19758b77fSLuigi Rizzo /* 2571f8c1bSLuigi Rizzo * Copyright (c) 2002-2003 Luigi Rizzo 39758b77fSLuigi Rizzo * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 49758b77fSLuigi Rizzo * Copyright (c) 1994 Ugen J.S.Antsilevich 59758b77fSLuigi Rizzo * 69758b77fSLuigi Rizzo * Idea and grammar partially left from: 79758b77fSLuigi Rizzo * Copyright (c) 1993 Daniel Boulet 89758b77fSLuigi Rizzo * 99758b77fSLuigi Rizzo * Redistribution and use in source forms, with and without modification, 109758b77fSLuigi Rizzo * are permitted provided that this entire comment appears intact. 119758b77fSLuigi Rizzo * 129758b77fSLuigi Rizzo * Redistribution in binary form may occur without any restrictions. 139758b77fSLuigi Rizzo * Obviously, it would be nice if you gave credit where credit is due 149758b77fSLuigi Rizzo * but requiring it would be too onerous. 159758b77fSLuigi Rizzo * 169758b77fSLuigi Rizzo * This software is provided ``AS IS'' without any warranties of any kind. 179758b77fSLuigi Rizzo * 189758b77fSLuigi Rizzo * NEW command line interface for IP firewall facility 199758b77fSLuigi Rizzo * 209758b77fSLuigi Rizzo * $FreeBSD$ 219758b77fSLuigi Rizzo */ 229758b77fSLuigi Rizzo 23e5dbf736SLuigi Rizzo #include <sys/types.h> 245f301949SBen Laurie #include <sys/param.h> 259758b77fSLuigi Rizzo #include <sys/socket.h> 269758b77fSLuigi Rizzo #include <sys/sockio.h> 279758b77fSLuigi Rizzo #include <sys/sysctl.h> 283c0c8717SLuigi Rizzo 293c0c8717SLuigi Rizzo #include "ipfw2.h" 309758b77fSLuigi Rizzo 319758b77fSLuigi Rizzo #include <ctype.h> 329758b77fSLuigi Rizzo #include <err.h> 339758b77fSLuigi Rizzo #include <errno.h> 349758b77fSLuigi Rizzo #include <grp.h> 359758b77fSLuigi Rizzo #include <netdb.h> 369758b77fSLuigi Rizzo #include <pwd.h> 379758b77fSLuigi Rizzo #include <stdio.h> 389758b77fSLuigi Rizzo #include <stdlib.h> 399758b77fSLuigi Rizzo #include <string.h> 409758b77fSLuigi Rizzo #include <sysexits.h> 4123c608c8SLuigi Rizzo #include <time.h> /* ctime */ 42e5dbf736SLuigi Rizzo #include <timeconv.h> /* _long_to_time */ 43974dfe30SBrian Feldman #include <unistd.h> 44974dfe30SBrian Feldman #include <fcntl.h> 45*f8bee51aSAlexander V. Chernikov #include <stddef.h> /* offsetof */ 469758b77fSLuigi Rizzo 47bd1d3456SMaxim Konovalov #include <net/ethernet.h> 4823c608c8SLuigi Rizzo #include <net/if.h> /* only IFNAMSIZ */ 499758b77fSLuigi Rizzo #include <netinet/in.h> 5023c608c8SLuigi Rizzo #include <netinet/in_systm.h> /* only n_short, n_long */ 519758b77fSLuigi Rizzo #include <netinet/ip.h> 529758b77fSLuigi Rizzo #include <netinet/ip_icmp.h> 539758b77fSLuigi Rizzo #include <netinet/ip_fw.h> 549758b77fSLuigi Rizzo #include <netinet/tcp.h> 559758b77fSLuigi Rizzo #include <arpa/inet.h> 569758b77fSLuigi Rizzo 573c0c8717SLuigi Rizzo struct cmdline_opts co; /* global options */ 58db7c5224SLuigi Rizzo 593c0c8717SLuigi Rizzo int resvd_set_number = RESVD_SET; 609758b77fSLuigi Rizzo 61*f8bee51aSAlexander V. Chernikov int ipfw_socket = -1; 62*f8bee51aSAlexander V. Chernikov 63*f8bee51aSAlexander V. Chernikov #ifndef s6_addr32 64*f8bee51aSAlexander V. Chernikov #define s6_addr32 __u6_addr.__u6_addr32 65*f8bee51aSAlexander V. Chernikov #endif 66*f8bee51aSAlexander V. Chernikov 67254c4725SOleg Bulyzhin #define GET_UINT_ARG(arg, min, max, tok, s_x) do { \ 68cc4d3c30SLuigi Rizzo if (!av[0]) \ 69254c4725SOleg Bulyzhin errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \ 70254c4725SOleg Bulyzhin if (_substrcmp(*av, "tablearg") == 0) { \ 71254c4725SOleg Bulyzhin arg = IP_FW_TABLEARG; \ 72254c4725SOleg Bulyzhin break; \ 736a7d5cb6SOleg Bulyzhin } \ 74254c4725SOleg Bulyzhin \ 75254c4725SOleg Bulyzhin { \ 76cc4d3c30SLuigi Rizzo long _xval; \ 77254c4725SOleg Bulyzhin char *end; \ 78254c4725SOleg Bulyzhin \ 79cc4d3c30SLuigi Rizzo _xval = strtol(*av, &end, 10); \ 80254c4725SOleg Bulyzhin \ 81cc4d3c30SLuigi Rizzo if (!isdigit(**av) || *end != '\0' || (_xval == 0 && errno == EINVAL)) \ 82254c4725SOleg Bulyzhin errx(EX_DATAERR, "%s: invalid argument: %s", \ 83254c4725SOleg Bulyzhin match_value(s_x, tok), *av); \ 84254c4725SOleg Bulyzhin \ 85cc4d3c30SLuigi Rizzo if (errno == ERANGE || _xval < min || _xval > max) \ 86254c4725SOleg Bulyzhin errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \ 87254c4725SOleg Bulyzhin match_value(s_x, tok), min, max, *av); \ 88254c4725SOleg Bulyzhin \ 89cc4d3c30SLuigi Rizzo if (_xval == IP_FW_TABLEARG) \ 90254c4725SOleg Bulyzhin errx(EX_DATAERR, "%s: illegal argument value: %s", \ 91254c4725SOleg Bulyzhin match_value(s_x, tok), *av); \ 92cc4d3c30SLuigi Rizzo arg = _xval; \ 93254c4725SOleg Bulyzhin } \ 94254c4725SOleg Bulyzhin } while (0) 95254c4725SOleg Bulyzhin 96be39e0b2SLuigi Rizzo static void 97be39e0b2SLuigi Rizzo PRINT_UINT_ARG(const char *str, uint32_t arg) 98be39e0b2SLuigi Rizzo { 99be39e0b2SLuigi Rizzo if (str != NULL) 100be39e0b2SLuigi Rizzo printf("%s",str); 101be39e0b2SLuigi Rizzo if (arg == IP_FW_TABLEARG) 102be39e0b2SLuigi Rizzo printf("tablearg"); 103be39e0b2SLuigi Rizzo else 104be39e0b2SLuigi Rizzo printf("%u", arg); 105be39e0b2SLuigi Rizzo } 1066a7d5cb6SOleg Bulyzhin 1079758b77fSLuigi Rizzo static struct _s_x f_tcpflags[] = { 1089758b77fSLuigi Rizzo { "syn", TH_SYN }, 1099758b77fSLuigi Rizzo { "fin", TH_FIN }, 1109758b77fSLuigi Rizzo { "ack", TH_ACK }, 1119758b77fSLuigi Rizzo { "psh", TH_PUSH }, 1129758b77fSLuigi Rizzo { "rst", TH_RST }, 1139758b77fSLuigi Rizzo { "urg", TH_URG }, 1149758b77fSLuigi Rizzo { "tcp flag", 0 }, 1159758b77fSLuigi Rizzo { NULL, 0 } 1169758b77fSLuigi Rizzo }; 1179758b77fSLuigi Rizzo 1189758b77fSLuigi Rizzo static struct _s_x f_tcpopts[] = { 1199758b77fSLuigi Rizzo { "mss", IP_FW_TCPOPT_MSS }, 1209758b77fSLuigi Rizzo { "maxseg", IP_FW_TCPOPT_MSS }, 1219758b77fSLuigi Rizzo { "window", IP_FW_TCPOPT_WINDOW }, 1229758b77fSLuigi Rizzo { "sack", IP_FW_TCPOPT_SACK }, 1239758b77fSLuigi Rizzo { "ts", IP_FW_TCPOPT_TS }, 1249758b77fSLuigi Rizzo { "timestamp", IP_FW_TCPOPT_TS }, 1259758b77fSLuigi Rizzo { "cc", IP_FW_TCPOPT_CC }, 1269758b77fSLuigi Rizzo { "tcp option", 0 }, 1279758b77fSLuigi Rizzo { NULL, 0 } 1289758b77fSLuigi Rizzo }; 1299758b77fSLuigi Rizzo 1309758b77fSLuigi Rizzo /* 1319758b77fSLuigi Rizzo * IP options span the range 0 to 255 so we need to remap them 1329758b77fSLuigi Rizzo * (though in fact only the low 5 bits are significant). 1339758b77fSLuigi Rizzo */ 1349758b77fSLuigi Rizzo static struct _s_x f_ipopts[] = { 1359758b77fSLuigi Rizzo { "ssrr", IP_FW_IPOPT_SSRR}, 1369758b77fSLuigi Rizzo { "lsrr", IP_FW_IPOPT_LSRR}, 1379758b77fSLuigi Rizzo { "rr", IP_FW_IPOPT_RR}, 1389758b77fSLuigi Rizzo { "ts", IP_FW_IPOPT_TS}, 1399758b77fSLuigi Rizzo { "ip option", 0 }, 1409758b77fSLuigi Rizzo { NULL, 0 } 1419758b77fSLuigi Rizzo }; 1429758b77fSLuigi Rizzo 1439758b77fSLuigi Rizzo static struct _s_x f_iptos[] = { 1449758b77fSLuigi Rizzo { "lowdelay", IPTOS_LOWDELAY}, 1459758b77fSLuigi Rizzo { "throughput", IPTOS_THROUGHPUT}, 1469758b77fSLuigi Rizzo { "reliability", IPTOS_RELIABILITY}, 1479758b77fSLuigi Rizzo { "mincost", IPTOS_MINCOST}, 14806d703efSRui Paulo { "congestion", IPTOS_ECN_CE}, 14906d703efSRui Paulo { "ecntransport", IPTOS_ECN_ECT0}, 1509758b77fSLuigi Rizzo { "ip tos option", 0}, 1519758b77fSLuigi Rizzo { NULL, 0 } 1529758b77fSLuigi Rizzo }; 1539758b77fSLuigi Rizzo 1549758b77fSLuigi Rizzo static struct _s_x limit_masks[] = { 1559758b77fSLuigi Rizzo {"all", DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT}, 1569758b77fSLuigi Rizzo {"src-addr", DYN_SRC_ADDR}, 1579758b77fSLuigi Rizzo {"src-port", DYN_SRC_PORT}, 1589758b77fSLuigi Rizzo {"dst-addr", DYN_DST_ADDR}, 1599758b77fSLuigi Rizzo {"dst-port", DYN_DST_PORT}, 1609758b77fSLuigi Rizzo {NULL, 0} 1619758b77fSLuigi Rizzo }; 1629758b77fSLuigi Rizzo 1639758b77fSLuigi Rizzo /* 1649758b77fSLuigi Rizzo * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines 1659758b77fSLuigi Rizzo * This is only used in this code. 1669758b77fSLuigi Rizzo */ 1679758b77fSLuigi Rizzo #define IPPROTO_ETHERTYPE 0x1000 1689758b77fSLuigi Rizzo static struct _s_x ether_types[] = { 1699758b77fSLuigi Rizzo /* 1709758b77fSLuigi Rizzo * Note, we cannot use "-:&/" in the names because they are field 1719758b77fSLuigi Rizzo * separators in the type specifications. Also, we use s = NULL as 1729758b77fSLuigi Rizzo * end-delimiter, because a type of 0 can be legal. 1739758b77fSLuigi Rizzo */ 1749758b77fSLuigi Rizzo { "ip", 0x0800 }, 1759758b77fSLuigi Rizzo { "ipv4", 0x0800 }, 1769758b77fSLuigi Rizzo { "ipv6", 0x86dd }, 1779758b77fSLuigi Rizzo { "arp", 0x0806 }, 1789758b77fSLuigi Rizzo { "rarp", 0x8035 }, 1799758b77fSLuigi Rizzo { "vlan", 0x8100 }, 1809758b77fSLuigi Rizzo { "loop", 0x9000 }, 1819758b77fSLuigi Rizzo { "trail", 0x1000 }, 1829758b77fSLuigi Rizzo { "at", 0x809b }, 1839758b77fSLuigi Rizzo { "atalk", 0x809b }, 1849758b77fSLuigi Rizzo { "aarp", 0x80f3 }, 1859758b77fSLuigi Rizzo { "pppoe_disc", 0x8863 }, 1869758b77fSLuigi Rizzo { "pppoe_sess", 0x8864 }, 1879758b77fSLuigi Rizzo { "ipx_8022", 0x00E0 }, 1889758b77fSLuigi Rizzo { "ipx_8023", 0x0000 }, 1899758b77fSLuigi Rizzo { "ipx_ii", 0x8137 }, 1909758b77fSLuigi Rizzo { "ipx_snap", 0x8137 }, 1919758b77fSLuigi Rizzo { "ipx", 0x8137 }, 1929758b77fSLuigi Rizzo { "ns", 0x0600 }, 1939758b77fSLuigi Rizzo { NULL, 0 } 1949758b77fSLuigi Rizzo }; 1959758b77fSLuigi Rizzo 1969758b77fSLuigi Rizzo 1974e9c8ae7SLuigi Rizzo static struct _s_x rule_actions[] = { 1989758b77fSLuigi Rizzo { "accept", TOK_ACCEPT }, 1999758b77fSLuigi Rizzo { "pass", TOK_ACCEPT }, 2009758b77fSLuigi Rizzo { "allow", TOK_ACCEPT }, 2019758b77fSLuigi Rizzo { "permit", TOK_ACCEPT }, 2029758b77fSLuigi Rizzo { "count", TOK_COUNT }, 2039758b77fSLuigi Rizzo { "pipe", TOK_PIPE }, 2049758b77fSLuigi Rizzo { "queue", TOK_QUEUE }, 2059758b77fSLuigi Rizzo { "divert", TOK_DIVERT }, 2069758b77fSLuigi Rizzo { "tee", TOK_TEE }, 207670742a1SGleb Smirnoff { "netgraph", TOK_NETGRAPH }, 208670742a1SGleb Smirnoff { "ngtee", TOK_NGTEE }, 2099758b77fSLuigi Rizzo { "fwd", TOK_FORWARD }, 2109758b77fSLuigi Rizzo { "forward", TOK_FORWARD }, 2119758b77fSLuigi Rizzo { "skipto", TOK_SKIPTO }, 2129758b77fSLuigi Rizzo { "deny", TOK_DENY }, 2139758b77fSLuigi Rizzo { "drop", TOK_DENY }, 2149758b77fSLuigi Rizzo { "reject", TOK_REJECT }, 2159066356bSBjoern A. Zeeb { "reset6", TOK_RESET6 }, 2169758b77fSLuigi Rizzo { "reset", TOK_RESET }, 2179066356bSBjoern A. Zeeb { "unreach6", TOK_UNREACH6 }, 2185e43aef8SLuigi Rizzo { "unreach", TOK_UNREACH }, 2199758b77fSLuigi Rizzo { "check-state", TOK_CHECKSTATE }, 22062ff38aeSLuigi Rizzo { "//", TOK_COMMENT }, 221ff2f6fe8SPaolo Pisati { "nat", TOK_NAT }, 222eb2e4119SPaolo Pisati { "reass", TOK_REASS }, 2238b07e49aSJulian Elischer { "setfib", TOK_SETFIB }, 2249527ec6eSAndrey V. Elsukov { "call", TOK_CALL }, 2259527ec6eSAndrey V. Elsukov { "return", TOK_RETURN }, 226571f8c1bSLuigi Rizzo { NULL, 0 } /* terminator */ 2279758b77fSLuigi Rizzo }; 2289758b77fSLuigi Rizzo 2294e9c8ae7SLuigi Rizzo static struct _s_x rule_action_params[] = { 230974dfe30SBrian Feldman { "altq", TOK_ALTQ }, 231974dfe30SBrian Feldman { "log", TOK_LOG }, 2326a7d5cb6SOleg Bulyzhin { "tag", TOK_TAG }, 2336a7d5cb6SOleg Bulyzhin { "untag", TOK_UNTAG }, 234974dfe30SBrian Feldman { NULL, 0 } /* terminator */ 235974dfe30SBrian Feldman }; 236974dfe30SBrian Feldman 237472099c4SLuigi Rizzo /* 238472099c4SLuigi Rizzo * The 'lookup' instruction accepts one of the following arguments. 239472099c4SLuigi Rizzo * -1 is a terminator for the list. 240472099c4SLuigi Rizzo * Arguments are passed as v[1] in O_DST_LOOKUP options. 241472099c4SLuigi Rizzo */ 242472099c4SLuigi Rizzo static int lookup_key[] = { 243472099c4SLuigi Rizzo TOK_DSTIP, TOK_SRCIP, TOK_DSTPORT, TOK_SRCPORT, 24472662a75SLuigi Rizzo TOK_UID, TOK_JAIL, TOK_DSCP, -1 }; 245472099c4SLuigi Rizzo 2464e9c8ae7SLuigi Rizzo static struct _s_x rule_options[] = { 2476a7d5cb6SOleg Bulyzhin { "tagged", TOK_TAGGED }, 2489758b77fSLuigi Rizzo { "uid", TOK_UID }, 2499758b77fSLuigi Rizzo { "gid", TOK_GID }, 25031c88a30SChristian S.J. Peron { "jail", TOK_JAIL }, 2519758b77fSLuigi Rizzo { "in", TOK_IN }, 2529758b77fSLuigi Rizzo { "limit", TOK_LIMIT }, 2539758b77fSLuigi Rizzo { "keep-state", TOK_KEEPSTATE }, 2549758b77fSLuigi Rizzo { "bridged", TOK_LAYER2 }, 2559758b77fSLuigi Rizzo { "layer2", TOK_LAYER2 }, 2569758b77fSLuigi Rizzo { "out", TOK_OUT }, 2576daf7ebdSBrian Feldman { "diverted", TOK_DIVERTED }, 2586daf7ebdSBrian Feldman { "diverted-loopback", TOK_DIVERTEDLOOPBACK }, 2596daf7ebdSBrian Feldman { "diverted-output", TOK_DIVERTEDOUTPUT }, 2609758b77fSLuigi Rizzo { "xmit", TOK_XMIT }, 2619758b77fSLuigi Rizzo { "recv", TOK_RECV }, 2629758b77fSLuigi Rizzo { "via", TOK_VIA }, 2639758b77fSLuigi Rizzo { "fragment", TOK_FRAG }, 2649758b77fSLuigi Rizzo { "frag", TOK_FRAG }, 2658b07e49aSJulian Elischer { "fib", TOK_FIB }, 2669758b77fSLuigi Rizzo { "ipoptions", TOK_IPOPTS }, 2679758b77fSLuigi Rizzo { "ipopts", TOK_IPOPTS }, 2689758b77fSLuigi Rizzo { "iplen", TOK_IPLEN }, 2699758b77fSLuigi Rizzo { "ipid", TOK_IPID }, 2709758b77fSLuigi Rizzo { "ipprecedence", TOK_IPPRECEDENCE }, 27172662a75SLuigi Rizzo { "dscp", TOK_DSCP }, 2729758b77fSLuigi Rizzo { "iptos", TOK_IPTOS }, 2739758b77fSLuigi Rizzo { "ipttl", TOK_IPTTL }, 2749758b77fSLuigi Rizzo { "ipversion", TOK_IPVER }, 2759758b77fSLuigi Rizzo { "ipver", TOK_IPVER }, 2769758b77fSLuigi Rizzo { "estab", TOK_ESTAB }, 2779758b77fSLuigi Rizzo { "established", TOK_ESTAB }, 2789758b77fSLuigi Rizzo { "setup", TOK_SETUP }, 279ae99fd0eSLuigi Rizzo { "sockarg", TOK_SOCKARG }, 280c99ee9e0SBrian Feldman { "tcpdatalen", TOK_TCPDATALEN }, 2819758b77fSLuigi Rizzo { "tcpflags", TOK_TCPFLAGS }, 2829758b77fSLuigi Rizzo { "tcpflgs", TOK_TCPFLAGS }, 2839758b77fSLuigi Rizzo { "tcpoptions", TOK_TCPOPTS }, 2849758b77fSLuigi Rizzo { "tcpopts", TOK_TCPOPTS }, 2859758b77fSLuigi Rizzo { "tcpseq", TOK_TCPSEQ }, 2869758b77fSLuigi Rizzo { "tcpack", TOK_TCPACK }, 2879758b77fSLuigi Rizzo { "tcpwin", TOK_TCPWIN }, 2880a7197a8SLuigi Rizzo { "icmptype", TOK_ICMPTYPES }, 2899758b77fSLuigi Rizzo { "icmptypes", TOK_ICMPTYPES }, 290e706181bSLuigi Rizzo { "dst-ip", TOK_DSTIP }, 291e706181bSLuigi Rizzo { "src-ip", TOK_SRCIP }, 292e706181bSLuigi Rizzo { "dst-port", TOK_DSTPORT }, 293e706181bSLuigi Rizzo { "src-port", TOK_SRCPORT }, 294e706181bSLuigi Rizzo { "proto", TOK_PROTO }, 295e706181bSLuigi Rizzo { "MAC", TOK_MAC }, 296e706181bSLuigi Rizzo { "mac", TOK_MAC }, 297e706181bSLuigi Rizzo { "mac-type", TOK_MACTYPE }, 298010dabb0SCrist J. Clark { "verrevpath", TOK_VERREVPATH }, 29922b5770bSAndre Oppermann { "versrcreach", TOK_VERSRCREACH }, 3005f9541ecSAndre Oppermann { "antispoof", TOK_ANTISPOOF }, 301c3e5b9f1SLuigi Rizzo { "ipsec", TOK_IPSEC }, 3028195404bSBrooks Davis { "icmp6type", TOK_ICMP6TYPES }, 3038195404bSBrooks Davis { "icmp6types", TOK_ICMP6TYPES }, 3048195404bSBrooks Davis { "ext6hdr", TOK_EXT6HDR}, 3058195404bSBrooks Davis { "flow-id", TOK_FLOWID}, 3068195404bSBrooks Davis { "ipv6", TOK_IPV6}, 3078195404bSBrooks Davis { "ip6", TOK_IPV6}, 30857cd6d26SMax Laier { "ipv4", TOK_IPV4}, 30957cd6d26SMax Laier { "ip4", TOK_IPV4}, 3108195404bSBrooks Davis { "dst-ipv6", TOK_DSTIP6}, 3118195404bSBrooks Davis { "dst-ip6", TOK_DSTIP6}, 3128195404bSBrooks Davis { "src-ipv6", TOK_SRCIP6}, 3138195404bSBrooks Davis { "src-ip6", TOK_SRCIP6}, 314472099c4SLuigi Rizzo { "lookup", TOK_LOOKUP}, 31562ff38aeSLuigi Rizzo { "//", TOK_COMMENT }, 3169758b77fSLuigi Rizzo 3179758b77fSLuigi Rizzo { "not", TOK_NOT }, /* pseudo option */ 3189758b77fSLuigi Rizzo { "!", /* escape ? */ TOK_NOT }, /* pseudo option */ 3199758b77fSLuigi Rizzo { "or", TOK_OR }, /* pseudo option */ 3209758b77fSLuigi Rizzo { "|", /* escape */ TOK_OR }, /* pseudo option */ 3218ed2d749SLuigi Rizzo { "{", TOK_STARTBRACE }, /* pseudo option */ 3228ed2d749SLuigi Rizzo { "(", TOK_STARTBRACE }, /* pseudo option */ 3238ed2d749SLuigi Rizzo { "}", TOK_ENDBRACE }, /* pseudo option */ 3248ed2d749SLuigi Rizzo { ")", TOK_ENDBRACE }, /* pseudo option */ 325571f8c1bSLuigi Rizzo { NULL, 0 } /* terminator */ 3269758b77fSLuigi Rizzo }; 3279758b77fSLuigi Rizzo 32850a99912SLuigi Rizzo /* 32937133ba7SLuigi Rizzo * Helper routine to print a possibly unaligned uint64_t on 33037133ba7SLuigi Rizzo * various platform. If width > 0, print the value with 33137133ba7SLuigi Rizzo * the desired width, followed by a space; 33237133ba7SLuigi Rizzo * otherwise, return the required width. 33350a99912SLuigi Rizzo */ 33437133ba7SLuigi Rizzo int 33537133ba7SLuigi Rizzo pr_u64(uint64_t *pd, int width) 33650a99912SLuigi Rizzo { 33737133ba7SLuigi Rizzo #ifdef TCC 33837133ba7SLuigi Rizzo #define U64_FMT "I64" 33937133ba7SLuigi Rizzo #else 34037133ba7SLuigi Rizzo #define U64_FMT "llu" 34137133ba7SLuigi Rizzo #endif 342d55ebfbdSLuigi Rizzo uint64_t u; 343d55ebfbdSLuigi Rizzo unsigned long long d; 344330462a3SBernd Walter 345d55ebfbdSLuigi Rizzo bcopy (pd, &u, sizeof(u)); 346d55ebfbdSLuigi Rizzo d = u; 34737133ba7SLuigi Rizzo return (width > 0) ? 34837133ba7SLuigi Rizzo printf("%*" U64_FMT " ", width, d) : 34937133ba7SLuigi Rizzo snprintf(NULL, 0, "%" U64_FMT, d) ; 35037133ba7SLuigi Rizzo #undef U64_FMT 351c85c1d27SStefan Farfeleder } 352330462a3SBernd Walter 3533c0c8717SLuigi Rizzo void * 3545f356082SLuigi Rizzo safe_calloc(size_t number, size_t size) 3555f356082SLuigi Rizzo { 3565f356082SLuigi Rizzo void *ret = calloc(number, size); 3575f356082SLuigi Rizzo 3585f356082SLuigi Rizzo if (ret == NULL) 3595f356082SLuigi Rizzo err(EX_OSERR, "calloc"); 3605f356082SLuigi Rizzo return ret; 3615f356082SLuigi Rizzo } 3625f356082SLuigi Rizzo 3633c0c8717SLuigi Rizzo void * 3645f356082SLuigi Rizzo safe_realloc(void *ptr, size_t size) 3655f356082SLuigi Rizzo { 3665f356082SLuigi Rizzo void *ret = realloc(ptr, size); 3675f356082SLuigi Rizzo 3685f356082SLuigi Rizzo if (ret == NULL) 3695f356082SLuigi Rizzo err(EX_OSERR, "realloc"); 3705f356082SLuigi Rizzo return ret; 3715f356082SLuigi Rizzo } 3725f356082SLuigi Rizzo 373571f8c1bSLuigi Rizzo /* 374571f8c1bSLuigi Rizzo * conditionally runs the command. 375cc4d3c30SLuigi Rizzo * Selected options or negative -> getsockopt 376571f8c1bSLuigi Rizzo */ 3774e9c8ae7SLuigi Rizzo int 378884be75cSThomas Moestl do_cmd(int optname, void *optval, uintptr_t optlen) 379571f8c1bSLuigi Rizzo { 380571f8c1bSLuigi Rizzo int i; 381571f8c1bSLuigi Rizzo 382db7c5224SLuigi Rizzo if (co.test_only) 383571f8c1bSLuigi Rizzo return 0; 384571f8c1bSLuigi Rizzo 385*f8bee51aSAlexander V. Chernikov if (ipfw_socket == -1) 386*f8bee51aSAlexander V. Chernikov ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 387*f8bee51aSAlexander V. Chernikov if (ipfw_socket < 0) 388571f8c1bSLuigi Rizzo err(EX_UNAVAILABLE, "socket"); 389571f8c1bSLuigi Rizzo 390571f8c1bSLuigi Rizzo if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET || 391*f8bee51aSAlexander V. Chernikov optname == IP_FW_ADD || optname == IP_FW3 || 392ff2f6fe8SPaolo Pisati optname == IP_FW_NAT_GET_CONFIG || 393cc4d3c30SLuigi Rizzo optname < 0 || 394cc4d3c30SLuigi Rizzo optname == IP_FW_NAT_GET_LOG) { 395cc4d3c30SLuigi Rizzo if (optname < 0) 396cc4d3c30SLuigi Rizzo optname = -optname; 397*f8bee51aSAlexander V. Chernikov i = getsockopt(ipfw_socket, IPPROTO_IP, optname, optval, 398571f8c1bSLuigi Rizzo (socklen_t *)optlen); 399cc4d3c30SLuigi Rizzo } else { 400*f8bee51aSAlexander V. Chernikov i = setsockopt(ipfw_socket, IPPROTO_IP, optname, optval, optlen); 401cc4d3c30SLuigi Rizzo } 402571f8c1bSLuigi Rizzo return i; 403571f8c1bSLuigi Rizzo } 404571f8c1bSLuigi Rizzo 405*f8bee51aSAlexander V. Chernikov /* 406*f8bee51aSAlexander V. Chernikov * do_setcmd3 - pass ipfw control cmd to kernel 407*f8bee51aSAlexander V. Chernikov * @optname: option name 408*f8bee51aSAlexander V. Chernikov * @optval: pointer to option data 409*f8bee51aSAlexander V. Chernikov * @optlen: option length 410*f8bee51aSAlexander V. Chernikov * 411*f8bee51aSAlexander V. Chernikov * Function encapsulates option value in IP_FW3 socket option 412*f8bee51aSAlexander V. Chernikov * and calls setsockopt(). 413*f8bee51aSAlexander V. Chernikov * Function returns 0 on success or -1 otherwise. 414*f8bee51aSAlexander V. Chernikov */ 415*f8bee51aSAlexander V. Chernikov int 416*f8bee51aSAlexander V. Chernikov do_setcmd3(int optname, void *optval, socklen_t optlen) 417*f8bee51aSAlexander V. Chernikov { 418*f8bee51aSAlexander V. Chernikov socklen_t len; 419*f8bee51aSAlexander V. Chernikov ip_fw3_opheader *op3; 420*f8bee51aSAlexander V. Chernikov 421*f8bee51aSAlexander V. Chernikov if (co.test_only) 422*f8bee51aSAlexander V. Chernikov return (0); 423*f8bee51aSAlexander V. Chernikov 424*f8bee51aSAlexander V. Chernikov if (ipfw_socket == -1) 425*f8bee51aSAlexander V. Chernikov ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 426*f8bee51aSAlexander V. Chernikov if (ipfw_socket < 0) 427*f8bee51aSAlexander V. Chernikov err(EX_UNAVAILABLE, "socket"); 428*f8bee51aSAlexander V. Chernikov 429*f8bee51aSAlexander V. Chernikov len = sizeof(ip_fw3_opheader) + optlen; 430*f8bee51aSAlexander V. Chernikov op3 = alloca(len); 431*f8bee51aSAlexander V. Chernikov /* Zero reserved fields */ 432*f8bee51aSAlexander V. Chernikov memset(op3, 0, sizeof(ip_fw3_opheader)); 433*f8bee51aSAlexander V. Chernikov memcpy(op3 + 1, optval, optlen); 434*f8bee51aSAlexander V. Chernikov op3->opcode = optname; 435*f8bee51aSAlexander V. Chernikov 436*f8bee51aSAlexander V. Chernikov return setsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3, len); 437*f8bee51aSAlexander V. Chernikov } 438*f8bee51aSAlexander V. Chernikov 4399758b77fSLuigi Rizzo /** 4409758b77fSLuigi Rizzo * match_token takes a table and a string, returns the value associated 441571f8c1bSLuigi Rizzo * with the string (-1 in case of failure). 4429758b77fSLuigi Rizzo */ 4434e9c8ae7SLuigi Rizzo int 4449758b77fSLuigi Rizzo match_token(struct _s_x *table, char *string) 4459758b77fSLuigi Rizzo { 4469758b77fSLuigi Rizzo struct _s_x *pt; 44762ff38aeSLuigi Rizzo uint i = strlen(string); 4489758b77fSLuigi Rizzo 4499758b77fSLuigi Rizzo for (pt = table ; i && pt->s != NULL ; pt++) 4509758b77fSLuigi Rizzo if (strlen(pt->s) == i && !bcmp(string, pt->s, i)) 4519758b77fSLuigi Rizzo return pt->x; 4529758b77fSLuigi Rizzo return -1; 453c85c1d27SStefan Farfeleder } 4549758b77fSLuigi Rizzo 455571f8c1bSLuigi Rizzo /** 456571f8c1bSLuigi Rizzo * match_value takes a table and a value, returns the string associated 457571f8c1bSLuigi Rizzo * with the value (NULL in case of failure). 458571f8c1bSLuigi Rizzo */ 459ead75a59SLuigi Rizzo char const * 46062ff38aeSLuigi Rizzo match_value(struct _s_x *p, int value) 4619758b77fSLuigi Rizzo { 4629758b77fSLuigi Rizzo for (; p->s != NULL; p++) 4639758b77fSLuigi Rizzo if (p->x == value) 4649758b77fSLuigi Rizzo return p->s; 4659758b77fSLuigi Rizzo return NULL; 4669758b77fSLuigi Rizzo } 4679758b77fSLuigi Rizzo 4689758b77fSLuigi Rizzo /* 46901750186SBrooks Davis * _substrcmp takes two strings and returns 1 if they do not match, 47001750186SBrooks Davis * and 0 if they match exactly or the first string is a sub-string 47101750186SBrooks Davis * of the second. A warning is printed to stderr in the case that the 47201750186SBrooks Davis * first string is a sub-string of the second. 47301750186SBrooks Davis * 47401750186SBrooks Davis * This function will be removed in the future through the usual 47501750186SBrooks Davis * deprecation process. 47601750186SBrooks Davis */ 4773c0c8717SLuigi Rizzo int 47801750186SBrooks Davis _substrcmp(const char *str1, const char* str2) 47901750186SBrooks Davis { 48001750186SBrooks Davis 48101750186SBrooks Davis if (strncmp(str1, str2, strlen(str1)) != 0) 48201750186SBrooks Davis return 1; 48301750186SBrooks Davis 48401750186SBrooks Davis if (strlen(str1) != strlen(str2)) 48501750186SBrooks Davis warnx("DEPRECATED: '%s' matched '%s' as a sub-string", 48601750186SBrooks Davis str1, str2); 48701750186SBrooks Davis return 0; 48801750186SBrooks Davis } 48901750186SBrooks Davis 49001750186SBrooks Davis /* 49101750186SBrooks Davis * _substrcmp2 takes three strings and returns 1 if the first two do not match, 49201750186SBrooks Davis * and 0 if they match exactly or the second string is a sub-string 49301750186SBrooks Davis * of the first. A warning is printed to stderr in the case that the 49401750186SBrooks Davis * first string does not match the third. 49501750186SBrooks Davis * 4964b85a12fSUlrich Spörlein * This function exists to warn about the bizarre construction 4974b85a12fSUlrich Spörlein * strncmp(str, "by", 2) which is used to allow people to use a shortcut 49801750186SBrooks Davis * for "bytes". The problem is that in addition to accepting "by", 49901750186SBrooks Davis * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any 50001750186SBrooks Davis * other string beginning with "by". 