1 /*- 2 * Copyright (c) 2002-2003 Luigi Rizzo 3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4 * Copyright (c) 1994 Ugen J.S.Antsilevich 5 * 6 * Idea and grammar partially left from: 7 * Copyright (c) 1993 Daniel Boulet 8 * 9 * Redistribution and use in source forms, with and without modification, 10 * are permitted provided that this entire comment appears intact. 11 * 12 * Redistribution in binary form may occur without any restrictions. 13 * Obviously, it would be nice if you gave credit where credit is due 14 * but requiring it would be too onerous. 15 * 16 * This software is provided ``AS IS'' without any warranties of any kind. 17 * 18 * NEW command line interface for IP firewall facility 19 * 20 * $FreeBSD$ 21 */ 22 23 #include <sys/types.h> 24 #include <sys/param.h> 25 #include <sys/socket.h> 26 #include <sys/sockio.h> 27 #include <sys/sysctl.h> 28 29 #include "ipfw2.h" 30 31 #include <ctype.h> 32 #include <err.h> 33 #include <errno.h> 34 #include <grp.h> 35 #include <jail.h> 36 #include <netdb.h> 37 #include <pwd.h> 38 #include <stdio.h> 39 #include <stdarg.h> 40 #include <stdint.h> 41 #include <stdlib.h> 42 #include <string.h> 43 #include <sysexits.h> 44 #include <time.h> /* ctime */ 45 #include <timeconv.h> /* _long_to_time */ 46 #include <unistd.h> 47 #include <fcntl.h> 48 #include <stddef.h> /* offsetof */ 49 50 #include <net/ethernet.h> 51 #include <net/if.h> /* only IFNAMSIZ */ 52 #include <netinet/in.h> 53 #include <netinet/in_systm.h> /* only n_short, n_long */ 54 #include <netinet/ip.h> 55 #include <netinet/ip_icmp.h> 56 #include <netinet/ip_fw.h> 57 #include <netinet/tcp.h> 58 #include <arpa/inet.h> 59 60 struct cmdline_opts g_co; /* global options */ 61 62 struct format_opts { 63 int bcwidth; 64 int pcwidth; 65 int show_counters; 66 int show_time; /* show timestamp */ 67 uint32_t set_mask; /* enabled sets mask */ 68 uint32_t flags; /* request flags */ 69 uint32_t first; /* first rule to request */ 70 uint32_t last; /* last rule to request */ 71 uint32_t dcnt; /* number of dynamic states */ 72 ipfw_obj_ctlv *tstate; /* table state data */ 73 }; 74 75 int resvd_set_number = RESVD_SET; 76 77 static int ipfw_socket = -1; 78 79 #define CHECK_LENGTH(v, len) do { \ 80 if ((v) < (len)) \ 81 errx(EX_DATAERR, "Rule too long"); \ 82 } while (0) 83 /* 84 * Check if we have enough space in cmd buffer. Note that since 85 * first 8? u32 words are reserved by reserved header, full cmd 86 * buffer can't be used, so we need to protect from buffer overrun 87 * only. At the beginning, cblen is less than actual buffer size by 88 * size of ipfw_insn_u32 instruction + 1 u32 work. This eliminates need 89 * for checking small instructions fitting in given range. 90 * We also (ab)use the fact that ipfw_insn is always the first field 91 * for any custom instruction. 92 */ 93 #define CHECK_CMDLEN CHECK_LENGTH(cblen, F_LEN((ipfw_insn *)cmd)) 94 95 #define GET_UINT_ARG(arg, min, max, tok, s_x) do { \ 96 if (!av[0]) \ 97 errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \ 98 if (_substrcmp(*av, "tablearg") == 0) { \ 99 arg = IP_FW_TARG; \ 100 break; \ 101 } \ 102 \ 103 { \ 104 long _xval; \ 105 char *end; \ 106 \ 107 _xval = strtol(*av, &end, 10); \ 108 \ 109 if (!isdigit(**av) || *end != '\0' || (_xval == 0 && errno == EINVAL)) \ 110 errx(EX_DATAERR, "%s: invalid argument: %s", \ 111 match_value(s_x, tok), *av); \ 112 \ 113 if (errno == ERANGE || _xval < min || _xval > max) \ 114 errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \ 115 match_value(s_x, tok), min, max, *av); \ 116 \ 117 if (_xval == IP_FW_TARG) \ 118 errx(EX_DATAERR, "%s: illegal argument value: %s", \ 119 match_value(s_x, tok), *av); \ 120 arg = _xval; \ 121 } \ 122 } while (0) 123 124 static struct _s_x f_tcpflags[] = { 125 { "syn", TH_SYN }, 126 { "fin", TH_FIN }, 127 { "ack", TH_ACK }, 128 { "psh", TH_PUSH }, 129 { "rst", TH_RST }, 130 { "urg", TH_URG }, 131 { "tcp flag", 0 }, 132 { NULL, 0 } 133 }; 134 135 static struct _s_x f_tcpopts[] = { 136 { "mss", IP_FW_TCPOPT_MSS }, 137 { "maxseg", IP_FW_TCPOPT_MSS }, 138 { "window", IP_FW_TCPOPT_WINDOW }, 139 { "sack", IP_FW_TCPOPT_SACK }, 140 { "ts", IP_FW_TCPOPT_TS }, 141 { "timestamp", IP_FW_TCPOPT_TS }, 142 { "cc", IP_FW_TCPOPT_CC }, 143 { "tcp option", 0 }, 144 { NULL, 0 } 145 }; 146 147 /* 148 * IP options span the range 0 to 255 so we need to remap them 149 * (though in fact only the low 5 bits are significant). 150 */ 151 static struct _s_x f_ipopts[] = { 152 { "ssrr", IP_FW_IPOPT_SSRR}, 153 { "lsrr", IP_FW_IPOPT_LSRR}, 154 { "rr", IP_FW_IPOPT_RR}, 155 { "ts", IP_FW_IPOPT_TS}, 156 { "ip option", 0 }, 157 { NULL, 0 } 158 }; 159 160 static struct _s_x f_iptos[] = { 161 { "lowdelay", IPTOS_LOWDELAY}, 162 { "throughput", IPTOS_THROUGHPUT}, 163 { "reliability", IPTOS_RELIABILITY}, 164 { "mincost", IPTOS_MINCOST}, 165 { "congestion", IPTOS_ECN_CE}, 166 { "ecntransport", IPTOS_ECN_ECT0}, 167 { "ip tos option", 0}, 168 { NULL, 0 } 169 }; 170 171 static struct _s_x f_ipoff[] = { 172 { "rf", IP_RF >> 8 }, 173 { "df", IP_DF >> 8 }, 174 { "mf", IP_MF >> 8 }, 175 { "offset", 0x1 }, 176 { NULL, 0} 177 }; 178 179 struct _s_x f_ipdscp[] = { 180 { "af11", IPTOS_DSCP_AF11 >> 2 }, /* 001010 */ 181 { "af12", IPTOS_DSCP_AF12 >> 2 }, /* 001100 */ 182 { "af13", IPTOS_DSCP_AF13 >> 2 }, /* 001110 */ 183 { "af21", IPTOS_DSCP_AF21 >> 2 }, /* 010010 */ 184 { "af22", IPTOS_DSCP_AF22 >> 2 }, /* 010100 */ 185 { "af23", IPTOS_DSCP_AF23 >> 2 }, /* 010110 */ 186 { "af31", IPTOS_DSCP_AF31 >> 2 }, /* 011010 */ 187 { "af32", IPTOS_DSCP_AF32 >> 2 }, /* 011100 */ 188 { "af33", IPTOS_DSCP_AF33 >> 2 }, /* 011110 */ 189 { "af41", IPTOS_DSCP_AF41 >> 2 }, /* 100010 */ 190 { "af42", IPTOS_DSCP_AF42 >> 2 }, /* 100100 */ 191 { "af43", IPTOS_DSCP_AF43 >> 2 }, /* 100110 */ 192 { "be", IPTOS_DSCP_CS0 >> 2 }, /* 000000 */ 193 { "va", IPTOS_DSCP_VA >> 2 }, /* 101100 */ 194 { "ef", IPTOS_DSCP_EF >> 2 }, /* 101110 */ 195 { "cs0", IPTOS_DSCP_CS0 >> 2 }, /* 000000 */ 196 { "cs1", IPTOS_DSCP_CS1 >> 2 }, /* 001000 */ 197 { "cs2", IPTOS_DSCP_CS2 >> 2 }, /* 010000 */ 198 { "cs3", IPTOS_DSCP_CS3 >> 2 }, /* 011000 */ 199 { "cs4", IPTOS_DSCP_CS4 >> 2 }, /* 100000 */ 200 { "cs5", IPTOS_DSCP_CS5 >> 2 }, /* 101000 */ 201 { "cs6", IPTOS_DSCP_CS6 >> 2 }, /* 110000 */ 202 { "cs7", IPTOS_DSCP_CS7 >> 2 }, /* 100000 */ 203 { NULL, 0 } 204 }; 205 206 static struct _s_x limit_masks[] = { 207 {"all", DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT}, 208 {"src-addr", DYN_SRC_ADDR}, 209 {"src-port", DYN_SRC_PORT}, 210 {"dst-addr", DYN_DST_ADDR}, 211 {"dst-port", DYN_DST_PORT}, 212 {NULL, 0} 213 }; 214 215 /* 216 * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines 217 * This is only used in this code. 218 */ 219 #define IPPROTO_ETHERTYPE 0x1000 220 static struct _s_x ether_types[] = { 221 /* 222 * Note, we cannot use "-:&/" in the names because they are field 223 * separators in the type specifications. Also, we use s = NULL as 224 * end-delimiter, because a type of 0 can be legal. 225 */ 226 { "ip", 0x0800 }, 227 { "ipv4", 0x0800 }, 228 { "ipv6", 0x86dd }, 229 { "arp", 0x0806 }, 230 { "rarp", 0x8035 }, 231 { "vlan", 0x8100 }, 232 { "loop", 0x9000 }, 233 { "trail", 0x1000 }, 234 { "at", 0x809b }, 235 { "atalk", 0x809b }, 236 { "aarp", 0x80f3 }, 237 { "pppoe_disc", 0x8863 }, 238 { "pppoe_sess", 0x8864 }, 239 { "ipx_8022", 0x00E0 }, 240 { "ipx_8023", 0x0000 }, 241 { "ipx_ii", 0x8137 }, 242 { "ipx_snap", 0x8137 }, 243 { "ipx", 0x8137 }, 244 { "ns", 0x0600 }, 245 { NULL, 0 } 246 }; 247 248 static struct _s_x rule_eactions[] = { 249 { "nat64clat", TOK_NAT64CLAT }, 250 { "nat64lsn", TOK_NAT64LSN }, 251 { "nat64stl", TOK_NAT64STL }, 252 { "nptv6", TOK_NPTV6 }, 253 { "tcp-setmss", TOK_TCPSETMSS }, 254 { NULL, 0 } /* terminator */ 255 }; 256 257 static struct _s_x rule_actions[] = { 258 { "abort6", TOK_ABORT6 }, 259 { "abort", TOK_ABORT }, 260 { "accept", TOK_ACCEPT }, 261 { "pass", TOK_ACCEPT }, 262 { "allow", TOK_ACCEPT }, 263 { "permit", TOK_ACCEPT }, 264 { "count", TOK_COUNT }, 265 { "pipe", TOK_PIPE }, 266 { "queue", TOK_QUEUE }, 267 { "divert", TOK_DIVERT }, 268 { "tee", TOK_TEE }, 269 { "netgraph", TOK_NETGRAPH }, 270 { "ngtee", TOK_NGTEE }, 271 { "fwd", TOK_FORWARD }, 272 { "forward", TOK_FORWARD }, 273 { "skipto", TOK_SKIPTO }, 274 { "deny", TOK_DENY }, 275 { "drop", TOK_DENY }, 276 { "reject", TOK_REJECT }, 277 { "reset6", TOK_RESET6 }, 278 { "reset", TOK_RESET }, 279 { "unreach6", TOK_UNREACH6 }, 280 { "unreach", TOK_UNREACH }, 281 { "check-state", TOK_CHECKSTATE }, 282 { "//", TOK_COMMENT }, 283 { "nat", TOK_NAT }, 284 { "reass", TOK_REASS }, 285 { "setfib", TOK_SETFIB }, 286 { "setdscp", TOK_SETDSCP }, 287 { "call", TOK_CALL }, 288 { "return", TOK_RETURN }, 289 { "eaction", TOK_EACTION }, 290 { "tcp-setmss", TOK_TCPSETMSS }, 291 { "setmark", TOK_SETMARK }, 292 { NULL, 0 } /* terminator */ 293 }; 294 295 static struct _s_x rule_action_params[] = { 296 { "altq", TOK_ALTQ }, 297 { "log", TOK_LOG }, 298 { "tag", TOK_TAG }, 299 { "untag", TOK_UNTAG }, 300 { NULL, 0 } /* terminator */ 301 }; 302 303 /* 304 * The 'lookup' instruction accepts one of the following arguments. 305 * Arguments are passed as v[1] in O_DST_LOOKUP options. 306 */ 307 static struct _s_x lookup_keys[] = { 308 { "dst-ip", LOOKUP_DST_IP }, 309 { "src-ip", LOOKUP_SRC_IP }, 310 { "dst-port", LOOKUP_DST_PORT }, 311 { "src-port", LOOKUP_SRC_PORT }, 312 { "dst-mac", LOOKUP_DST_MAC }, 313 { "src-mac", LOOKUP_SRC_MAC }, 314 { "uid", LOOKUP_UID }, 315 { "jail", LOOKUP_JAIL }, 316 { "dscp", LOOKUP_DSCP }, 317 { "mark", LOOKUP_MARK }, 318 { NULL, 0 }, 319 }; 320 321 static struct _s_x rule_options[] = { 322 { "tagged", TOK_TAGGED }, 323 { "uid", TOK_UID }, 324 { "gid", TOK_GID }, 325 { "jail", TOK_JAIL }, 326 { "in", TOK_IN }, 327 { "limit", TOK_LIMIT }, 328 { "set-limit", TOK_SETLIMIT }, 329 { "keep-state", TOK_KEEPSTATE }, 330 { "record-state", TOK_RECORDSTATE }, 331 { "bridged", TOK_LAYER2 }, 332 { "layer2", TOK_LAYER2 }, 333 { "out", TOK_OUT }, 334 { "diverted", TOK_DIVERTED }, 335 { "diverted-loopback", TOK_DIVERTEDLOOPBACK }, 336 { "diverted-output", TOK_DIVERTEDOUTPUT }, 337 { "xmit", TOK_XMIT }, 338 { "recv", TOK_RECV }, 339 { "via", TOK_VIA }, 340 { "fragment", TOK_FRAG }, 341 { "frag", TOK_FRAG }, 342 { "fib", TOK_FIB }, 343 { "ipoptions", TOK_IPOPTS }, 344 { "ipopts", TOK_IPOPTS }, 345 { "iplen", TOK_IPLEN }, 346 { "ipid", TOK_IPID }, 347 { "ipprecedence", TOK_IPPRECEDENCE }, 348 { "dscp", TOK_DSCP }, 349 { "iptos", TOK_IPTOS }, 350 { "ipttl", TOK_IPTTL }, 351 { "ipversion", TOK_IPVER }, 352 { "ipver", TOK_IPVER }, 353 { "estab", TOK_ESTAB }, 354 { "established", TOK_ESTAB }, 355 { "setup", TOK_SETUP }, 356 { "sockarg", TOK_SOCKARG }, 357 { "tcpdatalen", TOK_TCPDATALEN }, 358 { "tcpflags", TOK_TCPFLAGS }, 359 { "tcpflgs", TOK_TCPFLAGS }, 360 { "tcpmss", TOK_TCPMSS }, 361 { "tcpoptions", TOK_TCPOPTS }, 362 { "tcpopts", TOK_TCPOPTS }, 363 { "tcpseq", TOK_TCPSEQ }, 364 { "tcpack", TOK_TCPACK }, 365 { "tcpwin", TOK_TCPWIN }, 366 { "icmptype", TOK_ICMPTYPES }, 367 { "icmptypes", TOK_ICMPTYPES }, 368 { "dst-ip", TOK_DSTIP }, 369 { "src-ip", TOK_SRCIP }, 370 { "dst-port", TOK_DSTPORT }, 371 { "src-port", TOK_SRCPORT }, 372 { "dst-mac", TOK_DSTMAC }, 373 { "src-mac", TOK_SRCMAC }, 374 { "proto", TOK_PROTO }, 375 { "MAC", TOK_MAC }, 376 { "mac", TOK_MAC }, 377 { "mac-type", TOK_MACTYPE }, 378 { "verrevpath", TOK_VERREVPATH }, 379 { "versrcreach", TOK_VERSRCREACH }, 380 { "antispoof", TOK_ANTISPOOF }, 381 { "ipsec", TOK_IPSEC }, 382 { "icmp6type", TOK_ICMP6TYPES }, 383 { "icmp6types", TOK_ICMP6TYPES }, 384 { "ext6hdr", TOK_EXT6HDR }, 385 { "flow-id", TOK_FLOWID }, 386 { "ipv6", TOK_IPV6 }, 387 { "ip6", TOK_IPV6 }, 388 { "ipv4", TOK_IPV4 }, 389 { "ip4", TOK_IPV4 }, 390 { "dst-ipv6", TOK_DSTIP6 }, 391 { "dst-ip6", TOK_DSTIP6 }, 392 { "src-ipv6", TOK_SRCIP6 }, 393 { "src-ip6", TOK_SRCIP6 }, 394 { "lookup", TOK_LOOKUP }, 395 { "flow", TOK_FLOW }, 396 { "mark", TOK_MARK }, 397 { "defer-action", TOK_SKIPACTION }, 398 { "defer-immediate-action", TOK_SKIPACTION }, 399 { "//", TOK_COMMENT }, 400 401 { "not", TOK_NOT }, /* pseudo option */ 402 { "!", /* escape ? */ TOK_NOT }, /* pseudo option */ 403 { "or", TOK_OR }, /* pseudo option */ 404 { "|", /* escape */ TOK_OR }, /* pseudo option */ 405 { "{", TOK_STARTBRACE }, /* pseudo option */ 406 { "(", TOK_STARTBRACE }, /* pseudo option */ 407 { "}", TOK_ENDBRACE }, /* pseudo option */ 408 { ")", TOK_ENDBRACE }, /* pseudo option */ 409 { NULL, 0 } /* terminator */ 410 }; 411 412 void bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg); 413 static int ipfw_get_config(struct cmdline_opts *co, struct format_opts *fo, 414 ipfw_cfg_lheader **pcfg, size_t *psize); 415 static int ipfw_show_config(struct cmdline_opts *co, struct format_opts *fo, 416 ipfw_cfg_lheader *cfg, size_t sz, int ac, char **av); 417 static void ipfw_list_tifaces(void); 418 419 struct tidx; 420 static uint16_t pack_object(struct tidx *tstate, const char *name, int otype); 421 static uint16_t pack_table(struct tidx *tstate, const char *name); 422 423 static char *table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx); 424 static void object_sort_ctlv(ipfw_obj_ctlv *ctlv); 425 static char *object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx, 426 uint16_t type); 427 428 int 429 is_ipfw(void) 430 { 431 return (g_co.prog == cmdline_prog_ipfw); 432 } 433 434 /* 435 * Simple string buffer API. 436 * Used to simplify buffer passing between function and for 437 * transparent overrun handling. 438 */ 439 440 /* 441 * Allocates new buffer of given size @sz. 442 * 443 * Returns 0 on success. 444 */ 445 int 446 bp_alloc(struct buf_pr *b, size_t size) 447 { 448 memset(b, 0, sizeof(struct buf_pr)); 449 450 if ((b->buf = calloc(1, size)) == NULL) 451 return (ENOMEM); 452 453 b->ptr = b->buf; 454 b->size = size; 455 b->avail = b->size; 456 457 return (0); 458 } 459 460 void 461 bp_free(struct buf_pr *b) 462 { 463 464 free(b->buf); 465 } 466 467 /* 468 * Flushes buffer so new writer start from beginning. 469 */ 470 void 471 bp_flush(struct buf_pr *b) 472 { 473 474 b->ptr = b->buf; 475 b->avail = b->size; 476 b->buf[0] = '\0'; 477 } 478 479 /* 480 * Print message specified by @format and args. 481 * Automatically manage buffer space and transparently handle 482 * buffer overruns. 483 * 484 * Returns number of bytes that should have been printed. 485 */ 486 int 487 bprintf(struct buf_pr *b, const char *format, ...) 488 { 489 va_list args; 490 int i; 491 492 va_start(args, format); 493 494 i = vsnprintf(b->ptr, b->avail, format, args); 495 va_end(args); 496 497 if (i < 0 || (size_t)i > b->avail) { 498 /* Overflow or print error */ 499 b->avail = 0; 500 } else { 501 b->ptr += i; 502 b->avail -= i; 503 } 504 505 b->needed += i; 506 507 return (i); 508 } 509 510 /* 511 * Special values printer for tablearg-aware opcodes. 512 */ 513 void 514 bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg) 515 { 516 517 if (str != NULL) 518 bprintf(bp, "%s", str); 519 if (arg == IP_FW_TARG) 520 bprintf(bp, "tablearg"); 521 else 522 bprintf(bp, "%u", arg); 523 } 524 525 /* 526 * Helper routine to print a possibly unaligned uint64_t on 527 * various platform. If width > 0, print the value with 528 * the desired width, followed by a space; 529 * otherwise, return the required width. 530 */ 531 int 532 pr_u64(struct buf_pr *b, void *pd, int width) 533 { 534 #ifdef TCC 535 #define U64_FMT "I64" 536 #else 537 #define U64_FMT "llu" 538 #endif 539 uint64_t u; 540 unsigned long long d; 541 542 bcopy (pd, &u, sizeof(u)); 543 d = u; 544 return (width > 0) ? 545 bprintf(b, "%*" U64_FMT " ", width, d) : 546 snprintf(NULL, 0, "%" U64_FMT, d) ; 547 #undef U64_FMT 548 } 549 550 551 void * 552 safe_calloc(size_t number, size_t size) 553 { 554 void *ret = calloc(number, size); 555 556 if (ret == NULL) 557 err(EX_OSERR, "calloc"); 558 return ret; 559 } 560 561 void * 562 safe_realloc(void *ptr, size_t size) 563 { 564 void *ret = realloc(ptr, size); 565 566 if (ret == NULL) 567 err(EX_OSERR, "realloc"); 568 return ret; 569 } 570 571 /* 572 * Compare things like interface or table names. 573 */ 574 int 575 stringnum_cmp(const char *a, const char *b) 576 { 577 int la, lb; 578 579 la = strlen(a); 580 lb = strlen(b); 581 582 if (la > lb) 583 return (1); 584 else if (la < lb) 585 return (-01); 586 587 return (strcmp(a, b)); 588 } 589 590 struct debug_header { 591 uint16_t cmd_type; 592 uint16_t spare1; 593 uint32_t opt_name; 594 uint32_t total_len; 595 uint32_t spare2; 596 }; 597 598 /* 599 * conditionally runs the command. 600 * Selected options or negative -> getsockopt 601 */ 602 int 603 do_cmd(int optname, void *optval, uintptr_t optlen) 604 { 605 int i; 606 607 if (g_co.debug_only) { 608 struct debug_header dbg = { 609 .cmd_type = 1, 610 .opt_name = optname, 611 .total_len = optlen + sizeof(struct debug_header), 612 }; 613 write(1, &dbg, sizeof(dbg)); 614 write(1, optval, optlen); 615 } 616 617 if (g_co.test_only) 618 return (0); 619 620 if (ipfw_socket == -1) 621 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 622 if (ipfw_socket < 0) 623 err(EX_UNAVAILABLE, "socket"); 624 625 if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET || 626 optname == IP_FW_ADD || optname == IP_FW3 || 627 optname == IP_FW_NAT_GET_CONFIG || 628 optname < 0 || 629 optname == IP_FW_NAT_GET_LOG) { 630 if (optname < 0) 631 optname = -optname; 632 i = getsockopt(ipfw_socket, IPPROTO_IP, optname, optval, 633 (socklen_t *)optlen); 634 } else { 635 i = setsockopt(ipfw_socket, IPPROTO_IP, optname, optval, optlen); 636 } 637 return (i); 638 } 639 640 /* 641 * do_set3 - pass ipfw control cmd to kernel 642 * @optname: option name 643 * @optval: pointer to option data 644 * @optlen: option length 645 * 646 * Assumes op3 header is already embedded. 647 * Calls setsockopt() with IP_FW3 as kernel-visible opcode. 648 * Returns 0 on success or errno otherwise. 649 */ 650 int 651 do_set3(int optname, ip_fw3_opheader *op3, size_t optlen) 652 { 653 654 op3->opcode = optname; 655 656 if (g_co.debug_only) { 657 struct debug_header dbg = { 658 .cmd_type = 2, 659 .opt_name = optname, 660 .total_len = optlen, sizeof(struct debug_header), 661 }; 662 write(1, &dbg, sizeof(dbg)); 663 write(1, op3, optlen); 664 } 665 666 if (g_co.test_only) 667 return (0); 668 669 if (ipfw_socket == -1) 670 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 671 if (ipfw_socket < 0) 672 err(EX_UNAVAILABLE, "socket"); 673 674 675 return (setsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3, optlen)); 676 } 677 678 /* 679 * do_get3 - pass ipfw control cmd to kernel 680 * @optname: option name 681 * @optval: pointer to option data 682 * @optlen: pointer to option length 683 * 684 * Assumes op3 header is already embedded. 685 * Calls getsockopt() with IP_FW3 as kernel-visible opcode. 686 * Returns 0 on success or errno otherwise. 687 */ 688 int 689 do_get3(int optname, ip_fw3_opheader *op3, size_t *optlen) 690 { 691 int error; 692 socklen_t len; 693 694 op3->opcode = optname; 695 696 if (g_co.debug_only) { 697 struct debug_header dbg = { 698 .cmd_type = 3, 699 .opt_name = optname, 700 .total_len = *optlen + sizeof(struct debug_header), 701 }; 702 write(1, &dbg, sizeof(dbg)); 703 write(1, op3, *optlen); 704 } 705 706 if (g_co.test_only) 707 return (0); 708 709 if (ipfw_socket == -1) 710 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 711 if (ipfw_socket < 0) 712 err(EX_UNAVAILABLE, "socket"); 713 714 715 len = *optlen; 716 error = getsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3, &len); 717 *optlen = len; 718 719 return (error); 720 } 721 722 /** 723 * match_token takes a table and a string, returns the value associated 724 * with the string (-1 in case of failure). 