xref: /freebsd/sbin/ipfw/ipfw2.c (revision 262e143bd46171a6415a5b28af260a5efa2a3db8)
1 /*
2  * Copyright (c) 2002-2003 Luigi Rizzo
3  * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
4  * Copyright (c) 1994 Ugen J.S.Antsilevich
5  *
6  * Idea and grammar partially left from:
7  * Copyright (c) 1993 Daniel Boulet
8  *
9  * Redistribution and use in source forms, with and without modification,
10  * are permitted provided that this entire comment appears intact.
11  *
12  * Redistribution in binary form may occur without any restrictions.
13  * Obviously, it would be nice if you gave credit where credit is due
14  * but requiring it would be too onerous.
15  *
16  * This software is provided ``AS IS'' without any warranties of any kind.
17  *
18  * NEW command line interface for IP firewall facility
19  *
20  * $FreeBSD$
21  */
22 
23 #include <sys/param.h>
24 #include <sys/mbuf.h>
25 #include <sys/socket.h>
26 #include <sys/sockio.h>
27 #include <sys/sysctl.h>
28 #include <sys/time.h>
29 #include <sys/wait.h>
30 #include <sys/queue.h>
31 
32 #include <ctype.h>
33 #include <err.h>
34 #include <errno.h>
35 #include <grp.h>
36 #include <limits.h>
37 #include <netdb.h>
38 #include <pwd.h>
39 #include <signal.h>
40 #include <stdio.h>
41 #include <stdlib.h>
42 #include <stdarg.h>
43 #include <string.h>
44 #include <timeconv.h>	/* XXX do we need this ? */
45 #include <unistd.h>
46 #include <sysexits.h>
47 #include <unistd.h>
48 #include <fcntl.h>
49 
50 #include <net/if.h>
51 #include <net/pfvar.h>
52 #include <net/route.h> /* def. of struct route */
53 #include <netinet/in.h>
54 #include <netinet/in_systm.h>
55 #include <netinet/ip.h>
56 #include <netinet/ip_icmp.h>
57 #include <netinet/icmp6.h>
58 #include <netinet/ip_fw.h>
59 #include <netinet/ip_dummynet.h>
60 #include <netinet/tcp.h>
61 #include <arpa/inet.h>
62 
63 int
64 		do_resolv,		/* Would try to resolve all */
65 		do_time,		/* Show time stamps */
66 		do_quiet,		/* Be quiet in add and flush */
67 		do_pipe,		/* this cmd refers to a pipe */
68 		do_sort,		/* field to sort results (0 = no) */
69 		do_dynamic,		/* display dynamic rules */
70 		do_expired,		/* display expired dynamic rules */
71 		do_compact,		/* show rules in compact mode */
72 		do_force,		/* do not ask for confirmation */
73 		show_sets,		/* display rule sets */
74 		test_only,		/* only check syntax */
75 		comment_only,		/* only print action and comment */
76 		verbose;
77 
78 #define	IP_MASK_ALL	0xffffffff
79 /*
80  * the following macro returns an error message if we run out of
81  * arguments.
82  */
83 #define NEED1(msg)      {if (!ac) errx(EX_USAGE, msg);}
84 
85 /*
86  * _s_x is a structure that stores a string <-> token pairs, used in
87  * various places in the parser. Entries are stored in arrays,
88  * with an entry with s=NULL as terminator.
89  * The search routines are match_token() and match_value().
90  * Often, an element with x=0 contains an error string.
91  *
92  */
93 struct _s_x {
94 	char const *s;
95 	int x;
96 };
97 
98 static struct _s_x f_tcpflags[] = {
99 	{ "syn", TH_SYN },
100 	{ "fin", TH_FIN },
101 	{ "ack", TH_ACK },
102 	{ "psh", TH_PUSH },
103 	{ "rst", TH_RST },
104 	{ "urg", TH_URG },
105 	{ "tcp flag", 0 },
106 	{ NULL,	0 }
107 };
108 
109 static struct _s_x f_tcpopts[] = {
110 	{ "mss",	IP_FW_TCPOPT_MSS },
111 	{ "maxseg",	IP_FW_TCPOPT_MSS },
112 	{ "window",	IP_FW_TCPOPT_WINDOW },
113 	{ "sack",	IP_FW_TCPOPT_SACK },
114 	{ "ts",		IP_FW_TCPOPT_TS },
115 	{ "timestamp",	IP_FW_TCPOPT_TS },
116 	{ "cc",		IP_FW_TCPOPT_CC },
117 	{ "tcp option",	0 },
118 	{ NULL,	0 }
119 };
120 
121 /*
122  * IP options span the range 0 to 255 so we need to remap them
123  * (though in fact only the low 5 bits are significant).
124  */
125 static struct _s_x f_ipopts[] = {
126 	{ "ssrr",	IP_FW_IPOPT_SSRR},
127 	{ "lsrr",	IP_FW_IPOPT_LSRR},
128 	{ "rr",		IP_FW_IPOPT_RR},
129 	{ "ts",		IP_FW_IPOPT_TS},
130 	{ "ip option",	0 },
131 	{ NULL,	0 }
132 };
133 
134 static struct _s_x f_iptos[] = {
135 	{ "lowdelay",	IPTOS_LOWDELAY},
136 	{ "throughput",	IPTOS_THROUGHPUT},
137 	{ "reliability", IPTOS_RELIABILITY},
138 	{ "mincost",	IPTOS_MINCOST},
139 	{ "congestion",	IPTOS_CE},
140 	{ "ecntransport", IPTOS_ECT},
141 	{ "ip tos option", 0},
142 	{ NULL,	0 }
143 };
144 
145 static struct _s_x limit_masks[] = {
146 	{"all",		DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT},
147 	{"src-addr",	DYN_SRC_ADDR},
148 	{"src-port",	DYN_SRC_PORT},
149 	{"dst-addr",	DYN_DST_ADDR},
150 	{"dst-port",	DYN_DST_PORT},
151 	{NULL,		0}
152 };
153 
154 /*
155  * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines
156  * This is only used in this code.
157  */
158 #define IPPROTO_ETHERTYPE	0x1000
159 static struct _s_x ether_types[] = {
160     /*
161      * Note, we cannot use "-:&/" in the names because they are field
162      * separators in the type specifications. Also, we use s = NULL as
163      * end-delimiter, because a type of 0 can be legal.
164      */
165 	{ "ip",		0x0800 },
166 	{ "ipv4",	0x0800 },
167 	{ "ipv6",	0x86dd },
168 	{ "arp",	0x0806 },
169 	{ "rarp",	0x8035 },
170 	{ "vlan",	0x8100 },
171 	{ "loop",	0x9000 },
172 	{ "trail",	0x1000 },
173 	{ "at",		0x809b },
174 	{ "atalk",	0x809b },
175 	{ "aarp",	0x80f3 },
176 	{ "pppoe_disc",	0x8863 },
177 	{ "pppoe_sess",	0x8864 },
178 	{ "ipx_8022",	0x00E0 },
179 	{ "ipx_8023",	0x0000 },
180 	{ "ipx_ii",	0x8137 },
181 	{ "ipx_snap",	0x8137 },
182 	{ "ipx",	0x8137 },
183 	{ "ns",		0x0600 },
184 	{ NULL,		0 }
185 };
186 
187 static void show_usage(void);
188 
189 enum tokens {
190 	TOK_NULL=0,
191 
192 	TOK_OR,
193 	TOK_NOT,
194 	TOK_STARTBRACE,
195 	TOK_ENDBRACE,
196 
197 	TOK_ACCEPT,
198 	TOK_COUNT,
199 	TOK_PIPE,
200 	TOK_QUEUE,
201 	TOK_DIVERT,
202 	TOK_TEE,
203 	TOK_NETGRAPH,
204 	TOK_NGTEE,
205 	TOK_FORWARD,
206 	TOK_SKIPTO,
207 	TOK_DENY,
208 	TOK_REJECT,
209 	TOK_RESET,
210 	TOK_UNREACH,
211 	TOK_CHECKSTATE,
212 
213 	TOK_ALTQ,
214 	TOK_LOG,
215 
216 	TOK_UID,
217 	TOK_GID,
218 	TOK_JAIL,
219 	TOK_IN,
220 	TOK_LIMIT,
221 	TOK_KEEPSTATE,
222 	TOK_LAYER2,
223 	TOK_OUT,
224 	TOK_DIVERTED,
225 	TOK_DIVERTEDLOOPBACK,
226 	TOK_DIVERTEDOUTPUT,
227 	TOK_XMIT,
228 	TOK_RECV,
229 	TOK_VIA,
230 	TOK_FRAG,
231 	TOK_IPOPTS,
232 	TOK_IPLEN,
233 	TOK_IPID,
234 	TOK_IPPRECEDENCE,
235 	TOK_IPTOS,
236 	TOK_IPTTL,
237 	TOK_IPVER,
238 	TOK_ESTAB,
239 	TOK_SETUP,
240 	TOK_TCPDATALEN,
241 	TOK_TCPFLAGS,
242 	TOK_TCPOPTS,
243 	TOK_TCPSEQ,
244 	TOK_TCPACK,
245 	TOK_TCPWIN,
246 	TOK_ICMPTYPES,
247 	TOK_MAC,
248 	TOK_MACTYPE,
249 	TOK_VERREVPATH,
250 	TOK_VERSRCREACH,
251 	TOK_ANTISPOOF,
252 	TOK_IPSEC,
253 	TOK_COMMENT,
254 
255 	TOK_PLR,
256 	TOK_NOERROR,
257 	TOK_BUCKETS,
258 	TOK_DSTIP,
259 	TOK_SRCIP,
260 	TOK_DSTPORT,
261 	TOK_SRCPORT,
262 	TOK_ALL,
263 	TOK_MASK,
264 	TOK_BW,
265 	TOK_DELAY,
266 	TOK_RED,
267 	TOK_GRED,
268 	TOK_DROPTAIL,
269 	TOK_PROTO,
270 	TOK_WEIGHT,
271 
272 	TOK_IPV6,
273 	TOK_FLOWID,
274 	TOK_ICMP6TYPES,
275 	TOK_EXT6HDR,
276 	TOK_DSTIP6,
277 	TOK_SRCIP6,
278 
279 	TOK_IPV4,
280 	TOK_UNREACH6,
281 	TOK_RESET6,
282 };
283 
284 struct _s_x dummynet_params[] = {
285 	{ "plr",		TOK_PLR },
286 	{ "noerror",		TOK_NOERROR },
287 	{ "buckets",		TOK_BUCKETS },
288 	{ "dst-ip",		TOK_DSTIP },
289 	{ "src-ip",		TOK_SRCIP },
290 	{ "dst-port",		TOK_DSTPORT },
291 	{ "src-port",		TOK_SRCPORT },
292 	{ "proto",		TOK_PROTO },
293 	{ "weight",		TOK_WEIGHT },
294 	{ "all",		TOK_ALL },
295 	{ "mask",		TOK_MASK },
296 	{ "droptail",		TOK_DROPTAIL },
297 	{ "red",		TOK_RED },
298 	{ "gred",		TOK_GRED },
299 	{ "bw",			TOK_BW },
300 	{ "bandwidth",		TOK_BW },
301 	{ "delay",		TOK_DELAY },
302 	{ "pipe",		TOK_PIPE },
303 	{ "queue",		TOK_QUEUE },
304 	{ "flow-id",		TOK_FLOWID},
305 	{ "dst-ipv6",		TOK_DSTIP6},
306 	{ "dst-ip6",		TOK_DSTIP6},
307 	{ "src-ipv6",		TOK_SRCIP6},
308 	{ "src-ip6",		TOK_SRCIP6},
309 	{ "dummynet-params",	TOK_NULL },
310 	{ NULL, 0 }	/* terminator */
311 };
312 
313 struct _s_x rule_actions[] = {
314 	{ "accept",		TOK_ACCEPT },
315 	{ "pass",		TOK_ACCEPT },
316 	{ "allow",		TOK_ACCEPT },
317 	{ "permit",		TOK_ACCEPT },
318 	{ "count",		TOK_COUNT },
319 	{ "pipe",		TOK_PIPE },
320 	{ "queue",		TOK_QUEUE },
321 	{ "divert",		TOK_DIVERT },
322 	{ "tee",		TOK_TEE },
323 	{ "netgraph",		TOK_NETGRAPH },
324 	{ "ngtee",		TOK_NGTEE },
325 	{ "fwd",		TOK_FORWARD },
326 	{ "forward",		TOK_FORWARD },
327 	{ "skipto",		TOK_SKIPTO },
328 	{ "deny",		TOK_DENY },
329 	{ "drop",		TOK_DENY },
330 	{ "reject",		TOK_REJECT },
331 	{ "reset6",		TOK_RESET6 },
332 	{ "reset",		TOK_RESET },
333 	{ "unreach6",		TOK_UNREACH6 },
334 	{ "unreach",		TOK_UNREACH },
335 	{ "check-state",	TOK_CHECKSTATE },
336 	{ "//",			TOK_COMMENT },
337 	{ NULL, 0 }	/* terminator */
338 };
339 
340 struct _s_x rule_action_params[] = {
341 	{ "altq",		TOK_ALTQ },
342 	{ "log",		TOK_LOG },
343 	{ NULL, 0 }	/* terminator */
344 };
345 
346 struct _s_x rule_options[] = {
347 	{ "uid",		TOK_UID },
348 	{ "gid",		TOK_GID },
349 	{ "jail",		TOK_JAIL },
350 	{ "in",			TOK_IN },
351 	{ "limit",		TOK_LIMIT },
352 	{ "keep-state",		TOK_KEEPSTATE },
353 	{ "bridged",		TOK_LAYER2 },
354 	{ "layer2",		TOK_LAYER2 },
355 	{ "out",		TOK_OUT },
356 	{ "diverted",		TOK_DIVERTED },
357 	{ "diverted-loopback",	TOK_DIVERTEDLOOPBACK },
358 	{ "diverted-output",	TOK_DIVERTEDOUTPUT },
359 	{ "xmit",		TOK_XMIT },
360 	{ "recv",		TOK_RECV },
361 	{ "via",		TOK_VIA },
362 	{ "fragment",		TOK_FRAG },
363 	{ "frag",		TOK_FRAG },
364 	{ "ipoptions",		TOK_IPOPTS },
365 	{ "ipopts",		TOK_IPOPTS },
366 	{ "iplen",		TOK_IPLEN },
367 	{ "ipid",		TOK_IPID },
368 	{ "ipprecedence",	TOK_IPPRECEDENCE },
369 	{ "iptos",		TOK_IPTOS },
370 	{ "ipttl",		TOK_IPTTL },
371 	{ "ipversion",		TOK_IPVER },
372 	{ "ipver",		TOK_IPVER },
373 	{ "estab",		TOK_ESTAB },
374 	{ "established",	TOK_ESTAB },
375 	{ "setup",		TOK_SETUP },
376 	{ "tcpdatalen",		TOK_TCPDATALEN },
377 	{ "tcpflags",		TOK_TCPFLAGS },
378 	{ "tcpflgs",		TOK_TCPFLAGS },
379 	{ "tcpoptions",		TOK_TCPOPTS },
380 	{ "tcpopts",		TOK_TCPOPTS },
381 	{ "tcpseq",		TOK_TCPSEQ },
382 	{ "tcpack",		TOK_TCPACK },
383 	{ "tcpwin",		TOK_TCPWIN },
384 	{ "icmptype",		TOK_ICMPTYPES },
385 	{ "icmptypes",		TOK_ICMPTYPES },
386 	{ "dst-ip",		TOK_DSTIP },
387 	{ "src-ip",		TOK_SRCIP },
388 	{ "dst-port",		TOK_DSTPORT },
389 	{ "src-port",		TOK_SRCPORT },
390 	{ "proto",		TOK_PROTO },
391 	{ "MAC",		TOK_MAC },
392 	{ "mac",		TOK_MAC },
393 	{ "mac-type",		TOK_MACTYPE },
394 	{ "verrevpath",		TOK_VERREVPATH },
395 	{ "versrcreach",	TOK_VERSRCREACH },
396 	{ "antispoof",		TOK_ANTISPOOF },
397 	{ "ipsec",		TOK_IPSEC },
398 	{ "icmp6type",		TOK_ICMP6TYPES },
399 	{ "icmp6types",		TOK_ICMP6TYPES },
400 	{ "ext6hdr",		TOK_EXT6HDR},
401 	{ "flow-id",		TOK_FLOWID},
402 	{ "ipv6",		TOK_IPV6},
403 	{ "ip6",		TOK_IPV6},
404 	{ "ipv4",		TOK_IPV4},
405 	{ "ip4",		TOK_IPV4},
406 	{ "dst-ipv6",		TOK_DSTIP6},
407 	{ "dst-ip6",		TOK_DSTIP6},
408 	{ "src-ipv6",		TOK_SRCIP6},
409 	{ "src-ip6",		TOK_SRCIP6},
410 	{ "//",			TOK_COMMENT },
411 
412 	{ "not",		TOK_NOT },		/* pseudo option */
413 	{ "!", /* escape ? */	TOK_NOT },		/* pseudo option */
414 	{ "or",			TOK_OR },		/* pseudo option */
415 	{ "|", /* escape */	TOK_OR },		/* pseudo option */
416 	{ "{",			TOK_STARTBRACE },	/* pseudo option */
417 	{ "(",			TOK_STARTBRACE },	/* pseudo option */
418 	{ "}",			TOK_ENDBRACE },		/* pseudo option */
419 	{ ")",			TOK_ENDBRACE },		/* pseudo option */
420 	{ NULL, 0 }	/* terminator */
421 };
422 
423 static __inline uint64_t
424 align_uint64(uint64_t *pll) {
425 	uint64_t ret;
426 
427 	bcopy (pll, &ret, sizeof(ret));
428 	return ret;
429 }
430 
431 /*
432  * conditionally runs the command.
433  */
434 static int
435 do_cmd(int optname, void *optval, uintptr_t optlen)
436 {
437 	static int s = -1;	/* the socket */
438 	int i;
439 
440 	if (test_only)
441 		return 0;
442 
443 	if (s == -1)
444 		s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
445 	if (s < 0)
446 		err(EX_UNAVAILABLE, "socket");
447 
448 	if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET ||
449 	    optname == IP_FW_ADD || optname == IP_FW_TABLE_LIST ||
450 	    optname == IP_FW_TABLE_GETSIZE)
451 		i = getsockopt(s, IPPROTO_IP, optname, optval,
452 			(socklen_t *)optlen);
453 	else
454 		i = setsockopt(s, IPPROTO_IP, optname, optval, optlen);
455 	return i;
456 }
457 
458 /**
459  * match_token takes a table and a string, returns the value associated
460  * with the string (-1 in case of failure).
461  */
462 static int
463 match_token(struct _s_x *table, char *string)
464 {
465 	struct _s_x *pt;
466 	uint i = strlen(string);
467 
468 	for (pt = table ; i && pt->s != NULL ; pt++)
469 		if (strlen(pt->s) == i && !bcmp(string, pt->s, i))
470 			return pt->x;
471 	return -1;
472 }
473 
474 /**
475  * match_value takes a table and a value, returns the string associated
476  * with the value (NULL in case of failure).
477  */
478 static char const *
479 match_value(struct _s_x *p, int value)
480 {
481 	for (; p->s != NULL; p++)
482 		if (p->x == value)
483 			return p->s;
484 	return NULL;
485 }
486 
487 /*
488  * _substrcmp takes two strings and returns 1 if they do not match,
489  * and 0 if they match exactly or the first string is a sub-string
490  * of the second.  A warning is printed to stderr in the case that the
491  * first string is a sub-string of the second.
492  *
493  * This function will be removed in the future through the usual
494  * deprecation process.
495  */
496 static int
497 _substrcmp(const char *str1, const char* str2)
498 {
499 
500 	if (strncmp(str1, str2, strlen(str1)) != 0)
501 		return 1;
502 
503 	if (strlen(str1) != strlen(str2))
504 		warnx("DEPRECATED: '%s' matched '%s' as a sub-string",
505 		    str1, str2);
506 	return 0;
507 }
508 
509 /*
510  * _substrcmp2 takes three strings and returns 1 if the first two do not match,
511  * and 0 if they match exactly or the second string is a sub-string
512  * of the first.  A warning is printed to stderr in the case that the
513  * first string does not match the third.
514  *
515  * This function exists to warn about the bizzare construction
516  * strncmp(str, "by", 2) which is used to allow people to use a shotcut
517  * for "bytes".  The problem is that in addition to accepting "by",
518  * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any
519  * other string beginning with "by".
520  *
521  * This function will be removed in the future through the usual
522  * deprecation process.
523  */
524 static int
525 _substrcmp2(const char *str1, const char* str2, const char* str3)
526 {
527 
528 	if (strncmp(str1, str2, strlen(str2)) != 0)
529 		return 1;
530 
531 	if (strcmp(str1, str3) != 0)
532 		warnx("DEPRECATED: '%s' matched '%s'",
533 		    str1, str3);
534 	return 0;
535 }
536 
537 /*
538  * prints one port, symbolic or numeric
539  */
540 static void
541 print_port(int proto, uint16_t port)
542 {
543 
544 	if (proto == IPPROTO_ETHERTYPE) {
545 		char const *s;
546 
547 		if (do_resolv && (s = match_value(ether_types, port)) )
548 			printf("%s", s);
549 		else
550 			printf("0x%04x", port);
551 	} else {
552 		struct servent *se = NULL;
553 		if (do_resolv) {
554 			struct protoent *pe = getprotobynumber(proto);
555 
556 			se = getservbyport(htons(port), pe ? pe->p_name : NULL);
557 		}
558 		if (se)
559 			printf("%s", se->s_name);
560 		else
561 			printf("%d", port);
562 	}
563 }
564 
565 struct _s_x _port_name[] = {
566 	{"dst-port",	O_IP_DSTPORT},
567 	{"src-port",	O_IP_SRCPORT},
568 	{"ipid",	O_IPID},
569 	{"iplen",	O_IPLEN},
570 	{"ipttl",	O_IPTTL},
571 	{"mac-type",	O_MAC_TYPE},
572 	{"tcpdatalen",	O_TCPDATALEN},
573 	{NULL,		0}
574 };
575 
576 /*
577  * Print the values in a list 16-bit items of the types above.
578  * XXX todo: add support for mask.
579  */
580 static void
581 print_newports(ipfw_insn_u16 *cmd, int proto, int opcode)
582 {
583 	uint16_t *p = cmd->ports;
584 	int i;
585 	char const *sep;
586 
587 	if (cmd->o.len & F_NOT)
588 		printf(" not");
589 	if (opcode != 0) {
590 		sep = match_value(_port_name, opcode);
591 		if (sep == NULL)
592 			sep = "???";
593 		printf (" %s", sep);
594 	}
595 	sep = " ";
596 	for (i = F_LEN((ipfw_insn *)cmd) - 1; i > 0; i--, p += 2) {
597 		printf(sep);
598 		print_port(proto, p[0]);
599 		if (p[0] != p[1]) {
600 			printf("-");
601 			print_port(proto, p[1]);
602 		}
603 		sep = ",";
604 	}
605 }
606 
607 /*
608  * Like strtol, but also translates service names into port numbers
609  * for some protocols.
610  * In particular:
611  *	proto == -1 disables the protocol check;
612  *	proto == IPPROTO_ETHERTYPE looks up an internal table
613  *	proto == <some value in /etc/protocols> matches the values there.
614  * Returns *end == s in case the parameter is not found.
615  */
616 static int
617 strtoport(char *s, char **end, int base, int proto)
618 {
619 	char *p, *buf;
620 	char *s1;
621 	int i;
622 
623 	*end = s;		/* default - not found */
624 	if (*s == '\0')
625 		return 0;	/* not found */
626 
627 	if (isdigit(*s))
628 		return strtol(s, end, base);
629 
630 	/*
631 	 * find separator. '\\' escapes the next char.
632 	 */
633 	for (s1 = s; *s1 && (isalnum(*s1) || *s1 == '\\') ; s1++)
634 		if (*s1 == '\\' && s1[1] != '\0')
635 			s1++;
636 
637 	buf = malloc(s1 - s + 1);
638 	if (buf == NULL)
639 		return 0;
640 
641 	/*
642 	 * copy into a buffer skipping backslashes
643 	 */
644 	for (p = s, i = 0; p != s1 ; p++)
645 		if (*p != '\\')
646 			buf[i++] = *p;
647 	buf[i++] = '\0';
648 
649 	if (proto == IPPROTO_ETHERTYPE) {
650 		i = match_token(ether_types, buf);
651 		free(buf);
652 		if (i != -1) {	/* found */
653 			*end = s1;
654 			return i;
655 		}
656 	} else {
657 		struct protoent *pe = NULL;
658 		struct servent *se;
659 
660 		if (proto != 0)
661 			pe = getprotobynumber(proto);
662 		setservent(1);
663 		se = getservbyname(buf, pe ? pe->p_name : NULL);
664 		free(buf);
665 		if (se != NULL) {
666 			*end = s1;
667 			return ntohs(se->s_port);
668 		}
669 	}
670 	return 0;	/* not found */
671 }
672 
673 /*
674  * Map between current altq queue id numbers and names.