50101750186SBrooks Davis * 50201750186SBrooks Davis * This function will be removed in the future through the usual 50301750186SBrooks Davis * deprecation process. 50401750186SBrooks Davis */ 5054e9c8ae7SLuigi Rizzo int 50601750186SBrooks Davis _substrcmp2(const char *str1, const char* str2, const char* str3) 50701750186SBrooks Davis { 50801750186SBrooks Davis 50901750186SBrooks Davis if (strncmp(str1, str2, strlen(str2)) != 0) 51001750186SBrooks Davis return 1; 51101750186SBrooks Davis 51201750186SBrooks Davis if (strcmp(str1, str3) != 0) 51301750186SBrooks Davis warnx("DEPRECATED: '%s' matched '%s'", 51401750186SBrooks Davis str1, str3); 51501750186SBrooks Davis return 0; 51601750186SBrooks Davis } 51701750186SBrooks Davis 51801750186SBrooks Davis /* 5199758b77fSLuigi Rizzo * prints one port, symbolic or numeric 5209758b77fSLuigi Rizzo */ 5219758b77fSLuigi Rizzo static void 522571f8c1bSLuigi Rizzo print_port(int proto, uint16_t port) 5239758b77fSLuigi Rizzo { 5249758b77fSLuigi Rizzo 5259758b77fSLuigi Rizzo if (proto == IPPROTO_ETHERTYPE) { 52662ff38aeSLuigi Rizzo char const *s; 5279758b77fSLuigi Rizzo 528db7c5224SLuigi Rizzo if (co.do_resolv && (s = match_value(ether_types, port)) ) 5299758b77fSLuigi Rizzo printf("%s", s); 5309758b77fSLuigi Rizzo else 5319758b77fSLuigi Rizzo printf("0x%04x", port); 5329758b77fSLuigi Rizzo } else { 5339758b77fSLuigi Rizzo struct servent *se = NULL; 534db7c5224SLuigi Rizzo if (co.do_resolv) { 5359758b77fSLuigi Rizzo struct protoent *pe = getprotobynumber(proto); 5369758b77fSLuigi Rizzo 5379758b77fSLuigi Rizzo se = getservbyport(htons(port), pe ? pe->p_name : NULL); 5389758b77fSLuigi Rizzo } 5399758b77fSLuigi Rizzo if (se) 5409758b77fSLuigi Rizzo printf("%s", se->s_name); 5419758b77fSLuigi Rizzo else 5429758b77fSLuigi Rizzo printf("%d", port); 5439758b77fSLuigi Rizzo } 5449758b77fSLuigi Rizzo } 5459758b77fSLuigi Rizzo 5464e9c8ae7SLuigi Rizzo static struct _s_x _port_name[] = { 547571f8c1bSLuigi Rizzo {"dst-port", O_IP_DSTPORT}, 548571f8c1bSLuigi Rizzo {"src-port", O_IP_SRCPORT}, 549571f8c1bSLuigi Rizzo {"ipid", O_IPID}, 550571f8c1bSLuigi Rizzo {"iplen", O_IPLEN}, 551571f8c1bSLuigi Rizzo {"ipttl", O_IPTTL}, 552571f8c1bSLuigi Rizzo {"mac-type", O_MAC_TYPE}, 553c99ee9e0SBrian Feldman {"tcpdatalen", O_TCPDATALEN}, 55423ccd3d9SGleb Smirnoff {"tcpwin", O_TCPWIN}, 5556a7d5cb6SOleg Bulyzhin {"tagged", O_TAGGED}, 556571f8c1bSLuigi Rizzo {NULL, 0} 557571f8c1bSLuigi Rizzo }; 558571f8c1bSLuigi Rizzo 5599758b77fSLuigi Rizzo /* 560571f8c1bSLuigi Rizzo * Print the values in a list 16-bit items of the types above. 5619758b77fSLuigi Rizzo * XXX todo: add support for mask. 5629758b77fSLuigi Rizzo */ 5639758b77fSLuigi Rizzo static void 564e706181bSLuigi Rizzo print_newports(ipfw_insn_u16 *cmd, int proto, int opcode) 5659758b77fSLuigi Rizzo { 566571f8c1bSLuigi Rizzo uint16_t *p = cmd->ports; 5679758b77fSLuigi Rizzo int i; 56862ff38aeSLuigi Rizzo char const *sep; 5699758b77fSLuigi Rizzo 57044c884e1SLuigi Rizzo if (opcode != 0) { 571571f8c1bSLuigi Rizzo sep = match_value(_port_name, opcode); 572571f8c1bSLuigi Rizzo if (sep == NULL) 57344c884e1SLuigi Rizzo sep = "???"; 57444c884e1SLuigi Rizzo printf (" %s", sep); 57544c884e1SLuigi Rizzo } 57644c884e1SLuigi Rizzo sep = " "; 5779758b77fSLuigi Rizzo for (i = F_LEN((ipfw_insn *)cmd) - 1; i > 0; i--, p += 2) { 57891dbeea7SLuigi Rizzo printf("%s", sep); 5799758b77fSLuigi Rizzo print_port(proto, p[0]); 5809758b77fSLuigi Rizzo if (p[0] != p[1]) { 5819758b77fSLuigi Rizzo printf("-"); 5829758b77fSLuigi Rizzo print_port(proto, p[1]); 5839758b77fSLuigi Rizzo } 5849758b77fSLuigi Rizzo sep = ","; 5859758b77fSLuigi Rizzo } 5869758b77fSLuigi Rizzo } 5879758b77fSLuigi Rizzo 5889758b77fSLuigi Rizzo /* 5899758b77fSLuigi Rizzo * Like strtol, but also translates service names into port numbers 5909758b77fSLuigi Rizzo * for some protocols. 5919758b77fSLuigi Rizzo * In particular: 5929758b77fSLuigi Rizzo * proto == -1 disables the protocol check; 5939758b77fSLuigi Rizzo * proto == IPPROTO_ETHERTYPE looks up an internal table 5949758b77fSLuigi Rizzo * proto == <some value in /etc/protocols> matches the values there. 59543405724SLuigi Rizzo * Returns *end == s in case the parameter is not found. 5969758b77fSLuigi Rizzo */ 5979758b77fSLuigi Rizzo static int 5989758b77fSLuigi Rizzo strtoport(char *s, char **end, int base, int proto) 5999758b77fSLuigi Rizzo { 60043405724SLuigi Rizzo char *p, *buf; 60143405724SLuigi Rizzo char *s1; 6029758b77fSLuigi Rizzo int i; 6039758b77fSLuigi Rizzo 60443405724SLuigi Rizzo *end = s; /* default - not found */ 6059758b77fSLuigi Rizzo if (*s == '\0') 60643405724SLuigi Rizzo return 0; /* not found */ 6079758b77fSLuigi Rizzo 6089758b77fSLuigi Rizzo if (isdigit(*s)) 6099758b77fSLuigi Rizzo return strtol(s, end, base); 6109758b77fSLuigi Rizzo 6119758b77fSLuigi Rizzo /* 61243405724SLuigi Rizzo * find separator. '\\' escapes the next char. 6139758b77fSLuigi Rizzo */ 61443405724SLuigi Rizzo for (s1 = s; *s1 && (isalnum(*s1) || *s1 == '\\') ; s1++) 61543405724SLuigi Rizzo if (*s1 == '\\' && s1[1] != '\0') 61643405724SLuigi Rizzo s1++; 61743405724SLuigi Rizzo 6185f356082SLuigi Rizzo buf = safe_calloc(s1 - s + 1, 1); 61943405724SLuigi Rizzo 62043405724SLuigi Rizzo /* 62143405724SLuigi Rizzo * copy into a buffer skipping backslashes 62243405724SLuigi Rizzo */ 62343405724SLuigi Rizzo for (p = s, i = 0; p != s1 ; p++) 62443405724SLuigi Rizzo if (*p != '\\') 62543405724SLuigi Rizzo buf[i++] = *p; 62643405724SLuigi Rizzo buf[i++] = '\0'; 6279758b77fSLuigi Rizzo 6289758b77fSLuigi Rizzo if (proto == IPPROTO_ETHERTYPE) { 62943405724SLuigi Rizzo i = match_token(ether_types, buf); 63043405724SLuigi Rizzo free(buf); 63143405724SLuigi Rizzo if (i != -1) { /* found */ 6329758b77fSLuigi Rizzo *end = s1; 6339758b77fSLuigi Rizzo return i; 6349758b77fSLuigi Rizzo } 6359758b77fSLuigi Rizzo } else { 6369758b77fSLuigi Rizzo struct protoent *pe = NULL; 6379758b77fSLuigi Rizzo struct servent *se; 6389758b77fSLuigi Rizzo 6399758b77fSLuigi Rizzo if (proto != 0) 6409758b77fSLuigi Rizzo pe = getprotobynumber(proto); 6419758b77fSLuigi Rizzo setservent(1); 64243405724SLuigi Rizzo se = getservbyname(buf, pe ? pe->p_name : NULL); 64343405724SLuigi Rizzo free(buf); 6449758b77fSLuigi Rizzo if (se != NULL) { 6459758b77fSLuigi Rizzo *end = s1; 6469758b77fSLuigi Rizzo return ntohs(se->s_port); 6479758b77fSLuigi Rizzo } 6489758b77fSLuigi Rizzo } 64943405724SLuigi Rizzo return 0; /* not found */ 6509758b77fSLuigi Rizzo } 6519758b77fSLuigi Rizzo 6529758b77fSLuigi Rizzo /* 653571f8c1bSLuigi Rizzo * Fill the body of the command with the list of port ranges. 6549758b77fSLuigi Rizzo */ 6559758b77fSLuigi Rizzo static int 6569758b77fSLuigi Rizzo fill_newports(ipfw_insn_u16 *cmd, char *av, int proto) 6579758b77fSLuigi Rizzo { 658571f8c1bSLuigi Rizzo uint16_t a, b, *p = cmd->ports; 6599758b77fSLuigi Rizzo int i = 0; 660e706181bSLuigi Rizzo char *s = av; 6619758b77fSLuigi Rizzo 662e706181bSLuigi Rizzo while (*s) { 6639758b77fSLuigi Rizzo a = strtoport(av, &s, 0, proto); 664254c4725SOleg Bulyzhin if (s == av) /* empty or invalid argument */ 665254c4725SOleg Bulyzhin return (0); 666254c4725SOleg Bulyzhin 667254c4725SOleg Bulyzhin switch (*s) { 668254c4725SOleg Bulyzhin case '-': /* a range */ 6699758b77fSLuigi Rizzo av = s + 1; 6709758b77fSLuigi Rizzo b = strtoport(av, &s, 0, proto); 671254c4725SOleg Bulyzhin /* Reject expressions like '1-abc' or '1-2-3'. */ 672254c4725SOleg Bulyzhin if (s == av || (*s != ',' && *s != '\0')) 673254c4725SOleg Bulyzhin return (0); 6749758b77fSLuigi Rizzo p[0] = a; 6759758b77fSLuigi Rizzo p[1] = b; 676254c4725SOleg Bulyzhin break; 677254c4725SOleg Bulyzhin case ',': /* comma separated list */ 678254c4725SOleg Bulyzhin case '\0': 6799758b77fSLuigi Rizzo p[0] = p[1] = a; 680254c4725SOleg Bulyzhin break; 681254c4725SOleg Bulyzhin default: 682254c4725SOleg Bulyzhin warnx("port list: invalid separator <%c> in <%s>", 68399e5e645SLuigi Rizzo *s, av); 684254c4725SOleg Bulyzhin return (0); 685254c4725SOleg Bulyzhin } 686254c4725SOleg Bulyzhin 687e706181bSLuigi Rizzo i++; 688e706181bSLuigi Rizzo p += 2; 6899758b77fSLuigi Rizzo av = s + 1; 6909758b77fSLuigi Rizzo } 6919758b77fSLuigi Rizzo if (i > 0) { 6929758b77fSLuigi Rizzo if (i + 1 > F_LEN_MASK) 693e706181bSLuigi Rizzo errx(EX_DATAERR, "too many ports/ranges\n"); 6949758b77fSLuigi Rizzo cmd->o.len |= i + 1; /* leave F_NOT and F_OR untouched */ 6959758b77fSLuigi Rizzo } 696254c4725SOleg Bulyzhin return (i); 6979758b77fSLuigi Rizzo } 6989758b77fSLuigi Rizzo 6999758b77fSLuigi Rizzo static struct _s_x icmpcodes[] = { 7009758b77fSLuigi Rizzo { "net", ICMP_UNREACH_NET }, 7019758b77fSLuigi Rizzo { "host", ICMP_UNREACH_HOST }, 7029758b77fSLuigi Rizzo { "protocol", ICMP_UNREACH_PROTOCOL }, 7039758b77fSLuigi Rizzo { "port", ICMP_UNREACH_PORT }, 7049758b77fSLuigi Rizzo { "needfrag", ICMP_UNREACH_NEEDFRAG }, 7059758b77fSLuigi Rizzo { "srcfail", ICMP_UNREACH_SRCFAIL }, 7069758b77fSLuigi Rizzo { "net-unknown", ICMP_UNREACH_NET_UNKNOWN }, 7079758b77fSLuigi Rizzo { "host-unknown", ICMP_UNREACH_HOST_UNKNOWN }, 7089758b77fSLuigi Rizzo { "isolated", ICMP_UNREACH_ISOLATED }, 7099758b77fSLuigi Rizzo { "net-prohib", ICMP_UNREACH_NET_PROHIB }, 7109758b77fSLuigi Rizzo { "host-prohib", ICMP_UNREACH_HOST_PROHIB }, 7119758b77fSLuigi Rizzo { "tosnet", ICMP_UNREACH_TOSNET }, 7129758b77fSLuigi Rizzo { "toshost", ICMP_UNREACH_TOSHOST }, 7139758b77fSLuigi Rizzo { "filter-prohib", ICMP_UNREACH_FILTER_PROHIB }, 7149758b77fSLuigi Rizzo { "host-precedence", ICMP_UNREACH_HOST_PRECEDENCE }, 7159758b77fSLuigi Rizzo { "precedence-cutoff", ICMP_UNREACH_PRECEDENCE_CUTOFF }, 7169758b77fSLuigi Rizzo { NULL, 0 } 7179758b77fSLuigi Rizzo }; 7189758b77fSLuigi Rizzo 7199758b77fSLuigi Rizzo static void 7209758b77fSLuigi Rizzo fill_reject_code(u_short *codep, char *str) 7219758b77fSLuigi Rizzo { 7229758b77fSLuigi Rizzo int val; 7239758b77fSLuigi Rizzo char *s; 7249758b77fSLuigi Rizzo 7259758b77fSLuigi Rizzo val = strtoul(str, &s, 0); 7269758b77fSLuigi Rizzo if (s == str || *s != '\0' || val >= 0x100) 7279758b77fSLuigi Rizzo val = match_token(icmpcodes, str); 728e706181bSLuigi Rizzo if (val < 0) 7299758b77fSLuigi Rizzo errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str); 7309758b77fSLuigi Rizzo *codep = val; 7319758b77fSLuigi Rizzo return; 7329758b77fSLuigi Rizzo } 7339758b77fSLuigi Rizzo 7349758b77fSLuigi Rizzo static void 735571f8c1bSLuigi Rizzo print_reject_code(uint16_t code) 7369758b77fSLuigi Rizzo { 73762ff38aeSLuigi Rizzo char const *s = match_value(icmpcodes, code); 7389758b77fSLuigi Rizzo 7399758b77fSLuigi Rizzo if (s != NULL) 7405e43aef8SLuigi Rizzo printf("unreach %s", s); 7419758b77fSLuigi Rizzo else 7425e43aef8SLuigi Rizzo printf("unreach %u", code); 7439758b77fSLuigi Rizzo } 7449758b77fSLuigi Rizzo 7459758b77fSLuigi Rizzo /* 7469758b77fSLuigi Rizzo * Returns the number of bits set (from left) in a contiguous bitmask, 7479758b77fSLuigi Rizzo * or -1 if the mask is not contiguous. 7489758b77fSLuigi Rizzo * XXX this needs a proper fix. 7499758b77fSLuigi Rizzo * This effectively works on masks in big-endian (network) format. 7509758b77fSLuigi Rizzo * when compiled on little endian architectures. 7519758b77fSLuigi Rizzo * 7529758b77fSLuigi Rizzo * First bit is bit 7 of the first byte -- note, for MAC addresses, 7539758b77fSLuigi Rizzo * the first bit on the wire is bit 0 of the first byte. 7549758b77fSLuigi Rizzo * len is the max length in bits. 7559758b77fSLuigi Rizzo */ 756ead75a59SLuigi Rizzo int 757f3a126d3SLuigi Rizzo contigmask(uint8_t *p, int len) 7589758b77fSLuigi Rizzo { 7599758b77fSLuigi Rizzo int i, n; 760f3a126d3SLuigi Rizzo 7619758b77fSLuigi Rizzo for (i=0; i<len ; i++) 7629758b77fSLuigi Rizzo if ( (p[i/8] & (1 << (7 - (i%8)))) == 0) /* first bit unset */ 7639758b77fSLuigi Rizzo break; 7649758b77fSLuigi Rizzo for (n=i+1; n < len; n++) 7659758b77fSLuigi Rizzo if ( (p[n/8] & (1 << (7 - (n%8)))) != 0) 7669758b77fSLuigi Rizzo return -1; /* mask not contiguous */ 7679758b77fSLuigi Rizzo return i; 7689758b77fSLuigi Rizzo } 7699758b77fSLuigi Rizzo 7709758b77fSLuigi Rizzo /* 7719758b77fSLuigi Rizzo * print flags set/clear in the two bitmasks passed as parameters. 7729758b77fSLuigi Rizzo * There is a specialized check for f_tcpflags. 7739758b77fSLuigi Rizzo */ 7749758b77fSLuigi Rizzo static void 77562ff38aeSLuigi Rizzo print_flags(char const *name, ipfw_insn *cmd, struct _s_x *list) 7769758b77fSLuigi Rizzo { 77762ff38aeSLuigi Rizzo char const *comma = ""; 7789758b77fSLuigi Rizzo int i; 779f3a126d3SLuigi Rizzo uint8_t set = cmd->arg1 & 0xff; 780f3a126d3SLuigi Rizzo uint8_t clear = (cmd->arg1 >> 8) & 0xff; 7819758b77fSLuigi Rizzo 7829758b77fSLuigi Rizzo if (list == f_tcpflags && set == TH_SYN && clear == TH_ACK) { 7839758b77fSLuigi Rizzo printf(" setup"); 7849758b77fSLuigi Rizzo return; 7859758b77fSLuigi Rizzo } 7869758b77fSLuigi Rizzo 7879758b77fSLuigi Rizzo printf(" %s ", name); 7889758b77fSLuigi Rizzo for (i=0; list[i].x != 0; i++) { 7899758b77fSLuigi Rizzo if (set & list[i].x) { 7909758b77fSLuigi Rizzo set &= ~list[i].x; 7919758b77fSLuigi Rizzo printf("%s%s", comma, list[i].s); 7929758b77fSLuigi Rizzo comma = ","; 7939758b77fSLuigi Rizzo } 7949758b77fSLuigi Rizzo if (clear & list[i].x) { 7959758b77fSLuigi Rizzo clear &= ~list[i].x; 7969758b77fSLuigi Rizzo printf("%s!%s", comma, list[i].s); 7979758b77fSLuigi Rizzo comma = ","; 7989758b77fSLuigi Rizzo } 7999758b77fSLuigi Rizzo } 8009758b77fSLuigi Rizzo } 8019758b77fSLuigi Rizzo 8029758b77fSLuigi Rizzo /* 8039758b77fSLuigi Rizzo * Print the ip address contained in a command. 8049758b77fSLuigi Rizzo */ 8059758b77fSLuigi Rizzo static void 80662ff38aeSLuigi Rizzo print_ip(ipfw_insn_ip *cmd, char const *s) 8079758b77fSLuigi Rizzo { 8089758b77fSLuigi Rizzo struct hostent *he = NULL; 809cc4d3c30SLuigi Rizzo uint32_t len = F_LEN((ipfw_insn *)cmd); 810571f8c1bSLuigi Rizzo uint32_t *a = ((ipfw_insn_u32 *)cmd)->d; 8119758b77fSLuigi Rizzo 812472099c4SLuigi Rizzo if (cmd->o.opcode == O_IP_DST_LOOKUP && len > F_INSN_SIZE(ipfw_insn_u32)) { 813472099c4SLuigi Rizzo uint32_t d = a[1]; 814472099c4SLuigi Rizzo const char *arg = "<invalid>"; 815472099c4SLuigi Rizzo 816472099c4SLuigi Rizzo if (d < sizeof(lookup_key)/sizeof(lookup_key[0])) 817472099c4SLuigi Rizzo arg = match_value(rule_options, lookup_key[d]); 818472099c4SLuigi Rizzo printf("%s lookup %s %d", cmd->o.len & F_NOT ? " not": "", 819472099c4SLuigi Rizzo arg, cmd->o.arg1); 820472099c4SLuigi Rizzo return; 821472099c4SLuigi Rizzo } 822e706181bSLuigi Rizzo printf("%s%s ", cmd->o.len & F_NOT ? " not": "", s); 8239758b77fSLuigi Rizzo 8249758b77fSLuigi Rizzo if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) { 8259758b77fSLuigi Rizzo printf("me"); 8269758b77fSLuigi Rizzo return; 8279758b77fSLuigi Rizzo } 828cd8b5ae0SRuslan Ermilov if (cmd->o.opcode == O_IP_SRC_LOOKUP || 829cd8b5ae0SRuslan Ermilov cmd->o.opcode == O_IP_DST_LOOKUP) { 830cd8b5ae0SRuslan Ermilov printf("table(%u", ((ipfw_insn *)cmd)->arg1); 831cd8b5ae0SRuslan Ermilov if (len == F_INSN_SIZE(ipfw_insn_u32)) 832cd8b5ae0SRuslan Ermilov printf(",%u", *a); 833cd8b5ae0SRuslan Ermilov printf(")"); 834cd8b5ae0SRuslan Ermilov return; 835cd8b5ae0SRuslan Ermilov } 8369758b77fSLuigi Rizzo if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) { 837571f8c1bSLuigi Rizzo uint32_t x, *map = (uint32_t *)&(cmd->mask); 8389ef3f16dSLuigi Rizzo int i, j; 8399758b77fSLuigi Rizzo char comma = '{'; 8409758b77fSLuigi Rizzo 8419758b77fSLuigi Rizzo x = cmd->o.arg1 - 1; 8429758b77fSLuigi Rizzo x = htonl( ~x ); 8439758b77fSLuigi Rizzo cmd->addr.s_addr = htonl(cmd->addr.s_addr); 8449758b77fSLuigi Rizzo printf("%s/%d", inet_ntoa(cmd->addr), 845f3a126d3SLuigi Rizzo contigmask((uint8_t *)&x, 32)); 8469758b77fSLuigi Rizzo x = cmd->addr.s_addr = htonl(cmd->addr.s_addr); 8479758b77fSLuigi Rizzo x &= 0xff; /* base */ 8489ef3f16dSLuigi Rizzo /* 8499ef3f16dSLuigi Rizzo * Print bits and ranges. 8509ef3f16dSLuigi Rizzo * Locate first bit set (i), then locate first bit unset (j). 8519ef3f16dSLuigi Rizzo * If we have 3+ consecutive bits set, then print them as a 8529ef3f16dSLuigi Rizzo * range, otherwise only print the initial bit and rescan. 8539ef3f16dSLuigi Rizzo */ 8549758b77fSLuigi Rizzo for (i=0; i < cmd->o.arg1; i++) 855571f8c1bSLuigi Rizzo if (map[i/32] & (1<<(i & 31))) { 8569ef3f16dSLuigi Rizzo for (j=i+1; j < cmd->o.arg1; j++) 857571f8c1bSLuigi Rizzo if (!(map[ j/32] & (1<<(j & 31)))) 8589ef3f16dSLuigi Rizzo break; 8599758b77fSLuigi Rizzo printf("%c%d", comma, i+x); 8609ef3f16dSLuigi Rizzo if (j>i+2) { /* range has at least 3 elements */ 8619ef3f16dSLuigi Rizzo printf("-%d", j-1+x); 8629ef3f16dSLuigi Rizzo i = j-1; 8639ef3f16dSLuigi Rizzo } 8649758b77fSLuigi Rizzo comma = ','; 8659758b77fSLuigi Rizzo } 8669758b77fSLuigi Rizzo printf("}"); 8679758b77fSLuigi Rizzo return; 8689758b77fSLuigi Rizzo } 869571f8c1bSLuigi Rizzo /* 870571f8c1bSLuigi Rizzo * len == 2 indicates a single IP, whereas lists of 1 or more 871571f8c1bSLuigi Rizzo * addr/mask pairs have len = (2n+1). We convert len to n so we 872571f8c1bSLuigi Rizzo * use that to count the number of entries. 873571f8c1bSLuigi Rizzo */ 874571f8c1bSLuigi Rizzo for (len = len / 2; len > 0; len--, a += 2) { 875571f8c1bSLuigi Rizzo int mb = /* mask length */ 876571f8c1bSLuigi Rizzo (cmd->o.opcode == O_IP_SRC || cmd->o.opcode == O_IP_DST) ? 877f3a126d3SLuigi Rizzo 32 : contigmask((uint8_t *)&(a[1]), 32); 878db7c5224SLuigi Rizzo if (mb == 32 && co.do_resolv) 879571f8c1bSLuigi Rizzo he = gethostbyaddr((char *)&(a[0]), sizeof(u_long), AF_INET); 8809758b77fSLuigi Rizzo if (he != NULL) /* resolved to name */ 8819758b77fSLuigi Rizzo printf("%s", he->h_name); 8829758b77fSLuigi Rizzo else if (mb == 0) /* any */ 8839758b77fSLuigi Rizzo printf("any"); 8849758b77fSLuigi Rizzo else { /* numeric IP followed by some kind of mask */ 885571f8c1bSLuigi Rizzo printf("%s", inet_ntoa( *((struct in_addr *)&a[0]) ) ); 8869758b77fSLuigi Rizzo if (mb < 0) 887571f8c1bSLuigi Rizzo printf(":%s", inet_ntoa( *((struct in_addr *)&a[1]) ) ); 8889758b77fSLuigi Rizzo else if (mb < 32) 8899758b77fSLuigi Rizzo printf("/%d", mb); 8909758b77fSLuigi Rizzo } 891571f8c1bSLuigi Rizzo if (len > 1) 892571f8c1bSLuigi Rizzo printf(","); 893571f8c1bSLuigi Rizzo } 8949758b77fSLuigi Rizzo } 8959758b77fSLuigi Rizzo 8969758b77fSLuigi Rizzo /* 8979758b77fSLuigi Rizzo * prints a MAC address/mask pair 8989758b77fSLuigi Rizzo */ 8999758b77fSLuigi Rizzo static void 900f3a126d3SLuigi Rizzo print_mac(uint8_t *addr, uint8_t *mask) 9019758b77fSLuigi Rizzo { 9029758b77fSLuigi Rizzo int l = contigmask(mask, 48); 9039758b77fSLuigi Rizzo 9049758b77fSLuigi Rizzo if (l == 0) 9059758b77fSLuigi Rizzo printf(" any"); 9069758b77fSLuigi Rizzo else { 9079758b77fSLuigi Rizzo printf(" %02x:%02x:%02x:%02x:%02x:%02x", 9089758b77fSLuigi Rizzo addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); 9099758b77fSLuigi Rizzo if (l == -1) 9109758b77fSLuigi Rizzo printf("&%02x:%02x:%02x:%02x:%02x:%02x", 9119758b77fSLuigi Rizzo mask[0], mask[1], mask[2], 9129758b77fSLuigi Rizzo mask[3], mask[4], mask[5]); 9139758b77fSLuigi Rizzo else if (l < 48) 9149758b77fSLuigi Rizzo printf("/%d", l); 9159758b77fSLuigi Rizzo } 9169758b77fSLuigi Rizzo } 9179758b77fSLuigi Rizzo 9185e43aef8SLuigi Rizzo static void 9195e43aef8SLuigi Rizzo fill_icmptypes(ipfw_insn_u32 *cmd, char *av) 9205e43aef8SLuigi Rizzo { 921571f8c1bSLuigi Rizzo uint8_t type; 9225e43aef8SLuigi Rizzo 9235e43aef8SLuigi Rizzo cmd->d[0] = 0; 9245e43aef8SLuigi Rizzo while (*av) { 9255e43aef8SLuigi Rizzo if (*av == ',') 9265e43aef8SLuigi Rizzo av++; 9275e43aef8SLuigi Rizzo 9285e43aef8SLuigi Rizzo type = strtoul(av, &av, 0); 9295e43aef8SLuigi Rizzo 9305e43aef8SLuigi Rizzo if (*av != ',' && *av != '\0') 9315e43aef8SLuigi Rizzo errx(EX_DATAERR, "invalid ICMP type"); 9325e43aef8SLuigi Rizzo 9335e43aef8SLuigi Rizzo if (type > 31) 9345e43aef8SLuigi Rizzo errx(EX_DATAERR, "ICMP type out of range"); 9355e43aef8SLuigi Rizzo 9365e43aef8SLuigi Rizzo cmd->d[0] |= 1 << type; 9375e43aef8SLuigi Rizzo } 9385e43aef8SLuigi Rizzo cmd->o.opcode = O_ICMPTYPE; 9395e43aef8SLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 9405e43aef8SLuigi Rizzo } 9415e43aef8SLuigi Rizzo 9425e43aef8SLuigi Rizzo static void 9435e43aef8SLuigi Rizzo print_icmptypes(ipfw_insn_u32 *cmd) 9445e43aef8SLuigi Rizzo { 9455e43aef8SLuigi Rizzo int i; 9465e43aef8SLuigi Rizzo char sep= ' '; 9475e43aef8SLuigi Rizzo 9485e43aef8SLuigi Rizzo printf(" icmptypes"); 9495e43aef8SLuigi Rizzo for (i = 0; i < 32; i++) { 9505e43aef8SLuigi Rizzo if ( (cmd->d[0] & (1 << (i))) == 0) 9515e43aef8SLuigi Rizzo continue; 9525e43aef8SLuigi Rizzo printf("%c%d", sep, i); 9535e43aef8SLuigi Rizzo sep = ','; 9545e43aef8SLuigi Rizzo } 9555e43aef8SLuigi Rizzo } 9569758b77fSLuigi Rizzo 9579758b77fSLuigi Rizzo /* 9589758b77fSLuigi Rizzo * show_ipfw() prints the body of an ipfw rule. 9599758b77fSLuigi Rizzo * Because the standard rule has at least proto src_ip dst_ip, we use 9609758b77fSLuigi Rizzo * a helper function to produce these entries if not provided explicitly. 961e706181bSLuigi Rizzo * The first argument is the list of fields we have, the second is 962e706181bSLuigi Rizzo * the list of fields we want to be printed. 96399e5e645SLuigi Rizzo * 964e706181bSLuigi Rizzo * Special cases if we have provided a MAC header: 965e706181bSLuigi Rizzo * + if the rule does not contain IP addresses/ports, do not print them; 966e706181bSLuigi Rizzo * + if the rule does not contain an IP proto, print "all" instead of "ip"; 967e706181bSLuigi Rizzo * 968e706181bSLuigi Rizzo * Once we have 'have_options', IP header fields are printed as options. 9699758b77fSLuigi Rizzo */ 97099e5e645SLuigi Rizzo #define HAVE_PROTO 0x0001 97199e5e645SLuigi Rizzo #define HAVE_SRCIP 0x0002 97299e5e645SLuigi Rizzo #define HAVE_DSTIP 0x0004 9735b41efddSMaxim Konovalov #define HAVE_PROTO4 0x0008 9745b41efddSMaxim Konovalov #define HAVE_PROTO6 0x0010 975f68f58e5SLuigi Rizzo #define HAVE_IP 0x0100 976e706181bSLuigi Rizzo #define HAVE_OPTIONS 0x8000 9779758b77fSLuigi Rizzo 9789758b77fSLuigi Rizzo static void 979daa9733aSLuigi Rizzo show_prerequisites(int *flags, int want, int cmd __unused) 9809758b77fSLuigi Rizzo { 981db7c5224SLuigi Rizzo if (co.comment_only) 982ac6cec51SLuigi Rizzo return; 983e706181bSLuigi Rizzo if ( (*flags & HAVE_IP) == HAVE_IP) 984e706181bSLuigi Rizzo *flags |= HAVE_OPTIONS; 98599e5e645SLuigi Rizzo 986e706181bSLuigi Rizzo if ( !(*flags & HAVE_OPTIONS)) { 987daa9733aSLuigi Rizzo if ( !(*flags & HAVE_PROTO) && (want & HAVE_PROTO)) { 98857cd6d26SMax Laier if ( (*flags & HAVE_PROTO4)) 98957cd6d26SMax Laier printf(" ip4"); 99057cd6d26SMax Laier else if ( (*flags & HAVE_PROTO6)) 99157cd6d26SMax Laier printf(" ip6"); 99257cd6d26SMax Laier else 993e706181bSLuigi Rizzo printf(" ip"); 994daa9733aSLuigi Rizzo } 9959758b77fSLuigi Rizzo if ( !(*flags & HAVE_SRCIP) && (want & HAVE_SRCIP)) 9969758b77fSLuigi Rizzo printf(" from any"); 9979758b77fSLuigi Rizzo if ( !