1 /*- 2 * Copyright (c) 2002-2003 Luigi Rizzo 3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4 * Copyright (c) 1994 Ugen J.S.Antsilevich 5 * 6 * Idea and grammar partially left from: 7 * Copyright (c) 1993 Daniel Boulet 8 * 9 * Redistribution and use in source forms, with and without modification, 10 * are permitted provided that this entire comment appears intact. 11 * 12 * Redistribution in binary form may occur without any restrictions. 13 * Obviously, it would be nice if you gave credit where credit is due 14 * but requiring it would be too onerous. 15 * 16 * This software is provided ``AS IS'' without any warranties of any kind. 17 * 18 * NEW command line interface for IP firewall facility 19 * 20 * $FreeBSD$ 21 */ 22 23 #include <sys/types.h> 24 #include <sys/param.h> 25 #include <sys/socket.h> 26 #include <sys/sockio.h> 27 #include <sys/sysctl.h> 28 29 #include "ipfw2.h" 30 31 #include <ctype.h> 32 #include <err.h> 33 #include <errno.h> 34 #include <grp.h> 35 #include <jail.h> 36 #include <netdb.h> 37 #include <pwd.h> 38 #include <stdio.h> 39 #include <stdarg.h> 40 #include <stdint.h> 41 #include <stdlib.h> 42 #include <string.h> 43 #include <sysexits.h> 44 #include <time.h> /* ctime */ 45 #include <timeconv.h> /* _long_to_time */ 46 #include <unistd.h> 47 #include <fcntl.h> 48 #include <stddef.h> /* offsetof */ 49 50 #include <net/ethernet.h> 51 #include <net/if.h> /* only IFNAMSIZ */ 52 #include <netinet/in.h> 53 #include <netinet/in_systm.h> /* only n_short, n_long */ 54 #include <netinet/ip.h> 55 #include <netinet/ip_icmp.h> 56 #include <netinet/ip_fw.h> 57 #include <netinet/tcp.h> 58 #include <arpa/inet.h> 59 60 struct cmdline_opts g_co; /* global options */ 61 62 struct format_opts { 63 int bcwidth; 64 int pcwidth; 65 int show_counters; 66 int show_time; /* show timestamp */ 67 uint32_t set_mask; /* enabled sets mask */ 68 uint32_t flags; /* request flags */ 69 uint32_t first; /* first rule to request */ 70 uint32_t last; /* last rule to request */ 71 uint32_t dcnt; /* number of dynamic states */ 72 ipfw_obj_ctlv *tstate; /* table state data */ 73 }; 74 75 int resvd_set_number = RESVD_SET; 76 77 static int ipfw_socket = -1; 78 79 #define CHECK_LENGTH(v, len) do { \ 80 if ((v) < (len)) \ 81 errx(EX_DATAERR, "Rule too long"); \ 82 } while (0) 83 /* 84 * Check if we have enough space in cmd buffer. Note that since 85 * first 8? u32 words are reserved by reserved header, full cmd 86 * buffer can't be used, so we need to protect from buffer overrun 87 * only. At the beginning, cblen is less than actual buffer size by 88 * size of ipfw_insn_u32 instruction + 1 u32 work. This eliminates need 89 * for checking small instructions fitting in given range. 90 * We also (ab)use the fact that ipfw_insn is always the first field 91 * for any custom instruction. 92 */ 93 #define CHECK_CMDLEN CHECK_LENGTH(cblen, F_LEN((ipfw_insn *)cmd)) 94 95 #define GET_UINT_ARG(arg, min, max, tok, s_x) do { \ 96 if (!av[0]) \ 97 errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \ 98 if (_substrcmp(*av, "tablearg") == 0) { \ 99 arg = IP_FW_TARG; \ 100 break; \ 101 } \ 102 \ 103 { \ 104 long _xval; \ 105 char *end; \ 106 \ 107 _xval = strtol(*av, &end, 10); \ 108 \ 109 if (!isdigit(**av) || *end != '\0' || (_xval == 0 && errno == EINVAL)) \ 110 errx(EX_DATAERR, "%s: invalid argument: %s", \ 111 match_value(s_x, tok), *av); \ 112 \ 113 if (errno == ERANGE || _xval < min || _xval > max) \ 114 errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \ 115 match_value(s_x, tok), min, max, *av); \ 116 \ 117 if (_xval == IP_FW_TARG) \ 118 errx(EX_DATAERR, "%s: illegal argument value: %s", \ 119 match_value(s_x, tok), *av); \ 120 arg = _xval; \ 121 } \ 122 } while (0) 123 124 static struct _s_x f_tcpflags[] = { 125 { "syn", TH_SYN }, 126 { "fin", TH_FIN }, 127 { "ack", TH_ACK }, 128 { "psh", TH_PUSH }, 129 { "rst", TH_RST }, 130 { "urg", TH_URG }, 131 { "tcp flag", 0 }, 132 { NULL, 0 } 133 }; 134 135 static struct _s_x f_tcpopts[] = { 136 { "mss", IP_FW_TCPOPT_MSS }, 137 { "maxseg", IP_FW_TCPOPT_MSS }, 138 { "window", IP_FW_TCPOPT_WINDOW }, 139 { "sack", IP_FW_TCPOPT_SACK }, 140 { "ts", IP_FW_TCPOPT_TS }, 141 { "timestamp", IP_FW_TCPOPT_TS }, 142 { "cc", IP_FW_TCPOPT_CC }, 143 { "tcp option", 0 }, 144 { NULL, 0 } 145 }; 146 147 /* 148 * IP options span the range 0 to 255 so we need to remap them 149 * (though in fact only the low 5 bits are significant). 150 */ 151 static struct _s_x f_ipopts[] = { 152 { "ssrr", IP_FW_IPOPT_SSRR}, 153 { "lsrr", IP_FW_IPOPT_LSRR}, 154 { "rr", IP_FW_IPOPT_RR}, 155 { "ts", IP_FW_IPOPT_TS}, 156 { "ip option", 0 }, 157 { NULL, 0 } 158 }; 159 160 static struct _s_x f_iptos[] = { 161 { "lowdelay", IPTOS_LOWDELAY}, 162 { "throughput", IPTOS_THROUGHPUT}, 163 { "reliability", IPTOS_RELIABILITY}, 164 { "mincost", IPTOS_MINCOST}, 165 { "congestion", IPTOS_ECN_CE}, 166 { "ecntransport", IPTOS_ECN_ECT0}, 167 { "ip tos option", 0}, 168 { NULL, 0 } 169 }; 170 171 static struct _s_x f_ipoff[] = { 172 { "rf", IP_RF >> 8 }, 173 { "df", IP_DF >> 8 }, 174 { "mf", IP_MF >> 8 }, 175 { "offset", 0x1 }, 176 { NULL, 0} 177 }; 178 179 struct _s_x f_ipdscp[] = { 180 { "af11", IPTOS_DSCP_AF11 >> 2 }, /* 001010 */ 181 { "af12", IPTOS_DSCP_AF12 >> 2 }, /* 001100 */ 182 { "af13", IPTOS_DSCP_AF13 >> 2 }, /* 001110 */ 183 { "af21", IPTOS_DSCP_AF21 >> 2 }, /* 010010 */ 184 { "af22", IPTOS_DSCP_AF22 >> 2 }, /* 010100 */ 185 { "af23", IPTOS_DSCP_AF23 >> 2 }, /* 010110 */ 186 { "af31", IPTOS_DSCP_AF31 >> 2 }, /* 011010 */ 187 { "af32", IPTOS_DSCP_AF32 >> 2 }, /* 011100 */ 188 { "af33", IPTOS_DSCP_AF33 >> 2 }, /* 011110 */ 189 { "af41", IPTOS_DSCP_AF41 >> 2 }, /* 100010 */ 190 { "af42", IPTOS_DSCP_AF42 >> 2 }, /* 100100 */ 191 { "af43", IPTOS_DSCP_AF43 >> 2 }, /* 100110 */ 192 { "be", IPTOS_DSCP_CS0 >> 2 }, /* 000000 */ 193 { "va", IPTOS_DSCP_VA >> 2 }, /* 101100 */ 194 { "ef", IPTOS_DSCP_EF >> 2 }, /* 101110 */ 195 { "cs0", IPTOS_DSCP_CS0 >> 2 }, /* 000000 */ 196 { "cs1", IPTOS_DSCP_CS1 >> 2 }, /* 001000 */ 197 { "cs2", IPTOS_DSCP_CS2 >> 2 }, /* 010000 */ 198 { "cs3", IPTOS_DSCP_CS3 >> 2 }, /* 011000 */ 199 { "cs4", IPTOS_DSCP_CS4 >> 2 }, /* 100000 */ 200 { "cs5", IPTOS_DSCP_CS5 >> 2 }, /* 101000 */ 201 { "cs6", IPTOS_DSCP_CS6 >> 2 }, /* 110000 */ 202 { "cs7", IPTOS_DSCP_CS7 >> 2 }, /* 100000 */ 203 { NULL, 0 } 204 }; 205 206 static struct _s_x limit_masks[] = { 207 {"all", DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT}, 208 {"src-addr", DYN_SRC_ADDR}, 209 {"src-port", DYN_SRC_PORT}, 210 {"dst-addr", DYN_DST_ADDR}, 211 {"dst-port", DYN_DST_PORT}, 212 {NULL, 0} 213 }; 214 215 /* 216 * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines 217 * This is only used in this code. 218 */ 219 #define IPPROTO_ETHERTYPE 0x1000 220 static struct _s_x ether_types[] = { 221 /* 222 * Note, we cannot use "-:&/" in the names because they are field 223 * separators in the type specifications. Also, we use s = NULL as 224 * end-delimiter, because a type of 0 can be legal. 225 */ 226 { "ip", 0x0800 }, 227 { "ipv4", 0x0800 }, 228 { "ipv6", 0x86dd }, 229 { "arp", 0x0806 }, 230 { "rarp", 0x8035 }, 231 { "vlan", 0x8100 }, 232 { "loop", 0x9000 }, 233 { "trail", 0x1000 }, 234 { "at", 0x809b }, 235 { "atalk", 0x809b }, 236 { "aarp", 0x80f3 }, 237 { "pppoe_disc", 0x8863 }, 238 { "pppoe_sess", 0x8864 }, 239 { "ipx_8022", 0x00E0 }, 240 { "ipx_8023", 0x0000 }, 241 { "ipx_ii", 0x8137 }, 242 { "ipx_snap", 0x8137 }, 243 { "ipx", 0x8137 }, 244 { "ns", 0x0600 }, 245 { NULL, 0 } 246 }; 247 248 static struct _s_x rule_eactions[] = { 249 { "nat64clat", TOK_NAT64CLAT }, 250 { "nat64lsn", TOK_NAT64LSN }, 251 { "nat64stl", TOK_NAT64STL }, 252 { "nptv6", TOK_NPTV6 }, 253 { "tcp-setmss", TOK_TCPSETMSS }, 254 { NULL, 0 } /* terminator */ 255 }; 256 257 static struct _s_x rule_actions[] = { 258 { "abort6", TOK_ABORT6 }, 259 { "abort", TOK_ABORT }, 260 { "accept", TOK_ACCEPT }, 261 { "pass", TOK_ACCEPT }, 262 { "allow", TOK_ACCEPT }, 263 { "permit", TOK_ACCEPT }, 264 { "count", TOK_COUNT }, 265 { "pipe", TOK_PIPE }, 266 { "queue", TOK_QUEUE }, 267 { "divert", TOK_DIVERT }, 268 { "tee", TOK_TEE }, 269 { "netgraph", TOK_NETGRAPH }, 270 { "ngtee", TOK_NGTEE }, 271 { "fwd", TOK_FORWARD }, 272 { "forward", TOK_FORWARD }, 273 { "skipto", TOK_SKIPTO }, 274 { "deny", TOK_DENY }, 275 { "drop", TOK_DENY }, 276 { "reject", TOK_REJECT }, 277 { "reset6", TOK_RESET6 }, 278 { "reset", TOK_RESET }, 279 { "unreach6", TOK_UNREACH6 }, 280 { "unreach", TOK_UNREACH }, 281 { "check-state", TOK_CHECKSTATE }, 282 { "//", TOK_COMMENT }, 283 { "nat", TOK_NAT }, 284 { "reass", TOK_REASS }, 285 { "setfib", TOK_SETFIB }, 286 { "setdscp", TOK_SETDSCP }, 287 { "call", TOK_CALL }, 288 { "return", TOK_RETURN }, 289 { "eaction", TOK_EACTION }, 290 { "tcp-setmss", TOK_TCPSETMSS }, 291 { "setmark", TOK_SETMARK }, 292 { NULL, 0 } /* terminator */ 293 }; 294 295 static struct _s_x rule_action_params[] = { 296 { "altq", TOK_ALTQ }, 297 { "log", TOK_LOG }, 298 { "tag", TOK_TAG }, 299 { "untag", TOK_UNTAG }, 300 { NULL, 0 } /* terminator */ 301 }; 302 303 /* 304 * The 'lookup' instruction accepts one of the following arguments. 305 * Arguments are passed as v[1] in O_DST_LOOKUP options. 