725 */ 726 int 727 match_token(struct _s_x *table, const char *string) 728 { 729 struct _s_x *pt; 730 uint i = strlen(string); 731 732 for (pt = table ; i && pt->s != NULL ; pt++) 733 if (strlen(pt->s) == i && !bcmp(string, pt->s, i)) 734 return pt->x; 735 return (-1); 736 } 737 738 /** 739 * match_token_relaxed takes a table and a string, returns the value associated 740 * with the string for the best match. 741 * 742 * Returns: 743 * value from @table for matched records 744 * -1 for non-matched records 745 * -2 if more than one records match @string. 746 */ 747 int 748 match_token_relaxed(struct _s_x *table, const char *string) 749 { 750 struct _s_x *pt, *m; 751 int i, c; 752 753 i = strlen(string); 754 c = 0; 755 756 for (pt = table ; i != 0 && pt->s != NULL ; pt++) { 757 if (strncmp(pt->s, string, i) != 0) 758 continue; 759 m = pt; 760 c++; 761 } 762 763 if (c == 1) 764 return (m->x); 765 766 return (c > 0 ? -2: -1); 767 } 768 769 int 770 get_token(struct _s_x *table, const char *string, const char *errbase) 771 { 772 int tcmd; 773 774 if ((tcmd = match_token_relaxed(table, string)) < 0) 775 errx(EX_USAGE, "%s %s %s", 776 (tcmd == 0) ? "invalid" : "ambiguous", errbase, string); 777 778 return (tcmd); 779 } 780 781 /** 782 * match_value takes a table and a value, returns the string associated 783 * with the value (NULL in case of failure). 784 */ 785 char const * 786 match_value(struct _s_x *p, int value) 787 { 788 for (; p->s != NULL; p++) 789 if (p->x == value) 790 return p->s; 791 return NULL; 792 } 793 794 size_t 795 concat_tokens(char *buf, size_t bufsize, struct _s_x *table, 796 const char *delimiter) 797 { 798 struct _s_x *pt; 799 int l; 800 size_t sz; 801 802 for (sz = 0, pt = table ; pt->s != NULL; pt++) { 803 l = snprintf(buf + sz, bufsize - sz, "%s%s", 804 (sz == 0) ? "" : delimiter, pt->s); 805 sz += l; 806 bufsize += l; 807 if (sz > bufsize) 808 return (bufsize); 809 } 810 811 return (sz); 812 } 813 814 /* 815 * helper function to process a set of flags and set bits in the 816 * appropriate masks. 817 */ 818 int 819 fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set, 820 uint32_t *clear) 821 { 822 char *q; /* points to the separator */ 823 int val; 824 uint32_t *which; /* mask we are working on */ 825 826 while (p && *p) { 827 if (*p == '!') { 828 p++; 829 which = clear; 830 } else 831 which = set; 832 q = strchr(p, ','); 833 if (q) 834 *q++ = '\0'; 835 val = match_token(flags, p); 836 if (val <= 0) { 837 if (e != NULL) 838 *e = p; 839 return (-1); 840 } 841 *which |= (uint32_t)val; 842 p = q; 843 } 844 return (0); 845 } 846 847 void 848 print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set) 849 { 850 char const *comma = ""; 851 int i, l; 852 853 for (i = 0; list[i].x != 0; i++) { 854 if ((set & list[i].x) == 0) 855 continue; 856 857 set &= ~list[i].x; 858 l = snprintf(buf, sz, "%s%s", comma, list[i].s); 859 if (l < 0 || (size_t)l >= sz) 860 return; 861 comma = ","; 862 buf += l; 863 sz -=l; 864 } 865 } 866 867 /* 868 * _substrcmp takes two strings and returns 1 if they do not match, 869 * and 0 if they match exactly or the first string is a sub-string 870 * of the second. A warning is printed to stderr in the case that the 871 * first string is a sub-string of the second. 872 * 873 * This function will be removed in the future through the usual 874 * deprecation process. 875 */ 876 int 877 _substrcmp(const char *str1, const char* str2) 878 { 879 880 if (strncmp(str1, str2, strlen(str1)) != 0) 881 return 1; 882 883 if (strlen(str1) != strlen(str2)) 884 warnx("DEPRECATED: '%s' matched '%s' as a sub-string", 885 str1, str2); 886 return 0; 887 } 888 889 /* 890 * _substrcmp2 takes three strings and returns 1 if the first two do not match, 891 * and 0 if they match exactly or the second string is a sub-string 892 * of the first. A warning is printed to stderr in the case that the 893 * first string does not match the third. 894 * 895 * This function exists to warn about the bizarre construction 896 * strncmp(str, "by", 2) which is used to allow people to use a shortcut 897 * for "bytes". The problem is that in addition to accepting "by", 898 * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any 899 * other string beginning with "by". 900 * 901 * This function will be removed in the future through the usual 902 * deprecation process. 903 */ 904 int 905 _substrcmp2(const char *str1, const char* str2, const char* str3) 906 { 907 908 if (strncmp(str1, str2, strlen(str2)) != 0) 909 return 1; 910 911 if (strcmp(str1, str3) != 0) 912 warnx("DEPRECATED: '%s' matched '%s'", 913 str1, str3); 914 return 0; 915 } 916 917 /* 918 * prints one port, symbolic or numeric 919 */ 920 static void 921 print_port(struct buf_pr *bp, int proto, uint16_t port) 922 { 923 924 if (proto == IPPROTO_ETHERTYPE) { 925 char const *s; 926 927 if (g_co.do_resolv && (s = match_value(ether_types, port)) ) 928 bprintf(bp, "%s", s); 929 else 930 bprintf(bp, "0x%04x", port); 931 } else { 932 struct servent *se = NULL; 933 if (g_co.do_resolv) { 934 struct protoent *pe = getprotobynumber(proto); 935 936 se = getservbyport(htons(port), pe ? pe->p_name : NULL); 937 } 938 if (se) 939 bprintf(bp, "%s", se->s_name); 940 else 941 bprintf(bp, "%d", port); 942 } 943 } 944 945 static struct _s_x _port_name[] = { 946 {"dst-port", O_IP_DSTPORT}, 947 {"src-port", O_IP_SRCPORT}, 948 {"ipid", O_IPID}, 949 {"iplen", O_IPLEN}, 950 {"ipttl", O_IPTTL}, 951 {"mac-type", O_MAC_TYPE}, 952 {"tcpdatalen", O_TCPDATALEN}, 953 {"tcpmss", O_TCPMSS}, 954 {"tcpwin", O_TCPWIN}, 955 {"tagged", O_TAGGED}, 956 {NULL, 0} 957 }; 958 959 /* 960 * Print the values in a list 16-bit items of the types above. 961 * XXX todo: add support for mask. 962 */ 963 static void 964 print_newports(struct buf_pr *bp, const ipfw_insn_u16 *cmd, int proto, int opcode) 965 { 966 const uint16_t *p = cmd->ports; 967 int i; 968 char const *sep; 969 970 if (opcode != 0) { 971 sep = match_value(_port_name, opcode); 972 if (sep == NULL) 973 sep = "???"; 974 bprintf(bp, " %s", sep); 975 } 976 sep = " "; 977 for (i = F_LEN((const ipfw_insn *)cmd) - 1; i > 0; i--, p += 2) { 978 bprintf(bp, "%s", sep); 979 print_port(bp, proto, p[0]); 980 if (p[0] != p[1]) { 981 bprintf(bp, "-"); 982 print_port(bp, proto, p[1]); 983 } 984 sep = ","; 985 } 986 } 987 988 /* 989 * Like strtol, but also translates service names into port numbers 990 * for some protocols. 991 * In particular: 992 * proto == -1 disables the protocol check; 993 * proto == IPPROTO_ETHERTYPE looks up an internal table 994 * proto == <some value in /etc/protocols> matches the values there. 995 * Returns *end == s in case the parameter is not found. 996 */ 997 static int 998 strtoport(char *s, char **end, int base, int proto) 999 { 1000 char *p, *buf; 1001 char *s1; 1002 int i; 1003 1004 *end = s; /* default - not found */ 1005 if (*s == '\0') 1006 return 0; /* not found */ 1007 1008 if (isdigit(*s)) 1009 return strtol(s, end, base); 1010 1011 /* 1012 * find separator. '\\' escapes the next char. 1013 */ 1014 for (s1 = s; *s1 && (isalnum(*s1) || *s1 == '\\' || 1015 *s1 == '_' || *s1 == '.') ; s1++) 1016 if (*s1 == '\\' && s1[1] != '\0') 1017 s1++; 1018 1019 buf = safe_calloc(s1 - s + 1, 1); 1020 1021 /* 1022 * copy into a buffer skipping backslashes 1023 */ 1024 for (p = s, i = 0; p != s1 ; p++) 1025 if (*p != '\\') 1026 buf[i++] = *p; 1027 buf[i++] = '\0'; 1028 1029 if (proto == IPPROTO_ETHERTYPE) { 1030 i = match_token(ether_types, buf); 1031 free(buf); 1032 if (i != -1) { /* found */ 1033 *end = s1; 1034 return i; 1035 } 1036 } else { 1037 struct protoent *pe = NULL; 1038 struct servent *se; 1039 1040 if (proto != 0) 1041 pe = getprotobynumber(proto); 1042 setservent(1); 1043 se = getservbyname(buf, pe ? pe->p_name : NULL); 1044 free(buf); 1045 if (se != NULL) { 1046 *end = s1; 1047 return ntohs(se->s_port); 1048 } 1049 } 1050 return 0; /* not found */ 1051 } 1052 1053 /* 1054 * Fill the body of the command with the list of port ranges. 1055 */ 1056 static int 1057 fill_newports(ipfw_insn_u16 *cmd, char *av, int proto, int cblen) 1058 { 1059 uint16_t a, b, *p = cmd->ports; 1060 int i = 0; 1061 char *s = av; 1062 1063 while (*s) { 1064 a = strtoport(av, &s, 0, proto); 1065 if (s == av) /* empty or invalid argument */ 1066 return (0); 1067 1068 CHECK_LENGTH(cblen, i + 2); 1069 1070 switch (*s) { 1071 case '-': /* a range */ 1072 av = s + 1; 1073 b = strtoport(av, &s, 0, proto); 1074 /* Reject expressions like '1-abc' or '1-2-3'. */ 1075 if (s == av || (*s != ',' && *s != '\0')) 1076 return (0); 1077 p[0] = a; 1078 p[1] = b; 1079 break; 1080 case ',': /* comma separated list */ 1081 case '\0': 1082 p[0] = p[1] = a; 1083 break; 1084 default: 1085 warnx("port list: invalid separator <%c> in <%s>", 1086 *s, av); 1087 return (0); 1088 } 1089 1090 i++; 1091 p += 2; 1092 av = s + 1; 1093 } 1094 if (i > 0) { 1095 if (i + 1 > F_LEN_MASK) 1096 errx(EX_DATAERR, "too many ports/ranges\n"); 1097 cmd->o.len |= i + 1; /* leave F_NOT and F_OR untouched */ 1098 } 1099 return (i); 1100 } 1101 1102 /* 1103 * Fill the body of the command with the list of DiffServ codepoints. 1104 */ 1105 static void 1106 fill_dscp(ipfw_insn *cmd, char *av, int cblen) 1107 { 1108 uint32_t *low, *high; 1109 char *s = av, *a; 1110 int code; 1111 1112 cmd->opcode = O_DSCP; 1113 cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1; 1114 1115 CHECK_CMDLEN; 1116 1117 low = (uint32_t *)(cmd + 1); 1118 high = low + 1; 1119 1120 *low = 0; 1121 *high = 0; 1122 1123 while (s != NULL) { 1124 a = strchr(s, ','); 1125 1126 if (a != NULL) 1127 *a++ = '\0'; 1128 1129 if (isalpha(*s)) { 1130 if ((code = match_token(f_ipdscp, s)) == -1) 1131 errx(EX_DATAERR, "Unknown DSCP code"); 1132 } else { 1133 code = strtoul(s, NULL, 10); 1134 if (code < 0 || code > 63) 1135 errx(EX_DATAERR, "Invalid DSCP value"); 1136 } 1137 1138 if (code >= 32) 1139 *high |= 1 << (code - 32); 1140 else 1141 *low |= 1 << code; 1142 1143 s = a; 1144 } 1145 } 1146 1147 /* 1148 * Fill the body of the command with mark value and mask. 1149 */ 1150 static void 1151 fill_mark(ipfw_insn *cmd, char *av, int cblen) 1152 { 1153 uint32_t *value, *mask; 1154 char *value_str; 1155 1156 cmd->opcode = O_MARK; 1157 cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1; 1158 1159 CHECK_CMDLEN; 1160 1161 value = (uint32_t *)(cmd + 1); 1162 mask = value + 1; 1163 1164 value_str = strsep(&av, ":"); 1165 1166 if (strcmp(value_str, "tablearg") == 0) { 1167 cmd->arg1 = IP_FW_TARG; 1168 *value = 0; 1169 } else { 1170 /* This is not a tablearg */ 1171 cmd->arg1 |= 0x8000; 1172 *value = strtoul(value_str, NULL, 0); 1173 } 1174 if (av) 1175 *mask = strtoul(av, NULL, 0); 1176 else 1177 *mask = 0xFFFFFFFF; 1178 1179 if ((*value & *mask) != *value) 1180 errx(EX_DATAERR, "Static mark value: some bits in value are" 1181 " set that will be masked out by mask " 1182 "(%#x & %#x) = %#x != %#x", 1183 *value, *mask, (*value & *mask), *value); 1184 } 1185 1186 static struct _s_x icmpcodes[] = { 1187 { "net", ICMP_UNREACH_NET }, 1188 { "host", ICMP_UNREACH_HOST }, 1189 { "protocol", ICMP_UNREACH_PROTOCOL }, 1190 { "port", ICMP_UNREACH_PORT }, 1191 { "needfrag", ICMP_UNREACH_NEEDFRAG }, 1192 { "srcfail", ICMP_UNREACH_SRCFAIL }, 1193 { "net-unknown", ICMP_UNREACH_NET_UNKNOWN }, 1194 { "host-unknown", ICMP_UNREACH_HOST_UNKNOWN }, 1195 { "isolated", ICMP_UNREACH_ISOLATED }, 1196 { "net-prohib", ICMP_UNREACH_NET_PROHIB }, 1197 { "host-prohib", ICMP_UNREACH_HOST_PROHIB }, 1198 { "tosnet", ICMP_UNREACH_TOSNET }, 1199 { "toshost", ICMP_UNREACH_TOSHOST }, 1200 { "filter-prohib", ICMP_UNREACH_FILTER_PROHIB }, 1201 { "host-precedence", ICMP_UNREACH_HOST_PRECEDENCE }, 1202 { "precedence-cutoff", ICMP_UNREACH_PRECEDENCE_CUTOFF }, 1203 { NULL, 0 } 1204 }; 1205 1206 static void 1207 fill_reject_code(u_short *codep, char *str) 1208 { 1209 int val; 1210 char *s; 1211 1212 val = strtoul(str, &s, 0); 1213 if (s == str || *s != '\0' || val >= 0x100) 1214 val = match_token(icmpcodes, str); 1215 if (val < 0) 1216 errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str); 1217 *codep = val; 1218 return; 1219 } 1220 1221 static void 1222 print_reject_code(struct buf_pr *bp, uint16_t code) 1223 { 1224 char const *s; 1225 1226 if ((s = match_value(icmpcodes, code)) != NULL) 1227 bprintf(bp, "unreach %s", s); 1228 else 1229 bprintf(bp, "unreach %u", code); 1230 } 1231 1232 /* 1233 * Returns the number of bits set (from left) in a contiguous bitmask, 1234 * or -1 if the mask is not contiguous. 1235 * XXX this needs a proper fix. 1236 * This effectively works on masks in big-endian (network) format. 1237 * when compiled on little endian architectures. 1238 * 1239 * First bit is bit 7 of the first byte -- note, for MAC addresses, 1240 * the first bit on the wire is bit 0 of the first byte. 1241 * len is the max length in bits. 1242 */ 1243 int 1244 contigmask(const uint8_t *p, int len) 1245 { 1246 int i, n; 1247 1248 for (i=0; i<len ; i++) 1249 if ( (p[i/8] & (1 << (7 - (i%8)))) == 0) /* first bit unset */ 1250 break; 1251 for (n=i+1; n < len; n++) 1252 if ( (p[n/8] & (1 << (7 - (n%8)))) != 0) 1253 return -1; /* mask not contiguous */ 1254 return i; 1255 } 1256 1257 /* 1258 * print flags set/clear in the two bitmasks passed as parameters. 1259 * There is a specialized check for f_tcpflags. 1260 */ 1261 static void 1262 print_flags(struct buf_pr *bp, char const *name, const ipfw_insn *cmd, 1263 struct _s_x *list) 1264 { 1265 char const *comma = ""; 1266 int i; 1267 uint8_t set = cmd->arg1 & 0xff; 1268 uint8_t clear = (cmd->arg1 >> 8) & 0xff; 1269 1270 if (list == f_tcpflags && set == TH_SYN && clear == TH_ACK) { 1271 bprintf(bp, " setup"); 1272 return; 1273 } 1274 1275 bprintf(bp, " %s ", name); 1276 for (i=0; list[i].x != 0; i++) { 1277 if (set & list[i].x) { 1278 set &= ~list[i].x; 1279 bprintf(bp, "%s%s", comma, list[i].s); 1280 comma = ","; 1281 } 1282 if (clear & list[i].x) { 1283 clear &= ~list[i].x; 1284 bprintf(bp, "%s!%s", comma, list[i].s); 1285 comma = ","; 1286 } 1287 } 1288 } 1289 1290 1291 /* 1292 * Print the ip address contained in a command. 1293 */ 1294 static void 1295 print_ip(struct buf_pr *bp, const struct format_opts *fo, 1296 const ipfw_insn_ip *cmd) 1297 { 1298 struct hostent *he = NULL; 1299 const struct in_addr *ia; 1300 const uint32_t *a = ((const ipfw_insn_u32 *)cmd)->d; 1301 uint32_t len = F_LEN((const ipfw_insn *)cmd); 1302 char *t; 1303 1304 bprintf(bp, " "); 1305 if (cmd->o.opcode == O_IP_DST_LOOKUP && len > F_INSN_SIZE(ipfw_insn_u32)) { 1306 const char *arg; 1307 1308 arg = match_value(lookup_keys, a[1]); 1309 t = table_search_ctlv(fo->tstate, 1310 ((const ipfw_insn *)cmd)->arg1); 1311 bprintf(bp, "lookup %s %s", arg, t); 1312 return; 1313 } 1314 if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) { 1315 bprintf(bp, "me"); 1316 return; 1317 } 1318 if (cmd->o.opcode == O_IP_SRC_LOOKUP || 1319 cmd->o.opcode == O_IP_DST_LOOKUP) { 1320 t = table_search_ctlv(fo->tstate, 1321 ((const ipfw_insn *)cmd)->arg1); 1322 bprintf(bp, "table(%s", t); 1323 if (len == F_INSN_SIZE(ipfw_insn_u32)) 1324 bprintf(bp, ",%u", *a); 1325 bprintf(bp, ")"); 1326 return; 1327 } 1328 if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) { 1329 const uint32_t *map = (const uint32_t *)&cmd->mask; 1330 struct in_addr addr; 1331 uint32_t x; 1332 int i, j; 1333 char comma = '{'; 1334 1335 x = cmd->o.arg1 - 1; 1336 x = htonl(~x); 1337 addr.s_addr = htonl(cmd->addr.s_addr); 1338 bprintf(bp, "%s/%d", inet_ntoa(addr), 1339 contigmask((uint8_t *)&x, 32)); 1340 x = cmd->addr.s_addr; 1341 x &= 0xff; /* base */ 1342 /* 1343 * Print bits and ranges. 1344 * Locate first bit set (i), then locate first bit unset (j). 1345 * If we have 3+ consecutive bits set, then print them as a 1346 * range, otherwise only print the initial bit and rescan. 1347 */ 1348 for (i=0; i < cmd->o.arg1; i++) 1349 if (map[i/32] & (1<<(i & 31))) { 1350 for (j=i+1; j < cmd->o.arg1; j++) 1351 if (!(map[ j/32] & (1<<(j & 31)))) 1352 break; 1353 bprintf(bp, "%c%d", comma, i+x); 1354 if (j>i+2) { /* range has at least 3 elements */ 1355 bprintf(bp, "-%d", j-1+x); 1356 i = j-1; 1357 } 1358 comma = ','; 1359 } 1360 bprintf(bp, "}"); 1361 return; 1362 } 1363 /* 1364 * len == 2 indicates a single IP, whereas lists of 1 or more 1365 * addr/mask pairs have len = (2n+1). We convert len to n so we 1366 * use that to count the number of entries. 1367 */ 1368 for (len = len / 2; len > 0; len--, a += 2) { 1369 int mb = /* mask length */ 1370 (cmd->o.opcode == O_IP_SRC || cmd->o.opcode == O_IP_DST) ? 