675  */
676 static int altq_fetched = 0;
677 static TAILQ_HEAD(, pf_altq) altq_entries =
678 	TAILQ_HEAD_INITIALIZER(altq_entries);
679 
680 static void
681 altq_set_enabled(int enabled)
682 {
683 	int pffd;
684 
685 	pffd = open("/dev/pf", O_RDWR);
686 	if (pffd == -1)
687 		err(EX_UNAVAILABLE,
688 		    "altq support opening pf(4) control device");
689 	if (enabled) {
690 		if (ioctl(pffd, DIOCSTARTALTQ) != 0 && errno != EEXIST)
691 			err(EX_UNAVAILABLE, "enabling altq");
692 	} else {
693 		if (ioctl(pffd, DIOCSTOPALTQ) != 0 && errno != ENOENT)
694 			err(EX_UNAVAILABLE, "disabling altq");
695 	}
696 	close(pffd);
697 }
698 
699 static void
700 altq_fetch()
701 {
702 	struct pfioc_altq pfioc;
703 	struct pf_altq *altq;
704 	int pffd, mnr;
705 
706 	if (altq_fetched)
707 		return;
708 	altq_fetched = 1;
709 	pffd = open("/dev/pf", O_RDONLY);
710 	if (pffd == -1) {
711 		warn("altq support opening pf(4) control device");
712 		return;
713 	}
714 	bzero(&pfioc, sizeof(pfioc));
715 	if (ioctl(pffd, DIOCGETALTQS, &pfioc) != 0) {
716 		warn("altq support getting queue list");
717 		close(pffd);
718 		return;
719 	}
720 	mnr = pfioc.nr;
721 	for (pfioc.nr = 0; pfioc.nr < mnr; pfioc.nr++) {
722 		if (ioctl(pffd, DIOCGETALTQ, &pfioc) != 0) {
723 			if (errno == EBUSY)
724 				break;
725 			warn("altq support getting queue list");
726 			close(pffd);
727 			return;
728 		}
729 		if (pfioc.altq.qid == 0)
730 			continue;
731 		altq = malloc(sizeof(*altq));
732 		if (altq == NULL)
733 			err(EX_OSERR, "malloc");
734 		*altq = pfioc.altq;
735 		TAILQ_INSERT_TAIL(&altq_entries, altq, entries);
736 	}
737 	close(pffd);
738 }
739 
740 static u_int32_t
741 altq_name_to_qid(const char *name)
742 {
743 	struct pf_altq *altq;
744 
745 	altq_fetch();
746 	TAILQ_FOREACH(altq, &altq_entries, entries)
747 		if (strcmp(name, altq->qname) == 0)
748 			break;
749 	if (altq == NULL)
750 		errx(EX_DATAERR, "altq has no queue named `%s'", name);
751 	return altq->qid;
752 }
753 
754 static const char *
755 altq_qid_to_name(u_int32_t qid)
756 {
757 	struct pf_altq *altq;
758 
759 	altq_fetch();
760 	TAILQ_FOREACH(altq, &altq_entries, entries)
761 		if (qid == altq->qid)
762 			break;
763 	if (altq == NULL)
764 		return NULL;
765 	return altq->qname;
766 }
767 
768 static void
769 fill_altq_qid(u_int32_t *qid, const char *av)
770 {
771 	*qid = altq_name_to_qid(av);
772 }
773 
774 /*
775  * Fill the body of the command with the list of port ranges.
776  */
777 static int
778 fill_newports(ipfw_insn_u16 *cmd, char *av, int proto)
779 {
780 	uint16_t a, b, *p = cmd->ports;
781 	int i = 0;
782 	char *s = av;
783 
784 	while (*s) {
785 		a = strtoport(av, &s, 0, proto);
786 		if (s == av) /* no parameter */
787 			break;
788 		if (*s == '-') { /* a range */
789 			av = s+1;
790 			b = strtoport(av, &s, 0, proto);
791 			if (s == av) /* no parameter */
792 				break;
793 			p[0] = a;
794 			p[1] = b;
795 		} else if (*s == ',' || *s == '\0' )
796 			p[0] = p[1] = a;
797 		else 	/* invalid separator */
798 			errx(EX_DATAERR, "invalid separator <%c> in <%s>\n",
799 				*s, av);
800 		i++;
801 		p += 2;
802 		av = s+1;
803 	}
804 	if (i > 0) {
805 		if (i+1 > F_LEN_MASK)
806 			errx(EX_DATAERR, "too many ports/ranges\n");
807 		cmd->o.len |= i+1; /* leave F_NOT and F_OR untouched */
808 	}
809 	return i;
810 }
811 
812 static struct _s_x icmpcodes[] = {
813       { "net",			ICMP_UNREACH_NET },
814       { "host",			ICMP_UNREACH_HOST },
815       { "protocol",		ICMP_UNREACH_PROTOCOL },
816       { "port",			ICMP_UNREACH_PORT },
817       { "needfrag",		ICMP_UNREACH_NEEDFRAG },
818       { "srcfail",		ICMP_UNREACH_SRCFAIL },
819       { "net-unknown",		ICMP_UNREACH_NET_UNKNOWN },
820       { "host-unknown",		ICMP_UNREACH_HOST_UNKNOWN },
821       { "isolated",		ICMP_UNREACH_ISOLATED },
822       { "net-prohib",		ICMP_UNREACH_NET_PROHIB },
823       { "host-prohib",		ICMP_UNREACH_HOST_PROHIB },
824       { "tosnet",		ICMP_UNREACH_TOSNET },
825       { "toshost",		ICMP_UNREACH_TOSHOST },
826       { "filter-prohib",	ICMP_UNREACH_FILTER_PROHIB },
827       { "host-precedence",	ICMP_UNREACH_HOST_PRECEDENCE },
828       { "precedence-cutoff",	ICMP_UNREACH_PRECEDENCE_CUTOFF },
829       { NULL, 0 }
830 };
831 
832 static void
833 fill_reject_code(u_short *codep, char *str)
834 {
835 	int val;
836 	char *s;
837 
838 	val = strtoul(str, &s, 0);
839 	if (s == str || *s != '\0' || val >= 0x100)
840 		val = match_token(icmpcodes, str);
841 	if (val < 0)
842 		errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str);
843 	*codep = val;
844 	return;
845 }
846 
847 static void
848 print_reject_code(uint16_t code)
849 {
850 	char const *s = match_value(icmpcodes, code);
851 
852 	if (s != NULL)
853 		printf("unreach %s", s);
854 	else
855 		printf("unreach %u", code);
856 }
857 
858 static struct _s_x icmp6codes[] = {
859       { "no-route",		ICMP6_DST_UNREACH_NOROUTE },
860       { "admin-prohib",		ICMP6_DST_UNREACH_ADMIN },
861       { "address",		ICMP6_DST_UNREACH_ADDR },
862       { "port",			ICMP6_DST_UNREACH_NOPORT },
863       { NULL, 0 }
864 };
865 
866 static void
867 fill_unreach6_code(u_short *codep, char *str)
868 {
869 	int val;
870 	char *s;
871 
872 	val = strtoul(str, &s, 0);
873 	if (s == str || *s != '\0' || val >= 0x100)
874 		val = match_token(icmp6codes, str);
875 	if (val < 0)
876 		errx(EX_DATAERR, "unknown ICMPv6 unreachable code ``%s''", str);
877 	*codep = val;
878 	return;
879 }
880 
881 static void
882 print_unreach6_code(uint16_t code)
883 {
884 	char const *s = match_value(icmp6codes, code);
885 
886 	if (s != NULL)
887 		printf("unreach6 %s", s);
888 	else
889 		printf("unreach6 %u", code);
890 }
891 
892 /*
893  * Returns the number of bits set (from left) in a contiguous bitmask,
894  * or -1 if the mask is not contiguous.
895  * XXX this needs a proper fix.
896  * This effectively works on masks in big-endian (network) format.
897  * when compiled on little endian architectures.
898  *
899  * First bit is bit 7 of the first byte -- note, for MAC addresses,
900  * the first bit on the wire is bit 0 of the first byte.
901  * len is the max length in bits.
902  */
903 static int
904 contigmask(uint8_t *p, int len)
905 {
906 	int i, n;
907 
908 	for (i=0; i<len ; i++)
909 		if ( (p[i/8] & (1 << (7 - (i%8)))) == 0) /* first bit unset */
910 			break;
911 	for (n=i+1; n < len; n++)
912 		if ( (p[n/8] & (1 << (7 - (n%8)))) != 0)
913 			return -1; /* mask not contiguous */
914 	return i;
915 }
916 
917 /*
918  * print flags set/clear in the two bitmasks passed as parameters.
919  * There is a specialized check for f_tcpflags.
920  */
921 static void
922 print_flags(char const *name, ipfw_insn *cmd, struct _s_x *list)
923 {
924 	char const *comma = "";
925 	int i;
926 	uint8_t set = cmd->arg1 & 0xff;
927 	uint8_t clear = (cmd->arg1 >> 8) & 0xff;
928 
929 	if (list == f_tcpflags && set == TH_SYN && clear == TH_ACK) {
930 		printf(" setup");
931 		return;
932 	}
933 
934 	printf(" %s ", name);
935 	for (i=0; list[i].x != 0; i++) {
936 		if (set & list[i].x) {
937 			set &= ~list[i].x;
938 			printf("%s%s", comma, list[i].s);
939 			comma = ",";
940 		}
941 		if (clear & list[i].x) {
942 			clear &= ~list[i].x;
943 			printf("%s!%s", comma, list[i].s);
944 			comma = ",";
945 		}
946 	}
947 }
948 
949 /*
950  * Print the ip address contained in a command.
951  */
952 static void
953 print_ip(ipfw_insn_ip *cmd, char const *s)
954 {
955 	struct hostent *he = NULL;
956 	int len = F_LEN((ipfw_insn *)cmd);
957 	uint32_t *a = ((ipfw_insn_u32 *)cmd)->d;
958 
959 	printf("%s%s ", cmd->o.len & F_NOT ? " not": "", s);
960 
961 	if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) {
962 		printf("me");
963 		return;
964 	}
965 	if (cmd->o.opcode == O_IP_SRC_LOOKUP ||
966 	    cmd->o.opcode == O_IP_DST_LOOKUP) {
967 		printf("table(%u", ((ipfw_insn *)cmd)->arg1);
968 		if (len == F_INSN_SIZE(ipfw_insn_u32))
969 			printf(",%u", *a);
970 		printf(")");
971 		return;
972 	}
973 	if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) {
974 		uint32_t x, *map = (uint32_t *)&(cmd->mask);
975 		int i, j;
976 		char comma = '{';
977 
978 		x = cmd->o.arg1 - 1;
979 		x = htonl( ~x );
980 		cmd->addr.s_addr = htonl(cmd->addr.s_addr);
981 		printf("%s/%d", inet_ntoa(cmd->addr),
982 			contigmask((uint8_t *)&x, 32));
983 		x = cmd->addr.s_addr = htonl(cmd->addr.s_addr);
984 		x &= 0xff; /* base */
985 		/*
986 		 * Print bits and ranges.
987 		 * Locate first bit set (i), then locate first bit unset (j).
988 		 * If we have 3+ consecutive bits set, then print them as a
989 		 * range, otherwise only print the initial bit and rescan.
990 		 */
991 		for (i=0; i < cmd->o.arg1; i++)
992 			if (map[i/32] & (1<<(i & 31))) {
993 				for (j=i+1; j < cmd->o.arg1; j++)
994 					if (!(map[ j/32] & (1<<(j & 31))))
995 						break;
996 				printf("%c%d", comma, i+x);
997 				if (j>i+2) { /* range has at least 3 elements */
998 					printf("-%d", j-1+x);
999 					i = j-1;
1000 				}
1001 				comma = ',';
1002 			}
1003 		printf("}");
1004 		return;
1005 	}
1006 	/*
1007 	 * len == 2 indicates a single IP, whereas lists of 1 or more
1008 	 * addr/mask pairs have len = (2n+1). We convert len to n so we
1009 	 * use that to count the number of entries.
1010 	 */
1011     for (len = len / 2; len > 0; len--, a += 2) {
1012 	int mb =	/* mask length */
1013 	    (cmd->o.opcode == O_IP_SRC || cmd->o.opcode == O_IP_DST) ?
1014 		32 : contigmask((uint8_t *)&(a[1]), 32);
1015 	if (mb == 32 && do_resolv)
1016 		he = gethostbyaddr((char *)&(a[0]), sizeof(u_long), AF_INET);
1017 	if (he != NULL)		/* resolved to name */
1018 		printf("%s", he->h_name);
1019 	else if (mb == 0)	/* any */
1020 		printf("any");
1021 	else {		/* numeric IP followed by some kind of mask */
1022 		printf("%s", inet_ntoa( *((struct in_addr *)&a[0]) ) );
1023 		if (mb < 0)
1024 			printf(":%s", inet_ntoa( *((struct in_addr *)&a[1]) ) );
1025 		else if (mb < 32)
1026 			printf("/%d", mb);
1027 	}
1028 	if (len > 1)
1029 		printf(",");
1030     }
1031 }
1032 
1033 /*
1034  * prints a MAC address/mask pair
1035  */
1036 static void
1037 print_mac(uint8_t *addr, uint8_t *mask)
1038 {
1039 	int l = contigmask(mask, 48);
1040 
1041 	if (l == 0)
1042 		printf(" any");
1043 	else {
1044 		printf(" %02x:%02x:%02x:%02x:%02x:%02x",
1045 		    addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
1046 		if (l == -1)
1047 			printf("&%02x:%02x:%02x:%02x:%02x:%02x",
1048 			    mask[0], mask[1], mask[2],
1049 			    mask[3], mask[4], mask[5]);
1050 		else if (l < 48)
1051 			printf("/%d", l);
1052 	}
1053 }
1054 
1055 static void
1056 fill_icmptypes(ipfw_insn_u32 *cmd, char *av)
1057 {
1058 	uint8_t type;
1059 
1060 	cmd->d[0] = 0;
1061 	while (*av) {
1062 		if (*av == ',')
1063 			av++;
1064 
1065 		type = strtoul(av, &av, 0);
1066 
1067 		if (*av != ',' && *av != '\0')
1068 			errx(EX_DATAERR, "invalid ICMP type");
1069 
1070 		if (type > 31)
1071 			errx(EX_DATAERR, "ICMP type out of range");
1072 
1073 		cmd->d[0] |= 1 << type;
1074 	}
1075 	cmd->o.opcode = O_ICMPTYPE;
1076 	cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32);
1077 }
1078 
1079 static void
1080 print_icmptypes(ipfw_insn_u32 *cmd)
1081 {
1082 	int i;
1083 	char sep= ' ';
1084 
1085 	printf(" icmptypes");
1086 	for (i = 0; i < 32; i++) {
1087 		if ( (cmd->d[0] & (1 << (i))) == 0)
1088 			continue;
1089 		printf("%c%d", sep, i);
1090 		sep = ',';
1091 	}
1092 }
1093 
1094 /*
1095  * Print the ip address contained in a command.
1096  */
1097 static void
1098 print_ip6(ipfw_insn_ip6 *cmd, char const *s)
1099 {
1100        struct hostent *he = NULL;
1101        int len = F_LEN((ipfw_insn *) cmd) - 1;
1102        struct in6_addr *a = &(cmd->addr6);
1103        char trad[255];
1104 
1105        printf("%s%s ", cmd->o.len & F_NOT ? " not": "", s);
1106 
1107        if (cmd->o.opcode == O_IP6_SRC_ME || cmd->o.opcode == O_IP6_DST_ME) {
1108                printf("me6");
1109                return;
1110        }
1111        if (cmd->o.opcode == O_IP6) {
1112                printf(" ip6");
1113                return;
1114        }
1115 
1116        /*
1117         * len == 4 indicates a single IP, whereas lists of 1 or more
1118         * addr/mask pairs have len = (2n+1). We convert len to n so we
1119         * use that to count the number of entries.
1120         */
1121 
1122        for (len = len / 4; len > 0; len -= 2, a += 2) {
1123            int mb =        /* mask length */
1124                (cmd->o.opcode == O_IP6_SRC || cmd->o.opcode == O_IP6_DST) ?
1125                128 : contigmask((uint8_t *)&(a[1]), 128);
1126 
1127            if (mb == 128 && do_resolv)
1128                he = gethostbyaddr((char *)a, sizeof(*a), AF_INET6);
1129            if (he != NULL)             /* resolved to name */
1130                printf("%s", he->h_name);
1131            else if (mb == 0)           /* any */
1132                printf("any");
1133            else {          /* numeric IP followed by some kind of mask */
1134                if (inet_ntop(AF_INET6,  a, trad, sizeof( trad ) ) == NULL)
1135                    printf("Error ntop in print_ip6\n");
1136                printf("%s",  trad );
1137                if (mb < 0)     /* XXX not really legal... */
1138                    printf(":%s",
1139                        inet_ntop(AF_INET6, &a[1], trad, sizeof(trad)));
1140                else if (mb < 128)
1141                    printf("/%d", mb);
1142            }
1143            if (len > 2)
1144                printf(",");
1145        }
1146 }
1147 
1148 static void
1149 fill_icmp6types(ipfw_insn_icmp6 *cmd, char *av)
1150 {
1151        uint8_t type;
1152 
1153        cmd->d[0] = 0;
1154        while (*av) {
1155            if (*av == ',')
1156                av++;
1157            type = strtoul(av, &av, 0);
1158            if (*av != ',' && *av != '\0')
1159                errx(EX_DATAERR, "invalid ICMP6 type");
1160 	   /*
1161 	    * XXX: shouldn't this be 0xFF?  I can't see any reason why
1162 	    * we shouldn't be able to filter all possiable values
1163 	    * regardless of the ability of the rest of the kernel to do
1164 	    * anything useful with them.
1165 	    */
1166            if (type > ICMP6_MAXTYPE)
1167                errx(EX_DATAERR, "ICMP6 type out of range");
1168            cmd->d[type / 32] |= ( 1 << (type % 32));
1169        }
1170        cmd->o.opcode = O_ICMP6TYPE;
1171        cmd->o.len |= F_INSN_SIZE(ipfw_insn_icmp6);
1172 }
1173 
1174 
1175 static void
1176 print_icmp6types(ipfw_insn_u32 *cmd)
1177 {
1178        int i, j;
1179        char sep= ' ';
1180 
1181        printf(" ip6 icmp6types");
1182        for (i = 0; i < 7; i++)
1183                for (j=0; j < 32; ++j) {
1184                        if ( (cmd->d[i] & (1 << (j))) == 0)
1185                                continue;
1186                        printf("%c%d", sep, (i*32 + j));
1187                        sep = ',';
1188                }
1189 }
1190 
1191 static void
1192 print_flow6id( ipfw_insn_u32 *cmd)
1193 {
1194        uint16_t i, limit = cmd->o.arg1;
1195        char sep = ',';
1196 
1197        printf(" flow-id ");
1198        for( i=0; i < limit; ++i) {
1199                if (i == limit - 1)
1200                        sep = ' ';
1201                printf("%d%c", cmd->d[i], sep);
1202        }
1203 }
1204 
1205 /* structure and define for the extension header in ipv6 */
1206 static struct _s_x ext6hdrcodes[] = {
1207        { "frag",       EXT_FRAGMENT },
1208        { "hopopt",     EXT_HOPOPTS },
1209        { "route",      EXT_ROUTING },
1210        { "dstopt",     EXT_DSTOPTS },
1211        { "ah",         EXT_AH },
1212        { "esp",        EXT_ESP },
1213        { NULL,         0 }
1214 };
1215 
1216 /* fills command for the extension header filtering */
1217 int
1218 fill_ext6hdr( ipfw_insn *cmd, char *av)
1219 {
1220        int tok;
1221        char *s = av;
1222 
1223        cmd->arg1 = 0;
1224 
1225        while(s) {
1226            av = strsep( &s, ",") ;
1227            tok = match_token(ext6hdrcodes, av);
1228            switch (tok) {
1229            case EXT_FRAGMENT:
1230                cmd->arg1 |= EXT_FRAGMENT;
1231                break;
1232 
1233            case EXT_HOPOPTS:
1234                cmd->arg1 |= EXT_HOPOPTS;
1235                break;
1236 
1237            case EXT_ROUTING:
1238                cmd->arg1 |= EXT_ROUTING;
1239                break;
1240 
1241            case EXT_DSTOPTS:
1242                cmd->arg1 |= EXT_DSTOPTS;
1243                break;
1244 
1245            case EXT_AH:
1246                cmd->arg1 |= EXT_AH;
1247                break;
1248 
1249            case EXT_ESP:
1250                cmd->arg1 |= EXT_ESP;
1251                break;
1252 
1253            default:
1254                errx( EX_DATAERR, "invalid option for ipv6 exten header" );
1255                break;
1256            }
1257        }
1258        if (cmd->arg1 == 0 )
1259            return 0;
1260        cmd->opcode = O_EXT_HDR;
1261        cmd->len |= F_INSN_SIZE( ipfw_insn );
1262        return 1;
1263 }
1264 
1265 void
1266 print_ext6hdr( ipfw_insn *cmd )
1267 {
1268        char sep = ' ';
1269 
1270        printf(" extension header:");
1271        if (cmd->arg1 & EXT_FRAGMENT ) {
1272            printf("%cfragmentation", sep);
1273            sep = ',';
1274        }
1275        if (cmd->arg1 & EXT_HOPOPTS ) {
1276            printf("%chop options", sep);
1277            sep = ',';
1278        }
1279        if (cmd->arg1 & EXT_ROUTING ) {
1280            printf("%crouting options", sep);
1281            sep = ',';
1282        }
1283        if (cmd->arg1 & EXT_DSTOPTS ) {
1284            printf("%cdestination options", sep);
1285            sep = ',';
1286        }
1287        if (cmd->arg1 & EXT_AH ) {
1288            printf("%cauthentication header", sep);
1289            sep = ',';
1290        }
1291        if (cmd->arg1 & EXT_ESP ) {
1292            printf("%cencapsulated security payload", sep);
1293        }
1294 }
1295 
1296 /*
1297  * show_ipfw() prints the body of an ipfw rule.
1298  * Because the standard rule has at least proto src_ip dst_ip, we use
1299  * a helper function to produce these entries if not provided explicitly.
1300  * The first argument is the list of fields we have, the second is
1301  * the list of fields we want to be printed.
1302  *
1303  * Special cases if we have provided a MAC header:
1304  *   + if the rule does not contain IP addresses/ports, do not print them;
1305  *   + if the rule does not contain an IP proto, print "all" instead of "ip";
1306  *
1307  * Once we have 'have_options', IP header fields are printed as options.