306 */ 307 static struct _s_x lookup_keys[] = { 308 { "dst-ip", LOOKUP_DST_IP }, 309 { "src-ip", LOOKUP_SRC_IP }, 310 { "dst-port", LOOKUP_DST_PORT }, 311 { "src-port", LOOKUP_SRC_PORT }, 312 { "dst-mac", LOOKUP_DST_MAC }, 313 { "src-mac", LOOKUP_SRC_MAC }, 314 { "uid", LOOKUP_UID }, 315 { "jail", LOOKUP_JAIL }, 316 { "dscp", LOOKUP_DSCP }, 317 { "mark", LOOKUP_MARK }, 318 { NULL, 0 }, 319 }; 320 321 static struct _s_x rule_options[] = { 322 { "tagged", TOK_TAGGED }, 323 { "uid", TOK_UID }, 324 { "gid", TOK_GID }, 325 { "jail", TOK_JAIL }, 326 { "in", TOK_IN }, 327 { "limit", TOK_LIMIT }, 328 { "set-limit", TOK_SETLIMIT }, 329 { "keep-state", TOK_KEEPSTATE }, 330 { "record-state", TOK_RECORDSTATE }, 331 { "bridged", TOK_LAYER2 }, 332 { "layer2", TOK_LAYER2 }, 333 { "out", TOK_OUT }, 334 { "diverted", TOK_DIVERTED }, 335 { "diverted-loopback", TOK_DIVERTEDLOOPBACK }, 336 { "diverted-output", TOK_DIVERTEDOUTPUT }, 337 { "xmit", TOK_XMIT }, 338 { "recv", TOK_RECV }, 339 { "via", TOK_VIA }, 340 { "fragment", TOK_FRAG }, 341 { "frag", TOK_FRAG }, 342 { "fib", TOK_FIB }, 343 { "ipoptions", TOK_IPOPTS }, 344 { "ipopts", TOK_IPOPTS }, 345 { "iplen", TOK_IPLEN }, 346 { "ipid", TOK_IPID }, 347 { "ipprecedence", TOK_IPPRECEDENCE }, 348 { "dscp", TOK_DSCP }, 349 { "iptos", TOK_IPTOS }, 350 { "ipttl", TOK_IPTTL }, 351 { "ipversion", TOK_IPVER }, 352 { "ipver", TOK_IPVER }, 353 { "estab", TOK_ESTAB }, 354 { "established", TOK_ESTAB }, 355 { "setup", TOK_SETUP }, 356 { "sockarg", TOK_SOCKARG }, 357 { "tcpdatalen", TOK_TCPDATALEN }, 358 { "tcpflags", TOK_TCPFLAGS }, 359 { "tcpflgs", TOK_TCPFLAGS }, 360 { "tcpmss", TOK_TCPMSS }, 361 { "tcpoptions", TOK_TCPOPTS }, 362 { "tcpopts", TOK_TCPOPTS }, 363 { "tcpseq", TOK_TCPSEQ }, 364 { "tcpack", TOK_TCPACK }, 365 { "tcpwin", TOK_TCPWIN }, 366 { "icmptype", TOK_ICMPTYPES }, 367 { "icmptypes", TOK_ICMPTYPES }, 368 { "dst-ip", TOK_DSTIP }, 369 { "src-ip", TOK_SRCIP }, 370 { "dst-port", TOK_DSTPORT }, 371 { "src-port", TOK_SRCPORT }, 372 { "dst-mac", TOK_DSTMAC }, 373 { "src-mac", TOK_SRCMAC }, 374 { "proto", TOK_PROTO }, 375 { "MAC", TOK_MAC }, 376 { "mac", TOK_MAC }, 377 { "mac-type", TOK_MACTYPE }, 378 { "verrevpath", TOK_VERREVPATH }, 379 { "versrcreach", TOK_VERSRCREACH }, 380 { "antispoof", TOK_ANTISPOOF }, 381 { "ipsec", TOK_IPSEC }, 382 { "icmp6type", TOK_ICMP6TYPES }, 383 { "icmp6types", TOK_ICMP6TYPES }, 384 { "ext6hdr", TOK_EXT6HDR }, 385 { "flow-id", TOK_FLOWID }, 386 { "ipv6", TOK_IPV6 }, 387 { "ip6", TOK_IPV6 }, 388 { "ipv4", TOK_IPV4 }, 389 { "ip4", TOK_IPV4 }, 390 { "dst-ipv6", TOK_DSTIP6 }, 391 { "dst-ip6", TOK_DSTIP6 }, 392 { "src-ipv6", TOK_SRCIP6 }, 393 { "src-ip6", TOK_SRCIP6 }, 394 { "lookup", TOK_LOOKUP }, 395 { "flow", TOK_FLOW }, 396 { "mark", TOK_MARK }, 397 { "defer-action", TOK_SKIPACTION }, 398 { "defer-immediate-action", TOK_SKIPACTION }, 399 { "//", TOK_COMMENT }, 400 401 { "not", TOK_NOT }, /* pseudo option */ 402 { "!", /* escape ? */ TOK_NOT }, /* pseudo option */ 403 { "or", TOK_OR }, /* pseudo option */ 404 { "|", /* escape */ TOK_OR }, /* pseudo option */ 405 { "{", TOK_STARTBRACE }, /* pseudo option */ 406 { "(", TOK_STARTBRACE }, /* pseudo option */ 407 { "}", TOK_ENDBRACE }, /* pseudo option */ 408 { ")", TOK_ENDBRACE }, /* pseudo option */ 409 { NULL, 0 } /* terminator */ 410 }; 411 412 void bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg); 413 static int ipfw_get_config(struct cmdline_opts *co, struct format_opts *fo, 414 ipfw_cfg_lheader **pcfg, size_t *psize); 415 static int ipfw_show_config(struct cmdline_opts *co, struct format_opts *fo, 416 ipfw_cfg_lheader *cfg, size_t sz, int ac, char **av); 417 static void ipfw_list_tifaces(void); 418 419 struct tidx; 420 static uint16_t pack_object(struct tidx *tstate, const char *name, int otype); 421 static uint16_t pack_table(struct tidx *tstate, const char *name); 422 423 static char *table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx); 424 static void object_sort_ctlv(ipfw_obj_ctlv *ctlv); 425 static char *object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx, 426 uint16_t type); 427 428 int 429 is_ipfw(void) 430 { 431 return (g_co.prog == cmdline_prog_ipfw); 432 } 433 434 /* 435 * Simple string buffer API. 436 * Used to simplify buffer passing between function and for 437 * transparent overrun handling. 438 */ 439 440 /* 441 * Allocates new buffer of given size @sz. 442 * 443 * Returns 0 on success. 444 */ 445 int 446 bp_alloc(struct buf_pr *b, size_t size) 447 { 448 memset(b, 0, sizeof(struct buf_pr)); 449 450 if ((b->buf = calloc(1, size)) == NULL) 451 return (ENOMEM); 452 453 b->ptr = b->buf; 454 b->size = size; 455 b->avail = b->size; 456 457 return (0); 458 } 459 460 void 461 bp_free(struct buf_pr *b) 462 { 463 464 free(b->buf); 465 } 466 467 /* 468 * Flushes buffer so new writer start from beginning. 469 */ 470 void 471 bp_flush(struct buf_pr *b) 472 { 473 474 b->ptr = b->buf; 475 b->avail = b->size; 476 b->buf[0] = '\0'; 477 } 478 479 /* 480 * Print message specified by @format and args. 481 * Automatically manage buffer space and transparently handle 482 * buffer overruns. 483 * 484 * Returns number of bytes that should have been printed. 485 */ 486 int 487 bprintf(struct buf_pr *b, const char *format, ...) 488 { 489 va_list args; 490 int i; 491 492 va_start(args, format); 493 494 i = vsnprintf(b->ptr, b->avail, format, args); 495 va_end(args); 496 497 if (i < 0 || (size_t)i > b->avail) { 498 /* Overflow or print error */ 499 b->avail = 0; 500 } else { 501 b->ptr += i; 502 b->avail -= i; 503 } 504 505 b->needed += i; 506 507 return (i); 508 } 509 510 /* 511 * Special values printer for tablearg-aware opcodes. 512 */ 513 void 514 bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg) 515 { 516 517 if (str != NULL) 518 bprintf(bp, "%s", str); 519 if (arg == IP_FW_TARG) 520 bprintf(bp, "tablearg"); 521 else 522 bprintf(bp, "%u", arg); 523 } 524 525 /* 526 * Helper routine to print a possibly unaligned uint64_t on 527 * various platform. If width > 0, print the value with 528 * the desired width, followed by a space; 529 * otherwise, return the required width. 530 */ 531 int 532 pr_u64(struct buf_pr *b, void *pd, int width) 533 { 534 #ifdef TCC 535 #define U64_FMT "I64" 536 #else 537 #define U64_FMT "llu" 538 #endif 539 uint64_t u; 540 unsigned long long d; 541 542 bcopy (pd, &u, sizeof(u)); 543 d = u; 544 return (width > 0) ? 545 bprintf(b, "%*" U64_FMT " ", width, d) : 546 snprintf(NULL, 0, "%" U64_FMT, d) ; 547 #undef U64_FMT 548 } 549 550 551 void * 552 safe_calloc(size_t number, size_t size) 553 { 554 void *ret = calloc(number, size); 555 556 if (ret == NULL) 557 err(EX_OSERR, "calloc"); 558 return ret; 559 } 560 561 void * 562 safe_realloc(void *ptr, size_t size) 563 { 564 void *ret = realloc(ptr, size); 565 566 if (ret == NULL) 567 err(EX_OSERR, "realloc"); 568 return ret; 569 } 570 571 /* 572 * Compare things like interface or table names. 573 */ 574 int 575 stringnum_cmp(const char *a, const char *b) 576 { 577 int la, lb; 578 579 la = strlen(a); 580 lb = strlen(b); 581 582 if (la > lb) 583 return (1); 584 else if (la < lb) 585 return (-01); 586 587 return (strcmp(a, b)); 588 } 589 590 591 /* 592 * conditionally runs the command. 593 * Selected options or negative -> getsockopt 594 */ 595 int 596 do_cmd(int optname, void *optval, uintptr_t optlen) 597 { 598 int i; 599 600 if (g_co.test_only) 601 return 0; 602 603 if (ipfw_socket == -1) 604 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 605 if (ipfw_socket < 0) 606 err(EX_UNAVAILABLE, "socket"); 607 608 if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET || 609 optname == IP_FW_ADD || optname == IP_FW3 || 610 optname == IP_FW_NAT_GET_CONFIG || 611 optname < 0 || 612 optname == IP_FW_NAT_GET_LOG) { 613 if (optname < 0) 614 optname = -optname; 615 i = getsockopt(ipfw_socket, IPPROTO_IP, optname, optval, 616 (socklen_t *)optlen); 617 } else { 618 i = setsockopt(ipfw_socket, IPPROTO_IP, optname, optval, optlen); 619 } 620 return i; 621 } 622 623 /* 624 * do_set3 - pass ipfw control cmd to kernel 625 * @optname: option name 626 * @optval: pointer to option data 627 * @optlen: option length 628 * 629 * Assumes op3 header is already embedded. 630 * Calls setsockopt() with IP_FW3 as kernel-visible opcode. 631 * Returns 0 on success or errno otherwise. 632 */ 633 int 634 do_set3(int optname, ip_fw3_opheader *op3, size_t optlen) 635 { 636 637 if (g_co.test_only) 638 return (0); 639 640 if (ipfw_socket == -1) 641 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 642 if (ipfw_socket < 0) 643 err(EX_UNAVAILABLE, "socket"); 644 645 op3->opcode = optname; 646 647 return (setsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3, optlen)); 648 } 649 650 /* 651 * do_get3 - pass ipfw control cmd to kernel 652 * @optname: option name 653 * @optval: pointer to option data 654 * @optlen: pointer to option length 655 * 656 * Assumes op3 header is already embedded. 657 * Calls getsockopt() with IP_FW3 as kernel-visible opcode. 658 * Returns 0 on success or errno otherwise. 659 */ 660 int 661 do_get3(int optname, ip_fw3_opheader *op3, size_t *optlen) 662 { 663 int error; 664 socklen_t len; 665 666 if (g_co.test_only) 667 return (0); 668 669 if (ipfw_socket == -1) 670 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); 671 if (ipfw_socket < 0) 672 err(EX_UNAVAILABLE, "socket"); 673 674 op3->opcode = optname; 675 676 len = *optlen; 677 error = getsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3, &len); 678 *optlen = len; 679 680 return (error); 681 } 682 683 /** 684 * match_token takes a table and a string, returns the value associated 685 * with the string (-1 in case of failure). 686 */ 687 int 688 match_token(struct _s_x *table, const char *string) 689 { 690 struct _s_x *pt; 691 uint i = strlen(string); 692 693 for (pt = table ; i && pt->s != NULL ; pt++) 694 if (strlen(pt->s) == i && !bcmp(string, pt->s, i)) 695 return pt->x; 696 return (-1); 697 } 698 699 /** 700 * match_token_relaxed takes a table and a string, returns the value associated 701 * with the string for the best match. 702 * 703 * Returns: 704 * value from @table for matched records 705 * -1 for non-matched records 706 * -2 if more than one records match @string. 707 */ 708 int 709 match_token_relaxed(struct _s_x *table, const char *string) 710 { 711 struct _s_x *pt, *m; 712 int i, c; 713 714 i = strlen(string); 715 c = 0; 716 717 for (pt = table ; i != 0 && pt->s != NULL ; pt++) { 718 if (strncmp(pt->s, string, i) != 0) 719 continue; 720 m = pt; 721 c++; 722 } 723 724 if (c == 1) 725 return (m->x); 726 727 return (c > 0 ? -2: -1); 728 } 729 730 int 731 get_token(struct _s_x *table, const char *string, const char *errbase) 732 { 733 int tcmd; 734 735 if ((tcmd = match_token_relaxed(table, string)) < 0) 736 errx(EX_USAGE, "%s %s %s", 737 (tcmd == 0) ? "invalid" : "ambiguous", errbase, string); 738 739 return (tcmd); 740 } 741 742 /** 743 * match_value takes a table and a value, returns the string associated 744 * with the value (NULL in case of failure). 