1371 32 : contigmask((const uint8_t *)&(a[1]), 32); 1372 if (mb == 32 && g_co.do_resolv) 1373 he = gethostbyaddr((const char *)&(a[0]), sizeof(in_addr_t), 1374 AF_INET); 1375 if (he != NULL) /* resolved to name */ 1376 bprintf(bp, "%s", he->h_name); 1377 else if (mb == 0) /* any */ 1378 bprintf(bp, "any"); 1379 else { /* numeric IP followed by some kind of mask */ 1380 ia = (const struct in_addr *)&a[0]; 1381 bprintf(bp, "%s", inet_ntoa(*ia)); 1382 if (mb < 0) { 1383 ia = (const struct in_addr *)&a[1]; 1384 bprintf(bp, ":%s", inet_ntoa(*ia)); 1385 } else if (mb < 32) 1386 bprintf(bp, "/%d", mb); 1387 } 1388 if (len > 1) 1389 bprintf(bp, ","); 1390 } 1391 } 1392 1393 /* 1394 * prints a MAC address/mask pair 1395 */ 1396 static void 1397 format_mac(struct buf_pr *bp, const uint8_t *addr, const uint8_t *mask) 1398 { 1399 int l = contigmask(mask, 48); 1400 1401 if (l == 0) 1402 bprintf(bp, " any"); 1403 else { 1404 bprintf(bp, " %02x:%02x:%02x:%02x:%02x:%02x", 1405 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); 1406 if (l == -1) 1407 bprintf(bp, "&%02x:%02x:%02x:%02x:%02x:%02x", 1408 mask[0], mask[1], mask[2], 1409 mask[3], mask[4], mask[5]); 1410 else if (l < 48) 1411 bprintf(bp, "/%d", l); 1412 } 1413 } 1414 1415 static void 1416 print_mac(struct buf_pr *bp, const ipfw_insn_mac *mac) 1417 { 1418 1419 bprintf(bp, " MAC"); 1420 format_mac(bp, mac->addr, mac->mask); 1421 format_mac(bp, mac->addr + 6, mac->mask + 6); 1422 } 1423 1424 static void 1425 print_mac_lookup(struct buf_pr *bp, const struct format_opts *fo, 1426 const ipfw_insn *cmd) 1427 { 1428 uint32_t len = F_LEN(cmd); 1429 char *t; 1430 1431 bprintf(bp, " "); 1432 1433 t = table_search_ctlv(fo->tstate, cmd->arg1); 1434 bprintf(bp, "table(%s", t); 1435 if (len == F_INSN_SIZE(ipfw_insn_u32)) 1436 bprintf(bp, ",%u", ((const ipfw_insn_u32 *)cmd)->d[0]); 1437 bprintf(bp, ")"); 1438 } 1439 1440 static void 1441 fill_icmptypes(ipfw_insn_u32 *cmd, char *av) 1442 { 1443 uint8_t type; 1444 1445 cmd->d[0] = 0; 1446 while (*av) { 1447 if (*av == ',') 1448 av++; 1449 1450 type = strtoul(av, &av, 0); 1451 1452 if (*av != ',' && *av != '\0') 1453 errx(EX_DATAERR, "invalid ICMP type"); 1454 1455 if (type > 31) 1456 errx(EX_DATAERR, "ICMP type out of range"); 1457 1458 cmd->d[0] |= 1 << type; 1459 } 1460 cmd->o.opcode = O_ICMPTYPE; 1461 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 1462 } 1463 1464 static void 1465 print_icmptypes(struct buf_pr *bp, const ipfw_insn_u32 *cmd) 1466 { 1467 int i; 1468 char sep= ' '; 1469 1470 bprintf(bp, " icmptypes"); 1471 for (i = 0; i < 32; i++) { 1472 if ( (cmd->d[0] & (1 << (i))) == 0) 1473 continue; 1474 bprintf(bp, "%c%d", sep, i); 1475 sep = ','; 1476 } 1477 } 1478 1479 static void 1480 print_dscp(struct buf_pr *bp, const ipfw_insn_u32 *cmd) 1481 { 1482 const uint32_t *v; 1483 const char *code; 1484 int i = 0; 1485 char sep= ' '; 1486 1487 bprintf(bp, " dscp"); 1488 v = cmd->d; 1489 while (i < 64) { 1490 if (*v & (1 << i)) { 1491 if ((code = match_value(f_ipdscp, i)) != NULL) 1492 bprintf(bp, "%c%s", sep, code); 1493 else 1494 bprintf(bp, "%c%d", sep, i); 1495 sep = ','; 1496 } 1497 1498 if ((++i % 32) == 0) 1499 v++; 1500 } 1501 } 1502 1503 #define insntod(cmd, type) ((const ipfw_insn_ ## type *)(cmd)) 1504 struct show_state { 1505 struct ip_fw_rule *rule; 1506 const ipfw_insn *eaction; 1507 uint8_t *printed; 1508 int flags; 1509 #define HAVE_PROTO 0x0001 1510 #define HAVE_SRCIP 0x0002 1511 #define HAVE_DSTIP 0x0004 1512 #define HAVE_PROBE_STATE 0x0008 1513 int proto; 1514 int or_block; 1515 }; 1516 1517 static int 1518 init_show_state(struct show_state *state, struct ip_fw_rule *rule) 1519 { 1520 1521 state->printed = calloc(rule->cmd_len, sizeof(uint8_t)); 1522 if (state->printed == NULL) 1523 return (ENOMEM); 1524 state->rule = rule; 1525 state->eaction = NULL; 1526 state->flags = 0; 1527 state->proto = 0; 1528 state->or_block = 0; 1529 return (0); 1530 } 1531 1532 static void 1533 free_show_state(struct show_state *state) 1534 { 1535 1536 free(state->printed); 1537 } 1538 1539 static uint8_t 1540 is_printed_opcode(struct show_state *state, const ipfw_insn *cmd) 1541 { 1542 1543 return (state->printed[cmd - state->rule->cmd]); 1544 } 1545 1546 static void 1547 mark_printed(struct show_state *state, const ipfw_insn *cmd) 1548 { 1549 1550 state->printed[cmd - state->rule->cmd] = 1; 1551 } 1552 1553 static void 1554 print_limit_mask(struct buf_pr *bp, const ipfw_insn_limit *limit) 1555 { 1556 struct _s_x *p = limit_masks; 1557 char const *comma = " "; 1558 uint8_t x; 1559 1560 for (x = limit->limit_mask; p->x != 0; p++) { 1561 if ((x & p->x) == p->x) { 1562 x &= ~p->x; 1563 bprintf(bp, "%s%s", comma, p->s); 1564 comma = ","; 1565 } 1566 } 1567 bprint_uint_arg(bp, " ", limit->conn_limit); 1568 } 1569 1570 static int 1571 print_instruction(struct buf_pr *bp, const struct format_opts *fo, 1572 struct show_state *state, const ipfw_insn *cmd) 1573 { 1574 struct protoent *pe; 1575 struct passwd *pwd; 1576 struct group *grp; 1577 const char *s; 1578 double d; 1579 1580 if (is_printed_opcode(state, cmd)) 1581 return (0); 1582 if ((cmd->len & F_OR) != 0 && state->or_block == 0) 1583 bprintf(bp, " {"); 1584 if (cmd->opcode != O_IN && (cmd->len & F_NOT) != 0) 1585 bprintf(bp, " not"); 1586 1587 switch (cmd->opcode) { 1588 case O_PROB: 1589 d = 1.0 * insntod(cmd, u32)->d[0] / 0x7fffffff; 1590 bprintf(bp, "prob %f ", d); 1591 break; 1592 case O_PROBE_STATE: /* no need to print anything here */ 1593 state->flags |= HAVE_PROBE_STATE; 1594 break; 1595 case O_IP_SRC: 1596 case O_IP_SRC_LOOKUP: 1597 case O_IP_SRC_MASK: 1598 case O_IP_SRC_ME: 1599 case O_IP_SRC_SET: 1600 if (state->flags & HAVE_SRCIP) 1601 bprintf(bp, " src-ip"); 1602 print_ip(bp, fo, insntod(cmd, ip)); 1603 break; 1604 case O_IP_DST: 1605 case O_IP_DST_LOOKUP: 1606 case O_IP_DST_MASK: 1607 case O_IP_DST_ME: 1608 case O_IP_DST_SET: 1609 if (state->flags & HAVE_DSTIP) 1610 bprintf(bp, " dst-ip"); 1611 print_ip(bp, fo, insntod(cmd, ip)); 1612 break; 1613 case O_IP6_SRC: 1614 case O_IP6_SRC_MASK: 1615 case O_IP6_SRC_ME: 1616 if (state->flags & HAVE_SRCIP) 1617 bprintf(bp, " src-ip6"); 1618 print_ip6(bp, insntod(cmd, ip6)); 1619 break; 1620 case O_IP6_DST: 1621 case O_IP6_DST_MASK: 1622 case O_IP6_DST_ME: 1623 if (state->flags & HAVE_DSTIP) 1624 bprintf(bp, " dst-ip6"); 1625 print_ip6(bp, insntod(cmd, ip6)); 1626 break; 1627 case O_MAC_SRC_LOOKUP: 1628 bprintf(bp, " src-mac"); 1629 print_mac_lookup(bp, fo, cmd); 1630 break; 1631 case O_MAC_DST_LOOKUP: 1632 bprintf(bp, " dst-mac"); 1633 print_mac_lookup(bp, fo, cmd); 1634 break; 1635 case O_FLOW6ID: 1636 print_flow6id(bp, insntod(cmd, u32)); 1637 break; 1638 case O_IP_DSTPORT: 1639 case O_IP_SRCPORT: 1640 print_newports(bp, insntod(cmd, u16), state->proto, 1641 (state->flags & (HAVE_SRCIP | HAVE_DSTIP)) == 1642 (HAVE_SRCIP | HAVE_DSTIP) ? cmd->opcode: 0); 1643 break; 1644 case O_PROTO: 1645 pe = getprotobynumber(cmd->arg1); 1646 if (state->flags & HAVE_PROTO) 1647 bprintf(bp, " proto"); 1648 if (pe != NULL) 1649 bprintf(bp, " %s", pe->p_name); 1650 else 1651 bprintf(bp, " %u", cmd->arg1); 1652 state->proto = cmd->arg1; 1653 break; 1654 case O_MACADDR2: 1655 print_mac(bp, insntod(cmd, mac)); 1656 break; 1657 case O_MAC_TYPE: 1658 print_newports(bp, insntod(cmd, u16), 1659 IPPROTO_ETHERTYPE, cmd->opcode); 1660 break; 1661 case O_FRAG: 1662 print_flags(bp, "frag", cmd, f_ipoff); 1663 break; 1664 case O_FIB: 1665 bprintf(bp, " fib %u", cmd->arg1); 1666 break; 1667 case O_SOCKARG: 1668 bprintf(bp, " sockarg"); 1669 break; 1670 case O_IN: 1671 bprintf(bp, cmd->len & F_NOT ? " out" : " in"); 1672 break; 1673 case O_DIVERTED: 1674 switch (cmd->arg1) { 1675 case 3: 1676 bprintf(bp, " diverted"); 1677 break; 1678 case 2: 1679 bprintf(bp, " diverted-output"); 1680 break; 1681 case 1: 1682 bprintf(bp, " diverted-loopback"); 1683 break; 1684 default: 1685 bprintf(bp, " diverted-?<%u>", cmd->arg1); 1686 break; 1687 } 1688 break; 1689 case O_LAYER2: 1690 bprintf(bp, " layer2"); 1691 break; 1692 case O_XMIT: 1693 case O_RECV: 1694 case O_VIA: 1695 if (cmd->opcode == O_XMIT) 1696 s = "xmit"; 1697 else if (cmd->opcode == O_RECV) 1698 s = "recv"; 1699 else /* if (cmd->opcode == O_VIA) */ 1700 s = "via"; 1701 switch (insntod(cmd, if)->name[0]) { 1702 case '\0': 1703 bprintf(bp, " %s %s", s, 1704 inet_ntoa(insntod(cmd, if)->p.ip)); 1705 break; 1706 case '\1': 1707 bprintf(bp, " %s table(%s)", s, 1708 table_search_ctlv(fo->tstate, 1709 insntod(cmd, if)->p.kidx)); 1710 break; 1711 default: 1712 bprintf(bp, " %s %s", s, 1713 insntod(cmd, if)->name); 1714 } 1715 break; 1716 case O_IP_FLOW_LOOKUP: 1717 s = table_search_ctlv(fo->tstate, cmd->arg1); 1718 bprintf(bp, " flow table(%s", s); 1719 if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) 1720 bprintf(bp, ",%u", insntod(cmd, u32)->d[0]); 1721 bprintf(bp, ")"); 1722 break; 1723 case O_IPID: 1724 case O_IPTTL: 1725 case O_IPLEN: 1726 case O_TCPDATALEN: 1727 case O_TCPMSS: 1728 case O_TCPWIN: 1729 if (F_LEN(cmd) == 1) { 1730 switch (cmd->opcode) { 1731 case O_IPID: 1732 s = "ipid"; 1733 break; 1734 case O_IPTTL: 1735 s = "ipttl"; 1736 break; 1737 case O_IPLEN: 1738 s = "iplen"; 1739 break; 1740 case O_TCPDATALEN: 1741 s = "tcpdatalen"; 1742 break; 1743 case O_TCPMSS: 1744 s = "tcpmss"; 1745 break; 1746 case O_TCPWIN: 1747 s = "tcpwin"; 1748 break; 1749 default: 1750 s = "<unknown>"; 1751 break; 1752 } 1753 bprintf(bp, " %s %u", s, cmd->arg1); 1754 } else 1755 print_newports(bp, insntod(cmd, u16), 0, 1756 cmd->opcode); 1757 break; 1758 case O_IPVER: 1759 bprintf(bp, " ipver %u", cmd->arg1); 1760 break; 1761 case O_IPPRECEDENCE: 1762 bprintf(bp, " ipprecedence %u", cmd->arg1 >> 5); 1763 break; 1764 case O_DSCP: 1765 print_dscp(bp, insntod(cmd, u32)); 1766 break; 1767 case O_IPOPT: 1768 print_flags(bp, "ipoptions", cmd, f_ipopts); 1769 break; 1770 case O_IPTOS: 1771 print_flags(bp, "iptos", cmd, f_iptos); 1772 break; 1773 case O_ICMPTYPE: 1774 print_icmptypes(bp, insntod(cmd, u32)); 1775 break; 1776 case O_ESTAB: 1777 bprintf(bp, " established"); 1778 break; 1779 case O_TCPFLAGS: 1780 print_flags(bp, "tcpflags", cmd, f_tcpflags); 1781 break; 1782 case O_TCPOPTS: 1783 print_flags(bp, "tcpoptions", cmd, f_tcpopts); 1784 break; 1785 case O_TCPACK: 1786 bprintf(bp, " tcpack %d", 1787 ntohl(insntod(cmd, u32)->d[0])); 1788 break; 1789 case O_TCPSEQ: 1790 bprintf(bp, " tcpseq %d", 1791 ntohl(insntod(cmd, u32)->d[0])); 1792 break; 1793 case O_UID: 1794 pwd = getpwuid(insntod(cmd, u32)->d[0]); 1795 if (pwd != NULL) 1796 bprintf(bp, " uid %s", pwd->pw_name); 1797 else 1798 bprintf(bp, " uid %u", 1799 insntod(cmd, u32)->d[0]); 1800 break; 1801 case O_GID: 1802 grp = getgrgid(insntod(cmd, u32)->d[0]); 1803 if (grp != NULL) 1804 bprintf(bp, " gid %s", grp->gr_name); 1805 else 1806 bprintf(bp, " gid %u", 1807 insntod(cmd, u32)->d[0]); 1808 break; 1809 case O_JAIL: 1810 bprintf(bp, " jail %d", insntod(cmd, u32)->d[0]); 1811 break; 1812 case O_VERREVPATH: 1813 bprintf(bp, " verrevpath"); 1814 break; 1815 case O_VERSRCREACH: 1816 bprintf(bp, " versrcreach"); 1817 break; 1818 case O_ANTISPOOF: 1819 bprintf(bp, " antispoof"); 1820 break; 1821 case O_IPSEC: 1822 bprintf(bp, " ipsec"); 1823 break; 1824 case O_NOP: 1825 bprintf(bp, " // %s", (const char *)(cmd + 1)); 1826 break; 1827 case O_KEEP_STATE: 1828 if (state->flags & HAVE_PROBE_STATE) 1829 bprintf(bp, " keep-state"); 1830 else 1831 bprintf(bp, " record-state"); 1832 bprintf(bp, " :%s", 1833 object_search_ctlv(fo->tstate, cmd->arg1, 1834 IPFW_TLV_STATE_NAME)); 1835 break; 1836 case O_LIMIT: 1837 if (state->flags & HAVE_PROBE_STATE) 1838 bprintf(bp, " limit"); 1839 else 1840 bprintf(bp, " set-limit"); 1841 print_limit_mask(bp, insntod(cmd, limit)); 1842 bprintf(bp, " :%s", 1843 object_search_ctlv(fo->tstate, cmd->arg1, 1844 IPFW_TLV_STATE_NAME)); 1845 break; 1846 case O_IP6: 1847 if (state->flags & HAVE_PROTO) 1848 bprintf(bp, " proto"); 1849 bprintf(bp, " ip6"); 1850 break; 1851 case O_IP4: 1852 if (state->flags & HAVE_PROTO) 1853 bprintf(bp, " proto"); 1854 bprintf(bp, " ip4"); 1855 break; 1856 case O_ICMP6TYPE: 1857 print_icmp6types(bp, insntod(cmd, u32)); 1858 break; 1859 case O_EXT_HDR: 1860 print_ext6hdr(bp, cmd); 1861 break; 1862 case O_TAGGED: 1863 if (F_LEN(cmd) == 1) 1864 bprint_uint_arg(bp, " tagged ", cmd->arg1); 1865 else 1866 print_newports(bp, insntod(cmd, u16), 1867 0, O_TAGGED); 1868 break; 1869 case O_SKIP_ACTION: 1870 bprintf(bp, " defer-immediate-action"); 1871 break; 1872 case O_MARK: 1873 bprintf(bp, " mark"); 1874 if (cmd->arg1 == IP_FW_TARG) 1875 bprintf(bp, " tablearg"); 1876 else 1877 bprintf(bp, " %#x", 1878 ((const ipfw_insn_u32 *)cmd)->d[0]); 1879 1880 if (((const ipfw_insn_u32 *)cmd)->d[1] != 0xFFFFFFFF) 1881 bprintf(bp, ":%#x", 1882 ((const ipfw_insn_u32 *)cmd)->d[1]); 1883 break; 1884 1885 default: 1886 bprintf(bp, " [opcode %d len %d]", cmd->opcode, 1887 cmd->len); 1888 } 1889 if (cmd->len & F_OR) { 1890 bprintf(bp, " or"); 1891 state->or_block = 1; 1892 } else if (state->or_block != 0) { 1893 bprintf(bp, " }"); 1894 state->or_block = 0; 1895 } 1896 mark_printed(state, cmd); 1897 1898 return (1); 1899 } 1900 1901 static ipfw_insn * 1902 print_opcode(struct buf_pr *bp, struct format_opts *fo, 1903 struct show_state *state, int opcode) 1904 { 1905 ipfw_insn *cmd; 1906 int l; 1907 1908 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 1909 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 1910 /* We use zero opcode to print the rest of options */ 1911 if (opcode >= 0 && cmd->opcode != opcode) 1912 continue; 1913 /* 1914 * Skip O_NOP, when we printing the rest 1915 * of options, it will be handled separately. 1916 */ 1917 if (cmd->opcode == O_NOP && opcode != O_NOP) 1918 continue; 1919 if (!print_instruction(bp, fo, state, cmd)) 1920 continue; 1921 return (cmd); 1922 } 1923 return (NULL); 1924 } 1925 1926 static void 1927 print_fwd(struct buf_pr *bp, const ipfw_insn *cmd) 1928 { 1929 char buf[INET6_ADDRSTRLEN + IF_NAMESIZE + 2]; 1930 const ipfw_insn_sa6 *sa6; 1931 const ipfw_insn_sa *sa; 1932 uint16_t port; 1933 1934 if (cmd->opcode == O_FORWARD_IP) { 1935 sa = insntod(cmd, sa); 1936 port = sa->sa.sin_port; 1937 if (sa->sa.sin_addr.s_addr == INADDR_ANY) 1938 bprintf(bp, "fwd tablearg"); 1939 else 1940 bprintf(bp, "fwd %s", inet_ntoa(sa->sa.sin_addr)); 1941 } else { 1942 sa6 = insntod(cmd, sa6); 1943 port = sa6->sa.sin6_port; 1944 bprintf(bp, "fwd "); 1945 if (getnameinfo((const struct sockaddr *)&sa6->sa, 1946 sizeof(struct sockaddr_in6), buf, sizeof(buf), NULL, 0, 1947 NI_NUMERICHOST) == 0) 1948 bprintf(bp, "%s", buf); 1949 } 1950 if (port != 0) 1951 bprintf(bp, ",%u", port); 1952 } 1953 1954 static int 1955 print_action_instruction(struct buf_pr *bp, const struct format_opts *fo, 1956 struct show_state *state, const ipfw_insn *cmd) 1957 { 1958 const char *s; 1959 1960 if (is_printed_opcode(state, cmd)) 1961 return (0); 1962 switch (cmd->opcode) { 1963 case O_CHECK_STATE: 1964 bprintf(bp, "check-state"); 1965 if (cmd->arg1 != 0) 1966 s = object_search_ctlv(fo->tstate, cmd->arg1, 1967 IPFW_TLV_STATE_NAME); 1968 else 1969 s = NULL; 1970 bprintf(bp, " :%s", s ? s: "any"); 1971 break; 1972 case O_ACCEPT: 1973 bprintf(bp, "allow"); 1974 break; 1975 case O_COUNT: 1976 bprintf(bp, "count"); 1977 break; 1978 case O_DENY: 1979 bprintf(bp, "deny"); 1980 break; 1981 case O_REJECT: 1982 if (cmd->arg1 == ICMP_REJECT_RST) 1983 bprintf(bp, "reset"); 1984 else if (cmd->arg1 == ICMP_REJECT_ABORT) 1985 bprintf(bp, "abort"); 1986 else if (cmd->arg1 == ICMP_UNREACH_HOST) 1987 bprintf(bp, "reject"); 1988 else if (cmd->arg1 == ICMP_UNREACH_NEEDFRAG && 1989 cmd->len == F_INSN_SIZE(ipfw_insn_u16)) 1990 bprintf(bp, "needfrag %u", 1991 ((const ipfw_insn_u16 *)cmd)->ports[0]); 1992 else 1993 print_reject_code(bp, cmd->arg1); 1994 break; 1995 case O_UNREACH6: 1996 if (cmd->arg1 == ICMP6_UNREACH_RST) 1997 bprintf(bp, "reset6"); 1998 else if (cmd->arg1 == ICMP6_UNREACH_ABORT) 1999 bprintf(bp, "abort6"); 2000 else 2001 print_unreach6_code(bp, cmd->arg1); 2002 break; 2003 case O_SKIPTO: 2004 bprint_uint_arg(bp, "skipto ", cmd->arg1); 2005 break; 2006 case O_PIPE: 2007 bprint_uint_arg(bp, "pipe ", cmd->arg1); 2008 break; 2009 case O_QUEUE: 2010 bprint_uint_arg(bp, "queue ", cmd->arg1); 2011 break; 2012 case O_DIVERT: 2013 bprint_uint_arg(bp, "divert ", cmd->arg1); 2014 break; 2015 case O_TEE: 2016 bprint_uint_arg(bp, "tee ", cmd->arg1); 2017 break; 2018 case O_NETGRAPH: 2019 bprint_uint_arg(bp, "netgraph ", cmd->arg1); 2020 break; 2021 case O_NGTEE: 2022 bprint_uint_arg(bp, "ngtee ", cmd->arg1); 2023 break; 2024 case O_FORWARD_IP: 2025 case O_FORWARD_IP6: 2026 print_fwd(bp, cmd); 2027 break; 2028 case O_LOG: 2029 if (insntod(cmd, log)->max_log > 0) 2030 bprintf(bp, " log logamount %d", 2031 insntod(cmd, log)->max_log); 2032 else 2033 bprintf(bp, " log"); 2034 break; 2035 case O_ALTQ: 2036 #ifndef NO_ALTQ 2037 print_altq_cmd(bp, insntod(cmd, altq)); 2038 #endif 2039 break; 2040 case O_TAG: 2041 bprint_uint_arg(bp, cmd->len & F_NOT ? " untag ": 2042 " tag ", cmd->arg1); 2043 break; 2044 case O_NAT: 2045 if (cmd->arg1 != IP_FW_NAT44_GLOBAL) 2046 bprint_uint_arg(bp, "nat ", cmd->arg1); 2047 else 2048 bprintf(bp, "nat global"); 2049 break; 2050 case O_SETFIB: 2051 if (cmd->arg1 == IP_FW_TARG) 2052 bprint_uint_arg(bp, "setfib ", cmd->arg1); 2053 else 2054 bprintf(bp, "setfib %u", cmd->arg1 & 0x7FFF); 2055 break; 2056 case O_EXTERNAL_ACTION: 2057 /* 2058 * The external action can consists of two following 2059 * each other opcodes - O_EXTERNAL_ACTION and 2060 * O_EXTERNAL_INSTANCE. The first contains the ID of 2061 * name of external action. The second contains the ID 2062 * of name of external action instance. 2063 * NOTE: in case when external action has no named 2064 * instances support, the second opcode isn't needed. 2065 */ 2066 state->eaction = cmd; 2067 s = object_search_ctlv(fo->tstate, cmd->arg1, 2068 IPFW_TLV_EACTION); 2069 if (match_token(rule_eactions, s) != -1) 2070 bprintf(bp, "%s", s); 2071 else 2072 bprintf(bp, "eaction %s", s); 2073 break; 2074 case O_EXTERNAL_INSTANCE: 2075 if (state->eaction == NULL) 2076 break; 2077 /* 2078 * XXX: we need to teach ipfw(9) to rewrite opcodes 2079 * in the user buffer on rule addition. When we add 2080 * the rule, we specify zero TLV type for 2081 * O_EXTERNAL_INSTANCE object. To show correct 2082 * rule after `ipfw add` we need to search instance 2083 * name with zero type. But when we do `ipfw show` 2084 * we calculate TLV type using IPFW_TLV_EACTION_NAME() 2085 * macro. 2086 */ 2087 s = object_search_ctlv(fo->tstate, cmd->arg1, 0); 2088 if (s == NULL) 2089 s = object_search_ctlv(fo->tstate, 2090 cmd->arg1, IPFW_TLV_EACTION_NAME( 2091 state->eaction->arg1)); 2092 bprintf(bp, " %s", s); 2093 break; 2094 case O_EXTERNAL_DATA: 2095 if (state->eaction == NULL) 2096 break; 2097 /* 2098 * Currently we support data formatting only for 2099 * external data with datalen u16. For unknown data 2100 * print its size in bytes. 2101 */ 2102 if (cmd->len == F_INSN_SIZE(ipfw_insn)) 2103 bprintf(bp, " %u", cmd->arg1); 2104 else 2105 bprintf(bp, " %ubytes", 2106 cmd->len * sizeof(uint32_t)); 2107 break; 2108 case O_SETDSCP: 2109 if (cmd->arg1 == IP_FW_TARG) { 2110 bprintf(bp, "setdscp tablearg"); 2111 break; 2112 } 2113 s = match_value(f_ipdscp, cmd->arg1 & 0x3F); 2114 if (s != NULL) 2115 bprintf(bp, "setdscp %s", s); 2116 else 2117 bprintf(bp, "setdscp %u", cmd->arg1 & 0x3F); 2118 break; 2119 case O_REASS: 2120 bprintf(bp, "reass"); 2121 break; 2122 case O_CALLRETURN: 2123 if (cmd->len & F_NOT) 2124 bprintf(bp, "return"); 2125 else 2126 bprint_uint_arg(bp, "call ", cmd->arg1); 2127 break; 2128 case O_SETMARK: 2129 if (cmd->arg1 == IP_FW_TARG) { 2130 bprintf(bp, "setmark tablearg"); 2131 break; 2132 } 2133 bprintf(bp, "setmark %#x", ((const ipfw_insn_u32 *)cmd)->d[0]); 2134 break; 2135 default: 2136 bprintf(bp, "** unrecognized action %d len %d ", 2137 cmd->opcode, cmd->len); 2138 } 2139 mark_printed(state, cmd); 2140 2141 return (1); 2142 } 2143 2144 2145 static ipfw_insn * 2146 print_action(struct buf_pr *bp, struct format_opts *fo, 2147 struct show_state *state, uint8_t opcode) 2148 { 2149 ipfw_insn *cmd; 2150 int l; 2151 2152 for (l = state->rule->cmd_len - state->rule->act_ofs, 2153 cmd = ACTION_PTR(state->rule); l > 0; 2154 l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2155 if (cmd->opcode != opcode) 2156 continue; 2157 if (!print_action_instruction(bp, fo, state, cmd)) 2158 continue; 2159 return (cmd); 2160 } 2161 return (NULL); 2162 } 2163 2164 static void 2165 print_proto(struct buf_pr *bp, struct format_opts *fo, 2166 struct show_state *state) 2167 { 2168 ipfw_insn *cmd; 2169 int l, proto, ip4, ip6; 2170 2171 /* Count all O_PROTO, O_IP4, O_IP6 instructions. */ 2172 proto = ip4 = ip6 = 0; 2173 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 2174 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2175 switch (cmd->opcode) { 2176 case O_PROTO: 2177 proto++; 2178 break; 2179 case O_IP4: 2180 ip4 = 1; 2181 if (cmd->len & F_OR) 2182 ip4++; 2183 break; 2184 case O_IP6: 2185 ip6 = 1; 2186 if (cmd->len & F_OR) 2187 ip6++; 2188 break; 2189 default: 2190 continue; 2191 } 2192 } 2193 if (proto == 0 && ip4 == 0 && ip6 == 0) { 2194 state->proto = IPPROTO_IP; 2195 state->flags |= HAVE_PROTO; 2196 bprintf(bp, " ip"); 2197 return; 2198 } 2199 /* To handle the case { ip4 or ip6 }, print opcode with F_OR first */ 2200 cmd = NULL; 2201 if (ip4 || ip6) 2202 cmd = print_opcode(bp, fo, state, ip4 > ip6 ? O_IP4: O_IP6); 2203 if (cmd != NULL && (cmd->len & F_OR)) 2204 cmd = print_opcode(bp, fo, state, ip4 > ip6 ? O_IP6: O_IP4); 2205 if (cmd == NULL || (cmd->len & F_OR)) 2206 for (l = proto; l > 0; l--) { 2207 cmd = print_opcode(bp, fo, state, O_PROTO); 2208 if (cmd == NULL || (cmd->len & F_OR) == 0) 2209 break; 2210 } 2211 /* Initialize proto, it is used by print_newports() */ 2212 state->flags |= HAVE_PROTO; 2213 if (state->proto == 0 && ip6 != 0) 2214 state->proto = IPPROTO_IPV6; 2215 } 2216 2217 static int 2218 match_opcode(int opcode, const int opcodes[], size_t nops) 2219 { 2220 size_t i; 2221 2222 for (i = 0; i < nops; i++) 2223 if (opcode == opcodes[i]) 2224 return (1); 2225 return (0); 2226 } 2227 2228 static void 2229 print_address(struct buf_pr *bp, struct format_opts *fo, 2230 struct show_state *state, const int opcodes[], size_t nops, int portop, 2231 int flag) 2232 { 2233 ipfw_insn *cmd; 2234 int count, l, portcnt, pf; 2235 2236 count = portcnt = 0; 2237 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 2238 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2239 if (match_opcode(cmd->opcode, opcodes, nops)) 2240 count++; 2241 else if (cmd->opcode == portop) 2242 portcnt++; 2243 } 2244 if (count == 0) 2245 bprintf(bp, " any"); 2246 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 2247 l > 0 && count > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2248 if (!match_opcode(cmd->opcode, opcodes, nops)) 2249 continue; 2250 print_instruction(bp, fo, state, cmd); 2251 if ((cmd->len & F_OR) == 0) 2252 break; 2253 count--; 2254 } 2255 /* 2256 * If several O_IP_?PORT opcodes specified, leave them to the 2257 * options section. 