fSLuigi Rizzo if (!do_quiet) 468662ff38aeSLuigi Rizzo show_ipfw(rule, 0, 0); 46879758b77fSLuigi Rizzo } 46889758b77fSLuigi Rizzo 46899758b77fSLuigi Rizzo static void 4690571f8c1bSLuigi Rizzo zero(int ac, char *av[], int optname /* IP_FW_ZERO or IP_FW_RESETLOG */) 46919758b77fSLuigi Rizzo { 46929758b77fSLuigi Rizzo int rulenum; 46939758b77fSLuigi Rizzo int failed = EX_OK; 469462ff38aeSLuigi Rizzo char const *name = optname == IP_FW_ZERO ? "ZERO" : "RESETLOG"; 46959758b77fSLuigi Rizzo 46969758b77fSLuigi Rizzo av++; ac--; 46979758b77fSLuigi Rizzo 46989758b77fSLuigi Rizzo if (!ac) { 46999758b77fSLuigi Rizzo /* clear all entries */ 4700571f8c1bSLuigi Rizzo if (do_cmd(optname, NULL, 0) < 0) 4701571f8c1bSLuigi Rizzo err(EX_UNAVAILABLE, "setsockopt(IP_FW_%s)", name); 47029758b77fSLuigi Rizzo if (!do_quiet) 4703571f8c1bSLuigi Rizzo printf("%s.\n", optname == IP_FW_ZERO ? 4704571f8c1bSLuigi Rizzo "Accounting cleared":"Logging counts reset"); 47059758b77fSLuigi Rizzo 47069758b77fSLuigi Rizzo return; 47079758b77fSLuigi Rizzo } 47089758b77fSLuigi Rizzo 47099758b77fSLuigi Rizzo while (ac) { 47109758b77fSLuigi Rizzo /* Rule number */ 47119758b77fSLuigi Rizzo if (isdigit(**av)) { 47129758b77fSLuigi Rizzo rulenum = atoi(*av); 47139758b77fSLuigi Rizzo av++; 47149758b77fSLuigi Rizzo ac--; 4715571f8c1bSLuigi Rizzo if (do_cmd(optname, &rulenum, sizeof rulenum)) { 4716571f8c1bSLuigi Rizzo warn("rule %u: setsockopt(IP_FW_%s)", 4717571f8c1bSLuigi Rizzo rulenum, name); 47189758b77fSLuigi Rizzo failed = EX_UNAVAILABLE; 47199758b77fSLuigi Rizzo } else if (!do_quiet) 4720571f8c1bSLuigi Rizzo printf("Entry %d %s.\n", rulenum, 4721571f8c1bSLuigi Rizzo optname == IP_FW_ZERO ? 4722571f8c1bSLuigi Rizzo "cleared" : "logging count reset"); 47239758b77fSLuigi Rizzo } else { 47249758b77fSLuigi Rizzo errx(EX_USAGE, "invalid rule number ``%s''", *av); 47259758b77fSLuigi Rizzo } 47269758b77fSLuigi Rizzo } 47279758b77fSLuigi Rizzo if (failed != EX_OK) 47289758b77fSLuigi Rizzo exit(failed); 47299758b77fSLuigi Rizzo } 47309758b77fSLuigi Rizzo 47319758b77fSLuigi Rizzo static void 473226bf4d78SLuigi Rizzo flush(int force) 47339758b77fSLuigi Rizzo { 47349758b77fSLuigi Rizzo int cmd = do_pipe ? IP_DUMMYNET_FLUSH : IP_FW_FLUSH; 47359758b77fSLuigi Rizzo 473626bf4d78SLuigi Rizzo if (!force && !do_quiet) { /* need to ask user */ 47379758b77fSLuigi Rizzo int c; 47389758b77fSLuigi Rizzo 47399758b77fSLuigi Rizzo printf("Are you sure? [yn] "); 47409758b77fSLuigi Rizzo fflush(stdout); 47419758b77fSLuigi Rizzo do { 47429758b77fSLuigi Rizzo c = toupper(getc(stdin)); 47439758b77fSLuigi Rizzo while (c != '\n' && getc(stdin) != '\n') 47449758b77fSLuigi Rizzo if (feof(stdin)) 47459758b77fSLuigi Rizzo return; /* and do not flush */ 47469758b77fSLuigi Rizzo } while (c != 'Y' && c != 'N'); 47479758b77fSLuigi Rizzo printf("\n"); 47489758b77fSLuigi Rizzo if (c == 'N') /* user said no */ 47499758b77fSLuigi Rizzo return; 47509758b77fSLuigi Rizzo } 4751571f8c1bSLuigi Rizzo if (do_cmd(cmd, NULL, 0) < 0) 47529758b77fSLuigi Rizzo err(EX_UNAVAILABLE, "setsockopt(IP_%s_FLUSH)", 47539758b77fSLuigi Rizzo do_pipe ? "DUMMYNET" : "FW"); 47549758b77fSLuigi Rizzo if (!do_quiet) 47559758b77fSLuigi Rizzo printf("Flushed all %s.