(*flags & HAVE_DSTIP) && (want & HAVE_DSTIP)) 9989758b77fSLuigi Rizzo printf(" to any"); 999e706181bSLuigi Rizzo } 10009758b77fSLuigi Rizzo *flags |= want; 10019758b77fSLuigi Rizzo } 10029758b77fSLuigi Rizzo 10039758b77fSLuigi Rizzo static void 100445f61351SMaxim Konovalov show_ipfw(struct ip_fw *rule, int pcwidth, int bcwidth) 10059758b77fSLuigi Rizzo { 10063d2209aeSGiorgos Keramidas static int twidth = 0; 10079758b77fSLuigi Rizzo int l; 10086a7d5cb6SOleg Bulyzhin ipfw_insn *cmd, *tagptr = NULL; 1009daa9733aSLuigi Rizzo const char *comment = NULL; /* ptr to comment if we have one */ 10109758b77fSLuigi Rizzo int proto = 0; /* default */ 10119758b77fSLuigi Rizzo int flags = 0; /* prerequisites */ 10129758b77fSLuigi Rizzo ipfw_insn_log *logptr = NULL; /* set if we find an O_LOG */ 1013974dfe30SBrian Feldman ipfw_insn_altq *altqptr = NULL; /* set if we find an O_ALTQ */ 10149758b77fSLuigi Rizzo int or_block = 0; /* we are in an or block */ 1015571f8c1bSLuigi Rizzo uint32_t set_disable; 10169758b77fSLuigi Rizzo 1017330462a3SBernd Walter bcopy(&rule->next_rule, &set_disable, sizeof(set_disable)); 101843405724SLuigi Rizzo 101943405724SLuigi Rizzo if (set_disable & (1 << rule->set)) { /* disabled */ 1020db7c5224SLuigi Rizzo if (!co.show_sets) 102143405724SLuigi Rizzo return; 102243405724SLuigi Rizzo else 102343405724SLuigi Rizzo printf("# DISABLED "); 102443405724SLuigi Rizzo } 10259758b77fSLuigi Rizzo printf("%05u ", rule->rulenum); 10269758b77fSLuigi Rizzo 102737133ba7SLuigi Rizzo if (pcwidth > 0 || bcwidth > 0) { 102837133ba7SLuigi Rizzo pr_u64(&rule->pcnt, pcwidth); 102937133ba7SLuigi Rizzo pr_u64(&rule->bcnt, bcwidth); 103037133ba7SLuigi Rizzo } 10319758b77fSLuigi Rizzo 1032db7c5224SLuigi Rizzo if (co.do_time == 2) 10331b43a426SLuigi Rizzo printf("%10u ", rule->timestamp); 1034db7c5224SLuigi Rizzo else if (co.do_time == 1) { 10359758b77fSLuigi Rizzo char timestr[30]; 10363d2209aeSGiorgos Keramidas time_t t = (time_t)0; 10373d2209aeSGiorgos Keramidas 10383d2209aeSGiorgos Keramidas if (twidth == 0) { 10393d2209aeSGiorgos Keramidas strcpy(timestr, ctime(&t)); 10403d2209aeSGiorgos Keramidas *strchr(timestr, '\n') = '\0'; 10413d2209aeSGiorgos Keramidas twidth = strlen(timestr); 10423d2209aeSGiorgos Keramidas } 10433d2209aeSGiorgos Keramidas if (rule->timestamp) { 10443d2209aeSGiorgos Keramidas t = _long_to_time(rule->timestamp); 10459758b77fSLuigi Rizzo 10469758b77fSLuigi Rizzo strcpy(timestr, ctime(&t)); 10479758b77fSLuigi Rizzo *strchr(timestr, '\n') = '\0'; 10489758b77fSLuigi Rizzo printf("%s ", timestr); 10499758b77fSLuigi Rizzo } else { 10503d2209aeSGiorgos Keramidas printf("%*s", twidth, " "); 10519758b77fSLuigi Rizzo } 10529758b77fSLuigi Rizzo } 10539758b77fSLuigi Rizzo 1054db7c5224SLuigi Rizzo if (co.show_sets) 105543405724SLuigi Rizzo printf("set %d ", rule->set); 105643405724SLuigi Rizzo 10579758b77fSLuigi Rizzo /* 105812b5dc6aSLuigi Rizzo * print the optional "match probability" 105912b5dc6aSLuigi Rizzo */ 106012b5dc6aSLuigi Rizzo if (rule->cmd_len > 0) { 106112b5dc6aSLuigi Rizzo cmd = rule->cmd ; 106212b5dc6aSLuigi Rizzo if (cmd->opcode == O_PROB) { 106312b5dc6aSLuigi Rizzo ipfw_insn_u32 *p = (ipfw_insn_u32 *)cmd; 106412b5dc6aSLuigi Rizzo double d = 1.0 * p->d[0]; 106512b5dc6aSLuigi Rizzo 106612b5dc6aSLuigi Rizzo d = (d / 0x7fffffff); 106712b5dc6aSLuigi Rizzo printf("prob %f ", d); 106812b5dc6aSLuigi Rizzo } 106912b5dc6aSLuigi Rizzo } 107012b5dc6aSLuigi Rizzo 107112b5dc6aSLuigi Rizzo /* 10729758b77fSLuigi Rizzo * first print actions 10739758b77fSLuigi Rizzo */ 10749758b77fSLuigi Rizzo for (l = rule->cmd_len - rule->act_ofs, cmd = ACTION_PTR(rule); 10759758b77fSLuigi Rizzo l > 0 ; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 10769758b77fSLuigi Rizzo switch(cmd->opcode) { 10779758b77fSLuigi Rizzo case O_CHECK_STATE: 10789758b77fSLuigi Rizzo printf("check-state"); 1079f68f58e5SLuigi Rizzo /* avoid printing anything else */ 1080f68f58e5SLuigi Rizzo flags = HAVE_PROTO | HAVE_SRCIP | 1081f68f58e5SLuigi Rizzo HAVE_DSTIP | HAVE_IP; 10829758b77fSLuigi Rizzo break; 10839758b77fSLuigi Rizzo 10849758b77fSLuigi Rizzo case O_ACCEPT: 10859758b77fSLuigi Rizzo printf("allow"); 10869758b77fSLuigi Rizzo break; 10879758b77fSLuigi Rizzo 10889758b77fSLuigi Rizzo case O_COUNT: 10899758b77fSLuigi Rizzo printf("count"); 10909758b77fSLuigi Rizzo break; 10919758b77fSLuigi Rizzo 10929758b77fSLuigi Rizzo case O_DENY: 10939758b77fSLuigi Rizzo printf("deny"); 10949758b77fSLuigi Rizzo break; 10959758b77fSLuigi Rizzo 10965e43aef8SLuigi Rizzo case O_REJECT: 10975e43aef8SLuigi Rizzo if (cmd->arg1 == ICMP_REJECT_RST) 10985e43aef8SLuigi Rizzo printf("reset"); 10995e43aef8SLuigi Rizzo else if (cmd->arg1 == ICMP_UNREACH_HOST) 11005e43aef8SLuigi Rizzo printf("reject"); 11015e43aef8SLuigi Rizzo else 11025e43aef8SLuigi Rizzo print_reject_code(cmd->arg1); 11035e43aef8SLuigi Rizzo break; 11045e43aef8SLuigi Rizzo 11059066356bSBjoern A. Zeeb case O_UNREACH6: 11069066356bSBjoern A. Zeeb if (cmd->arg1 == ICMP6_UNREACH_RST) 11079066356bSBjoern A. Zeeb printf("reset6"); 11089066356bSBjoern A. Zeeb else 11099066356bSBjoern A. Zeeb print_unreach6_code(cmd->arg1); 11109066356bSBjoern A. Zeeb break; 11119066356bSBjoern A. Zeeb 1112254c4725SOleg Bulyzhin case O_SKIPTO: 1113254c4725SOleg Bulyzhin PRINT_UINT_ARG("skipto ", cmd->arg1); 111440b1ae9eSGleb Smirnoff break; 111540b1ae9eSGleb Smirnoff 11169758b77fSLuigi Rizzo case O_PIPE: 1117254c4725SOleg Bulyzhin PRINT_UINT_ARG("pipe ", cmd->arg1); 1118254c4725SOleg Bulyzhin break; 1119254c4725SOleg Bulyzhin 11209758b77fSLuigi Rizzo case O_QUEUE: 1121254c4725SOleg Bulyzhin PRINT_UINT_ARG("queue ", cmd->arg1); 1122254c4725SOleg Bulyzhin break; 1123254c4725SOleg Bulyzhin 11249758b77fSLuigi Rizzo case O_DIVERT: 1125254c4725SOleg Bulyzhin PRINT_UINT_ARG("divert ", cmd->arg1); 1126254c4725SOleg Bulyzhin break; 1127254c4725SOleg Bulyzhin 11289758b77fSLuigi Rizzo case O_TEE: 1129254c4725SOleg Bulyzhin PRINT_UINT_ARG("tee ", cmd->arg1); 1130254c4725SOleg Bulyzhin break; 1131254c4725SOleg Bulyzhin 1132670742a1SGleb Smirnoff case O_NETGRAPH: 1133254c4725SOleg Bulyzhin PRINT_UINT_ARG("netgraph ", cmd->arg1); 1134254c4725SOleg Bulyzhin break; 1135254c4725SOleg Bulyzhin 1136670742a1SGleb Smirnoff case O_NGTEE: 1137254c4725SOleg Bulyzhin PRINT_UINT_ARG("ngtee ", cmd->arg1); 1138254c4725SOleg Bulyzhin break; 1139670742a1SGleb Smirnoff 11409758b77fSLuigi Rizzo case O_FORWARD_IP: 11419758b77fSLuigi Rizzo { 11429758b77fSLuigi Rizzo ipfw_insn_sa *s = (ipfw_insn_sa *)cmd; 11439758b77fSLuigi Rizzo 1144c487be96SJulian Elischer if (s->sa.sin_addr.s_addr == INADDR_ANY) { 1145c487be96SJulian Elischer printf("fwd tablearg"); 1146c487be96SJulian Elischer } else { 11479758b77fSLuigi Rizzo printf("fwd %s", inet_ntoa(s->sa.sin_addr)); 1148c487be96SJulian Elischer } 11499758b77fSLuigi Rizzo if (s->sa.sin_port) 11504f531a53SLuigi Rizzo printf(",%d", s->sa.sin_port); 11519758b77fSLuigi Rizzo } 11529758b77fSLuigi Rizzo break; 11539758b77fSLuigi Rizzo 11548a006adbSBjoern A. Zeeb case O_FORWARD_IP6: 11558a006adbSBjoern A. Zeeb { 11568a006adbSBjoern A. Zeeb char buf[4 + INET6_ADDRSTRLEN + 1]; 11578a006adbSBjoern A. Zeeb ipfw_insn_sa6 *s = (ipfw_insn_sa6 *)cmd; 11588a006adbSBjoern A. Zeeb 11598a006adbSBjoern A. Zeeb printf("fwd %s", inet_ntop(AF_INET6, &s->sa.sin6_addr, 11608a006adbSBjoern A. Zeeb buf, sizeof(buf))); 11618a006adbSBjoern A. Zeeb if (s->sa.sin6_port) 11628a006adbSBjoern A. Zeeb printf(",%d", s->sa.sin6_port); 11638a006adbSBjoern A. Zeeb } 11648a006adbSBjoern A. Zeeb break; 11658a006adbSBjoern A. Zeeb 11669758b77fSLuigi Rizzo case O_LOG: /* O_LOG is printed last */ 11679758b77fSLuigi Rizzo logptr = (ipfw_insn_log *)cmd; 11689758b77fSLuigi Rizzo break; 11699758b77fSLuigi Rizzo 1170974dfe30SBrian Feldman case O_ALTQ: /* O_ALTQ is printed after O_LOG */ 1171974dfe30SBrian Feldman altqptr = (ipfw_insn_altq *)cmd; 1172974dfe30SBrian Feldman break; 1173974dfe30SBrian Feldman 11746a7d5cb6SOleg Bulyzhin case O_TAG: 11756a7d5cb6SOleg Bulyzhin tagptr = cmd; 11766a7d5cb6SOleg Bulyzhin break; 11776a7d5cb6SOleg Bulyzhin 1178ff2f6fe8SPaolo Pisati case O_NAT: 11791875bbfeSAndrey V. Elsukov if (cmd->arg1 != 0) 1180f94a7fc0SPaolo Pisati PRINT_UINT_ARG("nat ", cmd->arg1); 11811875bbfeSAndrey V. Elsukov else 11821875bbfeSAndrey V. Elsukov printf("nat global"); 1183ff2f6fe8SPaolo Pisati break; 1184ff2f6fe8SPaolo Pisati 11858b07e49aSJulian Elischer case O_SETFIB: 11868b07e49aSJulian Elischer PRINT_UINT_ARG("setfib ", cmd->arg1); 11878b07e49aSJulian Elischer break; 11888b07e49aSJulian Elischer 1189eb2e4119SPaolo Pisati case O_REASS: 1190eb2e4119SPaolo Pisati printf("reass"); 1191eb2e4119SPaolo Pisati break; 1192eb2e4119SPaolo Pisati 11939527ec6eSAndrey V. Elsukov case O_CALLRETURN: 11949527ec6eSAndrey V. Elsukov if (cmd->len & F_NOT) 11959527ec6eSAndrey V. Elsukov printf("return"); 11969527ec6eSAndrey V. Elsukov else 11979527ec6eSAndrey V. Elsukov PRINT_UINT_ARG("call ", cmd->arg1); 11989527ec6eSAndrey V. Elsukov break; 11999527ec6eSAndrey V. Elsukov 12009758b77fSLuigi Rizzo default: 12019758b77fSLuigi Rizzo printf("** unrecognized action %d len %d ", 12029758b77fSLuigi Rizzo cmd->opcode, cmd->len); 12039758b77fSLuigi Rizzo } 12049758b77fSLuigi Rizzo } 12059758b77fSLuigi Rizzo if (logptr) { 12069758b77fSLuigi Rizzo if (logptr->max_log > 0) 12079758b77fSLuigi Rizzo printf(" log logamount %d", logptr->max_log); 12089758b77fSLuigi Rizzo else 12099758b77fSLuigi Rizzo printf(" log"); 12109758b77fSLuigi Rizzo } 1211cc4d3c30SLuigi Rizzo #ifndef NO_ALTQ 1212974dfe30SBrian Feldman if (altqptr) { 121323c608c8SLuigi Rizzo print_altq_cmd(altqptr); 1214974dfe30SBrian Feldman } 1215cc4d3c30SLuigi Rizzo #endif 12166a7d5cb6SOleg Bulyzhin if (tagptr) { 12176a7d5cb6SOleg Bulyzhin if (tagptr->len & F_NOT) 1218254c4725SOleg Bulyzhin PRINT_UINT_ARG(" untag ", tagptr->arg1); 12196a7d5cb6SOleg Bulyzhin else 1220254c4725SOleg Bulyzhin PRINT_UINT_ARG(" tag ", tagptr->arg1); 12216a7d5cb6SOleg Bulyzhin } 1222e706181bSLuigi Rizzo 12239758b77fSLuigi Rizzo /* 1224e706181bSLuigi Rizzo * then print the body. 12259758b77fSLuigi Rizzo */ 122657cd6d26SMax Laier for (l = rule->act_ofs, cmd = rule->cmd ; 122757cd6d26SMax Laier l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) { 122857cd6d26SMax Laier if ((cmd->len & F_OR) || (cmd->len & F_NOT)) 122957cd6d26SMax Laier continue; 123057cd6d26SMax Laier if (cmd->opcode == O_IP4) { 123157cd6d26SMax Laier flags |= HAVE_PROTO4; 123257cd6d26SMax Laier break; 123357cd6d26SMax Laier } else if (cmd->opcode == O_IP6) { 123457cd6d26SMax Laier flags |= HAVE_PROTO6; 123557cd6d26SMax Laier break; 123657cd6d26SMax Laier } 123757cd6d26SMax Laier } 1238e706181bSLuigi Rizzo if (rule->_pad & 1) { /* empty rules before options */ 1239db7c5224SLuigi Rizzo if (!co.do_compact) { 124057cd6d26SMax Laier show_prerequisites(&flags, HAVE_PROTO, 0); 124157cd6d26SMax Laier printf(" from any to any"); 124257cd6d26SMax Laier } 1243f68f58e5SLuigi Rizzo flags |= HAVE_IP | HAVE_OPTIONS | HAVE_PROTO | 1244f68f58e5SLuigi Rizzo HAVE_SRCIP | HAVE_DSTIP; 1245e706181bSLuigi Rizzo } 1246e706181bSLuigi Rizzo 1247db7c5224SLuigi Rizzo if (co.comment_only) 1248ac6cec51SLuigi Rizzo comment = "..."; 1249ac6cec51SLuigi Rizzo 12509758b77fSLuigi Rizzo for (l = rule->act_ofs, cmd = rule->cmd ; 12519758b77fSLuigi Rizzo l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) { 12525e43aef8SLuigi Rizzo /* useful alias */ 12535e43aef8SLuigi Rizzo ipfw_insn_u32 *cmd32 = (ipfw_insn_u32 *)cmd; 12549758b77fSLuigi Rizzo 1255db7c5224SLuigi Rizzo if (co.comment_only) { 1256ac6cec51SLuigi Rizzo if (cmd->opcode != O_NOP) 1257ac6cec51SLuigi Rizzo continue; 1258ac6cec51SLuigi Rizzo printf(" // %s\n", (char *)(cmd + 1)); 1259ac6cec51SLuigi Rizzo return; 1260ac6cec51SLuigi Rizzo } 1261ac6cec51SLuigi Rizzo 1262e706181bSLuigi Rizzo show_prerequisites(&flags, 0, cmd->opcode); 1263e706181bSLuigi Rizzo 12649758b77fSLuigi Rizzo switch(cmd->opcode) { 126512b5dc6aSLuigi Rizzo case O_PROB: 126612b5dc6aSLuigi Rizzo break; /* done already */ 126712b5dc6aSLuigi Rizzo 12689758b77fSLuigi Rizzo case O_PROBE_STATE: 12699758b77fSLuigi Rizzo break; /* no need to print anything here */ 12709758b77fSLuigi Rizzo 12719758b77fSLuigi Rizzo case O_IP_SRC: 1272cd8b5ae0SRuslan Ermilov case O_IP_SRC_LOOKUP: 12739758b77fSLuigi Rizzo case O_IP_SRC_MASK: 12749758b77fSLuigi Rizzo case O_IP_SRC_ME: 12759758b77fSLuigi Rizzo case O_IP_SRC_SET: 1276e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO, 0); 12779758b77fSLuigi Rizzo if (!(flags & HAVE_SRCIP)) 12789758b77fSLuigi Rizzo printf(" from"); 12799758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 12809758b77fSLuigi Rizzo printf(" {"); 1281e706181bSLuigi Rizzo print_ip((ipfw_insn_ip *)cmd, 1282e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? " src-ip" : ""); 12839758b77fSLuigi Rizzo flags |= HAVE_SRCIP; 12849758b77fSLuigi Rizzo break; 12859758b77fSLuigi Rizzo 12869758b77fSLuigi Rizzo case O_IP_DST: 1287cd8b5ae0SRuslan Ermilov case O_IP_DST_LOOKUP: 12889758b77fSLuigi Rizzo case O_IP_DST_MASK: 12899758b77fSLuigi Rizzo case O_IP_DST_ME: 12909758b77fSLuigi Rizzo case O_IP_DST_SET: 1291e706181bSLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0); 12929758b77fSLuigi Rizzo if (!(flags & HAVE_DSTIP)) 12939758b77fSLuigi Rizzo printf(" to"); 12949758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 12959758b77fSLuigi Rizzo printf(" {"); 1296e706181bSLuigi Rizzo print_ip((ipfw_insn_ip *)cmd, 1297e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? " dst-ip" : ""); 12989758b77fSLuigi Rizzo flags |= HAVE_DSTIP; 12999758b77fSLuigi Rizzo break; 13009758b77fSLuigi Rizzo 13018195404bSBrooks Davis case O_IP6_SRC: 13028195404bSBrooks Davis case O_IP6_SRC_MASK: 13038195404bSBrooks Davis case O_IP6_SRC_ME: 1304b730879fSMax Laier show_prerequisites(&flags, HAVE_PROTO, 0); 13058195404bSBrooks Davis if (!(flags & HAVE_SRCIP)) 13068195404bSBrooks Davis printf(" from"); 13078195404bSBrooks Davis if ((cmd->len & F_OR) && !or_block) 13088195404bSBrooks Davis printf(" {"); 13098195404bSBrooks Davis print_ip6((ipfw_insn_ip6 *)cmd, 13108195404bSBrooks Davis (flags & HAVE_OPTIONS) ? " src-ip6" : ""); 13118195404bSBrooks Davis flags |= HAVE_SRCIP | HAVE_PROTO; 13128195404bSBrooks Davis break; 13138195404bSBrooks Davis 13148195404bSBrooks Davis case O_IP6_DST: 13158195404bSBrooks Davis case O_IP6_DST_MASK: 13168195404bSBrooks Davis case O_IP6_DST_ME: 13178195404bSBrooks Davis show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0); 13188195404bSBrooks Davis if (!(flags & HAVE_DSTIP)) 13198195404bSBrooks Davis printf(" to"); 13208195404bSBrooks Davis if ((cmd->len & F_OR) && !or_block) 13218195404bSBrooks Davis printf(" {"); 13228195404bSBrooks Davis print_ip6((ipfw_insn_ip6 *)cmd, 13238195404bSBrooks Davis (flags & HAVE_OPTIONS) ? " dst-ip6" : ""); 13248195404bSBrooks Davis flags |= HAVE_DSTIP; 13258195404bSBrooks Davis break; 13268195404bSBrooks Davis 13278195404bSBrooks Davis case O_FLOW6ID: 13288195404bSBrooks Davis print_flow6id( (ipfw_insn_u32 *) cmd ); 13298195404bSBrooks Davis flags |= HAVE_OPTIONS; 13308195404bSBrooks Davis break; 13318195404bSBrooks Davis 13329758b77fSLuigi Rizzo case O_IP_DSTPORT: 1333f68f58e5SLuigi Rizzo show_prerequisites(&flags, 1334f68f58e5SLuigi Rizzo HAVE_PROTO | HAVE_SRCIP | 1335f68f58e5SLuigi Rizzo HAVE_DSTIP | HAVE_IP, 0); 13369758b77fSLuigi Rizzo case O_IP_SRCPORT: 1337e89359c2SJohn Baldwin if (flags & HAVE_DSTIP) 1338e89359c2SJohn Baldwin flags |= HAVE_IP; 1339f68f58e5SLuigi Rizzo show_prerequisites(&flags, 1340f68f58e5SLuigi Rizzo HAVE_PROTO | HAVE_SRCIP, 0); 13418ed2d749SLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 13428ed2d749SLuigi Rizzo printf(" {"); 1343087aa087SMaxim Konovalov if (cmd->len & F_NOT) 1344087aa087SMaxim Konovalov printf(" not"); 1345e706181bSLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, proto, 1346e706181bSLuigi Rizzo (flags & HAVE_OPTIONS) ? cmd->opcode : 0); 13479758b77fSLuigi Rizzo break; 13489758b77fSLuigi Rizzo 13499758b77fSLuigi Rizzo case O_PROTO: { 13508195404bSBrooks Davis struct protoent *pe = NULL; 13519758b77fSLuigi Rizzo 13529758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 13539758b77fSLuigi Rizzo printf(" {"); 13549758b77fSLuigi Rizzo if (cmd->len & F_NOT) 13559758b77fSLuigi Rizzo printf(" not"); 13569758b77fSLuigi Rizzo proto = cmd->arg1; 1357d360073bSBrooks Davis pe = getprotobynumber(cmd->arg1); 135857cd6d26SMax Laier if ((flags & (HAVE_PROTO4 | HAVE_PROTO6)) && 135957cd6d26SMax Laier !(flags & HAVE_PROTO)) 136057cd6d26SMax Laier show_prerequisites(&flags, 1361f68f58e5SLuigi Rizzo HAVE_PROTO | HAVE_IP | HAVE_SRCIP | 1362f68f58e5SLuigi Rizzo HAVE_DSTIP | HAVE_OPTIONS, 0); 1363e706181bSLuigi Rizzo if (flags & HAVE_OPTIONS) 1364e706181bSLuigi Rizzo printf(" proto"); 13659758b77fSLuigi Rizzo if (pe) 13669758b77fSLuigi Rizzo printf(" %s", pe->p_name); 13679758b77fSLuigi Rizzo else 13689758b77fSLuigi Rizzo printf(" %u", cmd->arg1); 13699758b77fSLuigi Rizzo } 13709758b77fSLuigi Rizzo flags |= HAVE_PROTO; 13719758b77fSLuigi Rizzo break; 13729758b77fSLuigi Rizzo 13739758b77fSLuigi Rizzo default: /*options ... */ 137457cd6d26SMax Laier if (!(cmd->len & (F_OR|F_NOT))) 137557cd6d26SMax Laier if (((cmd->opcode == O_IP6) && 137657cd6d26SMax Laier (flags & HAVE_PROTO6)) || 137757cd6d26SMax Laier ((cmd->opcode == O_IP4) && 137857cd6d26SMax Laier (flags & HAVE_PROTO4))) 137957cd6d26SMax Laier break; 1380f68f58e5SLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO | HAVE_SRCIP | 1381f68f58e5SLuigi Rizzo HAVE_DSTIP | HAVE_IP | HAVE_OPTIONS, 0); 13829758b77fSLuigi Rizzo if ((cmd->len & F_OR) && !or_block) 13839758b77fSLuigi Rizzo printf(" {"); 13849758b77fSLuigi Rizzo if (cmd->len & F_NOT && cmd->opcode != O_IN) 13859758b77fSLuigi Rizzo printf(" not"); 13869758b77fSLuigi Rizzo switch(cmd->opcode) { 13875b41efddSMaxim Konovalov case O_MACADDR2: { 13885b41efddSMaxim Konovalov ipfw_insn_mac *m = (ipfw_insn_mac *)cmd; 13895b41efddSMaxim Konovalov 13905b41efddSMaxim Konovalov printf(" MAC"); 13915b41efddSMaxim Konovalov print_mac(m->addr, m->mask); 13925b41efddSMaxim Konovalov print_mac(m->addr + 6, m->mask + 6); 13935b41efddSMaxim Konovalov } 13945b41efddSMaxim Konovalov break; 13955b41efddSMaxim Konovalov 13965b41efddSMaxim Konovalov case O_MAC_TYPE: 13975b41efddSMaxim Konovalov print_newports((ipfw_insn_u16 *)cmd, 13985b41efddSMaxim Konovalov IPPROTO_ETHERTYPE, cmd->opcode); 13995b41efddSMaxim Konovalov break; 14005b41efddSMaxim Konovalov 14015b41efddSMaxim Konovalov 14029758b77fSLuigi Rizzo case O_FRAG: 14039758b77fSLuigi Rizzo printf(" frag"); 14049758b77fSLuigi Rizzo break; 14059758b77fSLuigi Rizzo 14068b07e49aSJulian Elischer case O_FIB: 14078b07e49aSJulian Elischer printf(" fib %u", cmd->arg1 ); 14088b07e49aSJulian Elischer break; 1409ae99fd0eSLuigi Rizzo case O_SOCKARG: 1410ae99fd0eSLuigi Rizzo printf(" sockarg"); 1411ae99fd0eSLuigi Rizzo break; 14128b07e49aSJulian Elischer 14139758b77fSLuigi Rizzo case O_IN: 14149758b77fSLuigi Rizzo printf(cmd->len & F_NOT ? " out" : " in"); 14159758b77fSLuigi Rizzo break; 14169758b77fSLuigi Rizzo 14176daf7ebdSBrian Feldman case O_DIVERTED: 14186daf7ebdSBrian Feldman switch (cmd->arg1) { 14196daf7ebdSBrian Feldman case 3: 14206daf7ebdSBrian Feldman printf(" diverted"); 14216daf7ebdSBrian Feldman break; 14226daf7ebdSBrian Feldman case 1: 14236daf7ebdSBrian Feldman printf(" diverted-loopback"); 14246daf7ebdSBrian Feldman break; 14256daf7ebdSBrian Feldman case 2: 14266daf7ebdSBrian Feldman printf(" diverted-output"); 14276daf7ebdSBrian Feldman break; 14286daf7ebdSBrian Feldman default: 14296daf7ebdSBrian Feldman printf(" diverted-?<%u>", cmd->arg1); 14306daf7ebdSBrian Feldman break; 14316daf7ebdSBrian Feldman } 14326daf7ebdSBrian Feldman break; 14336daf7ebdSBrian Feldman 14349758b77fSLuigi Rizzo case O_LAYER2: 14359758b77fSLuigi Rizzo printf(" layer2"); 14369758b77fSLuigi Rizzo break; 14379758b77fSLuigi Rizzo case O_XMIT: 14389758b77fSLuigi Rizzo case O_RECV: 1439bd528823SGleb Smirnoff case O_VIA: 1440bd528823SGleb Smirnoff { 144162ff38aeSLuigi Rizzo char const *s; 14429758b77fSLuigi Rizzo ipfw_insn_if *cmdif = (ipfw_insn_if *)cmd; 14439758b77fSLuigi Rizzo 14449758b77fSLuigi Rizzo if (cmd->opcode == O_XMIT) 14459758b77fSLuigi Rizzo s = "xmit"; 14469758b77fSLuigi Rizzo else if (cmd->opcode == O_RECV) 14479758b77fSLuigi Rizzo s = "recv"; 144862ff38aeSLuigi Rizzo else /* if (cmd->opcode == O_VIA) */ 14499758b77fSLuigi Rizzo s = "via"; 14509758b77fSLuigi Rizzo if (cmdif->name[0] == '\0') 14515e43aef8SLuigi Rizzo printf(" %s %s", s, 14525e43aef8SLuigi Rizzo inet_ntoa(cmdif->p.ip)); 1453*f8bee51aSAlexander V. Chernikov else if (cmdif->name[0] == '\1') /* interface table */ 1454*f8bee51aSAlexander V. Chernikov printf(" %s table(%d)", s, cmdif->p.glob); 1455bd528823SGleb Smirnoff else 14569bf40edeSBrooks Davis printf(" %s %s", s, cmdif->name); 14579758b77fSLuigi Rizzo 1458bd528823SGleb Smirnoff break; 1459bd528823SGleb Smirnoff } 14609758b77fSLuigi Rizzo case O_IPID: 146144c884e1SLuigi Rizzo if (F_LEN(cmd) == 1) 14629758b77fSLuigi Rizzo printf(" ipid %u", cmd->arg1 ); 146344c884e1SLuigi Rizzo else 146444c884e1SLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, 0, 146544c884e1SLuigi Rizzo O_IPID); 14669758b77fSLuigi Rizzo break; 14679758b77fSLuigi Rizzo 14689758b77fSLuigi Rizzo case O_IPTTL: 146944c884e1SLuigi Rizzo if (F_LEN(cmd) == 1) 14709758b77fSLuigi Rizzo printf(" ipttl %u", cmd->arg1 ); 147144c884e1SLuigi Rizzo else 147244c884e1SLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, 0, 147344c884e1SLuigi Rizzo O_IPTTL); 14749758b77fSLuigi Rizzo break; 14759758b77fSLuigi Rizzo 14769758b77fSLuigi Rizzo case O_IPVER: 14779758b77fSLuigi Rizzo printf(" ipver %u", cmd->arg1 ); 14789758b77fSLuigi Rizzo break; 14799758b77fSLuigi Rizzo 14805e43aef8SLuigi Rizzo case O_IPPRECEDENCE: 14815e43aef8SLuigi Rizzo printf(" ipprecedence %u", (cmd->arg1) >> 5 ); 14825e43aef8SLuigi Rizzo break; 14835e43aef8SLuigi Rizzo 14849758b77fSLuigi Rizzo case O_IPLEN: 148544c884e1SLuigi Rizzo if (F_LEN(cmd) == 1) 14869758b77fSLuigi Rizzo printf(" iplen %u", cmd->arg1 ); 148744c884e1SLuigi Rizzo else 148844c884e1SLuigi Rizzo print_newports((ipfw_insn_u16 *)cmd, 0, 148944c884e1SLuigi Rizzo O_IPLEN); 14909758b77fSLuigi Rizzo break; 14919758b77fSLuigi Rizzo 149252bc23abSLuigi Rizzo case O_IPOPT: 14939758b77fSLuigi Rizzo print_flags("ipoptions", cmd, f_ipopts); 14949758b77fSLuigi Rizzo break; 14959758b77fSLuigi Rizzo 14965e43aef8SLuigi Rizzo case O_IPTOS: 14975e43aef8SLuigi Rizzo print_flags("iptos", cmd, f_iptos); 14985e43aef8SLuigi Rizzo break; 14995e43aef8SLuigi Rizzo 15005e43aef8SLuigi Rizzo case O_ICMPTYPE: 15015e43aef8SLuigi Rizzo print_icmptypes((ipfw_insn_u32 *)cmd); 15025e43aef8SLuigi Rizzo break; 15035e43aef8SLuigi Rizzo 15049758b77fSLuigi Rizzo case O_ESTAB: 15059758b77fSLuigi Rizzo printf(" established"); 15069758b77fSLuigi Rizzo break; 15079758b77fSLuigi Rizzo 1508c99ee9e0SBrian Feldman case O_TCPDATALEN: 1509c99ee9e0SBrian Feldman if (F_LEN(cmd) == 1) 1510c99ee9e0SBrian Feldman printf(" tcpdatalen %u", cmd->arg1 ); 1511c99ee9e0SBrian Feldman else 1512c99ee9e0SBrian Feldman print_newports((ipfw_insn_u16 *)cmd, 0, 1513c99ee9e0SBrian Feldman O_TCPDATALEN); 1514c99ee9e0SBrian Feldman break; 1515c99ee9e0SBrian Feldman 15169758b77fSLuigi Rizzo case O_TCPFLAGS: 15179758b77fSLuigi Rizzo print_flags("tcpflags", cmd, f_tcpflags); 15189758b77fSLuigi Rizzo break; 15199758b77fSLuigi Rizzo 15209758b77fSLuigi Rizzo case O_TCPOPTS: 15219758b77fSLuigi Rizzo print_flags("tcpoptions", cmd, f_tcpopts); 15229758b77fSLuigi Rizzo break; 15239758b77fSLuigi Rizzo 15249758b77fSLuigi Rizzo case O_TCPWIN: 152523ccd3d9SGleb Smirnoff if (F_LEN(cmd) == 1) 152623ccd3d9SGleb Smirnoff printf(" tcpwin %u", cmd->arg1); 152723ccd3d9SGleb Smirnoff else 152823ccd3d9SGleb Smirnoff print_newports((ipfw_insn_u16 *)cmd, 0, 152923ccd3d9SGleb Smirnoff O_TCPWIN); 15309758b77fSLuigi Rizzo break; 15319758b77fSLuigi Rizzo 15329758b77fSLuigi Rizzo case O_TCPACK: 15339758b77fSLuigi Rizzo printf(" tcpack %d", ntohl(cmd32->d[0])); 15349758b77fSLuigi Rizzo break; 15359758b77fSLuigi Rizzo 15369758b77fSLuigi Rizzo case O_TCPSEQ: 15379758b77fSLuigi Rizzo printf(" tcpseq %d", ntohl(cmd32->d[0])); 15389758b77fSLuigi Rizzo break; 15399758b77fSLuigi Rizzo 15409758b77fSLuigi Rizzo case O_UID: 15419758b77fSLuigi Rizzo { 15429758b77fSLuigi Rizzo struct passwd *pwd = getpwuid(cmd32->d[0]); 15439758b77fSLuigi Rizzo 15449758b77fSLuigi Rizzo if (pwd) 15459758b77fSLuigi Rizzo printf(" uid %s", pwd->pw_name); 15469758b77fSLuigi Rizzo else 15479758b77fSLuigi Rizzo printf(" uid %u", cmd32->d[0]); 15489758b77fSLuigi Rizzo } 15499758b77fSLuigi Rizzo break; 15509758b77fSLuigi Rizzo 15519758b77fSLuigi Rizzo case O_GID: 15529758b77fSLuigi Rizzo { 15539758b77fSLuigi Rizzo struct group *grp = getgrgid(cmd32->d[0]); 15549758b77fSLuigi Rizzo 15559758b77fSLuigi Rizzo if (grp) 15569758b77fSLuigi Rizzo printf(" gid %s", grp->gr_name); 15579758b77fSLuigi Rizzo else 15589758b77fSLuigi Rizzo printf(" gid %u", cmd32->d[0]); 15599758b77fSLuigi Rizzo } 15609758b77fSLuigi Rizzo break; 15619758b77fSLuigi Rizzo 156231c88a30SChristian S.J. Peron case O_JAIL: 156331c88a30SChristian S.J. Peron printf(" jail %d", cmd32->d[0]); 156431c88a30SChristian S.J. Peron break; 156531c88a30SChristian S.J. Peron 1566010dabb0SCrist J. Clark case O_VERREVPATH: 1567010dabb0SCrist J. Clark printf(" verrevpath"); 1568010dabb0SCrist J. Clark break; 1569010dabb0SCrist J. Clark 157022b5770bSAndre Oppermann case O_VERSRCREACH: 157122b5770bSAndre Oppermann printf(" versrcreach"); 157222b5770bSAndre Oppermann break; 157322b5770bSAndre Oppermann 15745f9541ecSAndre Oppermann case O_ANTISPOOF: 15755f9541ecSAndre Oppermann printf(" antispoof"); 15765f9541ecSAndre Oppermann break; 15775f9541ecSAndre Oppermann 1578c3e5b9f1SLuigi Rizzo case O_IPSEC: 1579c3e5b9f1SLuigi Rizzo printf(" ipsec"); 1580c3e5b9f1SLuigi Rizzo break; 1581c3e5b9f1SLuigi Rizzo 158262ff38aeSLuigi Rizzo case O_NOP: 1583bbc39c83SLuigi Rizzo comment = (char *)(cmd + 1); 158462ff38aeSLuigi Rizzo break; 158562ff38aeSLuigi Rizzo 15869758b77fSLuigi Rizzo case O_KEEP_STATE: 15879758b77fSLuigi Rizzo printf(" keep-state"); 15889758b77fSLuigi Rizzo break; 15899758b77fSLuigi Rizzo 1590254c4725SOleg Bulyzhin case O_LIMIT: { 15919758b77fSLuigi Rizzo struct _s_x *p = limit_masks; 15929758b77fSLuigi Rizzo ipfw_insn_limit *c = (ipfw_insn_limit *)cmd; 1593571f8c1bSLuigi Rizzo uint8_t x = c->limit_mask; 159462ff38aeSLuigi Rizzo char const *comma = " "; 15959758b77fSLuigi Rizzo 15969758b77fSLuigi Rizzo printf(" limit"); 15979758b77fSLuigi Rizzo for (; p->x != 0 ; p++) 15980a7197a8SLuigi Rizzo if ((x & p->x) == p->x) { 15999758b77fSLuigi Rizzo x &= ~p->x; 16009758b77fSLuigi Rizzo printf("%s%s", comma, p->s); 16019758b77fSLuigi Rizzo comma = ","; 16029758b77fSLuigi Rizzo } 1603254c4725SOleg Bulyzhin PRINT_UINT_ARG(" ", c->conn_limit); 16049758b77fSLuigi Rizzo break; 1605254c4725SOleg Bulyzhin } 16069758b77fSLuigi Rizzo 16078195404bSBrooks Davis case O_IP6: 160836c263ccSHajimu UMEMOTO printf(" ip6"); 16098195404bSBrooks Davis break; 16108195404bSBrooks Davis 161157cd6d26SMax Laier case O_IP4: 161236c263ccSHajimu UMEMOTO printf(" ip4"); 161357cd6d26SMax Laier break; 161457cd6d26SMax Laier 16158195404bSBrooks Davis case O_ICMP6TYPE: 16168195404bSBrooks Davis print_icmp6types((ipfw_insn_u32 *)cmd); 16178195404bSBrooks Davis break; 16188195404bSBrooks Davis 16198195404bSBrooks Davis case O_EXT_HDR: 16208195404bSBrooks Davis print_ext6hdr( (ipfw_insn *) cmd ); 16218195404bSBrooks Davis break; 16228195404bSBrooks Davis 16236a7d5cb6SOleg Bulyzhin case O_TAGGED: 16246a7d5cb6SOleg Bulyzhin if (F_LEN(cmd) == 1) 1625254c4725SOleg Bulyzhin PRINT_UINT_ARG(" tagged ", cmd->arg1); 16266a7d5cb6SOleg Bulyzhin else 16276a7d5cb6SOleg Bulyzhin print_newports((ipfw_insn_u16 *)cmd, 0, 16286a7d5cb6SOleg Bulyzhin O_TAGGED); 16296a7d5cb6SOleg Bulyzhin break; 16306a7d5cb6SOleg Bulyzhin 16319758b77fSLuigi Rizzo default: 16329758b77fSLuigi Rizzo printf(" [opcode %d len %d]", 16339758b77fSLuigi Rizzo cmd->opcode, cmd->len); 16349758b77fSLuigi Rizzo } 16359758b77fSLuigi Rizzo } 16369758b77fSLuigi Rizzo if (cmd->len & F_OR) { 16379758b77fSLuigi Rizzo printf(" or"); 16389758b77fSLuigi Rizzo or_block = 1; 16399758b77fSLuigi Rizzo } else if (or_block) { 16409758b77fSLuigi Rizzo printf(" }"); 16419758b77fSLuigi Rizzo or_block = 0; 16429758b77fSLuigi Rizzo } 16439758b77fSLuigi Rizzo } 1644f68f58e5SLuigi Rizzo show_prerequisites(&flags, HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP 1645f68f58e5SLuigi Rizzo | HAVE_IP, 0); 1646bbc39c83SLuigi Rizzo if (comment) 1647bbc39c83SLuigi Rizzo printf(" // %s", comment); 16489758b77fSLuigi Rizzo printf("\n"); 16499758b77fSLuigi Rizzo } 16509758b77fSLuigi Rizzo 16519758b77fSLuigi Rizzo static void 165245f61351SMaxim Konovalov show_dyn_ipfw(ipfw_dyn_rule *d, int pcwidth, int bcwidth) 16539758b77fSLuigi Rizzo { 16549758b77fSLuigi Rizzo struct protoent *pe; 16559758b77fSLuigi Rizzo struct in_addr a; 1656330462a3SBernd Walter uint16_t rulenum; 165781bd0dc0SMax Laier char buf[INET6_ADDRSTRLEN]; 16589758b77fSLuigi Rizzo 1659db7c5224SLuigi Rizzo if (!co.do_expired) { 16609758b77fSLuigi Rizzo if (!d->expire && !