2258 */ 2259 if (portcnt == 1) { 2260 for (l = state->rule->act_ofs, cmd = state->rule->cmd, pf = 0; 2261 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2262 if (cmd->opcode != portop) { 2263 pf = (cmd->len & F_OR); 2264 continue; 2265 } 2266 /* Print opcode iff it is not in OR block. */ 2267 if (pf == 0 && (cmd->len & F_OR) == 0) 2268 print_instruction(bp, fo, state, cmd); 2269 break; 2270 } 2271 } 2272 state->flags |= flag; 2273 } 2274 2275 static const int action_opcodes[] = { 2276 O_CHECK_STATE, O_ACCEPT, O_COUNT, O_DENY, O_REJECT, 2277 O_UNREACH6, O_SKIPTO, O_PIPE, O_QUEUE, O_DIVERT, O_TEE, 2278 O_NETGRAPH, O_NGTEE, O_FORWARD_IP, O_FORWARD_IP6, O_NAT, 2279 O_SETFIB, O_SETDSCP, O_REASS, O_CALLRETURN, O_SETMARK, 2280 /* keep the following opcodes at the end of the list */ 2281 O_EXTERNAL_ACTION, O_EXTERNAL_INSTANCE, O_EXTERNAL_DATA 2282 }; 2283 2284 static const int modifier_opcodes[] = { 2285 O_LOG, O_ALTQ, O_TAG 2286 }; 2287 2288 static const int src_opcodes[] = { 2289 O_IP_SRC, O_IP_SRC_LOOKUP, O_IP_SRC_MASK, O_IP_SRC_ME, 2290 O_IP_SRC_SET, O_IP6_SRC, O_IP6_SRC_MASK, O_IP6_SRC_ME 2291 }; 2292 2293 static const int dst_opcodes[] = { 2294 O_IP_DST, O_IP_DST_LOOKUP, O_IP_DST_MASK, O_IP_DST_ME, 2295 O_IP_DST_SET, O_IP6_DST, O_IP6_DST_MASK, O_IP6_DST_ME 2296 }; 2297 2298 static void 2299 show_static_rule(struct cmdline_opts *co, struct format_opts *fo, 2300 struct buf_pr *bp, struct ip_fw_rule *rule, struct ip_fw_bcounter *cntr) 2301 { 2302 static int twidth = 0; 2303 struct show_state state; 2304 ipfw_insn *cmd; 2305 size_t i; 2306 2307 /* Print # DISABLED or skip the rule */ 2308 if ((fo->set_mask & (1 << rule->set)) == 0) { 2309 /* disabled mask */ 2310 if (!co->show_sets) 2311 return; 2312 else 2313 bprintf(bp, "# DISABLED "); 2314 } 2315 if (init_show_state(&state, rule) != 0) { 2316 warn("init_show_state() failed"); 2317 return; 2318 } 2319 bprintf(bp, "%05u ", rule->rulenum); 2320 2321 /* only if counters are available */ 2322 if (cntr != NULL) { 2323 /* Print counters if enabled */ 2324 if (fo->pcwidth > 0 || fo->bcwidth > 0) { 2325 pr_u64(bp, &cntr->pcnt, fo->pcwidth); 2326 pr_u64(bp, &cntr->bcnt, fo->bcwidth); 2327 } 2328 2329 /* Print timestamp */ 2330 if (co->do_time == TIMESTAMP_NUMERIC) 2331 bprintf(bp, "%10u ", cntr->timestamp); 2332 else if (co->do_time == TIMESTAMP_STRING) { 2333 char timestr[30]; 2334 time_t t = (time_t)0; 2335 2336 if (twidth == 0) { 2337 strcpy(timestr, ctime(&t)); 2338 *strchr(timestr, '\n') = '\0'; 2339 twidth = strlen(timestr); 2340 } 2341 if (cntr->timestamp > 0) { 2342 t = _long_to_time(cntr->timestamp); 2343 2344 strcpy(timestr, ctime(&t)); 2345 *strchr(timestr, '\n') = '\0'; 2346 bprintf(bp, "%s ", timestr); 2347 } else { 2348 bprintf(bp, "%*s ", twidth, ""); 2349 } 2350 } 2351 } 2352 2353 /* Print set number */ 2354 if (co->show_sets) 2355 bprintf(bp, "set %d ", rule->set); 2356 2357 /* Print the optional "match probability" */ 2358 cmd = print_opcode(bp, fo, &state, O_PROB); 2359 /* Print rule action */ 2360 for (i = 0; i < nitems(action_opcodes); i++) { 2361 cmd = print_action(bp, fo, &state, action_opcodes[i]); 2362 if (cmd == NULL) 2363 continue; 2364 /* Handle special cases */ 2365 switch (cmd->opcode) { 2366 case O_CHECK_STATE: 2367 goto end; 2368 case O_EXTERNAL_ACTION: 2369 case O_EXTERNAL_INSTANCE: 2370 /* External action can have several instructions */ 2371 continue; 2372 } 2373 break; 2374 } 2375 /* Print rule modifiers */ 2376 for (i = 0; i < nitems(modifier_opcodes); i++) 2377 print_action(bp, fo, &state, modifier_opcodes[i]); 2378 /* 2379 * Print rule body 2380 */ 2381 if (co->comment_only != 0) 2382 goto end; 2383 2384 if (rule->flags & IPFW_RULE_JUSTOPTS) { 2385 state.flags |= HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP; 2386 goto justopts; 2387 } 2388 2389 print_proto(bp, fo, &state); 2390 if (co->do_compact != 0 && (rule->flags & IPFW_RULE_NOOPT)) 2391 goto justopts; 2392 2393 /* Print source */ 2394 bprintf(bp, " from"); 2395 print_address(bp, fo, &state, src_opcodes, nitems(src_opcodes), 2396 O_IP_SRCPORT, HAVE_SRCIP); 2397 2398 /* Print destination */ 2399 bprintf(bp, " to"); 2400 print_address(bp, fo, &state, dst_opcodes, nitems(dst_opcodes), 2401 O_IP_DSTPORT, HAVE_DSTIP); 2402 2403 justopts: 2404 /* Print the rest of options */ 2405 while (print_opcode(bp, fo, &state, -1)) 2406 ; 2407 end: 2408 /* Print comment at the end */ 2409 cmd = print_opcode(bp, fo, &state, O_NOP); 2410 if (co->comment_only != 0 && cmd == NULL) 2411 bprintf(bp, " // ..."); 2412 bprintf(bp, "\n"); 2413 free_show_state(&state); 2414 } 2415 2416 static void 2417 show_dyn_state(struct cmdline_opts *co, struct format_opts *fo, 2418 struct buf_pr *bp, ipfw_dyn_rule *d) 2419 { 2420 struct protoent *pe; 2421 struct in_addr a; 2422 uint16_t rulenum; 2423 char buf[INET6_ADDRSTRLEN]; 2424 2425 if (d->expire == 0 && d->dyn_type != O_LIMIT_PARENT) 2426 return; 2427 2428 bcopy(&d->rule, &rulenum, sizeof(rulenum)); 2429 bprintf(bp, "%05d", rulenum); 2430 if (fo->pcwidth > 0 || fo->bcwidth > 0) { 2431 bprintf(bp, " "); 2432 pr_u64(bp, &d->pcnt, fo->pcwidth); 2433 pr_u64(bp, &d->bcnt, fo->bcwidth); 2434 bprintf(bp, "(%ds)", d->expire); 2435 } 2436 switch (d->dyn_type) { 2437 case O_LIMIT_PARENT: 2438 bprintf(bp, " PARENT %d", d->count); 2439 break; 2440 case O_LIMIT: 2441 bprintf(bp, " LIMIT"); 2442 break; 2443 case O_KEEP_STATE: /* bidir, no mask */ 2444 bprintf(bp, " STATE"); 2445 break; 2446 } 2447 2448 if ((pe = getprotobynumber(d->id.proto)) != NULL) 2449 bprintf(bp, " %s", pe->p_name); 2450 else 2451 bprintf(bp, " proto %u", d->id.proto); 2452 2453 if (d->id.addr_type == 4) { 2454 a.s_addr = htonl(d->id.src_ip); 2455 bprintf(bp, " %s %d", inet_ntoa(a), d->id.src_port); 2456 2457 a.s_addr = htonl(d->id.dst_ip); 2458 bprintf(bp, " <-> %s %d", inet_ntoa(a), d->id.dst_port); 2459 } else if (d->id.addr_type == 6) { 2460 bprintf(bp, " %s %d", inet_ntop(AF_INET6, &d->id.src_ip6, buf, 2461 sizeof(buf)), d->id.src_port); 2462 bprintf(bp, " <-> %s %d", inet_ntop(AF_INET6, &d->id.dst_ip6, 2463 buf, sizeof(buf)), d->id.dst_port); 2464 } else 2465 bprintf(bp, " UNKNOWN <-> UNKNOWN"); 2466 if (d->kidx != 0) 2467 bprintf(bp, " :%s", object_search_ctlv(fo->tstate, 2468 d->kidx, IPFW_TLV_STATE_NAME)); 2469 2470 #define BOTH_SYN (TH_SYN | (TH_SYN << 8)) 2471 #define BOTH_FIN (TH_FIN | (TH_FIN << 8)) 2472 if (co->verbose) { 2473 bprintf(bp, " state 0x%08x%s", d->state, 2474 d->state ? " ": ","); 2475 if (d->state & IPFW_DYN_ORPHANED) 2476 bprintf(bp, "ORPHANED,"); 2477 if ((d->state & BOTH_SYN) == BOTH_SYN) 2478 bprintf(bp, "BOTH_SYN,"); 2479 else { 2480 if (d->state & TH_SYN) 2481 bprintf(bp, "F_SYN,"); 2482 if (d->state & (TH_SYN << 8)) 2483 bprintf(bp, "R_SYN,"); 2484 } 2485 if ((d->state & BOTH_FIN) == BOTH_FIN) 2486 bprintf(bp, "BOTH_FIN,"); 2487 else { 2488 if (d->state & TH_FIN) 2489 bprintf(bp, "F_FIN,"); 2490 if (d->state & (TH_FIN << 8)) 2491 bprintf(bp, "R_FIN,"); 2492 } 2493 bprintf(bp, " f_ack 0x%x, r_ack 0x%x", d->ack_fwd, 2494 d->ack_rev); 2495 } 2496 } 2497 2498 static int 2499 do_range_cmd(int cmd, ipfw_range_tlv *rt) 2500 { 2501 ipfw_range_header rh; 2502 size_t sz; 2503 2504 memset(&rh, 0, sizeof(rh)); 2505 memcpy(&rh.range, rt, sizeof(*rt)); 2506 rh.range.head.length = sizeof(*rt); 2507 rh.range.head.type = IPFW_TLV_RANGE; 2508 sz = sizeof(rh); 2509 2510 if (do_get3(cmd, &rh.opheader, &sz) != 0) 2511 return (-1); 2512 /* Save number of matched objects */ 2513 rt->new_set = rh.range.new_set; 2514 return (0); 2515 } 2516 2517 /* 2518 * This one handles all set-related commands 2519 * ipfw set { show | enable | disable } 2520 * ipfw set swap X Y 2521 * ipfw set move X to Y 2522 * ipfw set move rule X to Y 2523 */ 2524 void 2525 ipfw_sets_handler(char *av[]) 2526 { 2527 ipfw_range_tlv rt; 2528 const char *msg; 2529 size_t size; 2530 uint32_t masks[2]; 2531 int i; 2532 uint16_t rulenum; 2533 uint8_t cmd; 2534 2535 av++; 2536 memset(&rt, 0, sizeof(rt)); 2537 2538 if (av[0] == NULL) 2539 errx(EX_USAGE, "set needs command"); 2540 if (_substrcmp(*av, "show") == 0) { 2541 struct format_opts fo; 2542 ipfw_cfg_lheader *cfg; 2543 2544 memset(&fo, 0, sizeof(fo)); 2545 if (ipfw_get_config(&g_co, &fo, &cfg, &size) != 0) 2546 err(EX_OSERR, "requesting config failed"); 2547 2548 for (i = 0, msg = "disable"; i < RESVD_SET; i++) 2549 if ((cfg->set_mask & (1<<i)) == 0) { 2550 printf("%s %d", msg, i); 2551 msg = ""; 2552 } 2553 msg = (cfg->set_mask != (uint32_t)-1) ? " enable" : "enable"; 2554 for (i = 0; i < RESVD_SET; i++) 2555 if ((cfg->set_mask & (1<<i)) != 0) { 2556 printf("%s %d", msg, i); 2557 msg = ""; 2558 } 2559 printf("\n"); 2560 free(cfg); 2561 } else if (_substrcmp(*av, "swap") == 0) { 2562 av++; 2563 if ( av[0] == NULL || av[1] == NULL ) 2564 errx(EX_USAGE, "set swap needs 2 set numbers\n"); 2565 rt.set = atoi(av[0]); 2566 rt.new_set = atoi(av[1]); 2567 if (!isdigit(*(av[0])) || rt.set > RESVD_SET) 2568 errx(EX_DATAERR, "invalid set number %s\n", av[0]); 2569 if (!isdigit(*(av[1])) || rt.new_set > RESVD_SET) 2570 errx(EX_DATAERR, "invalid set number %s\n", av[1]); 2571 i = do_range_cmd(IP_FW_SET_SWAP, &rt); 2572 } else if (_substrcmp(*av, "move") == 0) { 2573 av++; 2574 if (av[0] && _substrcmp(*av, "rule") == 0) { 2575 rt.flags = IPFW_RCFLAG_RANGE; /* move rules to new set */ 2576 cmd = IP_FW_XMOVE; 2577 av++; 2578 } else 2579 cmd = IP_FW_SET_MOVE; /* Move set to new one */ 2580 if (av[0] == NULL || av[1] == NULL || av[2] == NULL || 2581 av[3] != NULL || _substrcmp(av[1], "to") != 0) 2582 errx(EX_USAGE, "syntax: set move [rule] X to Y\n"); 2583 rulenum = atoi(av[0]); 2584 rt.new_set = atoi(av[2]); 2585 if (cmd == IP_FW_XMOVE) { 2586 rt.start_rule = rulenum; 2587 rt.end_rule = rulenum; 2588 } else 2589 rt.set = rulenum; 2590 rt.new_set = atoi(av[2]); 2591 if (!isdigit(*(av[0])) || (cmd == 3 && rt.set > RESVD_SET) || 2592 (cmd == 2 && rt.start_rule == IPFW_DEFAULT_RULE) ) 2593 errx(EX_DATAERR, "invalid source number %s\n", av[0]); 2594 if (!isdigit(*(av[2])) || rt.new_set > RESVD_SET) 2595 errx(EX_DATAERR, "invalid dest. set %s\n", av[1]); 2596 i = do_range_cmd(cmd, &rt); 2597 if (i < 0) 2598 err(EX_OSERR, "failed to move %s", 2599 cmd == IP_FW_SET_MOVE ? "set": "rule"); 2600 } else if (_substrcmp(*av, "disable") == 0 || 2601 _substrcmp(*av, "enable") == 0 ) { 2602 int which = _substrcmp(*av, "enable") == 0 ? 1 : 0; 2603 2604 av++; 2605 masks[0] = masks[1] = 0; 2606 2607 while (av[0]) { 2608 if (isdigit(**av)) { 2609 i = atoi(*av); 2610 if (i < 0 || i > RESVD_SET) 2611 errx(EX_DATAERR, 2612 "invalid set number %d\n", i); 2613 masks[which] |= (1<<i); 2614 } else if (_substrcmp(*av, "disable") == 0) 2615 which = 0; 2616 else if (_substrcmp(*av, "enable") == 0) 2617 which = 1; 2618 else 2619 errx(EX_DATAERR, 2620 "invalid set command %s\n", *av); 2621 av++; 2622 } 2623 if ( (masks[0] & masks[1]) != 0 ) 2624 errx(EX_DATAERR, 2625 "cannot enable and disable the same set\n"); 2626 2627 rt.set = masks[0]; 2628 rt.new_set = masks[1]; 2629 i = do_range_cmd(IP_FW_SET_ENABLE, &rt); 2630 if (i) 2631 warn("set enable/disable: setsockopt(IP_FW_SET_ENABLE)"); 2632 } else 2633 errx(EX_USAGE, "invalid set command %s\n", *av); 2634 } 2635 2636 void 2637 ipfw_sysctl_handler(char *av[], int which) 2638 { 2639 av++; 2640 2641 if (av[0] == NULL) { 2642 warnx("missing keyword to enable/disable\n"); 2643 } else if (_substrcmp(*av, "firewall") == 0) { 2644 sysctlbyname("net.inet.ip.fw.enable", NULL, 0, 2645 &which, sizeof(which)); 2646 sysctlbyname("net.inet6.ip6.fw.enable", NULL, 0, 2647 &which, sizeof(which)); 2648 } else if (_substrcmp(*av, "one_pass") == 0) { 2649 sysctlbyname("net.inet.ip.fw.one_pass", NULL, 0, 2650 &which, sizeof(which)); 2651 } else if (_substrcmp(*av, "debug") == 0) { 2652 sysctlbyname("net.inet.ip.fw.debug", NULL, 0, 2653 &which, sizeof(which)); 2654 } else if (_substrcmp(*av, "verbose") == 0) { 2655 sysctlbyname("net.inet.ip.fw.verbose", NULL, 0, 2656 &which, sizeof(which)); 2657 } else if (_substrcmp(*av, "dyn_keepalive") == 0) { 2658 sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0, 2659 &which, sizeof(which)); 2660 #ifndef NO_ALTQ 2661 } else if (_substrcmp(*av, "altq") == 0) { 2662 altq_set_enabled(which); 2663 #endif 2664 } else { 2665 warnx("unrecognize enable/disable keyword: %s\n", *av); 2666 } 2667 } 2668 2669 typedef void state_cb(struct cmdline_opts *co, struct format_opts *fo, 2670 void *arg, void *state); 2671 2672 static void 2673 prepare_format_dyn(struct cmdline_opts *co, struct format_opts *fo, 2674 void *arg __unused, void *_state) 2675 { 2676 ipfw_dyn_rule *d; 2677 int width; 2678 uint8_t set; 2679 2680 d = (ipfw_dyn_rule *)_state; 2681 /* Count _ALL_ states */ 2682 fo->dcnt++; 2683 2684 if (fo->show_counters == 0) 2685 return; 2686 2687 if (co->use_set) { 2688 /* skip states from another set */ 2689 bcopy((char *)&d->rule + sizeof(uint16_t), &set, 2690 sizeof(uint8_t)); 2691 if (set != co->use_set - 1) 2692 return; 2693 } 2694 2695 width = pr_u64(NULL, &d->pcnt, 0); 2696 if (width > fo->pcwidth) 2697 fo->pcwidth = width; 2698 2699 width = pr_u64(NULL, &d->bcnt, 0); 2700 if (width > fo->bcwidth) 2701 fo->bcwidth = width; 2702 } 2703 2704 static int 2705 foreach_state(struct cmdline_opts *co, struct format_opts *fo, 2706 caddr_t base, size_t sz, state_cb dyn_bc, void *dyn_arg) 2707 { 2708 int ttype; 2709 state_cb *fptr; 2710 void *farg; 2711 ipfw_obj_tlv *tlv; 2712 ipfw_obj_ctlv *ctlv; 2713 2714 fptr = NULL; 2715 ttype = 0; 2716 2717 while (sz > 0) { 2718 ctlv = (ipfw_obj_ctlv *)base; 2719 switch (ctlv->head.type) { 2720 case IPFW_TLV_DYNSTATE_LIST: 2721 base += sizeof(*ctlv); 2722 sz -= sizeof(*ctlv); 2723 ttype = IPFW_TLV_DYN_ENT; 2724 fptr = dyn_bc; 2725 farg = dyn_arg; 2726 break; 2727 default: 2728 return (sz); 2729 } 2730 2731 while (sz > 0) { 2732 tlv = (ipfw_obj_tlv *)base; 2733 if (tlv->type != ttype) 2734 break; 2735 2736 fptr(co, fo, farg, tlv + 1); 2737 sz -= tlv->length; 2738 base += tlv->length; 2739 } 2740 } 2741 2742 return (sz); 2743 } 2744 2745 static void 2746 prepare_format_opts(struct cmdline_opts *co, struct format_opts *fo, 2747 ipfw_obj_tlv *rtlv, int rcnt, caddr_t dynbase, size_t dynsz) 2748 { 2749 int bcwidth, pcwidth, width; 2750 int n; 2751 struct ip_fw_bcounter *cntr; 2752 struct ip_fw_rule *r; 2753 2754 bcwidth = 0; 2755 pcwidth = 0; 2756 if (fo->show_counters != 0) { 2757 for (n = 0; n < rcnt; n++, 2758 rtlv = (ipfw_obj_tlv *)((caddr_t)rtlv + rtlv->length)) { 2759 cntr = (struct ip_fw_bcounter *)(rtlv + 1); 2760 r = (struct ip_fw_rule *)((caddr_t)cntr + cntr->size); 2761 /* skip rules from another set */ 2762 if (co->use_set && r->set != co->use_set - 1) 2763 continue; 2764 2765 /* packet counter */ 2766 width = pr_u64(NULL, &cntr->pcnt, 0); 2767 if (width > pcwidth) 2768 pcwidth = width; 2769 2770 /* byte counter */ 2771 width = pr_u64(NULL, &cntr->bcnt, 0); 2772 if (width > bcwidth) 2773 bcwidth = width; 2774 } 2775 } 2776 fo->bcwidth = bcwidth; 2777 fo->pcwidth = pcwidth; 2778 2779 fo->dcnt = 0; 2780 if (co->do_dynamic && dynsz > 0) 2781 foreach_state(co, fo, dynbase, dynsz, prepare_format_dyn, NULL); 2782 } 2783 2784 static int 2785 list_static_range(struct cmdline_opts *co, struct format_opts *fo, 2786 struct buf_pr *bp, ipfw_obj_tlv *rtlv, int rcnt) 2787 { 2788 int n, seen; 2789 struct ip_fw_rule *r; 2790 struct ip_fw_bcounter *cntr; 2791 2792 for (n = seen = 0; n < rcnt; n++, 2793 rtlv = (ipfw_obj_tlv *)((caddr_t)rtlv + rtlv->length)) { 2794 2795 if ((fo->show_counters | fo->show_time) != 0) { 2796 cntr = (struct ip_fw_bcounter *)(rtlv + 1); 2797 r = (struct ip_fw_rule *)((caddr_t)cntr + cntr->size); 2798 } else { 2799 cntr = NULL; 2800 r = (struct ip_fw_rule *)(rtlv + 1); 2801 } 2802 if (r->rulenum > fo->last) 2803 break; 2804 if (co->use_set && r->set != co->use_set - 1) 2805 continue; 2806 if (r->rulenum >= fo->first && r->rulenum <= fo->last) { 2807 show_static_rule(co, fo, bp, r, cntr); 2808 printf("%s", bp->buf); 2809 bp_flush(bp); 2810 seen++; 2811 } 2812 } 2813 2814 return (seen); 2815 } 2816 2817 static void 2818 list_dyn_state(struct cmdline_opts *co, struct format_opts *fo, 2819 void *_arg, void *_state) 2820 { 2821 uint16_t rulenum; 2822 uint8_t set; 2823 ipfw_dyn_rule *d; 2824 struct buf_pr *bp; 2825 2826 d = (ipfw_dyn_rule *)_state; 2827 bp = (struct buf_pr *)_arg; 2828 2829 bcopy(&d->rule, &rulenum, sizeof(rulenum)); 2830 if (rulenum > fo->last) 2831 return; 2832 if (co->use_set) { 2833 bcopy((char *)&d->rule + sizeof(uint16_t), 2834 &set, sizeof(uint8_t)); 2835 if (set != co->use_set - 1) 2836 return; 2837 } 2838 if (rulenum >= fo->first) { 2839 show_dyn_state(co, fo, bp, d); 2840 printf("%s\n", bp->buf); 2841 bp_flush(bp); 2842 } 2843 } 2844 2845 static int 2846 list_dyn_range(struct cmdline_opts *co, struct format_opts *fo, 2847 struct buf_pr *bp, caddr_t base, size_t sz) 2848 { 2849 2850 sz = foreach_state(co, fo, base, sz, list_dyn_state, bp); 2851 return (sz); 2852 } 2853 2854 void 2855 ipfw_list(int ac, char *av[], int show_counters) 2856 { 2857 ipfw_cfg_lheader *cfg; 2858 struct format_opts sfo; 2859 size_t sz; 2860 int error; 2861 int lac; 2862 char **lav; 2863 uint32_t rnum; 2864 char *endptr; 2865 2866 if (g_co.test_only) { 2867 fprintf(stderr, "Testing only, list disabled\n"); 2868 return; 2869 } 2870 if (g_co.do_pipe) { 2871 dummynet_list(ac, av, show_counters); 2872 return; 2873 } 2874 2875 ac--; 2876 av++; 2877 memset(&sfo, 0, sizeof(sfo)); 2878 2879 /* Determine rule range to request */ 2880 if (ac > 0) { 2881 for (lac = ac, lav = av; lac != 0; lac--) { 2882 rnum = strtoul(*lav++, &endptr, 10); 2883 if (sfo.first == 0 || rnum < sfo.first) 2884 sfo.first = rnum; 2885 2886 if (*endptr == '-') 2887 rnum = strtoul(endptr + 1, &endptr, 10); 2888 if (sfo.last == 0 || rnum > sfo.last) 2889 sfo.last = rnum; 2890 } 2891 } 2892 2893 /* get configuration from kernel */ 2894 cfg = NULL; 2895 sfo.show_counters = show_counters; 2896 sfo.show_time = g_co.do_time; 2897 if (g_co.do_dynamic != 2) 2898 sfo.flags |= IPFW_CFG_GET_STATIC; 2899 if (g_co.do_dynamic != 0) 2900 sfo.flags |= IPFW_CFG_GET_STATES; 2901 if ((sfo.show_counters | sfo.show_time) != 0) 2902 sfo.flags |= IPFW_CFG_GET_COUNTERS; 2903 if (ipfw_get_config(&g_co, &sfo, &cfg, &sz) != 0) 2904 err(EX_OSERR, "retrieving config failed"); 2905 2906 error = ipfw_show_config(&g_co, &sfo, cfg, sz, ac, av); 2907 2908 free(cfg); 2909 2910 if (error != EX_OK) 2911 exit(error); 2912 } 2913 2914 static int 2915 ipfw_show_config(struct cmdline_opts *co, struct format_opts *fo, 2916 ipfw_cfg_lheader *cfg, size_t sz, int ac, char *av[]) 2917 { 2918 caddr_t dynbase; 2919 size_t dynsz; 2920 int rcnt; 2921 int exitval = EX_OK; 2922 int lac; 2923 char **lav; 2924 char *endptr; 2925 size_t readsz; 2926 struct buf_pr bp; 2927 ipfw_obj_ctlv *ctlv; 2928 ipfw_obj_tlv *rbase; 2929 2930 /* 2931 * Handle tablenames TLV first, if any 2932 */ 2933 rbase = NULL; 2934 dynbase = NULL; 2935 dynsz = 0; 2936 readsz = sizeof(*cfg); 2937 rcnt = 0; 2938 2939 fo->set_mask = cfg->set_mask; 2940 2941 ctlv = (ipfw_obj_ctlv *)(cfg + 1); 2942 if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) { 2943 object_sort_ctlv(ctlv); 2944 fo->tstate = ctlv; 2945 readsz += ctlv->head.length; 2946 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length); 2947 } 2948 2949 if (cfg->flags & IPFW_CFG_GET_STATIC) { 2950 /* We've requested static rules */ 2951 if (ctlv->head.type == IPFW_TLV_RULE_LIST) { 2952 rbase = (ipfw_obj_tlv *)(ctlv + 1); 2953 rcnt = ctlv->count; 2954 readsz += ctlv->head.length; 2955 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + 2956 ctlv->head.length); 2957 } 2958 } 2959 2960 if ((cfg->flags & IPFW_CFG_GET_STATES) && (readsz != sz)) { 2961 /* We may have some dynamic states */ 2962 dynsz = sz - readsz; 2963 /* Skip empty header */ 2964 if (dynsz != sizeof(ipfw_obj_ctlv)) 2965 dynbase = (caddr_t)ctlv; 2966 else 2967 dynsz = 0; 2968 } 2969 2970 prepare_format_opts(co, fo, rbase, rcnt, dynbase, dynsz); 2971 bp_alloc(&bp, 4096); 2972 2973 /* if no rule numbers were specified, list all rules */ 2974 if (ac == 0) { 2975 fo->first = 0; 2976 fo->last = IPFW_DEFAULT_RULE; 2977 if (cfg->flags & IPFW_CFG_GET_STATIC) 2978 list_static_range(co, fo, &bp, rbase, rcnt); 2979 2980 if (co->do_dynamic && dynsz > 0) { 2981 printf("## Dynamic rules (%d %zu):\n", fo->dcnt, 2982 dynsz); 2983 list_dyn_range(co, fo, &bp, dynbase, dynsz); 2984 } 2985 2986 bp_free(&bp); 2987 return (EX_OK); 2988 } 2989 2990 /* display specific rules requested on command line */ 2991 for (lac = ac, lav = av; lac != 0; lac--) { 2992 /* convert command line rule # */ 2993 fo->last = fo->first = strtoul(*lav++, &endptr, 10); 2994 if (*endptr == '-') 2995 fo->last = strtoul(endptr + 1, &endptr, 10); 2996 if (*endptr) { 2997 exitval = EX_USAGE; 2998 warnx("invalid rule number: %s", *(lav - 1)); 2999 continue; 3000 } 3001 3002 if ((cfg->flags & IPFW_CFG_GET_STATIC) == 0) 3003 continue; 3004 3005 if (list_static_range(co, fo, &bp, rbase, rcnt) == 0) { 3006 /* give precedence to other error(s) */ 3007 if (exitval == EX_OK) 3008 exitval = EX_UNAVAILABLE; 3009 if (fo->first == fo->last) 3010 warnx("rule %u does not exist", fo->first); 3011 else 3012 warnx("no rules in range %u-%u", 3013 fo->first, fo->last); 3014 } 3015 } 3016 3017 if (co->do_dynamic && dynsz > 0) { 3018 printf("## Dynamic rules:\n"); 3019 for (lac = ac, lav = av; lac != 0; lac--) { 3020 fo->last = fo->first = strtoul(*lav++, &endptr, 10); 3021 if (*endptr == '-') 3022 fo->last = strtoul(endptr+1, &endptr, 10); 3023 if (*endptr) 3024 /* already warned */ 3025 continue; 3026 list_dyn_range(co, fo, &bp, dynbase, dynsz); 3027 } 3028 } 3029 3030 bp_free(&bp); 3031 return (exitval); 3032 } 3033 3034 3035 /* 3036 * Retrieves current ipfw configuration of given type 3037 * and stores its pointer to @pcfg. 3038 * 3039 * Caller is responsible for freeing @pcfg. 3040 * 3041 * Returns 0 on success. 3042 */ 3043 3044 static int 3045 ipfw_get_config(struct cmdline_opts *co, struct format_opts *fo, 3046 ipfw_cfg_lheader **pcfg, size_t *psize) 3047 { 3048 ipfw_cfg_lheader *cfg; 3049 size_t sz; 3050 int i; 3051 3052 3053 if (co->test_only != 0) { 3054 fprintf(stderr, "Testing only, list disabled\n"); 3055 return (0); 3056 } 3057 3058 /* Start with some data size */ 3059 sz = 4096; 3060 cfg = NULL; 3061 3062 for (i = 0; i < 16; i++) { 3063 if (cfg != NULL) 3064 free(cfg); 3065 if ((cfg = calloc(1, sz)) == NULL) 3066 return (ENOMEM); 3067 3068 cfg->flags = fo->flags; 3069 cfg->start_rule = fo->first; 3070 cfg->end_rule = fo->last; 3071 3072 if (do_get3(IP_FW_XGET, &cfg->opheader, &sz) != 0) { 3073 if (errno != ENOMEM) { 3074 free(cfg); 3075 return (errno); 3076 } 3077 3078 /* Buffer size is not enough. Try to increase */ 3079 sz = sz * 2; 3080 if (sz < cfg->size) 3081 sz = cfg->size; 3082 continue; 3083 } 3084 3085 *pcfg = cfg; 3086 *psize = sz; 3087 return (0); 3088 } 3089 3090 free(cfg); 3091 return (ENOMEM); 3092 } 3093 3094 static int 3095 lookup_host (char *host, struct in_addr *ipaddr) 3096 { 3097 struct hostent *he; 3098 3099 if (!inet_aton(host, ipaddr)) { 3100 if ((he = gethostbyname(host)) == NULL) 3101 return(-1); 3102 *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 3103 } 3104 return(0); 3105 } 3106 3107 struct tidx { 3108 ipfw_obj_ntlv *idx; 3109 uint32_t count; 3110 uint32_t size; 3111 uint16_t counter; 3112 uint8_t set; 3113 }; 3114 3115 int 3116 ipfw_check_object_name(const char *name) 3117 { 3118 int c, i, l; 3119 3120 /* 3121 * Check that name is null-terminated and contains 3122 * valid symbols only. Valid mask is: 3123 * [a-zA-Z0-9\-_\.]{1,63} 3124 */ 3125 l = strlen(name); 3126 if (l == 0 || l >= 64) 3127 return (EINVAL); 3128 for (i = 0; i < l; i++) { 3129 c = name[i]; 3130 if (isalpha(c) || isdigit(c) || c == '_' || 3131 c == '-' || c == '.') 3132 continue; 3133 return (EINVAL); 3134 } 3135 return (0); 3136 } 3137 3138 static const char *default_state_name = "default"; 3139 3140 static int 3141 state_check_name(const char *name) 3142 { 3143 3144 if (ipfw_check_object_name(name) != 0) 3145 return (EINVAL); 3146 if (strcmp(name, "any") == 0) 3147 return (EINVAL); 3148 return (0); 3149 } 3150 3151 static int 3152 eaction_check_name(const char *name) 3153 { 3154 3155 if (ipfw_check_object_name(name) != 0) 3156 return (EINVAL); 3157 /* Restrict some 'special' names */ 3158 if (match_token(rule_actions, name) != -1 && 3159 match_token(rule_action_params, name) != -1) 3160 return (EINVAL); 3161 return (0); 3162 } 3163 3164 static uint16_t 3165 pack_object(struct tidx *tstate, const char *name, int otype) 3166 { 3167 ipfw_obj_ntlv *ntlv; 3168 uint32_t i; 3169 3170 for (i = 0; i < tstate->count; i++) { 3171 if (strcmp(tstate->idx[i].name, name) != 0) 3172 continue; 3173 if (tstate->idx[i].set != tstate->set) 3174 continue; 3175 if (tstate->idx[i].head.type != otype) 3176 continue; 3177 3178 return (tstate->idx[i].idx); 3179 } 3180 3181 if (tstate->count + 1 > tstate->size) { 3182 tstate->size += 4; 3183 tstate->idx = realloc(tstate->idx, tstate->size * 3184 sizeof(ipfw_obj_ntlv)); 3185 if (tstate->idx == NULL) 3186 return (0); 3187 } 3188 3189 ntlv = &tstate->idx[i]; 3190 memset(ntlv, 0, sizeof(ipfw_obj_ntlv)); 3191 strlcpy(ntlv->name, name, sizeof(ntlv->name)); 3192 ntlv->head.type = otype; 3193 ntlv->head.length = sizeof(ipfw_obj_ntlv); 3194 ntlv->set = tstate->set; 3195 ntlv->idx = ++tstate->counter; 3196 tstate->count++; 3197 3198 return (ntlv->idx); 3199 } 3200 3201 static uint16_t 3202 pack_table(struct tidx *tstate, const char *name) 3203 { 3204 3205 if (table_check_name(name) != 0) 3206 return (0); 3207 3208 return (pack_object(tstate, name, IPFW_TLV_TBL_NAME)); 3209 } 3210 3211 void 3212 fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode, 3213 struct tidx *tstate) 3214 { 3215 uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; 3216 uint16_t uidx; 3217 char *p; 3218 3219 if ((p = strchr(av + 6, ')')) == NULL) 3220 errx(EX_DATAERR, "forgotten parenthesis: '%s'", av); 3221 *p = '\0'; 3222 p = strchr(av + 6, ','); 3223 if (p) 3224 *p++ = '\0'; 3225 3226 if ((uidx = pack_table(tstate, av + 6)) == 0) 3227 errx(EX_DATAERR, "Invalid table name: %s", av + 6); 3228 3229 cmd->opcode = opcode; 3230 cmd->arg1 = uidx; 3231 if (p) { 3232 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 3233 d[0] = strtoul(p, NULL, 0); 3234 } else 3235 cmd->len |= F_INSN_SIZE(ipfw_insn); 3236 } 3237 3238 3239 /* 3240 * fills the addr and mask fields in the instruction as appropriate from av. 3241 * Update length as appropriate. 3242 * The following formats are allowed: 3243 * me returns O_IP_*_ME 3244 * 1.2.3.4 single IP address 3245 * 1.2.3.4:5.6.7.8 address:mask 3246 * 1.2.3.4/24 address/mask 3247 * 1.2.3.4/26{1,6,5,4,23} set of addresses in a subnet 3248 * We can have multiple comma-separated address/mask entries. 3249 */ 3250 static void 3251 fill_ip(ipfw_insn_ip *cmd, char *av, int cblen, struct tidx *tstate) 3252 { 3253 int len = 0; 3254 uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; 3255 3256 cmd->o.len &= ~F_LEN_MASK; /* zero len */ 3257 3258 if (_substrcmp(av, "any") == 0) 3259 return; 3260 3261 if (_substrcmp(av, "me") == 0) { 3262 cmd->o.len |= F_INSN_SIZE(ipfw_insn); 3263 return; 3264 } 3265 3266 if (strncmp(av, "table(", 6) == 0) { 3267 fill_table(&cmd->o, av, O_IP_DST_LOOKUP, tstate); 3268 return; 3269 } 3270 3271 while (av) { 3272 /* 3273 * After the address we can have '/' or ':' indicating a mask, 3274 * ',' indicating another address follows, '{' indicating a 3275 * set of addresses of unspecified size. 3276 */ 3277 char *t = NULL, *p = strpbrk(av, "/:,{"); 3278 int masklen; 3279 char md, nd = '\0'; 3280 3281 CHECK_LENGTH(cblen, (int)F_INSN_SIZE(ipfw_insn) + 2 + len); 3282 3283 if (p) { 3284 md = *p; 3285 *p++ = '\0'; 3286 if ((t = strpbrk(p, ",{")) != NULL) { 3287 nd = *t; 3288 *t = '\0'; 3289 } 3290 } else 3291 md = '\0'; 3292 3293 if (lookup_host(av, (struct in_addr *)&d[0]) != 0) 3294 errx(EX_NOHOST, "hostname ``%s'' unknown", av); 3295 switch (md) { 3296 case ':': 3297 if (!inet_aton(p, (struct in_addr *)&d[1])) 3298 errx(EX_DATAERR, "bad netmask ``%s''", p); 3299 break; 3300 case '/': 3301 masklen = atoi(p); 3302 if (masklen == 0) 3303 d[1] = htonl(0U); /* mask */ 3304 else if (masklen > 32) 3305 errx(EX_DATAERR, "bad width ``%s''", p); 3306 else 3307 d[1] = htonl(~0U << (32 - masklen)); 3308 break; 3309 case '{': /* no mask, assume /24 and put back the '{' */ 3310 d[1] = htonl(~0U << (32 - 24)); 3311 *(--p) = md; 3312 break; 3313 3314 case ',': /* single address plus continuation */ 3315 *(--p) = md; 3316 /* FALLTHROUGH */ 3317 case 0: /* initialization value */ 3318 default: 3319 d[1] = htonl(~0U); /* force /32 */ 3320 break; 3321 } 3322 d[0] &= d[1]; /* mask base address with mask */ 3323 if (t) 3324 *t = nd; 3325 /* find next separator */ 3326 if (p) 3327 p = strpbrk(p, ",{"); 3328 if (p && *p == '{') { 3329 /* 3330 * We have a set of addresses. They are stored as follows: 3331 * arg1 is the set size (powers of 2, 2..256) 3332 * addr is the base address IN HOST FORMAT 3333 * mask.. is an array of arg1 bits (rounded up to 3334 * the next multiple of 32) with bits set 3335 * for each host in the map. 3336 */ 3337 uint32_t *map = (uint32_t *)&cmd->mask; 3338 int low, high; 3339 int i = contigmask((uint8_t *)&(d[1]), 32); 3340 3341 if (len > 0) 3342 errx(EX_DATAERR, "address set cannot be in a list"); 3343 if (i < 24 || i > 31) 3344 errx(EX_DATAERR, "invalid set with mask %d\n", i); 3345 cmd->o.arg1 = 1<<(32-i); /* map length */ 3346 d[0] = ntohl(d[0]); /* base addr in host format */ 3347 cmd->o.opcode = O_IP_DST_SET; /* default */ 3348 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + (cmd->o.arg1+31)/32; 3349 for (i = 0; i < (cmd->o.arg1+31)/32 ; i++) 3350 map[i] = 0; /* clear map */ 3351 3352 av = p + 1; 3353 low = d[0] & 0xff; 3354 high = low + cmd->o.arg1 - 1; 3355 /* 3356 * Here, i stores the previous value when we specify a range 3357 * of addresses within a mask, e.g. 45-63. i = -1 means we 3358 * have no previous value. 3359 */ 3360 i = -1; /* previous value in a range */ 3361 while (isdigit(*av)) { 3362 char *s; 3363 int a = strtol(av, &s, 0); 3364 3365 if (s == av) { /* no parameter */ 3366 if (*av != '}') 3367 errx(EX_DATAERR, "set not closed\n"); 3368 if (i != -1) 3369 errx(EX_DATAERR, "incomplete range %d-", i); 3370 break; 3371 } 3372 if (a < low || a > high) 3373 errx(EX_DATAERR, "addr %d out of range [%d-%d]\n", 3374 a, low, high); 3375 a -= low; 3376 if (i == -1) /* no previous in range */ 3377 i = a; 3378 else { /* check that range is valid */ 3379 if (i > a) 3380 errx(EX_DATAERR, "invalid range %d-%d", 3381 i+low, a+low); 3382 if (*s == '-') 3383 errx(EX_DATAERR, "double '-' in range"); 3384 } 3385 for (; i <= a; i++) 3386 map[i/32] |= 1<<(i & 31); 3387 i = -1; 3388 if (*s == '-') 3389 i = a; 3390 else if (*s == '}') 3391 break; 3392 av = s+1; 3393 } 3394 return; 3395 } 3396 av = p; 3397 if (av) /* then *av must be a ',' */ 3398 av++; 3399 3400 /* Check this entry */ 3401 if (d[1] == 0) { /* "any", specified as x.x.x.x/0 */ 3402 /* 3403 * 'any' turns the entire list into a NOP. 3404 * 'not any' never matches, so it is removed from the 3405 * list unless it is the only item, in which case we 3406 * report an error. 3407 */ 3408 if (cmd->o.len & F_NOT) { /* "not any" never matches */ 3409 if (av == NULL && len == 0) /* only this entry */ 3410 errx(EX_DATAERR, "not any never matches"); 3411 } 3412 /* else do nothing and skip this entry */ 3413 return; 3414 } 3415 /* A single IP can be stored in an optimized format */ 3416 if (d[1] == (uint32_t)~0 && av == NULL && len == 0) { 3417 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 3418 return; 3419 } 3420 len += 2; /* two words... */ 3421 d += 2; 3422 } /* end while */ 3423 if (len + 1 > F_LEN_MASK) 3424 errx(EX_DATAERR, "address list too long"); 3425 cmd->o.len |= len+1; 3426 } 3427 3428 3429 /* n2mask sets n bits of the mask */ 3430 void 3431 n2mask(struct in6_addr *mask, int n) 3432 { 3433 static int minimask[9] = 3434 { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff }; 3435 u_char *p; 3436 3437 memset(mask, 0, sizeof(struct in6_addr)); 3438 p = (u_char *) mask; 3439 for (; n > 0; p++, n -= 8) { 3440 if (n >= 8) 3441 *p = 0xff; 3442 else 3443 *p = minimask[n]; 3444 } 3445 return; 3446 } 3447 3448 static void 3449 fill_flags_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, 3450 struct _s_x *flags, char *p) 3451 { 3452 char *e; 3453 uint32_t set = 0, clear = 0; 3454 3455 if (fill_flags(flags, p, &e, &set, &clear) != 0) 3456 errx(EX_DATAERR, "invalid flag %s", e); 3457 3458 cmd->opcode = opcode; 3459 cmd->len = (cmd->len & (F_NOT | F_OR)) | 1; 3460 cmd->arg1 = (set & 0xff) | ( (clear & 0xff) << 8); 3461 } 3462 3463 3464 void 3465 ipfw_delete(char *av[]) 3466 { 3467 ipfw_range_tlv rt; 3468 char *sep; 3469 int i, j; 3470 int exitval = EX_OK; 3471 int do_set = 0; 3472 3473 av++; 3474 NEED1("missing rule specification"); 3475 if ( *av && _substrcmp(*av, "set") == 0) { 3476 /* Do not allow using the following syntax: 3477 * ipfw set N delete set M 3478 */ 3479 if (g_co.use_set) 3480 errx(EX_DATAERR, "invalid syntax"); 3481 do_set = 1; /* delete set */ 3482 av++; 3483 } 3484 3485 /* Rule number */ 3486 while (*av && isdigit(**av)) { 3487 i = strtol(*av, &sep, 10); 3488 j = i; 3489 if (*sep== '-') 3490 j = strtol(sep + 1, NULL, 10); 3491 av++; 3492 if (g_co.do_nat) { 3493 exitval = ipfw_delete_nat(i); 3494 } else if (g_co.do_pipe) { 3495 exitval = ipfw_delete_pipe(g_co.do_pipe, i); 3496 } else { 3497 memset(&rt, 0, sizeof(rt)); 3498 if (do_set != 0) { 3499 rt.set = i & 31; 3500 rt.flags = IPFW_RCFLAG_SET; 3501 } else { 3502 rt.start_rule = i & 0xffff; 3503 rt.end_rule = j & 0xffff; 3504 if (rt.start_rule == 0 && rt.end_rule == 0) 3505 rt.flags |= IPFW_RCFLAG_ALL; 3506 else 3507 rt.flags |= IPFW_RCFLAG_RANGE; 3508 if (g_co.use_set != 0) { 3509 rt.set = g_co.use_set - 1; 3510 rt.flags |= IPFW_RCFLAG_SET; 3511 } 3512 } 3513 if (g_co.do_dynamic == 2) 3514 rt.flags |= IPFW_RCFLAG_DYNAMIC; 3515 i = do_range_cmd(IP_FW_XDEL, &rt); 3516 if (i != 0) { 3517 exitval = EX_UNAVAILABLE; 3518 if (g_co.do_quiet) 3519 continue; 3520 warn("rule %u: setsockopt(IP_FW_XDEL)", 3521 rt.start_rule); 3522 } else if (rt.new_set == 0 && do_set == 0 && 3523 g_co.do_dynamic != 2) { 3524 exitval = EX_UNAVAILABLE; 3525 if (g_co.do_quiet) 3526 continue; 3527 if (rt.start_rule != rt.end_rule) 3528 warnx("no rules rules in %u-%u range", 3529 rt.start_rule, rt.end_rule); 3530 else 3531 warnx("rule %u not found", 3532 rt.start_rule); 3533 } 3534 } 3535 } 3536 if (exitval != EX_OK && g_co.do_force == 0) 3537 exit(exitval); 3538 } 3539 3540 3541 /* 3542 * fill the interface structure. We do not check the name as we can 3543 * create interfaces dynamically, so checking them at insert time 3544 * makes relatively little sense. 3545 * Interface names containing '*', '?', or '[' are assumed to be shell 3546 * patterns which match interfaces. 3547 */ 3548 static void 3549 fill_iface(ipfw_insn_if *cmd, char *arg, int cblen, struct tidx *tstate) 3550 { 3551 char *p; 3552 uint16_t uidx; 3553 3554 cmd->name[0] = '\0'; 3555 cmd->o.len |= F_INSN_SIZE(ipfw_insn_if); 3556 3557 CHECK_CMDLEN; 3558 3559 /* Parse the interface or address */ 3560 if (strcmp(arg, "any") == 0) 3561 cmd->o.len = 0; /* effectively ignore this command */ 3562 else if (strncmp(arg, "table(", 6) == 0) { 3563 if ((p = strchr(arg + 6, ')')) == NULL) 3564 errx(EX_DATAERR, "forgotten parenthesis: '%s'", arg); 3565 *p = '\0'; 3566 p = strchr(arg + 6, ','); 3567 if (p) 3568 *p++ = '\0'; 3569 if ((uidx = pack_table(tstate, arg + 6)) == 0) 3570 errx(EX_DATAERR, "Invalid table name: %s", arg + 6); 3571 3572 cmd->name[0] = '\1'; /* Special value indicating table */ 3573 cmd->p.kidx = uidx; 3574 } else if (!isdigit(*arg)) { 3575 strlcpy(cmd->name, arg, sizeof(cmd->name)); 3576 cmd->p.glob = strpbrk(arg, "*?[") != NULL ? 1 : 0; 3577 } else if (!inet_aton(arg, &cmd->p.ip)) 3578 errx(EX_DATAERR, "bad ip address ``%s''", arg); 3579 } 3580 3581 static void 3582 get_mac_addr_mask(const char *p, uint8_t *addr, uint8_t *mask) 3583 { 3584 int i; 3585 size_t l; 3586 char *ap, *ptr, *optr; 3587 struct ether_addr *mac; 3588 const char *macset = "0123456789abcdefABCDEF:"; 3589 3590 if (strcmp(p, "any") == 0) { 3591 for (i = 0; i < ETHER_ADDR_LEN; i++) 3592 addr[i] = mask[i] = 0; 3593 return; 3594 } 3595 3596 optr = ptr = strdup(p); 3597 if ((ap = strsep(&ptr, "&/")) != NULL && *ap != 0) { 3598 l = strlen(ap); 3599 if (strspn(ap, macset) != l || (mac = ether_aton(ap)) == NULL) 3600 errx(EX_DATAERR, "Incorrect MAC address"); 3601 bcopy(mac, addr, ETHER_ADDR_LEN); 3602 } else 3603 errx(EX_DATAERR, "Incorrect MAC address"); 3604 3605 if (ptr != NULL) { /* we have mask? */ 3606 if (p[ptr - optr - 1] == '/') { /* mask len */ 3607 long ml = strtol(ptr, &ap, 10); 3608 if (*ap != 0 || ml > ETHER_ADDR_LEN * 8 || ml < 0) 3609 errx(EX_DATAERR, "Incorrect mask length"); 3610 for (i = 0; ml > 0 && i < ETHER_ADDR_LEN; ml -= 8, i++) 3611 mask[i] = (ml >= 8) ? 0xff: (~0) << (8 - ml); 3612 } else { /* mask */ 3613 l = strlen(ptr); 3614 if (strspn(ptr, macset) != l || 3615 (mac = ether_aton(ptr)) == NULL) 3616 errx(EX_DATAERR, "Incorrect mask"); 3617 bcopy(mac, mask, ETHER_ADDR_LEN); 3618 } 3619 } else { /* default mask: ff:ff:ff:ff:ff:ff */ 3620 for (i = 0; i < ETHER_ADDR_LEN; i++) 3621 mask[i] = 0xff; 3622 } 3623 for (i = 0; i < ETHER_ADDR_LEN; i++) 3624 addr[i] &= mask[i]; 3625 3626 free(optr); 3627 } 3628 3629 /* 3630 * helper function, updates the pointer to cmd with the length 3631 * of the current command, and also cleans up the first word of 3632 * the new command in case it has been clobbered before. 