\n", do_pipe ? "pipes" : "rules"); 47569758b77fSLuigi Rizzo } 47579758b77fSLuigi Rizzo 475862ff38aeSLuigi Rizzo /* 475926bf4d78SLuigi Rizzo * Free a the (locally allocated) copy of command line arguments. 476026bf4d78SLuigi Rizzo */ 476126bf4d78SLuigi Rizzo static void 476226bf4d78SLuigi Rizzo free_args(int ac, char **av) 476326bf4d78SLuigi Rizzo { 476426bf4d78SLuigi Rizzo int i; 476526bf4d78SLuigi Rizzo 476626bf4d78SLuigi Rizzo for (i=0; i < ac; i++) 476726bf4d78SLuigi Rizzo free(av[i]); 476826bf4d78SLuigi Rizzo free(av); 476926bf4d78SLuigi Rizzo } 477026bf4d78SLuigi Rizzo 477126bf4d78SLuigi Rizzo /* 4772cd8b5ae0SRuslan Ermilov * This one handles all table-related commands 4773cd8b5ae0SRuslan Ermilov * ipfw table N add addr[/masklen] [value] 4774cd8b5ae0SRuslan Ermilov * ipfw table N delete addr[/masklen] 4775cd8b5ae0SRuslan Ermilov * ipfw table N flush 4776cd8b5ae0SRuslan Ermilov * ipfw table N list 4777cd8b5ae0SRuslan Ermilov */ 4778cd8b5ae0SRuslan Ermilov static void 4779cd8b5ae0SRuslan Ermilov table_handler(int ac, char *av[]) 4780cd8b5ae0SRuslan Ermilov { 4781cd8b5ae0SRuslan Ermilov ipfw_table_entry ent; 4782cd8b5ae0SRuslan Ermilov ipfw_table *tbl; 4783cd8b5ae0SRuslan Ermilov int do_add; 4784cd8b5ae0SRuslan Ermilov char *p; 4785cd8b5ae0SRuslan Ermilov socklen_t l; 4786cd8b5ae0SRuslan Ermilov uint32_t a; 4787cd8b5ae0SRuslan Ermilov 4788cd8b5ae0SRuslan Ermilov ac--; av++; 4789cd8b5ae0SRuslan Ermilov if (ac && isdigit(**av)) { 4790cd8b5ae0SRuslan Ermilov ent.tbl = atoi(*av); 4791cd8b5ae0SRuslan Ermilov ac--; av++; 4792cd8b5ae0SRuslan Ermilov } else 4793cd8b5ae0SRuslan Ermilov errx(EX_USAGE, "table number required"); 4794cd8b5ae0SRuslan Ermilov NEED1("table needs command"); 479501750186SBrooks Davis if (_substrcmp(*av, "add") == 0 || 479601750186SBrooks Davis _substrcmp(*av, "delete") == 0) { 4797cd8b5ae0SRuslan Ermilov do_add = **av == 'a'; 4798cd8b5ae0SRuslan Ermilov ac--; av++; 4799cd8b5ae0SRuslan Ermilov if (!ac) 4800cd8b5ae0SRuslan Ermilov errx(EX_USAGE, "IP address required"); 4801cd8b5ae0SRuslan Ermilov p = strchr(*av, '/'); 4802cd8b5ae0SRuslan Ermilov if (p) { 4803cd8b5ae0SRuslan Ermilov *p++ = '\0'; 4804cd8b5ae0SRuslan Ermilov ent.masklen = atoi(p); 4805cd8b5ae0SRuslan Ermilov if (ent.masklen > 32) 4806cd8b5ae0SRuslan Ermilov errx(EX_DATAERR, "bad width ``%s''", p); 4807cd8b5ae0SRuslan Ermilov } else 4808cd8b5ae0SRuslan Ermilov ent.masklen = 32; 4809cd8b5ae0SRuslan Ermilov if (lookup_host(*av, (struct in_addr *)&ent.addr) != 0) 48101a41a8e4SRuslan Ermilov errx(EX_NOHOST, "hostname ``%s'' unknown", *av); 4811cd8b5ae0SRuslan Ermilov ac--; av++; 4812cd8b5ae0SRuslan Ermilov if (do_add && ac) 4813cd8b5ae0SRuslan Ermilov ent.value = strtoul(*av, NULL, 0); 4814cd8b5ae0SRuslan Ermilov else 4815cd8b5ae0SRuslan Ermilov ent.value = 0; 4816cd8b5ae0SRuslan Ermilov if (do_cmd(do_add ? IP_FW_TABLE_ADD : IP_FW_TABLE_DEL, 4817cd8b5ae0SRuslan Ermilov &ent, sizeof(ent)) < 0) 4818cd8b5ae0SRuslan Ermilov err(EX_OSERR, "setsockopt(IP_FW_TABLE_%s)", 4819cd8b5ae0SRuslan