(d->dyn_type == O_LIMIT_PARENT)) 16619758b77fSLuigi Rizzo return; 16629758b77fSLuigi Rizzo } 1663330462a3SBernd Walter bcopy(&d->rule, &rulenum, sizeof(rulenum)); 1664571f8c1bSLuigi Rizzo printf("%05d", rulenum); 166537133ba7SLuigi Rizzo if (pcwidth > 0 || bcwidth > 0) { 166637133ba7SLuigi Rizzo printf(" "); 166737133ba7SLuigi Rizzo pr_u64(&d->pcnt, pcwidth); 166837133ba7SLuigi Rizzo pr_u64(&d->bcnt, bcwidth); 166937133ba7SLuigi Rizzo printf("(%ds)", d->expire); 167037133ba7SLuigi Rizzo } 16719758b77fSLuigi Rizzo switch (d->dyn_type) { 16729758b77fSLuigi Rizzo case O_LIMIT_PARENT: 16739758b77fSLuigi Rizzo printf(" PARENT %d", d->count); 16749758b77fSLuigi Rizzo break; 16759758b77fSLuigi Rizzo case O_LIMIT: 16769758b77fSLuigi Rizzo printf(" LIMIT"); 16779758b77fSLuigi Rizzo break; 16789758b77fSLuigi Rizzo case O_KEEP_STATE: /* bidir, no mask */ 16799758b77fSLuigi Rizzo printf(" STATE"); 16809758b77fSLuigi Rizzo break; 16819758b77fSLuigi Rizzo } 16829758b77fSLuigi Rizzo 16839758b77fSLuigi Rizzo if ((pe = getprotobynumber(d->id.proto)) != NULL) 16849758b77fSLuigi Rizzo printf(" %s", pe->p_name); 16859758b77fSLuigi Rizzo else 16869758b77fSLuigi Rizzo printf(" proto %u", d->id.proto); 16879758b77fSLuigi Rizzo 168881bd0dc0SMax Laier if (d->id.addr_type == 4) { 16899758b77fSLuigi Rizzo a.s_addr = htonl(d->id.src_ip); 16909758b77fSLuigi Rizzo printf(" %s %d", inet_ntoa(a), d->id.src_port); 16919758b77fSLuigi Rizzo 16929758b77fSLuigi Rizzo a.s_addr = htonl(d->id.dst_ip); 16939758b77fSLuigi Rizzo printf(" <-> %s %d", inet_ntoa(a), d->id.dst_port); 169481bd0dc0SMax Laier } else if (d->id.addr_type == 6) { 169581bd0dc0SMax Laier printf(" %s %d", inet_ntop(AF_INET6, &d->id.src_ip6, buf, 169681bd0dc0SMax Laier sizeof(buf)), d->id.src_port); 169781bd0dc0SMax Laier printf(" <-> %s %d", inet_ntop(AF_INET6, &d->id.dst_ip6, buf, 169881bd0dc0SMax Laier sizeof(buf)), d->id.dst_port); 169981bd0dc0SMax Laier } else 170081bd0dc0SMax Laier printf(" UNKNOWN <-> UNKNOWN\n"); 170181bd0dc0SMax Laier 17029758b77fSLuigi Rizzo printf("\n"); 17039758b77fSLuigi Rizzo } 17049758b77fSLuigi Rizzo 170599e5e645SLuigi Rizzo /* 170699e5e645SLuigi Rizzo * This one handles all set-related commands 170799e5e645SLuigi Rizzo * ipfw set { show | enable | disable } 170899e5e645SLuigi Rizzo * ipfw set swap X Y 170999e5e645SLuigi Rizzo * ipfw set move X to Y 171099e5e645SLuigi Rizzo * ipfw set move rule X to Y 171199e5e645SLuigi Rizzo */ 17123c0c8717SLuigi Rizzo void 1713cc4d3c30SLuigi Rizzo ipfw_sets_handler(char *av[]) 171499e5e645SLuigi Rizzo { 1715571f8c1bSLuigi Rizzo uint32_t set_disable, masks[2]; 171699e5e645SLuigi Rizzo int i, nbytes; 1717571f8c1bSLuigi Rizzo uint16_t rulenum; 1718571f8c1bSLuigi Rizzo uint8_t cmd, new_set; 171999e5e645SLuigi Rizzo 172099e5e645SLuigi Rizzo av++; 172199e5e645SLuigi Rizzo 1722cc4d3c30SLuigi Rizzo if (av[0] == NULL) 172399e5e645SLuigi Rizzo errx(EX_USAGE, "set needs command"); 172401750186SBrooks Davis if (_substrcmp(*av, "show") == 0) { 1725c751221aSLuigi Rizzo void *data = NULL; 172662ff38aeSLuigi Rizzo char const *msg; 1727c751221aSLuigi Rizzo int nalloc; 172899e5e645SLuigi Rizzo 1729c751221aSLuigi Rizzo nalloc = nbytes = sizeof(struct ip_fw); 1730c751221aSLuigi Rizzo while (nbytes >= nalloc) { 1731c751221aSLuigi Rizzo if (data) 1732c751221aSLuigi Rizzo free(data); 1733c751221aSLuigi Rizzo nalloc = nalloc * 2 + 200; 1734c751221aSLuigi Rizzo nbytes = nalloc; 17355f356082SLuigi Rizzo data = safe_calloc(1, nbytes); 1736884be75cSThomas Moestl if (do_cmd(IP_FW_GET, data, (uintptr_t)&nbytes) < 0) 173799e5e645SLuigi Rizzo err(EX_OSERR, "getsockopt(IP_FW_GET)"); 1738c751221aSLuigi Rizzo } 1739c751221aSLuigi Rizzo 1740330462a3SBernd Walter bcopy(&((struct ip_fw *)data)->next_rule, 1741330462a3SBernd Walter &set_disable, sizeof(set_disable)); 1742330462a3SBernd Walter 17433004afcaSLuigi Rizzo for (i = 0, msg = "disable" ; i < RESVD_SET; i++) 174499e5e645SLuigi Rizzo if ((set_disable & (1<<i))) { 174599e5e645SLuigi Rizzo printf("%s %d", msg, i); 174699e5e645SLuigi Rizzo msg = ""; 174799e5e645SLuigi Rizzo } 174899e5e645SLuigi Rizzo msg = (set_disable) ? " enable" : "enable"; 17493004afcaSLuigi Rizzo for (i = 0; i < RESVD_SET; i++) 175099e5e645SLuigi Rizzo if (!(set_disable & (1<<i))) { 175199e5e645SLuigi Rizzo printf("%s %d", msg, i); 175299e5e645SLuigi Rizzo msg = ""; 175399e5e645SLuigi Rizzo } 175499e5e645SLuigi Rizzo printf("\n"); 175501750186SBrooks Davis } else if (_substrcmp(*av, "swap") == 0) { 1756cc4d3c30SLuigi Rizzo av++; 1757cc4d3c30SLuigi Rizzo if ( av[0] == NULL || av[1] == NULL ) 175899e5e645SLuigi Rizzo errx(EX_USAGE, "set swap needs 2 set numbers\n"); 175999e5e645SLuigi Rizzo rulenum = atoi(av[0]); 176099e5e645SLuigi Rizzo new_set = atoi(av[1]); 17613004afcaSLuigi Rizzo if (!isdigit(*(av[0])) || rulenum > RESVD_SET) 176299e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid set number %s\n", av[0]); 17633004afcaSLuigi Rizzo if (!isdigit(*(av[1])) || new_set > RESVD_SET) 176499e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid set number %s\n", av[1]); 176599e5e645SLuigi Rizzo masks[0] = (4 << 24) | (new_set << 16) | (rulenum); 1766571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, masks, sizeof(uint32_t)); 176701750186SBrooks Davis } else if (_substrcmp(*av, "move") == 0) { 1768cc4d3c30SLuigi Rizzo av++; 1769c751221aSLuigi Rizzo if (av[0] && _substrcmp(*av, "rule") == 0) { 177099e5e645SLuigi Rizzo cmd = 2; 1771cc4d3c30SLuigi Rizzo av++; 177299e5e645SLuigi Rizzo } else 177399e5e645SLuigi Rizzo cmd = 3; 1774cc4d3c30SLuigi Rizzo if (av[0] == NULL || av[1] == NULL || av[2] == NULL || 1775cc4d3c30SLuigi Rizzo av[3] != NULL || _substrcmp(av[1], "to") != 0) 177699e5e645SLuigi Rizzo errx(EX_USAGE, "syntax: set move [rule] X to Y\n"); 177799e5e645SLuigi Rizzo rulenum = atoi(av[0]); 177899e5e645SLuigi Rizzo new_set = atoi(av[2]); 17793004afcaSLuigi Rizzo if (!isdigit(*(av[0])) || (cmd == 3 && rulenum > RESVD_SET) || 1780759dd6f7SRoman Kurakin (cmd == 2 && rulenum == IPFW_DEFAULT_RULE) ) 178199e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid source number %s\n", av[0]); 17823004afcaSLuigi Rizzo if (!isdigit(*(av[2])) || new_set > RESVD_SET) 178399e5e645SLuigi Rizzo errx(EX_DATAERR, "invalid dest. set %s\n", av[1]); 178499e5e645SLuigi Rizzo masks[0] = (cmd << 24) | (new_set << 16) | (rulenum); 1785571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, masks, sizeof(uint32_t)); 178601750186SBrooks Davis } else if (_substrcmp(*av, "disable") == 0 || 178701750186SBrooks Davis _substrcmp(*av, "enable") == 0 ) { 178801750186SBrooks Davis int which = _substrcmp(*av, "enable") == 0 ? 1 : 0; 178999e5e645SLuigi Rizzo 1790cc4d3c30SLuigi Rizzo av++; 179199e5e645SLuigi Rizzo masks[0] = masks[1] = 0; 179299e5e645SLuigi Rizzo 1793c751221aSLuigi Rizzo while (av[0]) { 179499e5e645SLuigi Rizzo if (isdigit(**av)) { 179599e5e645SLuigi Rizzo i = atoi(*av); 17963004afcaSLuigi Rizzo if (i < 0 || i > RESVD_SET) 179799e5e645SLuigi Rizzo errx(EX_DATAERR, 179899e5e645SLuigi Rizzo "invalid set number %d\n", i); 179999e5e645SLuigi Rizzo masks[which] |= (1<<i); 180001750186SBrooks Davis } else if (_substrcmp(*av, "disable") == 0) 180199e5e645SLuigi Rizzo which = 0; 180201750186SBrooks Davis else if (_substrcmp(*av, "enable") == 0) 180399e5e645SLuigi Rizzo which = 1; 180499e5e645SLuigi Rizzo else 180599e5e645SLuigi Rizzo errx(EX_DATAERR, 180699e5e645SLuigi Rizzo "invalid set command %s\n", *av); 1807cc4d3c30SLuigi Rizzo av++; 180899e5e645SLuigi Rizzo } 180999e5e645SLuigi Rizzo if ( (masks[0] & masks[1]) != 0 ) 181099e5e645SLuigi Rizzo errx(EX_DATAERR, 181199e5e645SLuigi Rizzo "cannot enable and disable the same set\n"); 181299e5e645SLuigi Rizzo 1813571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, masks, sizeof(masks)); 181499e5e645SLuigi Rizzo if (i) 181599e5e645SLuigi Rizzo warn("set enable/disable: setsockopt(IP_FW_DEL)"); 181699e5e645SLuigi Rizzo } else 181799e5e645SLuigi Rizzo errx(EX_USAGE, "invalid set command %s\n", *av); 181899e5e645SLuigi Rizzo } 181999e5e645SLuigi Rizzo 18203c0c8717SLuigi Rizzo void 1821cc4d3c30SLuigi Rizzo ipfw_sysctl_handler(char *av[], int which) 18226690be9eSMatthew Dillon { 18236690be9eSMatthew Dillon av++; 18246690be9eSMatthew Dillon 1825cc4d3c30SLuigi Rizzo if (av[0] == NULL) { 18266690be9eSMatthew Dillon warnx("missing keyword to enable/disable\n"); 182701750186SBrooks Davis } else if (_substrcmp(*av, "firewall") == 0) { 182829c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.enable", NULL, 0, 182929c1402aSLuigi Rizzo &which, sizeof(which)); 1830c323a5faSHajimu UMEMOTO sysctlbyname("net.inet6.ip6.fw.enable", NULL, 0, 1831c323a5faSHajimu UMEMOTO &which, sizeof(which)); 183201750186SBrooks Davis } else if (_substrcmp(*av, "one_pass") == 0) { 183329c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.one_pass", NULL, 0, 183429c1402aSLuigi Rizzo &which, sizeof(which)); 183501750186SBrooks Davis } else if (_substrcmp(*av, "debug") == 0) { 183629c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.debug", NULL, 0, 183729c1402aSLuigi Rizzo &which, sizeof(which)); 183801750186SBrooks Davis } else if (_substrcmp(*av, "verbose") == 0) { 183929c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.verbose", NULL, 0, 184029c1402aSLuigi Rizzo &which, sizeof(which)); 184101750186SBrooks Davis } else if (_substrcmp(*av, "dyn_keepalive") == 0) { 184229c1402aSLuigi Rizzo sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0, 184329c1402aSLuigi Rizzo &which, sizeof(which)); 1844cc4d3c30SLuigi Rizzo #ifndef NO_ALTQ 184501750186SBrooks Davis } else if (_substrcmp(*av, "altq") == 0) { 1846974dfe30SBrian Feldman altq_set_enabled(which); 1847cc4d3c30SLuigi Rizzo #endif 18486690be9eSMatthew Dillon } else { 18496690be9eSMatthew Dillon warnx("unrecognize enable/disable keyword: %s\n", *av); 18506690be9eSMatthew Dillon } 18516690be9eSMatthew Dillon } 18526690be9eSMatthew Dillon 18533c0c8717SLuigi Rizzo void 18543c0c8717SLuigi Rizzo ipfw_list(int ac, char *av[], int show_counters) 18559758b77fSLuigi Rizzo { 18569758b77fSLuigi Rizzo struct ip_fw *r; 18579758b77fSLuigi Rizzo ipfw_dyn_rule *dynrules, *d; 18589758b77fSLuigi Rizzo 185962ff38aeSLuigi Rizzo #define NEXT(r) ((struct ip_fw *)((char *)r + RULESIZE(r))) 186062ff38aeSLuigi Rizzo char *lim; 186162ff38aeSLuigi Rizzo void *data = NULL; 186245f61351SMaxim Konovalov int bcwidth, n, nbytes, nstat, ndyn, pcwidth, width; 18639758b77fSLuigi Rizzo int exitval = EX_OK; 18649758b77fSLuigi Rizzo int lac; 18659758b77fSLuigi Rizzo char **lav; 186662ff38aeSLuigi Rizzo u_long rnum, last; 18679758b77fSLuigi Rizzo char *endptr; 18689758b77fSLuigi Rizzo int seen = 0; 1869d069a5d4SMaxim Konovalov uint8_t set; 18709758b77fSLuigi Rizzo 1871db7c5224SLuigi Rizzo const int ocmd = co.do_pipe ? IP_DUMMYNET_GET : IP_FW_GET; 18729758b77fSLuigi Rizzo int nalloc = 1024; /* start somewhere... */ 18739758b77fSLuigi Rizzo 187400ed6609SMaxim Konovalov last = 0; 187500ed6609SMaxim Konovalov 1876db7c5224SLuigi Rizzo if (co.test_only) { 1877571f8c1bSLuigi Rizzo fprintf(stderr, "Testing only, list disabled\n"); 1878571f8c1bSLuigi Rizzo return; 1879571f8c1bSLuigi Rizzo } 1880cc4d3c30SLuigi Rizzo if (co.do_pipe) { 1881cc4d3c30SLuigi Rizzo dummynet_list(ac, av, show_counters); 1882cc4d3c30SLuigi Rizzo return; 1883cc4d3c30SLuigi Rizzo } 1884571f8c1bSLuigi Rizzo 18859758b77fSLuigi Rizzo ac--; 18869758b77fSLuigi Rizzo av++; 18879758b77fSLuigi Rizzo 18889758b77fSLuigi Rizzo /* get rules or pipes from kernel, resizing array as necessary */ 18899758b77fSLuigi Rizzo nbytes = nalloc; 18909758b77fSLuigi Rizzo 18919758b77fSLuigi Rizzo while (nbytes >= nalloc) { 18929758b77fSLuigi Rizzo nalloc = nalloc * 2 + 200; 18939758b77fSLuigi Rizzo nbytes = nalloc; 18945f356082SLuigi Rizzo data = safe_realloc(data, nbytes); 1895884be75cSThomas Moestl if (do_cmd(ocmd, data, (uintptr_t)&nbytes) < 0) 18969758b77fSLuigi Rizzo err(EX_OSERR, "getsockopt(IP_%s_GET)", 1897db7c5224SLuigi Rizzo co.do_pipe ? "DUMMYNET" : "FW"); 18989758b77fSLuigi Rizzo } 18999758b77fSLuigi Rizzo 19009758b77fSLuigi Rizzo /* 19019758b77fSLuigi Rizzo * Count static rules. They have variable size so we 19029758b77fSLuigi Rizzo * need to scan the list to count them. 19039758b77fSLuigi Rizzo */ 190462ff38aeSLuigi Rizzo for (nstat = 1, r = data, lim = (char *)data + nbytes; 1905759dd6f7SRoman Kurakin r->rulenum < IPFW_DEFAULT_RULE && (char *)r < lim; 190662ff38aeSLuigi Rizzo ++nstat, r = NEXT(r) ) 19079758b77fSLuigi Rizzo ; /* nothing */ 19089758b77fSLuigi Rizzo 19099758b77fSLuigi Rizzo /* 19109758b77fSLuigi Rizzo * Count dynamic rules. This is easier as they have 19119758b77fSLuigi Rizzo * fixed size. 19129758b77fSLuigi Rizzo */ 191362ff38aeSLuigi Rizzo r = NEXT(r); 19149758b77fSLuigi Rizzo dynrules = (ipfw_dyn_rule *)r ; 191562ff38aeSLuigi Rizzo n = (char *)r - (char *)data; 19169758b77fSLuigi Rizzo ndyn = (nbytes - n) / sizeof *dynrules; 19179758b77fSLuigi Rizzo 191845f61351SMaxim Konovalov /* if showing stats, figure out column widths ahead of time */ 191945f61351SMaxim Konovalov bcwidth = pcwidth = 0; 192062ff38aeSLuigi Rizzo if (show_counters) { 192162ff38aeSLuigi Rizzo for (n = 0, r = data; n < nstat; n++, r = NEXT(r)) { 1922d069a5d4SMaxim Konovalov /* skip rules from another set */ 1923db7c5224SLuigi Rizzo if (co.use_set && r->set != co.use_set - 1) 1924d069a5d4SMaxim Konovalov continue; 1925d069a5d4SMaxim Konovalov 192645f61351SMaxim Konovalov /* packet counter */ 192737133ba7SLuigi Rizzo width = pr_u64(&r->pcnt, 0); 192845f61351SMaxim Konovalov if (width > pcwidth) 192945f61351SMaxim Konovalov pcwidth = width; 193045f61351SMaxim Konovalov 193145f61351SMaxim Konovalov /* byte counter */ 193237133ba7SLuigi Rizzo width = pr_u64(&r->bcnt, 0); 193345f61351SMaxim Konovalov if (width > bcwidth) 193445f61351SMaxim Konovalov bcwidth = width; 193545f61351SMaxim Konovalov } 193645f61351SMaxim Konovalov } 1937db7c5224SLuigi Rizzo if (co.do_dynamic && ndyn) { 193845f61351SMaxim Konovalov for (n = 0, d = dynrules; n < ndyn; n++, d++) { 1939db7c5224SLuigi Rizzo if (co.use_set) { 1940d069a5d4SMaxim Konovalov /* skip rules from another set */ 19414a296ec7SMaxim Konovalov bcopy((char *)&d->rule + sizeof(uint16_t), 1942d069a5d4SMaxim Konovalov &set, sizeof(uint8_t)); 1943db7c5224SLuigi Rizzo if (set != co.use_set - 1) 1944d069a5d4SMaxim Konovalov continue; 1945d069a5d4SMaxim Konovalov } 194637133ba7SLuigi Rizzo width = pr_u64(&d->pcnt, 0); 194745f61351SMaxim Konovalov if (width > pcwidth) 194845f61351SMaxim Konovalov pcwidth = width; 194945f61351SMaxim Konovalov 195037133ba7SLuigi Rizzo width = pr_u64(&d->bcnt, 0); 195145f61351SMaxim Konovalov if (width > bcwidth) 195245f61351SMaxim Konovalov bcwidth = width; 195345f61351SMaxim Konovalov } 195445f61351SMaxim Konovalov } 19559758b77fSLuigi Rizzo /* if no rule numbers were specified, list all rules */ 19569758b77fSLuigi Rizzo if (ac == 0) { 1957d069a5d4SMaxim Konovalov for (n = 0, r = data; n < nstat; n++, r = NEXT(r)) { 1958db7c5224SLuigi Rizzo if (co.use_set && r->set != co.use_set - 1) 1959d069a5d4SMaxim Konovalov continue; 196045f61351SMaxim Konovalov show_ipfw(r, pcwidth, bcwidth); 1961d069a5d4SMaxim Konovalov } 19629758b77fSLuigi Rizzo 1963db7c5224SLuigi Rizzo if (co.do_dynamic && ndyn) { 19649758b77fSLuigi Rizzo printf("## Dynamic rules (%d):\n", ndyn); 1965d069a5d4SMaxim Konovalov for (n = 0, d = dynrules; n < ndyn; n++, d++) { 1966db7c5224SLuigi Rizzo if (co.use_set) { 19674a296ec7SMaxim Konovalov bcopy((char *)&d->rule + sizeof(uint16_t), 1968d069a5d4SMaxim Konovalov &set, sizeof(uint8_t)); 1969db7c5224SLuigi Rizzo if (set != co.use_set - 1) 1970d069a5d4SMaxim Konovalov continue; 1971d069a5d4SMaxim Konovalov } 197245f61351SMaxim Konovalov show_dyn_ipfw(d, pcwidth, bcwidth); 19739758b77fSLuigi Rizzo } 1974d069a5d4SMaxim Konovalov } 19759758b77fSLuigi Rizzo goto done; 19769758b77fSLuigi Rizzo } 19779758b77fSLuigi Rizzo 19789758b77fSLuigi Rizzo /* display specific rules requested on command line */ 19799758b77fSLuigi Rizzo 19809758b77fSLuigi Rizzo for (lac = ac, lav = av; lac != 0; lac--) { 19819758b77fSLuigi Rizzo /* convert command line rule # */ 198262ff38aeSLuigi Rizzo last = rnum = strtoul(*lav++, &endptr, 10); 198362ff38aeSLuigi Rizzo if (*endptr == '-') 198462ff38aeSLuigi Rizzo last = strtoul(endptr+1, &endptr, 10); 19859758b77fSLuigi Rizzo if (*endptr) { 19869758b77fSLuigi Rizzo exitval = EX_USAGE; 19879758b77fSLuigi Rizzo warnx("invalid rule number: %s", *(lav - 1)); 19889758b77fSLuigi Rizzo continue; 19899758b77fSLuigi Rizzo } 199062ff38aeSLuigi Rizzo for (n = seen = 0, r = data; n < nstat; n++, r = NEXT(r) ) { 199162ff38aeSLuigi Rizzo if (r->rulenum > last) 19929758b77fSLuigi Rizzo break; 1993db7c5224SLuigi Rizzo if (co.use_set && r->set != co.use_set - 1) 1994d069a5d4SMaxim Konovalov continue; 199562ff38aeSLuigi Rizzo if (r->rulenum >= rnum && r->rulenum <= last) { 199645f61351SMaxim Konovalov show_ipfw(r, pcwidth, bcwidth); 19979758b77fSLuigi Rizzo seen = 1; 19989758b77fSLuigi Rizzo } 19999758b77fSLuigi Rizzo } 20009758b77fSLuigi Rizzo if (!seen) { 20019758b77fSLuigi Rizzo /* give precedence to other error(s) */ 20029758b77fSLuigi Rizzo if (exitval == EX_OK) 20039758b77fSLuigi Rizzo exitval = EX_UNAVAILABLE; 20049758b77fSLuigi Rizzo warnx("rule %lu does not exist", rnum); 20059758b77fSLuigi Rizzo } 20069758b77fSLuigi Rizzo } 20079758b77fSLuigi Rizzo 2008db7c5224SLuigi Rizzo if (co.do_dynamic && ndyn) { 20099758b77fSLuigi Rizzo printf("## Dynamic rules:\n"); 20109758b77fSLuigi Rizzo for (lac = ac, lav = av; lac != 0; lac--) { 20118195404bSBrooks Davis last = rnum = strtoul(*lav++, &endptr, 10); 201262ff38aeSLuigi Rizzo if (*endptr == '-') 201362ff38aeSLuigi Rizzo last = strtoul(endptr+1, &endptr, 10); 20149758b77fSLuigi Rizzo if (*endptr) 20159758b77fSLuigi Rizzo /* already warned */ 20169758b77fSLuigi Rizzo continue; 20179758b77fSLuigi Rizzo for (n = 0, d = dynrules; n < ndyn; n++, d++) { 2018330462a3SBernd Walter uint16_t rulenum; 2019330462a3SBernd Walter 2020330462a3SBernd Walter bcopy(&d->rule, &rulenum, sizeof(rulenum)); 2021330462a3SBernd Walter if (rulenum > rnum) 20229758b77fSLuigi Rizzo break; 2023db7c5224SLuigi Rizzo if (co.use_set) { 20244a296ec7SMaxim Konovalov bcopy((char *)&d->rule + sizeof(uint16_t), 2025d069a5d4SMaxim Konovalov &set, sizeof(uint8_t)); 2026db7c5224SLuigi Rizzo if (set != co.use_set - 1) 2027d069a5d4SMaxim Konovalov continue; 2028d069a5d4SMaxim Konovalov } 202962ff38aeSLuigi Rizzo if (r->rulenum >= rnum && r->rulenum <= last) 203045f61351SMaxim Konovalov show_dyn_ipfw(d, pcwidth, bcwidth); 20319758b77fSLuigi Rizzo } 20329758b77fSLuigi Rizzo } 20339758b77fSLuigi Rizzo } 20349758b77fSLuigi Rizzo 20359758b77fSLuigi Rizzo ac = 0; 20369758b77fSLuigi Rizzo 20379758b77fSLuigi Rizzo done: 20389758b77fSLuigi Rizzo free(data); 20399758b77fSLuigi Rizzo 20409758b77fSLuigi Rizzo if (exitval != EX_OK) 20419758b77fSLuigi Rizzo exit(exitval); 204262ff38aeSLuigi Rizzo #undef NEXT 20439758b77fSLuigi Rizzo } 20449758b77fSLuigi Rizzo 20459758b77fSLuigi Rizzo static int 20469758b77fSLuigi Rizzo lookup_host (char *host, struct in_addr *ipaddr) 20479758b77fSLuigi Rizzo { 20489758b77fSLuigi Rizzo struct hostent *he; 20499758b77fSLuigi Rizzo 20509758b77fSLuigi Rizzo if (!inet_aton(host, ipaddr)) { 20519758b77fSLuigi Rizzo if ((he = gethostbyname(host)) == NULL) 20529758b77fSLuigi Rizzo return(-1); 20539758b77fSLuigi Rizzo *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 20549758b77fSLuigi Rizzo } 20559758b77fSLuigi Rizzo return(0); 20569758b77fSLuigi Rizzo } 20579758b77fSLuigi Rizzo 20589758b77fSLuigi Rizzo /* 20599758b77fSLuigi Rizzo * fills the addr and mask fields in the instruction as appropriate from av. 20609758b77fSLuigi Rizzo * Update length as appropriate. 20619758b77fSLuigi Rizzo * The following formats are allowed: 20629758b77fSLuigi Rizzo * me returns O_IP_*_ME 20639758b77fSLuigi Rizzo * 1.2.3.4 single IP address 20649758b77fSLuigi Rizzo * 1.2.3.4:5.6.7.8 address:mask 20659758b77fSLuigi Rizzo * 1.2.3.4/24 address/mask 20669758b77fSLuigi Rizzo * 1.2.3.4/26{1,6,5,4,23} set of addresses in a subnet 2067571f8c1bSLuigi Rizzo * We can have multiple comma-separated address/mask entries. 