1308  */
1309 #define	HAVE_PROTO	0x0001
1310 #define	HAVE_SRCIP	0x0002
1311 #define	HAVE_DSTIP	0x0004
1312 #define	HAVE_MAC	0x0008
1313 #define	HAVE_MACTYPE	0x0010
1314 #define	HAVE_PROTO4	0x0040
1315 #define	HAVE_PROTO6	0x0080
1316 #define	HAVE_OPTIONS	0x8000
1317 
1318 #define	HAVE_IP		(HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP)
1319 static void
1320 show_prerequisites(int *flags, int want, int cmd)
1321 {
1322 	if (comment_only)
1323 		return;
1324 	if ( (*flags & HAVE_IP) == HAVE_IP)
1325 		*flags |= HAVE_OPTIONS;
1326 
1327 	if ( (*flags & (HAVE_MAC|HAVE_MACTYPE|HAVE_OPTIONS)) == HAVE_MAC &&
1328 	     cmd != O_MAC_TYPE) {
1329 		/*
1330 		 * mac-type was optimized out by the compiler,
1331 		 * restore it
1332 		 */
1333 		printf(" any");
1334 		*flags |= HAVE_MACTYPE | HAVE_OPTIONS;
1335 		return;
1336 	}
1337 	if ( !(*flags & HAVE_OPTIONS)) {
1338 		if ( !(*flags & HAVE_PROTO) && (want & HAVE_PROTO))
1339 			if ( (*flags & HAVE_PROTO4))
1340 				printf(" ip4");
1341 			else if ( (*flags & HAVE_PROTO6))
1342 				printf(" ip6");
1343 			else
1344 				printf(" ip");
1345 
1346 		if ( !(*flags & HAVE_SRCIP) && (want & HAVE_SRCIP))
1347 			printf(" from any");
1348 		if ( !(*flags & HAVE_DSTIP) && (want & HAVE_DSTIP))
1349 			printf(" to any");
1350 	}
1351 	*flags |= want;
1352 }
1353 
1354 static void
1355 show_ipfw(struct ip_fw *rule, int pcwidth, int bcwidth)
1356 {
1357 	static int twidth = 0;
1358 	int l;
1359 	ipfw_insn *cmd;
1360 	char *comment = NULL;	/* ptr to comment if we have one */
1361 	int proto = 0;		/* default */
1362 	int flags = 0;	/* prerequisites */
1363 	ipfw_insn_log *logptr = NULL; /* set if we find an O_LOG */
1364 	ipfw_insn_altq *altqptr = NULL; /* set if we find an O_ALTQ */
1365 	int or_block = 0;	/* we are in an or block */
1366 	uint32_t set_disable;
1367 
1368 	bcopy(&rule->next_rule, &set_disable, sizeof(set_disable));
1369 
1370 	if (set_disable & (1 << rule->set)) { /* disabled */
1371 		if (!show_sets)
1372 			return;
1373 		else
1374 			printf("# DISABLED ");
1375 	}
1376 	printf("%05u ", rule->rulenum);
1377 
1378 	if (pcwidth>0 || bcwidth>0)
1379 		printf("%*llu %*llu ", pcwidth, align_uint64(&rule->pcnt),
1380 		    bcwidth, align_uint64(&rule->bcnt));
1381 
1382 	if (do_time == 2)
1383 		printf("%10u ", rule->timestamp);
1384 	else if (do_time == 1) {
1385 		char timestr[30];
1386 		time_t t = (time_t)0;
1387 
1388 		if (twidth == 0) {
1389 			strcpy(timestr, ctime(&t));
1390 			*strchr(timestr, '\n') = '\0';
1391 			twidth = strlen(timestr);
1392 		}
1393 		if (rule->timestamp) {
1394 			t = _long_to_time(rule->timestamp);
1395 
1396 			strcpy(timestr, ctime(&t));
1397 			*strchr(timestr, '\n') = '\0';
1398 			printf("%s ", timestr);
1399 		} else {
1400 			printf("%*s", twidth, " ");
1401 		}
1402 	}
1403 
1404 	if (show_sets)
1405 		printf("set %d ", rule->set);
1406 
1407 	/*
1408 	 * print the optional "match probability"
1409 	 */
1410 	if (rule->cmd_len > 0) {
1411 		cmd = rule->cmd ;
1412 		if (cmd->opcode == O_PROB) {
1413 			ipfw_insn_u32 *p = (ipfw_insn_u32 *)cmd;
1414 			double d = 1.0 * p->d[0];
1415 
1416 			d = (d / 0x7fffffff);
1417 			printf("prob %f ", d);
1418 		}
1419 	}
1420 
1421 	/*
1422 	 * first print actions
1423 	 */
1424         for (l = rule->cmd_len - rule->act_ofs, cmd = ACTION_PTR(rule);
1425 			l > 0 ; l -= F_LEN(cmd), cmd += F_LEN(cmd)) {
1426 		switch(cmd->opcode) {
1427 		case O_CHECK_STATE:
1428 			printf("check-state");
1429 			flags = HAVE_IP; /* avoid printing anything else */
1430 			break;
1431 
1432 		case O_ACCEPT:
1433 			printf("allow");
1434 			break;
1435 
1436 		case O_COUNT:
1437 			printf("count");
1438 			break;
1439 
1440 		case O_DENY:
1441 			printf("deny");
1442 			break;
1443 
1444 		case O_REJECT:
1445 			if (cmd->arg1 == ICMP_REJECT_RST)
1446 				printf("reset");
1447 			else if (cmd->arg1 == ICMP_UNREACH_HOST)
1448 				printf("reject");
1449 			else
1450 				print_reject_code(cmd->arg1);
1451 			break;
1452 
1453 		case O_UNREACH6:
1454 			if (cmd->arg1 == ICMP6_UNREACH_RST)
1455 				printf("reset6");
1456 			else
1457 				print_unreach6_code(cmd->arg1);
1458 			break;
1459 
1460 		case O_SKIPTO:
1461 			printf("skipto %u", cmd->arg1);
1462 			break;
1463 
1464 		case O_PIPE:
1465 			printf("pipe %u", cmd->arg1);
1466 			break;
1467 
1468 		case O_QUEUE:
1469 			printf("queue %u", cmd->arg1);
1470 			break;
1471 
1472 		case O_DIVERT:
1473 			printf("divert %u", cmd->arg1);
1474 			break;
1475 
1476 		case O_TEE:
1477 			printf("tee %u", cmd->arg1);
1478 			break;
1479 
1480 		case O_NETGRAPH:
1481 			printf("netgraph %u", cmd->arg1);
1482 			break;
1483 
1484 		case O_NGTEE:
1485 			printf("ngtee %u", cmd->arg1);
1486 			break;
1487 
1488 		case O_FORWARD_IP:
1489 		    {
1490 			ipfw_insn_sa *s = (ipfw_insn_sa *)cmd;
1491 
1492 			printf("fwd %s", inet_ntoa(s->sa.sin_addr));
1493 			if (s->sa.sin_port)
1494 				printf(",%d", s->sa.sin_port);
1495 		    }
1496 			break;
1497 
1498 		case O_LOG: /* O_LOG is printed last */
1499 			logptr = (ipfw_insn_log *)cmd;
1500 			break;
1501 
1502 		case O_ALTQ: /* O_ALTQ is printed after O_LOG */
1503 			altqptr = (ipfw_insn_altq *)cmd;
1504 			break;
1505 
1506 		default:
1507 			printf("** unrecognized action %d len %d ",
1508 				cmd->opcode, cmd->len);
1509 		}
1510 	}
1511 	if (logptr) {
1512 		if (logptr->max_log > 0)
1513 			printf(" log logamount %d", logptr->max_log);
1514 		else
1515 			printf(" log");
1516 	}
1517 	if (altqptr) {
1518 		const char *qname;
1519 
1520 		qname = altq_qid_to_name(altqptr->qid);
1521 		if (qname == NULL)
1522 			printf(" altq ?<%u>", altqptr->qid);
1523 		else
1524 			printf(" altq %s", qname);
1525 	}
1526 
1527 	/*
1528 	 * then print the body.
1529 	 */
1530         for (l = rule->act_ofs, cmd = rule->cmd ;
1531 			l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) {
1532 		if ((cmd->len & F_OR) || (cmd->len & F_NOT))
1533 			continue;
1534 		if (cmd->opcode == O_IP4) {
1535 			flags |= HAVE_PROTO4;
1536 			break;
1537 		} else if (cmd->opcode == O_IP6) {
1538 			flags |= HAVE_PROTO6;
1539 			break;
1540 		}
1541 	}
1542 	if (rule->_pad & 1) {	/* empty rules before options */
1543 		if (!do_compact) {
1544 			show_prerequisites(&flags, HAVE_PROTO, 0);
1545 			printf(" from any to any");
1546 		}
1547 		flags |= HAVE_IP | HAVE_OPTIONS;
1548 	}
1549 
1550 	if (comment_only)
1551 		comment = "...";
1552 
1553         for (l = rule->act_ofs, cmd = rule->cmd ;
1554 			l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) {
1555 		/* useful alias */
1556 		ipfw_insn_u32 *cmd32 = (ipfw_insn_u32 *)cmd;
1557 
1558 		if (comment_only) {
1559 			if (cmd->opcode != O_NOP)
1560 				continue;
1561 			printf(" // %s\n", (char *)(cmd + 1));
1562 			return;
1563 		}
1564 
1565 		show_prerequisites(&flags, 0, cmd->opcode);
1566 
1567 		switch(cmd->opcode) {
1568 		case O_PROB:
1569 			break;	/* done already */
1570 
1571 		case O_PROBE_STATE:
1572 			break; /* no need to print anything here */
1573 
1574 		case O_MACADDR2: {
1575 			ipfw_insn_mac *m = (ipfw_insn_mac *)cmd;
1576 
1577 			if ((cmd->len & F_OR) && !or_block)
1578 				printf(" {");
1579 			if (cmd->len & F_NOT)
1580 				printf(" not");
1581 			printf(" MAC");
1582 			flags |= HAVE_MAC;
1583 			print_mac(m->addr, m->mask);
1584 			print_mac(m->addr + 6, m->mask + 6);
1585 			}
1586 			break;
1587 
1588 		case O_MAC_TYPE:
1589 			if ((cmd->len & F_OR) && !or_block)
1590 				printf(" {");
1591 			print_newports((ipfw_insn_u16 *)cmd, IPPROTO_ETHERTYPE,
1592 				(flags & HAVE_OPTIONS) ? cmd->opcode : 0);
1593 			flags |= HAVE_MAC | HAVE_MACTYPE | HAVE_OPTIONS;
1594 			break;
1595 
1596 		case O_IP_SRC:
1597 		case O_IP_SRC_LOOKUP:
1598 		case O_IP_SRC_MASK:
1599 		case O_IP_SRC_ME:
1600 		case O_IP_SRC_SET:
1601 			show_prerequisites(&flags, HAVE_PROTO, 0);
1602 			if (!(flags & HAVE_SRCIP))
1603 				printf(" from");
1604 			if ((cmd->len & F_OR) && !or_block)
1605 				printf(" {");
1606 			print_ip((ipfw_insn_ip *)cmd,
1607 				(flags & HAVE_OPTIONS) ? " src-ip" : "");
1608 			flags |= HAVE_SRCIP;
1609 			break;
1610 
1611 		case O_IP_DST:
1612 		case O_IP_DST_LOOKUP:
1613 		case O_IP_DST_MASK:
1614 		case O_IP_DST_ME:
1615 		case O_IP_DST_SET:
1616 			show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0);
1617 			if (!(flags & HAVE_DSTIP))
1618 				printf(" to");
1619 			if ((cmd->len & F_OR) && !or_block)
1620 				printf(" {");
1621 			print_ip((ipfw_insn_ip *)cmd,
1622 				(flags & HAVE_OPTIONS) ? " dst-ip" : "");
1623 			flags |= HAVE_DSTIP;
1624 			break;
1625 
1626 		case O_IP6_SRC:
1627 		case O_IP6_SRC_MASK:
1628 		case O_IP6_SRC_ME:
1629 			show_prerequisites(&flags, HAVE_PROTO, 0);
1630 			if (!(flags & HAVE_SRCIP))
1631 				printf(" from");
1632 			if ((cmd->len & F_OR) && !or_block)
1633 				printf(" {");
1634 			print_ip6((ipfw_insn_ip6 *)cmd,
1635 			    (flags & HAVE_OPTIONS) ? " src-ip6" : "");
1636 			flags |= HAVE_SRCIP | HAVE_PROTO;
1637 			break;
1638 
1639 		case O_IP6_DST:
1640 		case O_IP6_DST_MASK:
1641 		case O_IP6_DST_ME:
1642 			show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0);
1643 			if (!(flags & HAVE_DSTIP))
1644 				printf(" to");
1645 			if ((cmd->len & F_OR) && !or_block)
1646 				printf(" {");
1647 			print_ip6((ipfw_insn_ip6 *)cmd,
1648 			    (flags & HAVE_OPTIONS) ? " dst-ip6" : "");
1649 			flags |= HAVE_DSTIP;
1650 			break;
1651 
1652 		case O_FLOW6ID:
1653 		print_flow6id( (ipfw_insn_u32 *) cmd );
1654 		flags |= HAVE_OPTIONS;
1655 		break;
1656 
1657 		case O_IP_DSTPORT:
1658 			show_prerequisites(&flags, HAVE_IP, 0);
1659 		case O_IP_SRCPORT:
1660 			show_prerequisites(&flags, HAVE_PROTO|HAVE_SRCIP, 0);
1661 			if ((cmd->len & F_OR) && !or_block)
1662 				printf(" {");
1663 			print_newports((ipfw_insn_u16 *)cmd, proto,
1664 				(flags & HAVE_OPTIONS) ? cmd->opcode : 0);
1665 			break;
1666 
1667 		case O_PROTO: {
1668 			struct protoent *pe = NULL;
1669 
1670 			if ((cmd->len & F_OR) && !or_block)
1671 				printf(" {");
1672 			if (cmd->len & F_NOT)
1673 				printf(" not");
1674 			proto = cmd->arg1;
1675 			pe = getprotobynumber(cmd->arg1);
1676 			if ((flags & (HAVE_PROTO4 | HAVE_PROTO6)) &&
1677 			    !(flags & HAVE_PROTO))
1678 				show_prerequisites(&flags,
1679 				    HAVE_IP | HAVE_OPTIONS, 0);
1680 			if (flags & HAVE_OPTIONS)
1681 				printf(" proto");
1682 			if (pe)
1683 				printf(" %s", pe->p_name);
1684 			else
1685 				printf(" %u", cmd->arg1);
1686 			}
1687 			flags |= HAVE_PROTO;
1688 			break;
1689 
1690 		default: /*options ... */
1691 			if (!(cmd->len & (F_OR|F_NOT)))
1692 				if (((cmd->opcode == O_IP6) &&
1693 				    (flags & HAVE_PROTO6)) ||
1694 				    ((cmd->opcode == O_IP4) &&
1695 				    (flags & HAVE_PROTO4)))
1696 					break;
1697 			show_prerequisites(&flags, HAVE_IP | HAVE_OPTIONS, 0);
1698 			if ((cmd->len & F_OR) && !or_block)
1699 				printf(" {");
1700 			if (cmd->len & F_NOT && cmd->opcode != O_IN)
1701 				printf(" not");
1702 			switch(cmd->opcode) {
1703 			case O_FRAG:
1704 				printf(" frag");
1705 				break;
1706 
1707 			case O_IN:
1708 				printf(cmd->len & F_NOT ? " out" : " in");
1709 				break;
1710 
1711 			case O_DIVERTED:
1712 				switch (cmd->arg1) {
1713 				case 3:
1714 					printf(" diverted");
1715 					break;
1716 				case 1:
1717 					printf(" diverted-loopback");
1718 					break;
1719 				case 2:
1720 					printf(" diverted-output");
1721 					break;
1722 				default:
1723 					printf(" diverted-?<%u>", cmd->arg1);
1724 					break;
1725 				}
1726 				break;
1727 
1728 			case O_LAYER2:
1729 				printf(" layer2");
1730 				break;
1731 			case O_XMIT:
1732 			case O_RECV:
1733 			case O_VIA:
1734 			    {
1735 				char const *s;
1736 				ipfw_insn_if *cmdif = (ipfw_insn_if *)cmd;
1737 
1738 				if (cmd->opcode == O_XMIT)
1739 					s = "xmit";
1740 				else if (cmd->opcode == O_RECV)
1741 					s = "recv";
1742 				else /* if (cmd->opcode == O_VIA) */
1743 					s = "via";
1744 				if (cmdif->name[0] == '\0')
1745 					printf(" %s %s", s,
1746 					    inet_ntoa(cmdif->p.ip));
1747 				else
1748 					printf(" %s %s", s, cmdif->name);
1749 
1750 				break;
1751 			    }
1752 			case O_IPID:
1753 				if (F_LEN(cmd) == 1)
1754 				    printf(" ipid %u", cmd->arg1 );
1755 				else
1756 				    print_newports((ipfw_insn_u16 *)cmd, 0,
1757 					O_IPID);
1758 				break;
1759 
1760 			case O_IPTTL:
1761 				if (F_LEN(cmd) == 1)
1762 				    printf(" ipttl %u", cmd->arg1 );
1763 				else
1764 				    print_newports((ipfw_insn_u16 *)cmd, 0,
1765 					O_IPTTL);
1766 				break;
1767 
1768 			case O_IPVER:
1769 				printf(" ipver %u", cmd->arg1 );
1770 				break;
1771 
1772 			case O_IPPRECEDENCE:
1773 				printf(" ipprecedence %u", (cmd->arg1) >> 5 );
1774 				break;
1775 
1776 			case O_IPLEN:
1777 				if (F_LEN(cmd) == 1)
1778 				    printf(" iplen %u", cmd->arg1 );
1779 				else
1780 				    print_newports((ipfw_insn_u16 *)cmd, 0,
1781 					O_IPLEN);
1782 				break;
1783 
1784 			case O_IPOPT:
1785 				print_flags("ipoptions", cmd, f_ipopts);
1786 				break;
1787 
1788 			case O_IPTOS:
1789 				print_flags("iptos", cmd, f_iptos);
1790 				break;
1791 
1792 			case O_ICMPTYPE:
1793 				print_icmptypes((ipfw_insn_u32 *)cmd);
1794 				break;
1795 
1796 			case O_ESTAB:
1797 				printf(" established");
1798 				break;
1799 
1800 			case O_TCPDATALEN:
1801 				if (F_LEN(cmd) == 1)
1802 				    printf(" tcpdatalen %u", cmd->arg1 );
1803 				else
1804 				    print_newports((ipfw_insn_u16 *)cmd, 0,
1805 					O_TCPDATALEN);
1806 				break;
1807 
1808 			case O_TCPFLAGS:
1809 				print_flags("tcpflags", cmd, f_tcpflags);
1810 				break;
1811 
1812 			case O_TCPOPTS:
1813 				print_flags("tcpoptions", cmd, f_tcpopts);
1814 				break;
1815 
1816 			case O_TCPWIN:
1817 				printf(" tcpwin %d", ntohs(cmd->arg1));
1818 				break;
1819 
1820 			case O_TCPACK:
1821 				printf(" tcpack %d", ntohl(cmd32->d[0]));
1822 				break;
1823 
1824 			case O_TCPSEQ:
1825 				printf(" tcpseq %d", ntohl(cmd32->d[0]));
1826 				break;
1827 
1828 			case O_UID:
1829 			    {
1830 				struct passwd *pwd = getpwuid(cmd32->d[0]);
1831 
1832 				if (pwd)
1833 					printf(" uid %s", pwd->pw_name);
1834 				else
1835 					printf(" uid %u", cmd32->d[0]);
1836 			    }
1837 				break;
1838 
1839 			case O_GID:
1840 			    {
1841 				struct group *grp = getgrgid(cmd32->d[0]);
1842 
1843 				if (grp)
1844 					printf(" gid %s", grp->gr_name);
1845 				else
1846 					printf(" gid %u", cmd32->d[0]);
1847 			    }
1848 				break;
1849 
1850 			case O_JAIL:
1851 				printf(" jail %d", cmd32->d[0]);
1852 				break;
1853 
1854 			case O_VERREVPATH:
1855 				printf(" verrevpath");
1856 				break;
1857 
1858 			case O_VERSRCREACH:
1859 				printf(" versrcreach");
1860 				break;
1861 
1862 			case O_ANTISPOOF:
1863 				printf(" antispoof");
1864 				break;
1865 
1866 			case O_IPSEC:
1867 				printf(" ipsec");
1868 				break;
1869 
1870 			case O_NOP:
1871 				comment = (char *)(cmd + 1);
1872 				break;
1873 
1874 			case O_KEEP_STATE:
1875 				printf(" keep-state");
1876 				break;
1877 
1878 			case O_LIMIT:
1879 			    {
1880 				struct _s_x *p = limit_masks;
1881 				ipfw_insn_limit *c = (ipfw_insn_limit *)cmd;
1882 				uint8_t x = c->limit_mask;
1883 				char const *comma = " ";
1884 
1885 				printf(" limit");
1886 				for (; p->x != 0 ; p++)
1887 					if ((x & p->x) == p->x) {
1888 						x &= ~p->x;
1889 						printf("%s%s", comma, p->s);
1890 						comma = ",";
1891 					}
1892 				printf(" %d", c->conn_limit);
1893 			    }
1894 				break;
1895 
1896 			case O_IP6:
1897 				printf(" ip6");
1898 				break;
1899 
1900 			case O_IP4:
1901 				printf(" ip4");
1902 				break;
1903 
1904 			case O_ICMP6TYPE:
1905 				print_icmp6types((ipfw_insn_u32 *)cmd);
1906 				break;
1907 
1908 			case O_EXT_HDR:
1909 				print_ext6hdr( (ipfw_insn *) cmd );
1910 				break;
1911 
1912 			default:
1913 				printf(" [opcode %d len %d]",
1914 				    cmd->opcode, cmd->len);
1915 			}
1916 		}
1917 		if (cmd->len & F_OR) {
1918 			printf(" or");
1919 			or_block = 1;
1920 		} else if (or_block) {
1921 			printf(" }");
1922 			or_block = 0;
1923 		}
1924 	}
1925 	show_prerequisites(&flags, HAVE_IP, 0);
1926 	if (comment)
1927 		printf(" // %s", comment);
1928 	printf("\n");
1929 }
1930 
1931 static void
1932 show_dyn_ipfw(ipfw_dyn_rule *d, int pcwidth, int bcwidth)
1933 {
1934 	struct protoent *pe;
1935 	struct in_addr a;
1936 	uint16_t rulenum;
1937 
1938 	if (!do_expired) {
1939 		if (!d->expire && !(d->dyn_type == O_LIMIT_PARENT))
1940 			return;
1941 	}
1942 	bcopy(&d->rule, &rulenum, sizeof(rulenum));
1943 	printf("%05d", rulenum);
1944 	if (pcwidth>0 || bcwidth>0)
1945 	    printf(" %*llu %*llu (%ds)", pcwidth,
1946 		align_uint64(&d->pcnt), bcwidth,
1947 		align_uint64(&d->bcnt), d->expire);
1948 	switch (d->dyn_type) {
1949 	case O_LIMIT_PARENT:
1950 		printf(" PARENT %d", d->count);
1951 		break;
1952 	case O_LIMIT:
1953 		printf(" LIMIT");
1954 		break;
1955 	case O_KEEP_STATE: /* bidir, no mask */
1956 		printf(" STATE");
1957 		break;
1958 	}
1959 
1960 	if ((pe = getprotobynumber(d->id.proto)) != NULL)
1961 		printf(" %s", pe->p_name);
1962 	else
1963 		printf(" proto %u", d->id.proto);
1964 
1965 	a.s_addr = htonl(d->id.src_ip);
1966 	printf(" %s %d", inet_ntoa(a), d->id.src_port);
1967 
1968 	a.s_addr = htonl(d->id.dst_ip);
1969 	printf(" <-> %s %d", inet_ntoa(a), d->id.dst_port);
1970 	printf("\n");
1971 }
1972 
1973 static int
1974 sort_q(const void *pa, const void *pb)
1975 {
1976 	int rev = (do_sort < 0);
1977 	int field = rev ? -do_sort : do_sort;
1978 	long long res = 0;
1979 	const struct dn_flow_queue *a = pa;
1980 	const struct dn_flow_queue *b = pb;
1981 
1982 	switch (field) {
1983 	case 1: /* pkts */
1984 		res = a->len - b->len;
1985 		break;
1986 	case 2: /* bytes */
1987 		res = a->len_bytes - b->len_bytes;
1988 		break;
1989 
1990 	case 3: /* tot pkts */
1991 		res = a->tot_pkts - b->tot_pkts;
1992 		break;
1993 
1994 	case 4: /* tot bytes */
1995 		res = a->tot_bytes - b->tot_bytes;
1996 		break;
1997 	}
1998 	if (res < 0)
1999 		res = -1;
2000 	if (res > 0)
2001 		res = 1;
2002 	return (int)(rev ? res : -res);
2003 }
2004 
2005 static void
2006 list_queues(struct dn_flow_set *fs, struct dn_flow_queue *q)
2007 {
2008 	int l;
2009 	int index_printed, indexes = 0;
2010 	char buff[255];
2011 	struct protoent *pe;
2012 
2013 	if (fs->rq_elements == 0)
2014 		return;
2015 
2016 	if (do_sort != 0)
2017 		heapsort(q, fs->rq_elements, sizeof *q, sort_q);
2018 
2019 	/* Print IPv4 flows */
2020 	index_printed = 0;
2021 	for (l = 0; l < fs->rq_elements; l++) {
2022 		struct in_addr ina;
2023 