Ermilov do_add ? "ADD" : "DEL"); 482001750186SBrooks Davis } else if (_substrcmp(*av, "flush") == 0) { 4821cd8b5ae0SRuslan Ermilov if (do_cmd(IP_FW_TABLE_FLUSH, &ent.tbl, sizeof(ent.tbl)) < 0) 4822cd8b5ae0SRuslan Ermilov err(EX_OSERR, "setsockopt(IP_FW_TABLE_FLUSH)"); 482301750186SBrooks Davis } else if (_substrcmp(*av, "list") == 0) { 4824cd8b5ae0SRuslan Ermilov a = ent.tbl; 4825cd8b5ae0SRuslan Ermilov l = sizeof(a); 4826cd8b5ae0SRuslan Ermilov if (do_cmd(IP_FW_TABLE_GETSIZE, &a, (uintptr_t)&l) < 0) 4827cd8b5ae0SRuslan Ermilov err(EX_OSERR, "getsockopt(IP_FW_TABLE_GETSIZE)"); 4828cd8b5ae0SRuslan Ermilov l = sizeof(*tbl) + a * sizeof(ipfw_table_entry); 4829cd8b5ae0SRuslan Ermilov tbl = malloc(l); 4830cd8b5ae0SRuslan Ermilov if (tbl == NULL) 4831cd8b5ae0SRuslan Ermilov err(EX_OSERR, "malloc"); 4832cd8b5ae0SRuslan Ermilov tbl->tbl = ent.tbl; 4833cd8b5ae0SRuslan Ermilov if (do_cmd(IP_FW_TABLE_LIST, tbl, (uintptr_t)&l) < 0) 4834cd8b5ae0SRuslan Ermilov err(EX_OSERR, "getsockopt(IP_FW_TABLE_LIST)"); 4835cd8b5ae0SRuslan Ermilov for (a = 0; a < tbl->cnt; a++) { 4836cd8b5ae0SRuslan Ermilov printf("%s/%u %u\n", 4837cd8b5ae0SRuslan Ermilov inet_ntoa(*(struct in_addr *)&tbl->ent[a].addr), 4838cd8b5ae0SRuslan Ermilov tbl->ent[a].masklen, tbl->ent[a].value); 4839cd8b5ae0SRuslan Ermilov } 4840cd8b5ae0SRuslan Ermilov } else 4841cd8b5ae0SRuslan Ermilov errx(EX_USAGE, "invalid table command %s", *av); 4842cd8b5ae0SRuslan Ermilov } 4843cd8b5ae0SRuslan Ermilov 4844cd8b5ae0SRuslan Ermilov /* 484526bf4d78SLuigi Rizzo * Called with the arguments (excluding program name). 484626bf4d78SLuigi Rizzo * Returns 0 if successful, 1 if empty command, errx() in case of errors. 484762ff38aeSLuigi Rizzo */ 48489758b77fSLuigi Rizzo static int 4849571f8c1bSLuigi Rizzo ipfw_main(int oldac, char **oldav) 48509758b77fSLuigi Rizzo { 485162ff38aeSLuigi Rizzo int ch, ac, save_ac; 485262ff38aeSLuigi Rizzo char **av, **save_av; 485362ff38aeSLuigi Rizzo int do_acct = 0; /* Show packet/byte count */ 4854571f8c1bSLuigi Rizzo 485562ff38aeSLuigi Rizzo #define WHITESP " \t\f\v\n\r" 485626bf4d78SLuigi Rizzo if (oldac == 0) 485726bf4d78SLuigi Rizzo return 1; 485826bf4d78SLuigi Rizzo else if (oldac == 1) { 4859571f8c1bSLuigi Rizzo /* 4860571f8c1bSLuigi Rizzo * If we are called with a single string, try to split it into 4861571f8c1bSLuigi Rizzo * arguments for subsequent parsing. 4862571f8c1bSLuigi Rizzo * But first, remove spaces after a ',', by copying the string 4863571f8c1bSLuigi Rizzo * in-place. 4864571f8c1bSLuigi Rizzo */ 486562ff38aeSLuigi Rizzo char *arg = oldav[0]; /* The string... */ 4866571f8c1bSLuigi Rizzo int l = strlen(arg); 4867571f8c1bSLuigi Rizzo int copy = 0; /* 1 if we need to copy, 0 otherwise */ 4868571f8c1bSLuigi Rizzo int i, j; 486962ff38aeSLuigi Rizzo for (i = j = 0; i < l; i++) { 487062ff38aeSLuigi Rizzo if (arg[i] == '#') /* comment marker */ 487162ff38aeSLuigi Rizzo break; 4872571f8c1bSLuigi Rizzo if (copy) { 4873571f8c1bSLuigi Rizzo arg[j++] = arg[i]; 487462ff38aeSLuigi Rizzo copy = !index("," WHITESP, arg[i]); 4875571f8c1bSLuigi Rizzo } else { 487662ff38aeSLuigi Rizzo copy = !index(WHITESP, arg[i]); 4877571f8c1bSLuigi Rizzo if (copy) 4878571f8c1bSLuigi Rizzo arg[j++] = arg[i]; 4879571f8c1bSLuigi Rizzo } 488062ff38aeSLuigi Rizzo } 4881571f8c1bSLuigi Rizzo if (!copy && j > 0) /* last char was a 'blank', remove it */ 4882571f8c1bSLuigi Rizzo j--; 4883571f8c1bSLuigi Rizzo l = j; /* the new argument length */ 4884571f8c1bSLuigi Rizzo arg[j++] = '\0'; 488562ff38aeSLuigi Rizzo if (l == 0) /* empty string! */ 488626bf4d78SLuigi Rizzo return 1; 4887571f8c1bSLuigi Rizzo 4888571f8c1bSLuigi Rizzo /* 4889571f8c1bSLuigi Rizzo * First, count number of arguments. Because of the previous 489062ff38aeSLuigi Rizzo * processing, this is just the number of blanks plus 1. 4891571f8c1bSLuigi Rizzo */ 4892571f8c1bSLuigi Rizzo for (i = 0, ac = 1; i < l; i++) 489362ff38aeSLuigi Rizzo if (index(WHITESP, arg[i]) != NULL) 4894571f8c1bSLuigi Rizzo ac++; 4895571f8c1bSLuigi Rizzo 4896571f8c1bSLuigi Rizzo av = calloc(ac, sizeof(char *)); 4897571f8c1bSLuigi Rizzo 4898571f8c1bSLuigi Rizzo /* 4899571f8c1bSLuigi Rizzo * Second, copy arguments from cmd[] to av[]. For each one, 4900571f8c1bSLuigi Rizzo * j is the initial character, i is the one past the end. 4901571f8c1bSLuigi Rizzo */ 490262ff38aeSLuigi Rizzo for (ac = 0, i = j = 0; i < l; i++) 490362ff38aeSLuigi Rizzo if (index(WHITESP, arg[i]) != NULL || i == l-1) { 4904571f8c1bSLuigi Rizzo if (i == l-1) 4905571f8c1bSLuigi Rizzo i++; 4906571f8c1bSLuigi Rizzo av[ac] = calloc(i-j+1, 1); 4907571f8c1bSLuigi Rizzo bcopy(arg+j, av[ac], i-j); 4908571f8c1bSLuigi Rizzo ac++; 4909571f8c1bSLuigi Rizzo j = i + 1; 4910571f8c1bSLuigi Rizzo } 4911571f8c1bSLuigi Rizzo } else { 4912571f8c1bSLuigi Rizzo /* 4913571f8c1bSLuigi Rizzo * If an argument ends with ',' join with the next one. 4914571f8c1bSLuigi Rizzo */ 4915571f8c1bSLuigi Rizzo int first, i, l; 4916571f8c1bSLuigi Rizzo 4917571f8c1bSLuigi Rizzo av = calloc(oldac, sizeof(char *)); 4918571f8c1bSLuigi Rizzo for (first = i = ac = 0, l = 0; i < oldac; i++) { 4919571f8c1bSLuigi Rizzo char *arg = oldav[i]; 4920571f8c1bSLuigi Rizzo int k = strlen(arg); 4921571f8c1bSLuigi Rizzo 4922571f8c1bSLuigi Rizzo l += k; 4923571f8c1bSLuigi Rizzo if (arg[k-1] != ',' || i == oldac-1) { 4924571f8c1bSLuigi Rizzo /* Time to copy. */ 4925571f8c1bSLuigi Rizzo av[ac] = calloc(l+1, 1); 4926571f8c1bSLuigi Rizzo for (l=0; first <= i; first++) { 4927571f8c1bSLuigi Rizzo strcat(av[ac]+l, oldav[first]); 4928571f8c1bSLuigi Rizzo l += strlen(oldav[first]); 4929571f8c1bSLuigi Rizzo } 4930571f8c1bSLuigi Rizzo ac++; 4931571f8c1bSLuigi Rizzo l = 0; 4932571f8c1bSLuigi Rizzo first = i+1; 4933571f8c1bSLuigi Rizzo } 4934571f8c1bSLuigi Rizzo } 4935571f8c1bSLuigi Rizzo } 49369758b77fSLuigi Rizzo 49379758b77fSLuigi Rizzo /* Set the force flag for non-interactive processes */ 4938cec4ab6aSMaxim Konovalov if (!do_force) 49399758b77fSLuigi Rizzo do_force = !isatty(STDIN_FILENO); 49409758b77fSLuigi Rizzo 494162ff38aeSLuigi Rizzo /* Save arguments for final freeing of memory. */ 494262ff38aeSLuigi Rizzo save_ac = ac; 494362ff38aeSLuigi Rizzo save_av = av; 494462ff38aeSLuigi Rizzo 494562ff38aeSLuigi Rizzo optind = optreset = 0; 4946ac6cec51SLuigi Rizzo while ((ch = getopt(ac, av, "abcdefhnNqs:STtv")) != -1) 49479758b77fSLuigi Rizzo switch (ch) { 4948571f8c1bSLuigi Rizzo case 'a': 4949571f8c1bSLuigi Rizzo do_acct = 1; 4950571f8c1bSLuigi Rizzo break; 4951571f8c1bSLuigi Rizzo 4952ac6cec51SLuigi Rizzo case 'b': 4953ac6cec51SLuigi Rizzo comment_only = 1; 4954ac6cec51SLuigi Rizzo do_compact = 1; 4955ac6cec51SLuigi Rizzo break; 4956ac6cec51SLuigi Rizzo 4957571f8c1bSLuigi Rizzo case 'c': 4958571f8c1bSLuigi Rizzo do_compact = 1; 4959571f8c1bSLuigi Rizzo break; 4960571f8c1bSLuigi Rizzo 4961571f8c1bSLuigi Rizzo case 'd': 4962571f8c1bSLuigi Rizzo do_dynamic = 1; 4963571f8c1bSLuigi Rizzo break; 4964571f8c1bSLuigi Rizzo 4965571f8c1bSLuigi Rizzo case 'e': 4966571f8c1bSLuigi Rizzo do_expired = 1; 4967571f8c1bSLuigi Rizzo break; 4968571f8c1bSLuigi Rizzo 4969571f8c1bSLuigi Rizzo case 'f': 4970571f8c1bSLuigi Rizzo do_force = 1; 4971571f8c1bSLuigi Rizzo break; 4972571f8c1bSLuigi Rizzo 49739758b77fSLuigi Rizzo case 'h': /* help */ 497426bf4d78SLuigi Rizzo free_args(save_ac, save_av); 49759758b77fSLuigi Rizzo help(); 49769758b77fSLuigi Rizzo break; /* NOTREACHED */ 49779758b77fSLuigi Rizzo 4978571f8c1bSLuigi Rizzo case 'n': 4979571f8c1bSLuigi Rizzo test_only = 1; 49809758b77fSLuigi Rizzo break; 4981571f8c1bSLuigi Rizzo 49829758b77fSLuigi Rizzo case 'N': 49839758b77fSLuigi Rizzo do_resolv = 1; 49849758b77fSLuigi Rizzo break; 4985571f8c1bSLuigi Rizzo 49869758b77fSLuigi Rizzo case 'q': 49879758b77fSLuigi Rizzo do_quiet = 1; 49889758b77fSLuigi Rizzo break; 4989571f8c1bSLuigi Rizzo 4990571f8c1bSLuigi Rizzo case 's': /* sort */ 4991571f8c1bSLuigi Rizzo do_sort = atoi(optarg); 4992571f8c1bSLuigi Rizzo break; 4993571f8c1bSLuigi Rizzo 499443405724SLuigi Rizzo case 'S': 499543405724SLuigi Rizzo show_sets = 1; 499643405724SLuigi Rizzo break; 4997571f8c1bSLuigi Rizzo 49989758b77fSLuigi Rizzo case 't': 49999758b77fSLuigi Rizzo do_time = 1; 50009758b77fSLuigi Rizzo break; 5001571f8c1bSLuigi Rizzo 50021b43a426SLuigi Rizzo case 'T': 50031b43a426SLuigi Rizzo do_time = 2; /* numeric timestamp */ 50041b43a426SLuigi Rizzo break; 50051b43a426SLuigi Rizzo 50069758b77fSLuigi Rizzo case 'v': /* verbose */ 5007571f8c1bSLuigi Rizzo verbose = 1; 50089758b77fSLuigi Rizzo break; 5009571f8c1bSLuigi Rizzo 50109758b77fSLuigi Rizzo default: 501126bf4d78SLuigi Rizzo free_args(save_ac, save_av); 501226bf4d78SLuigi Rizzo return 1; 50139758b77fSLuigi Rizzo } 50149758b77fSLuigi Rizzo 50159758b77fSLuigi Rizzo ac -= optind; 50169758b77fSLuigi Rizzo av += optind; 50179758b77fSLuigi Rizzo NEED1("bad arguments, for usage summary ``ipfw''"); 50189758b77fSLuigi Rizzo 50199758b77fSLuigi Rizzo /* 502026bf4d78SLuigi Rizzo * An undocumented behaviour of ipfw1 was to allow rule numbers first, 502126bf4d78SLuigi Rizzo * e.g. "100 add allow ..." instead of "add 100 allow ...". 