20689758b77fSLuigi Rizzo */ 20699758b77fSLuigi Rizzo static void 20709758b77fSLuigi Rizzo fill_ip(ipfw_insn_ip *cmd, char *av) 20719758b77fSLuigi Rizzo { 2072571f8c1bSLuigi Rizzo int len = 0; 2073571f8c1bSLuigi Rizzo uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; 20749758b77fSLuigi Rizzo 20759758b77fSLuigi Rizzo cmd->o.len &= ~F_LEN_MASK; /* zero len */ 20769758b77fSLuigi Rizzo 207701750186SBrooks Davis if (_substrcmp(av, "any") == 0) 20789758b77fSLuigi Rizzo return; 20799758b77fSLuigi Rizzo 208001750186SBrooks Davis if (_substrcmp(av, "me") == 0) { 20819758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn); 20829758b77fSLuigi Rizzo return; 20839758b77fSLuigi Rizzo } 20849758b77fSLuigi Rizzo 208501750186SBrooks Davis if (strncmp(av, "table(", 6) == 0) { 2086cd8b5ae0SRuslan Ermilov char *p = strchr(av + 6, ','); 2087cd8b5ae0SRuslan Ermilov 2088cd8b5ae0SRuslan Ermilov if (p) 2089cd8b5ae0SRuslan Ermilov *p++ = '\0'; 2090cd8b5ae0SRuslan Ermilov cmd->o.opcode = O_IP_DST_LOOKUP; 2091cd8b5ae0SRuslan Ermilov cmd->o.arg1 = strtoul(av + 6, NULL, 0); 2092cd8b5ae0SRuslan Ermilov if (p) { 2093cd8b5ae0SRuslan Ermilov cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 2094cd8b5ae0SRuslan Ermilov d[0] = strtoul(p, NULL, 0); 2095cd8b5ae0SRuslan Ermilov } else 2096cd8b5ae0SRuslan Ermilov cmd->o.len |= F_INSN_SIZE(ipfw_insn); 2097cd8b5ae0SRuslan Ermilov return; 2098cd8b5ae0SRuslan Ermilov } 2099cd8b5ae0SRuslan Ermilov 2100571f8c1bSLuigi Rizzo while (av) { 2101571f8c1bSLuigi Rizzo /* 2102571f8c1bSLuigi Rizzo * After the address we can have '/' or ':' indicating a mask, 2103571f8c1bSLuigi Rizzo * ',' indicating another address follows, '{' indicating a 2104571f8c1bSLuigi Rizzo * set of addresses of unspecified size. 2105571f8c1bSLuigi Rizzo */ 2106c2221c35SMax Laier char *t = NULL, *p = strpbrk(av, "/:,{"); 2107571f8c1bSLuigi Rizzo int masklen; 2108daa9733aSLuigi Rizzo char md, nd = '\0'; 2109571f8c1bSLuigi Rizzo 21109758b77fSLuigi Rizzo if (p) { 21119758b77fSLuigi Rizzo md = *p; 21129758b77fSLuigi Rizzo *p++ = '\0'; 2113c2221c35SMax Laier if ((t = strpbrk(p, ",{")) != NULL) { 2114c2221c35SMax Laier nd = *t; 2115c2221c35SMax Laier *t = '\0'; 2116c2221c35SMax Laier } 2117571f8c1bSLuigi Rizzo } else 2118571f8c1bSLuigi Rizzo md = '\0'; 21199758b77fSLuigi Rizzo 2120571f8c1bSLuigi Rizzo if (lookup_host(av, (struct in_addr *)&d[0]) != 0) 21219758b77fSLuigi Rizzo errx(EX_NOHOST, "hostname ``%s'' unknown", av); 21229758b77fSLuigi Rizzo switch (md) { 21239758b77fSLuigi Rizzo case ':': 2124571f8c1bSLuigi Rizzo if (!inet_aton(p, (struct in_addr *)&d[1])) 21259758b77fSLuigi Rizzo errx(EX_DATAERR, "bad netmask ``%s''", p); 21269758b77fSLuigi Rizzo break; 21279758b77fSLuigi Rizzo case '/': 2128571f8c1bSLuigi Rizzo masklen = atoi(p); 2129571f8c1bSLuigi Rizzo if (masklen == 0) 2130571f8c1bSLuigi Rizzo d[1] = htonl(0); /* mask */ 2131571f8c1bSLuigi Rizzo else if (masklen > 32) 21329758b77fSLuigi Rizzo errx(EX_DATAERR, "bad width ``%s''", p); 21339758b77fSLuigi Rizzo else 2134571f8c1bSLuigi Rizzo d[1] = htonl(~0 << (32 - masklen)); 21359758b77fSLuigi Rizzo break; 2136571f8c1bSLuigi Rizzo case '{': /* no mask, assume /24 and put back the '{' */ 2137571f8c1bSLuigi Rizzo d[1] = htonl(~0 << (32 - 24)); 2138571f8c1bSLuigi Rizzo *(--p) = md; 2139571f8c1bSLuigi Rizzo break; 2140571f8c1bSLuigi Rizzo 2141571f8c1bSLuigi Rizzo case ',': /* single address plus continuation */ 2142571f8c1bSLuigi Rizzo *(--p) = md; 2143571f8c1bSLuigi Rizzo /* FALLTHROUGH */ 2144571f8c1bSLuigi Rizzo case 0: /* initialization value */ 21459758b77fSLuigi Rizzo default: 2146571f8c1bSLuigi Rizzo d[1] = htonl(~0); /* force /32 */ 21479758b77fSLuigi Rizzo break; 21489758b77fSLuigi Rizzo } 2149571f8c1bSLuigi Rizzo d[0] &= d[1]; /* mask base address with mask */ 2150c2221c35SMax Laier if (t) 2151c2221c35SMax Laier *t = nd; 2152571f8c1bSLuigi Rizzo /* find next separator */ 2153571f8c1bSLuigi Rizzo if (p) 2154571f8c1bSLuigi Rizzo p = strpbrk(p, ",{"); 2155571f8c1bSLuigi Rizzo if (p && *p == '{') { 21569758b77fSLuigi Rizzo /* 2157571f8c1bSLuigi Rizzo * We have a set of addresses. They are stored as follows: 21589758b77fSLuigi Rizzo * arg1 is the set size (powers of 2, 2..256) 21599758b77fSLuigi Rizzo * addr is the base address IN HOST FORMAT 2160571f8c1bSLuigi Rizzo * mask.. is an array of arg1 bits (rounded up to 2161571f8c1bSLuigi Rizzo * the next multiple of 32) with bits set 2162571f8c1bSLuigi Rizzo * for each host in the map. 21639758b77fSLuigi Rizzo */ 2164571f8c1bSLuigi Rizzo uint32_t *map = (uint32_t *)&cmd->mask; 21659758b77fSLuigi Rizzo int low, high; 2166f3a126d3SLuigi Rizzo int i = contigmask((uint8_t *)&(d[1]), 32); 21679758b77fSLuigi Rizzo 2168571f8c1bSLuigi Rizzo if (len > 0) 2169571f8c1bSLuigi Rizzo errx(EX_DATAERR, "address set cannot be in a list"); 2170571f8c1bSLuigi Rizzo if (i < 24 || i > 31) 2171571f8c1bSLuigi Rizzo errx(EX_DATAERR, "invalid set with mask %d\n", i); 2172571f8c1bSLuigi Rizzo cmd->o.arg1 = 1<<(32-i); /* map length */ 2173571f8c1bSLuigi Rizzo d[0] = ntohl(d[0]); /* base addr in host format */ 21749758b77fSLuigi Rizzo cmd->o.opcode = O_IP_DST_SET; /* default */ 21759758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + (cmd->o.arg1+31)/32; 217661360012SLuigi Rizzo for (i = 0; i < (cmd->o.arg1+31)/32 ; i++) 2177571f8c1bSLuigi Rizzo map[i] = 0; /* clear map */ 21789758b77fSLuigi Rizzo 21799758b77fSLuigi Rizzo av = p + 1; 2180571f8c1bSLuigi Rizzo low = d[0] & 0xff; 21819758b77fSLuigi Rizzo high = low + cmd->o.arg1 - 1; 2182571f8c1bSLuigi Rizzo /* 2183571f8c1bSLuigi Rizzo * Here, i stores the previous value when we specify a range 2184571f8c1bSLuigi Rizzo * of addresses within a mask, e.g. 45-63. i = -1 means we 2185571f8c1bSLuigi Rizzo * have no previous value. 2186571f8c1bSLuigi Rizzo */ 21879ef3f16dSLuigi Rizzo i = -1; /* previous value in a range */ 21889758b77fSLuigi Rizzo while (isdigit(*av)) { 21899758b77fSLuigi Rizzo char *s; 2190571f8c1bSLuigi Rizzo int a = strtol(av, &s, 0); 21919758b77fSLuigi Rizzo 2192571f8c1bSLuigi Rizzo if (s == av) { /* no parameter */ 2193571f8c1bSLuigi Rizzo if (*av != '}') 2194571f8c1bSLuigi Rizzo errx(EX_DATAERR, "set not closed\n"); 2195571f8c1bSLuigi Rizzo if (i != -1) 2196571f8c1bSLuigi Rizzo errx(EX_DATAERR, "incomplete range %d-", i); 21979758b77fSLuigi Rizzo break; 21989758b77fSLuigi Rizzo } 2199571f8c1bSLuigi Rizzo if (a < low || a > high) 2200571f8c1bSLuigi Rizzo errx(EX_DATAERR, "addr %d out of range [%d-%d]\n", 2201571f8c1bSLuigi Rizzo a, low, high); 22029758b77fSLuigi Rizzo a -= low; 22039ef3f16dSLuigi Rizzo if (i == -1) /* no previous in range */ 22049ef3f16dSLuigi Rizzo i = a; 22059ef3f16dSLuigi Rizzo else { /* check that range is valid */ 22069ef3f16dSLuigi Rizzo if (i > a) 22079ef3f16dSLuigi Rizzo errx(EX_DATAERR, "invalid range %d-%d", 22089ef3f16dSLuigi Rizzo i+low, a+low); 22099ef3f16dSLuigi Rizzo if (*s == '-') 22109ef3f16dSLuigi Rizzo errx(EX_DATAERR, "double '-' in range"); 22119ef3f16dSLuigi Rizzo } 22129ef3f16dSLuigi Rizzo for (; i <= a; i++) 2213571f8c1bSLuigi Rizzo map[i/32] |= 1<<(i & 31); 22149ef3f16dSLuigi Rizzo i = -1; 22159ef3f16dSLuigi Rizzo if (*s == '-') 22169ef3f16dSLuigi Rizzo i = a; 2217571f8c1bSLuigi Rizzo else if (*s == '}') 22189758b77fSLuigi Rizzo break; 22199758b77fSLuigi Rizzo av = s+1; 22209758b77fSLuigi Rizzo } 22219758b77fSLuigi Rizzo return; 22229758b77fSLuigi Rizzo } 2223571f8c1bSLuigi Rizzo av = p; 2224571f8c1bSLuigi Rizzo if (av) /* then *av must be a ',' */ 2225571f8c1bSLuigi Rizzo av++; 22269758b77fSLuigi Rizzo 2227571f8c1bSLuigi Rizzo /* Check this entry */ 2228571f8c1bSLuigi Rizzo if (d[1] == 0) { /* "any", specified as x.x.x.x/0 */ 2229571f8c1bSLuigi Rizzo /* 2230571f8c1bSLuigi Rizzo * 'any' turns the entire list into a NOP. 2231571f8c1bSLuigi Rizzo * 'not any' never matches, so it is removed from the 2232571f8c1bSLuigi Rizzo * list unless it is the only item, in which case we 2233571f8c1bSLuigi Rizzo * report an error. 2234571f8c1bSLuigi Rizzo */ 2235571f8c1bSLuigi Rizzo if (cmd->o.len & F_NOT) { /* "not any" never matches */ 2236571f8c1bSLuigi Rizzo if (av == NULL && len == 0) /* only this entry */ 22379758b77fSLuigi Rizzo errx(EX_DATAERR, "not any never matches"); 2238571f8c1bSLuigi Rizzo } 2239571f8c1bSLuigi Rizzo /* else do nothing and skip this entry */ 224014533a98SMaxim Konovalov return; 2241571f8c1bSLuigi Rizzo } 2242571f8c1bSLuigi Rizzo /* A single IP can be stored in an optimized format */ 2243cc4d3c30SLuigi Rizzo if (d[1] == (uint32_t)~0 && av == NULL && len == 0) { 22449758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 2245571f8c1bSLuigi Rizzo return; 2246571f8c1bSLuigi Rizzo } 2247571f8c1bSLuigi Rizzo len += 2; /* two words... */ 2248571f8c1bSLuigi Rizzo d += 2; 2249571f8c1bSLuigi Rizzo } /* end while */ 2250268f526cSJohn Hay if (len + 1 > F_LEN_MASK) 2251268f526cSJohn Hay errx(EX_DATAERR, "address list too long"); 2252571f8c1bSLuigi Rizzo cmd->o.len |= len+1; 22539758b77fSLuigi Rizzo } 22549758b77fSLuigi Rizzo 22559758b77fSLuigi Rizzo 22568195404bSBrooks Davis /* n2mask sets n bits of the mask */ 22574e9c8ae7SLuigi Rizzo void 22588195404bSBrooks Davis n2mask(struct in6_addr *mask, int n) 22598195404bSBrooks Davis { 22608195404bSBrooks Davis static int minimask[9] = 22618195404bSBrooks Davis { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff }; 22628195404bSBrooks Davis u_char *p; 22638195404bSBrooks Davis 22648195404bSBrooks Davis memset(mask, 0, sizeof(struct in6_addr)); 22658195404bSBrooks Davis p = (u_char *) mask; 22668195404bSBrooks Davis for (; n > 0; p++, n -= 8) { 22678195404bSBrooks Davis if (n >= 8) 22688195404bSBrooks Davis *p = 0xff; 22698195404bSBrooks Davis else 22708195404bSBrooks Davis *p = minimask[n]; 22718195404bSBrooks Davis } 22728195404bSBrooks Davis return; 22738195404bSBrooks Davis } 22748195404bSBrooks Davis 22758195404bSBrooks Davis /* 22769758b77fSLuigi Rizzo * helper function to process a set of flags and set bits in the 22779758b77fSLuigi Rizzo * appropriate masks. 22789758b77fSLuigi Rizzo */ 22799758b77fSLuigi Rizzo static void 22809758b77fSLuigi Rizzo fill_flags(ipfw_insn *cmd, enum ipfw_opcodes opcode, 22819758b77fSLuigi Rizzo struct _s_x *flags, char *p) 22829758b77fSLuigi Rizzo { 2283571f8c1bSLuigi Rizzo uint8_t set=0, clear=0; 22849758b77fSLuigi Rizzo 22859758b77fSLuigi Rizzo while (p && *p) { 22869758b77fSLuigi Rizzo char *q; /* points to the separator */ 22879758b77fSLuigi Rizzo int val; 2288571f8c1bSLuigi Rizzo uint8_t *which; /* mask we are working on */ 22899758b77fSLuigi Rizzo 22909758b77fSLuigi Rizzo if (*p == '!') { 22919758b77fSLuigi Rizzo p++; 22929758b77fSLuigi Rizzo which = &clear; 22939758b77fSLuigi Rizzo } else 22949758b77fSLuigi Rizzo which = &set; 22959758b77fSLuigi Rizzo q = strchr(p, ','); 22969758b77fSLuigi Rizzo if (q) 22979758b77fSLuigi Rizzo *q++ = '\0'; 22989758b77fSLuigi Rizzo val = match_token(flags, p); 22999758b77fSLuigi Rizzo if (val <= 0) 23009758b77fSLuigi Rizzo errx(EX_DATAERR, "invalid flag %s", p); 2301571f8c1bSLuigi Rizzo *which |= (uint8_t)val; 23029758b77fSLuigi Rizzo p = q; 23039758b77fSLuigi Rizzo } 23049758b77fSLuigi Rizzo cmd->opcode = opcode; 23059758b77fSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)) | 1; 23069758b77fSLuigi Rizzo cmd->arg1 = (set & 0xff) | ( (clear & 0xff) << 8); 23079758b77fSLuigi Rizzo } 23089758b77fSLuigi Rizzo 23099758b77fSLuigi Rizzo 23103c0c8717SLuigi Rizzo void 2311cc4d3c30SLuigi Rizzo ipfw_delete(char *av[]) 23129758b77fSLuigi Rizzo { 2313571f8c1bSLuigi Rizzo uint32_t rulenum; 23149758b77fSLuigi Rizzo int i; 23159758b77fSLuigi Rizzo int exitval = EX_OK; 231643405724SLuigi Rizzo int do_set = 0; 23179758b77fSLuigi Rizzo 2318cc4d3c30SLuigi Rizzo av++; 231904f70834SChristian S.J. Peron NEED1("missing rule specification"); 2320cc4d3c30SLuigi Rizzo if ( *av && _substrcmp(*av, "set") == 0) { 2321d069a5d4SMaxim Konovalov /* Do not allow using the following syntax: 2322d069a5d4SMaxim Konovalov * ipfw set N delete set M 2323d069a5d4SMaxim Konovalov */ 2324db7c5224SLuigi Rizzo if (co.use_set) 2325d069a5d4SMaxim Konovalov errx(EX_DATAERR, "invalid syntax"); 232643405724SLuigi Rizzo do_set = 1; /* delete set */ 2327cc4d3c30SLuigi Rizzo av++; 232899e5e645SLuigi Rizzo } 23299758b77fSLuigi Rizzo 23309758b77fSLuigi Rizzo /* Rule number */ 2331cc4d3c30SLuigi Rizzo while (*av && isdigit(**av)) { 2332cc4d3c30SLuigi Rizzo i = atoi(*av); av++; 2333db7c5224SLuigi Rizzo if (co.do_nat) { 2334ff2f6fe8SPaolo Pisati exitval = do_cmd(IP_FW_NAT_DEL, &i, sizeof i); 2335ff2f6fe8SPaolo Pisati if (exitval) { 2336ff2f6fe8SPaolo Pisati exitval = EX_UNAVAILABLE; 2337ff2f6fe8SPaolo Pisati warn("rule %u not available", i); 2338ff2f6fe8SPaolo Pisati } 2339db7c5224SLuigi Rizzo } else if (co.do_pipe) { 23404e9c8ae7SLuigi Rizzo exitval = ipfw_delete_pipe(co.do_pipe, i); 23419758b77fSLuigi Rizzo } else { 2342db7c5224SLuigi Rizzo if (co.use_set) 2343d069a5d4SMaxim Konovalov rulenum = (i & 0xffff) | (5 << 24) | 2344db7c5224SLuigi Rizzo ((co.use_set - 1) << 16); 2345d069a5d4SMaxim Konovalov else 234699e5e645SLuigi Rizzo rulenum = (i & 0xffff) | (do_set << 24); 2347571f8c1bSLuigi Rizzo i = do_cmd(IP_FW_DEL, &rulenum, sizeof rulenum); 23489758b77fSLuigi Rizzo if (i) { 23499758b77fSLuigi Rizzo exitval = EX_UNAVAILABLE; 23509758b77fSLuigi Rizzo warn("rule %u: setsockopt(IP_FW_DEL)", 23519758b77fSLuigi Rizzo rulenum); 23529758b77fSLuigi Rizzo } 23539758b77fSLuigi Rizzo } 23549758b77fSLuigi Rizzo } 23559758b77fSLuigi Rizzo if (exitval != EX_OK) 23569758b77fSLuigi Rizzo exit(exitval); 23579758b77fSLuigi Rizzo } 23589758b77fSLuigi Rizzo 23599758b77fSLuigi Rizzo 23609758b77fSLuigi Rizzo /* 23619758b77fSLuigi Rizzo * fill the interface structure. We do not check the name as we can 23629758b77fSLuigi Rizzo * create interfaces dynamically, so checking them at insert time 23639758b77fSLuigi Rizzo * makes relatively little sense. 23649bf40edeSBrooks Davis * Interface names containing '*', '?', or '[' are assumed to be shell 23659bf40edeSBrooks Davis * patterns which match interfaces. 23669758b77fSLuigi Rizzo */ 23679758b77fSLuigi Rizzo static void 23689758b77fSLuigi Rizzo fill_iface(ipfw_insn_if *cmd, char *arg) 23699758b77fSLuigi Rizzo { 23709758b77fSLuigi Rizzo cmd->name[0] = '\0'; 23719758b77fSLuigi Rizzo cmd->o.len |= F_INSN_SIZE(ipfw_insn_if); 23729758b77fSLuigi Rizzo 23739758b77fSLuigi Rizzo /* Parse the interface or address */ 237401750186SBrooks Davis if (strcmp(arg, "any") == 0) 23759758b77fSLuigi Rizzo cmd->o.len = 0; /* effectively ignore this command */ 2376*f8bee51aSAlexander V. Chernikov else if (strncmp(arg, "table(", 6) == 0) { 2377*f8bee51aSAlexander V. Chernikov char *p = strchr(arg + 6, ','); 2378*f8bee51aSAlexander V. Chernikov if (p) 2379*f8bee51aSAlexander V. Chernikov *p++ = '\0'; 2380*f8bee51aSAlexander V. Chernikov cmd->name[0] = '\1'; /* Special value indicating table */ 2381*f8bee51aSAlexander V. Chernikov cmd->p.glob = strtoul(arg + 6, NULL, 0); 2382*f8bee51aSAlexander V. Chernikov } else if (!isdigit(*arg)) { 23839bf40edeSBrooks Davis strlcpy(cmd->name, arg, sizeof(cmd->name)); 23849bf40edeSBrooks Davis cmd->p.glob = strpbrk(arg, "*?[") != NULL ? 1 : 0; 23859758b77fSLuigi Rizzo } else if (!inet_aton(arg, &cmd->p.ip)) 23869758b77fSLuigi Rizzo errx(EX_DATAERR, "bad ip address ``%s''", arg); 23879758b77fSLuigi Rizzo } 23889758b77fSLuigi Rizzo 23899758b77fSLuigi Rizzo static void 2390bd1d3456SMaxim Konovalov get_mac_addr_mask(const char *p, uint8_t *addr, uint8_t *mask) 23919758b77fSLuigi Rizzo { 2392cc4d3c30SLuigi Rizzo int i; 2393cc4d3c30SLuigi Rizzo size_t l; 2394bd1d3456SMaxim Konovalov char *ap, *ptr, *optr; 2395bd1d3456SMaxim Konovalov struct ether_addr *mac; 2396bd1d3456SMaxim Konovalov const char *macset = "0123456789abcdefABCDEF:"; 23979758b77fSLuigi Rizzo 2398bd1d3456SMaxim Konovalov if (strcmp(p, "any") == 0) { 2399bd1d3456SMaxim Konovalov for (i = 0; i < ETHER_ADDR_LEN; i++) 24009758b77fSLuigi Rizzo addr[i] = mask[i] = 0; 24019758b77fSLuigi Rizzo return; 2402bd1d3456SMaxim Konovalov } 24039758b77fSLuigi Rizzo 2404bd1d3456SMaxim Konovalov optr = ptr = strdup(p); 2405bd1d3456SMaxim Konovalov if ((ap = strsep(&ptr, "&/")) != NULL && *ap != 0) { 2406bd1d3456SMaxim Konovalov l = strlen(ap); 2407bd1d3456SMaxim Konovalov if (strspn(ap, macset) != l || (mac = ether_aton(ap)) == NULL) 2408bd1d3456SMaxim Konovalov errx(EX_DATAERR, "Incorrect MAC address"); 2409bd1d3456SMaxim Konovalov bcopy(mac, addr, ETHER_ADDR_LEN); 2410bd1d3456SMaxim Konovalov } else 2411bd1d3456SMaxim Konovalov errx(EX_DATAERR, "Incorrect MAC address"); 2412bd1d3456SMaxim Konovalov 2413bd1d3456SMaxim Konovalov if (ptr != NULL) { /* we have mask? */ 2414bd1d3456SMaxim Konovalov if (p[ptr - optr - 1] == '/') { /* mask len */ 2415cc4d3c30SLuigi Rizzo long ml = strtol(ptr, &ap, 10); 2416cc4d3c30SLuigi Rizzo if (*ap != 0 || ml > ETHER_ADDR_LEN * 8 || ml < 0) 2417bd1d3456SMaxim Konovalov errx(EX_DATAERR, "Incorrect mask length"); 2418cc4d3c30SLuigi Rizzo for (i = 0; ml > 0 && i < ETHER_ADDR_LEN; ml -= 8, i++) 2419cc4d3c30SLuigi Rizzo mask[i] = (ml >= 8) ? 0xff: (~0) << (8 - ml); 2420bd1d3456SMaxim Konovalov } else { /* mask */ 2421bd1d3456SMaxim Konovalov l = strlen(ptr); 2422bd1d3456SMaxim Konovalov if (strspn(ptr, macset) != l || 2423bd1d3456SMaxim Konovalov (mac = ether_aton(ptr)) == NULL) 2424bd1d3456SMaxim Konovalov errx(EX_DATAERR, "Incorrect mask"); 2425bd1d3456SMaxim Konovalov bcopy(mac, mask, ETHER_ADDR_LEN); 24269758b77fSLuigi Rizzo } 2427bd1d3456SMaxim Konovalov } else { /* default mask: ff:ff:ff:ff:ff:ff */ 2428bd1d3456SMaxim Konovalov for (i = 0; i < ETHER_ADDR_LEN; i++) 24299758b77fSLuigi Rizzo mask[i] = 0xff; 24309758b77fSLuigi Rizzo } 2431bd1d3456SMaxim Konovalov for (i = 0; i < ETHER_ADDR_LEN; i++) 24329758b77fSLuigi Rizzo addr[i] &= mask[i]; 2433bd1d3456SMaxim Konovalov 2434bd1d3456SMaxim Konovalov free(optr); 24359758b77fSLuigi Rizzo } 24369758b77fSLuigi Rizzo 24379758b77fSLuigi Rizzo /* 24389758b77fSLuigi Rizzo * helper function, updates the pointer to cmd with the length 24399758b77fSLuigi Rizzo * of the current command, and also cleans up the first word of 24409758b77fSLuigi Rizzo * the new command in case it has been clobbered before. 24419758b77fSLuigi Rizzo */ 24429758b77fSLuigi Rizzo static ipfw_insn * 24439758b77fSLuigi Rizzo next_cmd(ipfw_insn *cmd) 24449758b77fSLuigi Rizzo { 24459758b77fSLuigi Rizzo cmd += F_LEN(cmd); 24469758b77fSLuigi Rizzo bzero(cmd, sizeof(*cmd)); 24479758b77fSLuigi Rizzo return cmd; 24489758b77fSLuigi Rizzo } 24499758b77fSLuigi Rizzo 24509758b77fSLuigi Rizzo /* 245162ff38aeSLuigi Rizzo * Takes arguments and copies them into a comment 245262ff38aeSLuigi Rizzo */ 245362ff38aeSLuigi Rizzo static void 2454cc4d3c30SLuigi Rizzo fill_comment(ipfw_insn *cmd, char **av) 245562ff38aeSLuigi Rizzo { 245662ff38aeSLuigi Rizzo int i, l; 245762ff38aeSLuigi Rizzo char *p = (char *)(cmd + 1); 245862ff38aeSLuigi Rizzo 245962ff38aeSLuigi Rizzo cmd->opcode = O_NOP; 246062ff38aeSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)); 246162ff38aeSLuigi Rizzo 246262ff38aeSLuigi Rizzo /* Compute length of comment string. */ 2463cc4d3c30SLuigi Rizzo for (i = 0, l = 0; av[i] != NULL; i++) 246462ff38aeSLuigi Rizzo l += strlen(av[i]) + 1; 246562ff38aeSLuigi Rizzo if (l == 0) 246662ff38aeSLuigi Rizzo return; 246762ff38aeSLuigi Rizzo if (l > 84) 246862ff38aeSLuigi Rizzo errx(EX_DATAERR, 246962ff38aeSLuigi Rizzo "comment too long (max 80 chars)"); 247062ff38aeSLuigi Rizzo l = 1 + (l+3)/4; 247162ff38aeSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)) | l; 2472cc4d3c30SLuigi Rizzo for (i = 0; av[i] != NULL; i++) { 247362ff38aeSLuigi Rizzo strcpy(p, av[i]); 247462ff38aeSLuigi Rizzo p += strlen(av[i]); 247562ff38aeSLuigi Rizzo *p++ = ' '; 247662ff38aeSLuigi Rizzo } 247762ff38aeSLuigi Rizzo *(--p) = '\0'; 247862ff38aeSLuigi Rizzo } 247962ff38aeSLuigi Rizzo 248062ff38aeSLuigi Rizzo /* 24819758b77fSLuigi Rizzo * A function to fill simple commands of size 1. 24829758b77fSLuigi Rizzo * Existing flags are preserved. 24839758b77fSLuigi Rizzo */ 24849758b77fSLuigi Rizzo static void 2485571f8c1bSLuigi Rizzo fill_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, int flags, uint16_t arg) 24869758b77fSLuigi Rizzo { 24879758b77fSLuigi Rizzo cmd->opcode = opcode; 24889758b77fSLuigi Rizzo cmd->len = ((cmd->len | flags) & (F_NOT | F_OR)) | 1; 24899758b77fSLuigi Rizzo cmd->arg1 = arg; 24909758b77fSLuigi Rizzo } 24919758b77fSLuigi Rizzo 24929758b77fSLuigi Rizzo /* 24939758b77fSLuigi Rizzo * Fetch and add the MAC address and type, with masks. This generates one or 24949758b77fSLuigi Rizzo * two microinstructions, and returns the pointer to the last one. 24959758b77fSLuigi Rizzo */ 24969758b77fSLuigi Rizzo static ipfw_insn * 2497cc4d3c30SLuigi Rizzo add_mac(ipfw_insn *cmd, char *av[]) 24989758b77fSLuigi Rizzo { 2499e706181bSLuigi Rizzo ipfw_insn_mac *mac; 25009758b77fSLuigi Rizzo 2501cc4d3c30SLuigi Rizzo if ( ( av[0] == NULL ) || ( av[1] == NULL ) ) 25025a155b40SLuigi Rizzo errx(EX_DATAERR, "MAC dst src"); 25039758b77fSLuigi Rizzo 25049758b77fSLuigi Rizzo cmd->opcode = O_MACADDR2; 25059758b77fSLuigi Rizzo cmd->len = (cmd->len & (F_NOT | F_OR)) | F_INSN_SIZE(ipfw_insn_mac); 25069758b77fSLuigi Rizzo 25079758b77fSLuigi Rizzo mac = (ipfw_insn_mac *)cmd; 25089758b77fSLuigi Rizzo get_mac_addr_mask(av[0], mac->addr, mac->mask); /* dst */ 2509bd1d3456SMaxim Konovalov get_mac_addr_mask(av[1], &(mac->addr[ETHER_ADDR_LEN]), 2510bd1d3456SMaxim Konovalov &(mac->mask[ETHER_ADDR_LEN])); /* src */ 2511e706181bSLuigi Rizzo return cmd; 25129758b77fSLuigi Rizzo } 25139758b77fSLuigi Rizzo 2514e706181bSLuigi Rizzo static ipfw_insn * 2515cc4d3c30SLuigi Rizzo add_mactype(ipfw_insn *cmd, char *av) 2516e706181bSLuigi Rizzo { 2517cc4d3c30SLuigi Rizzo if (!av) 2518e706181bSLuigi Rizzo errx(EX_DATAERR, "missing MAC type"); 2519e706181bSLuigi Rizzo if (strcmp(av, "any") != 0) { /* we have a non-null type */ 2520e706181bSLuigi Rizzo fill_newports((ipfw_insn_u16 *)cmd, av, IPPROTO_ETHERTYPE); 2521e706181bSLuigi Rizzo cmd->opcode = O_MAC_TYPE; 25229758b77fSLuigi Rizzo return cmd; 2523e706181bSLuigi Rizzo } else 2524e706181bSLuigi Rizzo return NULL; 2525e706181bSLuigi Rizzo } 2526e706181bSLuigi Rizzo 2527e706181bSLuigi Rizzo static ipfw_insn * 252836c263ccSHajimu UMEMOTO add_proto0(ipfw_insn *cmd, char *av, u_char *protop) 2529e706181bSLuigi Rizzo { 2530e706181bSLuigi Rizzo struct protoent *pe; 253136c263ccSHajimu UMEMOTO char *ep; 253236c263ccSHajimu UMEMOTO int proto; 25338195404bSBrooks Davis 2534c6ec0226SHajimu UMEMOTO proto = strtol(av, &ep, 10); 2535c6ec0226SHajimu UMEMOTO if (*ep != '\0' || proto <= 0) { 253636c263ccSHajimu UMEMOTO if ((pe = getprotobyname(av)) == NULL) 253736c263ccSHajimu UMEMOTO return NULL; 253836c263ccSHajimu UMEMOTO proto = pe->p_proto; 253936c263ccSHajimu UMEMOTO } 254036c263ccSHajimu UMEMOTO 254136c263ccSHajimu UMEMOTO fill_cmd(cmd, O_PROTO, 0, proto); 254236c263ccSHajimu UMEMOTO *protop = proto; 254336c263ccSHajimu UMEMOTO return cmd; 254436c263ccSHajimu UMEMOTO } 254536c263ccSHajimu UMEMOTO 254636c263ccSHajimu UMEMOTO static ipfw_insn * 254736c263ccSHajimu UMEMOTO add_proto(ipfw_insn *cmd, char *av, u_char *protop) 254836c263ccSHajimu UMEMOTO { 254936c263ccSHajimu UMEMOTO u_char proto = IPPROTO_IP; 2550e706181bSLuigi Rizzo 2551c6ec0226SHajimu UMEMOTO if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 255257cd6d26SMax Laier ; /* do not set O_IP4 nor O_IP6 */ 255336c263ccSHajimu UMEMOTO else if (strcmp(av, "ip4") == 0) 255436c263ccSHajimu UMEMOTO /* explicit "just IPv4" rule */ 255536c263ccSHajimu UMEMOTO fill_cmd(cmd, O_IP4, 0, 0); 255636c263ccSHajimu UMEMOTO else if (strcmp(av, "ip6") == 0) { 255736c263ccSHajimu UMEMOTO /* explicit "just IPv6" rule */ 255836c263ccSHajimu UMEMOTO proto = IPPROTO_IPV6; 255936c263ccSHajimu UMEMOTO fill_cmd(cmd, O_IP6, 0, 0); 256036c263ccSHajimu UMEMOTO } else 256136c263ccSHajimu UMEMOTO return add_proto0(cmd, av, protop); 256236c263ccSHajimu UMEMOTO 256336c263ccSHajimu UMEMOTO *protop = proto; 256436c263ccSHajimu UMEMOTO return cmd; 256536c263ccSHajimu UMEMOTO } 256636c263ccSHajimu UMEMOTO 256736c263ccSHajimu UMEMOTO static ipfw_insn * 256836c263ccSHajimu UMEMOTO add_proto_compat(ipfw_insn *cmd, char *av, u_char *protop) 256936c263ccSHajimu UMEMOTO { 257036c263ccSHajimu UMEMOTO u_char proto = IPPROTO_IP; 257136c263ccSHajimu UMEMOTO 257236c263ccSHajimu UMEMOTO if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 257336c263ccSHajimu UMEMOTO ; /* do not set O_IP4 nor O_IP6 */ 257457cd6d26SMax Laier else if (strcmp(av, "ipv4") == 0 || strcmp(av, "ip4") == 0) 257557cd6d26SMax Laier /* explicit "just IPv4" rule */ 257657cd6d26SMax Laier fill_cmd(cmd, O_IP4, 0, 0); 257757cd6d26SMax Laier else if (strcmp(av, "ipv6") == 0 || strcmp(av, "ip6") == 0) { 257857cd6d26SMax Laier /* explicit "just IPv6" rule */ 257936c263ccSHajimu UMEMOTO proto = IPPROTO_IPV6; 258057cd6d26SMax Laier fill_cmd(cmd, O_IP6, 0, 0); 258136c263ccSHajimu UMEMOTO } else 258236c263ccSHajimu UMEMOTO return add_proto0(cmd, av, protop); 25838195404bSBrooks Davis 258436c263ccSHajimu UMEMOTO *protop = proto; 2585e706181bSLuigi Rizzo return cmd; 2586e706181bSLuigi Rizzo } 2587e706181bSLuigi Rizzo 2588e706181bSLuigi Rizzo static ipfw_insn * 2589e706181bSLuigi Rizzo add_srcip(ipfw_insn *cmd, char *av) 2590e706181bSLuigi Rizzo { 2591e706181bSLuigi Rizzo fill_ip((ipfw_insn_ip *)cmd, av); 2592e706181bSLuigi Rizzo if (cmd->opcode == O_IP_DST_SET) /* set */ 2593e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC_SET; 2594cd8b5ae0SRuslan Ermilov else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 2595cd8b5ae0SRuslan Ermilov cmd->opcode = O_IP_SRC_LOOKUP; 2596e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 2597e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC_ME; 2598e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 2599e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC; 2600571f8c1bSLuigi Rizzo else /* addr/mask */ 2601e706181bSLuigi Rizzo cmd->opcode = O_IP_SRC_MASK; 2602e706181bSLuigi Rizzo return cmd; 2603e706181bSLuigi Rizzo } 2604e706181bSLuigi Rizzo 2605e706181bSLuigi Rizzo static ipfw_insn * 2606e706181bSLuigi Rizzo add_dstip(ipfw_insn *cmd, char *av) 2607e706181bSLuigi Rizzo { 2608e706181bSLuigi Rizzo fill_ip((ipfw_insn_ip *)cmd, av); 2609e706181bSLuigi Rizzo if (cmd->opcode == O_IP_DST_SET) /* set */ 2610e706181bSLuigi Rizzo ; 2611cd8b5ae0SRuslan Ermilov else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 2612cd8b5ae0SRuslan Ermilov ; 2613e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 2614e706181bSLuigi Rizzo cmd->opcode = O_IP_DST_ME; 2615e706181bSLuigi