2024 		/* XXX: Should check for IPv4 flows */
2025 		if (IS_IP6_FLOW_ID(&(q[l].id)))
2026 			continue;
2027 
2028 		if (!index_printed) {
2029 			index_printed = 1;
2030 			if (indexes > 0)	/* currently a no-op */
2031 				printf("\n");
2032 			indexes++;
2033 			printf("    "
2034 			    "mask: 0x%02x 0x%08x/0x%04x -> 0x%08x/0x%04x\n",
2035 			    fs->flow_mask.proto,
2036 			    fs->flow_mask.src_ip, fs->flow_mask.src_port,
2037 			    fs->flow_mask.dst_ip, fs->flow_mask.dst_port);
2038 
2039 			printf("BKT Prot ___Source IP/port____ "
2040 			    "____Dest. IP/port____ "
2041 			    "Tot_pkt/bytes Pkt/Byte Drp\n");
2042 		}
2043 
2044 		printf("%3d ", q[l].hash_slot);
2045 		pe = getprotobynumber(q[l].id.proto);
2046 		if (pe)
2047 			printf("%-4s ", pe->p_name);
2048 		else
2049 			printf("%4u ", q[l].id.proto);
2050 		ina.s_addr = htonl(q[l].id.src_ip);
2051 		printf("%15s/%-5d ",
2052 		    inet_ntoa(ina), q[l].id.src_port);
2053 		ina.s_addr = htonl(q[l].id.dst_ip);
2054 		printf("%15s/%-5d ",
2055 		    inet_ntoa(ina), q[l].id.dst_port);
2056 		printf("%4qu %8qu %2u %4u %3u\n",
2057 		    q[l].tot_pkts, q[l].tot_bytes,
2058 		    q[l].len, q[l].len_bytes, q[l].drops);
2059 		if (verbose)
2060 			printf("   S %20qd  F %20qd\n",
2061 			    q[l].S, q[l].F);
2062 	}
2063 
2064 	/* Print IPv6 flows */
2065 	index_printed = 0;
2066 	for (l = 0; l < fs->rq_elements; l++) {
2067 		if (!IS_IP6_FLOW_ID(&(q[l].id)))
2068 			continue;
2069 
2070 		if (!index_printed) {
2071 			index_printed = 1;
2072 			if (indexes > 0)
2073 				printf("\n");
2074 			indexes++;
2075 			printf("\n        mask: proto: 0x%02x, flow_id: 0x%08x,  ",
2076 			    fs->flow_mask.proto, fs->flow_mask.flow_id6);
2077 			inet_ntop(AF_INET6, &(fs->flow_mask.src_ip6),
2078 			    buff, sizeof(buff));
2079 			printf("%s/0x%04x -> ", buff, fs->flow_mask.src_port);
2080 			inet_ntop( AF_INET6, &(fs->flow_mask.dst_ip6),
2081 			    buff, sizeof(buff) );
2082 			printf("%s/0x%04x\n", buff, fs->flow_mask.dst_port);
2083 
2084 			printf("BKT ___Prot___ _flow-id_ "
2085 			    "______________Source IPv6/port_______________ "
2086 			    "_______________Dest. IPv6/port_______________ "
2087 			    "Tot_pkt/bytes Pkt/Byte Drp\n");
2088 		}
2089 		printf("%3d ", q[l].hash_slot);
2090 		pe = getprotobynumber(q[l].id.proto);
2091 		if (pe != NULL)
2092 			printf("%9s ", pe->p_name);
2093 		else
2094 			printf("%9u ", q[l].id.proto);
2095 		printf("%7d  %39s/%-5d ", q[l].id.flow_id6,
2096 		    inet_ntop(AF_INET6, &(q[l].id.src_ip6), buff, sizeof(buff)),
2097 		    q[l].id.src_port);
2098 		printf(" %39s/%-5d ",
2099 		    inet_ntop(AF_INET6, &(q[l].id.dst_ip6), buff, sizeof(buff)),
2100 		    q[l].id.dst_port);
2101 		printf(" %4qu %8qu %2u %4u %3u\n",
2102 		    q[l].tot_pkts, q[l].tot_bytes,
2103 		    q[l].len, q[l].len_bytes, q[l].drops);
2104 		if (verbose)
2105 			printf("   S %20qd  F %20qd\n", q[l].S, q[l].F);
2106 	}
2107 }
2108 
2109 static void
2110 print_flowset_parms(struct dn_flow_set *fs, char *prefix)
2111 {
2112 	int l;
2113 	char qs[30];
2114 	char plr[30];
2115 	char red[90];	/* Display RED parameters */
2116 
2117 	l = fs->qsize;
2118 	if (fs->flags_fs & DN_QSIZE_IS_BYTES) {
2119 		if (l >= 8192)
2120 			sprintf(qs, "%d KB", l / 1024);
2121 		else
2122 			sprintf(qs, "%d B", l);
2123 	} else
2124 		sprintf(qs, "%3d sl.", l);
2125 	if (fs->plr)
2126 		sprintf(plr, "plr %f", 1.0 * fs->plr / (double)(0x7fffffff));
2127 	else
2128 		plr[0] = '\0';
2129 	if (fs->flags_fs & DN_IS_RED)	/* RED parameters */
2130 		sprintf(red,
2131 		    "\n\t  %cRED w_q %f min_th %d max_th %d max_p %f",
2132 		    (fs->flags_fs & DN_IS_GENTLE_RED) ? 'G' : ' ',
2133 		    1.0 * fs->w_q / (double)(1 << SCALE_RED),
2134 		    SCALE_VAL(fs->min_th),
2135 		    SCALE_VAL(fs->max_th),
2136 		    1.0 * fs->max_p / (double)(1 << SCALE_RED));
2137 	else
2138 		sprintf(red, "droptail");
2139 
2140 	printf("%s %s%s %d queues (%d buckets) %s\n",
2141 	    prefix, qs, plr, fs->rq_elements, fs->rq_size, red);
2142 }
2143 
2144 static void
2145 list_pipes(void *data, uint nbytes, int ac, char *av[])
2146 {
2147 	int rulenum;
2148 	void *next = data;
2149 	struct dn_pipe *p = (struct dn_pipe *) data;
2150 	struct dn_flow_set *fs;
2151 	struct dn_flow_queue *q;
2152 	int l;
2153 
2154 	if (ac > 0)
2155 		rulenum = strtoul(*av++, NULL, 10);
2156 	else
2157 		rulenum = 0;
2158 	for (; nbytes >= sizeof *p; p = (struct dn_pipe *)next) {
2159 		double b = p->bandwidth;
2160 		char buf[30];
2161 		char prefix[80];
2162 
2163 		if (p->next.sle_next != (struct dn_pipe *)DN_IS_PIPE)
2164 			break;	/* done with pipes, now queues */
2165 
2166 		/*
2167 		 * compute length, as pipe have variable size
2168 		 */
2169 		l = sizeof(*p) + p->fs.rq_elements * sizeof(*q);
2170 		next = (char *)p + l;
2171 		nbytes -= l;
2172 
2173 		if ((rulenum != 0 && rulenum != p->pipe_nr) || do_pipe == 2)
2174 			continue;
2175 
2176 		/*
2177 		 * Print rate (or clocking interface)
2178 		 */
2179 		if (p->if_name[0] != '\0')
2180 			sprintf(buf, "%s", p->if_name);
2181 		else if (b == 0)
2182 			sprintf(buf, "unlimited");
2183 		else if (b >= 1000000)
2184 			sprintf(buf, "%7.3f Mbit/s", b/1000000);
2185 		else if (b >= 1000)
2186 			sprintf(buf, "%7.3f Kbit/s", b/1000);
2187 		else
2188 			sprintf(buf, "%7.3f bit/s ", b);
2189 
2190 		sprintf(prefix, "%05d: %s %4d ms ",
2191 		    p->pipe_nr, buf, p->delay);
2192 		print_flowset_parms(&(p->fs), prefix);
2193 		if (verbose)
2194 			printf("   V %20qd\n", p->V >> MY_M);
2195 
2196 		q = (struct dn_flow_queue *)(p+1);
2197 		list_queues(&(p->fs), q);
2198 	}
2199 	for (fs = next; nbytes >= sizeof *fs; fs = next) {
2200 		char prefix[80];
2201 
2202 		if (fs->next.sle_next != (struct dn_flow_set *)DN_IS_QUEUE)
2203 			break;
2204 		l = sizeof(*fs) + fs->rq_elements * sizeof(*q);
2205 		next = (char *)fs + l;
2206 		nbytes -= l;
2207 
2208 		if (rulenum != 0 && ((rulenum != fs->fs_nr && do_pipe == 2) ||
2209 		    (rulenum != fs->parent_nr && do_pipe == 1))) {
2210 			continue;
2211 		}
2212 
2213 		q = (struct dn_flow_queue *)(fs+1);
2214 		sprintf(prefix, "q%05d: weight %d pipe %d ",
2215 		    fs->fs_nr, fs->weight, fs->parent_nr);
2216 		print_flowset_parms(fs, prefix);
2217 		list_queues(fs, q);
2218 	}
2219 }
2220 
2221 /*
2222  * This one handles all set-related commands
2223  * 	ipfw set { show | enable | disable }
2224  * 	ipfw set swap X Y
2225  * 	ipfw set move X to Y
2226  * 	ipfw set move rule X to Y
2227  */
2228 static void
2229 sets_handler(int ac, char *av[])
2230 {
2231 	uint32_t set_disable, masks[2];
2232 	int i, nbytes;
2233 	uint16_t rulenum;
2234 	uint8_t cmd, new_set;
2235 
2236 	ac--;
2237 	av++;
2238 
2239 	if (!ac)
2240 		errx(EX_USAGE, "set needs command");
2241 	if (_substrcmp(*av, "show") == 0) {
2242 		void *data;
2243 		char const *msg;
2244 
2245 		nbytes = sizeof(struct ip_fw);
2246 		if ((data = calloc(1, nbytes)) == NULL)
2247 			err(EX_OSERR, "calloc");
2248 		if (do_cmd(IP_FW_GET, data, (uintptr_t)&nbytes) < 0)
2249 			err(EX_OSERR, "getsockopt(IP_FW_GET)");
2250 		bcopy(&((struct ip_fw *)data)->next_rule,
2251 			&set_disable, sizeof(set_disable));
2252 
2253 		for (i = 0, msg = "disable" ; i < RESVD_SET; i++)
2254 			if ((set_disable & (1<<i))) {
2255 				printf("%s %d", msg, i);
2256 				msg = "";
2257 			}
2258 		msg = (set_disable) ? " enable" : "enable";
2259 		for (i = 0; i < RESVD_SET; i++)
2260 			if (!(set_disable & (1<<i))) {
2261 				printf("%s %d", msg, i);
2262 				msg = "";
2263 			}
2264 		printf("\n");
2265 	} else if (_substrcmp(*av, "swap") == 0) {
2266 		ac--; av++;
2267 		if (ac != 2)
2268 			errx(EX_USAGE, "set swap needs 2 set numbers\n");
2269 		rulenum = atoi(av[0]);
2270 		new_set = atoi(av[1]);
2271 		if (!isdigit(*(av[0])) || rulenum > RESVD_SET)
2272 			errx(EX_DATAERR, "invalid set number %s\n", av[0]);
2273 		if (!isdigit(*(av[1])) || new_set > RESVD_SET)
2274 			errx(EX_DATAERR, "invalid set number %s\n", av[1]);
2275 		masks[0] = (4 << 24) | (new_set << 16) | (rulenum);
2276 		i = do_cmd(IP_FW_DEL, masks, sizeof(uint32_t));
2277 	} else if (_substrcmp(*av, "move") == 0) {
2278 		ac--; av++;
2279 		if (ac && _substrcmp(*av, "rule") == 0) {
2280 			cmd = 2;
2281 			ac--; av++;
2282 		} else
2283 			cmd = 3;
2284 		if (ac != 3 || _substrcmp(av[1], "to") != 0)
2285 			errx(EX_USAGE, "syntax: set move [rule] X to Y\n");
2286 		rulenum = atoi(av[0]);
2287 		new_set = atoi(av[2]);
2288 		if (!isdigit(*(av[0])) || (cmd == 3 && rulenum > RESVD_SET) ||
2289 			(cmd == 2 && rulenum == 65535) )
2290 			errx(EX_DATAERR, "invalid source number %s\n", av[0]);
2291 		if (!isdigit(*(av[2])) || new_set > RESVD_SET)
2292 			errx(EX_DATAERR, "invalid dest. set %s\n", av[1]);
2293 		masks[0] = (cmd << 24) | (new_set << 16) | (rulenum);
2294 		i = do_cmd(IP_FW_DEL, masks, sizeof(uint32_t));
2295 	} else if (_substrcmp(*av, "disable") == 0 ||
2296 		   _substrcmp(*av, "enable") == 0 ) {
2297 		int which = _substrcmp(*av, "enable") == 0 ? 1 : 0;
2298 
2299 		ac--; av++;
2300 		masks[0] = masks[1] = 0;
2301 
2302 		while (ac) {
2303 			if (isdigit(**av)) {
2304 				i = atoi(*av);
2305 				if (i < 0 || i > RESVD_SET)
2306 					errx(EX_DATAERR,
2307 					    "invalid set number %d\n", i);
2308 				masks[which] |= (1<<i);
2309 			} else if (_substrcmp(*av, "disable") == 0)
2310 				which = 0;
2311 			else if (_substrcmp(*av, "enable") == 0)
2312 				which = 1;
2313 			else
2314 				errx(EX_DATAERR,
2315 					"invalid set command %s\n", *av);
2316 			av++; ac--;
2317 		}
2318 		if ( (masks[0] & masks[1]) != 0 )
2319 			errx(EX_DATAERR,
2320 			    "cannot enable and disable the same set\n");
2321 
2322 		i = do_cmd(IP_FW_DEL, masks, sizeof(masks));
2323 		if (i)
2324 			warn("set enable/disable: setsockopt(IP_FW_DEL)");
2325 	} else
2326 		errx(EX_USAGE, "invalid set command %s\n", *av);
2327 }
2328 
2329 static void
2330 sysctl_handler(int ac, char *av[], int which)
2331 {
2332 	ac--;
2333 	av++;
2334 
2335 	if (ac == 0) {
2336 		warnx("missing keyword to enable/disable\n");
2337 	} else if (_substrcmp(*av, "firewall") == 0) {
2338 		sysctlbyname("net.inet.ip.fw.enable", NULL, 0,
2339 		    &which, sizeof(which));
2340 	} else if (_substrcmp(*av, "one_pass") == 0) {
2341 		sysctlbyname("net.inet.ip.fw.one_pass", NULL, 0,
2342 		    &which, sizeof(which));
2343 	} else if (_substrcmp(*av, "debug") == 0) {
2344 		sysctlbyname("net.inet.ip.fw.debug", NULL, 0,
2345 		    &which, sizeof(which));
2346 	} else if (_substrcmp(*av, "verbose") == 0) {
2347 		sysctlbyname("net.inet.ip.fw.verbose", NULL, 0,
2348 		    &which, sizeof(which));
2349 	} else if (_substrcmp(*av, "dyn_keepalive") == 0) {
2350 		sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0,
2351 		    &which, sizeof(which));
2352 	} else if (_substrcmp(*av, "altq") == 0) {
2353 		altq_set_enabled(which);
2354 	} else {
2355 		warnx("unrecognize enable/disable keyword: %s\n", *av);
2356 	}
2357 }
2358 
2359 static void
2360 list(int ac, char *av[], int show_counters)
2361 {
2362 	struct ip_fw *r;
2363 	ipfw_dyn_rule *dynrules, *d;
2364 
2365 #define NEXT(r)	((struct ip_fw *)((char *)r + RULESIZE(r)))
2366 	char *lim;
2367 	void *data = NULL;
2368 	int bcwidth, n, nbytes, nstat, ndyn, pcwidth, width;
2369 	int exitval = EX_OK;
2370 	int lac;
2371 	char **lav;
2372 	u_long rnum, last;
2373 	char *endptr;
2374 	int seen = 0;
2375 
2376 	const int ocmd = do_pipe ? IP_DUMMYNET_GET : IP_FW_GET;
2377 	int nalloc = 1024;	/* start somewhere... */
2378 
2379 	last = 0;
2380 
2381 	if (test_only) {
2382 		fprintf(stderr, "Testing only, list disabled\n");
2383 		return;
2384 	}
2385 
2386 	ac--;
2387 	av++;
2388 
2389 	/* get rules or pipes from kernel, resizing array as necessary */
2390 	nbytes = nalloc;
2391 
2392 	while (nbytes >= nalloc) {
2393 		nalloc = nalloc * 2 + 200;
2394 		nbytes = nalloc;
2395 		if ((data = realloc(data, nbytes)) == NULL)
2396 			err(EX_OSERR, "realloc");
2397 		if (do_cmd(ocmd, data, (uintptr_t)&nbytes) < 0)
2398 			err(EX_OSERR, "getsockopt(IP_%s_GET)",
2399 				do_pipe ? "DUMMYNET" : "FW");
2400 	}
2401 
2402 	if (do_pipe) {
2403 		list_pipes(data, nbytes, ac, av);
2404 		goto done;
2405 	}
2406 
2407 	/*
2408 	 * Count static rules. They have variable size so we
2409 	 * need to scan the list to count them.
2410 	 */
2411 	for (nstat = 1, r = data, lim = (char *)data + nbytes;
2412 		    r->rulenum < 65535 && (char *)r < lim;
2413 		    ++nstat, r = NEXT(r) )
2414 		; /* nothing */
2415 
2416 	/*
2417 	 * Count dynamic rules. This is easier as they have
2418 	 * fixed size.
2419 	 */
2420 	r = NEXT(r);
2421 	dynrules = (ipfw_dyn_rule *)r ;
2422 	n = (char *)r - (char *)data;
2423 	ndyn = (nbytes - n) / sizeof *dynrules;
2424 
2425 	/* if showing stats, figure out column widths ahead of time */
2426 	bcwidth = pcwidth = 0;
2427 	if (show_counters) {
2428 		for (n = 0, r = data; n < nstat; n++, r = NEXT(r)) {
2429 			/* packet counter */
2430 			width = snprintf(NULL, 0, "%llu",
2431 			    align_uint64(&r->pcnt));
2432 			if (width > pcwidth)
2433 				pcwidth = width;
2434 
2435 			/* byte counter */
2436 			width = snprintf(NULL, 0, "%llu",
2437 			    align_uint64(&r->bcnt));
2438 			if (width > bcwidth)
2439 				bcwidth = width;
2440 		}
2441 	}
2442 	if (do_dynamic && ndyn) {
2443 		for (n = 0, d = dynrules; n < ndyn; n++, d++) {
2444 			width = snprintf(NULL, 0, "%llu",
2445 			    align_uint64(&d->pcnt));
2446 			if (width > pcwidth)
2447 				pcwidth = width;
2448 
2449 			width = snprintf(NULL, 0, "%llu",
2450 			    align_uint64(&d->bcnt));
2451 			if (width > bcwidth)
2452 				bcwidth = width;
2453 		}
2454 	}
2455 	/* if no rule numbers were specified, list all rules */
2456 	if (ac == 0) {
2457 		for (n = 0, r = data; n < nstat; n++, r = NEXT(r) )
2458 			show_ipfw(r, pcwidth, bcwidth);
2459 
2460 		if (do_dynamic && ndyn) {
2461 			printf("## Dynamic rules (%d):\n", ndyn);
2462 			for (n = 0, d = dynrules; n < ndyn; n++, d++)
2463 				show_dyn_ipfw(d, pcwidth, bcwidth);
2464 		}
2465 		goto done;
2466 	}
2467 
2468 	/* display specific rules requested on command line */
2469 
2470 	for (lac = ac, lav = av; lac != 0; lac--) {
2471 		/* convert command line rule # */
2472 		last = rnum = strtoul(*lav++, &endptr, 10);
2473 		if (*endptr == '-')
2474 			last = strtoul(endptr+1, &endptr, 10);
2475 		if (*endptr) {
2476 			exitval = EX_USAGE;
2477 			warnx("invalid rule number: %s", *(lav - 1));
2478 			continue;
2479 		}
2480 		for (n = seen = 0, r = data; n < nstat; n++, r = NEXT(r) ) {
2481 			if (r->rulenum > last)
2482 				break;
2483 			if (r->rulenum >= rnum && r->rulenum <= last) {
2484 				show_ipfw(r, pcwidth, bcwidth);
2485 				seen = 1;
2486 			}
2487 		}
2488 		if (!seen) {
2489 			/* give precedence to other error(s) */
2490 			if (exitval == EX_OK)
2491 				exitval = EX_UNAVAILABLE;
2492 			warnx("rule %lu does not exist", rnum);
2493 		}
2494 	}
2495 
2496 	if (do_dynamic && ndyn) {
2497 		printf("## Dynamic rules:\n");
2498 		for (lac = ac, lav = av; lac != 0; lac--) {
2499 			last = rnum = strtoul(*lav++, &endptr, 10);
2500 			if (*endptr == '-')
2501 				last = strtoul(endptr+1, &endptr, 10);
2502 			if (*endptr)
2503 				/* already warned */
2504 				continue;
2505 			for (n = 0, d = dynrules; n < ndyn; n++, d++) {
2506 				uint16_t rulenum;
2507 
2508 				bcopy(&d->rule, &rulenum, sizeof(rulenum));
2509 				if (rulenum > rnum)
2510 					break;
2511 				if (r->rulenum >= rnum && r->rulenum <= last)
2512 					show_dyn_ipfw(d, pcwidth, bcwidth);
2513 			}
2514 		}
2515 	}
2516 
2517 	ac = 0;
2518 
2519 done:
2520 	free(data);
2521 
2522 	if (exitval != EX_OK)
2523 		exit(exitval);
2524 #undef NEXT
2525 }
2526 
2527 static void
2528 show_usage(void)
2529 {
2530 	fprintf(stderr, "usage: ipfw [options]\n"
2531 "do \"ipfw -h\" or see ipfw manpage for details\n"
2532 );
2533 	exit(EX_USAGE);
2534 }
2535 
2536 static void
2537 help(void)
2538 {
2539 	fprintf(stderr,
2540 "ipfw syntax summary (but please do read the ipfw(8) manpage):\n"
2541 "ipfw [-abcdefhnNqStTv] <command> where <command> is one of:\n"
2542 "add [num] [set N] [prob x] RULE-BODY\n"
2543 "{pipe|queue} N config PIPE-BODY\n"
2544 "[pipe|queue] {zero|delete|show} [N{,N}]\n"
2545 "set [disable N... enable N...] | move [rule] X to Y | swap X Y | show\n"
2546 "table N {add ip[/bits] [value] | delete ip[/bits] | flush | list}\n"
2547 "\n"
2548 "RULE-BODY:	check-state [PARAMS] | ACTION [PARAMS] ADDR [OPTION_LIST]\n"
2549 "ACTION:	check-state | allow | count | deny | unreach{,6} CODE |\n"
2550 "               skipto N | {divert|tee} PORT | forward ADDR |\n"
2551 "               pipe N | queue N\n"
2552 "PARAMS: 	[log [logamount LOGLIMIT]] [altq QUEUE_NAME]\n"
2553 "ADDR:		[ MAC dst src ether_type ] \n"
2554 "		[ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]\n"
2555 "		[ ipv6|ip6 from IP6ADDR [ PORT ] to IP6ADDR [ PORTLIST ] ]\n"
2556 "IPADDR:	[not] { any | me | ip/bits{x,y,z} | table(t[,v]) | IPLIST }\n"
2557 "IP6ADDR:	[not] { any | me | me6 | ip6/bits | IP6LIST }\n"
2558 "IP6LIST:	{ ip6 | ip6/bits }[,IP6LIST]\n"
2559 "IPLIST:	{ ip | ip/bits | ip:mask }[,IPLIST]\n"
2560 "OPTION_LIST:	OPTION [OPTION_LIST]\n"
2561 "OPTION:	bridged | diverted | diverted-loopback | diverted-output |\n"
2562 "	{dst-ip|src-ip} IPADDR | {dst-ip6|src-ip6|dst-ipv6|src-ipv6} IP6ADDR |\n"
2563 "	{dst-port|src-port} LIST |\n"
2564 "	estab | frag | {gid|uid} N | icmptypes LIST | in | out | ipid LIST |\n"
2565 "	iplen LIST | ipoptions SPEC | ipprecedence | ipsec | iptos SPEC |\n"
2566 "	ipttl LIST | ipversion VER | keep-state | layer2 | limit ... |\n"
2567 "	icmp6types LIST | ext6hdr LIST | flow-id N[,N] |\n"
2568 "	mac ... | mac-type LIST | proto LIST | {recv|xmit|via} {IF|IPADDR} |\n"
2569 "	setup | {tcpack|tcpseq|tcpwin} NN | tcpflags SPEC | tcpoptions SPEC |\n"
2570 "	tcpdatalen LIST | verrevpath | versrcreach | antispoof\n"
2571 );
2572 exit(0);
2573 }
2574 
2575 
2576 static int
2577 lookup_host (char *host, struct in_addr *ipaddr)
2578 {
2579 	struct hostent *he;
2580 
2581 	if (!inet_aton(host, ipaddr)) {
2582 		if ((he = gethostbyname(host)) == NULL)
2583 			return(-1);
2584 		*ipaddr = *(struct in_addr *)he->h_addr_list[0];
2585 	}
2586 	return(0);
2587 }
2588 
2589 /*
2590  * fills the addr and mask fields in the instruction as appropriate from av.
2591  * Update length as appropriate.
2592  * The following formats are allowed:
2593  *	me	returns O_IP_*_ME
2594  *	1.2.3.4		single IP address
2595  *	1.2.3.4:5.6.7.8	address:mask
2596  *	1.2.3.4/24	address/mask
2597  *	1.2.3.4/26{1,6,5,4,23}	set of addresses in a subnet
2598  * We can have multiple comma-separated address/mask entries.