502226bf4d78SLuigi Rizzo * In case, swap first and second argument to get the normal form. 502326bf4d78SLuigi Rizzo */ 502426bf4d78SLuigi Rizzo if (ac > 1 && isdigit(*av[0])) { 502526bf4d78SLuigi Rizzo char *p = av[0]; 502626bf4d78SLuigi Rizzo 502726bf4d78SLuigi Rizzo av[0] = av[1]; 502826bf4d78SLuigi Rizzo av[1] = p; 502926bf4d78SLuigi Rizzo } 503026bf4d78SLuigi Rizzo 503126bf4d78SLuigi Rizzo /* 50329758b77fSLuigi Rizzo * optional: pipe or queue 50339758b77fSLuigi Rizzo */ 50346fa74f7dSMaxim Konovalov do_pipe = 0; 503501750186SBrooks Davis if (_substrcmp(*av, "pipe") == 0) 50369758b77fSLuigi Rizzo do_pipe = 1; 503701750186SBrooks Davis else if (_substrcmp(*av, "queue") == 0) 50389758b77fSLuigi Rizzo do_pipe = 2; 503926bf4d78SLuigi Rizzo if (do_pipe) { 50409758b77fSLuigi Rizzo ac--; 50419758b77fSLuigi Rizzo av++; 50429758b77fSLuigi Rizzo } 50439758b77fSLuigi Rizzo NEED1("missing command"); 50449758b77fSLuigi Rizzo 50459758b77fSLuigi Rizzo /* 5046571f8c1bSLuigi Rizzo * For pipes and queues we normally say 'pipe NN config' 50479758b77fSLuigi Rizzo * but the code is easier to parse as 'pipe config NN' 50489758b77fSLuigi Rizzo * so we swap the two arguments. 50499758b77fSLuigi Rizzo */ 505062ff38aeSLuigi Rizzo if (do_pipe > 0 && ac > 1 && isdigit(*av[0])) { 50519758b77fSLuigi Rizzo char *p = av[0]; 505226bf4d78SLuigi Rizzo 50539758b77fSLuigi Rizzo av[0] = av[1]; 50549758b77fSLuigi Rizzo av[1] = p; 50559758b77fSLuigi Rizzo } 5056571f8c1bSLuigi Rizzo 505701750186SBrooks Davis if (_substrcmp(*av, "add") == 0) 50589758b77fSLuigi Rizzo add(ac, av); 505901750186SBrooks Davis else if (do_pipe && _substrcmp(*av, "config") == 0) 50609758b77fSLuigi Rizzo config_pipe(ac, av); 506101750186SBrooks Davis else if (_substrcmp(*av, "delete") == 0) 50629758b77fSLuigi Rizzo delete(ac, av); 506301750186SBrooks Davis else if (_substrcmp(*av, "flush") == 0) 506426bf4d78SLuigi Rizzo flush(do_force); 506501750186SBrooks Davis else if (_substrcmp(*av, "zero") == 0) 5066571f8c1bSLuigi Rizzo zero(ac, av, IP_FW_ZERO); 506701750186SBrooks Davis else if (_substrcmp(*av, "resetlog") == 0) 5068571f8c1bSLuigi Rizzo zero(ac, av, IP_FW_RESETLOG); 506901750186SBrooks Davis else if (_substrcmp(*av, "print") == 0 || 507001750186SBrooks Davis _substrcmp(*av, "list") == 0) 507162ff38aeSLuigi Rizzo list(ac, av, do_acct); 507201750186SBrooks Davis else if (_substrcmp(*av, "set") == 0) 507399e5e645SLuigi Rizzo sets_handler(ac, av); 507401750186SBrooks Davis else if (_substrcmp(*av, "table") == 0) 5075cd8b5ae0SRuslan Ermilov table_handler(ac, av); 507601750186SBrooks Davis else if (_substrcmp(*av, "enable") == 0) 50776690be9eSMatthew Dillon sysctl_handler(ac, av, 1); 507801750186SBrooks Davis else if (_substrcmp(*av, "disable") == 0) 50796690be9eSMatthew Dillon sysctl_handler(ac, av, 0); 508001750186SBrooks Davis else if (_substrcmp(*av, "show") == 0) 508162ff38aeSLuigi Rizzo list(ac, av, 1 /* show counters */); 508262ff38aeSLuigi Rizzo else 50839758b77fSLuigi Rizzo errx(EX_USAGE, "bad command `%s'", *av); 508462ff38aeSLuigi Rizzo 508562ff38aeSLuigi Rizzo /* Free memory allocated in the argument parsing. */ 508626bf4d78SLuigi Rizzo free_args(save_ac, save_av); 50879758b77fSLuigi Rizzo return 0; 50889758b77fSLuigi Rizzo } 50899758b77fSLuigi Rizzo 50909758b77fSLuigi Rizzo 50919758b77fSLuigi Rizzo static void 50929758b77fSLuigi Rizzo ipfw_readfile(int ac, char *av[]) 