Rizzo else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 2616e706181bSLuigi Rizzo cmd->opcode = O_IP_DST; 2617571f8c1bSLuigi Rizzo else /* addr/mask */ 2618e706181bSLuigi Rizzo cmd->opcode = O_IP_DST_MASK; 2619e706181bSLuigi Rizzo return cmd; 2620e706181bSLuigi Rizzo } 2621e706181bSLuigi Rizzo 2622e706181bSLuigi Rizzo static ipfw_insn * 2623e706181bSLuigi Rizzo add_ports(ipfw_insn *cmd, char *av, u_char proto, int opcode) 2624e706181bSLuigi Rizzo { 2625cc4d3c30SLuigi Rizzo /* XXX "any" is trapped before. Perhaps "to" */ 262601750186SBrooks Davis if (_substrcmp(av, "any") == 0) { 2627e706181bSLuigi Rizzo return NULL; 2628e706181bSLuigi Rizzo } else if (fill_newports((ipfw_insn_u16 *)cmd, av, proto)) { 2629e706181bSLuigi Rizzo /* XXX todo: check that we have a protocol with ports */ 2630e706181bSLuigi Rizzo cmd->opcode = opcode; 2631e706181bSLuigi Rizzo return cmd; 2632e706181bSLuigi Rizzo } 2633e706181bSLuigi Rizzo return NULL; 26349758b77fSLuigi Rizzo } 26359758b77fSLuigi Rizzo 26368195404bSBrooks Davis static ipfw_insn * 26378195404bSBrooks Davis add_src(ipfw_insn *cmd, char *av, u_char proto) 26388195404bSBrooks Davis { 26398195404bSBrooks Davis struct in6_addr a; 2640926bbf90SMax Laier char *host, *ch; 2641926bbf90SMax Laier ipfw_insn *ret = NULL; 2642926bbf90SMax Laier 2643926bbf90SMax Laier if ((host = strdup(av)) == NULL) 2644926bbf90SMax Laier return NULL; 2645926bbf90SMax Laier if ((ch = strrchr(host, '/')) != NULL) 2646926bbf90SMax Laier *ch = '\0'; 26478195404bSBrooks Davis 26488195404bSBrooks Davis if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 2649cc4d3c30SLuigi Rizzo inet_pton(AF_INET6, host, &a) == 1) 2650926bbf90SMax Laier ret = add_srcip6(cmd, av); 26518195404bSBrooks Davis /* XXX: should check for IPv4, not !IPv6 */ 2652e28cb025SDavid Malone if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 2653cc4d3c30SLuigi Rizzo inet_pton(AF_INET6, host, &a) != 1)) 2654926bbf90SMax Laier ret = add_srcip(cmd, av); 2655e28cb025SDavid Malone if (ret == NULL && strcmp(av, "any") != 0) 2656926bbf90SMax Laier ret = cmd; 26578195404bSBrooks Davis 2658926bbf90SMax Laier free(host); 2659926bbf90SMax Laier return ret; 26608195404bSBrooks Davis } 26618195404bSBrooks Davis 26628195404bSBrooks Davis static ipfw_insn * 26638195404bSBrooks Davis add_dst(ipfw_insn *cmd, char *av, u_char proto) 26648195404bSBrooks Davis { 26658195404bSBrooks Davis struct in6_addr a; 2666926bbf90SMax Laier char *host, *ch; 2667926bbf90SMax Laier ipfw_insn *ret = NULL; 2668926bbf90SMax Laier 2669926bbf90SMax Laier if ((host = strdup(av)) == NULL) 2670926bbf90SMax Laier return NULL; 2671926bbf90SMax Laier if ((ch = strrchr(host, '/')) != NULL) 2672926bbf90SMax Laier *ch = '\0'; 26738195404bSBrooks Davis 26748195404bSBrooks Davis if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 2675cc4d3c30SLuigi Rizzo inet_pton(AF_INET6, host, &a) == 1) 2676926bbf90SMax Laier ret = add_dstip6(cmd, av); 26778195404bSBrooks Davis /* XXX: should check for IPv4, not !IPv6 */ 2678e28cb025SDavid Malone if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 2679cc4d3c30SLuigi Rizzo inet_pton(AF_INET6, host, &a) != 1)) 2680926bbf90SMax Laier ret = add_dstip(cmd, av); 2681e28cb025SDavid Malone if (ret == NULL && strcmp(av, "any") != 0) 2682926bbf90SMax Laier ret = cmd; 26838195404bSBrooks Davis 2684926bbf90SMax Laier free(host); 2685926bbf90SMax Laier return ret; 26868195404bSBrooks Davis } 26878195404bSBrooks Davis 26889758b77fSLuigi Rizzo /* 26899758b77fSLuigi Rizzo * Parse arguments and assemble the microinstructions which make up a rule. 26909758b77fSLuigi Rizzo * Rules are added into the 'rulebuf' and then copied in the correct order 26919758b77fSLuigi Rizzo * into the actual rule. 26929758b77fSLuigi Rizzo * 2693974dfe30SBrian Feldman * The syntax for a rule starts with the action, followed by 2694974dfe30SBrian Feldman * optional action parameters, and the various match patterns. 26959d5abbddSJens Schweikhardt * In the assembled microcode, the first opcode must be an O_PROBE_STATE 26969758b77fSLuigi Rizzo * (generated if the rule includes a keep-state option), then the 2697974dfe30SBrian Feldman * various match patterns, log/altq actions, and the actual action. 26989758b77fSLuigi Rizzo * 26999758b77fSLuigi Rizzo */ 27003c0c8717SLuigi Rizzo void 2701cc4d3c30SLuigi Rizzo ipfw_add(char *av[]) 27029758b77fSLuigi Rizzo { 27039758b77fSLuigi Rizzo /* 27049758b77fSLuigi Rizzo * rules are added into the 'rulebuf' and then copied in 27059758b77fSLuigi Rizzo * the correct order into the actual rule. 27069758b77fSLuigi Rizzo * Some things that need to go out of order (prob, action etc.) 27079758b77fSLuigi Rizzo * go into actbuf[]. 27089758b77fSLuigi Rizzo */ 2709571f8c1bSLuigi Rizzo static uint32_t rulebuf[255], actbuf[255], cmdbuf[255]; 27109758b77fSLuigi Rizzo 271162ff38aeSLuigi Rizzo ipfw_insn *src, *dst, *cmd, *action, *prev=NULL; 2712e706181bSLuigi Rizzo ipfw_insn *first_cmd; /* first match pattern */ 27139758b77fSLuigi Rizzo 27149758b77fSLuigi Rizzo struct ip_fw *rule; 27159758b77fSLuigi Rizzo 27169758b77fSLuigi Rizzo /* 27179758b77fSLuigi Rizzo * various flags used to record that we entered some fields. 27189758b77fSLuigi Rizzo */ 271952bc23abSLuigi Rizzo ipfw_insn *have_state = NULL; /* check-state or keep-state */ 27206a7d5cb6SOleg Bulyzhin ipfw_insn *have_log = NULL, *have_altq = NULL, *have_tag = NULL; 27219ec4f2e1SMaxim Konovalov size_t len; 27229758b77fSLuigi Rizzo 27239758b77fSLuigi Rizzo int i; 27249758b77fSLuigi Rizzo 27259758b77fSLuigi Rizzo int open_par = 0; /* open parenthesis ( */ 27269758b77fSLuigi Rizzo 27279758b77fSLuigi Rizzo /* proto is here because it is used to fetch ports */ 27289758b77fSLuigi Rizzo u_char proto = IPPROTO_IP; /* default protocol */ 27299758b77fSLuigi Rizzo 273012b5dc6aSLuigi Rizzo double match_prob = 1; /* match probability, default is always match */ 273112b5dc6aSLuigi Rizzo 27329758b77fSLuigi Rizzo bzero(actbuf, sizeof(actbuf)); /* actions go here */ 27339758b77fSLuigi Rizzo bzero(cmdbuf, sizeof(cmdbuf)); 27349758b77fSLuigi Rizzo bzero(rulebuf, sizeof(rulebuf)); 27359758b77fSLuigi Rizzo 27369758b77fSLuigi Rizzo rule = (struct ip_fw *)rulebuf; 27379758b77fSLuigi Rizzo cmd = (ipfw_insn *)cmdbuf; 27389758b77fSLuigi Rizzo action = (ipfw_insn *)actbuf; 27399758b77fSLuigi Rizzo 2740cc4d3c30SLuigi Rizzo av++; 27419758b77fSLuigi Rizzo 27429758b77fSLuigi Rizzo /* [rule N] -- Rule number optional */ 2743cc4d3c30SLuigi Rizzo if (av[0] && isdigit(**av)) { 27449758b77fSLuigi Rizzo rule->rulenum = atoi(*av); 27459758b77fSLuigi Rizzo av++; 27469758b77fSLuigi Rizzo } 27479758b77fSLuigi Rizzo 27483004afcaSLuigi Rizzo /* [set N] -- set number (0..RESVD_SET), optional */ 2749c72c2330SLuigi Rizzo if (av[0] && av[1] && _substrcmp(*av, "set") == 0) { 275043405724SLuigi Rizzo int set = strtoul(av[1], NULL, 10); 27513004afcaSLuigi Rizzo if (set < 0 || set > RESVD_SET) 275243405724SLuigi Rizzo errx(EX_DATAERR, "illegal set %s", av[1]); 275343405724SLuigi Rizzo rule->set = set; 2754cc4d3c30SLuigi Rizzo av += 2; 275543405724SLuigi Rizzo } 275643405724SLuigi Rizzo 27579758b77fSLuigi Rizzo /* [prob D] -- match probability, optional */ 2758cc4d3c30SLuigi Rizzo if (av[0] && av[1] && _substrcmp(*av, "prob") == 0) { 275912b5dc6aSLuigi Rizzo match_prob = strtod(av[1], NULL); 27609758b77fSLuigi Rizzo 276112b5dc6aSLuigi Rizzo if (match_prob <= 0 || match_prob > 1) 27629758b77fSLuigi Rizzo errx(EX_DATAERR, "illegal match prob. %s", av[1]); 2763cc4d3c30SLuigi Rizzo av += 2; 27649758b77fSLuigi Rizzo } 27659758b77fSLuigi Rizzo 27669758b77fSLuigi Rizzo /* action -- mandatory */ 27679758b77fSLuigi Rizzo NEED1("missing action"); 27689758b77fSLuigi Rizzo i = match_token(rule_actions, *av); 2769cc4d3c30SLuigi Rizzo av++; 27709758b77fSLuigi Rizzo action->len = 1; /* default */ 27719758b77fSLuigi Rizzo switch(i) { 27729758b77fSLuigi Rizzo case TOK_CHECKSTATE: 277352bc23abSLuigi Rizzo have_state = action; 27749758b77fSLuigi Rizzo action->opcode = O_CHECK_STATE; 27759758b77fSLuigi Rizzo break; 27769758b77fSLuigi Rizzo 27779758b77fSLuigi Rizzo case TOK_ACCEPT: 27789758b77fSLuigi Rizzo action->opcode = O_ACCEPT; 27799758b77fSLuigi Rizzo break; 27809758b77fSLuigi Rizzo 27819758b77fSLuigi Rizzo case TOK_DENY: 27829758b77fSLuigi Rizzo action->opcode = O_DENY; 27835e43aef8SLuigi Rizzo action->arg1 = 0; 27845e43aef8SLuigi Rizzo break; 27855e43aef8SLuigi Rizzo 27865e43aef8SLuigi Rizzo case TOK_REJECT: 27875e43aef8SLuigi Rizzo action->opcode = O_REJECT; 27885e43aef8SLuigi Rizzo action->arg1 = ICMP_UNREACH_HOST; 27895e43aef8SLuigi Rizzo break; 27905e43aef8SLuigi Rizzo 27915e43aef8SLuigi Rizzo case TOK_RESET: 27925e43aef8SLuigi Rizzo action->opcode = O_REJECT; 27935e43aef8SLuigi Rizzo action->arg1 = ICMP_REJECT_RST; 27945e43aef8SLuigi Rizzo break; 27955e43aef8SLuigi Rizzo 27969066356bSBjoern A. Zeeb case TOK_RESET6: 27979066356bSBjoern A. Zeeb action->opcode = O_UNREACH6; 27989066356bSBjoern A. Zeeb action->arg1 = ICMP6_UNREACH_RST; 27999066356bSBjoern A. Zeeb break; 28009066356bSBjoern A. Zeeb 28015e43aef8SLuigi Rizzo case TOK_UNREACH: 28025e43aef8SLuigi Rizzo action->opcode = O_REJECT; 28035e43aef8SLuigi Rizzo NEED1("missing reject code"); 28045e43aef8SLuigi Rizzo fill_reject_code(&action->arg1, *av); 2805cc4d3c30SLuigi Rizzo av++; 28069758b77fSLuigi Rizzo break; 28079758b77fSLuigi Rizzo 28089066356bSBjoern A. Zeeb case TOK_UNREACH6: 28099066356bSBjoern A. Zeeb action->opcode = O_UNREACH6; 28109066356bSBjoern A. Zeeb NEED1("missing unreach code"); 28119066356bSBjoern A. Zeeb fill_unreach6_code(&action->arg1, *av); 2812cc4d3c30SLuigi Rizzo av++; 28139066356bSBjoern A. Zeeb break; 28149066356bSBjoern A. Zeeb 28159758b77fSLuigi Rizzo case TOK_COUNT: 28169758b77fSLuigi Rizzo action->opcode = O_COUNT; 28179758b77fSLuigi Rizzo break; 28189758b77fSLuigi Rizzo 2819f94a7fc0SPaolo Pisati case TOK_NAT: 2820f94a7fc0SPaolo Pisati action->opcode = O_NAT; 2821f94a7fc0SPaolo Pisati action->len = F_INSN_SIZE(ipfw_insn_nat); 28221875bbfeSAndrey V. Elsukov if (_substrcmp(*av, "global") == 0) { 28231875bbfeSAndrey V. Elsukov action->arg1 = 0; 28241875bbfeSAndrey V. Elsukov av++; 28251875bbfeSAndrey V. Elsukov break; 28261875bbfeSAndrey V. Elsukov } else 2827f94a7fc0SPaolo Pisati goto chkarg; 28288b07e49aSJulian Elischer 28299758b77fSLuigi Rizzo case TOK_QUEUE: 28309758b77fSLuigi Rizzo action->opcode = O_QUEUE; 283140b1ae9eSGleb Smirnoff goto chkarg; 283240b1ae9eSGleb Smirnoff case TOK_PIPE: 28339758b77fSLuigi Rizzo action->opcode = O_PIPE; 283440b1ae9eSGleb Smirnoff goto chkarg; 283540b1ae9eSGleb Smirnoff case TOK_SKIPTO: 28369758b77fSLuigi Rizzo action->opcode = O_SKIPTO; 283740b1ae9eSGleb Smirnoff goto chkarg; 283840b1ae9eSGleb Smirnoff case TOK_NETGRAPH: 283940b1ae9eSGleb Smirnoff action->opcode = O_NETGRAPH; 284040b1ae9eSGleb Smirnoff goto chkarg; 284140b1ae9eSGleb Smirnoff case TOK_NGTEE: 284240b1ae9eSGleb Smirnoff action->opcode = O_NGTEE; 284340b1ae9eSGleb Smirnoff goto chkarg; 28449758b77fSLuigi Rizzo case TOK_DIVERT: 284540b1ae9eSGleb Smirnoff action->opcode = O_DIVERT; 284640b1ae9eSGleb Smirnoff goto chkarg; 28479758b77fSLuigi Rizzo case TOK_TEE: 284840b1ae9eSGleb Smirnoff action->opcode = O_TEE; 28499527ec6eSAndrey V. Elsukov goto chkarg; 28509527ec6eSAndrey V. Elsukov case TOK_CALL: 28519527ec6eSAndrey V. Elsukov action->opcode = O_CALLRETURN; 285240b1ae9eSGleb Smirnoff chkarg: 2853cc4d3c30SLuigi Rizzo if (!av[0]) 285440b1ae9eSGleb Smirnoff errx(EX_USAGE, "missing argument for %s", *(av - 1)); 285540b1ae9eSGleb Smirnoff if (isdigit(**av)) { 285640b1ae9eSGleb Smirnoff action->arg1 = strtoul(*av, NULL, 10); 285740b1ae9eSGleb Smirnoff if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG) 285840b1ae9eSGleb Smirnoff errx(EX_DATAERR, "illegal argument for %s", 285940b1ae9eSGleb Smirnoff *(av - 1)); 2860be39e0b2SLuigi Rizzo } else if (_substrcmp(*av, "tablearg") == 0) { 286140b1ae9eSGleb Smirnoff action->arg1 = IP_FW_TABLEARG; 286240b1ae9eSGleb Smirnoff } else if (i == TOK_DIVERT || i == TOK_TEE) { 28639758b77fSLuigi Rizzo struct servent *s; 28649758b77fSLuigi Rizzo setservent(1); 28659758b77fSLuigi Rizzo s = getservbyname(av[0], "divert"); 28669758b77fSLuigi Rizzo if (s != NULL) 28679758b77fSLuigi Rizzo action->arg1 = ntohs(s->s_port); 28689758b77fSLuigi Rizzo else 28699758b77fSLuigi Rizzo errx(EX_DATAERR, "illegal divert/tee port"); 287040b1ae9eSGleb Smirnoff } else 287140b1ae9eSGleb Smirnoff errx(EX_DATAERR, "illegal argument for %s", *(av - 1)); 2872cc4d3c30SLuigi Rizzo av++; 2873670742a1SGleb Smirnoff break; 2874670742a1SGleb Smirnoff 28759758b77fSLuigi Rizzo case TOK_FORWARD: { 28768a006adbSBjoern A. Zeeb /* 28778a006adbSBjoern A. Zeeb * Locate the address-port separator (':' or ','). 28788a006adbSBjoern A. Zeeb * Could be one of the following: 28798a006adbSBjoern A. Zeeb * hostname:port 28808a006adbSBjoern A. Zeeb * IPv4 a.b.c.d,port 28818a006adbSBjoern A. Zeeb * IPv4 a.b.c.d:port 28828a006adbSBjoern A. Zeeb * IPv6 w:x:y::z,port 28838a006adbSBjoern A. Zeeb * The ':' can only be used with hostname and IPv4 address. 28848a006adbSBjoern A. Zeeb * XXX-BZ Should we also support [w:x:y::z]:port? 28858a006adbSBjoern A. Zeeb */ 28868a006adbSBjoern A. Zeeb struct sockaddr_storage result; 28878a006adbSBjoern A. Zeeb struct addrinfo *res; 28889758b77fSLuigi Rizzo char *s, *end; 28898a006adbSBjoern A. Zeeb int family; 28908a006adbSBjoern A. Zeeb u_short port_number; 28919758b77fSLuigi Rizzo 28929758b77fSLuigi Rizzo NEED1("missing forward address[:port]"); 28939758b77fSLuigi Rizzo 28948a006adbSBjoern A. Zeeb /* 28958a006adbSBjoern A. Zeeb * locate the address-port separator (':' or ',') 28968a006adbSBjoern A. Zeeb */ 28978a006adbSBjoern A. Zeeb s = strchr(*av, ','); 28988a006adbSBjoern A. Zeeb if (s == NULL) { 28998a006adbSBjoern A. Zeeb /* Distinguish between IPv4:port and IPv6 cases. */ 29008a006adbSBjoern A. Zeeb s = strchr(*av, ':'); 29018a006adbSBjoern A. Zeeb if (s && strchr(s+1, ':')) 29028a006adbSBjoern A. Zeeb s = NULL; /* no port */ 29038a006adbSBjoern A. Zeeb } 29048a006adbSBjoern A. Zeeb 29058a006adbSBjoern A. Zeeb port_number = 0; 29068a006adbSBjoern A. Zeeb if (s != NULL) { 29078a006adbSBjoern A. Zeeb /* Terminate host portion and set s to start of port. */ 29088a006adbSBjoern A. Zeeb *(s++) = '\0'; 29098a006adbSBjoern A. Zeeb i = strtoport(s, &end, 0 /* base */, 0 /* proto */); 29108a006adbSBjoern A. Zeeb if (s == end) 29118a006adbSBjoern A. Zeeb errx(EX_DATAERR, 29128a006adbSBjoern A. Zeeb "illegal forwarding port ``%s''", s); 29138a006adbSBjoern A. Zeeb port_number = (u_short)i; 29148a006adbSBjoern A. Zeeb } 29158a006adbSBjoern A. Zeeb 29168a006adbSBjoern A. Zeeb if (_substrcmp(*av, "tablearg") == 0) { 29178a006adbSBjoern A. Zeeb family = PF_INET; 29188a006adbSBjoern A. Zeeb ((struct sockaddr_in*)&result)->sin_addr.s_addr = 29198a006adbSBjoern A. Zeeb INADDR_ANY; 29208a006adbSBjoern A. Zeeb } else { 29218a006adbSBjoern A. Zeeb /* 29228a006adbSBjoern A. Zeeb * Resolve the host name or address to a family and a 29234b85a12fSUlrich Spörlein * network representation of the address. 29248a006adbSBjoern A. Zeeb */ 29258a006adbSBjoern A. Zeeb if (getaddrinfo(*av, NULL, NULL, &res)) 29268a006adbSBjoern A. Zeeb errx(EX_DATAERR, NULL); 29278a006adbSBjoern A. Zeeb /* Just use the first host in the answer. */ 29288a006adbSBjoern A. Zeeb family = res->ai_family; 29298a006adbSBjoern A. Zeeb memcpy(&result, res->ai_addr, res->ai_addrlen); 29308a006adbSBjoern A. Zeeb freeaddrinfo(res); 29318a006adbSBjoern A. Zeeb } 29328a006adbSBjoern A. Zeeb 29338a006adbSBjoern A. Zeeb if (family == PF_INET) { 29348a006adbSBjoern A. Zeeb ipfw_insn_sa *p = (ipfw_insn_sa *)action; 29358a006adbSBjoern A. Zeeb 29369758b77fSLuigi Rizzo action->opcode = O_FORWARD_IP; 29379758b77fSLuigi Rizzo action->len = F_INSN_SIZE(ipfw_insn_sa); 29389758b77fSLuigi Rizzo 2939a52e28c7SLuigi Rizzo /* 2940a52e28c7SLuigi Rizzo * In the kernel we assume AF_INET and use only 29416e47ca1bSLuigi Rizzo * sin_port and sin_addr. Remember to set sin_len as 29426e47ca1bSLuigi Rizzo * the routing code seems to use it too. 2943a52e28c7SLuigi Rizzo */ 29446e47ca1bSLuigi Rizzo p->sa.sin_len = sizeof(struct sockaddr_in); 29458a006adbSBjoern A. Zeeb p->sa.sin_family = AF_INET; 29468a006adbSBjoern A. Zeeb p->sa.sin_port = port_number; 29478a006adbSBjoern A. Zeeb p->sa.sin_addr.s_addr = 29488a006adbSBjoern A. Zeeb ((struct sockaddr_in *)&result)->sin_addr.s_addr; 29498a006adbSBjoern A. Zeeb } else if (family == PF_INET6) { 29508a006adbSBjoern A. Zeeb ipfw_insn_sa6 *p = (ipfw_insn_sa6 *)action; 29518a006adbSBjoern A. Zeeb 29528a006adbSBjoern A. Zeeb action->opcode = O_FORWARD_IP6; 29538a006adbSBjoern A. Zeeb action->len = F_INSN_SIZE(ipfw_insn_sa6); 29548a006adbSBjoern A. Zeeb 29558a006adbSBjoern A. Zeeb p->sa.sin6_len = sizeof(struct sockaddr_in6); 29568a006adbSBjoern A. Zeeb p->sa.sin6_family = AF_INET6; 29578a006adbSBjoern A. Zeeb p->sa.sin6_port = port_number; 29588a006adbSBjoern A. Zeeb p->sa.sin6_flowinfo = 0; 29598a006adbSBjoern A. Zeeb p->sa.sin6_scope_id = 0; 29608a006adbSBjoern A. Zeeb /* No table support for v6 yet. */ 29618a006adbSBjoern A. Zeeb bcopy(&((struct sockaddr_in6*)&result)->sin6_addr, 29628a006adbSBjoern A. Zeeb &p->sa.sin6_addr, sizeof(p->sa.sin6_addr)); 29638a006adbSBjoern A. Zeeb } else { 29648a006adbSBjoern A. Zeeb errx(EX_DATAERR, "Invalid address family in forward action"); 29659758b77fSLuigi Rizzo } 2966cc4d3c30SLuigi Rizzo av++; 29679758b77fSLuigi Rizzo break; 2968c487be96SJulian Elischer } 296962ff38aeSLuigi Rizzo case TOK_COMMENT: 297062ff38aeSLuigi Rizzo /* pretend it is a 'count' rule followed by the comment */ 297162ff38aeSLuigi Rizzo action->opcode = O_COUNT; 2972cc4d3c30SLuigi Rizzo av--; /* go back... */ 297362ff38aeSLuigi Rizzo break; 297462ff38aeSLuigi Rizzo 29758b07e49aSJulian Elischer case TOK_SETFIB: 29768b07e49aSJulian Elischer { 29778b07e49aSJulian Elischer int numfibs; 297805b0fdacSJulian Elischer size_t intsize = sizeof(int); 29798b07e49aSJulian Elischer 29808b07e49aSJulian Elischer action->opcode = O_SETFIB; 29818b07e49aSJulian Elischer NEED1("missing fib number"); 298241b60837SAndrey V. Elsukov if (_substrcmp(*av, "tablearg") == 0) { 298341b60837SAndrey V. Elsukov action->arg1 = IP_FW_TABLEARG; 298441b60837SAndrey V. Elsukov } else { 29858b07e49aSJulian Elischer action->arg1 = strtoul(*av, NULL, 10); 298641b60837SAndrey V. Elsukov if (sysctlbyname("net.fibs", &numfibs, &intsize, 298741b60837SAndrey V. Elsukov NULL, 0) == -1) 29888b07e49aSJulian Elischer errx(EX_DATAERR, "fibs not suported.\n"); 29898b07e49aSJulian Elischer if (action->arg1 >= numfibs) /* Temporary */ 29908b07e49aSJulian Elischer errx(EX_DATAERR, "fib too large.\n"); 299141b60837SAndrey V. Elsukov } 2992cc4d3c30SLuigi Rizzo av++; 29938b07e49aSJulian Elischer break; 29948b07e49aSJulian Elischer } 29958b07e49aSJulian Elischer 2996eb2e4119SPaolo Pisati case TOK_REASS: 2997eb2e4119SPaolo Pisati action->opcode = O_REASS; 2998eb2e4119SPaolo Pisati break; 2999eb2e4119SPaolo Pisati 30009527ec6eSAndrey V. Elsukov case TOK_RETURN: 30019527ec6eSAndrey V. Elsukov fill_cmd(action, O_CALLRETURN, F_NOT, 0); 30029527ec6eSAndrey V. Elsukov break; 30039527ec6eSAndrey V. Elsukov 30049758b77fSLuigi Rizzo default: 3005e706181bSLuigi Rizzo errx(EX_DATAERR, "invalid action %s\n", av[-1]); 30069758b77fSLuigi Rizzo } 30079758b77fSLuigi Rizzo action = next_cmd(action); 30089758b77fSLuigi Rizzo 30099758b77fSLuigi Rizzo /* 3010974dfe30SBrian Feldman * [altq queuename] -- altq tag, optional 30119758b77fSLuigi Rizzo * [log [logamount N]] -- log, optional 30129758b77fSLuigi Rizzo * 3013974dfe30SBrian Feldman * If they exist, it go first in the cmdbuf, but then it is 30149758b77fSLuigi Rizzo * skipped in the copy section to the end of the buffer. 30159758b77fSLuigi Rizzo */ 3016cc4d3c30SLuigi Rizzo while (av[0] != NULL && (i = match_token(rule_action_params, *av)) != -1) { 3017cc4d3c30SLuigi Rizzo av++; 3018974dfe30SBrian Feldman switch (i) { 3019974dfe30SBrian Feldman case TOK_LOG: 3020974dfe30SBrian Feldman { 30219758b77fSLuigi Rizzo ipfw_insn_log *c = (ipfw_insn_log *)cmd; 302262ff38aeSLuigi Rizzo int l; 30239758b77fSLuigi Rizzo 3024974dfe30SBrian Feldman if (have_log) 3025974dfe30SBrian Feldman errx(EX_DATAERR, 3026974dfe30SBrian Feldman "log cannot be specified more than once"); 3027974dfe30SBrian Feldman have_log = (ipfw_insn *)c; 30289758b77fSLuigi Rizzo cmd->len = F_INSN_SIZE(ipfw_insn_log); 30299758b77fSLuigi Rizzo cmd->opcode = O_LOG; 3030cc4d3c30SLuigi Rizzo if (av[0] && _substrcmp(*av, "logamount") == 0) { 3031cc4d3c30SLuigi Rizzo av++; 30329758b77fSLuigi Rizzo NEED1("logamount requires argument"); 303362ff38aeSLuigi Rizzo l = atoi(*av); 303462ff38aeSLuigi Rizzo if (l < 0) 3035974dfe30SBrian Feldman errx(EX_DATAERR, 3036974dfe30SBrian Feldman "logamount must be positive"); 303762ff38aeSLuigi Rizzo c->max_log = l; 3038cc4d3c30SLuigi Rizzo av++; 30399ec4f2e1SMaxim Konovalov } else { 30409ec4f2e1SMaxim Konovalov len = sizeof(c->max_log); 30419ec4f2e1SMaxim Konovalov if (sysctlbyname("net.inet.ip.fw.verbose_limit", 30429ec4f2e1SMaxim Konovalov &c->max_log, &len, NULL, 0) == -1) 30439ec4f2e1SMaxim Konovalov errx(1, "sysctlbyname(\"%s\")", 30449ec4f2e1SMaxim Konovalov "net.inet.ip.fw.verbose_limit"); 30459758b77fSLuigi Rizzo } 3046974dfe30SBrian Feldman } 3047974dfe30SBrian Feldman break; 3048974dfe30SBrian Feldman 3049cc4d3c30SLuigi Rizzo #ifndef NO_ALTQ 3050974dfe30SBrian Feldman case TOK_ALTQ: 3051974dfe30SBrian Feldman { 3052974dfe30SBrian Feldman ipfw_insn_altq *a = (ipfw_insn_altq *)cmd; 3053974dfe30SBrian Feldman 3054974dfe30SBrian Feldman NEED1("missing altq queue name"); 3055974dfe30SBrian Feldman if (have_altq) 3056974dfe30SBrian Feldman errx(EX_DATAERR, 3057974dfe30SBrian Feldman "altq cannot be specified more than once"); 3058974dfe30SBrian Feldman have_altq = (ipfw_insn *)a; 3059974dfe30SBrian Feldman cmd->len = F_INSN_SIZE(ipfw_insn_altq); 3060974dfe30SBrian Feldman cmd->opcode = O_ALTQ; 306123c608c8SLuigi Rizzo a->qid = altq_name_to_qid(*av); 3062cc4d3c30SLuigi Rizzo av++; 3063974dfe30SBrian Feldman } 3064974dfe30SBrian Feldman break; 3065cc4d3c30SLuigi Rizzo #endif 3066974dfe30SBrian Feldman 30676a7d5cb6SOleg Bulyzhin case TOK_TAG: 3068254c4725SOleg Bulyzhin case TOK_UNTAG: { 3069254c4725SOleg Bulyzhin uint16_t tag; 3070254c4725SOleg Bulyzhin 30716a7d5cb6SOleg Bulyzhin if (have_tag) 3072254c4725SOleg Bulyzhin errx(EX_USAGE, "tag and untag cannot be " 3073254c4725SOleg Bulyzhin "specified more than once"); 3074b87ce554SLuigi Rizzo GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, i, 3075759dd6f7SRoman Kurakin rule_action_params); 30766a7d5cb6SOleg Bulyzhin have_tag = cmd; 3077254c4725SOleg Bulyzhin fill_cmd(cmd, O_TAG, (i == TOK_TAG) ? 0: F_NOT, tag); 3078cc4d3c30SLuigi Rizzo av++; 30796a7d5cb6SOleg Bulyzhin break; 3080254c4725SOleg Bulyzhin } 30816a7d5cb6SOleg Bulyzhin 3082974dfe30SBrian Feldman default: 3083974dfe30SBrian Feldman abort(); 3084974dfe30SBrian Feldman } 30859758b77fSLuigi Rizzo cmd = next_cmd(cmd); 30869758b77fSLuigi Rizzo } 30879758b77fSLuigi Rizzo 308852bc23abSLuigi Rizzo if (have_state) /* must be a check-state, we are done */ 30899758b77fSLuigi Rizzo goto done; 30909758b77fSLuigi Rizzo 30919758b77fSLuigi Rizzo #define OR_START(target) \ 3092cc4d3c30SLuigi Rizzo if (av[0] && (*av[0] == '(' || *av[0] == '{')) { \ 30939758b77fSLuigi Rizzo if (open_par) \ 30949758b77fSLuigi Rizzo errx(EX_USAGE, "nested \"(\" not allowed\n"); \ 30958ed2d749SLuigi Rizzo prev = NULL; \ 30969758b77fSLuigi Rizzo open_par = 1; \ 30979758b77fSLuigi Rizzo if ( (av[0])[1] == '\0') { \ 3098cc4d3c30SLuigi Rizzo av++; \ 30999758b77fSLuigi Rizzo } else \ 31009758b77fSLuigi Rizzo (*av)++; \ 31019758b77fSLuigi Rizzo } \ 31029758b77fSLuigi Rizzo target: \ 31039758b77fSLuigi Rizzo 31049758b77fSLuigi Rizzo 31059758b77fSLuigi Rizzo #define CLOSE_PAR \ 31069758b77fSLuigi Rizzo if (open_par) { \ 3107cc4d3c30SLuigi Rizzo if (av[0] && ( \ 310801750186SBrooks Davis strcmp(*av, ")") == 0 || \ 310901750186SBrooks Davis strcmp(*av, "}") == 0)) { \ 31108ed2d749SLuigi Rizzo prev = NULL; \ 31119758b77fSLuigi Rizzo open_par = 0; \ 3112cc4d3c30SLuigi Rizzo av++; \ 31139758b77fSLuigi Rizzo } else \ 31149758b77fSLuigi Rizzo errx(EX_USAGE, "missing \")\"\n"); \ 31159758b77fSLuigi Rizzo } 31169758b77fSLuigi Rizzo 31179758b77fSLuigi Rizzo #define NOT_BLOCK \ 3118cc4d3c30SLuigi Rizzo if (av[0] && _substrcmp(*av, "not") == 0) { \ 31199758b77fSLuigi Rizzo if (cmd->len & F_NOT) \ 31209758b77fSLuigi Rizzo errx(EX_USAGE, "double \"not\" not allowed\n"); \ 31219758b77fSLuigi Rizzo cmd->len |= F_NOT; \ 3122cc4d3c30SLuigi Rizzo av++; \ 31239758b77fSLuigi Rizzo } 31249758b77fSLuigi Rizzo 31259758b77fSLuigi Rizzo #define OR_BLOCK(target) \ 3126cc4d3c30SLuigi Rizzo if (av[0] && _substrcmp(*av, "or") == 0) { \ 31279758b77fSLuigi Rizzo if (prev == NULL || open_par == 0) \ 31289758b77fSLuigi Rizzo errx(EX_DATAERR, "invalid OR block"); \ 31299758b77fSLuigi Rizzo prev->len |= F_OR; \ 3130cc4d3c30SLuigi Rizzo av++; \ 31319758b77fSLuigi Rizzo goto target; \ 31329758b77fSLuigi Rizzo } \ 31339758b77fSLuigi Rizzo CLOSE_PAR; 31349758b77fSLuigi Rizzo 3135e706181bSLuigi Rizzo first_cmd = cmd; 31365a155b40SLuigi Rizzo 31375a155b40SLuigi Rizzo #if 0 3138e706181bSLuigi Rizzo /* 3139e706181bSLuigi Rizzo * MAC addresses, optional. 