3633 */ 3634 static ipfw_insn * 3635 next_cmd(ipfw_insn *cmd, int *len) 3636 { 3637 *len -= F_LEN(cmd); 3638 CHECK_LENGTH(*len, 0); 3639 cmd += F_LEN(cmd); 3640 bzero(cmd, sizeof(*cmd)); 3641 return cmd; 3642 } 3643 3644 /* 3645 * Takes arguments and copies them into a comment 3646 */ 3647 static void 3648 fill_comment(ipfw_insn *cmd, char **av, int cblen) 3649 { 3650 int i, l; 3651 char *p = (char *)(cmd + 1); 3652 3653 cmd->opcode = O_NOP; 3654 cmd->len = (cmd->len & (F_NOT | F_OR)); 3655 3656 /* Compute length of comment string. */ 3657 for (i = 0, l = 0; av[i] != NULL; i++) 3658 l += strlen(av[i]) + 1; 3659 if (l == 0) 3660 return; 3661 if (l > 84) 3662 errx(EX_DATAERR, 3663 "comment too long (max 80 chars)"); 3664 l = 1 + (l+3)/4; 3665 cmd->len = (cmd->len & (F_NOT | F_OR)) | l; 3666 CHECK_CMDLEN; 3667 3668 for (i = 0; av[i] != NULL; i++) { 3669 strcpy(p, av[i]); 3670 p += strlen(av[i]); 3671 *p++ = ' '; 3672 } 3673 *(--p) = '\0'; 3674 } 3675 3676 /* 3677 * A function to fill simple commands of size 1. 3678 * Existing flags are preserved. 3679 */ 3680 static void 3681 fill_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, int flags, uint16_t arg) 3682 { 3683 cmd->opcode = opcode; 3684 cmd->len = ((cmd->len | flags) & (F_NOT | F_OR)) | 1; 3685 cmd->arg1 = arg; 3686 } 3687 3688 /* 3689 * Fetch and add the MAC address and type, with masks. This generates one or 3690 * two microinstructions, and returns the pointer to the last one. 3691 */ 3692 static ipfw_insn * 3693 add_mac(ipfw_insn *cmd, char *av[], int cblen) 3694 { 3695 ipfw_insn_mac *mac; 3696 3697 if ( ( av[0] == NULL ) || ( av[1] == NULL ) ) 3698 errx(EX_DATAERR, "MAC dst src"); 3699 3700 cmd->opcode = O_MACADDR2; 3701 cmd->len = (cmd->len & (F_NOT | F_OR)) | F_INSN_SIZE(ipfw_insn_mac); 3702 CHECK_CMDLEN; 3703 3704 mac = (ipfw_insn_mac *)cmd; 3705 get_mac_addr_mask(av[0], mac->addr, mac->mask); /* dst */ 3706 get_mac_addr_mask(av[1], &(mac->addr[ETHER_ADDR_LEN]), 3707 &(mac->mask[ETHER_ADDR_LEN])); /* src */ 3708 return cmd; 3709 } 3710 3711 static ipfw_insn * 3712 add_mactype(ipfw_insn *cmd, char *av, int cblen) 3713 { 3714 if (!av) 3715 errx(EX_DATAERR, "missing MAC type"); 3716 if (strcmp(av, "any") != 0) { /* we have a non-null type */ 3717 fill_newports((ipfw_insn_u16 *)cmd, av, IPPROTO_ETHERTYPE, 3718 cblen); 3719 cmd->opcode = O_MAC_TYPE; 3720 return cmd; 3721 } else 3722 return NULL; 3723 } 3724 3725 static ipfw_insn * 3726 add_proto0(ipfw_insn *cmd, char *av, u_char *protop) 3727 { 3728 struct protoent *pe; 3729 char *ep; 3730 int proto; 3731 3732 proto = strtol(av, &ep, 10); 3733 if (*ep != '\0' || proto <= 0) { 3734 if ((pe = getprotobyname(av)) == NULL) 3735 return NULL; 3736 proto = pe->p_proto; 3737 } 3738 3739 fill_cmd(cmd, O_PROTO, 0, proto); 3740 *protop = proto; 3741 return cmd; 3742 } 3743 3744 static ipfw_insn * 3745 add_proto(ipfw_insn *cmd, char *av, u_char *protop) 3746 { 3747 u_char proto = IPPROTO_IP; 3748 3749 if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 3750 ; /* do not set O_IP4 nor O_IP6 */ 3751 else if (strcmp(av, "ip4") == 0) 3752 /* explicit "just IPv4" rule */ 3753 fill_cmd(cmd, O_IP4, 0, 0); 3754 else if (strcmp(av, "ip6") == 0) { 3755 /* explicit "just IPv6" rule */ 3756 proto = IPPROTO_IPV6; 3757 fill_cmd(cmd, O_IP6, 0, 0); 3758 } else 3759 return add_proto0(cmd, av, protop); 3760 3761 *protop = proto; 3762 return cmd; 3763 } 3764 3765 static ipfw_insn * 3766 add_proto_compat(ipfw_insn *cmd, char *av, u_char *protop) 3767 { 3768 u_char proto = IPPROTO_IP; 3769 3770 if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 3771 ; /* do not set O_IP4 nor O_IP6 */ 3772 else if (strcmp(av, "ipv4") == 0 || strcmp(av, "ip4") == 0) 3773 /* explicit "just IPv4" rule */ 3774 fill_cmd(cmd, O_IP4, 0, 0); 3775 else if (strcmp(av, "ipv6") == 0 || strcmp(av, "ip6") == 0) { 3776 /* explicit "just IPv6" rule */ 3777 proto = IPPROTO_IPV6; 3778 fill_cmd(cmd, O_IP6, 0, 0); 3779 } else 3780 return add_proto0(cmd, av, protop); 3781 3782 *protop = proto; 3783 return cmd; 3784 } 3785 3786 static ipfw_insn * 3787 add_srcip(ipfw_insn *cmd, char *av, int cblen, struct tidx *tstate) 3788 { 3789 fill_ip((ipfw_insn_ip *)cmd, av, cblen, tstate); 3790 if (cmd->opcode == O_IP_DST_SET) /* set */ 3791 cmd->opcode = O_IP_SRC_SET; 3792 else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 3793 cmd->opcode = O_IP_SRC_LOOKUP; 3794 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 3795 cmd->opcode = O_IP_SRC_ME; 3796 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 3797 cmd->opcode = O_IP_SRC; 3798 else /* addr/mask */ 3799 cmd->opcode = O_IP_SRC_MASK; 3800 return cmd; 3801 } 3802 3803 static ipfw_insn * 3804 add_dstip(ipfw_insn *cmd, char *av, int cblen, struct tidx *tstate) 3805 { 3806 fill_ip((ipfw_insn_ip *)cmd, av, cblen, tstate); 3807 if (cmd->opcode == O_IP_DST_SET) /* set */ 3808 ; 3809 else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 3810 ; 3811 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 3812 cmd->opcode = O_IP_DST_ME; 3813 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 3814 cmd->opcode = O_IP_DST; 3815 else /* addr/mask */ 3816 cmd->opcode = O_IP_DST_MASK; 3817 return cmd; 3818 } 3819 3820 static ipfw_insn * 3821 add_srcmac(ipfw_insn *cmd, char *av, struct tidx *tstate) 3822 { 3823 3824 if (strncmp(av, "table(", 6) == 0) 3825 fill_table(cmd, av, O_MAC_SRC_LOOKUP, tstate); 3826 else 3827 errx(EX_DATAERR, "only mac table lookup is supported %s", av); 3828 return cmd; 3829 } 3830 3831 static ipfw_insn * 3832 add_dstmac(ipfw_insn *cmd, char *av, struct tidx *tstate) 3833 { 3834 3835 if (strncmp(av, "table(", 6) == 0) 3836 fill_table(cmd, av, O_MAC_DST_LOOKUP, tstate); 3837 else 3838 errx(EX_DATAERR, "only mac table lookup is supported %s", av); 3839 return cmd; 3840 } 3841 3842 3843 static struct _s_x f_reserved_keywords[] = { 3844 { "altq", TOK_OR }, 3845 { "//", TOK_OR }, 3846 { "diverted", TOK_OR }, 3847 { "dst-port", TOK_OR }, 3848 { "src-port", TOK_OR }, 3849 { "established", TOK_OR }, 3850 { "keep-state", TOK_OR }, 3851 { "frag", TOK_OR }, 3852 { "icmptypes", TOK_OR }, 3853 { "in", TOK_OR }, 3854 { "out", TOK_OR }, 3855 { "ip6", TOK_OR }, 3856 { "any", TOK_OR }, 3857 { "to", TOK_OR }, 3858 { "via", TOK_OR }, 3859 { "{", TOK_OR }, 3860 { NULL, 0 } /* terminator */ 3861 }; 3862 3863 static ipfw_insn * 3864 add_ports(ipfw_insn *cmd, char *av, u_char proto, int opcode, int cblen) 3865 { 3866 3867 if (match_token(f_reserved_keywords, av) != -1) 3868 return (NULL); 3869 3870 if (fill_newports((ipfw_insn_u16 *)cmd, av, proto, cblen)) { 3871 /* XXX todo: check that we have a protocol with ports */ 3872 cmd->opcode = opcode; 3873 return cmd; 3874 } 3875 return NULL; 3876 } 3877 3878 static ipfw_insn * 3879 add_src(ipfw_insn *cmd, char *av, u_char proto, int cblen, struct tidx *tstate) 3880 { 3881 struct in6_addr a; 3882 char *host, *ch, buf[INET6_ADDRSTRLEN]; 3883 ipfw_insn *ret = NULL; 3884 size_t len; 3885 3886 /* Copy first address in set if needed */ 3887 if ((ch = strpbrk(av, "/,")) != NULL) { 3888 len = ch - av; 3889 strlcpy(buf, av, sizeof(buf)); 3890 if (len < sizeof(buf)) 3891 buf[len] = '\0'; 3892 host = buf; 3893 } else 3894 host = av; 3895 3896 if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 3897 inet_pton(AF_INET6, host, &a) == 1) 3898 ret = add_srcip6(cmd, av, cblen, tstate); 3899 /* XXX: should check for IPv4, not !IPv6 */ 3900 if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 3901 inet_pton(AF_INET6, host, &a) != 1)) 3902 ret = add_srcip(cmd, av, cblen, tstate); 3903 if (ret == NULL && strcmp(av, "any") != 0) 3904 ret = cmd; 3905 3906 return ret; 3907 } 3908 3909 static ipfw_insn * 3910 add_dst(ipfw_insn *cmd, char *av, u_char proto, int cblen, struct tidx *tstate) 3911 { 3912 struct in6_addr a; 3913 char *host, *ch, buf[INET6_ADDRSTRLEN]; 3914 ipfw_insn *ret = NULL; 3915 size_t len; 3916 3917 /* Copy first address in set if needed */ 3918 if ((ch = strpbrk(av, "/,")) != NULL) { 3919 len = ch - av; 3920 strlcpy(buf, av, sizeof(buf)); 3921 if (len < sizeof(buf)) 3922 buf[len] = '\0'; 3923 host = buf; 3924 } else 3925 host = av; 3926 3927 if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 3928 inet_pton(AF_INET6, host, &a) == 1) 3929 ret = add_dstip6(cmd, av, cblen, tstate); 3930 /* XXX: should check for IPv4, not !IPv6 */ 3931 if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 3932 inet_pton(AF_INET6, host, &a) != 1)) 3933 ret = add_dstip(cmd, av, cblen, tstate); 3934 if (ret == NULL && strcmp(av, "any") != 0) 3935 ret = cmd; 3936 3937 return ret; 3938 } 3939 3940 /* 3941 * Parse arguments and assemble the microinstructions which make up a rule. 3942 * Rules are added into the 'rulebuf' and then copied in the correct order 3943 * into the actual rule. 3944 * 3945 * The syntax for a rule starts with the action, followed by 3946 * optional action parameters, and the various match patterns. 3947 * In the assembled microcode, the first opcode must be an O_PROBE_STATE 3948 * (generated if the rule includes a keep-state option), then the 3949 * various match patterns, log/altq actions, and the actual action. 3950 * 3951 */ 3952 static void 3953 compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate) 3954 { 3955 /* 3956 * rules are added into the 'rulebuf' and then copied in 3957 * the correct order into the actual rule. 3958 * Some things that need to go out of order (prob, action etc.) 3959 * go into actbuf[]. 3960 */ 3961 static uint32_t actbuf[255], cmdbuf[255]; 3962 int rblen, ablen, cblen; 3963 3964 ipfw_insn *src, *dst, *cmd, *action, *prev=NULL; 3965 ipfw_insn *first_cmd; /* first match pattern */ 3966 3967 struct ip_fw_rule *rule; 3968 3969 /* 3970 * various flags used to record that we entered some fields. 3971 */ 3972 ipfw_insn *have_state = NULL; /* any state-related option */ 3973 int have_rstate = 0; 3974 ipfw_insn *have_log = NULL, *have_altq = NULL, *have_tag = NULL; 3975 ipfw_insn *have_skipcmd = NULL; 3976 size_t len; 3977 3978 int i; 3979 3980 int open_par = 0; /* open parenthesis ( */ 3981 3982 /* proto is here because it is used to fetch ports */ 3983 u_char proto = IPPROTO_IP; /* default protocol */ 3984 3985 double match_prob = 1; /* match probability, default is always match */ 3986 3987 bzero(actbuf, sizeof(actbuf)); /* actions go here */ 3988 bzero(cmdbuf, sizeof(cmdbuf)); 3989 bzero(rbuf, *rbufsize); 3990 3991 rule = (struct ip_fw_rule *)rbuf; 3992 cmd = (ipfw_insn *)cmdbuf; 3993 action = (ipfw_insn *)actbuf; 3994 3995 rblen = *rbufsize / sizeof(uint32_t); 3996 rblen -= sizeof(struct ip_fw_rule) / sizeof(uint32_t); 3997 ablen = sizeof(actbuf) / sizeof(actbuf[0]); 3998 cblen = sizeof(cmdbuf) / sizeof(cmdbuf[0]); 3999 cblen -= F_INSN_SIZE(ipfw_insn_u32) + 1; 4000 4001 #define CHECK_RBUFLEN(len) { CHECK_LENGTH(rblen, len); rblen -= len; } 4002 #define CHECK_ACTLEN CHECK_LENGTH(ablen, action->len) 4003 4004 av++; 4005 4006 /* [rule N] -- Rule number optional */ 4007 if (av[0] && isdigit(**av)) { 4008 rule->rulenum = atoi(*av); 4009 av++; 4010 } 4011 4012 /* [set N] -- set number (0..RESVD_SET), optional */ 4013 if (av[0] && av[1] && _substrcmp(*av, "set") == 0) { 4014 int set = strtoul(av[1], NULL, 10); 4015 if (set < 0 || set > RESVD_SET) 4016 errx(EX_DATAERR, "illegal set %s", av[1]); 4017 rule->set = set; 4018 tstate->set = set; 4019 av += 2; 4020 } 4021 4022 /* [prob D] -- match probability, optional */ 4023 if (av[0] && av[1] && _substrcmp(*av, "prob") == 0) { 4024 match_prob = strtod(av[1], NULL); 4025 4026 if (match_prob <= 0 || match_prob > 1) 4027 errx(EX_DATAERR, "illegal match prob. %s", av[1]); 4028 av += 2; 4029 } 4030 4031 /* action -- mandatory */ 4032 NEED1("missing action"); 4033 i = match_token(rule_actions, *av); 4034 av++; 4035 action->len = 1; /* default */ 4036 CHECK_ACTLEN; 4037 switch(i) { 4038 case TOK_CHECKSTATE: 4039 have_state = action; 4040 action->opcode = O_CHECK_STATE; 4041 if (*av == NULL || 4042 match_token(rule_options, *av) == TOK_COMMENT) { 4043 action->arg1 = pack_object(tstate, 4044 default_state_name, IPFW_TLV_STATE_NAME); 4045 break; 4046 } 4047 if (*av[0] == ':') { 4048 if (strcmp(*av + 1, "any") == 0) 4049 action->arg1 = 0; 4050 else if (state_check_name(*av + 1) == 0) 4051 action->arg1 = pack_object(tstate, *av + 1, 4052 IPFW_TLV_STATE_NAME); 4053 else 4054 errx(EX_DATAERR, "Invalid state name %s", 4055 *av); 4056 av++; 4057 break; 4058 } 4059 errx(EX_DATAERR, "Invalid state name %s", *av); 4060 break; 4061 4062 case TOK_ABORT: 4063 action->opcode = O_REJECT; 4064 action->arg1 = ICMP_REJECT_ABORT; 4065 break; 4066 4067 case TOK_ABORT6: 4068 action->opcode = O_UNREACH6; 4069 action->arg1 = ICMP6_UNREACH_ABORT; 4070 break; 4071 4072 case TOK_ACCEPT: 4073 action->opcode = O_ACCEPT; 4074 break; 4075 4076 case TOK_DENY: 4077 action->opcode = O_DENY; 4078 action->arg1 = 0; 4079 break; 4080 4081 case TOK_REJECT: 4082 action->opcode = O_REJECT; 4083 action->arg1 = ICMP_UNREACH_HOST; 4084 break; 4085 4086 case TOK_RESET: 4087 action->opcode = O_REJECT; 4088 action->arg1 = ICMP_REJECT_RST; 4089 break; 4090 4091 case TOK_RESET6: 4092 action->opcode = O_UNREACH6; 4093 action->arg1 = ICMP6_UNREACH_RST; 4094 break; 4095 4096 case TOK_UNREACH: 4097 action->opcode = O_REJECT; 4098 NEED1("missing reject code"); 4099 fill_reject_code(&action->arg1, *av); 4100 av++; 4101 if (action->arg1 == ICMP_UNREACH_NEEDFRAG && isdigit(**av)) { 4102 uint16_t mtu; 4103 4104 mtu = strtoul(*av, NULL, 10); 4105 if (mtu < 68 || mtu >= IP_MAXPACKET) 4106 errx(EX_DATAERR, "illegal argument for %s", 4107 *(av - 1)); 4108 action->len = F_INSN_SIZE(ipfw_insn_u16); 4109 ((ipfw_insn_u16 *)action)->ports[0] = mtu; 4110 av++; 4111 } 4112 break; 4113 4114 case TOK_UNREACH6: 4115 action->opcode = O_UNREACH6; 4116 NEED1("missing unreach code"); 4117 fill_unreach6_code(&action->arg1, *av); 4118 av++; 4119 break; 4120 4121 case TOK_COUNT: 4122 action->opcode = O_COUNT; 4123 break; 4124 4125 case TOK_NAT: 4126 action->opcode = O_NAT; 4127 action->len = F_INSN_SIZE(ipfw_insn_nat); 4128 CHECK_ACTLEN; 4129 if (*av != NULL && _substrcmp(*av, "global") == 0) { 4130 action->arg1 = IP_FW_NAT44_GLOBAL; 4131 av++; 4132 break; 4133 } else 4134 goto chkarg; 4135 case TOK_QUEUE: 4136 action->opcode = O_QUEUE; 4137 goto chkarg; 4138 case TOK_PIPE: 4139 action->opcode = O_PIPE; 4140 goto chkarg; 4141 case TOK_SKIPTO: 4142 action->opcode = O_SKIPTO; 4143 goto chkarg; 4144 case TOK_NETGRAPH: 4145 action->opcode = O_NETGRAPH; 4146 goto chkarg; 4147 case TOK_NGTEE: 4148 action->opcode = O_NGTEE; 4149 goto chkarg; 4150 case TOK_DIVERT: 4151 action->opcode = O_DIVERT; 4152 goto chkarg; 4153 case TOK_TEE: 4154 action->opcode = O_TEE; 4155 goto chkarg; 4156 case TOK_CALL: 4157 action->opcode = O_CALLRETURN; 4158 chkarg: 4159 if (!av[0]) 4160 errx(EX_USAGE, "missing argument for %s", *(av - 1)); 4161 if (isdigit(**av)) { 4162 action->arg1 = strtoul(*av, NULL, 10); 4163 if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG) 4164 errx(EX_DATAERR, "illegal argument for %s", 4165 *(av - 1)); 4166 } else if (_substrcmp(*av, "tablearg") == 0) { 4167 action->arg1 = IP_FW_TARG; 4168 } else if (i == TOK_DIVERT || i == TOK_TEE) { 4169 struct servent *s; 4170 setservent(1); 4171 s = getservbyname(av[0], "divert"); 4172 if (s != NULL) 4173 action->arg1 = ntohs(s->s_port); 4174 else 4175 errx(EX_DATAERR, "illegal divert/tee port"); 4176 } else 4177 errx(EX_DATAERR, "illegal argument for %s", *(av - 1)); 4178 av++; 4179 break; 4180 4181 case TOK_FORWARD: { 4182 /* 4183 * Locate the address-port separator (':' or ','). 4184 * Could be one of the following: 4185 * hostname:port 4186 * IPv4 a.b.c.d,port 4187 * IPv4 a.b.c.d:port 4188 * IPv6 w:x:y::z,port 4189 * IPv6 [w:x:y::z]:port 4190 */ 4191 struct sockaddr_storage result; 4192 struct addrinfo *res; 4193 char *s, *end; 4194 int family; 4195 u_short port_number = 0; 4196 4197 NEED1("missing forward address[:port]"); 4198 4199 if (strncmp(*av, "tablearg", 8) == 0 && 4200 ((*av)[8] == '\0' || (*av)[8] == ',' || (*av)[8] == ':')) 4201 memcpy(++(*av), "0.0.0.0", 7); 4202 4203 /* 4204 * Are we an bracket-enclosed IPv6 address? 4205 */ 4206 if (strchr(*av, '[')) 4207 (*av)++; 4208 4209 /* 4210 * locate the address-port separator (':' or ',') 4211 */ 4212 s = strchr(*av, ','); 4213 if (s == NULL) { 4214 s = strchr(*av, ']'); 4215 /* Prevent erroneous parsing on brackets. */ 4216 if (s != NULL) 4217 *(s++) = '\0'; 4218 else 4219 s = *av; 4220 4221 /* Distinguish between IPv4:port and IPv6 cases. */ 4222 s = strchr(s, ':'); 4223 if (s && strchr(s+1, ':')) 4224 s = NULL; /* no port */ 4225 } 4226 4227 if (s != NULL) { 4228 /* Terminate host portion and set s to start of port. */ 4229 *(s++) = '\0'; 4230 i = strtoport(s, &end, 0 /* base */, 0 /* proto */); 4231 if (s == end) 4232 errx(EX_DATAERR, 4233 "illegal forwarding port ``%s''", s); 4234 port_number = (u_short)i; 4235 } 4236 4237 /* 4238 * Resolve the host name or address to a family and a 4239 * network representation of the address. 4240 */ 4241 if (getaddrinfo(*av, NULL, NULL, &res)) 4242 errx(EX_DATAERR, NULL); 4243 /* Just use the first host in the answer. */ 4244 family = res->ai_family; 4245 memcpy(&result, res->ai_addr, res->ai_addrlen); 4246 freeaddrinfo(res); 4247 4248 if (family == PF_INET) { 4249 ipfw_insn_sa *p = (ipfw_insn_sa *)action; 4250 4251 action->opcode = O_FORWARD_IP; 4252 action->len = F_INSN_SIZE(ipfw_insn_sa); 4253 CHECK_ACTLEN; 4254 4255 /* 4256 * In the kernel we assume AF_INET and use only 4257 * sin_port and sin_addr. Remember to set sin_len as 4258 * the routing code seems to use it too. 4259 */ 4260 p->sa.sin_len = sizeof(struct sockaddr_in); 4261 p->sa.sin_family = AF_INET; 4262 p->sa.sin_port = port_number; 4263 p->sa.sin_addr.s_addr = 4264 ((struct sockaddr_in *)&result)->sin_addr.s_addr; 4265 } else if (family == PF_INET6) { 4266 ipfw_insn_sa6 *p = (ipfw_insn_sa6 *)action; 4267 4268 action->opcode = O_FORWARD_IP6; 4269 action->len = F_INSN_SIZE(ipfw_insn_sa6); 4270 CHECK_ACTLEN; 4271 4272 p->sa.sin6_len = sizeof(struct sockaddr_in6); 4273 p->sa.sin6_family = AF_INET6; 4274 p->sa.sin6_port = port_number; 4275 p->sa.sin6_flowinfo = 0; 4276 p->sa.sin6_scope_id = 4277 ((struct sockaddr_in6 *)&result)->sin6_scope_id; 4278 bcopy(&((struct sockaddr_in6*)&result)->sin6_addr, 4279 &p->sa.sin6_addr, sizeof(p->sa.sin6_addr)); 4280 } else { 4281 errx(EX_DATAERR, "Invalid address family in forward action"); 4282 } 4283 av++; 4284 break; 4285 } 4286 case TOK_COMMENT: 4287 /* pretend it is a 'count' rule followed by the comment */ 4288 action->opcode = O_COUNT; 4289 av--; /* go back... */ 4290 break; 4291 4292 case TOK_SETFIB: 4293 { 4294 int numfibs; 4295 size_t intsize = sizeof(int); 4296 4297 action->opcode = O_SETFIB; 4298 NEED1("missing fib number"); 4299 if (_substrcmp(*av, "tablearg") == 0) { 4300 action->arg1 = IP_FW_TARG; 4301 } else { 4302 action->arg1 = strtoul(*av, NULL, 10); 4303 if (sysctlbyname("net.fibs", &numfibs, &intsize, 4304 NULL, 0) == -1) 4305 errx(EX_DATAERR, "fibs not supported.\n"); 4306 if (action->arg1 >= numfibs) /* Temporary */ 4307 errx(EX_DATAERR, "fib too large.