50939758b77fSLuigi Rizzo { 50949758b77fSLuigi Rizzo #define MAX_ARGS 32 50959758b77fSLuigi Rizzo char buf[BUFSIZ]; 509662ff38aeSLuigi Rizzo char *cmd = NULL, *filename = av[ac-1]; 509762ff38aeSLuigi Rizzo int c, lineno=0; 50989758b77fSLuigi Rizzo FILE *f = NULL; 50999758b77fSLuigi Rizzo pid_t preproc = 0; 51009758b77fSLuigi Rizzo 510162ff38aeSLuigi Rizzo filename = av[ac-1]; 510262ff38aeSLuigi Rizzo 5103cec4ab6aSMaxim Konovalov while ((c = getopt(ac, av, "cfNnp:qS")) != -1) { 51049758b77fSLuigi Rizzo switch(c) { 510562ff38aeSLuigi Rizzo case 'c': 510662ff38aeSLuigi Rizzo do_compact = 1; 510762ff38aeSLuigi Rizzo break; 510862ff38aeSLuigi Rizzo 5109cec4ab6aSMaxim Konovalov case 'f': 5110cec4ab6aSMaxim Konovalov do_force = 1; 5111cec4ab6aSMaxim Konovalov break; 5112cec4ab6aSMaxim Konovalov 511362ff38aeSLuigi Rizzo case 'N': 511462ff38aeSLuigi Rizzo do_resolv = 1; 511562ff38aeSLuigi Rizzo break; 511662ff38aeSLuigi Rizzo 5117571f8c1bSLuigi Rizzo case 'n': 5118571f8c1bSLuigi Rizzo test_only = 1; 5119571f8c1bSLuigi Rizzo break; 5120571f8c1bSLuigi Rizzo 51219758b77fSLuigi Rizzo case 'p': 51229758b77fSLuigi Rizzo cmd = optarg; 512362ff38aeSLuigi Rizzo /* 512462ff38aeSLuigi Rizzo * Skip previous args and delete last one, so we 512562ff38aeSLuigi Rizzo * pass all but the last argument to the preprocessor 512662ff38aeSLuigi Rizzo * via av[optind-1] 512762ff38aeSLuigi Rizzo */ 512862ff38aeSLuigi Rizzo av += optind - 1; 512962ff38aeSLuigi Rizzo ac -= optind - 1; 513062ff38aeSLuigi Rizzo av[ac-1] = NULL; 513162ff38aeSLuigi Rizzo fprintf(stderr, "command is %s\n", av[0]); 51329758b77fSLuigi Rizzo break; 51339758b77fSLuigi Rizzo 51349758b77fSLuigi Rizzo case 'q': 513562ff38aeSLuigi Rizzo do_quiet = 1; 513662ff38aeSLuigi Rizzo break; 513762ff38aeSLuigi Rizzo 513862ff38aeSLuigi Rizzo case 'S': 513962ff38aeSLuigi Rizzo show_sets = 1; 51409758b77fSLuigi Rizzo break; 51419758b77fSLuigi Rizzo 51429758b77fSLuigi Rizzo default: 51439758b77fSLuigi Rizzo errx(EX_USAGE, "bad arguments, for usage" 51449758b77fSLuigi Rizzo " summary ``ipfw''"); 51459758b77fSLuigi Rizzo } 51469758b77fSLuigi Rizzo 514762ff38aeSLuigi Rizzo if (cmd != NULL) 5148ca6e3cb0SKelly Yancey break; 5149ca6e3cb0SKelly Yancey } 5150ca6e3cb0SKelly Yancey 515162ff38aeSLuigi Rizzo if (cmd == NULL && ac != optind + 1) { 515262ff38aeSLuigi Rizzo fprintf(stderr, "ac %d, optind %d\n", ac, optind); 51539758b77fSLuigi Rizzo errx(EX_USAGE, "extraneous filename arguments"); 515462ff38aeSLuigi Rizzo } 51559758b77fSLuigi Rizzo 515662ff38aeSLuigi Rizzo if ((f = fopen(filename, "r")) == NULL) 515762ff38aeSLuigi Rizzo err(EX_UNAVAILABLE, "fopen: %s", filename); 51589758b77fSLuigi Rizzo 515962ff38aeSLuigi Rizzo if (cmd != NULL) { /* pipe through preprocessor */ 51609758b77fSLuigi Rizzo int pipedes[2]; 51619758b77fSLuigi Rizzo 51629758b77fSLuigi Rizzo if (pipe(pipedes) == -1) 51639758b77fSLuigi Rizzo err(EX_OSERR, "cannot create pipe"); 51649758b77fSLuigi Rizzo 516562ff38aeSLuigi Rizzo preproc = fork(); 516662ff38aeSLuigi Rizzo if (preproc == -1) 51679758b77fSLuigi Rizzo err(EX_OSERR, "cannot fork"); 51689758b77fSLuigi Rizzo 516962ff38aeSLuigi Rizzo if (preproc == 0) { 517062ff38aeSLuigi Rizzo /* 517162ff38aeSLuigi Rizzo * Child, will run the preprocessor with the 517262ff38aeSLuigi Rizzo * file on stdin and the pipe on stdout. 