3140e706181bSLuigi Rizzo * If we have this, we skip the part "proto from src to dst" 3141e706181bSLuigi Rizzo * and jump straight to the option parsing. 3142e706181bSLuigi Rizzo */ 3143e706181bSLuigi Rizzo NOT_BLOCK; 3144e706181bSLuigi Rizzo NEED1("missing protocol"); 314501750186SBrooks Davis if (_substrcmp(*av, "MAC") == 0 || 314601750186SBrooks Davis _substrcmp(*av, "mac") == 0) { 3147cc4d3c30SLuigi Rizzo av++; /* the "MAC" keyword */ 3148cc4d3c30SLuigi Rizzo add_mac(cmd, av); /* exits in case of errors */ 3149e706181bSLuigi Rizzo cmd = next_cmd(cmd); 3150cc4d3c30SLuigi Rizzo av += 2; /* dst-mac and src-mac */ 3151e706181bSLuigi Rizzo NOT_BLOCK; 3152e706181bSLuigi Rizzo NEED1("missing mac type"); 3153cc4d3c30SLuigi Rizzo if (add_mactype(cmd, av[0])) 3154e706181bSLuigi Rizzo cmd = next_cmd(cmd); 3155cc4d3c30SLuigi Rizzo av++; /* any or mac-type */ 3156e706181bSLuigi Rizzo goto read_options; 3157e706181bSLuigi Rizzo } 31585a155b40SLuigi Rizzo #endif 3159e706181bSLuigi Rizzo 31609758b77fSLuigi Rizzo /* 31619758b77fSLuigi Rizzo * protocol, mandatory 31629758b77fSLuigi Rizzo */ 31639758b77fSLuigi Rizzo OR_START(get_proto); 31649758b77fSLuigi Rizzo NOT_BLOCK; 31659758b77fSLuigi Rizzo NEED1("missing protocol"); 316636c263ccSHajimu UMEMOTO if (add_proto_compat(cmd, *av, &proto)) { 3167cc4d3c30SLuigi Rizzo av++; 3168b730879fSMax Laier if (F_LEN(cmd) != 0) { 3169e706181bSLuigi Rizzo prev = cmd; 31709758b77fSLuigi Rizzo cmd = next_cmd(cmd); 3171e706181bSLuigi Rizzo } 31725a155b40SLuigi Rizzo } else if (first_cmd != cmd) { 3173c82b8dceSMaxim Konovalov errx(EX_DATAERR, "invalid protocol ``%s''", *av); 31745a155b40SLuigi Rizzo } else 31755a155b40SLuigi Rizzo goto read_options; 31769758b77fSLuigi Rizzo OR_BLOCK(get_proto); 31779758b77fSLuigi Rizzo 31789758b77fSLuigi Rizzo /* 3179e706181bSLuigi Rizzo * "from", mandatory 31809758b77fSLuigi Rizzo */ 3181cc4d3c30SLuigi Rizzo if ((av[0] == NULL) || _substrcmp(*av, "from") != 0) 31829758b77fSLuigi Rizzo errx(EX_USAGE, "missing ``from''"); 3183cc4d3c30SLuigi Rizzo av++; 31849758b77fSLuigi Rizzo 31859758b77fSLuigi Rizzo /* 31869758b77fSLuigi Rizzo * source IP, mandatory 31879758b77fSLuigi Rizzo */ 31889758b77fSLuigi Rizzo OR_START(source_ip); 31899758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 31909758b77fSLuigi Rizzo NEED1("missing source address"); 31918195404bSBrooks Davis if (add_src(cmd, *av, proto)) { 3192cc4d3c30SLuigi Rizzo av++; 3193e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) { /* ! any */ 3194e706181bSLuigi Rizzo prev = cmd; 31959758b77fSLuigi Rizzo cmd = next_cmd(cmd); 3196e706181bSLuigi Rizzo } 31978195404bSBrooks Davis } else 31988195404bSBrooks Davis errx(EX_USAGE, "bad source address %s", *av); 31999758b77fSLuigi Rizzo OR_BLOCK(source_ip); 32009758b77fSLuigi Rizzo 32019758b77fSLuigi Rizzo /* 32029758b77fSLuigi Rizzo * source ports, optional 32039758b77fSLuigi Rizzo */ 32049758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 3205cc4d3c30SLuigi Rizzo if ( av[0] != NULL ) { 320601750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 3207e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_SRCPORT)) { 3208cc4d3c30SLuigi Rizzo av++; 3209e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) 32109758b77fSLuigi Rizzo cmd = next_cmd(cmd); 32119758b77fSLuigi Rizzo } 32128ed2d749SLuigi Rizzo } 32139758b77fSLuigi Rizzo 32149758b77fSLuigi Rizzo /* 3215e706181bSLuigi Rizzo * "to", mandatory 32169758b77fSLuigi Rizzo */ 3217cc4d3c30SLuigi Rizzo if ( (av[0] == NULL) || _substrcmp(*av, "to") != 0 ) 32189758b77fSLuigi Rizzo errx(EX_USAGE, "missing ``to''"); 3219cc4d3c30SLuigi Rizzo av++; 32209758b77fSLuigi Rizzo 32219758b77fSLuigi Rizzo /* 32229758b77fSLuigi Rizzo * destination, mandatory 32239758b77fSLuigi Rizzo */ 32249758b77fSLuigi Rizzo OR_START(dest_ip); 32259758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 32269758b77fSLuigi Rizzo NEED1("missing dst address"); 32278195404bSBrooks Davis if (add_dst(cmd, *av, proto)) { 3228cc4d3c30SLuigi Rizzo av++; 3229e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) { /* ! any */ 32309758b77fSLuigi Rizzo prev = cmd; 32319758b77fSLuigi Rizzo cmd = next_cmd(cmd); 3232e706181bSLuigi Rizzo } 32338195404bSBrooks Davis } else 32348195404bSBrooks Davis errx( EX_USAGE, "bad destination address %s", *av); 32359758b77fSLuigi Rizzo OR_BLOCK(dest_ip); 32369758b77fSLuigi Rizzo 32379758b77fSLuigi Rizzo /* 32389758b77fSLuigi Rizzo * dest. ports, optional 32399758b77fSLuigi Rizzo */ 32409758b77fSLuigi Rizzo NOT_BLOCK; /* optional "not" */ 3241cc4d3c30SLuigi Rizzo if (av[0]) { 324201750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 3243e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_DSTPORT)) { 3244cc4d3c30SLuigi Rizzo av++; 3245e706181bSLuigi Rizzo if (F_LEN(cmd) != 0) 3246e706181bSLuigi Rizzo cmd = next_cmd(cmd); 32479758b77fSLuigi Rizzo } 32488ed2d749SLuigi Rizzo } 32499758b77fSLuigi Rizzo 32509758b77fSLuigi Rizzo read_options: 3251cc4d3c30SLuigi Rizzo if (av[0] && first_cmd == cmd) { 3252e706181bSLuigi Rizzo /* 3253e706181bSLuigi Rizzo * nothing specified so far, store in the rule to ease 3254e706181bSLuigi Rizzo * printout later. 3255e706181bSLuigi Rizzo */ 3256e706181bSLuigi Rizzo rule->_pad = 1; 3257e706181bSLuigi Rizzo } 32589758b77fSLuigi Rizzo prev = NULL; 3259cc4d3c30SLuigi Rizzo while ( av[0] != NULL ) { 32608ed2d749SLuigi Rizzo char *s; 32618ed2d749SLuigi Rizzo ipfw_insn_u32 *cmd32; /* alias for cmd */ 32628ed2d749SLuigi Rizzo 32638ed2d749SLuigi Rizzo s = *av; 32648ed2d749SLuigi Rizzo cmd32 = (ipfw_insn_u32 *)cmd; 32659758b77fSLuigi Rizzo 32669758b77fSLuigi Rizzo if (*s == '!') { /* alternate syntax for NOT */ 32679758b77fSLuigi Rizzo if (cmd->len & F_NOT) 32689758b77fSLuigi Rizzo errx(EX_USAGE, "double \"not\" not allowed\n"); 32699758b77fSLuigi Rizzo cmd->len = F_NOT; 32709758b77fSLuigi Rizzo s++; 32719758b77fSLuigi Rizzo } 32729758b77fSLuigi Rizzo i = match_token(rule_options, s); 3273cc4d3c30SLuigi Rizzo av++; 32749758b77fSLuigi Rizzo switch(i) { 32759758b77fSLuigi Rizzo case TOK_NOT: 32769758b77fSLuigi Rizzo if (cmd->len & F_NOT) 32779758b77fSLuigi Rizzo errx(EX_USAGE, "double \"not\" not allowed\n"); 32789758b77fSLuigi Rizzo cmd->len = F_NOT; 32799758b77fSLuigi Rizzo break; 32809758b77fSLuigi Rizzo 32819758b77fSLuigi Rizzo case TOK_OR: 32828ed2d749SLuigi Rizzo if (open_par == 0 || prev == NULL) 32839758b77fSLuigi Rizzo errx(EX_USAGE, "invalid \"or\" block\n"); 32849758b77fSLuigi Rizzo prev->len |= F_OR; 32859758b77fSLuigi Rizzo break; 32869758b77fSLuigi Rizzo 32878ed2d749SLuigi Rizzo case TOK_STARTBRACE: 32888ed2d749SLuigi Rizzo if (open_par) 32898ed2d749SLuigi Rizzo errx(EX_USAGE, "+nested \"(\" not allowed\n"); 32908ed2d749SLuigi Rizzo open_par = 1; 32918ed2d749SLuigi Rizzo break; 32928ed2d749SLuigi Rizzo 32938ed2d749SLuigi Rizzo case TOK_ENDBRACE: 32948ed2d749SLuigi Rizzo if (!open_par) 32958ed2d749SLuigi Rizzo errx(EX_USAGE, "+missing \")\"\n"); 32968ed2d749SLuigi Rizzo open_par = 0; 3297e706181bSLuigi Rizzo prev = NULL; 32988ed2d749SLuigi Rizzo break; 32998ed2d749SLuigi Rizzo 33009758b77fSLuigi Rizzo case TOK_IN: 33019758b77fSLuigi Rizzo fill_cmd(cmd, O_IN, 0, 0); 33029758b77fSLuigi Rizzo break; 33039758b77fSLuigi Rizzo 33049758b77fSLuigi Rizzo case TOK_OUT: 33059758b77fSLuigi Rizzo cmd->len ^= F_NOT; /* toggle F_NOT */ 33069758b77fSLuigi Rizzo fill_cmd(cmd, O_IN, 0, 0); 33079758b77fSLuigi Rizzo break; 33089758b77fSLuigi Rizzo 33096daf7ebdSBrian Feldman case TOK_DIVERTED: 33106daf7ebdSBrian Feldman fill_cmd(cmd, O_DIVERTED, 0, 3); 33116daf7ebdSBrian Feldman break; 33126daf7ebdSBrian Feldman 33136daf7ebdSBrian Feldman case TOK_DIVERTEDLOOPBACK: 33146daf7ebdSBrian Feldman fill_cmd(cmd, O_DIVERTED, 0, 1); 33156daf7ebdSBrian Feldman break; 33166daf7ebdSBrian Feldman 33176daf7ebdSBrian Feldman case TOK_DIVERTEDOUTPUT: 33186daf7ebdSBrian Feldman fill_cmd(cmd, O_DIVERTED, 0, 2); 33196daf7ebdSBrian Feldman break; 33206daf7ebdSBrian Feldman 33219758b77fSLuigi Rizzo case TOK_FRAG: 33229758b77fSLuigi Rizzo fill_cmd(cmd, O_FRAG, 0, 0); 33239758b77fSLuigi Rizzo break; 33249758b77fSLuigi Rizzo 33259758b77fSLuigi Rizzo case TOK_LAYER2: 33269758b77fSLuigi Rizzo fill_cmd(cmd, O_LAYER2, 0, 0); 33279758b77fSLuigi Rizzo break; 33289758b77fSLuigi Rizzo 33299758b77fSLuigi Rizzo case TOK_XMIT: 33309758b77fSLuigi Rizzo case TOK_RECV: 33319758b77fSLuigi Rizzo case TOK_VIA: 33329758b77fSLuigi Rizzo NEED1("recv, xmit, via require interface name" 33339758b77fSLuigi Rizzo " or address"); 33349758b77fSLuigi Rizzo fill_iface((ipfw_insn_if *)cmd, av[0]); 3335cc4d3c30SLuigi Rizzo av++; 33369758b77fSLuigi Rizzo if (F_LEN(cmd) == 0) /* not a valid address */ 33379758b77fSLuigi Rizzo break; 33389758b77fSLuigi Rizzo if (i == TOK_XMIT) 33399758b77fSLuigi Rizzo cmd->opcode = O_XMIT; 33409758b77fSLuigi Rizzo else if (i == TOK_RECV) 33419758b77fSLuigi Rizzo cmd->opcode = O_RECV; 33429758b77fSLuigi Rizzo else if (i == TOK_VIA) 33439758b77fSLuigi Rizzo cmd->opcode = O_VIA; 33449758b77fSLuigi Rizzo break; 33459758b77fSLuigi Rizzo 33465e43aef8SLuigi Rizzo case TOK_ICMPTYPES: 33475e43aef8SLuigi Rizzo NEED1("icmptypes requires list of types"); 33485e43aef8SLuigi Rizzo fill_icmptypes((ipfw_insn_u32 *)cmd, *av); 3349cc4d3c30SLuigi Rizzo av++; 33505e43aef8SLuigi Rizzo break; 33515e43aef8SLuigi Rizzo 33528195404bSBrooks Davis case TOK_ICMP6TYPES: 33538195404bSBrooks Davis NEED1("icmptypes requires list of types"); 33548195404bSBrooks Davis fill_icmp6types((ipfw_insn_icmp6 *)cmd, *av); 3355cc4d3c30SLuigi Rizzo av++; 33568195404bSBrooks Davis break; 33578195404bSBrooks Davis 33589758b77fSLuigi Rizzo case TOK_IPTTL: 33599758b77fSLuigi Rizzo NEED1("ipttl requires TTL"); 336044c884e1SLuigi Rizzo if (strpbrk(*av, "-,")) { 336144c884e1SLuigi Rizzo if (!add_ports(cmd, *av, 0, O_IPTTL)) 336244c884e1SLuigi Rizzo errx(EX_DATAERR, "invalid ipttl %s", *av); 336344c884e1SLuigi Rizzo } else 33649758b77fSLuigi Rizzo fill_cmd(cmd, O_IPTTL, 0, strtoul(*av, NULL, 0)); 3365cc4d3c30SLuigi Rizzo av++; 33669758b77fSLuigi Rizzo break; 33679758b77fSLuigi Rizzo 33689758b77fSLuigi Rizzo case TOK_IPID: 336944c884e1SLuigi Rizzo NEED1("ipid requires id"); 337044c884e1SLuigi Rizzo if (strpbrk(*av, "-,")) { 337144c884e1SLuigi Rizzo if (!add_ports(cmd, *av, 0, O_IPID)) 337244c884e1SLuigi Rizzo errx(EX_DATAERR, "invalid ipid %s", *av); 337344c884e1SLuigi Rizzo } else 33749758b77fSLuigi Rizzo fill_cmd(cmd, O_IPID, 0, strtoul(*av, NULL, 0)); 3375cc4d3c30SLuigi Rizzo av++; 33769758b77fSLuigi Rizzo break; 33779758b77fSLuigi Rizzo 33789758b77fSLuigi Rizzo case TOK_IPLEN: 33799758b77fSLuigi Rizzo NEED1("iplen requires length"); 338044c884e1SLuigi Rizzo if (strpbrk(*av, "-,")) { 338144c884e1SLuigi Rizzo if (!add_ports(cmd, *av, 0, O_IPLEN)) 338244c884e1SLuigi Rizzo errx(EX_DATAERR, "invalid ip len %s", *av); 338344c884e1SLuigi Rizzo } else 33849758b77fSLuigi Rizzo fill_cmd(cmd, O_IPLEN, 0, strtoul(*av, NULL, 0)); 3385cc4d3c30SLuigi Rizzo av++; 33869758b77fSLuigi Rizzo break; 33879758b77fSLuigi Rizzo 33889758b77fSLuigi Rizzo case TOK_IPVER: 33899758b77fSLuigi Rizzo NEED1("ipver requires version"); 33909758b77fSLuigi Rizzo fill_cmd(cmd, O_IPVER, 0, strtoul(*av, NULL, 0)); 3391cc4d3c30SLuigi Rizzo av++; 33929758b77fSLuigi Rizzo break; 33939758b77fSLuigi Rizzo 33945e43aef8SLuigi Rizzo case TOK_IPPRECEDENCE: 33955e43aef8SLuigi Rizzo NEED1("ipprecedence requires value"); 33965e43aef8SLuigi Rizzo fill_cmd(cmd, O_IPPRECEDENCE, 0, 33975e43aef8SLuigi Rizzo (strtoul(*av, NULL, 0) & 7) << 5); 3398cc4d3c30SLuigi Rizzo av++; 33995e43aef8SLuigi Rizzo break; 34005e43aef8SLuigi Rizzo 34019758b77fSLuigi Rizzo case TOK_IPOPTS: 34029758b77fSLuigi Rizzo NEED1("missing argument for ipoptions"); 340352bc23abSLuigi Rizzo fill_flags(cmd, O_IPOPT, f_ipopts, *av); 3404cc4d3c30SLuigi Rizzo av++; 34059758b77fSLuigi Rizzo break; 34069758b77fSLuigi Rizzo 34075e43aef8SLuigi Rizzo case TOK_IPTOS: 34085e43aef8SLuigi Rizzo NEED1("missing argument for iptos"); 340952bc23abSLuigi Rizzo fill_flags(cmd, O_IPTOS, f_iptos, *av); 3410cc4d3c30SLuigi Rizzo av++; 34115e43aef8SLuigi Rizzo break; 34125e43aef8SLuigi Rizzo 34139758b77fSLuigi Rizzo case TOK_UID: 34149758b77fSLuigi Rizzo NEED1("uid requires argument"); 34159758b77fSLuigi Rizzo { 34169758b77fSLuigi Rizzo char *end; 34179758b77fSLuigi Rizzo uid_t uid; 34189758b77fSLuigi Rizzo struct passwd *pwd; 34199758b77fSLuigi Rizzo 34209758b77fSLuigi Rizzo cmd->opcode = O_UID; 34219758b77fSLuigi Rizzo uid = strtoul(*av, &end, 0); 34229758b77fSLuigi Rizzo pwd = (*end == '\0') ? getpwuid(uid) : getpwnam(*av); 34239758b77fSLuigi Rizzo if (pwd == NULL) 34249758b77fSLuigi Rizzo errx(EX_DATAERR, "uid \"%s\" nonexistent", *av); 3425d6abaeebSMaxim Konovalov cmd32->d[0] = pwd->pw_uid; 34263a27af0dSChristian S.J. Peron cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 3427cc4d3c30SLuigi Rizzo av++; 34289758b77fSLuigi Rizzo } 34299758b77fSLuigi Rizzo break; 34309758b77fSLuigi Rizzo 34319758b77fSLuigi Rizzo case TOK_GID: 34329758b77fSLuigi Rizzo NEED1("gid requires argument"); 34339758b77fSLuigi Rizzo { 34349758b77fSLuigi Rizzo char *end; 34359758b77fSLuigi Rizzo gid_t gid; 34369758b77fSLuigi Rizzo struct group *grp; 34379758b77fSLuigi Rizzo 34389758b77fSLuigi Rizzo cmd->opcode = O_GID; 34399758b77fSLuigi Rizzo gid = strtoul(*av, &end, 0); 34409758b77fSLuigi Rizzo grp = (*end == '\0') ? getgrgid(gid) : getgrnam(*av); 34419758b77fSLuigi Rizzo if (grp == NULL) 34429758b77fSLuigi Rizzo errx(EX_DATAERR, "gid \"%s\" nonexistent", *av); 3443d6abaeebSMaxim Konovalov cmd32->d[0] = grp->gr_gid; 34443a27af0dSChristian S.J. Peron cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 3445cc4d3c30SLuigi Rizzo av++; 34469758b77fSLuigi Rizzo } 34479758b77fSLuigi Rizzo break; 34489758b77fSLuigi Rizzo 344931c88a30SChristian S.J. Peron case TOK_JAIL: 345031c88a30SChristian S.J. Peron NEED1("jail requires argument"); 345131c88a30SChristian S.J. Peron { 345231c88a30SChristian S.J. Peron char *end; 345331c88a30SChristian S.J. Peron int jid; 345431c88a30SChristian S.J. Peron 345531c88a30SChristian S.J. Peron cmd->opcode = O_JAIL; 345631c88a30SChristian S.J. Peron jid = (int)strtol(*av, &end, 0); 345731c88a30SChristian S.J. Peron if (jid < 0 || *end != '\0') 345831c88a30SChristian S.J. Peron errx(EX_DATAERR, "jail requires prison ID"); 3459d413c2e4SChristian S.J. Peron cmd32->d[0] = (uint32_t)jid; 34603a27af0dSChristian S.J. Peron cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 3461cc4d3c30SLuigi Rizzo av++; 346231c88a30SChristian S.J. Peron } 346331c88a30SChristian S.J. Peron break; 346431c88a30SChristian S.J. Peron 34659758b77fSLuigi Rizzo case TOK_ESTAB: 34669758b77fSLuigi Rizzo fill_cmd(cmd, O_ESTAB, 0, 0); 34679758b77fSLuigi Rizzo break; 34689758b77fSLuigi Rizzo 34699758b77fSLuigi Rizzo case TOK_SETUP: 34709758b77fSLuigi Rizzo fill_cmd(cmd, O_TCPFLAGS, 0, 34719758b77fSLuigi Rizzo (TH_SYN) | ( (TH_ACK) & 0xff) <<8 ); 34729758b77fSLuigi Rizzo break; 34739758b77fSLuigi Rizzo 3474c99ee9e0SBrian Feldman case TOK_TCPDATALEN: 3475c99ee9e0SBrian Feldman NEED1("tcpdatalen requires length"); 3476c99ee9e0SBrian Feldman if (strpbrk(*av, "-,")) { 3477c99ee9e0SBrian Feldman if (!add_ports(cmd, *av, 0, O_TCPDATALEN)) 3478c99ee9e0SBrian Feldman errx(EX_DATAERR, "invalid tcpdata len %s", *av); 3479c99ee9e0SBrian Feldman } else 3480c99ee9e0SBrian Feldman fill_cmd(cmd, O_TCPDATALEN, 0, 3481c99ee9e0SBrian Feldman strtoul(*av, NULL, 0)); 3482cc4d3c30SLuigi Rizzo av++; 3483c99ee9e0SBrian Feldman break; 3484c99ee9e0SBrian Feldman 34859758b77fSLuigi Rizzo case TOK_TCPOPTS: 34869758b77fSLuigi Rizzo NEED1("missing argument for tcpoptions"); 34879758b77fSLuigi Rizzo fill_flags(cmd, O_TCPOPTS, f_tcpopts, *av); 3488cc4d3c30SLuigi Rizzo av++; 34899758b77fSLuigi Rizzo break; 34909758b77fSLuigi Rizzo 34919758b77fSLuigi Rizzo case TOK_TCPSEQ: 34929758b77fSLuigi Rizzo case TOK_TCPACK: 34939758b77fSLuigi Rizzo NEED1("tcpseq/tcpack requires argument"); 34949758b77fSLuigi Rizzo cmd->len = F_INSN_SIZE(ipfw_insn_u32); 34959758b77fSLuigi Rizzo cmd->opcode = (i == TOK_TCPSEQ) ? O_TCPSEQ : O_TCPACK; 34969758b77fSLuigi Rizzo cmd32->d[0] = htonl(strtoul(*av, NULL, 0)); 3497cc4d3c30SLuigi Rizzo av++; 34989758b77fSLuigi Rizzo break; 34999758b77fSLuigi Rizzo 35009758b77fSLuigi Rizzo case TOK_TCPWIN: 35019758b77fSLuigi Rizzo NEED1("tcpwin requires length"); 350223ccd3d9SGleb Smirnoff if (strpbrk(*av, "-,")) { 350323ccd3d9SGleb Smirnoff if (!add_ports(cmd, *av, 0, O_TCPWIN)) 350423ccd3d9SGleb Smirnoff errx(EX_DATAERR, "invalid tcpwin len %s", *av); 350523ccd3d9SGleb Smirnoff } else 35069758b77fSLuigi Rizzo fill_cmd(cmd, O_TCPWIN, 0, 350723ccd3d9SGleb Smirnoff strtoul(*av, NULL, 0)); 3508cc4d3c30SLuigi Rizzo av++; 35099758b77fSLuigi Rizzo break; 35109758b77fSLuigi Rizzo 35119758b77fSLuigi Rizzo case TOK_TCPFLAGS: 35129758b77fSLuigi Rizzo NEED1("missing argument for tcpflags"); 35139758b77fSLuigi Rizzo cmd->opcode = O_TCPFLAGS; 35149758b77fSLuigi Rizzo fill_flags(cmd, O_TCPFLAGS, f_tcpflags, *av); 3515cc4d3c30SLuigi Rizzo av++; 35169758b77fSLuigi Rizzo break; 35179758b77fSLuigi Rizzo 35189758b77fSLuigi Rizzo case TOK_KEEPSTATE: 35198ed2d749SLuigi Rizzo if (open_par) 35208ed2d749SLuigi Rizzo errx(EX_USAGE, "keep-state cannot be part " 35218ed2d749SLuigi Rizzo "of an or block"); 35220a7197a8SLuigi Rizzo if (have_state) 352352bc23abSLuigi Rizzo errx(EX_USAGE, "only one of keep-state " 35240a7197a8SLuigi Rizzo "and limit is allowed"); 352552bc23abSLuigi Rizzo have_state = cmd; 35269758b77fSLuigi Rizzo fill_cmd(cmd, O_KEEP_STATE, 0, 0); 35279758b77fSLuigi Rizzo break; 35289758b77fSLuigi Rizzo 3529254c4725SOleg Bulyzhin case TOK_LIMIT: { 35309758b77fSLuigi Rizzo ipfw_insn_limit *c = (ipfw_insn_limit *)cmd; 3531254c4725SOleg Bulyzhin int val; 3532254c4725SOleg Bulyzhin 3533254c4725SOleg Bulyzhin if (open_par) 3534254c4725SOleg Bulyzhin errx(EX_USAGE, 3535254c4725SOleg Bulyzhin "limit cannot be part of an or block"); 3536254c4725SOleg Bulyzhin if (have_state) 3537254c4725SOleg Bulyzhin errx(EX_USAGE, "only one of keep-state and " 3538254c4725SOleg Bulyzhin "limit is allowed"); 3539254c4725SOleg Bulyzhin have_state = cmd; 35409758b77fSLuigi Rizzo 35419758b77fSLuigi Rizzo cmd->len = F_INSN_SIZE(ipfw_insn_limit); 35429758b77fSLuigi Rizzo cmd->opcode = O_LIMIT; 3543254c4725SOleg Bulyzhin c->limit_mask = c->conn_limit = 0; 35449758b77fSLuigi Rizzo 3545cc4d3c30SLuigi Rizzo while ( av[0] != NULL ) { 3546254c4725SOleg Bulyzhin if ((val = match_token(limit_masks, *av)) <= 0) 35479758b77fSLuigi Rizzo break; 35489758b77fSLuigi Rizzo c->limit_mask |= val; 3549cc4d3c30SLuigi Rizzo av++; 35509758b77fSLuigi Rizzo } 3551254c4725SOleg Bulyzhin 35529758b77fSLuigi Rizzo if (c->limit_mask == 0) 3553254c4725SOleg Bulyzhin errx(EX_USAGE, "limit: missing limit mask"); 3554254c4725SOleg Bulyzhin 3555b87ce554SLuigi Rizzo GET_UINT_ARG(c->conn_limit, IPFW_ARG_MIN, IPFW_ARG_MAX, 3556759dd6f7SRoman Kurakin TOK_LIMIT, rule_options); 3557254c4725SOleg Bulyzhin 3558cc4d3c30SLuigi Rizzo av++; 35599758b77fSLuigi Rizzo break; 3560254c4725SOleg Bulyzhin } 35619758b77fSLuigi Rizzo 3562e706181bSLuigi Rizzo case TOK_PROTO: 3563e706181bSLuigi Rizzo NEED1("missing protocol"); 35648195404bSBrooks Davis if (add_proto(cmd, *av, &proto)) { 3565cc4d3c30SLuigi Rizzo av++; 35665a155b40SLuigi Rizzo } else 3567c82b8dceSMaxim Konovalov errx(EX_DATAERR, "invalid protocol ``%s''", 3568c82b8dceSMaxim Konovalov *av); 3569e706181bSLuigi Rizzo break; 3570e706181bSLuigi Rizzo 3571e706181bSLuigi Rizzo case TOK_SRCIP: 3572e706181bSLuigi Rizzo NEED1("missing source IP"); 3573e706181bSLuigi Rizzo if (add_srcip(cmd, *av)) { 3574cc4d3c30SLuigi Rizzo av++; 3575e706181bSLuigi Rizzo } 3576e706181bSLuigi Rizzo break; 3577e706181bSLuigi Rizzo 3578e706181bSLuigi Rizzo case TOK_DSTIP: 3579e706181bSLuigi Rizzo NEED1("missing destination IP"); 3580e706181bSLuigi Rizzo if (add_dstip(cmd, *av)) { 3581cc4d3c30SLuigi Rizzo av++; 3582e706181bSLuigi Rizzo } 3583e706181bSLuigi Rizzo break; 3584e706181bSLuigi Rizzo 35858195404bSBrooks Davis case TOK_SRCIP6: 35868195404bSBrooks Davis NEED1("missing source IP6"); 35878195404bSBrooks Davis if (add_srcip6(cmd, *av)) { 3588cc4d3c30SLuigi Rizzo av++; 35898195404bSBrooks Davis } 35908195404bSBrooks Davis break; 35918195404bSBrooks Davis 35928195404bSBrooks Davis case TOK_DSTIP6: 35938195404bSBrooks Davis NEED1("missing destination IP6"); 35948195404bSBrooks Davis if (add_dstip6(cmd, *av)) { 3595cc4d3c30SLuigi Rizzo av++; 35968195404bSBrooks Davis } 35978195404bSBrooks Davis break; 35988195404bSBrooks Davis 3599e706181bSLuigi Rizzo case TOK_SRCPORT: 3600e706181bSLuigi Rizzo NEED1("missing source port"); 360101750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 3602e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_SRCPORT)) { 3603cc4d3c30SLuigi Rizzo av++; 3604e706181bSLuigi Rizzo } else 3605e706181bSLuigi Rizzo errx(EX_DATAERR, "invalid source port %s", *av); 3606e706181bSLuigi Rizzo break; 3607e706181bSLuigi Rizzo 3608e706181bSLuigi Rizzo case TOK_DSTPORT: 3609e706181bSLuigi Rizzo NEED1("missing destination port"); 361001750186SBrooks Davis if (_substrcmp(*av, "any") == 0 || 3611e706181bSLuigi Rizzo add_ports(cmd, *av, proto, O_IP_DSTPORT)) { 3612cc4d3c30SLuigi Rizzo av++; 3613e706181bSLuigi Rizzo } else 3614e706181bSLuigi Rizzo errx(EX_DATAERR, "invalid destination port %s", 3615e706181bSLuigi Rizzo *av); 3616e706181bSLuigi Rizzo break; 3617e706181bSLuigi Rizzo 3618e706181bSLuigi Rizzo case TOK_MAC: 3619cc4d3c30SLuigi Rizzo if (add_mac(cmd, av)) 3620cc4d3c30SLuigi Rizzo av += 2; 3621e706181bSLuigi Rizzo break; 3622e706181bSLuigi Rizzo 3623e706181bSLuigi Rizzo case TOK_MACTYPE: 3624e706181bSLuigi Rizzo NEED1("missing mac type"); 3625cc4d3c30SLuigi Rizzo if (!add_mactype(cmd, *av)) 3626c82b8dceSMaxim Konovalov errx(EX_DATAERR, "invalid mac type %s", *av); 3627cc4d3c30SLuigi Rizzo av++; 3628e706181bSLuigi Rizzo break; 3629e706181bSLuigi Rizzo 3630010dabb0SCrist J. Clark case TOK_VERREVPATH: 3631010dabb0SCrist J. Clark fill_cmd(cmd, O_VERREVPATH, 0, 0); 3632010dabb0SCrist J. Clark break; 3633010dabb0SCrist J. Clark 363422b5770bSAndre Oppermann case TOK_VERSRCREACH: 363522b5770bSAndre Oppermann fill_cmd(cmd, O_VERSRCREACH, 0, 0); 363622b5770bSAndre Oppermann break; 363722b5770bSAndre Oppermann 36385f9541ecSAndre Oppermann case TOK_ANTISPOOF: 36395f9541ecSAndre Oppermann fill_cmd(cmd, O_ANTISPOOF, 0, 0); 36405f9541ecSAndre Oppermann break; 36415f9541ecSAndre Oppermann 3642c3e5b9f1SLuigi Rizzo case TOK_IPSEC: 3643c3e5b9f1SLuigi Rizzo fill_cmd(cmd, O_IPSEC, 0, 0); 3644c3e5b9f1SLuigi Rizzo break; 3645c3e5b9f1SLuigi Rizzo 36468195404bSBrooks Davis case TOK_IPV6: 36478195404bSBrooks Davis fill_cmd(cmd, O_IP6, 0, 0); 36488195404bSBrooks Davis break; 36498195404bSBrooks Davis 365057cd6d26SMax Laier case TOK_IPV4: 365157cd6d26SMax Laier fill_cmd(cmd, O_IP4, 0, 0); 365257cd6d26SMax Laier break; 365357cd6d26SMax Laier 36548195404bSBrooks Davis case TOK_EXT6HDR: 36558195404bSBrooks Davis fill_ext6hdr( cmd, *av ); 3656cc4d3c30SLuigi Rizzo av++; 36578195404bSBrooks Davis break; 36588195404bSBrooks Davis 36598195404bSBrooks Davis case TOK_FLOWID: 36608195404bSBrooks Davis if (proto != IPPROTO_IPV6 ) 36618195404bSBrooks Davis errx( EX_USAGE, "flow-id filter is active " 36628195404bSBrooks Davis "only for ipv6 protocol\n"); 36638195404bSBrooks Davis fill_flow6( (ipfw_insn_u32 *) cmd, *av ); 3664cc4d3c30SLuigi Rizzo av++; 36658195404bSBrooks Davis break; 36668195404bSBrooks Davis 366762ff38aeSLuigi Rizzo case TOK_COMMENT: 3668cc4d3c30SLuigi Rizzo fill_comment(cmd, av); 3669cc4d3c30SLuigi Rizzo av[0]=NULL; 367062ff38aeSLuigi Rizzo break; 367162ff38aeSLuigi Rizzo 36726a7d5cb6SOleg Bulyzhin case TOK_TAGGED: 3673cc4d3c30SLuigi Rizzo if (av[0] && strpbrk(*av, "-,")) { 36746a7d5cb6SOleg Bulyzhin if (!add_ports(cmd, *av, 0, O_TAGGED)) 3675254c4725SOleg Bulyzhin errx(EX_DATAERR, "tagged: invalid tag" 3676254c4725SOleg Bulyzhin " list: %s", *av); 3677254c4725SOleg Bulyzhin } 3678254c4725SOleg Bulyzhin else { 3679254c4725SOleg Bulyzhin uint16_t tag; 3680254c4725SOleg Bulyzhin 3681b87ce554SLuigi Rizzo GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, 3682759dd6f7SRoman Kurakin TOK_TAGGED, rule_options); 3683254c4725SOleg Bulyzhin fill_cmd(cmd, O_TAGGED, 0, tag); 36846a7d5cb6SOleg Bulyzhin } 3685cc4d3c30SLuigi Rizzo av++; 36866a7d5cb6SOleg Bulyzhin break; 36876a7d5cb6SOleg Bulyzhin 36888b07e49aSJulian Elischer case TOK_FIB: 36898b07e49aSJulian Elischer NEED1("fib requires fib number"); 36908b07e49aSJulian Elischer fill_cmd(cmd, O_FIB, 0, strtoul(*av, NULL, 0)); 3691cc4d3c30SLuigi Rizzo av++; 36928b07e49aSJulian Elischer break; 3693ae99fd0eSLuigi Rizzo case TOK_SOCKARG: 3694ae99fd0eSLuigi Rizzo fill_cmd(cmd, O_SOCKARG, 0, 0); 3695ae99fd0eSLuigi Rizzo break; 36968b07e49aSJulian Elischer 3697472099c4SLuigi Rizzo case TOK_LOOKUP: { 3698472099c4SLuigi Rizzo ipfw_insn_u32 *c = (ipfw_insn_u32 *)cmd; 3699472099c4SLuigi Rizzo char *p; 3700472099c4SLuigi Rizzo int j; 3701472099c4SLuigi Rizzo 370272662a75SLuigi Rizzo if (!av[0] || !av[1]) 3703472099c4SLuigi Rizzo errx(EX_USAGE, "format: lookup argument tablenum"); 3704472099c4SLuigi Rizzo cmd->opcode = O_IP_DST_LOOKUP; 3705472099c4SLuigi Rizzo cmd->len |= F_INSN_SIZE(ipfw_insn) + 2; 3706472099c4SLuigi Rizzo i = match_token(rule_options, *av); 3707472099c4SLuigi Rizzo for (j = 0; lookup_key[j] >= 0 ; j++) { 3708472099c4SLuigi Rizzo if (i == lookup_key[j]) 3709472099c4SLuigi Rizzo break; 3710472099c4SLuigi Rizzo } 3711472099c4SLuigi Rizzo if (lookup_key[j] <= 0) 3712472099c4SLuigi Rizzo errx(EX_USAGE, "format: cannot lookup on %s", *av); 37135f301949SBen Laurie __PAST_END(c->d, 1) = j; // i converted to option 3714cc4d3c30SLuigi Rizzo av++; 3715472099c4SLuigi Rizzo cmd->arg1 = strtoul(*av, &p, 0); 3716472099c4SLuigi Rizzo if (p && *p) 3717472099c4SLuigi Rizzo errx(EX_USAGE, "format: lookup argument tablenum"); 3718cc4d3c30SLuigi Rizzo av++; 3719472099c4SLuigi Rizzo } 3720472099c4SLuigi Rizzo break; 3721472099c4SLuigi Rizzo 37229758b77fSLuigi Rizzo default: 37239758b77fSLuigi Rizzo errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s); 37249758b77fSLuigi Rizzo } 37259758b77fSLuigi Rizzo if (F_LEN(cmd) > 0) { /* prepare to advance */ 37269758b77fSLuigi Rizzo prev = cmd; 37279758b77fSLuigi Rizzo cmd = next_cmd(cmd); 37289758b77fSLuigi Rizzo } 37299758b77fSLuigi Rizzo } 37309758b77fSLuigi Rizzo 37319758b77fSLuigi Rizzo done: 37329758b77fSLuigi Rizzo /* 37339758b77fSLuigi Rizzo * Now copy stuff into the rule. 37349758b77fSLuigi Rizzo * If we have a keep-state option, the first instruction 37359758b77fSLuigi Rizzo * must be a PROBE_STATE (which is generated here). 