745 */ 746 char const * 747 match_value(struct _s_x *p, int value) 748 { 749 for (; p->s != NULL; p++) 750 if (p->x == value) 751 return p->s; 752 return NULL; 753 } 754 755 size_t 756 concat_tokens(char *buf, size_t bufsize, struct _s_x *table, 757 const char *delimiter) 758 { 759 struct _s_x *pt; 760 int l; 761 size_t sz; 762 763 for (sz = 0, pt = table ; pt->s != NULL; pt++) { 764 l = snprintf(buf + sz, bufsize - sz, "%s%s", 765 (sz == 0) ? "" : delimiter, pt->s); 766 sz += l; 767 bufsize += l; 768 if (sz > bufsize) 769 return (bufsize); 770 } 771 772 return (sz); 773 } 774 775 /* 776 * helper function to process a set of flags and set bits in the 777 * appropriate masks. 778 */ 779 int 780 fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set, 781 uint32_t *clear) 782 { 783 char *q; /* points to the separator */ 784 int val; 785 uint32_t *which; /* mask we are working on */ 786 787 while (p && *p) { 788 if (*p == '!') { 789 p++; 790 which = clear; 791 } else 792 which = set; 793 q = strchr(p, ','); 794 if (q) 795 *q++ = '\0'; 796 val = match_token(flags, p); 797 if (val <= 0) { 798 if (e != NULL) 799 *e = p; 800 return (-1); 801 } 802 *which |= (uint32_t)val; 803 p = q; 804 } 805 return (0); 806 } 807 808 void 809 print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set) 810 { 811 char const *comma = ""; 812 int i, l; 813 814 for (i = 0; list[i].x != 0; i++) { 815 if ((set & list[i].x) == 0) 816 continue; 817 818 set &= ~list[i].x; 819 l = snprintf(buf, sz, "%s%s", comma, list[i].s); 820 if (l < 0 || (size_t)l >= sz) 821 return; 822 comma = ","; 823 buf += l; 824 sz -=l; 825 } 826 } 827 828 /* 829 * _substrcmp takes two strings and returns 1 if they do not match, 830 * and 0 if they match exactly or the first string is a sub-string 831 * of the second. A warning is printed to stderr in the case that the 832 * first string is a sub-string of the second. 833 * 834 * This function will be removed in the future through the usual 835 * deprecation process. 836 */ 837 int 838 _substrcmp(const char *str1, const char* str2) 839 { 840 841 if (strncmp(str1, str2, strlen(str1)) != 0) 842 return 1; 843 844 if (strlen(str1) != strlen(str2)) 845 warnx("DEPRECATED: '%s' matched '%s' as a sub-string", 846 str1, str2); 847 return 0; 848 } 849 850 /* 851 * _substrcmp2 takes three strings and returns 1 if the first two do not match, 852 * and 0 if they match exactly or the second string is a sub-string 853 * of the first. A warning is printed to stderr in the case that the 854 * first string does not match the third. 855 * 856 * This function exists to warn about the bizarre construction 857 * strncmp(str, "by", 2) which is used to allow people to use a shortcut 858 * for "bytes". The problem is that in addition to accepting "by", 859 * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any 860 * other string beginning with "by". 861 * 862 * This function will be removed in the future through the usual 863 * deprecation process. 864 */ 865 int 866 _substrcmp2(const char *str1, const char* str2, const char* str3) 867 { 868 869 if (strncmp(str1, str2, strlen(str2)) != 0) 870 return 1; 871 872 if (strcmp(str1, str3) != 0) 873 warnx("DEPRECATED: '%s' matched '%s'", 874 str1, str3); 875 return 0; 876 } 877 878 /* 879 * prints one port, symbolic or numeric 880 */ 881 static void 882 print_port(struct buf_pr *bp, int proto, uint16_t port) 883 { 884 885 if (proto == IPPROTO_ETHERTYPE) { 886 char const *s; 887 888 if (g_co.do_resolv && (s = match_value(ether_types, port)) ) 889 bprintf(bp, "%s", s); 890 else 891 bprintf(bp, "0x%04x", port); 892 } else { 893 struct servent *se = NULL; 894 if (g_co.do_resolv) { 895 struct protoent *pe = getprotobynumber(proto); 896 897 se = getservbyport(htons(port), pe ? pe->p_name : NULL); 898 } 899 if (se) 900 bprintf(bp, "%s", se->s_name); 901 else 902 bprintf(bp, "%d", port); 903 } 904 } 905 906 static struct _s_x _port_name[] = { 907 {"dst-port", O_IP_DSTPORT}, 908 {"src-port", O_IP_SRCPORT}, 909 {"ipid", O_IPID}, 910 {"iplen", O_IPLEN}, 911 {"ipttl", O_IPTTL}, 912 {"mac-type", O_MAC_TYPE}, 913 {"tcpdatalen", O_TCPDATALEN}, 914 {"tcpmss", O_TCPMSS}, 915 {"tcpwin", O_TCPWIN}, 916 {"tagged", O_TAGGED}, 917 {NULL, 0} 918 }; 919 920 /* 921 * Print the values in a list 16-bit items of the types above. 922 * XXX todo: add support for mask. 923 */ 924 static void 925 print_newports(struct buf_pr *bp, const ipfw_insn_u16 *cmd, int proto, int opcode) 926 { 927 const uint16_t *p = cmd->ports; 928 int i; 929 char const *sep; 930 931 if (opcode != 0) { 932 sep = match_value(_port_name, opcode); 933 if (sep == NULL) 934 sep = "???"; 935 bprintf(bp, " %s", sep); 936 } 937 sep = " "; 938 for (i = F_LEN((const ipfw_insn *)cmd) - 1; i > 0; i--, p += 2) { 939 bprintf(bp, "%s", sep); 940 print_port(bp, proto, p[0]); 941 if (p[0] != p[1]) { 942 bprintf(bp, "-"); 943 print_port(bp, proto, p[1]); 944 } 945 sep = ","; 946 } 947 } 948 949 /* 950 * Like strtol, but also translates service names into port numbers 951 * for some protocols. 952 * In particular: 953 * proto == -1 disables the protocol check; 954 * proto == IPPROTO_ETHERTYPE looks up an internal table 955 * proto == <some value in /etc/protocols> matches the values there. 956 * Returns *end == s in case the parameter is not found. 957 */ 958 static int 959 strtoport(char *s, char **end, int base, int proto) 960 { 961 char *p, *buf; 962 char *s1; 963 int i; 964 965 *end = s; /* default - not found */ 966 if (*s == '\0') 967 return 0; /* not found */ 968 969 if (isdigit(*s)) 970 return strtol(s, end, base); 971 972 /* 973 * find separator. '\\' escapes the next char. 974 */ 975 for (s1 = s; *s1 && (isalnum(*s1) || *s1 == '\\' || 976 *s1 == '_' || *s1 == '.') ; s1++) 977 if (*s1 == '\\' && s1[1] != '\0') 978 s1++; 979 980 buf = safe_calloc(s1 - s + 1, 1); 981 982 /* 983 * copy into a buffer skipping backslashes 984 */ 985 for (p = s, i = 0; p != s1 ; p++) 986 if (*p != '\\') 987 buf[i++] = *p; 988 buf[i++] = '\0'; 989 990 if (proto == IPPROTO_ETHERTYPE) { 991 i = match_token(ether_types, buf); 992 free(buf); 993 if (i != -1) { /* found */ 994 *end = s1; 995 return i; 996 } 997 } else { 998 struct protoent *pe = NULL; 999 struct servent *se; 1000 1001 if (proto != 0) 1002 pe = getprotobynumber(proto); 1003 setservent(1); 1004 se = getservbyname(buf, pe ? pe->p_name : NULL); 1005 free(buf); 1006 if (se != NULL) { 1007 *end = s1; 1008 return ntohs(se->s_port); 1009 } 1010 } 1011 return 0; /* not found */ 1012 } 1013 1014 /* 1015 * Fill the body of the command with the list of port ranges. 1016 */ 1017 static int 1018 fill_newports(ipfw_insn_u16 *cmd, char *av, int proto, int cblen) 1019 { 1020 uint16_t a, b, *p = cmd->ports; 1021 int i = 0; 1022 char *s = av; 1023 1024 while (*s) { 1025 a = strtoport(av, &s, 0, proto); 1026 if (s == av) /* empty or invalid argument */ 1027 return (0); 1028 1029 CHECK_LENGTH(cblen, i + 2); 1030 1031 switch (*s) { 1032 case '-': /* a range */ 1033 av = s + 1; 1034 b = strtoport(av, &s, 0, proto); 1035 /* Reject expressions like '1-abc' or '1-2-3'. */ 1036 if (s == av || (*s != ',' && *s != '\0')) 1037 return (0); 1038 p[0] = a; 1039 p[1] = b; 1040 break; 1041 case ',': /* comma separated list */ 1042 case '\0': 1043 p[0] = p[1] = a; 1044 break; 1045 default: 1046 warnx("port list: invalid separator <%c> in <%s>", 1047 *s, av); 1048 return (0); 1049 } 1050 1051 i++; 1052 p += 2; 1053 av = s + 1; 1054 } 1055 if (i > 0) { 1056 if (i + 1 > F_LEN_MASK) 1057 errx(EX_DATAERR, "too many ports/ranges\n"); 1058 cmd->o.len |= i + 1; /* leave F_NOT and F_OR untouched */ 1059 } 1060 return (i); 1061 } 1062 1063 /* 1064 * Fill the body of the command with the list of DiffServ codepoints. 1065 */ 1066 static void 1067 fill_dscp(ipfw_insn *cmd, char *av, int cblen) 1068 { 1069 uint32_t *low, *high; 1070 char *s = av, *a; 1071 int code; 1072 1073 cmd->opcode = O_DSCP; 1074 cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1; 1075 1076 CHECK_CMDLEN; 1077 1078 low = (uint32_t *)(cmd + 1); 1079 high = low + 1; 1080 1081 *low = 0; 1082 *high = 0; 1083 1084 while (s != NULL) { 1085 a = strchr(s, ','); 1086 1087 if (a != NULL) 1088 *a++ = '\0'; 1089 1090 if (isalpha(*s)) { 1091 if ((code = match_token(f_ipdscp, s)) == -1) 1092 errx(EX_DATAERR, "Unknown DSCP code"); 1093 } else { 1094 code = strtoul(s, NULL, 10); 1095 if (code < 0 || code > 63) 1096 errx(EX_DATAERR, "Invalid DSCP value"); 1097 } 1098 1099 if (code >= 32) 1100 *high |= 1 << (code - 32); 1101 else 1102 *low |= 1 << code; 1103 1104 s = a; 1105 } 1106 } 1107 1108 /* 1109 * Fill the body of the command with mark value and mask. 1110 */ 1111 static void 1112 fill_mark(ipfw_insn *cmd, char *av, int cblen) 1113 { 1114 uint32_t *value, *mask; 1115 char *value_str; 1116 1117 cmd->opcode = O_MARK; 1118 cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1; 1119 1120 CHECK_CMDLEN; 1121 1122 value = (uint32_t *)(cmd + 1); 1123 mask = value + 1; 1124 1125 value_str = strsep(&av, ":"); 1126 1127 if (strcmp(value_str, "tablearg") == 0) { 1128 cmd->arg1 = IP_FW_TARG; 1129 *value = 0; 1130 } else { 1131 /* This is not a tablearg */ 1132 cmd->arg1 |= 0x8000; 1133 *value = strtoul(value_str, NULL, 0); 1134 } 1135 if (av) 1136 *mask = strtoul(av, NULL, 0); 1137 else 1138 *mask = 0xFFFFFFFF; 1139 1140 if ((*value & *mask) != *value) 1141 errx(EX_DATAERR, "Static mark value: some bits in value are" 1142 " set that will be masked out by mask " 1143 "(%#x & %#x) = %#x != %#x", 1144 *value, *mask, (*value & *mask), *value); 1145 } 1146 1147 static struct _s_x icmpcodes[] = { 1148 { "net", ICMP_UNREACH_NET }, 1149 { "host", ICMP_UNREACH_HOST }, 1150 { "protocol", ICMP_UNREACH_PROTOCOL }, 1151 { "port", ICMP_UNREACH_PORT }, 1152 { "needfrag", ICMP_UNREACH_NEEDFRAG }, 1153 { "srcfail", ICMP_UNREACH_SRCFAIL }, 1154 { "net-unknown", ICMP_UNREACH_NET_UNKNOWN }, 1155 { "host-unknown", ICMP_UNREACH_HOST_UNKNOWN }, 1156 { "isolated", ICMP_UNREACH_ISOLATED }, 1157 { "net-prohib", ICMP_UNREACH_NET_PROHIB }, 1158 { "host-prohib", ICMP_UNREACH_HOST_PROHIB }, 1159 { "tosnet", ICMP_UNREACH_TOSNET }, 1160 { "toshost", ICMP_UNREACH_TOSHOST }, 1161 { "filter-prohib", ICMP_UNREACH_FILTER_PROHIB }, 1162 { "host-precedence", ICMP_UNREACH_HOST_PRECEDENCE }, 1163 { "precedence-cutoff", ICMP_UNREACH_PRECEDENCE_CUTOFF }, 1164 { NULL, 0 } 1165 }; 1166 1167 static void 1168 fill_reject_code(u_short *codep, char *str) 1169 { 1170 int val; 1171 char *s; 1172 1173 val = strtoul(str, &s, 0); 1174 if (s == str || *s != '\0' || val >= 0x100) 1175 val = match_token(icmpcodes, str); 1176 if (val < 0) 1177 errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str); 1178 *codep = val; 1179 return; 1180 } 1181 1182 static void 1183 print_reject_code(struct buf_pr *bp, uint16_t code) 1184 { 1185 char const *s; 1186 1187 if ((s = match_value(icmpcodes, code)) != NULL) 1188 bprintf(bp, "unreach %s", s); 1189 else 1190 bprintf(bp, "unreach %u", code); 1191 } 1192 1193 /* 1194 * Returns the number of bits set (from left) in a contiguous bitmask, 1195 * or -1 if the mask is not contiguous. 