\n"); 4308 /* Add high-order bit to fib to make room for tablearg*/ 4309 action->arg1 |= 0x8000; 4310 } 4311 av++; 4312 break; 4313 } 4314 4315 case TOK_SETDSCP: 4316 { 4317 int code; 4318 4319 action->opcode = O_SETDSCP; 4320 NEED1("missing DSCP code"); 4321 if (_substrcmp(*av, "tablearg") == 0) { 4322 action->arg1 = IP_FW_TARG; 4323 } else { 4324 if (isalpha(*av[0])) { 4325 if ((code = match_token(f_ipdscp, *av)) == -1) 4326 errx(EX_DATAERR, "Unknown DSCP code"); 4327 action->arg1 = code; 4328 } else 4329 action->arg1 = strtoul(*av, NULL, 10); 4330 /* 4331 * Add high-order bit to DSCP to make room 4332 * for tablearg 4333 */ 4334 action->arg1 |= 0x8000; 4335 } 4336 av++; 4337 break; 4338 } 4339 4340 case TOK_REASS: 4341 action->opcode = O_REASS; 4342 break; 4343 4344 case TOK_RETURN: 4345 fill_cmd(action, O_CALLRETURN, F_NOT, 0); 4346 break; 4347 4348 case TOK_SETMARK: { 4349 action->opcode = O_SETMARK; 4350 action->len = F_INSN_SIZE(ipfw_insn_u32); 4351 NEED1("missing mark"); 4352 if (strcmp(*av, "tablearg") == 0) { 4353 action->arg1 = IP_FW_TARG; 4354 } else { 4355 ((ipfw_insn_u32 *)action)->d[0] = 4356 strtoul(*av, NULL, 0); 4357 /* This is not a tablearg */ 4358 action->arg1 |= 0x8000; 4359 } 4360 av++; 4361 CHECK_CMDLEN; 4362 break; 4363 } 4364 4365 case TOK_TCPSETMSS: { 4366 u_long mss; 4367 uint16_t idx; 4368 4369 idx = pack_object(tstate, "tcp-setmss", IPFW_TLV_EACTION); 4370 if (idx == 0) 4371 errx(EX_DATAERR, "pack_object failed"); 4372 fill_cmd(action, O_EXTERNAL_ACTION, 0, idx); 4373 NEED1("Missing MSS value"); 4374 action = next_cmd(action, &ablen); 4375 action->len = 1; 4376 CHECK_ACTLEN; 4377 mss = strtoul(*av, NULL, 10); 4378 if (mss == 0 || mss > UINT16_MAX) 4379 errx(EX_USAGE, "invalid MSS value %s", *av); 4380 fill_cmd(action, O_EXTERNAL_DATA, 0, (uint16_t)mss); 4381 av++; 4382 break; 4383 } 4384 4385 default: 4386 av--; 4387 if (match_token(rule_eactions, *av) == -1) 4388 errx(EX_DATAERR, "invalid action %s\n", *av); 4389 /* 4390 * External actions support. 4391 * XXX: we support only syntax with instance name. 4392 * For known external actions (from rule_eactions list) 4393 * we can handle syntax directly. But with `eaction' 4394 * keyword we can use only `eaction <name> <instance>' 4395 * syntax. 4396 */ 4397 case TOK_EACTION: { 4398 uint16_t idx; 4399 4400 NEED1("Missing eaction name"); 4401 if (eaction_check_name(*av) != 0) 4402 errx(EX_DATAERR, "Invalid eaction name %s", *av); 4403 idx = pack_object(tstate, *av, IPFW_TLV_EACTION); 4404 if (idx == 0) 4405 errx(EX_DATAERR, "pack_object failed"); 4406 fill_cmd(action, O_EXTERNAL_ACTION, 0, idx); 4407 av++; 4408 NEED1("Missing eaction instance name"); 4409 action = next_cmd(action, &ablen); 4410 action->len = 1; 4411 CHECK_ACTLEN; 4412 if (eaction_check_name(*av) != 0) 4413 errx(EX_DATAERR, "Invalid eaction instance name %s", 4414 *av); 4415 /* 4416 * External action instance object has TLV type depended 4417 * from the external action name object index. Since we 4418 * currently don't know this index, use zero as TLV type. 4419 */ 4420 idx = pack_object(tstate, *av, 0); 4421 if (idx == 0) 4422 errx(EX_DATAERR, "pack_object failed"); 4423 fill_cmd(action, O_EXTERNAL_INSTANCE, 0, idx); 4424 av++; 4425 } 4426 } 4427 action = next_cmd(action, &ablen); 4428 4429 /* 4430 * [altq queuename] -- altq tag, optional 4431 * [log [logamount N]] -- log, optional 4432 * 4433 * If they exist, it go first in the cmdbuf, but then it is 4434 * skipped in the copy section to the end of the buffer. 4435 */ 4436 while (av[0] != NULL && (i = match_token(rule_action_params, *av)) != -1) { 4437 av++; 4438 switch (i) { 4439 case TOK_LOG: 4440 { 4441 ipfw_insn_log *c = (ipfw_insn_log *)cmd; 4442 int l; 4443 4444 if (have_log) 4445 errx(EX_DATAERR, 4446 "log cannot be specified more than once"); 4447 have_log = (ipfw_insn *)c; 4448 cmd->len = F_INSN_SIZE(ipfw_insn_log); 4449 CHECK_CMDLEN; 4450 cmd->opcode = O_LOG; 4451 if (av[0] && _substrcmp(*av, "logamount") == 0) { 4452 av++; 4453 NEED1("logamount requires argument"); 4454 l = atoi(*av); 4455 if (l < 0) 4456 errx(EX_DATAERR, 4457 "logamount must be positive"); 4458 c->max_log = l; 4459 av++; 4460 } else { 4461 len = sizeof(c->max_log); 4462 if (sysctlbyname("net.inet.ip.fw.verbose_limit", 4463 &c->max_log, &len, NULL, 0) == -1) { 4464 if (g_co.test_only) { 4465 c->max_log = 0; 4466 break; 4467 } 4468 errx(1, "sysctlbyname(\"%s\")", 4469 "net.inet.ip.fw.verbose_limit"); 4470 } 4471 } 4472 } 4473 break; 4474 4475 #ifndef NO_ALTQ 4476 case TOK_ALTQ: 4477 { 4478 ipfw_insn_altq *a = (ipfw_insn_altq *)cmd; 4479 4480 NEED1("missing altq queue name"); 4481 if (have_altq) 4482 errx(EX_DATAERR, 4483 "altq cannot be specified more than once"); 4484 have_altq = (ipfw_insn *)a; 4485 cmd->len = F_INSN_SIZE(ipfw_insn_altq); 4486 CHECK_CMDLEN; 4487 cmd->opcode = O_ALTQ; 4488 a->qid = altq_name_to_qid(*av); 4489 av++; 4490 } 4491 break; 4492 #endif 4493 4494 case TOK_TAG: 4495 case TOK_UNTAG: { 4496 uint16_t tag; 4497 4498 if (have_tag) 4499 errx(EX_USAGE, "tag and untag cannot be " 4500 "specified more than once"); 4501 GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, i, 4502 rule_action_params); 4503 have_tag = cmd; 4504 fill_cmd(cmd, O_TAG, (i == TOK_TAG) ? 0: F_NOT, tag); 4505 av++; 4506 break; 4507 } 4508 4509 default: 4510 abort(); 4511 } 4512 cmd = next_cmd(cmd, &cblen); 4513 } 4514 4515 if (have_state) { /* must be a check-state, we are done */ 4516 if (*av != NULL && 4517 match_token(rule_options, *av) == TOK_COMMENT) { 4518 /* check-state has a comment */ 4519 av++; 4520 fill_comment(cmd, av, cblen); 4521 cmd = next_cmd(cmd, &cblen); 4522 av[0] = NULL; 4523 } 4524 goto done; 4525 } 4526 4527 #define OR_START(target) \ 4528 if (av[0] && (*av[0] == '(' || *av[0] == '{')) { \ 4529 if (open_par) \ 4530 errx(EX_USAGE, "nested \"(\" not allowed\n"); \ 4531 prev = NULL; \ 4532 open_par = 1; \ 4533 if ( (av[0])[1] == '\0') { \ 4534 av++; \ 4535 } else \ 4536 (*av)++; \ 4537 } \ 4538 target: \ 4539 4540 4541 #define CLOSE_PAR \ 4542 if (open_par) { \ 4543 if (av[0] && ( \ 4544 strcmp(*av, ")") == 0 || \ 4545 strcmp(*av, "}") == 0)) { \ 4546 prev = NULL; \ 4547 open_par = 0; \ 4548 av++; \ 4549 } else \ 4550 errx(EX_USAGE, "missing \")\"\n"); \ 4551 } 4552 4553 #define NOT_BLOCK \ 4554 if (av[0] && _substrcmp(*av, "not") == 0) { \ 4555 if (cmd->len & F_NOT) \ 4556 errx(EX_USAGE, "double \"not\" not allowed\n"); \ 4557 cmd->len |= F_NOT; \ 4558 av++; \ 4559 } 4560 4561 #define OR_BLOCK(target) \ 4562 if (av[0] && _substrcmp(*av, "or") == 0) { \ 4563 if (prev == NULL || open_par == 0) \ 4564 errx(EX_DATAERR, "invalid OR block"); \ 4565 prev->len |= F_OR; \ 4566 av++; \ 4567 goto target; \ 4568 } \ 4569 CLOSE_PAR; 4570 4571 first_cmd = cmd; 4572 4573 #if 0 4574 /* 4575 * MAC addresses, optional. 4576 * If we have this, we skip the part "proto from src to dst" 4577 * and jump straight to the option parsing. 4578 */ 4579 NOT_BLOCK; 4580 NEED1("missing protocol"); 4581 if (_substrcmp(*av, "MAC") == 0 || 4582 _substrcmp(*av, "mac") == 0) { 4583 av++; /* the "MAC" keyword */ 4584 add_mac(cmd, av); /* exits in case of errors */ 4585 cmd = next_cmd(cmd); 4586 av += 2; /* dst-mac and src-mac */ 4587 NOT_BLOCK; 4588 NEED1("missing mac type"); 4589 if (add_mactype(cmd, av[0])) 4590 cmd = next_cmd(cmd); 4591 av++; /* any or mac-type */ 4592 goto read_options; 4593 } 4594 #endif 4595 4596 /* 4597 * protocol, mandatory 4598 */ 4599 OR_START(get_proto); 4600 NOT_BLOCK; 4601 NEED1("missing protocol"); 4602 if (add_proto_compat(cmd, *av, &proto)) { 4603 av++; 4604 if (F_LEN(cmd) != 0) { 4605 prev = cmd; 4606 cmd = next_cmd(cmd, &cblen); 4607 } 4608 } else if (first_cmd != cmd) { 4609 errx(EX_DATAERR, "invalid protocol ``%s''", *av); 4610 } else { 4611 rule->flags |= IPFW_RULE_JUSTOPTS; 4612 goto read_options; 4613 } 4614 OR_BLOCK(get_proto); 4615 4616 first_cmd = cmd; /* update pointer to use in compact form */ 4617 4618 /* 4619 * "from", mandatory 4620 */ 4621 if ((av[0] == NULL) || _substrcmp(*av, "from") != 0) 4622 errx(EX_USAGE, "missing ``from''"); 4623 av++; 4624 4625 /* 4626 * source IP, mandatory 4627 */ 4628 OR_START(source_ip); 4629 NOT_BLOCK; /* optional "not" */ 4630 NEED1("missing source address"); 4631 if (add_src(cmd, *av, proto, cblen, tstate)) { 4632 av++; 4633 if (F_LEN(cmd) != 0) { /* ! any */ 4634 prev = cmd; 4635 cmd = next_cmd(cmd, &cblen); 4636 } 4637 } else 4638 errx(EX_USAGE, "bad source address %s", *av); 4639 OR_BLOCK(source_ip); 4640 4641 /* 4642 * source ports, optional 4643 */ 4644 NOT_BLOCK; /* optional "not" */ 4645 if ( av[0] != NULL ) { 4646 if (_substrcmp(*av, "any") == 0 || 4647 add_ports(cmd, *av, proto, O_IP_SRCPORT, cblen)) { 4648 av++; 4649 if (F_LEN(cmd) != 0) 4650 cmd = next_cmd(cmd, &cblen); 4651 } 4652 } 4653 4654 /* 4655 * "to", mandatory 4656 */ 4657 if ( (av[0] == NULL) || _substrcmp(*av, "to") != 0 ) 4658 errx(EX_USAGE, "missing ``to''"); 4659 av++; 4660 4661 /* 4662 * destination, mandatory 4663 */ 4664 OR_START(dest_ip); 4665 NOT_BLOCK; /* optional "not" */ 4666 NEED1("missing dst address"); 4667 if (add_dst(cmd, *av, proto, cblen, tstate)) { 4668 av++; 4669 if (F_LEN(cmd) != 0) { /* ! any */ 4670 prev = cmd; 4671 cmd = next_cmd(cmd, &cblen); 4672 } 4673 } else 4674 errx( EX_USAGE, "bad destination address %s", *av); 4675 OR_BLOCK(dest_ip); 4676 4677 /* 4678 * dest. ports, optional 4679 */ 4680 NOT_BLOCK; /* optional "not" */ 4681 if (av[0]) { 4682 if (_substrcmp(*av, "any") == 0 || 4683 add_ports(cmd, *av, proto, O_IP_DSTPORT, cblen)) { 4684 av++; 4685 if (F_LEN(cmd) != 0) 4686 cmd = next_cmd(cmd, &cblen); 4687 } 4688 } 4689 if (first_cmd == cmd) 4690 rule->flags |= IPFW_RULE_NOOPT; 4691 4692 read_options: 4693 prev = NULL; 4694 while ( av[0] != NULL ) { 4695 char *s; 4696 ipfw_insn_u32 *cmd32; /* alias for cmd */ 4697 4698 s = *av; 4699 cmd32 = (ipfw_insn_u32 *)cmd; 4700 4701 if (*s == '!') { /* alternate syntax for NOT */ 4702 if (cmd->len & F_NOT) 4703 errx(EX_USAGE, "double \"not\" not allowed\n"); 4704 cmd->len = F_NOT; 4705 s++; 4706 } 4707 i = match_token(rule_options, s); 4708 av++; 4709 switch(i) { 4710 case TOK_NOT: 4711 if (cmd->len & F_NOT) 4712 errx(EX_USAGE, "double \"not\" not allowed\n"); 4713 cmd->len = F_NOT; 4714 break; 4715 4716 case TOK_OR: 4717 if (open_par == 0 || prev == NULL) 4718 errx(EX_USAGE, "invalid \"or\" block\n"); 4719 prev->len |= F_OR; 4720 break; 4721 4722 case TOK_STARTBRACE: 4723 if (open_par) 4724 errx(EX_USAGE, "+nested \"(\" not allowed\n"); 4725 open_par = 1; 4726 break; 4727 4728 case TOK_ENDBRACE: 4729 if (!open_par) 4730 errx(EX_USAGE, "+missing \")\"\n"); 4731 open_par = 0; 4732 prev = NULL; 4733 break; 4734 4735 case TOK_IN: 4736 fill_cmd(cmd, O_IN, 0, 0); 4737 break; 4738 4739 case TOK_OUT: 4740 cmd->len ^= F_NOT; /* toggle F_NOT */ 4741 fill_cmd(cmd, O_IN, 0, 0); 4742 break; 4743 4744 case TOK_DIVERTED: 4745 fill_cmd(cmd, O_DIVERTED, 0, 3); 4746 break; 4747 4748 case TOK_DIVERTEDLOOPBACK: 4749 fill_cmd(cmd, O_DIVERTED, 0, 1); 4750 break; 4751 4752 case TOK_DIVERTEDOUTPUT: 4753 fill_cmd(cmd, O_DIVERTED, 0, 2); 4754 break; 4755 4756 case TOK_FRAG: { 4757 uint32_t set = 0, clear = 0; 4758 4759 if (*av != NULL && fill_flags(f_ipoff, *av, NULL, 4760 &set, &clear) == 0) 4761 av++; 4762 else { 4763 /* 4764 * Compatibility: no argument after "frag" 4765 * keyword equals to "frag offset". 4766 */ 4767 set = 0x01; 4768 clear = 0; 4769 } 4770 fill_cmd(cmd, O_FRAG, 0, 4771 (set & 0xff) | ( (clear & 0xff) << 8)); 4772 break; 4773 } 4774 4775 case TOK_LAYER2: 4776 fill_cmd(cmd, O_LAYER2, 0, 0); 4777 break; 4778 4779 case TOK_XMIT: 4780 case TOK_RECV: 4781 case TOK_VIA: 4782 NEED1("recv, xmit, via require interface name" 4783 " or address"); 4784 fill_iface((ipfw_insn_if *)cmd, av[0], cblen, tstate); 4785 av++; 4786 if (F_LEN(cmd) == 0) /* not a valid address */ 4787 break; 4788 if (i == TOK_XMIT) 4789 cmd->opcode = O_XMIT; 4790 else if (i == TOK_RECV) 4791 cmd->opcode = O_RECV; 4792 else if (i == TOK_VIA) 4793 cmd->opcode = O_VIA; 4794 break; 4795 4796 case TOK_ICMPTYPES: 4797 NEED1("icmptypes requires list of types"); 4798 fill_icmptypes((ipfw_insn_u32 *)cmd, *av); 4799 av++; 4800 break; 4801 4802 case TOK_ICMP6TYPES: 4803 NEED1("icmptypes requires list of types"); 4804 fill_icmp6types((ipfw_insn_icmp6 *)cmd, *av, cblen); 4805 av++; 4806 break; 4807 4808 case TOK_IPTTL: 4809 NEED1("ipttl requires TTL"); 4810 if (strpbrk(*av, "-,")) { 4811 if (!add_ports(cmd, *av, 0, O_IPTTL, cblen)) 4812 errx(EX_DATAERR, "invalid ipttl %s", *av); 4813 } else 4814 fill_cmd(cmd, O_IPTTL, 0, strtoul(*av, NULL, 0)); 4815 av++; 4816 break; 4817 4818 case TOK_IPID: 4819 NEED1("ipid requires id"); 4820 if (strpbrk(*av, "-,")) { 4821 if (!add_ports(cmd, *av, 0, O_IPID, cblen)) 4822 errx(EX_DATAERR, "invalid ipid %s", *av); 4823 } else 4824 fill_cmd(cmd, O_IPID, 0, strtoul(*av, NULL, 0)); 4825 av++; 4826 break; 4827 4828 case TOK_IPLEN: 4829 NEED1("iplen requires length"); 4830 if (strpbrk(*av, "-,")) { 4831 if (!add_ports(cmd, *av, 0, O_IPLEN, cblen)) 4832 errx(EX_DATAERR, "invalid ip len %s", *av); 4833 } else 4834 fill_cmd(cmd, O_IPLEN, 0, strtoul(*av, NULL, 0)); 4835 av++; 4836 break; 4837 4838 case TOK_IPVER: 4839 NEED1("ipver requires version"); 4840 fill_cmd(cmd, O_IPVER, 0, strtoul(*av, NULL, 0)); 4841 av++; 4842 break; 4843 4844 case TOK_IPPRECEDENCE: 4845 NEED1("ipprecedence requires value"); 4846 fill_cmd(cmd, O_IPPRECEDENCE, 0, 4847 (strtoul(*av, NULL, 0) & 7) << 5); 4848 av++; 4849 break; 4850 4851 case TOK_DSCP: 4852 NEED1("missing DSCP code"); 4853 fill_dscp(cmd, *av, cblen); 4854 av++; 4855 break; 4856 4857 case TOK_IPOPTS: 4858 NEED1("missing argument for ipoptions"); 4859 fill_flags_cmd(cmd, O_IPOPT, f_ipopts, *av); 4860 av++; 4861 break; 4862 4863 case TOK_IPTOS: 4864 NEED1("missing argument for iptos"); 4865 fill_flags_cmd(cmd, O_IPTOS, f_iptos, *av); 4866 av++; 4867 break; 4868 4869 case TOK_UID: 4870 NEED1("uid requires argument"); 4871 { 4872 char *end; 4873 uid_t uid; 4874 struct passwd *pwd; 4875 4876 cmd->opcode = O_UID; 4877 uid = strtoul(*av, &end, 0); 4878 pwd = (*end == '\0') ? getpwuid(uid) : getpwnam(*av); 4879 if (pwd == NULL) 4880 errx(EX_DATAERR, "uid \"%s\" nonexistent", *av); 4881 cmd32->d[0] = pwd->pw_uid; 4882 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 4883 av++; 4884 } 4885 break; 4886 4887 case TOK_GID: 4888 NEED1("gid requires argument"); 4889 { 4890 char *end; 4891 gid_t gid; 4892 struct group *grp; 4893 4894 cmd->opcode = O_GID; 4895 gid = strtoul(*av, &end, 0); 4896 grp = (*end == '\0') ? getgrgid(gid) : getgrnam(*av); 4897 if (grp == NULL) 4898 errx(EX_DATAERR, "gid \"%s\" nonexistent", *av); 4899 cmd32->d[0] = grp->gr_gid; 4900 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 4901 av++; 4902 } 4903 break; 4904 4905 case TOK_JAIL: 4906 NEED1("jail requires argument"); 4907 { 4908 char *end; 4909 int jid; 4910 4911 cmd->opcode = O_JAIL; 4912 /* 4913 * If av is a number, then we'll just pass it as-is. If 4914 * it's a name, try to resolve that to a jid. 4915 * 4916 * We save the jail_getid(3) call for a fallback because 4917 * it entails an unconditional trip to the kernel to 4918 * either validate a jid or resolve a name to a jid. 4919 * This specific token doesn't currently require a 4920 * jid to be an active jail, so we save a transition 4921 * by simply using a number that we're given. 4922 */ 4923 jid = strtoul(*av, &end, 10); 4924 if (*end != '\0') { 4925 jid = jail_getid(*av); 4926 if (jid < 0) 4927 errx(EX_DATAERR, "%s", jail_errmsg); 4928 } 4929 cmd32->d[0] = (uint32_t)jid; 4930 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 4931 av++; 4932 } 4933 break; 4934 4935 case TOK_ESTAB: 4936 fill_cmd(cmd, O_ESTAB, 0, 0); 4937 break; 4938 4939 case TOK_SETUP: 4940 fill_cmd(cmd, O_TCPFLAGS, 0, 4941 (TH_SYN) | ( (TH_ACK) & 0xff) <<8 ); 4942 break; 4943 4944 case TOK_TCPDATALEN: 4945 NEED1("tcpdatalen requires length"); 4946 if (strpbrk(*av, "-,")) { 4947 if (!add_ports(cmd, *av, 0, O_TCPDATALEN, cblen)) 4948 errx(EX_DATAERR, "invalid tcpdata len %s", *av); 4949 } else 4950 fill_cmd(cmd, O_TCPDATALEN, 0, 4951 strtoul(*av, NULL, 0)); 4952 av++; 4953 break; 4954 4955 case TOK_TCPOPTS: 4956 NEED1("missing argument for tcpoptions"); 4957 fill_flags_cmd(cmd, O_TCPOPTS, f_tcpopts, *av); 4958 av++; 4959 break; 4960 4961 case TOK_TCPSEQ: 4962 case TOK_TCPACK: 4963 NEED1("tcpseq/tcpack requires argument"); 4964 cmd->len = F_INSN_SIZE(ipfw_insn_u32); 4965 cmd->opcode = (i == TOK_TCPSEQ) ? O_TCPSEQ : O_TCPACK; 4966 cmd32->d[0] = htonl(strtoul(*av, NULL, 0)); 4967 av++; 4968 break; 4969 4970 case TOK_TCPMSS: 4971 case TOK_TCPWIN: 4972 NEED1("tcpmss/tcpwin requires size"); 4973 if (strpbrk(*av, "-,")) { 4974 if (add_ports(cmd, *av, 0, 4975 i == TOK_TCPWIN ? O_TCPWIN : O_TCPMSS, 4976 cblen) == NULL) 4977 errx(EX_DATAERR, "invalid %s size %s", 4978 s, *av); 4979 } else 4980 fill_cmd(cmd, i == TOK_TCPWIN ? O_TCPWIN : 4981 O_TCPMSS, 0, strtoul(*av, NULL, 0)); 4982 av++; 4983 break; 4984 4985 case TOK_TCPFLAGS: 4986 NEED1("missing argument for tcpflags"); 4987 cmd->opcode = O_TCPFLAGS; 4988 fill_flags_cmd(cmd, O_TCPFLAGS, f_tcpflags, *av); 4989 av++; 4990 break; 4991 4992 case TOK_KEEPSTATE: 4993 case TOK_RECORDSTATE: { 4994 uint16_t uidx; 4995 4996 if (open_par) 4997 errx(EX_USAGE, "keep-state or record-state cannot be part " 4998 "of an or block"); 4999 if (have_state) 5000 errx(EX_USAGE, "only one of keep-state, record-state, " 5001 " limit and set-limit is allowed"); 5002 if (*av != NULL && *av[0] == ':') { 5003 if (state_check_name(*av + 1) != 0) 5004 errx(EX_DATAERR, 5005 "Invalid state name %s", *av); 5006 uidx = pack_object(tstate, *av + 1, 5007 IPFW_TLV_STATE_NAME); 5008 av++; 5009 } else 5010 uidx = pack_object(tstate, default_state_name, 5011 IPFW_TLV_STATE_NAME); 5012 have_state = cmd; 5013 have_rstate = i == TOK_RECORDSTATE; 5014 fill_cmd(cmd, O_KEEP_STATE, 0, uidx); 5015 break; 5016 } 5017 5018 case TOK_LIMIT: 5019 case TOK_SETLIMIT: { 5020 ipfw_insn_limit *c = (ipfw_insn_limit *)cmd; 5021 int val; 5022 5023 if (open_par) 5024 errx(EX_USAGE, 5025 "limit or set-limit cannot be part of an or block"); 5026 if (have_state) 5027 errx(EX_USAGE, "only one of keep-state, record-state, " 5028 " limit and set-limit is allowed"); 5029 have_state = cmd; 5030 have_rstate = i == TOK_SETLIMIT; 5031 5032 cmd->len = F_INSN_SIZE(ipfw_insn_limit); 5033 CHECK_CMDLEN; 5034 cmd->opcode = O_LIMIT; 5035 c->limit_mask = c->conn_limit = 0; 5036 5037 while ( av[0] != NULL ) { 5038 if ((val = match_token(limit_masks, *av)) <= 0) 5039 break; 5040 c->limit_mask |= val; 5041 av++; 5042 } 5043 5044 if (c->limit_mask == 0) 5045 errx(EX_USAGE, "limit: missing limit mask"); 5046 5047 GET_UINT_ARG(c->conn_limit, IPFW_ARG_MIN, IPFW_ARG_MAX, 5048 TOK_LIMIT, rule_options); 5049 av++; 5050 5051 if (*av != NULL && *av[0] == ':') { 5052 if (state_check_name(*av + 1) != 0) 5053 errx(EX_DATAERR, 5054 "Invalid state name %s", *av); 5055 cmd->arg1 = pack_object(tstate, *av + 1, 5056 IPFW_TLV_STATE_NAME); 5057 av++; 5058 } else 5059 cmd->arg1 = pack_object(tstate, 5060 default_state_name, IPFW_TLV_STATE_NAME); 5061 break; 5062 } 5063 5064 case TOK_PROTO: 5065 NEED1("missing protocol"); 5066 if (add_proto(cmd, *av, &proto)) { 5067 av++; 5068 } else 5069 errx(EX_DATAERR, "invalid protocol ``%s''", 5070 *av); 5071 break; 5072 5073 case TOK_SRCIP: 5074 NEED1("missing source IP"); 5075 if (add_srcip(cmd, *av, cblen, tstate)) { 5076 av++; 5077 } 5078 break; 5079 5080 case TOK_DSTIP: 5081 NEED1("missing destination IP"); 5082 if (add_dstip(cmd, *av, cblen, tstate)) { 5083 av++; 5084 } 5085 break; 5086 5087 case TOK_SRCIP6: 5088 NEED1("missing source IP6"); 5089 if (add_srcip6(cmd, *av, cblen, tstate)) { 5090 av++; 5091 } 5092 break; 5093 5094 case TOK_DSTIP6: 5095 NEED1("missing destination IP6"); 5096 if (add_dstip6(cmd, *av, cblen, tstate)) { 5097 av++; 