517362ff38aeSLuigi Rizzo */ 51749758b77fSLuigi Rizzo if (dup2(fileno(f), 0) == -1 51759758b77fSLuigi Rizzo || dup2(pipedes[1], 1) == -1) 51769758b77fSLuigi Rizzo err(EX_OSERR, "dup2()"); 51779758b77fSLuigi Rizzo fclose(f); 51789758b77fSLuigi Rizzo close(pipedes[1]); 51799758b77fSLuigi Rizzo close(pipedes[0]); 518062ff38aeSLuigi Rizzo execvp(cmd, av); 51819758b77fSLuigi Rizzo err(EX_OSERR, "execvp(%s) failed", cmd); 518262ff38aeSLuigi Rizzo } else { /* parent, will reopen f as the pipe */ 51839758b77fSLuigi Rizzo fclose(f); 51849758b77fSLuigi Rizzo close(pipedes[1]); 51859758b77fSLuigi Rizzo if ((f = fdopen(pipedes[0], "r")) == NULL) { 51869758b77fSLuigi Rizzo int savederrno = errno; 51879758b77fSLuigi Rizzo 51889758b77fSLuigi Rizzo (void)kill(preproc, SIGTERM); 51899758b77fSLuigi Rizzo errno = savederrno; 51909758b77fSLuigi Rizzo err(EX_OSERR, "fdopen()"); 51919758b77fSLuigi Rizzo } 51929758b77fSLuigi Rizzo } 51939758b77fSLuigi Rizzo } 51949758b77fSLuigi Rizzo 519562ff38aeSLuigi Rizzo while (fgets(buf, BUFSIZ, f)) { /* read commands */ 519662ff38aeSLuigi Rizzo char linename[10]; 519762ff38aeSLuigi Rizzo char *args[1]; 519862ff38aeSLuigi Rizzo 51999758b77fSLuigi Rizzo lineno++; 5200571f8c1bSLuigi Rizzo sprintf(linename, "Line %d", lineno); 5201571f8c1bSLuigi Rizzo setprogname(linename); /* XXX */ 520262ff38aeSLuigi Rizzo args[0] = buf; 520362ff38aeSLuigi Rizzo ipfw_main(1, args); 52049758b77fSLuigi Rizzo } 52059758b77fSLuigi Rizzo fclose(f); 520662ff38aeSLuigi Rizzo if (cmd != NULL) { 520762ff38aeSLuigi Rizzo int status; 520862ff38aeSLuigi Rizzo 52099758b77fSLuigi Rizzo if (waitpid(preproc, &status, 0) == -1) 52109758b77fSLuigi Rizzo errx(EX_OSERR, "waitpid()"); 52119758b77fSLuigi Rizzo if (WIFEXITED(status) && WEXITSTATUS(status) != EX_OK) 52129758b77fSLuigi Rizzo errx(EX_UNAVAILABLE, 52139758b77fSLuigi Rizzo "preprocessor exited with status %d", 52149758b77fSLuigi Rizzo WEXITSTATUS(status)); 52159758b77fSLuigi Rizzo else if (WIFSIGNALED(status)) 52169758b77fSLuigi Rizzo errx(EX_UNAVAILABLE, 52179758b77fSLuigi Rizzo "preprocessor exited with signal %d", 52189758b77fSLuigi Rizzo WTERMSIG(status)); 52199758b77fSLuigi Rizzo } 52209758b77fSLuigi Rizzo } 52219758b77fSLuigi Rizzo 52229758b77fSLuigi Rizzo int 52239758b77fSLuigi Rizzo main(int ac, char *av[]) 52249758b77fSLuigi Rizzo { 52259758b77fSLuigi Rizzo /* 52269758b77fSLuigi Rizzo * If the last argument is an absolute pathname, interpret it 52279758b77fSLuigi Rizzo * as a file to be preprocessed. 52289758b77fSLuigi Rizzo */ 52299758b77fSLuigi Rizzo 52309758b77fSLuigi Rizzo if (ac > 1 && av[ac - 1][0] == '/' && access(av[ac - 1], R_OK) == 0) 52319758b77fSLuigi Rizzo ipfw_readfile(ac, av); 523226bf4d78SLuigi Rizzo else { 523326bf4d78SLuigi Rizzo if (ipfw_main(ac-1, av+1)) 523426bf4d78SLuigi Rizzo show_usage(); 523526bf4d78SLuigi Rizzo } 52369758b77fSLuigi Rizzo return EX_OK; 52379758b77fSLuigi Rizzo } 5238