2599  */
2600 static void
2601 fill_ip(ipfw_insn_ip *cmd, char *av)
2602 {
2603 	int len = 0;
2604 	uint32_t *d = ((ipfw_insn_u32 *)cmd)->d;
2605 
2606 	cmd->o.len &= ~F_LEN_MASK;	/* zero len */
2607 
2608 	if (_substrcmp(av, "any") == 0)
2609 		return;
2610 
2611 	if (_substrcmp(av, "me") == 0) {
2612 		cmd->o.len |= F_INSN_SIZE(ipfw_insn);
2613 		return;
2614 	}
2615 
2616 	if (strncmp(av, "table(", 6) == 0) {
2617 		char *p = strchr(av + 6, ',');
2618 
2619 		if (p)
2620 			*p++ = '\0';
2621 		cmd->o.opcode = O_IP_DST_LOOKUP;
2622 		cmd->o.arg1 = strtoul(av + 6, NULL, 0);
2623 		if (p) {
2624 			cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32);
2625 			d[0] = strtoul(p, NULL, 0);
2626 		} else
2627 			cmd->o.len |= F_INSN_SIZE(ipfw_insn);
2628 		return;
2629 	}
2630 
2631     while (av) {
2632 	/*
2633 	 * After the address we can have '/' or ':' indicating a mask,
2634 	 * ',' indicating another address follows, '{' indicating a
2635 	 * set of addresses of unspecified size.
2636 	 */
2637 	char *p = strpbrk(av, "/:,{");
2638 	int masklen;
2639 	char md;
2640 
2641 	if (p) {
2642 		md = *p;
2643 		*p++ = '\0';
2644 	} else
2645 		md = '\0';
2646 
2647 	if (lookup_host(av, (struct in_addr *)&d[0]) != 0)
2648 		errx(EX_NOHOST, "hostname ``%s'' unknown", av);
2649 	switch (md) {
2650 	case ':':
2651 		if (!inet_aton(p, (struct in_addr *)&d[1]))
2652 			errx(EX_DATAERR, "bad netmask ``%s''", p);
2653 		break;
2654 	case '/':
2655 		masklen = atoi(p);
2656 		if (masklen == 0)
2657 			d[1] = htonl(0);	/* mask */
2658 		else if (masklen > 32)
2659 			errx(EX_DATAERR, "bad width ``%s''", p);
2660 		else
2661 			d[1] = htonl(~0 << (32 - masklen));
2662 		break;
2663 	case '{':	/* no mask, assume /24 and put back the '{' */
2664 		d[1] = htonl(~0 << (32 - 24));
2665 		*(--p) = md;
2666 		break;
2667 
2668 	case ',':	/* single address plus continuation */
2669 		*(--p) = md;
2670 		/* FALLTHROUGH */
2671 	case 0:		/* initialization value */
2672 	default:
2673 		d[1] = htonl(~0);	/* force /32 */
2674 		break;
2675 	}
2676 	d[0] &= d[1];		/* mask base address with mask */
2677 	/* find next separator */
2678 	if (p)
2679 		p = strpbrk(p, ",{");
2680 	if (p && *p == '{') {
2681 		/*
2682 		 * We have a set of addresses. They are stored as follows:
2683 		 *   arg1	is the set size (powers of 2, 2..256)
2684 		 *   addr	is the base address IN HOST FORMAT
2685 		 *   mask..	is an array of arg1 bits (rounded up to
2686 		 *		the next multiple of 32) with bits set
2687 		 *		for each host in the map.
2688 		 */
2689 		uint32_t *map = (uint32_t *)&cmd->mask;
2690 		int low, high;
2691 		int i = contigmask((uint8_t *)&(d[1]), 32);
2692 
2693 		if (len > 0)
2694 			errx(EX_DATAERR, "address set cannot be in a list");
2695 		if (i < 24 || i > 31)
2696 			errx(EX_DATAERR, "invalid set with mask %d\n", i);
2697 		cmd->o.arg1 = 1<<(32-i);	/* map length		*/
2698 		d[0] = ntohl(d[0]);		/* base addr in host format */
2699 		cmd->o.opcode = O_IP_DST_SET;	/* default */
2700 		cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + (cmd->o.arg1+31)/32;
2701 		for (i = 0; i < (cmd->o.arg1+31)/32 ; i++)
2702 			map[i] = 0;	/* clear map */
2703 
2704 		av = p + 1;
2705 		low = d[0] & 0xff;
2706 		high = low + cmd->o.arg1 - 1;
2707 		/*
2708 		 * Here, i stores the previous value when we specify a range
2709 		 * of addresses within a mask, e.g. 45-63. i = -1 means we
2710 		 * have no previous value.
2711 		 */
2712 		i = -1;	/* previous value in a range */
2713 		while (isdigit(*av)) {
2714 			char *s;
2715 			int a = strtol(av, &s, 0);
2716 
2717 			if (s == av) { /* no parameter */
2718 			    if (*av != '}')
2719 				errx(EX_DATAERR, "set not closed\n");
2720 			    if (i != -1)
2721 				errx(EX_DATAERR, "incomplete range %d-", i);
2722 			    break;
2723 			}
2724 			if (a < low || a > high)
2725 			    errx(EX_DATAERR, "addr %d out of range [%d-%d]\n",
2726 				a, low, high);
2727 			a -= low;
2728 			if (i == -1)	/* no previous in range */
2729 			    i = a;
2730 			else {		/* check that range is valid */
2731 			    if (i > a)
2732 				errx(EX_DATAERR, "invalid range %d-%d",
2733 					i+low, a+low);
2734 			    if (*s == '-')
2735 				errx(EX_DATAERR, "double '-' in range");
2736 			}
2737 			for (; i <= a; i++)
2738 			    map[i/32] |= 1<<(i & 31);
2739 			i = -1;
2740 			if (*s == '-')
2741 			    i = a;
2742 			else if (*s == '}')
2743 			    break;
2744 			av = s+1;
2745 		}
2746 		return;
2747 	}
2748 	av = p;
2749 	if (av)			/* then *av must be a ',' */
2750 		av++;
2751 
2752 	/* Check this entry */
2753 	if (d[1] == 0) { /* "any", specified as x.x.x.x/0 */
2754 		/*
2755 		 * 'any' turns the entire list into a NOP.
2756 		 * 'not any' never matches, so it is removed from the
2757 		 * list unless it is the only item, in which case we
2758 		 * report an error.
2759 		 */
2760 		if (cmd->o.len & F_NOT) {	/* "not any" never matches */
2761 			if (av == NULL && len == 0) /* only this entry */
2762 				errx(EX_DATAERR, "not any never matches");
2763 		}
2764 		/* else do nothing and skip this entry */
2765 		return;
2766 	}
2767 	/* A single IP can be stored in an optimized format */
2768 	if (d[1] == IP_MASK_ALL && av == NULL && len == 0) {
2769 		cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32);
2770 		return;
2771 	}
2772 	len += 2;	/* two words... */
2773 	d += 2;
2774     } /* end while */
2775     cmd->o.len |= len+1;
2776 }
2777 
2778 
2779 /* Try to find ipv6 address by hostname */
2780 static int
2781 lookup_host6 (char *host, struct in6_addr *ip6addr)
2782 {
2783 	struct hostent *he;
2784 
2785 	if (!inet_pton(AF_INET6, host, ip6addr)) {
2786 		if ((he = gethostbyname2(host, AF_INET6)) == NULL)
2787 			return(-1);
2788 		memcpy(ip6addr, he->h_addr_list[0], sizeof( struct in6_addr));
2789 	}
2790 	return(0);
2791 }
2792 
2793 
2794 /* n2mask sets n bits of the mask */
2795 static void
2796 n2mask(struct in6_addr *mask, int n)
2797 {
2798 	static int	minimask[9] =
2799 	    { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff };
2800 	u_char		*p;
2801 
2802 	memset(mask, 0, sizeof(struct in6_addr));
2803 	p = (u_char *) mask;
2804 	for (; n > 0; p++, n -= 8) {
2805 		if (n >= 8)
2806 			*p = 0xff;
2807 		else
2808 			*p = minimask[n];
2809 	}
2810 	return;
2811 }
2812 
2813 
2814 /*
2815  * fill the addr and mask fields in the instruction as appropriate from av.
2816  * Update length as appropriate.
2817  * The following formats are allowed:
2818  *     any     matches any IP6. Actually returns an empty instruction.
2819  *     me      returns O_IP6_*_ME
2820  *
2821  *     03f1::234:123:0342                single IP6 addres
2822  *     03f1::234:123:0342/24            address/mask
2823  *     03f1::234:123:0342/24,03f1::234:123:0343/               List of address
2824  *
2825  * Set of address (as in ipv6) not supported because ipv6 address
2826  * are typically random past the initial prefix.
2827  * Return 1 on success, 0 on failure.
2828  */
2829 static int
2830 fill_ip6(ipfw_insn_ip6 *cmd, char *av)
2831 {
2832 	int len = 0;
2833 	struct in6_addr *d = &(cmd->addr6);
2834 	/*
2835 	 * Needed for multiple address.
2836 	 * Note d[1] points to struct in6_add r mask6 of cmd
2837 	 */
2838 
2839        cmd->o.len &= ~F_LEN_MASK;	/* zero len */
2840 
2841        if (strcmp(av, "any") == 0)
2842 	       return (1);
2843 
2844 
2845        if (strcmp(av, "me") == 0) {	/* Set the data for "me" opt*/
2846 	       cmd->o.len |= F_INSN_SIZE(ipfw_insn);
2847 	       return (1);
2848        }
2849 
2850        if (strcmp(av, "me6") == 0) {	/* Set the data for "me" opt*/
2851 	       cmd->o.len |= F_INSN_SIZE(ipfw_insn);
2852 	       return (1);
2853        }
2854 
2855        av = strdup(av);
2856        while (av) {
2857 		/*
2858 		 * After the address we can have '/' indicating a mask,
2859 		 * or ',' indicating another address follows.
2860 		 */
2861 
2862 		char *p;
2863 		int masklen;
2864 		char md = '\0';
2865 
2866 		if ((p = strpbrk(av, "/,")) ) {
2867 			md = *p;	/* save the separator */
2868 			*p = '\0';	/* terminate address string */
2869 			p++;		/* and skip past it */
2870 		}
2871 		/* now p points to NULL, mask or next entry */
2872 
2873 		/* lookup stores address in *d as a side effect */
2874 		if (lookup_host6(av, d) != 0) {
2875 			/* XXX: failed. Free memory and go */
2876 			errx(EX_DATAERR, "bad address \"%s\"", av);
2877 		}
2878 		/* next, look at the mask, if any */
2879 		masklen = (md == '/') ? atoi(p) : 128;
2880 		if (masklen > 128 || masklen < 0)
2881 			errx(EX_DATAERR, "bad width \"%s\''", p);
2882 		else
2883 			n2mask(&d[1], masklen);
2884 
2885 		APPLY_MASK(d, &d[1])   /* mask base address with mask */
2886 
2887 		/* find next separator */
2888 
2889 		if (md == '/') {	/* find separator past the mask */
2890 			p = strpbrk(p, ",");
2891 			if (p != NULL)
2892 				p++;
2893 		}
2894 		av = p;
2895 
2896 		/* Check this entry */
2897 		if (masklen == 0) {
2898 			/*
2899 			 * 'any' turns the entire list into a NOP.
2900 			 * 'not any' never matches, so it is removed from the
2901 			 * list unless it is the only item, in which case we
2902 			 * report an error.
2903 			 */
2904 			if (cmd->o.len & F_NOT && av == NULL && len == 0)
2905 				errx(EX_DATAERR, "not any never matches");
2906 			continue;
2907 		}
2908 
2909 		/*
2910 		 * A single IP can be stored alone
2911 		 */
2912 		if (masklen == 128 && av == NULL && len == 0) {
2913 			len = F_INSN_SIZE(struct in6_addr);
2914 			break;
2915 		}
2916 
2917 		/* Update length and pointer to arguments */
2918 		len += F_INSN_SIZE(struct in6_addr)*2;
2919 		d += 2;
2920 	} /* end while */
2921 
2922 	/*
2923 	 * Total length of the command, remember that 1 is the size of
2924 	 * the base command.
2925 	 */
2926 	cmd->o.len |= len+1;
2927 	free(av);
2928 	return (1);
2929 }
2930 
2931 /*
2932  * fills command for ipv6 flow-id filtering
2933  * note that the 20 bit flow number is stored in a array of u_int32_t
2934  * it's supported lists of flow-id, so in the o.arg1 we store how many
2935  * additional flow-id we want to filter, the basic is 1
2936  */
2937 void
2938 fill_flow6( ipfw_insn_u32 *cmd, char *av )
2939 {
2940 	u_int32_t type;	 /* Current flow number */
2941 	u_int16_t nflow = 0;    /* Current flow index */
2942 	char *s = av;
2943 	cmd->d[0] = 0;	  /* Initializing the base number*/
2944 
2945 	while (s) {
2946 		av = strsep( &s, ",") ;
2947 		type = strtoul(av, &av, 0);
2948 		if (*av != ',' && *av != '\0')
2949 			errx(EX_DATAERR, "invalid ipv6 flow number %s", av);
2950 		if (type > 0xfffff)
2951 			errx(EX_DATAERR, "flow number out of range %s", av);
2952 		cmd->d[nflow] |= type;
2953 		nflow++;
2954 	}
2955 	if( nflow > 0 ) {
2956 		cmd->o.opcode = O_FLOW6ID;
2957 		cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + nflow;
2958 		cmd->o.arg1 = nflow;
2959 	}
2960 	else {
2961 		errx(EX_DATAERR, "invalid ipv6 flow number %s", av);
2962 	}
2963 }
2964 
2965 static ipfw_insn *
2966 add_srcip6(ipfw_insn *cmd, char *av)
2967 {
2968 
2969 	fill_ip6((ipfw_insn_ip6 *)cmd, av);
2970 	if (F_LEN(cmd) == 0)				/* any */
2971 		;
2972 	if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) {	/* "me" */
2973 		cmd->opcode = O_IP6_SRC_ME;
2974 	} else if (F_LEN(cmd) ==
2975 	    (F_INSN_SIZE(struct in6_addr) + F_INSN_SIZE(ipfw_insn))) {
2976 		/* single IP, no mask*/
2977 		cmd->opcode = O_IP6_SRC;
2978 	} else {					/* addr/mask opt */
2979 		cmd->opcode = O_IP6_SRC_MASK;
2980 	}
2981 	return cmd;
2982 }
2983 
2984 static ipfw_insn *
2985 add_dstip6(ipfw_insn *cmd, char *av)
2986 {
2987 
2988 	fill_ip6((ipfw_insn_ip6 *)cmd, av);
2989 	if (F_LEN(cmd) == 0)				/* any */
2990 		;
2991 	if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) {	/* "me" */
2992 		cmd->opcode = O_IP6_DST_ME;
2993 	} else if (F_LEN(cmd) ==
2994 	    (F_INSN_SIZE(struct in6_addr) + F_INSN_SIZE(ipfw_insn))) {
2995 		/* single IP, no mask*/
2996 		cmd->opcode = O_IP6_DST;
2997 	} else {					/* addr/mask opt */
2998 		cmd->opcode = O_IP6_DST_MASK;
2999 	}
3000 	return cmd;
3001 }
3002 
3003 
3004 /*
3005  * helper function to process a set of flags and set bits in the
3006  * appropriate masks.
3007  */
3008 static void
3009 fill_flags(ipfw_insn *cmd, enum ipfw_opcodes opcode,
3010 	struct _s_x *flags, char *p)
3011 {
3012 	uint8_t set=0, clear=0;
3013 
3014 	while (p && *p) {
3015 		char *q;	/* points to the separator */
3016 		int val;
3017 		uint8_t *which;	/* mask we are working on */
3018 
3019 		if (*p == '!') {
3020 			p++;
3021 			which = &clear;
3022 		} else
3023 			which = &set;
3024 		q = strchr(p, ',');
3025 		if (q)
3026 			*q++ = '\0';
3027 		val = match_token(flags, p);
3028 		if (val <= 0)
3029 			errx(EX_DATAERR, "invalid flag %s", p);
3030 		*which |= (uint8_t)val;
3031 		p = q;
3032 	}
3033         cmd->opcode = opcode;
3034         cmd->len =  (cmd->len & (F_NOT | F_OR)) | 1;
3035         cmd->arg1 = (set & 0xff) | ( (clear & 0xff) << 8);
3036 }
3037 
3038 
3039 static void
3040 delete(int ac, char *av[])
3041 {
3042 	uint32_t rulenum;
3043 	struct dn_pipe p;
3044 	int i;
3045 	int exitval = EX_OK;
3046 	int do_set = 0;
3047 
3048 	memset(&p, 0, sizeof p);
3049 
3050 	av++; ac--;
3051 	NEED1("missing rule specification");
3052 	if (ac > 0 && _substrcmp(*av, "set") == 0) {
3053 		do_set = 1;	/* delete set */
3054 		ac--; av++;
3055 	}
3056 
3057 	/* Rule number */
3058 	while (ac && isdigit(**av)) {
3059 		i = atoi(*av); av++; ac--;
3060 		if (do_pipe) {
3061 			if (do_pipe == 1)
3062 				p.pipe_nr = i;
3063 			else
3064 				p.fs.fs_nr = i;
3065 			i = do_cmd(IP_DUMMYNET_DEL, &p, sizeof p);
3066 			if (i) {
3067 				exitval = 1;
3068 				warn("rule %u: setsockopt(IP_DUMMYNET_DEL)",
3069 				    do_pipe == 1 ? p.pipe_nr : p.fs.fs_nr);
3070 			}
3071 		} else {
3072 			rulenum =  (i & 0xffff) | (do_set << 24);
3073 			i = do_cmd(IP_FW_DEL, &rulenum, sizeof rulenum);
3074 			if (i) {
3075 				exitval = EX_UNAVAILABLE;
3076 				warn("rule %u: setsockopt(IP_FW_DEL)",
3077 				    rulenum);
3078 			}
3079 		}
3080 	}
3081 	if (exitval != EX_OK)
3082 		exit(exitval);
3083 }
3084 
3085 
3086 /*
3087  * fill the interface structure. We do not check the name as we can
3088  * create interfaces dynamically, so checking them at insert time
3089  * makes relatively little sense.
3090  * Interface names containing '*', '?', or '[' are assumed to be shell
3091  * patterns which match interfaces.
3092  */
3093 static void
3094 fill_iface(ipfw_insn_if *cmd, char *arg)
3095 {
3096 	cmd->name[0] = '\0';
3097 	cmd->o.len |= F_INSN_SIZE(ipfw_insn_if);
3098 
3099 	/* Parse the interface or address */
3100 	if (strcmp(arg, "any") == 0)
3101 		cmd->o.len = 0;		/* effectively ignore this command */
3102 	else if (!isdigit(*arg)) {
3103 		strlcpy(cmd->name, arg, sizeof(cmd->name));
3104 		cmd->p.glob = strpbrk(arg, "*?[") != NULL ? 1 : 0;
3105 	} else if (!inet_aton(arg, &cmd->p.ip))
3106 		errx(EX_DATAERR, "bad ip address ``%s''", arg);
3107 }
3108 
3109 static void
3110 config_pipe(int ac, char **av)
3111 {
3112 	struct dn_pipe p;
3113 	int i;
3114 	char *end;
3115 	void *par = NULL;
3116 
3117 	memset(&p, 0, sizeof p);
3118 
3119 	av++; ac--;
3120 	/* Pipe number */
3121 	if (ac && isdigit(**av)) {
3122 		i = atoi(*av); av++; ac--;
3123 		if (do_pipe == 1)
3124 			p.pipe_nr = i;
3125 		else
3126 			p.fs.fs_nr = i;
3127 	}
3128 	while (ac > 0) {
3129 		double d;
3130 		int tok = match_token(dummynet_params, *av);
3131 		ac--; av++;
3132 
3133 		switch(tok) {
3134 		case TOK_NOERROR:
3135 			p.fs.flags_fs |= DN_NOERROR;
3136 			break;
3137 
3138 		case TOK_PLR:
3139 			NEED1("plr needs argument 0..1\n");
3140 			d = strtod(av[0], NULL);
3141 			if (d > 1)
3142 				d = 1;
3143 			else if (d < 0)
3144 				d = 0;
3145 			p.fs.plr = (int)(d*0x7fffffff);
3146 			ac--; av++;
3147 			break;
3148 
3149 		case TOK_QUEUE:
3150 			NEED1("queue needs queue size\n");
3151 			end = NULL;
3152 			p.fs.qsize = strtoul(av[0], &end, 0);
3153 			if (*end == 'K' || *end == 'k') {
3154 				p.fs.flags_fs |= DN_QSIZE_IS_BYTES;
3155 				p.fs.qsize *= 1024;
3156 			} else if (*end == 'B' ||
3157 			    _substrcmp2(end, "by", "bytes") == 0) {
3158 				p.fs.flags_fs |= DN_QSIZE_IS_BYTES;
3159 			}
3160 			ac--; av++;
3161 			break;
3162 
3163 		case TOK_BUCKETS:
3164 			NEED1("buckets needs argument\n");
3165 			p.fs.rq_size = strtoul(av[0], NULL, 0);
3166 			ac--; av++;
3167 			break;
3168 
3169 		case TOK_MASK:
3170 			NEED1("mask needs mask specifier\n");
3171 			/*
3172 			 * per-flow queue, mask is dst_ip, dst_port,
3173 			 * src_ip, src_port, proto measured in bits
3174 			 */
3175 			par = NULL;
3176 
3177 			bzero(&p.fs.flow_mask, sizeof(p.fs.flow_mask));
3178 			end = NULL;
3179 
3180 			while (ac >= 1) {
3181 			    uint32_t *p32 = NULL;
3182 			    uint16_t *p16 = NULL;
3183 			    uint32_t *p20 = NULL;
3184 			    struct in6_addr *pa6 = NULL;
3185 			    uint32_t a;
3186 
3187 			    tok = match_token(dummynet_params, *av);
3188 			    ac--; av++;
3189 			    switch(tok) {
3190 			    case TOK_ALL:
3191 				    /*
3192 				     * special case, all bits significant
3193 				     */
3194 				    p.fs.flow_mask.dst_ip = ~0;
3195 				    p.fs.flow_mask.src_ip = ~0;
3196 				    p.fs.flow_mask.dst_port = ~0;
3197 				    p.fs.flow_mask.src_port = ~0;
3198 				    p.fs.flow_mask.proto = ~0;
3199 				    n2mask(&(p.fs.flow_mask.dst_ip6), 128);
3200 				    n2mask(&(p.fs.flow_mask.src_ip6), 128);
3201 				    p.fs.flow_mask.flow_id6 = ~0;
3202 				    p.fs.flags_fs |= DN_HAVE_FLOW_MASK;
3203 				    goto end_mask;
3204 
3205 			    case TOK_DSTIP:
3206 				    p32 = &p.fs.flow_mask.dst_ip;
3207 				    break;
3208 
3209 			    case TOK_SRCIP:
3210 				    p32 = &p.fs.flow_mask.src_ip;
3211 				    break;
3212 
3213 			    case TOK_DSTIP6:
3214 				    pa6 = &(p.fs.flow_mask.dst_ip6);
3215 				    break;
3216 
3217 			    case TOK_SRCIP6:
3218 				    pa6 = &(p.fs.flow_mask.src_ip6);
3219 				    break;
3220 
3221 			    case TOK_FLOWID:
3222 				    p20 = &p.fs.flow_mask.flow_id6;
3223 				    break;
3224 
3225 			    case TOK_DSTPORT:
3226 				    p16 = &p.fs.flow_mask.dst_port;
3227 				    break;
3228 
3229 			    case TOK_SRCPORT:
3230 				    p16 = &p.fs.flow_mask.src_port;
3231 				    break;
3232 
3233 			    case TOK_PROTO:
3234 				    break;
3235 
3236 			    default:
3237 				    ac++; av--; /* backtrack */
3238 				    goto end_mask;
3239 			    }
3240 			    if (ac < 1)
3241 				    errx(EX_USAGE, "mask: value missing");
3242 			    if (*av[0] == '/') {
3243 				    a = strtoul(av[0]+1, &end, 0);
3244 				    if (pa6 == NULL)
3245 					    a = (a == 32) ? ~0 : (1 << a) - 1;
3246 			    } else
3247 				    a = strtoul(av[0], &end, 0);
3248 			    if (p32 != NULL)
3249 				    *p32 = a;
3250 			    else if (p16 != NULL) {
3251 				    if (a > 0xFFFF)
3252 					    errx(EX_DATAERR,
3253 						"port mask must be 16 bit");
3254 				    *p16 = (uint16_t)a;
3255 			    } else if (p20 != NULL) {
3256 				    if (a > 0xfffff)
3257 					errx(EX_DATAERR,
3258 					    "flow_id mask must be 20 bit");
3259 				    *p20 = (uint32_t)a;
3260 			    } else if (pa6 != NULL) {
3261 				    if (a < 0 || a > 128)
3262 					errx(EX_DATAERR,
3263 					    "in6addr invalid mask len");
3264 				    else
3265 					n2mask(pa6, a);
3266 			    } else {
3267 				    if (a > 0xFF)
3268 					    errx(EX_DATAERR,
3269 						"proto mask must be 8 bit");
3270 				    p.fs.flow_mask.proto = (uint8_t)a;
3271 			    }
3272 			    if (a != 0)
3273 				    p.fs.flags_fs |= DN_HAVE_FLOW_MASK;
3274 			    ac--; av++;
3275 			} /* end while, config masks */
3276 end_mask:
3277 			break;
3278 
3279 		case TOK_RED:
3280 		case TOK_GRED:
3281 			NEED1("red/gred needs w_q/min_th/max_th/max_p\n");
3282 			p.fs.flags_fs |= DN_IS_RED;
3283 			if (tok == TOK_GRED)
3284 				p.fs.flags_fs |= DN_IS_GENTLE_RED;
3285 			/*
3286 			 * the format for parameters is w_q/min_th/max_th/max_p
3287 			 */
3288 			if ((end = strsep(&av[0], "/"))) {
3289 			    double w_q = strtod(end, NULL);
3290 			    if (w_q > 1 || w_q <= 0)
3291 				errx(EX_DATAERR, "0 < w_q <= 1");
3292 			    p.fs.w_q = (int) (w_q * (1 << SCALE_RED));
3293 			}
3294 			if ((end = strsep(&av[0], "/"))) {
3295 			    p.fs.min_th = strtoul(end, &end, 0);
3296 			    if (*end == 'K' || *end == 'k')
3297 				p.fs.min_th *= 1024;
3298 			}
3299 			if ((end = strsep(&av[0], "/"))) {
3300 			    p.fs.max_th = strtoul(end, &end, 0);
3301 			    if (*end == 'K' || *end == 'k')
3302 				p.fs.max_th *= 1024;
3303 			}
3304 			if ((end = strsep(&av[0], "/"))) {
3305 			    double max_p = strtod(end, NULL);
3306 			    if (max_p > 1 || max_p <= 0)
3307 				errx(EX_DATAERR, "0 < max_p <= 1");
3308 			    p.fs.max_p = (int)(max_p * (1 << SCALE_RED));
3309 			}
3310 			ac--; av++;
3311 			break;
3312 
3313 		case TOK_DROPTAIL:
3314 			p.fs.flags_fs &= ~(DN_IS_RED|DN_IS_GENTLE_RED);
3315 			break;
3316 
3317 		case TOK_BW:
3318 			NEED1("bw needs bandwidth or interface\n");
3319 			if (do_pipe != 1)
3320 			    errx(EX_DATAERR, "bandwidth only valid for pipes");
3321 			/*
3322 			 * set clocking interface or bandwidth value
3323 			 */
3324 			if (av[0][0] >= 'a' && av[0][0] <= 'z') {
3325 			    int l = sizeof(p.if_name)-1;
3326 			    /* interface name */
3327 			    strncpy(p.if_name, av[0], l);
3328 			    p.if_name[l] = '\0';
3329 			    p.bandwidth = 0;
3330 			} else {
3331 			    p.if_name[0] = '\0';
3332 			    p.bandwidth = strtoul(av[0], &end, 0);
3333 			    if (*end == 'K' || *end == 'k') {
3334 				end++;
3335 				p.bandwidth *= 1000;
3336 			    } else if (*end == 'M') {
3337 				end++;
3338 				p.bandwidth *= 1000000;
3339 			    }
3340 			    if (*end == 'B' ||
3341 			        _substrcmp2(end, "by", "bytes") == 0)
3342 				p.bandwidth *= 8;
3343 			    if (p.bandwidth < 0)
3344 				errx(EX_DATAERR, "bandwidth too large");
3345 			}
3346 			ac--; av++;
3347 			break;
3348 
3349 		case TOK_DELAY:
3350 			if (do_pipe != 1)
3351 				errx(EX_DATAERR, "delay only valid for pipes");
3352 			NEED1("delay needs argument 0..10000ms\n");
3353 			p.delay = strtoul(av[0], NULL, 0);
3354 			ac--; av++;
3355 			break;
3356 
3357 		case TOK_WEIGHT:
3358 			if (do_pipe == 1)
3359 				errx(EX_DATAERR,"weight only valid for queues");
3360 			NEED1("weight needs argument 0..100\n");
3361 			p.fs.weight = strtoul(av[0], &end, 0);
3362 			ac--; av++;
3363 			break;
3364 
3365 		case TOK_PIPE:
3366 			if (do_pipe == 1)
3367 				errx(EX_DATAERR,"pipe only valid for queues");
3368 			NEED1("pipe needs pipe_number\n");
3369 			p.fs.parent_nr = strtoul(av[0], &end, 0);
3370 			ac--; av++;
3371 			break;
3372 
3373 		default:
3374 			errx(EX_DATAERR, "unrecognised option ``%s''", av[-1]);
3375 		}
3376 	}
3377 	if (do_pipe == 1) {
3378 		if (p.pipe_nr == 0)
3379 			errx(EX_DATAERR, "pipe_nr must be > 0");
3380 		if (p.delay > 10000)
3381 			errx(EX_DATAERR, "delay must be < 10000");
3382 	} else { /* do_pipe == 2, queue */
3383 		if (p.fs.parent_nr == 0)
3384 			errx(EX_DATAERR, "pipe must be > 0");
3385 		if (p.fs.weight >100)
3386 			errx(EX_DATAERR, "weight must be <= 100");
3387 	}
3388 	if (p.fs.flags_fs & DN_QSIZE_IS_BYTES) {
3389 		if (p.fs.qsize > 1024*1024)
3390 			errx(EX_DATAERR, "queue size must be < 1MB");
3391 	} else {
3392 		if (p.fs.qsize > 100)
3393 			errx(EX_DATAERR, "2 <= queue size <= 100");
3394 	}
3395 	if (p.fs.flags_fs & DN_IS_RED) {
3396 		size_t len;
3397 		int lookup_depth, avg_pkt_size;
3398 		double s, idle, weight, w_q;
3399 		struct clockinfo ck;
3400 		int t;
3401 
3402 		if (p.fs.min_th >= p.fs.max_th)
3403 		    errx(EX_DATAERR, "min_th %d must be < than max_th %d",
3404 			p.fs.min_th, p.fs.max_th);
3405 		if (p.fs.max_th == 0)
3406 		    errx(EX_DATAERR, "max_th must be > 0");
3407 
3408 		len = sizeof(int);
3409 		if (sysctlbyname("net.inet.ip.dummynet.red_lookup_depth",
3410 			&lookup_depth, &len, NULL, 0) == -1)
3411 
3412 		    errx(1, "sysctlbyname(\"%s\")",
3413 			"net.inet.ip.dummynet.red_lookup_depth");
3414 		if (lookup_depth == 0)
3415 		    errx(EX_DATAERR, "net.inet.ip.dummynet.red_lookup_depth"
3416 			" must be greater than zero");
3417 
3418 		len = sizeof(int);
3419 		if (sysctlbyname("net.inet.ip.dummynet.red_avg_pkt_size",
3420 			&avg_pkt_size, &len, NULL, 0) == -1)
3421 
3422 		    errx(1, "sysctlbyname(\"%s\")",
3423 			"net.inet.ip.dummynet.red_avg_pkt_size");
3424 		if (avg_pkt_size == 0)
3425 			errx(EX_DATAERR,
3426 			    "net.inet.ip.dummynet.red_avg_pkt_size must"
3427 			    " be greater than zero");
3428 
3429 		len = sizeof(struct clockinfo);
3430 		if (sysctlbyname("kern.clockrate", &ck, &len, NULL, 0) == -1)
3431 			errx(1, "sysctlbyname(\"%s\")", "kern.clockrate");
3432 
3433 		/*
3434 		 * Ticks needed for sending a medium-sized packet.