5098 } 5099 break; 5100 5101 5102 case TOK_SRCMAC: 5103 NEED1("missing source MAC"); 5104 if (add_srcmac(cmd, *av, tstate)) { 5105 av++; 5106 } 5107 break; 5108 5109 case TOK_DSTMAC: 5110 NEED1("missing destination MAC"); 5111 if (add_dstmac(cmd, *av, tstate)) { 5112 av++; 5113 } 5114 break; 5115 5116 case TOK_SRCPORT: 5117 NEED1("missing source port"); 5118 if (_substrcmp(*av, "any") == 0 || 5119 add_ports(cmd, *av, proto, O_IP_SRCPORT, cblen)) { 5120 av++; 5121 } else 5122 errx(EX_DATAERR, "invalid source port %s", *av); 5123 break; 5124 5125 case TOK_DSTPORT: 5126 NEED1("missing destination port"); 5127 if (_substrcmp(*av, "any") == 0 || 5128 add_ports(cmd, *av, proto, O_IP_DSTPORT, cblen)) { 5129 av++; 5130 } else 5131 errx(EX_DATAERR, "invalid destination port %s", 5132 *av); 5133 break; 5134 5135 case TOK_MAC: 5136 if (add_mac(cmd, av, cblen)) 5137 av += 2; 5138 break; 5139 5140 case TOK_MACTYPE: 5141 NEED1("missing mac type"); 5142 if (!add_mactype(cmd, *av, cblen)) 5143 errx(EX_DATAERR, "invalid mac type %s", *av); 5144 av++; 5145 break; 5146 5147 case TOK_VERREVPATH: 5148 fill_cmd(cmd, O_VERREVPATH, 0, 0); 5149 break; 5150 5151 case TOK_VERSRCREACH: 5152 fill_cmd(cmd, O_VERSRCREACH, 0, 0); 5153 break; 5154 5155 case TOK_ANTISPOOF: 5156 fill_cmd(cmd, O_ANTISPOOF, 0, 0); 5157 break; 5158 5159 case TOK_IPSEC: 5160 fill_cmd(cmd, O_IPSEC, 0, 0); 5161 break; 5162 5163 case TOK_IPV6: 5164 fill_cmd(cmd, O_IP6, 0, 0); 5165 break; 5166 5167 case TOK_IPV4: 5168 fill_cmd(cmd, O_IP4, 0, 0); 5169 break; 5170 5171 case TOK_EXT6HDR: 5172 NEED1("missing extension header"); 5173 fill_ext6hdr( cmd, *av ); 5174 av++; 5175 break; 5176 5177 case TOK_FLOWID: 5178 if (proto != IPPROTO_IPV6 ) 5179 errx( EX_USAGE, "flow-id filter is active " 5180 "only for ipv6 protocol\n"); 5181 fill_flow6( (ipfw_insn_u32 *) cmd, *av, cblen); 5182 av++; 5183 break; 5184 5185 case TOK_COMMENT: 5186 fill_comment(cmd, av, cblen); 5187 av[0]=NULL; 5188 break; 5189 5190 case TOK_TAGGED: 5191 if (av[0] && strpbrk(*av, "-,")) { 5192 if (!add_ports(cmd, *av, 0, O_TAGGED, cblen)) 5193 errx(EX_DATAERR, "tagged: invalid tag" 5194 " list: %s", *av); 5195 } 5196 else { 5197 uint16_t tag; 5198 5199 GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, 5200 TOK_TAGGED, rule_options); 5201 fill_cmd(cmd, O_TAGGED, 0, tag); 5202 } 5203 av++; 5204 break; 5205 5206 case TOK_FIB: 5207 NEED1("fib requires fib number"); 5208 fill_cmd(cmd, O_FIB, 0, strtoul(*av, NULL, 0)); 5209 av++; 5210 break; 5211 case TOK_SOCKARG: 5212 fill_cmd(cmd, O_SOCKARG, 0, 0); 5213 break; 5214 5215 case TOK_LOOKUP: { 5216 ipfw_insn_u32 *c = (ipfw_insn_u32 *)cmd; 5217 5218 if (!av[0] || !av[1]) 5219 errx(EX_USAGE, "format: lookup argument tablenum"); 5220 cmd->opcode = O_IP_DST_LOOKUP; 5221 cmd->len |= F_INSN_SIZE(ipfw_insn) + 2; 5222 i = match_token(lookup_keys, *av); 5223 if (i == -1) 5224 errx(EX_USAGE, "format: cannot lookup on %s", *av); 5225 __PAST_END(c->d, 1) = i; 5226 av++; 5227 5228 if ((i = pack_table(tstate, *av)) == 0) 5229 errx(EX_DATAERR, "Invalid table name: %s", *av); 5230 5231 cmd->arg1 = i; 5232 av++; 5233 } 5234 break; 5235 case TOK_FLOW: 5236 NEED1("missing table name"); 5237 if (strncmp(*av, "table(", 6) != 0) 5238 errx(EX_DATAERR, 5239 "enclose table name into \"table()\""); 5240 fill_table(cmd, *av, O_IP_FLOW_LOOKUP, tstate); 5241 av++; 5242 break; 5243 5244 case TOK_SKIPACTION: 5245 if (have_skipcmd) 5246 errx(EX_USAGE, "only one defer-action " 5247 "is allowed"); 5248 have_skipcmd = cmd; 5249 fill_cmd(cmd, O_SKIP_ACTION, 0, 0); 5250 break; 5251 5252 case TOK_MARK: 5253 NEED1("missing mark value:mask"); 5254 fill_mark(cmd, *av, cblen); 5255 av++; 5256 break; 5257 5258 default: 5259 errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s); 5260 } 5261 if (F_LEN(cmd) > 0) { /* prepare to advance */ 5262 prev = cmd; 5263 cmd = next_cmd(cmd, &cblen); 5264 } 5265 } 5266 5267 done: 5268 5269 if (!have_state && have_skipcmd) 5270 warnx("Rule contains \"defer-immediate-action\" " 5271 "and doesn't contain any state-related options."); 5272 5273 /* 5274 * Now copy stuff into the rule. 5275 * If we have a keep-state option, the first instruction 5276 * must be a PROBE_STATE (which is generated here). 5277 * If we have a LOG option, it was stored as the first command, 5278 * and now must be moved to the top of the action part. 5279 */ 5280 dst = (ipfw_insn *)rule->cmd; 5281 5282 /* 5283 * First thing to write into the command stream is the match probability. 5284 */ 5285 if (match_prob != 1) { /* 1 means always match */ 5286 dst->opcode = O_PROB; 5287 dst->len = 2; 5288 *((int32_t *)(dst+1)) = (int32_t)(match_prob * 0x7fffffff); 5289 dst += dst->len; 5290 } 5291 5292 /* 5293 * generate O_PROBE_STATE if necessary 5294 */ 5295 if (have_state && have_state->opcode != O_CHECK_STATE && !have_rstate) { 5296 fill_cmd(dst, O_PROBE_STATE, 0, have_state->arg1); 5297 dst = next_cmd(dst, &rblen); 5298 } 5299 5300 /* 5301 * copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT, O_ALTQ, O_TAG, 5302 * O_SKIP_ACTION 5303 */ 5304 for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) { 5305 i = F_LEN(src); 5306 CHECK_RBUFLEN(i); 5307 5308 switch (src->opcode) { 5309 case O_LOG: 5310 case O_KEEP_STATE: 5311 case O_LIMIT: 5312 case O_ALTQ: 5313 case O_TAG: 5314 case O_SKIP_ACTION: 5315 break; 5316 default: 5317 bcopy(src, dst, i * sizeof(uint32_t)); 5318 dst += i; 5319 } 5320 } 5321 5322 /* 5323 * put back the have_state command as last opcode 5324 */ 5325 if (have_state && have_state->opcode != O_CHECK_STATE) { 5326 i = F_LEN(have_state); 5327 CHECK_RBUFLEN(i); 5328 bcopy(have_state, dst, i * sizeof(uint32_t)); 5329 dst += i; 5330 } 5331 5332 /* 5333 * put back the have_skipcmd command as very last opcode 5334 */ 5335 if (have_skipcmd) { 5336 i = F_LEN(have_skipcmd); 5337 CHECK_RBUFLEN(i); 5338 bcopy(have_skipcmd, dst, i * sizeof(uint32_t)); 5339 dst += i; 5340 } 5341 5342 /* 5343 * start action section 5344 */ 5345 rule->act_ofs = dst - rule->cmd; 5346 5347 /* put back O_LOG, O_ALTQ, O_TAG if necessary */ 5348 if (have_log) { 5349 i = F_LEN(have_log); 5350 CHECK_RBUFLEN(i); 5351 bcopy(have_log, dst, i * sizeof(uint32_t)); 5352 dst += i; 5353 } 5354 if (have_altq) { 5355 i = F_LEN(have_altq); 5356 CHECK_RBUFLEN(i); 5357 bcopy(have_altq, dst, i * sizeof(uint32_t)); 5358 dst += i; 5359 } 5360 if (have_tag) { 5361 i = F_LEN(have_tag); 5362 CHECK_RBUFLEN(i); 5363 bcopy(have_tag, dst, i * sizeof(uint32_t)); 5364 dst += i; 5365 } 5366 5367 /* 5368 * copy all other actions 5369 */ 5370 for (src = (ipfw_insn *)actbuf; src != action; src += i) { 5371 i = F_LEN(src); 5372 CHECK_RBUFLEN(i); 5373 bcopy(src, dst, i * sizeof(uint32_t)); 5374 dst += i; 5375 } 5376 5377 rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd); 5378 *rbufsize = (char *)dst - (char *)rule; 5379 } 5380 5381 static int 5382 compare_ntlv(const void *_a, const void *_b) 5383 { 5384 const ipfw_obj_ntlv *a, *b; 5385 5386 a = (const ipfw_obj_ntlv *)_a; 5387 b = (const ipfw_obj_ntlv *)_b; 5388 5389 if (a->set < b->set) 5390 return (-1); 5391 else if (a->set > b->set) 5392 return (1); 5393 5394 if (a->idx < b->idx) 5395 return (-1); 5396 else if (a->idx > b->idx) 5397 return (1); 5398 5399 if (a->head.type < b->head.type) 5400 return (-1); 5401 else if (a->head.type > b->head.type) 5402 return (1); 5403 5404 return (0); 5405 } 5406 5407 /* 5408 * Provide kernel with sorted list of referenced objects 5409 */ 5410 static void 5411 object_sort_ctlv(ipfw_obj_ctlv *ctlv) 5412 { 5413 5414 qsort(ctlv + 1, ctlv->count, ctlv->objsize, compare_ntlv); 5415 } 5416 5417 struct object_kt { 5418 uint16_t uidx; 5419 uint16_t type; 5420 }; 5421 static int 5422 compare_object_kntlv(const void *k, const void *v) 5423 { 5424 const ipfw_obj_ntlv *ntlv; 5425 struct object_kt key; 5426 5427 key = *((const struct object_kt *)k); 5428 ntlv = (const ipfw_obj_ntlv *)v; 5429 5430 if (key.uidx < ntlv->idx) 5431 return (-1); 5432 else if (key.uidx > ntlv->idx) 5433 return (1); 5434 5435 if (key.type < ntlv->head.type) 5436 return (-1); 5437 else if (key.type > ntlv->head.type) 5438 return (1); 5439 5440 return (0); 5441 } 5442 5443 /* 5444 * Finds object name in @ctlv by @idx and @type. 5445 * Uses the following facts: 5446 * 1) All TLVs are the same size 5447 * 2) Kernel implementation provides already sorted list. 5448 * 5449 * Returns table name or NULL. 5450 */ 5451 static char * 5452 object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx, uint16_t type) 5453 { 5454 ipfw_obj_ntlv *ntlv; 5455 struct object_kt key; 5456 5457 key.uidx = idx; 5458 key.type = type; 5459 5460 ntlv = bsearch(&key, (ctlv + 1), ctlv->count, ctlv->objsize, 5461 compare_object_kntlv); 5462 5463 if (ntlv != NULL) 5464 return (ntlv->name); 5465 5466 return (NULL); 5467 } 5468 5469 static char * 5470 table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx) 5471 { 5472 5473 return (object_search_ctlv(ctlv, idx, IPFW_TLV_TBL_NAME)); 5474 } 5475 5476 /* 5477 * Adds one or more rules to ipfw chain. 5478 * Data layout: 5479 * Request: 5480 * [ 5481 * ip_fw3_opheader 5482 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional *1) 5483 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) [ ip_fw_rule ip_fw_insn ] x N ] (*2) (*3) 5484 * ] 5485 * Reply: 5486 * [ 5487 * ip_fw3_opheader 5488 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional) 5489 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) [ ip_fw_rule ip_fw_insn ] x N ] 5490 * ] 5491 * 5492 * Rules in reply are modified to store their actual ruleset number. 5493 * 5494 * (*1) TLVs inside IPFW_TLV_TBL_LIST needs to be sorted ascending 5495 * according to their idx field and there has to be no duplicates. 5496 * (*2) Numbered rules inside IPFW_TLV_RULE_LIST needs to be sorted ascending. 5497 * (*3) Each ip_fw structure needs to be aligned to u64 boundary. 5498 */ 5499 void 5500 ipfw_add(char *av[]) 5501 { 5502 uint32_t rulebuf[1024]; 5503 int rbufsize, default_off, tlen, rlen; 5504 size_t sz; 5505 struct tidx ts; 5506 struct ip_fw_rule *rule; 5507 caddr_t tbuf; 5508 ip_fw3_opheader *op3; 5509 ipfw_obj_ctlv *ctlv, *tstate; 5510 5511 rbufsize = sizeof(rulebuf); 5512 memset(rulebuf, 0, rbufsize); 5513 memset(&ts, 0, sizeof(ts)); 5514 5515 /* Optimize case with no tables */ 5516 default_off = sizeof(ipfw_obj_ctlv) + sizeof(ip_fw3_opheader); 5517 op3 = (ip_fw3_opheader *)rulebuf; 5518 ctlv = (ipfw_obj_ctlv *)(op3 + 1); 5519 rule = (struct ip_fw_rule *)(ctlv + 1); 5520 rbufsize -= default_off; 5521 5522 compile_rule(av, (uint32_t *)rule, &rbufsize, &ts); 5523 /* Align rule size to u64 boundary */ 5524 rlen = roundup2(rbufsize, sizeof(uint64_t)); 5525 5526 tbuf = NULL; 5527 sz = 0; 5528 tstate = NULL; 5529 if (ts.count != 0) { 5530 /* Some tables. We have to alloc more data */ 5531 tlen = ts.count * sizeof(ipfw_obj_ntlv); 5532 sz = default_off + sizeof(ipfw_obj_ctlv) + tlen + rlen; 5533 5534 if ((tbuf = calloc(1, sz)) == NULL) 5535 err(EX_UNAVAILABLE, "malloc() failed for IP_FW_ADD"); 5536 op3 = (ip_fw3_opheader *)tbuf; 5537 /* Tables first */ 5538 ctlv = (ipfw_obj_ctlv *)(op3 + 1); 5539 ctlv->head.type = IPFW_TLV_TBLNAME_LIST; 5540 ctlv->head.length = sizeof(ipfw_obj_ctlv) + tlen; 5541 ctlv->count = ts.count; 5542 ctlv->objsize = sizeof(ipfw_obj_ntlv); 5543 memcpy(ctlv + 1, ts.idx, tlen); 5544 object_sort_ctlv(ctlv); 5545 tstate = ctlv; 5546 /* Rule next */ 5547 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length); 5548 ctlv->head.type = IPFW_TLV_RULE_LIST; 5549 ctlv->head.length = sizeof(ipfw_obj_ctlv) + rlen; 5550 ctlv->count = 1; 5551 memcpy(ctlv + 1, rule, rbufsize); 5552 } else { 5553 /* Simply add header */ 5554 sz = rlen + default_off; 5555 memset(ctlv, 0, sizeof(*ctlv)); 5556 ctlv->head.type = IPFW_TLV_RULE_LIST; 5557 ctlv->head.length = sizeof(ipfw_obj_ctlv) + rlen; 5558 ctlv->count = 1; 5559 } 5560 5561 if (do_get3(IP_FW_XADD, op3, &sz) != 0) 5562 err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_XADD"); 5563 5564 if (!g_co.do_quiet) { 5565 struct format_opts sfo; 5566 struct buf_pr bp; 5567 memset(&sfo, 0, sizeof(sfo)); 5568 sfo.tstate = tstate; 5569 sfo.set_mask = (uint32_t)(-1); 5570 bp_alloc(&bp, 4096); 5571 show_static_rule(&g_co, &sfo, &bp, rule, NULL); 5572 printf("%s", bp.buf); 5573 bp_free(&bp); 5574 } 5575 5576 if (tbuf != NULL) 5577 free(tbuf); 5578 5579 if (ts.idx != NULL) 5580 free(ts.idx); 5581 } 5582 5583 /* 5584 * clear the counters or the log counters. 5585 * optname has the following values: 5586 * 0 (zero both counters and logging) 5587 * 1 (zero logging only) 5588 */ 5589 void 5590 ipfw_zero(int ac, char *av[], int optname) 5591 { 5592 ipfw_range_tlv rt; 5593 char const *errstr; 5594 char const *name = optname ? "RESETLOG" : "ZERO"; 5595 uint32_t arg; 5596 int failed = EX_OK; 5597 5598 optname = optname ? IP_FW_XRESETLOG : IP_FW_XZERO; 5599 av++; ac--; 5600 5601 if (ac == 0) { 5602 /* clear all entries */ 5603 memset(&rt, 0, sizeof(rt)); 5604 rt.flags = IPFW_RCFLAG_ALL; 5605 if (do_range_cmd(optname, &rt) < 0) 5606 err(EX_UNAVAILABLE, "setsockopt(IP_FW_X%s)", name); 5607 if (!g_co.do_quiet) 5608 printf("%s.\n", optname == IP_FW_XZERO ? 5609 "Accounting cleared":"Logging counts reset"); 5610 5611 return; 5612 } 5613 5614 while (ac) { 5615 /* Rule number */ 5616 if (isdigit(**av)) { 5617 arg = strtonum(*av, 0, 0xffff, &errstr); 5618 if (errstr) 5619 errx(EX_DATAERR, 5620 "invalid rule number %s\n", *av); 5621 memset(&rt, 0, sizeof(rt)); 5622 rt.start_rule = arg; 5623 rt.end_rule = arg; 5624 rt.flags |= IPFW_RCFLAG_RANGE; 5625 if (g_co.use_set != 0) { 5626 rt.set = g_co.use_set - 1; 5627 rt.flags |= IPFW_RCFLAG_SET; 5628 } 5629 if (do_range_cmd(optname, &rt) != 0) { 5630 warn("rule %u: setsockopt(IP_FW_X%s)", 5631 arg, name); 5632 failed = EX_UNAVAILABLE; 5633 } else if (rt.new_set == 0) { 5634 printf("Entry %d not found\n", arg); 5635 failed = EX_UNAVAILABLE; 5636 } else if (!g_co.do_quiet) 5637 printf("Entry %d %s.\n", arg, 5638 optname == IP_FW_XZERO ? 5639 "cleared" : "logging count reset"); 5640 } else { 5641 errx(EX_USAGE, "invalid rule number ``%s''", *av); 5642 } 5643 av++; ac--; 5644 } 5645 if (failed != EX_OK) 5646 exit(failed); 5647 } 5648 5649 void 5650 ipfw_flush(int force) 5651 { 5652 ipfw_range_tlv rt; 5653 5654 if (!force && !g_co.do_quiet) { /* need to ask user */ 5655 int c; 5656 5657 printf("Are you sure? [yn] "); 5658 fflush(stdout); 5659 do { 5660 c = toupper(getc(stdin)); 5661 while (c != '\n' && getc(stdin) != '\n') 5662 if (feof(stdin)) 5663 return; /* and do not flush */ 5664 } while (c != 'Y' && c != 'N'); 5665 printf("\n"); 5666 if (c == 'N') /* user said no */ 5667 return; 5668 } 5669 if (g_co.do_pipe) { 5670 dummynet_flush(); 5671 return; 5672 } 5673 /* `ipfw set N flush` - is the same that `ipfw delete set N` */ 5674 memset(&rt, 0, sizeof(rt)); 5675 if (g_co.use_set != 0) { 5676 rt.set = g_co.use_set - 1; 5677 rt.flags = IPFW_RCFLAG_SET; 5678 } else 5679 rt.flags = IPFW_RCFLAG_ALL; 5680 if (do_range_cmd(IP_FW_XDEL, &rt) != 0) 5681 err(EX_UNAVAILABLE, "setsockopt(IP_FW_XDEL)"); 5682 if (!g_co.do_quiet) 5683 printf("Flushed all %s.\n", g_co.do_pipe ? "pipes" : "rules"); 5684 } 5685 5686 static struct _s_x intcmds[] = { 5687 { "talist", TOK_TALIST }, 5688 { "iflist", TOK_IFLIST }, 5689 { "olist", TOK_OLIST }, 5690 { "vlist", TOK_VLIST }, 5691 { NULL, 0 } 5692 }; 5693 5694 static struct _s_x otypes[] = { 5695 { "EACTION", IPFW_TLV_EACTION }, 5696 { "DYNSTATE", IPFW_TLV_STATE_NAME }, 5697 { NULL, 0 } 5698 }; 5699 5700 static const char* 5701 lookup_eaction_name(ipfw_obj_ntlv *ntlv, int cnt, uint16_t type) 5702 { 5703 const char *name; 5704 int i; 5705 5706 name = NULL; 5707 for (i = 0; i < cnt; i++) { 5708 if (ntlv[i].head.type != IPFW_TLV_EACTION) 5709 continue; 5710 if (IPFW_TLV_EACTION_NAME(ntlv[i].idx) != type) 5711 continue; 5712 name = ntlv[i].name; 5713 break; 5714 } 5715 return (name); 5716 } 5717 5718 static void 5719 ipfw_list_objects(int ac __unused, char *av[] __unused) 5720 { 5721 ipfw_obj_lheader req, *olh; 5722 ipfw_obj_ntlv *ntlv; 5723 const char *name; 5724 size_t sz; 5725 uint32_t i; 5726 5727 memset(&req, 0, sizeof(req)); 5728 sz = sizeof(req); 5729 if (do_get3(IP_FW_DUMP_SRVOBJECTS, &req.opheader, &sz) != 0) 5730 if (errno != ENOMEM) 5731 return; 5732 5733 sz = req.size; 5734 if ((olh = calloc(1, sz)) == NULL) 5735 return; 5736 5737 olh->size = sz; 5738 if (do_get3(IP_FW_DUMP_SRVOBJECTS, &olh->opheader, &sz) != 0) { 5739 free(olh); 5740 return; 5741 } 5742 5743 if (olh->count > 0) 5744 printf("Objects list:\n"); 5745 else 5746 printf("There are no objects\n"); 5747 ntlv = (ipfw_obj_ntlv *)(olh + 1); 5748 for (i = 0; i < olh->count; i++) { 5749 name = match_value(otypes, ntlv->head.type); 5750 if (name == NULL) 5751 name = lookup_eaction_name( 5752 (ipfw_obj_ntlv *)(olh + 1), olh->count, 5753 ntlv->head.type); 5754 if (name == NULL) 5755 printf(" kidx: %4d\ttype: %10d\tname: %s\n", 5756 ntlv->idx, ntlv->head.type, ntlv->name); 5757 else 5758 printf(" kidx: %4d\ttype: %10s\tname: %s\n", 5759 ntlv->idx, name, ntlv->name); 5760 ntlv++; 5761 } 5762 free(olh); 5763 } 5764 5765 void 5766 ipfw_internal_handler(int ac, char *av[]) 5767 { 5768 int tcmd; 5769 5770 ac--; av++; 5771 NEED1("internal cmd required"); 5772 5773 if ((tcmd = match_token(intcmds, *av)) == -1) 5774 errx(EX_USAGE, "invalid internal sub-cmd: %s", *av); 5775 5776 switch (tcmd) { 5777 case TOK_IFLIST: 5778 ipfw_list_tifaces(); 5779 break; 5780 case TOK_TALIST: 5781 ipfw_list_ta(ac, av); 5782 break; 5783 case TOK_OLIST: 5784 ipfw_list_objects(ac, av); 5785 break; 5786 case TOK_VLIST: 5787 ipfw_list_values(ac, av); 5788 break; 5789 } 5790 } 5791 5792 static int 5793 ipfw_get_tracked_ifaces(ipfw_obj_lheader **polh) 5794 { 5795 ipfw_obj_lheader req, *olh; 5796 size_t sz; 5797 5798 memset(&req, 0, sizeof(req)); 5799 sz = sizeof(req); 5800 5801 if (do_get3(IP_FW_XIFLIST, &req.opheader, &sz) != 0) { 5802 if (errno != ENOMEM) 5803 return (errno); 5804 } 5805 5806 sz = req.size; 5807 if ((olh = calloc(1, sz)) == NULL) 5808 return (ENOMEM); 5809 5810 olh->size = sz; 5811 if (do_get3(IP_FW_XIFLIST, &olh->opheader, &sz) != 0) { 5812 free(olh); 5813 return (errno); 5814 } 5815 5816 *polh = olh; 5817 return (0); 5818 } 5819 5820 static int 5821 ifinfo_cmp(const void *a, const void *b) 5822 { 5823 const ipfw_iface_info *ia, *ib; 5824 5825 ia = (const ipfw_iface_info *)a; 5826 ib = (const ipfw_iface_info *)b; 5827 5828 return (stringnum_cmp(ia->ifname, ib->ifname)); 5829 } 5830 5831 /* 5832 * Retrieves table list from kernel, 5833 * optionally sorts it and calls requested function for each table. 5834 * Returns 0 on success. 5835 */ 5836 static void 5837 ipfw_list_tifaces(void) 5838 { 5839 ipfw_obj_lheader *olh = NULL; 5840 ipfw_iface_info *info; 5841 uint32_t i; 5842 int error; 5843 5844 if ((error = ipfw_get_tracked_ifaces(&olh)) != 0) 5845 err(EX_OSERR, "Unable to request ipfw tracked interface list"); 5846 5847 qsort(olh + 1, olh->count, olh->objsize, ifinfo_cmp); 5848 5849 info = (ipfw_iface_info *)(olh + 1); 5850 for (i = 0; i < olh->count; i++) { 5851 if (info->flags & IPFW_IFFLAG_RESOLVED) 5852 printf("%s ifindex: %d refcount: %u changes: %u\n", 5853 info->ifname, info->ifindex, info->refcnt, 5854 info->gencnt); 5855 else 5856 printf("%s ifindex: unresolved refcount: %u changes: %u\n", 5857 info->ifname, info->refcnt, info->gencnt); 5858 info = (ipfw_iface_info *)((caddr_t)info + olh->objsize); 5859 } 5860 5861 free(olh); 5862 } 5863