37369758b77fSLuigi Rizzo * If we have a LOG option, it was stored as the first command, 37379758b77fSLuigi Rizzo * and now must be moved to the top of the action part. 37389758b77fSLuigi Rizzo */ 37399758b77fSLuigi Rizzo dst = (ipfw_insn *)rule->cmd; 37409758b77fSLuigi Rizzo 37419758b77fSLuigi Rizzo /* 374212b5dc6aSLuigi Rizzo * First thing to write into the command stream is the match probability. 374312b5dc6aSLuigi Rizzo */ 374412b5dc6aSLuigi Rizzo if (match_prob != 1) { /* 1 means always match */ 374512b5dc6aSLuigi Rizzo dst->opcode = O_PROB; 374612b5dc6aSLuigi Rizzo dst->len = 2; 374712b5dc6aSLuigi Rizzo *((int32_t *)(dst+1)) = (int32_t)(match_prob * 0x7fffffff); 374812b5dc6aSLuigi Rizzo dst += dst->len; 374912b5dc6aSLuigi Rizzo } 375012b5dc6aSLuigi Rizzo 375112b5dc6aSLuigi Rizzo /* 37529758b77fSLuigi Rizzo * generate O_PROBE_STATE if necessary 37539758b77fSLuigi Rizzo */ 375452bc23abSLuigi Rizzo if (have_state && have_state->opcode != O_CHECK_STATE) { 37559758b77fSLuigi Rizzo fill_cmd(dst, O_PROBE_STATE, 0, 0); 37569758b77fSLuigi Rizzo dst = next_cmd(dst); 37579758b77fSLuigi Rizzo } 37586a7d5cb6SOleg Bulyzhin 37596a7d5cb6SOleg Bulyzhin /* copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT, O_ALTQ, O_TAG */ 37609758b77fSLuigi Rizzo for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) { 37619758b77fSLuigi Rizzo i = F_LEN(src); 37629758b77fSLuigi Rizzo 376352bc23abSLuigi Rizzo switch (src->opcode) { 376452bc23abSLuigi Rizzo case O_LOG: 376552bc23abSLuigi Rizzo case O_KEEP_STATE: 376652bc23abSLuigi Rizzo case O_LIMIT: 3767974dfe30SBrian Feldman case O_ALTQ: 37686a7d5cb6SOleg Bulyzhin case O_TAG: 376952bc23abSLuigi Rizzo break; 377052bc23abSLuigi Rizzo default: 3771571f8c1bSLuigi Rizzo bcopy(src, dst, i * sizeof(uint32_t)); 37729758b77fSLuigi Rizzo dst += i; 37739758b77fSLuigi Rizzo } 37749758b77fSLuigi Rizzo } 37759758b77fSLuigi Rizzo 37769758b77fSLuigi Rizzo /* 377752bc23abSLuigi Rizzo * put back the have_state command as last opcode 377852bc23abSLuigi Rizzo */ 3779b985a624SLuigi Rizzo if (have_state && have_state->opcode != O_CHECK_STATE) { 378052bc23abSLuigi Rizzo i = F_LEN(have_state); 3781571f8c1bSLuigi Rizzo bcopy(have_state, dst, i * sizeof(uint32_t)); 378252bc23abSLuigi Rizzo dst += i; 378352bc23abSLuigi Rizzo } 378452bc23abSLuigi Rizzo /* 37859758b77fSLuigi Rizzo * start action section 37869758b77fSLuigi Rizzo */ 37879758b77fSLuigi Rizzo rule->act_ofs = dst - rule->cmd; 37889758b77fSLuigi Rizzo 37896a7d5cb6SOleg Bulyzhin /* put back O_LOG, O_ALTQ, O_TAG if necessary */ 3790974dfe30SBrian Feldman if (have_log) { 3791974dfe30SBrian Feldman i = F_LEN(have_log); 3792974dfe30SBrian Feldman bcopy(have_log, dst, i * sizeof(uint32_t)); 3793974dfe30SBrian Feldman dst += i; 3794974dfe30SBrian Feldman } 3795974dfe30SBrian Feldman if (have_altq) { 3796974dfe30SBrian Feldman i = F_LEN(have_altq); 3797974dfe30SBrian Feldman bcopy(have_altq, dst, i * sizeof(uint32_t)); 37989758b77fSLuigi Rizzo dst += i; 37999758b77fSLuigi Rizzo } 38006a7d5cb6SOleg Bulyzhin if (have_tag) { 38016a7d5cb6SOleg Bulyzhin i = F_LEN(have_tag); 38026a7d5cb6SOleg Bulyzhin bcopy(have_tag, dst, i * sizeof(uint32_t)); 38036a7d5cb6SOleg Bulyzhin dst += i; 38046a7d5cb6SOleg Bulyzhin } 38059758b77fSLuigi Rizzo /* 38069758b77fSLuigi Rizzo * copy all other actions 38079758b77fSLuigi Rizzo */ 38089758b77fSLuigi Rizzo for (src = (ipfw_insn *)actbuf; src != action; src += i) { 38099758b77fSLuigi Rizzo i = F_LEN(src); 3810571f8c1bSLuigi Rizzo bcopy(src, dst, i * sizeof(uint32_t)); 38119758b77fSLuigi Rizzo dst += i; 38129758b77fSLuigi Rizzo } 38139758b77fSLuigi Rizzo 3814571f8c1bSLuigi Rizzo rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd); 381562ff38aeSLuigi Rizzo i = (char *)dst - (char *)rule; 3816884be75cSThomas Moestl if (do_cmd(IP_FW_ADD, rule, (uintptr_t)&i) == -1) 38179758b77fSLuigi Rizzo err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD"); 3818db7c5224SLuigi Rizzo if (!co.do_quiet) 381962ff38aeSLuigi Rizzo show_ipfw(rule, 0, 0); 38209758b77fSLuigi Rizzo } 38219758b77fSLuigi Rizzo 38223c0c8717SLuigi Rizzo /* 38233c0c8717SLuigi Rizzo * clear the counters or the log counters. 38243c0c8717SLuigi Rizzo */ 38253c0c8717SLuigi Rizzo void 38263c0c8717SLuigi Rizzo ipfw_zero(int ac, char *av[], int optname /* 0 = IP_FW_ZERO, 1 = IP_FW_RESETLOG */) 38279758b77fSLuigi Rizzo { 3828d069a5d4SMaxim Konovalov uint32_t arg, saved_arg; 38299758b77fSLuigi Rizzo int failed = EX_OK; 3830d069a5d4SMaxim Konovalov char const *errstr; 38313c0c8717SLuigi Rizzo char const *name = optname ? "RESETLOG" : "ZERO"; 38323c0c8717SLuigi Rizzo 38333c0c8717SLuigi Rizzo optname = optname ? IP_FW_RESETLOG : IP_FW_ZERO; 38349758b77fSLuigi Rizzo 38359758b77fSLuigi Rizzo av++; ac--; 38369758b77fSLuigi Rizzo 38379758b77fSLuigi Rizzo if (!ac) { 38389758b77fSLuigi Rizzo /* clear all entries */ 3839571f8c1bSLuigi Rizzo if (do_cmd(optname, NULL, 0) < 0) 3840571f8c1bSLuigi Rizzo err(EX_UNAVAILABLE, "setsockopt(IP_FW_%s)", name); 3841db7c5224SLuigi Rizzo if (!co.do_quiet) 3842571f8c1bSLuigi Rizzo printf("%s.\n", optname == IP_FW_ZERO ? 3843571f8c1bSLuigi Rizzo "Accounting cleared":"Logging counts reset"); 38449758b77fSLuigi Rizzo 38459758b77fSLuigi Rizzo return; 38469758b77fSLuigi Rizzo } 38479758b77fSLuigi Rizzo 38489758b77fSLuigi Rizzo while (ac) { 38499758b77fSLuigi Rizzo /* Rule number */ 38509758b77fSLuigi Rizzo if (isdigit(**av)) { 3851d069a5d4SMaxim Konovalov arg = strtonum(*av, 0, 0xffff, &errstr); 3852d069a5d4SMaxim Konovalov if (errstr) 3853d069a5d4SMaxim Konovalov errx(EX_DATAERR, 3854d069a5d4SMaxim Konovalov "invalid rule number %s\n", *av); 3855d069a5d4SMaxim Konovalov saved_arg = arg; 3856db7c5224SLuigi Rizzo if (co.use_set) 3857db7c5224SLuigi Rizzo arg |= (1 << 24) | ((co.use_set - 1) << 16); 38589758b77fSLuigi Rizzo av++; 38599758b77fSLuigi Rizzo ac--; 3860d069a5d4SMaxim Konovalov if (do_cmd(optname, &arg, sizeof(arg))) { 3861571f8c1bSLuigi Rizzo warn("rule %u: setsockopt(IP_FW_%s)", 3862d069a5d4SMaxim Konovalov saved_arg, name); 38639758b77fSLuigi Rizzo failed = EX_UNAVAILABLE; 3864db7c5224SLuigi Rizzo } else if (!co.do_quiet) 3865d069a5d4SMaxim Konovalov printf("Entry %d %s.\n", saved_arg, 3866571f8c1bSLuigi Rizzo optname == IP_FW_ZERO ? 3867571f8c1bSLuigi Rizzo "cleared" : "logging count reset"); 38689758b77fSLuigi Rizzo } else { 38699758b77fSLuigi Rizzo errx(EX_USAGE, "invalid rule number ``%s''", *av); 38709758b77fSLuigi Rizzo } 38719758b77fSLuigi Rizzo } 38729758b77fSLuigi Rizzo if (failed != EX_OK) 38739758b77fSLuigi Rizzo exit(failed); 38749758b77fSLuigi Rizzo } 38759758b77fSLuigi Rizzo 38763c0c8717SLuigi Rizzo void 38773c0c8717SLuigi Rizzo ipfw_flush(int force) 38789758b77fSLuigi Rizzo { 3879db7c5224SLuigi Rizzo int cmd = co.do_pipe ? IP_DUMMYNET_FLUSH : IP_FW_FLUSH; 38809758b77fSLuigi Rizzo 3881db7c5224SLuigi Rizzo if (!force && !co.do_quiet) { /* need to ask user */ 38829758b77fSLuigi Rizzo int c; 38839758b77fSLuigi Rizzo 38849758b77fSLuigi Rizzo printf("Are you sure? [yn] "); 38859758b77fSLuigi Rizzo fflush(stdout); 38869758b77fSLuigi Rizzo do { 38879758b77fSLuigi Rizzo c = toupper(getc(stdin)); 38889758b77fSLuigi Rizzo while (c != '\n' && getc(stdin) != '\n') 38899758b77fSLuigi Rizzo if (feof(stdin)) 38909758b77fSLuigi Rizzo return; /* and do not flush */ 38919758b77fSLuigi Rizzo } while (c != 'Y' && c != 'N'); 38929758b77fSLuigi Rizzo printf("\n"); 38939758b77fSLuigi Rizzo if (c == 'N') /* user said no */ 38949758b77fSLuigi Rizzo return; 38959758b77fSLuigi Rizzo } 3896cc4d3c30SLuigi Rizzo if (co.do_pipe) { 3897cc4d3c30SLuigi Rizzo dummynet_flush(); 3898cc4d3c30SLuigi Rizzo return; 3899cc4d3c30SLuigi Rizzo } 3900d069a5d4SMaxim Konovalov /* `ipfw set N flush` - is the same that `ipfw delete set N` */ 3901db7c5224SLuigi Rizzo if (co.use_set) { 3902db7c5224SLuigi Rizzo uint32_t arg = ((co.use_set - 1) & 0xffff) | (1 << 24); 3903d069a5d4SMaxim Konovalov if (do_cmd(IP_FW_DEL, &arg, sizeof(arg)) < 0) 3904d069a5d4SMaxim Konovalov err(EX_UNAVAILABLE, "setsockopt(IP_FW_DEL)"); 3905d069a5d4SMaxim Konovalov } else if (do_cmd(cmd, NULL, 0) < 0) 39069758b77fSLuigi Rizzo err(EX_UNAVAILABLE, "setsockopt(IP_%s_FLUSH)", 3907db7c5224SLuigi Rizzo co.do_pipe ? "DUMMYNET" : "FW"); 3908db7c5224SLuigi Rizzo if (!co.do_quiet) 3909db7c5224SLuigi Rizzo printf("Flushed all %s.\n", co.do_pipe ? "pipes" : "rules"); 39109758b77fSLuigi Rizzo } 39119758b77fSLuigi Rizzo 391226bf4d78SLuigi Rizzo 3913*f8bee51aSAlexander V. Chernikov static void table_list(uint16_t num, int need_header); 39145ec36cd6SRoman Kurakin 391526bf4d78SLuigi Rizzo /* 3916cd8b5ae0SRuslan Ermilov * This one handles all table-related commands 3917cd8b5ae0SRuslan Ermilov * ipfw table N add addr[/masklen] [value] 3918cd8b5ae0SRuslan Ermilov * ipfw table N delete addr[/masklen] 3919c15c2490SRoman Kurakin * ipfw table {N | all} flush 3920c15c2490SRoman Kurakin * ipfw table {N | all} list 3921cd8b5ae0SRuslan Ermilov */ 39223c0c8717SLuigi Rizzo void 39233c0c8717SLuigi Rizzo ipfw_table_handler(int ac, char *av[]) 3924cd8b5ae0SRuslan Ermilov { 3925*f8bee51aSAlexander V. Chernikov ipfw_table_xentry xent; 3926cd8b5ae0SRuslan Ermilov int do_add; 3927c15c2490SRoman Kurakin int is_all; 3928eba1dd21SRoman Kurakin size_t len; 3929cd8b5ae0SRuslan Ermilov char *p; 3930*f8bee51aSAlexander V. Chernikov uint32_t a, type, mask, addrlen; 3931eba1dd21SRoman Kurakin uint32_t tables_max; 3932eba1dd21SRoman Kurakin 39337bf717b7SGiorgos Keramidas len = sizeof(tables_max); 3934eba1dd21SRoman Kurakin if (sysctlbyname("net.inet.ip.fw.tables_max", &tables_max, &len, 3935eba1dd21SRoman Kurakin NULL, 0) == -1) { 3936eba1dd21SRoman Kurakin #ifdef IPFW_TABLES_MAX 3937eba1dd21SRoman Kurakin warn("Warn: Failed to get the max tables number via sysctl. " 3938eba1dd21SRoman Kurakin "Using the compiled in defaults. \nThe reason was"); 3939eba1dd21SRoman Kurakin tables_max = IPFW_TABLES_MAX; 3940eba1dd21SRoman Kurakin #else 3941eba1dd21SRoman Kurakin errx(1, "Failed sysctlbyname(\"net.inet.ip.fw.tables_max\")"); 3942eba1dd21SRoman Kurakin #endif 3943eba1dd21SRoman Kurakin } 3944cd8b5ae0SRuslan Ermilov 3945*f8bee51aSAlexander V. Chernikov memset(&xent, 0, sizeof(xent)); 3946*f8bee51aSAlexander V. Chernikov 3947cd8b5ae0SRuslan Ermilov ac--; av++; 3948cd8b5ae0SRuslan Ermilov if (ac && isdigit(**av)) { 3949*f8bee51aSAlexander V. Chernikov xent.tbl = atoi(*av); 3950c15c2490SRoman Kurakin is_all = 0; 3951c15c2490SRoman Kurakin ac--; av++; 3952c15c2490SRoman Kurakin } else if (ac && _substrcmp(*av, "all") == 0) { 3953*f8bee51aSAlexander V. Chernikov xent.tbl = 0; 3954c15c2490SRoman Kurakin is_all = 1; 3955cd8b5ae0SRuslan Ermilov ac--; av++; 3956cd8b5ae0SRuslan Ermilov } else 3957c15c2490SRoman Kurakin errx(EX_USAGE, "table number or 'all' keyword required"); 3958*f8bee51aSAlexander V. Chernikov if (xent.tbl >= tables_max) 3959eba1dd21SRoman Kurakin errx(EX_USAGE, "The table number exceeds the maximum allowed " 3960eba1dd21SRoman Kurakin "value (%d)", tables_max - 1); 3961cd8b5ae0SRuslan Ermilov NEED1("table needs command"); 3962c15c2490SRoman Kurakin if (is_all && _substrcmp(*av, "list") != 0 3963c15c2490SRoman Kurakin && _substrcmp(*av, "flush") != 0) 3964c15c2490SRoman Kurakin errx(EX_USAGE, "table number required"); 3965c15c2490SRoman Kurakin 396601750186SBrooks Davis if (_substrcmp(*av, "add") == 0 || 396701750186SBrooks Davis _substrcmp(*av, "delete") == 0) { 3968cd8b5ae0SRuslan Ermilov do_add = **av == 'a'; 3969cd8b5ae0SRuslan Ermilov ac--; av++; 3970cd8b5ae0SRuslan Ermilov if (!ac) 3971*f8bee51aSAlexander V. Chernikov errx(EX_USAGE, "address required"); 3972*f8bee51aSAlexander V. Chernikov /* 3973*f8bee51aSAlexander V. Chernikov * Let's try to guess type by agrument. 3974*f8bee51aSAlexander V. Chernikov * Possible types: 3975*f8bee51aSAlexander V. Chernikov * 1) IPv4[/mask] 3976*f8bee51aSAlexander V. Chernikov * 2) IPv6[/mask] 3977*f8bee51aSAlexander V. Chernikov * 3) interface name 3978*f8bee51aSAlexander V. Chernikov * 4) port ? 3979*f8bee51aSAlexander V. Chernikov */ 3980*f8bee51aSAlexander V. Chernikov type = 0; 3981*f8bee51aSAlexander V. Chernikov if (ishexnumber(*av[0])) { 3982*f8bee51aSAlexander V. Chernikov /* Remove / if exists */ 3983*f8bee51aSAlexander V. Chernikov if ((p = strchr(*av, '/')) != NULL) { 3984*f8bee51aSAlexander V. Chernikov *p = '\0'; 3985*f8bee51aSAlexander V. Chernikov mask = atoi(p + 1); 3986*f8bee51aSAlexander V. Chernikov } 3987*f8bee51aSAlexander V. Chernikov 3988*f8bee51aSAlexander V. Chernikov if (inet_pton(AF_INET, *av, &xent.k.addr6) == 1) { 3989*f8bee51aSAlexander V. Chernikov type = IPFW_TABLE_CIDR; 3990*f8bee51aSAlexander V. Chernikov if ((p != NULL) && (mask > 32)) 3991*f8bee51aSAlexander V. Chernikov errx(EX_DATAERR, "bad IPv4 mask width: %s", p + 1); 3992*f8bee51aSAlexander V. Chernikov xent.masklen = p ? mask : 32; 3993*f8bee51aSAlexander V. Chernikov addrlen = sizeof(struct in_addr); 3994*f8bee51aSAlexander V. Chernikov } else if (inet_pton(AF_INET6, *av, &xent.k.addr6) == 1) { 3995*f8bee51aSAlexander V. Chernikov type = IPFW_TABLE_CIDR; 3996*f8bee51aSAlexander V. Chernikov if ((p != NULL) && (mask > 128)) 3997*f8bee51aSAlexander V. Chernikov errx(EX_DATAERR, "bad IPv6 mask width: %s", p + 1); 3998*f8bee51aSAlexander V. Chernikov xent.masklen = p ? mask : 128; 3999*f8bee51aSAlexander V. Chernikov addrlen = sizeof(struct in6_addr); 4000*f8bee51aSAlexander V. Chernikov } 4001*f8bee51aSAlexander V. Chernikov } 4002*f8bee51aSAlexander V. Chernikov 4003*f8bee51aSAlexander V. Chernikov if ((type == 0) && (strchr(*av, '.') == NULL)) { 4004*f8bee51aSAlexander V. Chernikov /* Assume interface name. Copy significant data only */ 4005*f8bee51aSAlexander V. Chernikov mask = MIN(strlen(*av), IF_NAMESIZE - 1); 4006*f8bee51aSAlexander V. Chernikov memcpy(xent.k.iface, *av, mask); 4007*f8bee51aSAlexander V. Chernikov /* Set mask to exact match */ 4008*f8bee51aSAlexander V. Chernikov xent.masklen = 8 * IF_NAMESIZE; 4009*f8bee51aSAlexander V. Chernikov type = IPFW_TABLE_INTERFACE; 4010*f8bee51aSAlexander V. Chernikov addrlen = IF_NAMESIZE; 4011*f8bee51aSAlexander V. Chernikov } 4012*f8bee51aSAlexander V. Chernikov 4013*f8bee51aSAlexander V. Chernikov if (type == 0) { 4014*f8bee51aSAlexander V. Chernikov if (lookup_host(*av, (struct in_addr *)&xent.k.addr6) != 0) 40151a41a8e4SRuslan Ermilov errx(EX_NOHOST, "hostname ``%s'' unknown", *av); 4016*f8bee51aSAlexander V. Chernikov xent.masklen = 32; 4017*f8bee51aSAlexander V. Chernikov type = IPFW_TABLE_CIDR; 4018*f8bee51aSAlexander V. Chernikov addrlen = sizeof(struct in_addr); 4019*f8bee51aSAlexander V. Chernikov } 4020*f8bee51aSAlexander V. Chernikov 4021*f8bee51aSAlexander V. Chernikov xent.type = type; 4022*f8bee51aSAlexander V. Chernikov xent.len = offsetof(ipfw_table_xentry, k) + addrlen; 4023*f8bee51aSAlexander V. Chernikov 4024cd8b5ae0SRuslan Ermilov ac--; av++; 4025c487be96SJulian Elischer if (do_add && ac) { 4026c487be96SJulian Elischer unsigned int tval; 4027c487be96SJulian Elischer /* isdigit is a bit of a hack here.. */ 4028c487be96SJulian Elischer if (strchr(*av, (int)'.') == NULL && isdigit(**av)) { 4029*f8bee51aSAlexander V. Chernikov xent.value = strtoul(*av, NULL, 0); 4030c487be96SJulian Elischer } else { 4031c487be96SJulian Elischer if (lookup_host(*av, (struct in_addr *)&tval) == 0) { 4032c487be96SJulian Elischer /* The value must be stored in host order * 4033c487be96SJulian Elischer * so that the values < 65k can be distinguished */ 4034*f8bee51aSAlexander V. Chernikov xent.value = ntohl(tval); 4035c487be96SJulian Elischer } else { 4036c487be96SJulian Elischer errx(EX_NOHOST, "hostname ``%s'' unknown", *av); 4037c487be96SJulian Elischer } 4038c487be96SJulian Elischer } 4039c487be96SJulian Elischer } else 4040*f8bee51aSAlexander V. Chernikov xent.value = 0; 4041*f8bee51aSAlexander V. Chernikov if (do_setcmd3(do_add ? IP_FW_TABLE_XADD : IP_FW_TABLE_XDEL, 4042*f8bee51aSAlexander V. Chernikov &xent, xent.len) < 0) { 404321899082SJulian Elischer /* If running silent, don't bomb out on these errors. */ 4044db7c5224SLuigi Rizzo if (!(co.do_quiet && (errno == (do_add ? EEXIST : ESRCH)))) 404521899082SJulian Elischer err(EX_OSERR, "setsockopt(IP_FW_TABLE_%s)", 4046*f8bee51aSAlexander V. Chernikov do_add ? "XADD" : "XDEL"); 404721899082SJulian Elischer /* In silent mode, react to a failed add by deleting */ 4048dbadd6b0SJulian Elischer if (do_add) { 4049*f8bee51aSAlexander V. Chernikov do_setcmd3(IP_FW_TABLE_XDEL, &xent, xent.len); 4050*f8bee51aSAlexander V. Chernikov if (do_setcmd3(IP_FW_TABLE_XADD, &xent, xent.len) < 0) 405121899082SJulian Elischer err(EX_OSERR, 4052*f8bee51aSAlexander V. Chernikov "setsockopt(IP_FW_TABLE_XADD)"); 4053dbadd6b0SJulian Elischer } 4054905c41b5SJulian Elischer } 405501750186SBrooks Davis } else if (_substrcmp(*av, "flush") == 0) { 4056*f8bee51aSAlexander V. Chernikov a = is_all ? tables_max : (uint32_t)(xent.tbl + 1); 4057c15c2490SRoman Kurakin do { 4058*f8bee51aSAlexander V. Chernikov if (do_cmd(IP_FW_TABLE_FLUSH, &xent.tbl, 4059*f8bee51aSAlexander V. Chernikov sizeof(xent.tbl)) < 0) 4060cd8b5ae0SRuslan Ermilov err(EX_OSERR, "setsockopt(IP_FW_TABLE_FLUSH)"); 4061*f8bee51aSAlexander V. Chernikov } while (++xent.tbl < a); 406201750186SBrooks Davis } else if (_substrcmp(*av, "list") == 0) { 4063*f8bee51aSAlexander V. Chernikov a = is_all ? tables_max : (uint32_t)(xent.tbl + 1); 4064c15c2490SRoman Kurakin do { 4065*f8bee51aSAlexander V. Chernikov table_list(xent.tbl, is_all); 4066*f8bee51aSAlexander V. Chernikov } while (++xent.tbl < a); 40675ec36cd6SRoman Kurakin } else 40685ec36cd6SRoman Kurakin errx(EX_USAGE, "invalid table command %s", *av); 40695ec36cd6SRoman Kurakin } 40705ec36cd6SRoman Kurakin 40715ec36cd6SRoman Kurakin static void 4072*f8bee51aSAlexander V. Chernikov table_list(uint16_t num, int need_header) 40735ec36cd6SRoman Kurakin { 4074*f8bee51aSAlexander V. Chernikov ipfw_xtable *tbl; 4075*f8bee51aSAlexander V. Chernikov ipfw_table_xentry *xent; 40765ec36cd6SRoman Kurakin socklen_t l; 4077*f8bee51aSAlexander V. Chernikov uint32_t *a, sz, tval; 4078*f8bee51aSAlexander V. Chernikov char tbuf[128]; 4079*f8bee51aSAlexander V. Chernikov struct in6_addr *addr6; 4080*f8bee51aSAlexander V. Chernikov ip_fw3_opheader *op3; 40815ec36cd6SRoman Kurakin 4082*f8bee51aSAlexander V. Chernikov /* Prepend value with IP_FW3 header */ 4083*f8bee51aSAlexander V. Chernikov l = sizeof(ip_fw3_opheader) + sizeof(uint32_t); 4084*f8bee51aSAlexander V. Chernikov op3 = alloca(l); 4085*f8bee51aSAlexander V. Chernikov /* Zero reserved fields */ 4086*f8bee51aSAlexander V. Chernikov memset(op3, 0, sizeof(ip_fw3_opheader)); 4087*f8bee51aSAlexander V. Chernikov a = (uint32_t *)(op3 + 1); 4088*f8bee51aSAlexander V. Chernikov *a = num; 4089*f8bee51aSAlexander V. Chernikov op3->opcode = IP_FW_TABLE_XGETSIZE; 4090*f8bee51aSAlexander V. Chernikov if (do_cmd(IP_FW3, op3, (uintptr_t)&l) < 0) 4091*f8bee51aSAlexander V. Chernikov err(EX_OSERR, "getsockopt(IP_FW_TABLE_XGETSIZE)"); 409203d4b38dSRoman Kurakin 409303d4b38dSRoman Kurakin /* If a is zero we have nothing to do, the table is empty. */ 4094*f8bee51aSAlexander V. Chernikov if (*a == 0) 409503d4b38dSRoman Kurakin return; 409603d4b38dSRoman Kurakin 4097*f8bee51aSAlexander V. Chernikov l = *a; 40985f356082SLuigi Rizzo tbl = safe_calloc(1, l); 4099*f8bee51aSAlexander V. Chernikov tbl->opheader.opcode = IP_FW_TABLE_XLIST; 4100*f8bee51aSAlexander V. Chernikov tbl->tbl = num; 4101*f8bee51aSAlexander V. Chernikov if (do_cmd(IP_FW3, tbl, (uintptr_t)&l) < 0) 4102*f8bee51aSAlexander V. Chernikov err(EX_OSERR, "getsockopt(IP_FW_TABLE_XLIST)"); 4103c15c2490SRoman Kurakin if (tbl->cnt && need_header) 4104c15c2490SRoman Kurakin printf("---table(%d)---\n", tbl->tbl); 4105*f8bee51aSAlexander V. Chernikov sz = tbl->size - sizeof(ipfw_xtable); 4106*f8bee51aSAlexander V. Chernikov xent = &tbl->xent[0]; 4107*f8bee51aSAlexander V. Chernikov while (sz > 0) { 4108*f8bee51aSAlexander V. Chernikov switch (tbl->type) { 4109*f8bee51aSAlexander V. Chernikov case IPFW_TABLE_CIDR: 4110*f8bee51aSAlexander V. Chernikov /* IPv4 or IPv6 prefixes */ 4111*f8bee51aSAlexander V. Chernikov tval = xent->value; 4112*f8bee51aSAlexander V. Chernikov addr6 = &xent->k.addr6; 4113*f8bee51aSAlexander V. Chernikov 4114*f8bee51aSAlexander V. Chernikov if ((addr6->s6_addr32[0] == 0) && (addr6->s6_addr32[1] == 0) && 4115*f8bee51aSAlexander V. Chernikov (addr6->s6_addr32[2] == 0)) { 4116*f8bee51aSAlexander V. Chernikov /* IPv4 address */ 4117*f8bee51aSAlexander V. Chernikov inet_ntop(AF_INET, &addr6->s6_addr32[3], tbuf, sizeof(tbuf)); 4118c487be96SJulian Elischer } else { 4119*f8bee51aSAlexander V. Chernikov /* IPv6 address */ 4120*f8bee51aSAlexander V. Chernikov inet_ntop(AF_INET6, addr6, tbuf, sizeof(tbuf)); 4121cd8b5ae0SRuslan Ermilov } 4122*f8bee51aSAlexander V. Chernikov 4123*f8bee51aSAlexander V. Chernikov if (co.do_value_as_ip) { 4124*f8bee51aSAlexander V. Chernikov tval = htonl(tval); 4125*f8bee51aSAlexander V. Chernikov printf("%s/%u %s\n", tbuf, xent->masklen, 4126*f8bee51aSAlexander V. Chernikov inet_ntoa(*(struct in_addr *)&tval)); 4127*f8bee51aSAlexander V. Chernikov } else 4128*f8bee51aSAlexander V. Chernikov printf("%s/%u %u\n", tbuf, xent->masklen, tval); 4129*f8bee51aSAlexander V. Chernikov break; 4130*f8bee51aSAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 4131*f8bee51aSAlexander V. Chernikov /* Interface names */ 4132*f8bee51aSAlexander V. Chernikov tval = xent->value; 4133*f8bee51aSAlexander V. Chernikov if (co.do_value_as_ip) { 4134*f8bee51aSAlexander V. Chernikov tval = htonl(tval); 4135*f8bee51aSAlexander V. Chernikov printf("%s %s\n", xent->k.iface, 4136*f8bee51aSAlexander V. Chernikov inet_ntoa(*(struct in_addr *)&tval)); 4137*f8bee51aSAlexander V. Chernikov } else 4138*f8bee51aSAlexander V. Chernikov printf("%s %u\n", xent->k.iface, tval); 4139c487be96SJulian Elischer } 4140*f8bee51aSAlexander V. Chernikov 4141*f8bee51aSAlexander V. Chernikov if (sz < xent->len) 4142*f8bee51aSAlexander V. Chernikov break; 4143*f8bee51aSAlexander V. Chernikov sz -= xent->len; 4144*f8bee51aSAlexander V. Chernikov xent = (void *)xent + xent->len; 4145*f8bee51aSAlexander V. Chernikov } 4146*f8bee51aSAlexander V. Chernikov 4147b0000a98SRoman Kurakin free(tbl); 4148cd8b5ae0SRuslan Ermilov } 4149