3435 		 * Unfortunately, when we are configuring a WF2Q+ queue, we
3436 		 * do not have bandwidth information, because that is stored
3437 		 * in the parent pipe, and also we have multiple queues
3438 		 * competing for it. So we set s=0, which is not very
3439 		 * correct. But on the other hand, why do we want RED with
3440 		 * WF2Q+ ?
3441 		 */
3442 		if (p.bandwidth==0) /* this is a WF2Q+ queue */
3443 			s = 0;
3444 		else
3445 			s = ck.hz * avg_pkt_size * 8 / p.bandwidth;
3446 
3447 		/*
3448 		 * max idle time (in ticks) before avg queue size becomes 0.
3449 		 * NOTA:  (3/w_q) is approx the value x so that
3450 		 * (1-w_q)^x < 10^-3.
3451 		 */
3452 		w_q = ((double)p.fs.w_q) / (1 << SCALE_RED);
3453 		idle = s * 3. / w_q;
3454 		p.fs.lookup_step = (int)idle / lookup_depth;
3455 		if (!p.fs.lookup_step)
3456 			p.fs.lookup_step = 1;
3457 		weight = 1 - w_q;
3458 		for (t = p.fs.lookup_step; t > 0; --t)
3459 			weight *= weight;
3460 		p.fs.lookup_weight = (int)(weight * (1 << SCALE_RED));
3461 	}
3462 	i = do_cmd(IP_DUMMYNET_CONFIGURE, &p, sizeof p);
3463 	if (i)
3464 		err(1, "setsockopt(%s)", "IP_DUMMYNET_CONFIGURE");
3465 }
3466 
3467 static void
3468 get_mac_addr_mask(char *p, uint8_t *addr, uint8_t *mask)
3469 {
3470 	int i, l;
3471 
3472 	for (i=0; i<6; i++)
3473 		addr[i] = mask[i] = 0;
3474 	if (strcmp(p, "any") == 0)
3475 		return;
3476 
3477 	for (i=0; *p && i<6;i++, p++) {
3478 		addr[i] = strtol(p, &p, 16);
3479 		if (*p != ':') /* we start with the mask */
3480 			break;
3481 	}
3482 	if (*p == '/') { /* mask len */
3483 		l = strtol(p+1, &p, 0);
3484 		for (i=0; l>0; l -=8, i++)
3485 			mask[i] = (l >=8) ? 0xff : (~0) << (8-l);
3486 	} else if (*p == '&') { /* mask */
3487 		for (i=0, p++; *p && i<6;i++, p++) {
3488 			mask[i] = strtol(p, &p, 16);
3489 			if (*p != ':')
3490 				break;
3491 		}
3492 	} else if (*p == '\0') {
3493 		for (i=0; i<6; i++)
3494 			mask[i] = 0xff;
3495 	}
3496 	for (i=0; i<6; i++)
3497 		addr[i] &= mask[i];
3498 }
3499 
3500 /*
3501  * helper function, updates the pointer to cmd with the length
3502  * of the current command, and also cleans up the first word of
3503  * the new command in case it has been clobbered before.
3504  */
3505 static ipfw_insn *
3506 next_cmd(ipfw_insn *cmd)
3507 {
3508 	cmd += F_LEN(cmd);
3509 	bzero(cmd, sizeof(*cmd));
3510 	return cmd;
3511 }
3512 
3513 /*
3514  * Takes arguments and copies them into a comment
3515  */
3516 static void
3517 fill_comment(ipfw_insn *cmd, int ac, char **av)
3518 {
3519 	int i, l;
3520 	char *p = (char *)(cmd + 1);
3521 
3522 	cmd->opcode = O_NOP;
3523 	cmd->len =  (cmd->len & (F_NOT | F_OR));
3524 
3525 	/* Compute length of comment string. */
3526 	for (i = 0, l = 0; i < ac; i++)
3527 		l += strlen(av[i]) + 1;
3528 	if (l == 0)
3529 		return;
3530 	if (l > 84)
3531 		errx(EX_DATAERR,
3532 		    "comment too long (max 80 chars)");
3533 	l = 1 + (l+3)/4;
3534 	cmd->len =  (cmd->len & (F_NOT | F_OR)) | l;
3535 	for (i = 0; i < ac; i++) {
3536 		strcpy(p, av[i]);
3537 		p += strlen(av[i]);
3538 		*p++ = ' ';
3539 	}
3540 	*(--p) = '\0';
3541 }
3542 
3543 /*
3544  * A function to fill simple commands of size 1.
3545  * Existing flags are preserved.
3546  */
3547 static void
3548 fill_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, int flags, uint16_t arg)
3549 {
3550 	cmd->opcode = opcode;
3551 	cmd->len =  ((cmd->len | flags) & (F_NOT | F_OR)) | 1;
3552 	cmd->arg1 = arg;
3553 }
3554 
3555 /*
3556  * Fetch and add the MAC address and type, with masks. This generates one or
3557  * two microinstructions, and returns the pointer to the last one.
3558  */
3559 static ipfw_insn *
3560 add_mac(ipfw_insn *cmd, int ac, char *av[])
3561 {
3562 	ipfw_insn_mac *mac;
3563 
3564 	if (ac < 2)
3565 		errx(EX_DATAERR, "MAC dst src");
3566 
3567 	cmd->opcode = O_MACADDR2;
3568 	cmd->len = (cmd->len & (F_NOT | F_OR)) | F_INSN_SIZE(ipfw_insn_mac);
3569 
3570 	mac = (ipfw_insn_mac *)cmd;
3571 	get_mac_addr_mask(av[0], mac->addr, mac->mask);	/* dst */
3572 	get_mac_addr_mask(av[1], &(mac->addr[6]), &(mac->mask[6])); /* src */
3573 	return cmd;
3574 }
3575 
3576 static ipfw_insn *
3577 add_mactype(ipfw_insn *cmd, int ac, char *av)
3578 {
3579 	if (ac < 1)
3580 		errx(EX_DATAERR, "missing MAC type");
3581 	if (strcmp(av, "any") != 0) { /* we have a non-null type */
3582 		fill_newports((ipfw_insn_u16 *)cmd, av, IPPROTO_ETHERTYPE);
3583 		cmd->opcode = O_MAC_TYPE;
3584 		return cmd;
3585 	} else
3586 		return NULL;
3587 }
3588 
3589 static ipfw_insn *
3590 add_proto0(ipfw_insn *cmd, char *av, u_char *protop)
3591 {
3592 	struct protoent *pe;
3593 	char *ep;
3594 	int proto;
3595 
3596 	proto = strtol(av, &ep, 0);
3597 	if (*ep != '\0' || proto < 0) {
3598 		if ((pe = getprotobyname(av)) == NULL)
3599 			return NULL;
3600 		proto = pe->p_proto;
3601 	}
3602 
3603 	fill_cmd(cmd, O_PROTO, 0, proto);
3604 	*protop = proto;
3605 	return cmd;
3606 }
3607 
3608 static ipfw_insn *
3609 add_proto(ipfw_insn *cmd, char *av, u_char *protop)
3610 {
3611 	u_char proto = IPPROTO_IP;
3612 
3613 	if (_substrcmp(av, "all") == 0)
3614 		; /* do not set O_IP4 nor O_IP6 */
3615 	else if (strcmp(av, "ip4") == 0)
3616 		/* explicit "just IPv4" rule */
3617 		fill_cmd(cmd, O_IP4, 0, 0);
3618 	else if (strcmp(av, "ip6") == 0) {
3619 		/* explicit "just IPv6" rule */
3620 		proto = IPPROTO_IPV6;
3621 		fill_cmd(cmd, O_IP6, 0, 0);
3622 	} else
3623 		return add_proto0(cmd, av, protop);
3624 
3625 	*protop = proto;
3626 	return cmd;
3627 }
3628 
3629 static ipfw_insn *
3630 add_proto_compat(ipfw_insn *cmd, char *av, u_char *protop)
3631 {
3632 	u_char proto = IPPROTO_IP;
3633 
3634 	if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0)
3635 		; /* do not set O_IP4 nor O_IP6 */
3636 	else if (strcmp(av, "ipv4") == 0 || strcmp(av, "ip4") == 0)
3637 		/* explicit "just IPv4" rule */
3638 		fill_cmd(cmd, O_IP4, 0, 0);
3639 	else if (strcmp(av, "ipv6") == 0 || strcmp(av, "ip6") == 0) {
3640 		/* explicit "just IPv6" rule */
3641 		proto = IPPROTO_IPV6;
3642 		fill_cmd(cmd, O_IP6, 0, 0);
3643 	} else
3644 		return add_proto0(cmd, av, protop);
3645 
3646 	*protop = proto;
3647 	return cmd;
3648 }
3649 
3650 static ipfw_insn *
3651 add_srcip(ipfw_insn *cmd, char *av)
3652 {
3653 	fill_ip((ipfw_insn_ip *)cmd, av);
3654 	if (cmd->opcode == O_IP_DST_SET)			/* set */
3655 		cmd->opcode = O_IP_SRC_SET;
3656 	else if (cmd->opcode == O_IP_DST_LOOKUP)		/* table */
3657 		cmd->opcode = O_IP_SRC_LOOKUP;
3658 	else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn))		/* me */
3659 		cmd->opcode = O_IP_SRC_ME;
3660 	else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32))	/* one IP */
3661 		cmd->opcode = O_IP_SRC;
3662 	else							/* addr/mask */
3663 		cmd->opcode = O_IP_SRC_MASK;
3664 	return cmd;
3665 }
3666 
3667 static ipfw_insn *
3668 add_dstip(ipfw_insn *cmd, char *av)
3669 {
3670 	fill_ip((ipfw_insn_ip *)cmd, av);
3671 	if (cmd->opcode == O_IP_DST_SET)			/* set */
3672 		;
3673 	else if (cmd->opcode == O_IP_DST_LOOKUP)		/* table */
3674 		;
3675 	else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn))		/* me */
3676 		cmd->opcode = O_IP_DST_ME;
3677 	else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32))	/* one IP */
3678 		cmd->opcode = O_IP_DST;
3679 	else							/* addr/mask */
3680 		cmd->opcode = O_IP_DST_MASK;
3681 	return cmd;
3682 }
3683 
3684 static ipfw_insn *
3685 add_ports(ipfw_insn *cmd, char *av, u_char proto, int opcode)
3686 {
3687 	if (_substrcmp(av, "any") == 0) {
3688 		return NULL;
3689 	} else if (fill_newports((ipfw_insn_u16 *)cmd, av, proto)) {
3690 		/* XXX todo: check that we have a protocol with ports */
3691 		cmd->opcode = opcode;
3692 		return cmd;
3693 	}
3694 	return NULL;
3695 }
3696 
3697 static ipfw_insn *
3698 add_src(ipfw_insn *cmd, char *av, u_char proto)
3699 {
3700 	struct in6_addr a;
3701 
3702 	if (proto == IPPROTO_IPV6  || strcmp(av, "me6") == 0 ||
3703 	    inet_pton(AF_INET6, av, &a))
3704 		return add_srcip6(cmd, av);
3705 	/* XXX: should check for IPv4, not !IPv6 */
3706 	if (proto == IPPROTO_IP || strcmp(av, "me") == 0 ||
3707 	    !inet_pton(AF_INET6, av, &a))
3708 		return add_srcip(cmd, av);
3709 	if (strcmp(av, "any") != 0)
3710 		return cmd;
3711 
3712 	return NULL;
3713 }
3714 
3715 static ipfw_insn *
3716 add_dst(ipfw_insn *cmd, char *av, u_char proto)
3717 {
3718 	struct in6_addr a;
3719 
3720 	if (proto == IPPROTO_IPV6  || strcmp(av, "me6") == 0 ||
3721 	    inet_pton(AF_INET6, av, &a))
3722 		return add_dstip6(cmd, av);
3723 	/* XXX: should check for IPv4, not !IPv6 */
3724 	if (proto == IPPROTO_IP || strcmp(av, "me") == 0 ||
3725 	    !inet_pton(AF_INET6, av, &a))
3726 		return add_dstip(cmd, av);
3727 	if (strcmp(av, "any") != 0)
3728 		return cmd;
3729 
3730 	return NULL;
3731 }
3732 
3733 /*
3734  * Parse arguments and assemble the microinstructions which make up a rule.
3735  * Rules are added into the 'rulebuf' and then copied in the correct order
3736  * into the actual rule.
3737  *
3738  * The syntax for a rule starts with the action, followed by
3739  * optional action parameters, and the various match patterns.
3740  * In the assembled microcode, the first opcode must be an O_PROBE_STATE
3741  * (generated if the rule includes a keep-state option), then the
3742  * various match patterns, log/altq actions, and the actual action.
3743  *
3744  */
3745 static void
3746 add(int ac, char *av[])
3747 {
3748 	/*
3749 	 * rules are added into the 'rulebuf' and then copied in
3750 	 * the correct order into the actual rule.
3751 	 * Some things that need to go out of order (prob, action etc.)
3752 	 * go into actbuf[].
3753 	 */
3754 	static uint32_t rulebuf[255], actbuf[255], cmdbuf[255];
3755 
3756 	ipfw_insn *src, *dst, *cmd, *action, *prev=NULL;
3757 	ipfw_insn *first_cmd;	/* first match pattern */
3758 
3759 	struct ip_fw *rule;
3760 
3761 	/*
3762 	 * various flags used to record that we entered some fields.
3763 	 */
3764 	ipfw_insn *have_state = NULL;	/* check-state or keep-state */
3765 	ipfw_insn *have_log = NULL, *have_altq = NULL;
3766 	size_t len;
3767 
3768 	int i;
3769 
3770 	int open_par = 0;	/* open parenthesis ( */
3771 
3772 	/* proto is here because it is used to fetch ports */
3773 	u_char proto = IPPROTO_IP;	/* default protocol */
3774 
3775 	double match_prob = 1; /* match probability, default is always match */
3776 
3777 	bzero(actbuf, sizeof(actbuf));		/* actions go here */
3778 	bzero(cmdbuf, sizeof(cmdbuf));
3779 	bzero(rulebuf, sizeof(rulebuf));
3780 
3781 	rule = (struct ip_fw *)rulebuf;
3782 	cmd = (ipfw_insn *)cmdbuf;
3783 	action = (ipfw_insn *)actbuf;
3784 
3785 	av++; ac--;
3786 
3787 	/* [rule N]	-- Rule number optional */
3788 	if (ac && isdigit(**av)) {
3789 		rule->rulenum = atoi(*av);
3790 		av++;
3791 		ac--;
3792 	}
3793 
3794 	/* [set N]	-- set number (0..RESVD_SET), optional */
3795 	if (ac > 1 && _substrcmp(*av, "set") == 0) {
3796 		int set = strtoul(av[1], NULL, 10);
3797 		if (set < 0 || set > RESVD_SET)
3798 			errx(EX_DATAERR, "illegal set %s", av[1]);
3799 		rule->set = set;
3800 		av += 2; ac -= 2;
3801 	}
3802 
3803 	/* [prob D]	-- match probability, optional */
3804 	if (ac > 1 && _substrcmp(*av, "prob") == 0) {
3805 		match_prob = strtod(av[1], NULL);
3806 
3807 		if (match_prob <= 0 || match_prob > 1)
3808 			errx(EX_DATAERR, "illegal match prob. %s", av[1]);
3809 		av += 2; ac -= 2;
3810 	}
3811 
3812 	/* action	-- mandatory */
3813 	NEED1("missing action");
3814 	i = match_token(rule_actions, *av);
3815 	ac--; av++;
3816 	action->len = 1;	/* default */
3817 	switch(i) {
3818 	case TOK_CHECKSTATE:
3819 		have_state = action;
3820 		action->opcode = O_CHECK_STATE;
3821 		break;
3822 
3823 	case TOK_ACCEPT:
3824 		action->opcode = O_ACCEPT;
3825 		break;
3826 
3827 	case TOK_DENY:
3828 		action->opcode = O_DENY;
3829 		action->arg1 = 0;
3830 		break;
3831 
3832 	case TOK_REJECT:
3833 		action->opcode = O_REJECT;
3834 		action->arg1 = ICMP_UNREACH_HOST;
3835 		break;
3836 
3837 	case TOK_RESET:
3838 		action->opcode = O_REJECT;
3839 		action->arg1 = ICMP_REJECT_RST;
3840 		break;
3841 
3842 	case TOK_RESET6:
3843 		action->opcode = O_UNREACH6;
3844 		action->arg1 = ICMP6_UNREACH_RST;
3845 		break;
3846 
3847 	case TOK_UNREACH:
3848 		action->opcode = O_REJECT;
3849 		NEED1("missing reject code");
3850 		fill_reject_code(&action->arg1, *av);
3851 		ac--; av++;
3852 		break;
3853 
3854 	case TOK_UNREACH6:
3855 		action->opcode = O_UNREACH6;
3856 		NEED1("missing unreach code");
3857 		fill_unreach6_code(&action->arg1, *av);
3858 		ac--; av++;
3859 		break;
3860 
3861 	case TOK_COUNT:
3862 		action->opcode = O_COUNT;
3863 		break;
3864 
3865 	case TOK_QUEUE:
3866 	case TOK_PIPE:
3867 		action->len = F_INSN_SIZE(ipfw_insn);
3868 	case TOK_SKIPTO:
3869 		if (i == TOK_QUEUE)
3870 			action->opcode = O_QUEUE;
3871 		else if (i == TOK_PIPE)
3872 			action->opcode = O_PIPE;
3873 		else if (i == TOK_SKIPTO)
3874 			action->opcode = O_SKIPTO;
3875 		NEED1("missing skipto/pipe/queue number");
3876 		action->arg1 = strtoul(*av, NULL, 10);
3877 		av++; ac--;
3878 		break;
3879 
3880 	case TOK_DIVERT:
3881 	case TOK_TEE:
3882 		action->opcode = (i == TOK_DIVERT) ? O_DIVERT : O_TEE;
3883 		NEED1("missing divert/tee port");
3884 		action->arg1 = strtoul(*av, NULL, 0);
3885 		if (action->arg1 == 0) {
3886 			struct servent *s;
3887 			setservent(1);
3888 			s = getservbyname(av[0], "divert");
3889 			if (s != NULL)
3890 				action->arg1 = ntohs(s->s_port);
3891 			else
3892 				errx(EX_DATAERR, "illegal divert/tee port");
3893 		}
3894 		ac--; av++;
3895 		break;
3896 
3897 	case TOK_NETGRAPH:
3898 	case TOK_NGTEE:
3899 		action->opcode = (i == TOK_NETGRAPH ) ? O_NETGRAPH : O_NGTEE;
3900 		NEED1("missing netgraph cookie");
3901 		action->arg1 = strtoul(*av, NULL, 0);
3902 		if (action->arg1 == 0)
3903 			errx(EX_DATAERR, "illegal netgraph cookie");
3904 		ac--; av++;
3905 		break;
3906 
3907 	case TOK_FORWARD: {
3908 		ipfw_insn_sa *p = (ipfw_insn_sa *)action;
3909 		char *s, *end;
3910 
3911 		NEED1("missing forward address[:port]");
3912 
3913 		action->opcode = O_FORWARD_IP;
3914 		action->len = F_INSN_SIZE(ipfw_insn_sa);
3915 
3916 		p->sa.sin_len = sizeof(struct sockaddr_in);
3917 		p->sa.sin_family = AF_INET;
3918 		p->sa.sin_port = 0;
3919 		/*
3920 		 * locate the address-port separator (':' or ',')
3921 		 */
3922 		s = strchr(*av, ':');
3923 		if (s == NULL)
3924 			s = strchr(*av, ',');
3925 		if (s != NULL) {
3926 			*(s++) = '\0';
3927 			i = strtoport(s, &end, 0 /* base */, 0 /* proto */);
3928 			if (s == end)
3929 				errx(EX_DATAERR,
3930 				    "illegal forwarding port ``%s''", s);
3931 			p->sa.sin_port = (u_short)i;
3932 		}
3933 		lookup_host(*av, &(p->sa.sin_addr));
3934 		}
3935 		ac--; av++;
3936 		break;
3937 
3938 	case TOK_COMMENT:
3939 		/* pretend it is a 'count' rule followed by the comment */
3940 		action->opcode = O_COUNT;
3941 		ac++; av--;	/* go back... */
3942 		break;
3943 
3944 	default:
3945 		errx(EX_DATAERR, "invalid action %s\n", av[-1]);
3946 	}
3947 	action = next_cmd(action);
3948 
3949 	/*
3950 	 * [altq queuename] -- altq tag, optional
3951 	 * [log [logamount N]]	-- log, optional
3952 	 *
3953 	 * If they exist, it go first in the cmdbuf, but then it is
3954 	 * skipped in the copy section to the end of the buffer.