1196 * XXX this needs a proper fix. 1197 * This effectively works on masks in big-endian (network) format. 1198 * when compiled on little endian architectures. 1199 * 1200 * First bit is bit 7 of the first byte -- note, for MAC addresses, 1201 * the first bit on the wire is bit 0 of the first byte. 1202 * len is the max length in bits. 1203 */ 1204 int 1205 contigmask(const uint8_t *p, int len) 1206 { 1207 int i, n; 1208 1209 for (i=0; i<len ; i++) 1210 if ( (p[i/8] & (1 << (7 - (i%8)))) == 0) /* first bit unset */ 1211 break; 1212 for (n=i+1; n < len; n++) 1213 if ( (p[n/8] & (1 << (7 - (n%8)))) != 0) 1214 return -1; /* mask not contiguous */ 1215 return i; 1216 } 1217 1218 /* 1219 * print flags set/clear in the two bitmasks passed as parameters. 1220 * There is a specialized check for f_tcpflags. 1221 */ 1222 static void 1223 print_flags(struct buf_pr *bp, char const *name, const ipfw_insn *cmd, 1224 struct _s_x *list) 1225 { 1226 char const *comma = ""; 1227 int i; 1228 uint8_t set = cmd->arg1 & 0xff; 1229 uint8_t clear = (cmd->arg1 >> 8) & 0xff; 1230 1231 if (list == f_tcpflags && set == TH_SYN && clear == TH_ACK) { 1232 bprintf(bp, " setup"); 1233 return; 1234 } 1235 1236 bprintf(bp, " %s ", name); 1237 for (i=0; list[i].x != 0; i++) { 1238 if (set & list[i].x) { 1239 set &= ~list[i].x; 1240 bprintf(bp, "%s%s", comma, list[i].s); 1241 comma = ","; 1242 } 1243 if (clear & list[i].x) { 1244 clear &= ~list[i].x; 1245 bprintf(bp, "%s!%s", comma, list[i].s); 1246 comma = ","; 1247 } 1248 } 1249 } 1250 1251 1252 /* 1253 * Print the ip address contained in a command. 1254 */ 1255 static void 1256 print_ip(struct buf_pr *bp, const struct format_opts *fo, 1257 const ipfw_insn_ip *cmd) 1258 { 1259 struct hostent *he = NULL; 1260 const struct in_addr *ia; 1261 const uint32_t *a = ((const ipfw_insn_u32 *)cmd)->d; 1262 uint32_t len = F_LEN((const ipfw_insn *)cmd); 1263 char *t; 1264 1265 bprintf(bp, " "); 1266 if (cmd->o.opcode == O_IP_DST_LOOKUP && len > F_INSN_SIZE(ipfw_insn_u32)) { 1267 const char *arg; 1268 1269 arg = match_value(lookup_keys, a[1]); 1270 t = table_search_ctlv(fo->tstate, 1271 ((const ipfw_insn *)cmd)->arg1); 1272 bprintf(bp, "lookup %s %s", arg, t); 1273 return; 1274 } 1275 if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) { 1276 bprintf(bp, "me"); 1277 return; 1278 } 1279 if (cmd->o.opcode == O_IP_SRC_LOOKUP || 1280 cmd->o.opcode == O_IP_DST_LOOKUP) { 1281 t = table_search_ctlv(fo->tstate, 1282 ((const ipfw_insn *)cmd)->arg1); 1283 bprintf(bp, "table(%s", t); 1284 if (len == F_INSN_SIZE(ipfw_insn_u32)) 1285 bprintf(bp, ",%u", *a); 1286 bprintf(bp, ")"); 1287 return; 1288 } 1289 if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) { 1290 const uint32_t *map = (const uint32_t *)&cmd->mask; 1291 struct in_addr addr; 1292 uint32_t x; 1293 int i, j; 1294 char comma = '{'; 1295 1296 x = cmd->o.arg1 - 1; 1297 x = htonl(~x); 1298 addr.s_addr = htonl(cmd->addr.s_addr); 1299 bprintf(bp, "%s/%d", inet_ntoa(addr), 1300 contigmask((uint8_t *)&x, 32)); 1301 x = cmd->addr.s_addr; 1302 x &= 0xff; /* base */ 1303 /* 1304 * Print bits and ranges. 1305 * Locate first bit set (i), then locate first bit unset (j). 1306 * If we have 3+ consecutive bits set, then print them as a 1307 * range, otherwise only print the initial bit and rescan. 1308 */ 1309 for (i=0; i < cmd->o.arg1; i++) 1310 if (map[i/32] & (1<<(i & 31))) { 1311 for (j=i+1; j < cmd->o.arg1; j++) 1312 if (!(map[ j/32] & (1<<(j & 31)))) 1313 break; 1314 bprintf(bp, "%c%d", comma, i+x); 1315 if (j>i+2) { /* range has at least 3 elements */ 1316 bprintf(bp, "-%d", j-1+x); 1317 i = j-1; 1318 } 1319 comma = ','; 1320 } 1321 bprintf(bp, "}"); 1322 return; 1323 } 1324 /* 1325 * len == 2 indicates a single IP, whereas lists of 1 or more 1326 * addr/mask pairs have len = (2n+1). We convert len to n so we 1327 * use that to count the number of entries. 1328 */ 1329 for (len = len / 2; len > 0; len--, a += 2) { 1330 int mb = /* mask length */ 1331 (cmd->o.opcode == O_IP_SRC || cmd->o.opcode == O_IP_DST) ? 1332 32 : contigmask((const uint8_t *)&(a[1]), 32); 1333 if (mb == 32 && g_co.do_resolv) 1334 he = gethostbyaddr((const char *)&(a[0]), sizeof(in_addr_t), 1335 AF_INET); 1336 if (he != NULL) /* resolved to name */ 1337 bprintf(bp, "%s", he->h_name); 1338 else if (mb == 0) /* any */ 1339 bprintf(bp, "any"); 1340 else { /* numeric IP followed by some kind of mask */ 1341 ia = (const struct in_addr *)&a[0]; 1342 bprintf(bp, "%s", inet_ntoa(*ia)); 1343 if (mb < 0) { 1344 ia = (const struct in_addr *)&a[1]; 1345 bprintf(bp, ":%s", inet_ntoa(*ia)); 1346 } else if (mb < 32) 1347 bprintf(bp, "/%d", mb); 1348 } 1349 if (len > 1) 1350 bprintf(bp, ","); 1351 } 1352 } 1353 1354 /* 1355 * prints a MAC address/mask pair 1356 */ 1357 static void 1358 format_mac(struct buf_pr *bp, const uint8_t *addr, const uint8_t *mask) 1359 { 1360 int l = contigmask(mask, 48); 1361 1362 if (l == 0) 1363 bprintf(bp, " any"); 1364 else { 1365 bprintf(bp, " %02x:%02x:%02x:%02x:%02x:%02x", 1366 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); 1367 if (l == -1) 1368 bprintf(bp, "&%02x:%02x:%02x:%02x:%02x:%02x", 1369 mask[0], mask[1], mask[2], 1370 mask[3], mask[4], mask[5]); 1371 else if (l < 48) 1372 bprintf(bp, "/%d", l); 1373 } 1374 } 1375 1376 static void 1377 print_mac(struct buf_pr *bp, const ipfw_insn_mac *mac) 1378 { 1379 1380 bprintf(bp, " MAC"); 1381 format_mac(bp, mac->addr, mac->mask); 1382 format_mac(bp, mac->addr + 6, mac->mask + 6); 1383 } 1384 1385 static void 1386 print_mac_lookup(struct buf_pr *bp, const struct format_opts *fo, 1387 const ipfw_insn *cmd) 1388 { 1389 uint32_t len = F_LEN(cmd); 1390 char *t; 1391 1392 bprintf(bp, " "); 1393 1394 t = table_search_ctlv(fo->tstate, cmd->arg1); 1395 bprintf(bp, "table(%s", t); 1396 if (len == F_INSN_SIZE(ipfw_insn_u32)) 1397 bprintf(bp, ",%u", ((const ipfw_insn_u32 *)cmd)->d[0]); 1398 bprintf(bp, ")"); 1399 } 1400 1401 static void 1402 fill_icmptypes(ipfw_insn_u32 *cmd, char *av) 1403 { 1404 uint8_t type; 1405 1406 cmd->d[0] = 0; 1407 while (*av) { 1408 if (*av == ',') 1409 av++; 1410 1411 type = strtoul(av, &av, 0); 1412 1413 if (*av != ',' && *av != '\0') 1414 errx(EX_DATAERR, "invalid ICMP type"); 1415 1416 if (type > 31) 1417 errx(EX_DATAERR, "ICMP type out of range"); 1418 1419 cmd->d[0] |= 1 << type; 1420 } 1421 cmd->o.opcode = O_ICMPTYPE; 1422 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 1423 } 1424 1425 static void 1426 print_icmptypes(struct buf_pr *bp, const ipfw_insn_u32 *cmd) 1427 { 1428 int i; 1429 char sep= ' '; 1430 1431 bprintf(bp, " icmptypes"); 1432 for (i = 0; i < 32; i++) { 1433 if ( (cmd->d[0] & (1 << (i))) == 0) 1434 continue; 1435 bprintf(bp, "%c%d", sep, i); 1436 sep = ','; 1437 } 1438 } 1439 1440 static void 1441 print_dscp(struct buf_pr *bp, const ipfw_insn_u32 *cmd) 1442 { 1443 const uint32_t *v; 1444 const char *code; 1445 int i = 0; 1446 char sep= ' '; 1447 1448 bprintf(bp, " dscp"); 1449 v = cmd->d; 1450 while (i < 64) { 1451 if (*v & (1 << i)) { 1452 if ((code = match_value(f_ipdscp, i)) != NULL) 1453 bprintf(bp, "%c%s", sep, code); 1454 else 1455 bprintf(bp, "%c%d", sep, i); 1456 sep = ','; 1457 } 1458 1459 if ((++i % 32) == 0) 1460 v++; 1461 } 1462 } 1463 1464 #define insntod(cmd, type) ((const ipfw_insn_ ## type *)(cmd)) 1465 struct show_state { 1466 struct ip_fw_rule *rule; 1467 const ipfw_insn *eaction; 1468 uint8_t *printed; 1469 int flags; 1470 #define HAVE_PROTO 0x0001 1471 #define HAVE_SRCIP 0x0002 1472 #define HAVE_DSTIP 0x0004 1473 #define HAVE_PROBE_STATE 0x0008 1474 int proto; 1475 int or_block; 1476 }; 1477 1478 static int 1479 init_show_state(struct show_state *state, struct ip_fw_rule *rule) 1480 { 1481 1482 state->printed = calloc(rule->cmd_len, sizeof(uint8_t)); 1483 if (state->printed == NULL) 1484 return (ENOMEM); 1485 state->rule = rule; 1486 state->eaction = NULL; 1487 state->flags = 0; 1488 state->proto = 0; 1489 state->or_block = 0; 1490 return (0); 1491 } 1492 1493 static void 1494 free_show_state(struct show_state *state) 1495 { 1496 1497 free(state->printed); 1498 } 1499 1500 static uint8_t 1501 is_printed_opcode(struct show_state *state, const ipfw_insn *cmd) 1502 { 1503 1504 return (state->printed[cmd - state->rule->cmd]); 1505 } 1506 1507 static void 1508 mark_printed(struct show_state *state, const ipfw_insn *cmd) 1509 { 1510 1511 state->printed[cmd - state->rule->cmd] = 1; 1512 } 1513 1514 static void 1515 print_limit_mask(struct buf_pr *bp, const ipfw_insn_limit *limit) 1516 { 1517 struct _s_x *p = limit_masks; 1518 char const *comma = " "; 1519 uint8_t x; 1520 1521 for (x = limit->limit_mask; p->x != 0; p++) { 1522 if ((x & p->x) == p->x) { 1523 x &= ~p->x; 1524 bprintf(bp, "%s%s", comma, p->s); 1525 comma = ","; 1526 } 1527 } 1528 bprint_uint_arg(bp, " ", limit->conn_limit); 1529 } 1530 1531 static int 1532 print_instruction(struct buf_pr *bp, const struct format_opts *fo, 1533 struct show_state *state, const ipfw_insn *cmd) 1534 { 1535 struct protoent *pe; 1536 struct passwd *pwd; 1537 struct group *grp; 1538 const char *s; 1539 double d; 1540 1541 if (is_printed_opcode(state, cmd)) 1542 return (0); 1543 if ((cmd->len & F_OR) != 0 && state->or_block == 0) 1544 bprintf(bp, " {"); 1545 if (cmd->opcode != O_IN && (cmd->len & F_NOT) != 0) 1546 bprintf(bp, " not"); 1547 1548 switch (cmd->opcode) { 1549 case O_PROB: 1550 d = 1.0 * insntod(cmd, u32)->d[0] / 0x7fffffff; 1551 bprintf(bp, "prob %f ", d); 1552 break; 1553 case O_PROBE_STATE: /* no need to print anything here */ 1554 state->flags |= HAVE_PROBE_STATE; 1555 break; 1556 case O_IP_SRC: 1557 case O_IP_SRC_LOOKUP: 1558 case O_IP_SRC_MASK: 1559 case O_IP_SRC_ME: 1560 case O_IP_SRC_SET: 1561 if (state->flags & HAVE_SRCIP) 1562 bprintf(bp, " src-ip"); 1563 print_ip(bp, fo, insntod(cmd, ip)); 1564 break; 1565 case O_IP_DST: 1566 case O_IP_DST_LOOKUP: 1567 case O_IP_DST_MASK: 1568 case O_IP_DST_ME: 1569 case O_IP_DST_SET: 1570 if (state->flags & HAVE_DSTIP) 1571 bprintf(bp, " dst-ip"); 1572 print_ip(bp, fo, insntod(cmd, ip)); 1573 break; 1574 case O_IP6_SRC: 1575 case O_IP6_SRC_MASK: 1576 case O_IP6_SRC_ME: 1577 if (state->flags & HAVE_SRCIP) 1578 bprintf(bp, " src-ip6"); 1579 print_ip6(bp, insntod(cmd, ip6)); 1580 break; 1581 case O_IP6_DST: 1582 case O_IP6_DST_MASK: 1583 case O_IP6_DST_ME: 1584 if (state->flags & HAVE_DSTIP) 1585 bprintf(bp, " dst-ip6"); 1586 print_ip6(bp, insntod(cmd, ip6)); 1587 break; 1588 case O_MAC_SRC_LOOKUP: 1589 bprintf(bp, " src-mac"); 1590 print_mac_lookup(bp, fo, cmd); 1591 break; 1592 case O_MAC_DST_LOOKUP: 1593 bprintf(bp, " dst-mac"); 1594 print_mac_lookup(bp, fo, cmd); 1595 break; 1596 case O_FLOW6ID: 1597 print_flow6id(bp, insntod(cmd, u32)); 1598 break; 1599 case O_IP_DSTPORT: 1600 case O_IP_SRCPORT: 1601 print_newports(bp, insntod(cmd, u16), state->proto, 1602 (state->flags & (HAVE_SRCIP | HAVE_DSTIP)) == 1603 (HAVE_SRCIP | HAVE_DSTIP) ? cmd->opcode: 0); 1604 break; 1605 case O_PROTO: 1606 pe = getprotobynumber(cmd->arg1); 1607 if (state->flags & HAVE_PROTO) 1608 bprintf(bp, " proto"); 1609 if (pe != NULL) 1610 bprintf(bp, " %s", pe->p_name); 1611 else 1612 bprintf(bp, " %u", cmd->arg1); 1613 state->proto = cmd->arg1; 1614 break; 1615 case O_MACADDR2: 1616 print_mac(bp, insntod(cmd, mac)); 1617 break; 1618 case O_MAC_TYPE: 1619 print_newports(bp, insntod(cmd, u16), 1620 IPPROTO_ETHERTYPE, cmd->opcode); 1621 break; 1622 case O_FRAG: 1623 print_flags(bp, "frag", cmd, f_ipoff); 1624 break; 1625 case O_FIB: 1626 bprintf(bp, " fib %u", cmd->arg1); 1627 break; 1628 case O_SOCKARG: 1629 bprintf(bp, " sockarg"); 1630 break; 1631 case O_IN: 1632 bprintf(bp, cmd->len & F_NOT ? " out" : " in"); 1633 break; 1634 case O_DIVERTED: 1635 switch (cmd->arg1) { 1636 case 3: 1637 bprintf(bp, " diverted"); 1638 break; 1639 case 2: 1640 bprintf(bp, " diverted-output"); 1641 break; 1642 case 1: 1643 bprintf(bp, " diverted-loopback"); 1644 break; 1645 default: 1646 bprintf(bp, " diverted-?<%u>", cmd->arg1); 1647 break; 1648 } 1649 break; 1650 case O_LAYER2: 1651 bprintf(bp, " layer2"); 1652 break; 1653 case O_XMIT: 1654 case O_RECV: 1655 case O_VIA: 1656 if (cmd->opcode == O_XMIT) 1657 s = "xmit"; 1658 else if (cmd->opcode == O_RECV) 1659 s = "recv"; 1660 else /* if (cmd->opcode == O_VIA) */ 1661 s = "via"; 1662 switch (insntod(cmd, if)->name[0]) { 1663 case '\0': 1664 bprintf(bp, " %s %s", s, 1665 inet_ntoa(insntod(cmd, if)->p.ip)); 1666 break; 1667 case '\1': 1668 bprintf(bp, " %s table(%s)", s, 1669 table_search_ctlv(fo->tstate, 1670 insntod(cmd, if)->p.kidx)); 1671 break; 1672 default: 1673 bprintf(bp, " %s %s", s, 1674 insntod(cmd, if)->name); 1675 } 1676 break; 1677 case O_IP_FLOW_LOOKUP: 1678 s = table_search_ctlv(fo->tstate, cmd->arg1); 1679 bprintf(bp, " flow table(%s", s); 1680 if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) 1681 bprintf(bp, ",%u", insntod(cmd, u32)->d[0]); 1682 bprintf(bp, ")"); 1683 break; 1684 case O_IPID: 1685 case O_IPTTL: 1686 case O_IPLEN: 1687 case O_TCPDATALEN: 1688 case O_TCPMSS: 1689 case O_TCPWIN: 1690 if (F_LEN(cmd) == 1) { 1691 switch (cmd->opcode) { 1692 case O_IPID: 1693 s = "ipid"; 1694 break; 1695 case O_IPTTL: 1696 s = "ipttl"; 1697 break; 1698 case O_IPLEN: 1699 s = "iplen"; 1700 break; 1701 case O_TCPDATALEN: 1702 s = "tcpdatalen"; 1703 break; 1704 case O_TCPMSS: 1705 s = "tcpmss"; 1706 break; 1707 case O_TCPWIN: 1708 s = "tcpwin"; 1709 break; 1710 default: 1711 s = "<unknown>"; 1712 break; 1713 } 1714 bprintf(bp, " %s %u", s, cmd->arg1); 1715 } else 1716 print_newports(bp, insntod(cmd, u16), 0, 1717 cmd->opcode); 1718 break; 1719 case O_IPVER: 1720 bprintf(bp, " ipver %u", cmd->arg1); 1721 break; 1722 case O_IPPRECEDENCE: 1723 bprintf(bp, " ipprecedence %u", cmd->arg1 >> 5); 1724 break; 1725 case O_DSCP: 1726 print_dscp(bp, insntod(cmd, u32)); 1727 break; 1728 case O_IPOPT: 1729 print_flags(bp, "ipoptions", cmd, f_ipopts); 1730 break; 1731 case O_IPTOS: 1732 print_flags(bp, "iptos", cmd, f_iptos); 1733 break; 1734 case O_ICMPTYPE: 1735 print_icmptypes(bp, insntod(cmd, u32)); 1736 break; 1737 case O_ESTAB: 1738 bprintf(bp, " established"); 1739 break; 1740 case O_TCPFLAGS: 1741 print_flags(bp, "tcpflags", cmd, f_tcpflags); 1742 break; 1743 case O_TCPOPTS: 1744 print_flags(bp, "tcpoptions", cmd, f_tcpopts); 1745 break; 1746 case O_TCPACK: 1747 bprintf(bp, " tcpack %d", 1748 ntohl(insntod(cmd, u32)->d[0])); 1749 break; 1750 case O_TCPSEQ: 1751 bprintf(bp, " tcpseq %d", 1752 ntohl(insntod(cmd, u32)->d[0])); 1753 break; 1754 case O_UID: 1755 pwd = getpwuid(insntod(cmd, u32)->d[0]); 1756 if (pwd != NULL) 1757 bprintf(bp, " uid %s", pwd->pw_name); 1758 else 1759 bprintf(bp, " uid %u", 1760 insntod(cmd, u32)->d[0]); 1761 break; 1762 case O_GID: 1763 grp = getgrgid(insntod(cmd, u32)->d[0]); 1764 if (grp != NULL) 1765 bprintf(bp, " gid %s", grp->gr_name); 1766 else 1767 bprintf(bp, " gid %u", 1768 insntod(cmd, u32)->d[0]); 1769 break; 1770 case O_JAIL: 1771 bprintf(bp, " jail %d", insntod(cmd, u32)->d[0]); 1772 break; 1773 case O_VERREVPATH: 1774 bprintf(bp, " verrevpath"); 1775 break; 1776 case O_VERSRCREACH: 1777 bprintf(bp, " versrcreach"); 1778 break; 1779 case O_ANTISPOOF: 1780 bprintf(bp, " antispoof"); 1781 break; 1782 case O_IPSEC: 1783 bprintf(bp, " ipsec"); 1784 break; 1785 case O_NOP: 1786 bprintf(bp, " // %s", (const char *)(cmd + 1)); 1787 break; 1788 case O_KEEP_STATE: 1789 if (state->flags & HAVE_PROBE_STATE) 1790 bprintf(bp, " keep-state"); 1791 else 1792 bprintf(bp, " record-state"); 1793 bprintf(bp, " :%s", 1794 object_search_ctlv(fo->tstate, cmd->arg1, 1795 IPFW_TLV_STATE_NAME)); 1796 break; 1797 case O_LIMIT: 1798 if (state->flags & HAVE_PROBE_STATE) 1799 bprintf(bp, " limit"); 1800 else 1801 bprintf(bp, " set-limit"); 1802 print_limit_mask(bp, insntod(cmd, limit)); 1803 bprintf(bp, " :%s", 1804 object_search_ctlv(fo->tstate, cmd->arg1, 1805 IPFW_TLV_STATE_NAME)); 1806 break; 1807 case O_IP6: 1808 if (state->flags & HAVE_PROTO) 1809 bprintf(bp, " proto"); 1810 bprintf(bp, " ip6"); 1811 break; 1812 case O_IP4: 1813 if (state->flags & HAVE_PROTO) 1814 bprintf(bp, " proto"); 1815 bprintf(bp, " ip4"); 1816 break; 1817 case O_ICMP6TYPE: 1818 print_icmp6types(bp, insntod(cmd, u32)); 1819 break; 1820 case O_EXT_HDR: 1821 print_ext6hdr(bp, cmd); 1822 break; 1823 case O_TAGGED: 1824 if (F_LEN(cmd) == 1) 1825 bprint_uint_arg(bp, " tagged ", cmd->arg1); 1826 else 1827 print_newports(bp, insntod(cmd, u16), 1828 0, O_TAGGED); 1829 break; 1830 case O_SKIP_ACTION: 1831 bprintf(bp, " defer-immediate-action"); 1832 break; 1833 case O_MARK: 1834 bprintf(bp, " mark"); 1835 if (cmd->arg1 == IP_FW_TARG) 1836 bprintf(bp, " tablearg"); 1837 else 1838 bprintf(bp, " %#x", 1839 ((const ipfw_insn_u32 *)cmd)->d[0]); 1840 1841 if (((const ipfw_insn_u32 *)cmd)->d[1] != 0xFFFFFFFF) 1842 bprintf(bp, ":%#x", 1843 ((const ipfw_insn_u32 *)cmd)->d[1]); 1844 break; 1845 1846 default: 1847 bprintf(bp, " [opcode %d len %d]", cmd->opcode, 1848 cmd->len); 1849 } 1850 if (cmd->len & F_OR) { 1851 bprintf(bp, " or"); 1852 state->or_block = 1; 1853 } else if (state->or_block != 0) { 1854 bprintf(bp, " }"); 1855 state->or_block = 0; 1856 } 1857 mark_printed(state, cmd); 1858 1859 return (1); 1860 } 1861 1862 static ipfw_insn * 1863 print_opcode(struct buf_pr *bp, struct format_opts *fo, 1864 struct show_state *state, int opcode) 1865 { 1866 ipfw_insn *cmd; 1867 int l; 1868 1869 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 1870 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 1871 /* We use zero opcode to print the rest of options */ 1872 if (opcode >= 0 && cmd->opcode != opcode) 1873 continue; 1874 /* 1875 * Skip O_NOP, when we printing the rest 1876 * of options, it will be handled separately. 1877 */ 1878 if (cmd->opcode == O_NOP && opcode != O_NOP) 1879 continue; 1880 if (!print_instruction(bp, fo, state, cmd)) 1881 continue; 1882 return (cmd); 1883 } 1884 return (NULL); 1885 } 1886 1887 static void 1888 print_fwd(struct buf_pr *bp, const ipfw_insn *cmd) 1889 { 1890 char buf[INET6_ADDRSTRLEN + IF_NAMESIZE + 2]; 1891 const ipfw_insn_sa6 *sa6; 1892 const ipfw_insn_sa *sa; 1893 uint16_t port; 1894 1895 if (cmd->opcode == O_FORWARD_IP) { 1896 sa = insntod(cmd, sa); 1897 port = sa->sa.sin_port; 1898 if (sa->sa.sin_addr.s_addr == INADDR_ANY) 1899 bprintf(bp, "fwd tablearg"); 1900 else 1901 bprintf(bp, "fwd %s", inet_ntoa(sa->sa.sin_addr)); 1902 } else { 1903 sa6 = insntod(cmd, sa6); 1904 port = sa6->sa.sin6_port; 1905 bprintf(bp, "fwd "); 1906 if (getnameinfo((const struct sockaddr *)&sa6->sa, 1907 sizeof(struct sockaddr_in6), buf, sizeof(buf), NULL, 0, 1908 NI_NUMERICHOST) == 0) 1909 bprintf(bp, "%s", buf); 1910 } 1911 if (port != 0) 1912 bprintf(bp, ",%u", port); 1913 } 1914 1915 static int 1916 print_action_instruction(struct buf_pr *bp, const struct format_opts *fo, 1917 struct show_state *state, const ipfw_insn *cmd) 1918 { 1919 const char *s; 1920 1921 if (is_printed_opcode(state, cmd)) 1922 return (0); 1923 switch (cmd->opcode) { 1924 case O_CHECK_STATE: 1925 bprintf(bp, "check-state"); 1926 if (cmd->arg1 != 0) 1927 s = object_search_ctlv(fo->tstate, cmd->arg1, 1928 IPFW_TLV_STATE_NAME); 1929 else 1930 s = NULL; 1931 bprintf(bp, " :%s", s ? s: "any"); 1932 break; 1933 case O_ACCEPT: 1934 bprintf(bp, "allow"); 1935 break; 1936 case O_COUNT: 1937 bprintf(bp, "count"); 1938 break; 1939 case O_DENY: 1940 bprintf(bp, "deny"); 1941 break; 1942 case O_REJECT: 1943 if (cmd->arg1 == ICMP_REJECT_RST) 1944 bprintf(bp, "reset"); 1945 else if (cmd->arg1 == ICMP_REJECT_ABORT) 1946 bprintf(bp, "abort"); 1947 else if (cmd->arg1 == ICMP_UNREACH_HOST) 1948 bprintf(bp, "reject"); 1949 else if (cmd->arg1 == ICMP_UNREACH_NEEDFRAG && 1950 cmd->len == F_INSN_SIZE(ipfw_insn_u16)) 1951 bprintf(bp, "needfrag %u", 1952 ((const ipfw_insn_u16 *)cmd)->ports[0]); 1953 else 1954 print_reject_code(bp, cmd->arg1); 1955 break; 1956 case O_UNREACH6: 1957 if (cmd->arg1 == ICMP6_UNREACH_RST) 1958 bprintf(bp, "reset6"); 1959 else if (cmd->arg1 == ICMP6_UNREACH_ABORT) 1960 bprintf(bp, "abort6"); 1961 else 1962 print_unreach6_code(bp, cmd->arg1); 1963 break; 1964 case O_SKIPTO: 1965 bprint_uint_arg(bp, "skipto ", cmd->arg1); 1966 break; 1967 case O_PIPE: 1968 bprint_uint_arg(bp, "pipe ", cmd->arg1); 1969 break; 1970 case O_QUEUE: 1971 bprint_uint_arg(bp, "queue ", cmd->arg1); 1972 break; 1973 case O_DIVERT: 1974 bprint_uint_arg(bp, "divert ", cmd->arg1); 1975 break; 1976 case O_TEE: 1977 bprint_uint_arg(bp, "tee ", cmd->arg1); 1978 break; 1979 case O_NETGRAPH: 1980 bprint_uint_arg(bp, "netgraph ", cmd->arg1); 1981 break; 1982 case O_NGTEE: 1983 bprint_uint_arg(bp, "ngtee ", cmd->arg1); 1984 break; 1985 case O_FORWARD_IP: 1986 case O_FORWARD_IP6: 1987 print_fwd(bp, cmd); 1988 break; 1989 case O_LOG: 1990 if (insntod(cmd, log)->max_log > 0) 1991 bprintf(bp, " log logamount %d", 1992 insntod(cmd, log)->max_log); 1993 else 1994 bprintf(bp, " log"); 1995 break; 1996 case O_ALTQ: 1997 #ifndef NO_ALTQ 1998 print_altq_cmd(bp, insntod(cmd, altq)); 1999 #endif 2000 break; 2001 case O_TAG: 2002 bprint_uint_arg(bp, cmd->len & F_NOT ? " untag ": 2003 " tag ", cmd->arg1); 2004 break; 2005 case O_NAT: 2006 if (cmd->arg1 != IP_FW_NAT44_GLOBAL) 2007 bprint_uint_arg(bp, "nat ", cmd->arg1); 2008 else 2009 bprintf(bp, "nat global"); 2010 break; 2011 case O_SETFIB: 2012 if (cmd->arg1 == IP_FW_TARG) 2013 bprint_uint_arg(bp, "setfib ", cmd->arg1); 2014 else 2015 bprintf(bp, "setfib %u", cmd->arg1 & 0x7FFF); 2016 break; 2017 case O_EXTERNAL_ACTION: 2018 /* 2019 * The external action can consists of two following 2020 * each other opcodes - O_EXTERNAL_ACTION and 2021 * O_EXTERNAL_INSTANCE. The first contains the ID of 2022 * name of external action. The second contains the ID 2023 * of name of external action instance. 2024 * NOTE: in case when external action has no named 2025 * instances support, the second opcode isn't needed. 2026 */ 2027 state->eaction = cmd; 2028 s = object_search_ctlv(fo->tstate, cmd->arg1, 2029 IPFW_TLV_EACTION); 2030 if (match_token(rule_eactions, s) != -1) 2031 bprintf(bp, "%s", s); 2032 else 2033 bprintf(bp, "eaction %s", s); 2034 break; 2035 case O_EXTERNAL_INSTANCE: 2036 if (state->eaction == NULL) 2037 break; 2038 /* 2039 * XXX: we need to teach ipfw(9) to rewrite opcodes 2040 * in the user buffer on rule addition. When we add 2041 * the rule, we specify zero TLV type for 2042 * O_EXTERNAL_INSTANCE object. To show correct 2043 * rule after `ipfw add` we need to search instance 2044 * name with zero type. But when we do `ipfw show` 2045 * we calculate TLV type using IPFW_TLV_EACTION_NAME() 2046 * macro. 2047 */ 2048 s = object_search_ctlv(fo->tstate, cmd->arg1, 0); 2049 if (s == NULL) 2050 s = object_search_ctlv(fo->tstate, 2051 cmd->arg1, IPFW_TLV_EACTION_NAME( 2052 state->eaction->arg1)); 2053 bprintf(bp, " %s", s); 2054 break; 2055 case O_EXTERNAL_DATA: 2056 if (state->eaction == NULL) 2057 break; 2058 /* 2059 * Currently we support data formatting only for 2060 * external data with datalen u16. For unknown data 2061 * print its size in bytes. 2062 */ 2063 if (cmd->len == F_INSN_SIZE(ipfw_insn)) 2064 bprintf(bp, " %u", cmd->arg1); 2065 else 2066 bprintf(bp, " %ubytes", 2067 cmd->len * sizeof(uint32_t)); 2068 break; 2069 case O_SETDSCP: 2070 if (cmd->arg1 == IP_FW_TARG) { 2071 bprintf(bp, "setdscp tablearg"); 2072 break; 2073 } 2074 s = match_value(f_ipdscp, cmd->arg1 & 0x3F); 2075 if (s != NULL) 2076 bprintf(bp, "setdscp %s", s); 2077 else 2078 bprintf(bp, "setdscp %u", cmd->arg1 & 0x3F); 2079 break; 2080 case O_REASS: 2081 bprintf(bp, "reass"); 2082 break; 2083 case O_CALLRETURN: 2084 if (cmd->len & F_NOT) 2085 bprintf(bp, "return"); 2086 else 2087 bprint_uint_arg(bp, "call ", cmd->arg1); 2088 break; 2089 case O_SETMARK: 2090 if (cmd->arg1 == IP_FW_TARG) { 2091 bprintf(bp, "setmark tablearg"); 2092 break; 2093 } 2094 bprintf(bp, "setmark %#x", ((const ipfw_insn_u32 *)cmd)->d[0]); 2095 break; 2096 default: 2097 bprintf(bp, "** unrecognized action %d len %d ", 2098 cmd->opcode, cmd->len); 2099 } 2100 mark_printed(state, cmd); 2101 2102 return (1); 2103 } 2104 2105 2106 static ipfw_insn * 2107 print_action(struct buf_pr *bp, struct format_opts *fo, 2108 struct show_state *state, uint8_t opcode) 2109 { 2110 ipfw_insn *cmd; 2111 int l; 2112 2113 for (l = state->rule->cmd_len - state->rule->act_ofs, 2114 cmd = ACTION_PTR(state->rule); l > 0; 2115 l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2116 if (cmd->opcode != opcode) 2117 continue; 2118 if (!print_action_instruction(bp, fo, state, cmd)) 2119 continue; 2120 return (cmd); 2121 } 2122 return (NULL); 2123 } 2124 2125 static void 2126 print_proto(struct buf_pr *bp, struct format_opts *fo, 2127 struct show_state *state) 2128 { 2129 ipfw_insn *cmd; 2130 int l, proto, ip4, ip6; 2131 2132 /* Count all O_PROTO, O_IP4, O_IP6 instructions. */ 2133 proto = ip4 = ip6 = 0; 2134 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 2135 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2136 switch (cmd->opcode) { 2137 case O_PROTO: 2138 proto++; 2139 break; 2140 case O_IP4: 2141 ip4 = 1; 2142 if (cmd->len & F_OR) 2143 ip4++; 2144 break; 2145 case O_IP6: 2146 ip6 = 1; 2147 if (cmd->len & F_OR) 2148 ip6++; 2149 break; 2150 default: 2151 continue; 2152 } 2153 } 2154 if (proto == 0 && ip4 == 0 && ip6 == 0) { 2155 state->proto = IPPROTO_IP; 2156 state->flags |= HAVE_PROTO; 2157 bprintf(bp, " ip"); 2158 return; 2159 } 2160 /* To handle the case { ip4 or ip6 }, print opcode with F_OR first */ 2161 cmd = NULL; 2162 if (ip4 || ip6) 2163 cmd = print_opcode(bp, fo, state, ip4 > ip6 ? O_IP4: O_IP6); 2164 if (cmd != NULL && (cmd->len & F_OR)) 2165 cmd = print_opcode(bp, fo, state, ip4 > ip6 ? O_IP6: O_IP4); 2166 if (cmd == NULL || (cmd->len & F_OR)) 2167 for (l = proto; l > 0; l--) { 2168 cmd = print_opcode(bp, fo, state, O_PROTO); 2169 if (cmd == NULL || (cmd->len & F_OR) == 0) 2170 break; 2171 } 2172 /* Initialize proto, it is used by print_newports() */ 2173 state->flags |= HAVE_PROTO; 2174 if (state->proto == 0 && ip6 != 0) 2175 state->proto = IPPROTO_IPV6; 2176 } 2177 2178 static int 2179 match_opcode(int opcode, const int opcodes[], size_t nops) 2180 { 2181 size_t i; 2182 2183 for (i = 0; i < nops; i++) 2184 if (opcode == opcodes[i]) 2185 return (1); 2186 return (0); 2187 } 2188 2189 static void 2190 print_address(struct buf_pr *bp, struct format_opts *fo, 2191 struct show_state *state, const int opcodes[], size_t nops, int portop, 2192 int flag) 2193 { 2194 ipfw_insn *cmd; 2195 int count, l, portcnt, pf; 2196 2197 count = portcnt = 0; 2198 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 2199 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2200 if (match_opcode(cmd->opcode, opcodes, nops)) 2201 count++; 2202 else if (cmd->opcode == portop) 2203 portcnt++; 2204 } 2205 if (count == 0) 2206 bprintf(bp, " any"); 2207 for (l = state->rule->act_ofs, cmd = state->rule->cmd; 2208 l > 0 && count > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2209 if (!match_opcode(cmd->opcode, opcodes, nops)) 2210 continue; 2211 print_instruction(bp, fo, state, cmd); 2212 if ((cmd->len & F_OR) == 0) 2213 break; 2214 count--; 2215 } 2216 /* 2217 * If several O_IP_?PORT opcodes specified, leave them to the 2218 * options section. 