3955 	 */
3956 	while (ac != 0 && (i = match_token(rule_action_params, *av)) != -1) {
3957 		ac--; av++;
3958 		switch (i) {
3959 		case TOK_LOG:
3960 		    {
3961 			ipfw_insn_log *c = (ipfw_insn_log *)cmd;
3962 			int l;
3963 
3964 			if (have_log)
3965 				errx(EX_DATAERR,
3966 				    "log cannot be specified more than once");
3967 			have_log = (ipfw_insn *)c;
3968 			cmd->len = F_INSN_SIZE(ipfw_insn_log);
3969 			cmd->opcode = O_LOG;
3970 			if (ac && _substrcmp(*av, "logamount") == 0) {
3971 				ac--; av++;
3972 				NEED1("logamount requires argument");
3973 				l = atoi(*av);
3974 				if (l < 0)
3975 					errx(EX_DATAERR,
3976 					    "logamount must be positive");
3977 				c->max_log = l;
3978 				ac--; av++;
3979 			} else {
3980 				len = sizeof(c->max_log);
3981 				if (sysctlbyname("net.inet.ip.fw.verbose_limit",
3982 				    &c->max_log, &len, NULL, 0) == -1)
3983 					errx(1, "sysctlbyname(\"%s\")",
3984 					    "net.inet.ip.fw.verbose_limit");
3985 			}
3986 		    }
3987 			break;
3988 
3989 		case TOK_ALTQ:
3990 		    {
3991 			ipfw_insn_altq *a = (ipfw_insn_altq *)cmd;
3992 
3993 			NEED1("missing altq queue name");
3994 			if (have_altq)
3995 				errx(EX_DATAERR,
3996 				    "altq cannot be specified more than once");
3997 			have_altq = (ipfw_insn *)a;
3998 			cmd->len = F_INSN_SIZE(ipfw_insn_altq);
3999 			cmd->opcode = O_ALTQ;
4000 			fill_altq_qid(&a->qid, *av);
4001 			ac--; av++;
4002 		    }
4003 			break;
4004 
4005 		default:
4006 			abort();
4007 		}
4008 		cmd = next_cmd(cmd);
4009 	}
4010 
4011 	if (have_state)	/* must be a check-state, we are done */
4012 		goto done;
4013 
4014 #define OR_START(target)					\
4015 	if (ac && (*av[0] == '(' || *av[0] == '{')) {		\
4016 		if (open_par)					\
4017 			errx(EX_USAGE, "nested \"(\" not allowed\n"); \
4018 		prev = NULL;					\
4019 		open_par = 1;					\
4020 		if ( (av[0])[1] == '\0') {			\
4021 			ac--; av++;				\
4022 		} else						\
4023 			(*av)++;				\
4024 	}							\
4025 	target:							\
4026 
4027 
4028 #define	CLOSE_PAR						\
4029 	if (open_par) {						\
4030 		if (ac && (					\
4031 		    strcmp(*av, ")") == 0 ||			\
4032 		    strcmp(*av, "}") == 0)) {			\
4033 			prev = NULL;				\
4034 			open_par = 0;				\
4035 			ac--; av++;				\
4036 		} else						\
4037 			errx(EX_USAGE, "missing \")\"\n");	\
4038 	}
4039 
4040 #define NOT_BLOCK						\
4041 	if (ac && _substrcmp(*av, "not") == 0) {		\
4042 		if (cmd->len & F_NOT)				\
4043 			errx(EX_USAGE, "double \"not\" not allowed\n"); \
4044 		cmd->len |= F_NOT;				\
4045 		ac--; av++;					\
4046 	}
4047 
4048 #define OR_BLOCK(target)					\
4049 	if (ac && _substrcmp(*av, "or") == 0) {		\
4050 		if (prev == NULL || open_par == 0)		\
4051 			errx(EX_DATAERR, "invalid OR block");	\
4052 		prev->len |= F_OR;				\
4053 		ac--; av++;					\
4054 		goto target;					\
4055 	}							\
4056 	CLOSE_PAR;
4057 
4058 	first_cmd = cmd;
4059 
4060 #if 0
4061 	/*
4062 	 * MAC addresses, optional.
4063 	 * If we have this, we skip the part "proto from src to dst"
4064 	 * and jump straight to the option parsing.
4065 	 */
4066 	NOT_BLOCK;
4067 	NEED1("missing protocol");
4068 	if (_substrcmp(*av, "MAC") == 0 ||
4069 	    _substrcmp(*av, "mac") == 0) {
4070 		ac--; av++;	/* the "MAC" keyword */
4071 		add_mac(cmd, ac, av); /* exits in case of errors */
4072 		cmd = next_cmd(cmd);
4073 		ac -= 2; av += 2;	/* dst-mac and src-mac */
4074 		NOT_BLOCK;
4075 		NEED1("missing mac type");
4076 		if (add_mactype(cmd, ac, av[0]))
4077 			cmd = next_cmd(cmd);
4078 		ac--; av++;	/* any or mac-type */
4079 		goto read_options;
4080 	}
4081 #endif
4082 
4083 	/*
4084 	 * protocol, mandatory
4085 	 */
4086     OR_START(get_proto);
4087 	NOT_BLOCK;
4088 	NEED1("missing protocol");
4089 	if (add_proto_compat(cmd, *av, &proto)) {
4090 		av++; ac--;
4091 		if (F_LEN(cmd) != 0) {
4092 			prev = cmd;
4093 			cmd = next_cmd(cmd);
4094 		}
4095 	} else if (first_cmd != cmd) {
4096 		errx(EX_DATAERR, "invalid protocol ``%s''", *av);
4097 	} else
4098 		goto read_options;
4099     OR_BLOCK(get_proto);
4100 
4101 	/*
4102 	 * "from", mandatory
4103 	 */
4104 	if (!ac || _substrcmp(*av, "from") != 0)
4105 		errx(EX_USAGE, "missing ``from''");
4106 	ac--; av++;
4107 
4108 	/*
4109 	 * source IP, mandatory
4110 	 */
4111     OR_START(source_ip);
4112 	NOT_BLOCK;	/* optional "not" */
4113 	NEED1("missing source address");
4114 	if (add_src(cmd, *av, proto)) {
4115 		ac--; av++;
4116 		if (F_LEN(cmd) != 0) {	/* ! any */
4117 			prev = cmd;
4118 			cmd = next_cmd(cmd);
4119 		}
4120 	} else
4121 		errx(EX_USAGE, "bad source address %s", *av);
4122     OR_BLOCK(source_ip);
4123 
4124 	/*
4125 	 * source ports, optional
4126 	 */
4127 	NOT_BLOCK;	/* optional "not" */
4128 	if (ac) {
4129 		if (_substrcmp(*av, "any") == 0 ||
4130 		    add_ports(cmd, *av, proto, O_IP_SRCPORT)) {
4131 			ac--; av++;
4132 			if (F_LEN(cmd) != 0)
4133 				cmd = next_cmd(cmd);
4134 		}
4135 	}
4136 
4137 	/*
4138 	 * "to", mandatory
4139 	 */
4140 	if (!ac || _substrcmp(*av, "to") != 0)
4141 		errx(EX_USAGE, "missing ``to''");
4142 	av++; ac--;
4143 
4144 	/*
4145 	 * destination, mandatory
4146 	 */
4147     OR_START(dest_ip);
4148 	NOT_BLOCK;	/* optional "not" */
4149 	NEED1("missing dst address");
4150 	if (add_dst(cmd, *av, proto)) {
4151 		ac--; av++;
4152 		if (F_LEN(cmd) != 0) {	/* ! any */
4153 			prev = cmd;
4154 			cmd = next_cmd(cmd);
4155 		}
4156 	} else
4157 		errx( EX_USAGE, "bad destination address %s", *av);
4158     OR_BLOCK(dest_ip);
4159 
4160 	/*
4161 	 * dest. ports, optional
4162 	 */
4163 	NOT_BLOCK;	/* optional "not" */
4164 	if (ac) {
4165 		if (_substrcmp(*av, "any") == 0 ||
4166 		    add_ports(cmd, *av, proto, O_IP_DSTPORT)) {
4167 			ac--; av++;
4168 			if (F_LEN(cmd) != 0)
4169 				cmd = next_cmd(cmd);
4170 		}
4171 	}
4172 
4173 read_options:
4174 	if (ac && first_cmd == cmd) {
4175 		/*
4176 		 * nothing specified so far, store in the rule to ease
4177 		 * printout later.
4178 		 */
4179 		 rule->_pad = 1;
4180 	}
4181 	prev = NULL;
4182 	while (ac) {
4183 		char *s;
4184 		ipfw_insn_u32 *cmd32;	/* alias for cmd */
4185 
4186 		s = *av;
4187 		cmd32 = (ipfw_insn_u32 *)cmd;
4188 
4189 		if (*s == '!') {	/* alternate syntax for NOT */
4190 			if (cmd->len & F_NOT)
4191 				errx(EX_USAGE, "double \"not\" not allowed\n");
4192 			cmd->len = F_NOT;
4193 			s++;
4194 		}
4195 		i = match_token(rule_options, s);
4196 		ac--; av++;
4197 		switch(i) {
4198 		case TOK_NOT:
4199 			if (cmd->len & F_NOT)
4200 				errx(EX_USAGE, "double \"not\" not allowed\n");
4201 			cmd->len = F_NOT;
4202 			break;
4203 
4204 		case TOK_OR:
4205 			if (open_par == 0 || prev == NULL)
4206 				errx(EX_USAGE, "invalid \"or\" block\n");
4207 			prev->len |= F_OR;
4208 			break;
4209 
4210 		case TOK_STARTBRACE:
4211 			if (open_par)
4212 				errx(EX_USAGE, "+nested \"(\" not allowed\n");
4213 			open_par = 1;
4214 			break;
4215 
4216 		case TOK_ENDBRACE:
4217 			if (!open_par)
4218 				errx(EX_USAGE, "+missing \")\"\n");
4219 			open_par = 0;
4220 			prev = NULL;
4221         		break;
4222 
4223 		case TOK_IN:
4224 			fill_cmd(cmd, O_IN, 0, 0);
4225 			break;
4226 
4227 		case TOK_OUT:
4228 			cmd->len ^= F_NOT; /* toggle F_NOT */
4229 			fill_cmd(cmd, O_IN, 0, 0);
4230 			break;
4231 
4232 		case TOK_DIVERTED:
4233 			fill_cmd(cmd, O_DIVERTED, 0, 3);
4234 			break;
4235 
4236 		case TOK_DIVERTEDLOOPBACK:
4237 			fill_cmd(cmd, O_DIVERTED, 0, 1);
4238 			break;
4239 
4240 		case TOK_DIVERTEDOUTPUT:
4241 			fill_cmd(cmd, O_DIVERTED, 0, 2);
4242 			break;
4243 
4244 		case TOK_FRAG:
4245 			fill_cmd(cmd, O_FRAG, 0, 0);
4246 			break;
4247 
4248 		case TOK_LAYER2:
4249 			fill_cmd(cmd, O_LAYER2, 0, 0);
4250 			break;
4251 
4252 		case TOK_XMIT:
4253 		case TOK_RECV:
4254 		case TOK_VIA:
4255 			NEED1("recv, xmit, via require interface name"
4256 				" or address");
4257 			fill_iface((ipfw_insn_if *)cmd, av[0]);
4258 			ac--; av++;
4259 			if (F_LEN(cmd) == 0)	/* not a valid address */
4260 				break;
4261 			if (i == TOK_XMIT)
4262 				cmd->opcode = O_XMIT;
4263 			else if (i == TOK_RECV)
4264 				cmd->opcode = O_RECV;
4265 			else if (i == TOK_VIA)
4266 				cmd->opcode = O_VIA;
4267 			break;
4268 
4269 		case TOK_ICMPTYPES:
4270 			NEED1("icmptypes requires list of types");
4271 			fill_icmptypes((ipfw_insn_u32 *)cmd, *av);
4272 			av++; ac--;
4273 			break;
4274 
4275 		case TOK_ICMP6TYPES:
4276 			NEED1("icmptypes requires list of types");
4277 			fill_icmp6types((ipfw_insn_icmp6 *)cmd, *av);
4278 			av++; ac--;
4279 			break;
4280 
4281 		case TOK_IPTTL:
4282 			NEED1("ipttl requires TTL");
4283 			if (strpbrk(*av, "-,")) {
4284 			    if (!add_ports(cmd, *av, 0, O_IPTTL))
4285 				errx(EX_DATAERR, "invalid ipttl %s", *av);
4286 			} else
4287 			    fill_cmd(cmd, O_IPTTL, 0, strtoul(*av, NULL, 0));
4288 			ac--; av++;
4289 			break;
4290 
4291 		case TOK_IPID:
4292 			NEED1("ipid requires id");
4293 			if (strpbrk(*av, "-,")) {
4294 			    if (!add_ports(cmd, *av, 0, O_IPID))
4295 				errx(EX_DATAERR, "invalid ipid %s", *av);
4296 			} else
4297 			    fill_cmd(cmd, O_IPID, 0, strtoul(*av, NULL, 0));
4298 			ac--; av++;
4299 			break;
4300 
4301 		case TOK_IPLEN:
4302 			NEED1("iplen requires length");
4303 			if (strpbrk(*av, "-,")) {
4304 			    if (!add_ports(cmd, *av, 0, O_IPLEN))
4305 				errx(EX_DATAERR, "invalid ip len %s", *av);
4306 			} else
4307 			    fill_cmd(cmd, O_IPLEN, 0, strtoul(*av, NULL, 0));
4308 			ac--; av++;
4309 			break;
4310 
4311 		case TOK_IPVER:
4312 			NEED1("ipver requires version");
4313 			fill_cmd(cmd, O_IPVER, 0, strtoul(*av, NULL, 0));
4314 			ac--; av++;
4315 			break;
4316 
4317 		case TOK_IPPRECEDENCE:
4318 			NEED1("ipprecedence requires value");
4319 			fill_cmd(cmd, O_IPPRECEDENCE, 0,
4320 			    (strtoul(*av, NULL, 0) & 7) << 5);
4321 			ac--; av++;
4322 			break;
4323 
4324 		case TOK_IPOPTS:
4325 			NEED1("missing argument for ipoptions");
4326 			fill_flags(cmd, O_IPOPT, f_ipopts, *av);
4327 			ac--; av++;
4328 			break;
4329 
4330 		case TOK_IPTOS:
4331 			NEED1("missing argument for iptos");
4332 			fill_flags(cmd, O_IPTOS, f_iptos, *av);
4333 			ac--; av++;
4334 			break;
4335 
4336 		case TOK_UID:
4337 			NEED1("uid requires argument");
4338 		    {
4339 			char *end;
4340 			uid_t uid;
4341 			struct passwd *pwd;
4342 
4343 			cmd->opcode = O_UID;
4344 			uid = strtoul(*av, &end, 0);
4345 			pwd = (*end == '\0') ? getpwuid(uid) : getpwnam(*av);
4346 			if (pwd == NULL)
4347 				errx(EX_DATAERR, "uid \"%s\" nonexistent", *av);
4348 			cmd32->d[0] = pwd->pw_uid;
4349 			cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
4350 			ac--; av++;
4351 		    }
4352 			break;
4353 
4354 		case TOK_GID:
4355 			NEED1("gid requires argument");
4356 		    {
4357 			char *end;
4358 			gid_t gid;
4359 			struct group *grp;
4360 
4361 			cmd->opcode = O_GID;
4362 			gid = strtoul(*av, &end, 0);
4363 			grp = (*end == '\0') ? getgrgid(gid) : getgrnam(*av);
4364 			if (grp == NULL)
4365 				errx(EX_DATAERR, "gid \"%s\" nonexistent", *av);
4366 			cmd32->d[0] = grp->gr_gid;
4367 			cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
4368 			ac--; av++;
4369 		    }
4370 			break;
4371 
4372 		case TOK_JAIL:
4373 			NEED1("jail requires argument");
4374 		    {
4375 			char *end;
4376 			int jid;
4377 
4378 			cmd->opcode = O_JAIL;
4379 			jid = (int)strtol(*av, &end, 0);
4380 			if (jid < 0 || *end != '\0')
4381 				errx(EX_DATAERR, "jail requires prison ID");
4382 			cmd32->d[0] = (uint32_t)jid;
4383 			cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
4384 			ac--; av++;
4385 		    }
4386 			break;
4387 
4388 		case TOK_ESTAB:
4389 			fill_cmd(cmd, O_ESTAB, 0, 0);
4390 			break;
4391 
4392 		case TOK_SETUP:
4393 			fill_cmd(cmd, O_TCPFLAGS, 0,
4394 				(TH_SYN) | ( (TH_ACK) & 0xff) <<8 );
4395 			break;
4396 
4397 		case TOK_TCPDATALEN:
4398 			NEED1("tcpdatalen requires length");
4399 			if (strpbrk(*av, "-,")) {
4400 			    if (!add_ports(cmd, *av, 0, O_TCPDATALEN))
4401 				errx(EX_DATAERR, "invalid tcpdata len %s", *av);
4402 			} else
4403 			    fill_cmd(cmd, O_TCPDATALEN, 0,
4404 				    strtoul(*av, NULL, 0));
4405 			ac--; av++;
4406 			break;
4407 
4408 		case TOK_TCPOPTS:
4409 			NEED1("missing argument for tcpoptions");
4410 			fill_flags(cmd, O_TCPOPTS, f_tcpopts, *av);
4411 			ac--; av++;
4412 			break;
4413 
4414 		case TOK_TCPSEQ:
4415 		case TOK_TCPACK:
4416 			NEED1("tcpseq/tcpack requires argument");
4417 			cmd->len = F_INSN_SIZE(ipfw_insn_u32);
4418 			cmd->opcode = (i == TOK_TCPSEQ) ? O_TCPSEQ : O_TCPACK;
4419 			cmd32->d[0] = htonl(strtoul(*av, NULL, 0));
4420 			ac--; av++;
4421 			break;
4422 
4423 		case TOK_TCPWIN:
4424 			NEED1("tcpwin requires length");
4425 			fill_cmd(cmd, O_TCPWIN, 0,
4426 			    htons(strtoul(*av, NULL, 0)));
4427 			ac--; av++;
4428 			break;
4429 
4430 		case TOK_TCPFLAGS:
4431 			NEED1("missing argument for tcpflags");
4432 			cmd->opcode = O_TCPFLAGS;
4433 			fill_flags(cmd, O_TCPFLAGS, f_tcpflags, *av);
4434 			ac--; av++;
4435 			break;
4436 
4437 		case TOK_KEEPSTATE:
4438 			if (open_par)
4439 				errx(EX_USAGE, "keep-state cannot be part "
4440 				    "of an or block");
4441 			if (have_state)
4442 				errx(EX_USAGE, "only one of keep-state "
4443 					"and limit is allowed");
4444 			have_state = cmd;
4445 			fill_cmd(cmd, O_KEEP_STATE, 0, 0);
4446 			break;
4447 
4448 		case TOK_LIMIT:
4449 			if (open_par)
4450 				errx(EX_USAGE, "limit cannot be part "
4451 				    "of an or block");
4452 			if (have_state)
4453 				errx(EX_USAGE, "only one of keep-state "
4454 					"and limit is allowed");
4455 			NEED1("limit needs mask and # of connections");
4456 			have_state = cmd;
4457 		    {
4458 			ipfw_insn_limit *c = (ipfw_insn_limit *)cmd;
4459 
4460 			cmd->len = F_INSN_SIZE(ipfw_insn_limit);
4461 			cmd->opcode = O_LIMIT;
4462 			c->limit_mask = 0;
4463 			c->conn_limit = 0;
4464 			for (; ac >1 ;) {
4465 				int val;
4466 
4467 				val = match_token(limit_masks, *av);
4468 				if (val <= 0)
4469 					break;
4470 				c->limit_mask |= val;
4471 				ac--; av++;
4472 			}
4473 			c->conn_limit = atoi(*av);
4474 			if (c->conn_limit == 0)
4475 				errx(EX_USAGE, "limit: limit must be >0");
4476 			if (c->limit_mask == 0)
4477 				errx(EX_USAGE, "missing limit mask");
4478 			ac--; av++;
4479 		    }
4480 			break;
4481 
4482 		case TOK_PROTO:
4483 			NEED1("missing protocol");
4484 			if (add_proto(cmd, *av, &proto)) {
4485 				ac--; av++;
4486 			} else
4487 				errx(EX_DATAERR, "invalid protocol ``%s''",
4488 				    *av);
4489 			break;
4490 
4491 		case TOK_SRCIP:
4492 			NEED1("missing source IP");
4493 			if (add_srcip(cmd, *av)) {
4494 				ac--; av++;
4495 			}
4496 			break;
4497 
4498 		case TOK_DSTIP:
4499 			NEED1("missing destination IP");
4500 			if (add_dstip(cmd, *av)) {
4501 				ac--; av++;
4502 			}
4503 			break;
4504 
4505 		case TOK_SRCIP6:
4506 			NEED1("missing source IP6");
4507 			if (add_srcip6(cmd, *av)) {
4508 				ac--; av++;
4509 			}
4510 			break;
4511 
4512 		case TOK_DSTIP6:
4513 			NEED1("missing destination IP6");
4514 			if (add_dstip6(cmd, *av)) {
4515 				ac--; av++;
4516 			}
4517 			break;
4518 
4519 		case TOK_SRCPORT:
4520 			NEED1("missing source port");
4521 			if (_substrcmp(*av, "any") == 0 ||
4522 			    add_ports(cmd, *av, proto, O_IP_SRCPORT)) {
4523 				ac--; av++;
4524 			} else
4525 				errx(EX_DATAERR, "invalid source port %s", *av);
4526 			break;
4527 
4528 		case TOK_DSTPORT:
4529 			NEED1("missing destination port");
4530 			if (_substrcmp(*av, "any") == 0 ||
4531 			    add_ports(cmd, *av, proto, O_IP_DSTPORT)) {
4532 				ac--; av++;
4533 			} else
4534 				errx(EX_DATAERR, "invalid destination port %s",
4535 				    *av);
4536 			break;
4537 
4538 		case TOK_MAC:
4539 			if (add_mac(cmd, ac, av)) {
4540 				ac -= 2; av += 2;
4541 			}
4542 			break;
4543 
4544 		case TOK_MACTYPE:
4545 			NEED1("missing mac type");
4546 			if (!add_mactype(cmd, ac, *av))
4547 				errx(EX_DATAERR, "invalid mac type %s", *av);
4548 			ac--; av++;
4549 			break;
4550 
4551 		case TOK_VERREVPATH:
4552 			fill_cmd(cmd, O_VERREVPATH, 0, 0);
4553 			break;
4554 
4555 		case TOK_VERSRCREACH:
4556 			fill_cmd(cmd, O_VERSRCREACH, 0, 0);
4557 			break;
4558 
4559 		case TOK_ANTISPOOF:
4560 			fill_cmd(cmd, O_ANTISPOOF, 0, 0);
4561 			break;
4562 
4563 		case TOK_IPSEC:
4564 			fill_cmd(cmd, O_IPSEC, 0, 0);
4565 			break;
4566 
4567 		case TOK_IPV6:
4568 			fill_cmd(cmd, O_IP6, 0, 0);
4569 			break;
4570 
4571 		case TOK_IPV4:
4572 			fill_cmd(cmd, O_IP4, 0, 0);
4573 			break;
4574 
4575 		case TOK_EXT6HDR:
4576 			fill_ext6hdr( cmd, *av );
4577 			ac--; av++;
4578 			break;
4579 
4580 		case TOK_FLOWID:
4581 			if (proto != IPPROTO_IPV6 )
4582 				errx( EX_USAGE, "flow-id filter is active "
4583 				    "only for ipv6 protocol\n");
4584 			fill_flow6( (ipfw_insn_u32 *) cmd, *av );
4585 			ac--; av++;
4586 			break;
4587 
4588 		case TOK_COMMENT:
4589 			fill_comment(cmd, ac, av);
4590 			av += ac;
4591 			ac = 0;
4592 			break;
4593 
4594 		default:
4595 			errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s);
4596 		}
4597 		if (F_LEN(cmd) > 0) {	/* prepare to advance */
4598 			prev = cmd;
4599 			cmd = next_cmd(cmd);
4600 		}
4601 	}
4602 
4603 done:
4604 	/*
4605 	 * Now copy stuff into the rule.