2219 */ 2220 if (portcnt == 1) { 2221 for (l = state->rule->act_ofs, cmd = state->rule->cmd, pf = 0; 2222 l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) { 2223 if (cmd->opcode != portop) { 2224 pf = (cmd->len & F_OR); 2225 continue; 2226 } 2227 /* Print opcode iff it is not in OR block. */ 2228 if (pf == 0 && (cmd->len & F_OR) == 0) 2229 print_instruction(bp, fo, state, cmd); 2230 break; 2231 } 2232 } 2233 state->flags |= flag; 2234 } 2235 2236 static const int action_opcodes[] = { 2237 O_CHECK_STATE, O_ACCEPT, O_COUNT, O_DENY, O_REJECT, 2238 O_UNREACH6, O_SKIPTO, O_PIPE, O_QUEUE, O_DIVERT, O_TEE, 2239 O_NETGRAPH, O_NGTEE, O_FORWARD_IP, O_FORWARD_IP6, O_NAT, 2240 O_SETFIB, O_SETDSCP, O_REASS, O_CALLRETURN, O_SETMARK, 2241 /* keep the following opcodes at the end of the list */ 2242 O_EXTERNAL_ACTION, O_EXTERNAL_INSTANCE, O_EXTERNAL_DATA 2243 }; 2244 2245 static const int modifier_opcodes[] = { 2246 O_LOG, O_ALTQ, O_TAG 2247 }; 2248 2249 static const int src_opcodes[] = { 2250 O_IP_SRC, O_IP_SRC_LOOKUP, O_IP_SRC_MASK, O_IP_SRC_ME, 2251 O_IP_SRC_SET, O_IP6_SRC, O_IP6_SRC_MASK, O_IP6_SRC_ME 2252 }; 2253 2254 static const int dst_opcodes[] = { 2255 O_IP_DST, O_IP_DST_LOOKUP, O_IP_DST_MASK, O_IP_DST_ME, 2256 O_IP_DST_SET, O_IP6_DST, O_IP6_DST_MASK, O_IP6_DST_ME 2257 }; 2258 2259 static void 2260 show_static_rule(struct cmdline_opts *co, struct format_opts *fo, 2261 struct buf_pr *bp, struct ip_fw_rule *rule, struct ip_fw_bcounter *cntr) 2262 { 2263 static int twidth = 0; 2264 struct show_state state; 2265 ipfw_insn *cmd; 2266 size_t i; 2267 2268 /* Print # DISABLED or skip the rule */ 2269 if ((fo->set_mask & (1 << rule->set)) == 0) { 2270 /* disabled mask */ 2271 if (!co->show_sets) 2272 return; 2273 else 2274 bprintf(bp, "# DISABLED "); 2275 } 2276 if (init_show_state(&state, rule) != 0) { 2277 warn("init_show_state() failed"); 2278 return; 2279 } 2280 bprintf(bp, "%05u ", rule->rulenum); 2281 2282 /* only if counters are available */ 2283 if (cntr != NULL) { 2284 /* Print counters if enabled */ 2285 if (fo->pcwidth > 0 || fo->bcwidth > 0) { 2286 pr_u64(bp, &cntr->pcnt, fo->pcwidth); 2287 pr_u64(bp, &cntr->bcnt, fo->bcwidth); 2288 } 2289 2290 /* Print timestamp */ 2291 if (co->do_time == TIMESTAMP_NUMERIC) 2292 bprintf(bp, "%10u ", cntr->timestamp); 2293 else if (co->do_time == TIMESTAMP_STRING) { 2294 char timestr[30]; 2295 time_t t = (time_t)0; 2296 2297 if (twidth == 0) { 2298 strcpy(timestr, ctime(&t)); 2299 *strchr(timestr, '\n') = '\0'; 2300 twidth = strlen(timestr); 2301 } 2302 if (cntr->timestamp > 0) { 2303 t = _long_to_time(cntr->timestamp); 2304 2305 strcpy(timestr, ctime(&t)); 2306 *strchr(timestr, '\n') = '\0'; 2307 bprintf(bp, "%s ", timestr); 2308 } else { 2309 bprintf(bp, "%*s ", twidth, ""); 2310 } 2311 } 2312 } 2313 2314 /* Print set number */ 2315 if (co->show_sets) 2316 bprintf(bp, "set %d ", rule->set); 2317 2318 /* Print the optional "match probability" */ 2319 cmd = print_opcode(bp, fo, &state, O_PROB); 2320 /* Print rule action */ 2321 for (i = 0; i < nitems(action_opcodes); i++) { 2322 cmd = print_action(bp, fo, &state, action_opcodes[i]); 2323 if (cmd == NULL) 2324 continue; 2325 /* Handle special cases */ 2326 switch (cmd->opcode) { 2327 case O_CHECK_STATE: 2328 goto end; 2329 case O_EXTERNAL_ACTION: 2330 case O_EXTERNAL_INSTANCE: 2331 /* External action can have several instructions */ 2332 continue; 2333 } 2334 break; 2335 } 2336 /* Print rule modifiers */ 2337 for (i = 0; i < nitems(modifier_opcodes); i++) 2338 print_action(bp, fo, &state, modifier_opcodes[i]); 2339 /* 2340 * Print rule body 2341 */ 2342 if (co->comment_only != 0) 2343 goto end; 2344 2345 if (rule->flags & IPFW_RULE_JUSTOPTS) { 2346 state.flags |= HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP; 2347 goto justopts; 2348 } 2349 2350 print_proto(bp, fo, &state); 2351 if (co->do_compact != 0 && (rule->flags & IPFW_RULE_NOOPT)) 2352 goto justopts; 2353 2354 /* Print source */ 2355 bprintf(bp, " from"); 2356 print_address(bp, fo, &state, src_opcodes, nitems(src_opcodes), 2357 O_IP_SRCPORT, HAVE_SRCIP); 2358 2359 /* Print destination */ 2360 bprintf(bp, " to"); 2361 print_address(bp, fo, &state, dst_opcodes, nitems(dst_opcodes), 2362 O_IP_DSTPORT, HAVE_DSTIP); 2363 2364 justopts: 2365 /* Print the rest of options */ 2366 while (print_opcode(bp, fo, &state, -1)) 2367 ; 2368 end: 2369 /* Print comment at the end */ 2370 cmd = print_opcode(bp, fo, &state, O_NOP); 2371 if (co->comment_only != 0 && cmd == NULL) 2372 bprintf(bp, " // ..."); 2373 bprintf(bp, "\n"); 2374 free_show_state(&state); 2375 } 2376 2377 static void 2378 show_dyn_state(struct cmdline_opts *co, struct format_opts *fo, 2379 struct buf_pr *bp, ipfw_dyn_rule *d) 2380 { 2381 struct protoent *pe; 2382 struct in_addr a; 2383 uint16_t rulenum; 2384 char buf[INET6_ADDRSTRLEN]; 2385 2386 if (d->expire == 0 && d->dyn_type != O_LIMIT_PARENT) 2387 return; 2388 2389 bcopy(&d->rule, &rulenum, sizeof(rulenum)); 2390 bprintf(bp, "%05d", rulenum); 2391 if (fo->pcwidth > 0 || fo->bcwidth > 0) { 2392 bprintf(bp, " "); 2393 pr_u64(bp, &d->pcnt, fo->pcwidth); 2394 pr_u64(bp, &d->bcnt, fo->bcwidth); 2395 bprintf(bp, "(%ds)", d->expire); 2396 } 2397 switch (d->dyn_type) { 2398 case O_LIMIT_PARENT: 2399 bprintf(bp, " PARENT %d", d->count); 2400 break; 2401 case O_LIMIT: 2402 bprintf(bp, " LIMIT"); 2403 break; 2404 case O_KEEP_STATE: /* bidir, no mask */ 2405 bprintf(bp, " STATE"); 2406 break; 2407 } 2408 2409 if ((pe = getprotobynumber(d->id.proto)) != NULL) 2410 bprintf(bp, " %s", pe->p_name); 2411 else 2412 bprintf(bp, " proto %u", d->id.proto); 2413 2414 if (d->id.addr_type == 4) { 2415 a.s_addr = htonl(d->id.src_ip); 2416 bprintf(bp, " %s %d", inet_ntoa(a), d->id.src_port); 2417 2418 a.s_addr = htonl(d->id.dst_ip); 2419 bprintf(bp, " <-> %s %d", inet_ntoa(a), d->id.dst_port); 2420 } else if (d->id.addr_type == 6) { 2421 bprintf(bp, " %s %d", inet_ntop(AF_INET6, &d->id.src_ip6, buf, 2422 sizeof(buf)), d->id.src_port); 2423 bprintf(bp, " <-> %s %d", inet_ntop(AF_INET6, &d->id.dst_ip6, 2424 buf, sizeof(buf)), d->id.dst_port); 2425 } else 2426 bprintf(bp, " UNKNOWN <-> UNKNOWN"); 2427 if (d->kidx != 0) 2428 bprintf(bp, " :%s", object_search_ctlv(fo->tstate, 2429 d->kidx, IPFW_TLV_STATE_NAME)); 2430 2431 #define BOTH_SYN (TH_SYN | (TH_SYN << 8)) 2432 #define BOTH_FIN (TH_FIN | (TH_FIN << 8)) 2433 if (co->verbose) { 2434 bprintf(bp, " state 0x%08x%s", d->state, 2435 d->state ? " ": ","); 2436 if (d->state & IPFW_DYN_ORPHANED) 2437 bprintf(bp, "ORPHANED,"); 2438 if ((d->state & BOTH_SYN) == BOTH_SYN) 2439 bprintf(bp, "BOTH_SYN,"); 2440 else { 2441 if (d->state & TH_SYN) 2442 bprintf(bp, "F_SYN,"); 2443 if (d->state & (TH_SYN << 8)) 2444 bprintf(bp, "R_SYN,"); 2445 } 2446 if ((d->state & BOTH_FIN) == BOTH_FIN) 2447 bprintf(bp, "BOTH_FIN,"); 2448 else { 2449 if (d->state & TH_FIN) 2450 bprintf(bp, "F_FIN,"); 2451 if (d->state & (TH_FIN << 8)) 2452 bprintf(bp, "R_FIN,"); 2453 } 2454 bprintf(bp, " f_ack 0x%x, r_ack 0x%x", d->ack_fwd, 2455 d->ack_rev); 2456 } 2457 } 2458 2459 static int 2460 do_range_cmd(int cmd, ipfw_range_tlv *rt) 2461 { 2462 ipfw_range_header rh; 2463 size_t sz; 2464 2465 memset(&rh, 0, sizeof(rh)); 2466 memcpy(&rh.range, rt, sizeof(*rt)); 2467 rh.range.head.length = sizeof(*rt); 2468 rh.range.head.type = IPFW_TLV_RANGE; 2469 sz = sizeof(rh); 2470 2471 if (do_get3(cmd, &rh.opheader, &sz) != 0) 2472 return (-1); 2473 /* Save number of matched objects */ 2474 rt->new_set = rh.range.new_set; 2475 return (0); 2476 } 2477 2478 /* 2479 * This one handles all set-related commands 2480 * ipfw set { show | enable | disable } 2481 * ipfw set swap X Y 2482 * ipfw set move X to Y 2483 * ipfw set move rule X to Y 2484 */ 2485 void 2486 ipfw_sets_handler(char *av[]) 2487 { 2488 ipfw_range_tlv rt; 2489 const char *msg; 2490 size_t size; 2491 uint32_t masks[2]; 2492 int i; 2493 uint16_t rulenum; 2494 uint8_t cmd; 2495 2496 av++; 2497 memset(&rt, 0, sizeof(rt)); 2498 2499 if (av[0] == NULL) 2500 errx(EX_USAGE, "set needs command"); 2501 if (_substrcmp(*av, "show") == 0) { 2502 struct format_opts fo; 2503 ipfw_cfg_lheader *cfg; 2504 2505 memset(&fo, 0, sizeof(fo)); 2506 if (ipfw_get_config(&g_co, &fo, &cfg, &size) != 0) 2507 err(EX_OSERR, "requesting config failed"); 2508 2509 for (i = 0, msg = "disable"; i < RESVD_SET; i++) 2510 if ((cfg->set_mask & (1<<i)) == 0) { 2511 printf("%s %d", msg, i); 2512 msg = ""; 2513 } 2514 msg = (cfg->set_mask != (uint32_t)-1) ? " enable" : "enable"; 2515 for (i = 0; i < RESVD_SET; i++) 2516 if ((cfg->set_mask & (1<<i)) != 0) { 2517 printf("%s %d", msg, i); 2518 msg = ""; 2519 } 2520 printf("\n"); 2521 free(cfg); 2522 } else if (_substrcmp(*av, "swap") == 0) { 2523 av++; 2524 if ( av[0] == NULL || av[1] == NULL ) 2525 errx(EX_USAGE, "set swap needs 2 set numbers\n"); 2526 rt.set = atoi(av[0]); 2527 rt.new_set = atoi(av[1]); 2528 if (!isdigit(*(av[0])) || rt.set > RESVD_SET) 2529 errx(EX_DATAERR, "invalid set number %s\n", av[0]); 2530 if (!isdigit(*(av[1])) || rt.new_set > RESVD_SET) 2531 errx(EX_DATAERR, "invalid set number %s\n", av[1]); 2532 i = do_range_cmd(IP_FW_SET_SWAP, &rt); 2533 } else if (_substrcmp(*av, "move") == 0) { 2534 av++; 2535 if (av[0] && _substrcmp(*av, "rule") == 0) { 2536 rt.flags = IPFW_RCFLAG_RANGE; /* move rules to new set */ 2537 cmd = IP_FW_XMOVE; 2538 av++; 2539 } else 2540 cmd = IP_FW_SET_MOVE; /* Move set to new one */ 2541 if (av[0] == NULL || av[1] == NULL || av[2] == NULL || 2542 av[3] != NULL || _substrcmp(av[1], "to") != 0) 2543 errx(EX_USAGE, "syntax: set move [rule] X to Y\n"); 2544 rulenum = atoi(av[0]); 2545 rt.new_set = atoi(av[2]); 2546 if (cmd == IP_FW_XMOVE) { 2547 rt.start_rule = rulenum; 2548 rt.end_rule = rulenum; 2549 } else 2550 rt.set = rulenum; 2551 rt.new_set = atoi(av[2]); 2552 if (!isdigit(*(av[0])) || (cmd == 3 && rt.set > RESVD_SET) || 2553 (cmd == 2 && rt.start_rule == IPFW_DEFAULT_RULE) ) 2554 errx(EX_DATAERR, "invalid source number %s\n", av[0]); 2555 if (!isdigit(*(av[2])) || rt.new_set > RESVD_SET) 2556 errx(EX_DATAERR, "invalid dest. set %s\n", av[1]); 2557 i = do_range_cmd(cmd, &rt); 2558 if (i < 0) 2559 err(EX_OSERR, "failed to move %s", 2560 cmd == IP_FW_SET_MOVE ? "set": "rule"); 2561 } else if (_substrcmp(*av, "disable") == 0 || 2562 _substrcmp(*av, "enable") == 0 ) { 2563 int which = _substrcmp(*av, "enable") == 0 ? 