4606 	 * If we have a keep-state option, the first instruction
4607 	 * must be a PROBE_STATE (which is generated here).
4608 	 * If we have a LOG option, it was stored as the first command,
4609 	 * and now must be moved to the top of the action part.
4610 	 */
4611 	dst = (ipfw_insn *)rule->cmd;
4612 
4613 	/*
4614 	 * First thing to write into the command stream is the match probability.
4615 	 */
4616 	if (match_prob != 1) { /* 1 means always match */
4617 		dst->opcode = O_PROB;
4618 		dst->len = 2;
4619 		*((int32_t *)(dst+1)) = (int32_t)(match_prob * 0x7fffffff);
4620 		dst += dst->len;
4621 	}
4622 
4623 	/*
4624 	 * generate O_PROBE_STATE if necessary
4625 	 */
4626 	if (have_state && have_state->opcode != O_CHECK_STATE) {
4627 		fill_cmd(dst, O_PROBE_STATE, 0, 0);
4628 		dst = next_cmd(dst);
4629 	}
4630 	/*
4631 	 * copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT, O_ALTQ
4632 	 */
4633 	for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) {
4634 		i = F_LEN(src);
4635 
4636 		switch (src->opcode) {
4637 		case O_LOG:
4638 		case O_KEEP_STATE:
4639 		case O_LIMIT:
4640 		case O_ALTQ:
4641 			break;
4642 		default:
4643 			bcopy(src, dst, i * sizeof(uint32_t));
4644 			dst += i;
4645 		}
4646 	}
4647 
4648 	/*
4649 	 * put back the have_state command as last opcode
4650 	 */
4651 	if (have_state && have_state->opcode != O_CHECK_STATE) {
4652 		i = F_LEN(have_state);
4653 		bcopy(have_state, dst, i * sizeof(uint32_t));
4654 		dst += i;
4655 	}
4656 	/*
4657 	 * start action section
4658 	 */
4659 	rule->act_ofs = dst - rule->cmd;
4660 
4661 	/*
4662 	 * put back O_LOG, O_ALTQ if necessary
4663 	 */
4664 	if (have_log) {
4665 		i = F_LEN(have_log);
4666 		bcopy(have_log, dst, i * sizeof(uint32_t));
4667 		dst += i;
4668 	}
4669 	if (have_altq) {
4670 		i = F_LEN(have_altq);
4671 		bcopy(have_altq, dst, i * sizeof(uint32_t));
4672 		dst += i;
4673 	}
4674 	/*
4675 	 * copy all other actions
4676 	 */
4677 	for (src = (ipfw_insn *)actbuf; src != action; src += i) {
4678 		i = F_LEN(src);
4679 		bcopy(src, dst, i * sizeof(uint32_t));
4680 		dst += i;
4681 	}
4682 
4683 	rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd);
4684 	i = (char *)dst - (char *)rule;
4685 	if (do_cmd(IP_FW_ADD, rule, (uintptr_t)&i) == -1)
4686 		err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD");
4687 	if (!do_quiet)
4688 		show_ipfw(rule, 0, 0);
4689 }
4690 
4691 static void
4692 zero(int ac, char *av[], int optname /* IP_FW_ZERO or IP_FW_RESETLOG */)
4693 {
4694 	int rulenum;
4695 	int failed = EX_OK;
4696 	char const *name = optname == IP_FW_ZERO ?  "ZERO" : "RESETLOG";
4697 
4698 	av++; ac--;
4699 
4700 	if (!ac) {
4701 		/* clear all entries */
4702 		if (do_cmd(optname, NULL, 0) < 0)
4703 			err(EX_UNAVAILABLE, "setsockopt(IP_FW_%s)", name);
4704 		if (!do_quiet)
4705 			printf("%s.\n", optname == IP_FW_ZERO ?
4706 			    "Accounting cleared":"Logging counts reset");
4707 
4708 		return;
4709 	}
4710 
4711 	while (ac) {
4712 		/* Rule number */
4713 		if (isdigit(**av)) {
4714 			rulenum = atoi(*av);
4715 			av++;
4716 			ac--;
4717 			if (do_cmd(optname, &rulenum, sizeof rulenum)) {
4718 				warn("rule %u: setsockopt(IP_FW_%s)",
4719 				    rulenum, name);
4720 				failed = EX_UNAVAILABLE;
4721 			} else if (!do_quiet)
4722 				printf("Entry %d %s.\n", rulenum,
4723 				    optname == IP_FW_ZERO ?
4724 					"cleared" : "logging count reset");
4725 		} else {
4726 			errx(EX_USAGE, "invalid rule number ``%s''", *av);
4727 		}
4728 	}
4729 	if (failed != EX_OK)
4730 		exit(failed);
4731 }
4732 
4733 static void
4734 flush(int force)
4735 {
4736 	int cmd = do_pipe ? IP_DUMMYNET_FLUSH : IP_FW_FLUSH;
4737 
4738 	if (!force && !do_quiet) { /* need to ask user */
4739 		int c;
4740 
4741 		printf("Are you sure? [yn] ");
4742 		fflush(stdout);
4743 		do {
4744 			c = toupper(getc(stdin));
4745 			while (c != '\n' && getc(stdin) != '\n')
4746 				if (feof(stdin))
4747 					return; /* and do not flush */
4748 		} while (c != 'Y' && c != 'N');
4749 		printf("\n");
4750 		if (c == 'N')	/* user said no */
4751 			return;
4752 	}
4753 	if (do_cmd(cmd, NULL, 0) < 0)
4754 		err(EX_UNAVAILABLE, "setsockopt(IP_%s_FLUSH)",
4755 		    do_pipe ? "DUMMYNET" : "FW");
4756 	if (!do_quiet)
4757 		printf("Flushed all %s.\n", do_pipe ? "pipes" : "rules");
4758 }
4759 
4760 /*
4761  * Free a the (locally allocated) copy of command line arguments.
4762  */
4763 static void
4764 free_args(int ac, char **av)
4765 {
4766 	int i;
4767 
4768 	for (i=0; i < ac; i++)
4769 		free(av[i]);
4770 	free(av);
4771 }
4772 
4773 /*
4774  * This one handles all table-related commands
4775  * 	ipfw table N add addr[/masklen] [value]
4776  * 	ipfw table N delete addr[/masklen]
4777  * 	ipfw table N flush
4778  * 	ipfw table N list
4779  */
4780 static void
4781 table_handler(int ac, char *av[])
4782 {
4783 	ipfw_table_entry ent;
4784 	ipfw_table *tbl;
4785 	int do_add;
4786 	char *p;
4787 	socklen_t l;
4788 	uint32_t a;
4789 
4790 	ac--; av++;
4791 	if (ac && isdigit(**av)) {
4792 		ent.tbl = atoi(*av);
4793 		ac--; av++;
4794 	} else
4795 		errx(EX_USAGE, "table number required");
4796 	NEED1("table needs command");
4797 	if (_substrcmp(*av, "add") == 0 ||
4798 	    _substrcmp(*av, "delete") == 0) {
4799 		do_add = **av == 'a';
4800 		ac--; av++;
4801 		if (!ac)
4802 			errx(EX_USAGE, "IP address required");
4803 		p = strchr(*av, '/');
4804 		if (p) {
4805 			*p++ = '\0';
4806 			ent.masklen = atoi(p);
4807 			if (ent.masklen > 32)
4808 				errx(EX_DATAERR, "bad width ``%s''", p);
4809 		} else
4810 			ent.masklen = 32;
4811 		if (lookup_host(*av, (struct in_addr *)&ent.addr) != 0)
4812 			errx(EX_NOHOST, "hostname ``%s'' unknown", *av);
4813 		ac--; av++;
4814 		if (do_add && ac)
4815 			ent.value = strtoul(*av, NULL, 0);
4816 		else
4817 			ent.value = 0;
4818 		if (do_cmd(do_add ? IP_FW_TABLE_ADD : IP_FW_TABLE_DEL,
4819 		    &ent, sizeof(ent)) < 0)
4820 			err(EX_OSERR, "setsockopt(IP_FW_TABLE_%s)",
4821 			    do_add ? "ADD" : "DEL");
4822 	} else if (_substrcmp(*av, "flush") == 0) {
4823 		if (do_cmd(IP_FW_TABLE_FLUSH, &ent.tbl, sizeof(ent.tbl)) < 0)
4824 			err(EX_OSERR, "setsockopt(IP_FW_TABLE_FLUSH)");
4825 	} else if (_substrcmp(*av, "list") == 0) {
4826 		a = ent.tbl;
4827 		l = sizeof(a);
4828 		if (do_cmd(IP_FW_TABLE_GETSIZE, &a, (uintptr_t)&l) < 0)
4829 			err(EX_OSERR, "getsockopt(IP_FW_TABLE_GETSIZE)");
4830 		l = sizeof(*tbl) + a * sizeof(ipfw_table_entry);
4831 		tbl = malloc(l);
4832 		if (tbl == NULL)
4833 			err(EX_OSERR, "malloc");
4834 		tbl->tbl = ent.tbl;
4835 		if (do_cmd(IP_FW_TABLE_LIST, tbl, (uintptr_t)&l) < 0)
4836 			err(EX_OSERR, "getsockopt(IP_FW_TABLE_LIST)");
4837 		for (a = 0; a < tbl->cnt; a++) {
4838 			printf("%s/%u %u\n",
4839 			    inet_ntoa(*(struct in_addr *)&tbl->ent[a].addr),
4840 			    tbl->ent[a].masklen, tbl->ent[a].value);
4841 		}
4842 	} else
4843 		errx(EX_USAGE, "invalid table command %s", *av);
4844 }
4845 
4846 /*
4847  * Called with the arguments (excluding program name).
4848  * Returns 0 if successful, 1 if empty command, errx() in case of errors.
4849  */
4850 static int
4851 ipfw_main(int oldac, char **oldav)
4852 {
4853 	int ch, ac, save_ac;
4854 	char **av, **save_av;
4855 	int do_acct = 0;		/* Show packet/byte count */
4856 
4857 #define WHITESP		" \t\f\v\n\r"
4858 	if (oldac == 0)
4859 		return 1;
4860 	else if (oldac == 1) {
4861 		/*
4862 		 * If we are called with a single string, try to split it into
4863 		 * arguments for subsequent parsing.
4864 		 * But first, remove spaces after a ',', by copying the string
4865 		 * in-place.
4866 		 */
4867 		char *arg = oldav[0];	/* The string... */
4868 		int l = strlen(arg);
4869 		int copy = 0;		/* 1 if we need to copy, 0 otherwise */
4870 		int i, j;
4871 		for (i = j = 0; i < l; i++) {
4872 			if (arg[i] == '#')	/* comment marker */
4873 				break;
4874 			if (copy) {
4875 				arg[j++] = arg[i];
4876 				copy = !index("," WHITESP, arg[i]);
4877 			} else {
4878 				copy = !index(WHITESP, arg[i]);
4879 				if (copy)
4880 					arg[j++] = arg[i];
4881 			}
4882 		}
4883 		if (!copy && j > 0)	/* last char was a 'blank', remove it */
4884 			j--;
4885 		l = j;			/* the new argument length */
4886 		arg[j++] = '\0';
4887 		if (l == 0)		/* empty string! */
4888 			return 1;
4889 
4890 		/*
4891 		 * First, count number of arguments. Because of the previous
4892 		 * processing, this is just the number of blanks plus 1.
4893 		 */
4894 		for (i = 0, ac = 1; i < l; i++)
4895 			if (index(WHITESP, arg[i]) != NULL)
4896 				ac++;
4897 
4898 		av = calloc(ac, sizeof(char *));
4899 
4900 		/*
4901 		 * Second, copy arguments from cmd[] to av[]. For each one,
4902 		 * j is the initial character, i is the one past the end.
4903 		 */
4904 		for (ac = 0, i = j = 0; i < l; i++)
4905 			if (index(WHITESP, arg[i]) != NULL || i == l-1) {
4906 				if (i == l-1)
4907 					i++;
4908 				av[ac] = calloc(i-j+1, 1);
4909 				bcopy(arg+j, av[ac], i-j);
4910 				ac++;
4911 				j = i + 1;
4912 			}
4913 	} else {
4914 		/*
4915 		 * If an argument ends with ',' join with the next one.
4916 		 */
4917 		int first, i, l;
4918 
4919 		av = calloc(oldac, sizeof(char *));
4920 		for (first = i = ac = 0, l = 0; i < oldac; i++) {
4921 			char *arg = oldav[i];
4922 			int k = strlen(arg);
4923 
4924 			l += k;
4925 			if (arg[k-1] != ',' || i == oldac-1) {
4926 				/* Time to copy. */
4927 				av[ac] = calloc(l+1, 1);
4928 				for (l=0; first <= i; first++) {
4929 					strcat(av[ac]+l, oldav[first]);
4930 					l += strlen(oldav[first]);
4931 				}
4932 				ac++;
4933 				l = 0;
4934 				first = i+1;
4935 			}
4936 		}
4937 	}
4938 
4939 	/* Set the force flag for non-interactive processes */
4940 	if (!do_force)
4941 		do_force = !isatty(STDIN_FILENO);
4942 
4943 	/* Save arguments for final freeing of memory. */
4944 	save_ac = ac;
4945 	save_av = av;
4946 
4947 	optind = optreset = 0;
4948 	while ((ch = getopt(ac, av, "abcdefhnNqs:STtv")) != -1)
4949 		switch (ch) {
4950 		case 'a':
4951 			do_acct = 1;
4952 			break;
4953 
4954 		case 'b':
4955 			comment_only = 1;
4956 			do_compact = 1;
4957 			break;
4958 
4959 		case 'c':
4960 			do_compact = 1;
4961 			break;
4962 
4963 		case 'd':
4964 			do_dynamic = 1;
4965 			break;
4966 
4967 		case 'e':
4968 			do_expired = 1;
4969 			break;
4970 
4971 		case 'f':
4972 			do_force = 1;
4973 			break;
4974 
4975 		case 'h': /* help */
4976 			free_args(save_ac, save_av);
4977 			help();
4978 			break;	/* NOTREACHED */
4979 
4980 		case 'n':
4981 			test_only = 1;
4982 			break;
4983 
4984 		case 'N':
4985 			do_resolv = 1;
4986 			break;
4987 
4988 		case 'q':
4989 			do_quiet = 1;
4990 			break;
4991 
4992 		case 's': /* sort */
4993 			do_sort = atoi(optarg);
4994 			break;
4995 
4996 		case 'S':
4997 			show_sets = 1;
4998 			break;
4999 
5000 		case 't':
5001 			do_time = 1;
5002 			break;
5003 
5004 		case 'T':
5005 			do_time = 2;	/* numeric timestamp */
5006 			break;
5007 
5008 		case 'v': /* verbose */
5009 			verbose = 1;
5010 			break;
5011 
5012 		default:
5013 			free_args(save_ac, save_av);
5014 			return 1;
5015 		}
5016 
5017 	ac -= optind;
5018 	av += optind;
5019 	NEED1("bad arguments, for usage summary ``ipfw''");
5020 
5021 	/*
5022 	 * An undocumented behaviour of ipfw1 was to allow rule numbers first,
5023 	 * e.g. "100 add allow ..." instead of "add 100 allow ...".
5024 	 * In case, swap first and second argument to get the normal form.
5025 	 */
5026 	if (ac > 1 && isdigit(*av[0])) {
5027 		char *p = av[0];
5028 
5029 		av[0] = av[1];
5030 		av[1] = p;
5031 	}
5032 
5033 	/*
5034 	 * optional: pipe or queue
5035 	 */
5036 	do_pipe = 0;
5037 	if (_substrcmp(*av, "pipe") == 0)
5038 		do_pipe = 1;
5039 	else if (_substrcmp(*av, "queue") == 0)
5040 		do_pipe = 2;
5041 	if (do_pipe) {
5042 		ac--;
5043 		av++;
5044 	}
5045 	NEED1("missing command");
5046 
5047 	/*
5048 	 * For pipes and queues we normally say 'pipe NN config'
5049 	 * but the code is easier to parse as 'pipe config NN'
5050 	 * so we swap the two arguments.
5051 	 */
5052 	if (do_pipe > 0 && ac > 1 && isdigit(*av[0])) {
5053 		char *p = av[0];
5054 
5055 		av[0] = av[1];
5056 		av[1] = p;
5057 	}
5058 
5059 	if (_substrcmp(*av, "add") == 0)
5060 		add(ac, av);
5061 	else if (do_pipe && _substrcmp(*av, "config") == 0)
5062 		config_pipe(ac, av);
5063 	else if (_substrcmp(*av, "delete") == 0)
5064 		delete(ac, av);
5065 	else if (_substrcmp(*av, "flush") == 0)
5066 		flush(do_force);
5067 	else if (_substrcmp(*av, "zero") == 0)
5068 		zero(ac, av, IP_FW_ZERO);
5069 	else if (_substrcmp(*av, "resetlog") == 0)
5070 		zero(ac, av, IP_FW_RESETLOG);
5071 	else if (_substrcmp(*av, "print") == 0 ||
5072 	         _substrcmp(*av, "list") == 0)
5073 		list(ac, av, do_acct);
5074 	else if (_substrcmp(*av, "set") == 0)
5075 		sets_handler(ac, av);
5076 	else if (_substrcmp(*av, "table") == 0)
5077 		table_handler(ac, av);
5078 	else if (_substrcmp(*av, "enable") == 0)
5079 		sysctl_handler(ac, av, 1);
5080 	else if (_substrcmp(*av, "disable") == 0)
5081 		sysctl_handler(ac, av, 0);
5082 	else if (_substrcmp(*av, "show") == 0)
5083 		list(ac, av, 1 /* show counters */);
5084 	else
5085 		errx(EX_USAGE, "bad command `%s'", *av);
5086 
5087 	/* Free memory allocated in the argument parsing. */
5088 	free_args(save_ac, save_av);
5089 	return 0;
5090 }
5091 
5092 
5093 static void
5094 ipfw_readfile(int ac, char *av[])
5095 {
5096 #define MAX_ARGS	32
5097 	char	buf[BUFSIZ];
5098 	char	*cmd = NULL, *filename = av[ac-1];
5099 	int	c, lineno=0;
5100 	FILE	*f = NULL;
5101 	pid_t	preproc = 0;
5102 
5103 	filename = av[ac-1];
5104 
5105 	while ((c = getopt(ac, av, "cfNnp:qS")) != -1) {
5106 		switch(c) {
5107 		case 'c':
5108 			do_compact = 1;
5109 			break;
5110 
5111 		case 'f':
5112 			do_force = 1;
5113 			break;
5114 
5115 		case 'N':
5116 			do_resolv = 1;
5117 			break;
5118 
5119 		case 'n':
5120 			test_only = 1;
5121 			break;
5122 
5123 		case 'p':
5124 			cmd = optarg;
5125 			/*
5126 			 * Skip previous args and delete last one, so we
5127 			 * pass all but the last argument to the preprocessor
5128 			 * via av[optind-1]
5129 			 */
5130 			av += optind - 1;
5131 			ac -= optind - 1;
5132 			av[ac-1] = NULL;
5133 			fprintf(stderr, "command is %s\n", av[0]);
5134 			break;
5135 
5136 		case 'q':
5137 			do_quiet = 1;
5138 			break;
5139 
5140 		case 'S':
5141 			show_sets = 1;
5142 			break;
5143 
5144 		default:
5145 			errx(EX_USAGE, "bad arguments, for usage"
5146 			     " summary ``ipfw''");
5147 		}
5148 
5149 		if (cmd != NULL)
5150 			break;
5151 	}
5152 
5153 	if (cmd == NULL && ac != optind + 1) {
5154 		fprintf(stderr, "ac %d, optind %d\n", ac, optind);
5155 		errx(EX_USAGE, "extraneous filename arguments");
5156 	}
5157 
5158 	if ((f = fopen(filename, "r")) == NULL)
5159 		err(EX_UNAVAILABLE, "fopen: %s", filename);
5160 
5161 	if (cmd != NULL) {			/* pipe through preprocessor */
5162 		int pipedes[2];
5163 
5164 		if (pipe(pipedes) == -1)
5165 			err(EX_OSERR, "cannot create pipe");
5166 
5167 		preproc = fork();
5168 		if (preproc == -1)
5169 			err(EX_OSERR, "cannot fork");
5170 
5171 		if (preproc == 0) {
5172 			/*
5173 			 * Child, will run the preprocessor with the
5174 			 * file on stdin and the pipe on stdout.
5175 			 */
5176 			if (dup2(fileno(f), 0) == -1
5177 			    || dup2(pipedes[1], 1) == -1)
5178 				err(EX_OSERR, "dup2()");
5179 			fclose(f);
5180 			close(pipedes[1]);
5181 			close(pipedes[0]);
5182 			execvp(cmd, av);
5183 			err(EX_OSERR, "execvp(%s) failed", cmd);
5184 		} else { /* parent, will reopen f as the pipe */
5185 			fclose(f);
5186 			close(pipedes[1]);
5187 			if ((f = fdopen(pipedes[0], "r")) == NULL) {
5188 				int savederrno = errno;
5189 
5190 				(void)kill(preproc, SIGTERM);
5191 				errno = savederrno;
5192 				err(EX_OSERR, "fdopen()");
5193 			}
5194 		}
5195 	}
5196 
5197 	while (fgets(buf, BUFSIZ, f)) {		/* read commands */
5198 		char linename[10];
5199 		char *args[1];
5200 
5201 		lineno++;
5202 		sprintf(linename, "Line %d", lineno);
5203 		setprogname(linename); /* XXX */
5204 		args[0] = buf;
5205 		ipfw_main(1, args);
5206 	}
5207 	fclose(f);
5208 	if (cmd != NULL) {
5209 		int status;
5210 
5211 		if (waitpid(preproc, &status, 0) == -1)
5212 			errx(EX_OSERR, "waitpid()");
5213 		if (WIFEXITED(status) && WEXITSTATUS(status) != EX_OK)
5214 			errx(EX_UNAVAILABLE,
5215 			    "preprocessor exited with status %d",
5216 			    WEXITSTATUS(status));
5217 		else if (WIFSIGNALED(status))
5218 			errx(EX_UNAVAILABLE,
5219 			    "preprocessor exited with signal %d",
5220 			    WTERMSIG(status));
5221 	}
5222 }
5223 
5224 int
5225 main(int ac, char *av[])
5226 {
5227 	/*
5228 	 * If the last argument is an absolute pathname, interpret it
5229 	 * as a file to be preprocessed.
5230 	 */
5231 
5232 	if (ac > 1 && av[ac - 1][0] == '/' && access(av[ac - 1], R_OK) == 0)
5233 		ipfw_readfile(ac, av);
5234 	else {
5235 		if (ipfw_main(ac-1, av+1))
5236 			show_usage();
5237 	}
5238 	return EX_OK;
5239 }
5240