1 : 0; 2564 2565 av++; 2566 masks[0] = masks[1] = 0; 2567 2568 while (av[0]) { 2569 if (isdigit(**av)) { 2570 i = atoi(*av); 2571 if (i < 0 || i > RESVD_SET) 2572 errx(EX_DATAERR, 2573 "invalid set number %d\n", i); 2574 masks[which] |= (1<<i); 2575 } else if (_substrcmp(*av, "disable") == 0) 2576 which = 0; 2577 else if (_substrcmp(*av, "enable") == 0) 2578 which = 1; 2579 else 2580 errx(EX_DATAERR, 2581 "invalid set command %s\n", *av); 2582 av++; 2583 } 2584 if ( (masks[0] & masks[1]) != 0 ) 2585 errx(EX_DATAERR, 2586 "cannot enable and disable the same set\n"); 2587 2588 rt.set = masks[0]; 2589 rt.new_set = masks[1]; 2590 i = do_range_cmd(IP_FW_SET_ENABLE, &rt); 2591 if (i) 2592 warn("set enable/disable: setsockopt(IP_FW_SET_ENABLE)"); 2593 } else 2594 errx(EX_USAGE, "invalid set command %s\n", *av); 2595 } 2596 2597 void 2598 ipfw_sysctl_handler(char *av[], int which) 2599 { 2600 av++; 2601 2602 if (av[0] == NULL) { 2603 warnx("missing keyword to enable/disable\n"); 2604 } else if (_substrcmp(*av, "firewall") == 0) { 2605 sysctlbyname("net.inet.ip.fw.enable", NULL, 0, 2606 &which, sizeof(which)); 2607 sysctlbyname("net.inet6.ip6.fw.enable", NULL, 0, 2608 &which, sizeof(which)); 2609 } else if (_substrcmp(*av, "one_pass") == 0) { 2610 sysctlbyname("net.inet.ip.fw.one_pass", NULL, 0, 2611 &which, sizeof(which)); 2612 } else if (_substrcmp(*av, "debug") == 0) { 2613 sysctlbyname("net.inet.ip.fw.debug", NULL, 0, 2614 &which, sizeof(which)); 2615 } else if (_substrcmp(*av, "verbose") == 0) { 2616 sysctlbyname("net.inet.ip.fw.verbose", NULL, 0, 2617 &which, sizeof(which)); 2618 } else if (_substrcmp(*av, "dyn_keepalive") == 0) { 2619 sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0, 2620 &which, sizeof(which)); 2621 #ifndef NO_ALTQ 2622 } else if (_substrcmp(*av, "altq") == 0) { 2623 altq_set_enabled(which); 2624 #endif 2625 } else { 2626 warnx("unrecognize enable/disable keyword: %s\n", *av); 2627 } 2628 } 2629 2630 typedef void state_cb(struct cmdline_opts *co, struct format_opts *fo, 2631 void *arg, void *state); 2632 2633 static void 2634 prepare_format_dyn(struct cmdline_opts *co, struct format_opts *fo, 2635 void *arg __unused, void *_state) 2636 { 2637 ipfw_dyn_rule *d; 2638 int width; 2639 uint8_t set; 2640 2641 d = (ipfw_dyn_rule *)_state; 2642 /* Count _ALL_ states */ 2643 fo->dcnt++; 2644 2645 if (fo->show_counters == 0) 2646 return; 2647 2648 if (co->use_set) { 2649 /* skip states from another set */ 2650 bcopy((char *)&d->rule + sizeof(uint16_t), &set, 2651 sizeof(uint8_t)); 2652 if (set != co->use_set - 1) 2653 return; 2654 } 2655 2656 width = pr_u64(NULL, &d->pcnt, 0); 2657 if (width > fo->pcwidth) 2658 fo->pcwidth = width; 2659 2660 width = pr_u64(NULL, &d->bcnt, 0); 2661 if (width > fo->bcwidth) 2662 fo->bcwidth = width; 2663 } 2664 2665 static int 2666 foreach_state(struct cmdline_opts *co, struct format_opts *fo, 2667 caddr_t base, size_t sz, state_cb dyn_bc, void *dyn_arg) 2668 { 2669 int ttype; 2670 state_cb *fptr; 2671 void *farg; 2672 ipfw_obj_tlv *tlv; 2673 ipfw_obj_ctlv *ctlv; 2674 2675 fptr = NULL; 2676 ttype = 0; 2677 2678 while (sz > 0) { 2679 ctlv = (ipfw_obj_ctlv *)base; 2680 switch (ctlv->head.type) { 2681 case IPFW_TLV_DYNSTATE_LIST: 2682 base += sizeof(*ctlv); 2683 sz -= sizeof(*ctlv); 2684 ttype = IPFW_TLV_DYN_ENT; 2685 fptr = dyn_bc; 2686 farg = dyn_arg; 2687 break; 2688 default: 2689 return (sz); 2690 } 2691 2692 while (sz > 0) { 2693 tlv = (ipfw_obj_tlv *)base; 2694 if (tlv->type != ttype) 2695 break; 2696 2697 fptr(co, fo, farg, tlv + 1); 2698 sz -= tlv->length; 2699 base += tlv->length; 2700 } 2701 } 2702 2703 return (sz); 2704 } 2705 2706 static void 2707 prepare_format_opts(struct cmdline_opts *co, struct format_opts *fo, 2708 ipfw_obj_tlv *rtlv, int rcnt, caddr_t dynbase, size_t dynsz) 2709 { 2710 int bcwidth, pcwidth, width; 2711 int n; 2712 struct ip_fw_bcounter *cntr; 2713 struct ip_fw_rule *r; 2714 2715 bcwidth = 0; 2716 pcwidth = 0; 2717 if (fo->show_counters != 0) { 2718 for (n = 0; n < rcnt; n++, 2719 rtlv = (ipfw_obj_tlv *)((caddr_t)rtlv + rtlv->length)) { 2720 cntr = (struct ip_fw_bcounter *)(rtlv + 1); 2721 r = (struct ip_fw_rule *)((caddr_t)cntr + cntr->size); 2722 /* skip rules from another set */ 2723 if (co->use_set && r->set != co->use_set - 1) 2724 continue; 2725 2726 /* packet counter */ 2727 width = pr_u64(NULL, &cntr->pcnt, 0); 2728 if (width > pcwidth) 2729 pcwidth = width; 2730 2731 /* byte counter */ 2732 width = pr_u64(NULL, &cntr->bcnt, 0); 2733 if (width > bcwidth) 2734 bcwidth = width; 2735 } 2736 } 2737 fo->bcwidth = bcwidth; 2738 fo->pcwidth = pcwidth; 2739 2740 fo->dcnt = 0; 2741 if (co->do_dynamic && dynsz > 0) 2742 foreach_state(co, fo, dynbase, dynsz, prepare_format_dyn, NULL); 2743 } 2744 2745 static int 2746 list_static_range(struct cmdline_opts *co, struct format_opts *fo, 2747 struct buf_pr *bp, ipfw_obj_tlv *rtlv, int rcnt) 2748 { 2749 int n, seen; 2750 struct ip_fw_rule *r; 2751 struct ip_fw_bcounter *cntr; 2752 2753 for (n = seen = 0; n < rcnt; n++, 2754 rtlv = (ipfw_obj_tlv *)((caddr_t)rtlv + rtlv->length)) { 2755 2756 if ((fo->show_counters | fo->show_time) != 0) { 2757 cntr = (struct ip_fw_bcounter *)(rtlv + 1); 2758 r = (struct ip_fw_rule *)((caddr_t)cntr + cntr->size); 2759 } else { 2760 cntr = NULL; 2761 r = (struct ip_fw_rule *)(rtlv + 1); 2762 } 2763 if (r->rulenum > fo->last) 2764 break; 2765 if (co->use_set && r->set != co->use_set - 1) 2766 continue; 2767 if (r->rulenum >= fo->first && r->rulenum <= fo->last) { 2768 show_static_rule(co, fo, bp, r, cntr); 2769 printf("%s", bp->buf); 2770 bp_flush(bp); 2771 seen++; 2772 } 2773 } 2774 2775 return (seen); 2776 } 2777 2778 static void 2779 list_dyn_state(struct cmdline_opts *co, struct format_opts *fo, 2780 void *_arg, void *_state) 2781 { 2782 uint16_t rulenum; 2783 uint8_t set; 2784 ipfw_dyn_rule *d; 2785 struct buf_pr *bp; 2786 2787 d = (ipfw_dyn_rule *)_state; 2788 bp = (struct buf_pr *)_arg; 2789 2790 bcopy(&d->rule, &rulenum, sizeof(rulenum)); 2791 if (rulenum > fo->last) 2792 return; 2793 if (co->use_set) { 2794 bcopy((char *)&d->rule + sizeof(uint16_t), 2795 &set, sizeof(uint8_t)); 2796 if (set != co->use_set - 1) 2797 return; 2798 } 2799 if (rulenum >= fo->first) { 2800 show_dyn_state(co, fo, bp, d); 2801 printf("%s\n", bp->buf); 2802 bp_flush(bp); 2803 } 2804 } 2805 2806 static int 2807 list_dyn_range(struct cmdline_opts *co, struct format_opts *fo, 2808 struct buf_pr *bp, caddr_t base, size_t sz) 2809 { 2810 2811 sz = foreach_state(co, fo, base, sz, list_dyn_state, bp); 2812 return (sz); 2813 } 2814 2815 void 2816 ipfw_list(int ac, char *av[], int show_counters) 2817 { 2818 ipfw_cfg_lheader *cfg; 2819 struct format_opts sfo; 2820 size_t sz; 2821 int error; 2822 int lac; 2823 char **lav; 2824 uint32_t rnum; 2825 char *endptr; 2826 2827 if (g_co.test_only) { 2828 fprintf(stderr, "Testing only, list disabled\n"); 2829 return; 2830 } 2831 if (g_co.do_pipe) { 2832 dummynet_list(ac, av, show_counters); 2833 return; 2834 } 2835 2836 ac--; 2837 av++; 2838 memset(&sfo, 0, sizeof(sfo)); 2839 2840 /* Determine rule range to request */ 2841 if (ac > 0) { 2842 for (lac = ac, lav = av; lac != 0; lac--) { 2843 rnum = strtoul(*lav++, &endptr, 10); 2844 if (sfo.first == 0 || rnum < sfo.first) 2845 sfo.first = rnum; 2846 2847 if (*endptr == '-') 2848 rnum = strtoul(endptr + 1, &endptr, 10); 2849 if (sfo.last == 0 || rnum > sfo.last) 2850 sfo.last = rnum; 2851 } 2852 } 2853 2854 /* get configuration from kernel */ 2855 cfg = NULL; 2856 sfo.show_counters = show_counters; 2857 sfo.show_time = g_co.do_time; 2858 if (g_co.do_dynamic != 2) 2859 sfo.flags |= IPFW_CFG_GET_STATIC; 2860 if (g_co.do_dynamic != 0) 2861 sfo.flags |= IPFW_CFG_GET_STATES; 2862 if ((sfo.show_counters | sfo.show_time) != 0) 2863 sfo.flags |= IPFW_CFG_GET_COUNTERS; 2864 if (ipfw_get_config(&g_co, &sfo, &cfg, &sz) != 0) 2865 err(EX_OSERR, "retrieving config failed"); 2866 2867 error = ipfw_show_config(&g_co, &sfo, cfg, sz, ac, av); 2868 2869 free(cfg); 2870 2871 if (error != EX_OK) 2872 exit(error); 2873 } 2874 2875 static int 2876 ipfw_show_config(struct cmdline_opts *co, struct format_opts *fo, 2877 ipfw_cfg_lheader *cfg, size_t sz, int ac, char *av[]) 2878 { 2879 caddr_t dynbase; 2880 size_t dynsz; 2881 int rcnt; 2882 int exitval = EX_OK; 2883 int lac; 2884 char **lav; 2885 char *endptr; 2886 size_t readsz; 2887 struct buf_pr bp; 2888 ipfw_obj_ctlv *ctlv; 2889 ipfw_obj_tlv *rbase; 2890 2891 /* 2892 * Handle tablenames TLV first, if any 2893 */ 2894 rbase = NULL; 2895 dynbase = NULL; 2896 dynsz = 0; 2897 readsz = sizeof(*cfg); 2898 rcnt = 0; 2899 2900 fo->set_mask = cfg->set_mask; 2901 2902 ctlv = (ipfw_obj_ctlv *)(cfg + 1); 2903 if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) { 2904 object_sort_ctlv(ctlv); 2905 fo->tstate = ctlv; 2906 readsz += ctlv->head.length; 2907 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length); 2908 } 2909 2910 if (cfg->flags & IPFW_CFG_GET_STATIC) { 2911 /* We've requested static rules */ 2912 if (ctlv->head.type == IPFW_TLV_RULE_LIST) { 2913 rbase = (ipfw_obj_tlv *)(ctlv + 1); 2914 rcnt = ctlv->count; 2915 readsz += ctlv->head.length; 2916 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + 2917 ctlv->head.length); 2918 } 2919 } 2920 2921 if ((cfg->flags & IPFW_CFG_GET_STATES) && (readsz != sz)) { 2922 /* We may have some dynamic states */ 2923 dynsz = sz - readsz; 2924 /* Skip empty header */ 2925 if (dynsz != sizeof(ipfw_obj_ctlv)) 2926 dynbase = (caddr_t)ctlv; 2927 else 2928 dynsz = 0; 2929 } 2930 2931 prepare_format_opts(co, fo, rbase, rcnt, dynbase, dynsz); 2932 bp_alloc(&bp, 4096); 2933 2934 /* if no rule numbers were specified, list all rules */ 2935 if (ac == 0) { 2936 fo->first = 0; 2937 fo->last = IPFW_DEFAULT_RULE; 2938 if (cfg->flags & IPFW_CFG_GET_STATIC) 2939 list_static_range(co, fo, &bp, rbase, rcnt); 2940 2941 if (co->do_dynamic && dynsz > 0) { 2942 printf("## Dynamic rules (%d %zu):\n", fo->dcnt, 2943 dynsz); 2944 list_dyn_range(co, fo, &bp, dynbase, dynsz); 2945 } 2946 2947 bp_free(&bp); 2948 return (EX_OK); 2949 } 2950 2951 /* display specific rules requested on command line */ 2952 for (lac = ac, lav = av; lac != 0; lac--) { 2953 /* convert command line rule # */ 2954 fo->last = fo->first = strtoul(*lav++, &endptr, 10); 2955 if (*endptr == '-') 2956 fo->last = strtoul(endptr + 1, &endptr, 10); 2957 if (*endptr) { 2958 exitval = EX_USAGE; 2959 warnx("invalid rule number: %s", *(lav - 1)); 2960 continue; 2961 } 2962 2963 if ((cfg->flags & IPFW_CFG_GET_STATIC) == 0) 2964 continue; 2965 2966 if (list_static_range(co, fo, &bp, rbase, rcnt) == 0) { 2967 /* give precedence to other error(s) */ 2968 if (exitval == EX_OK) 2969 exitval = EX_UNAVAILABLE; 2970 if (fo->first == fo->last) 2971 warnx("rule %u does not exist", fo->first); 2972 else 2973 warnx("no rules in range %u-%u", 2974 fo->first, fo->last); 2975 } 2976 } 2977 2978 if (co->do_dynamic && dynsz > 0) { 2979 printf("## Dynamic rules:\n"); 2980 for (lac = ac, lav = av; lac != 0; lac--) { 2981 fo->last = fo->first = strtoul(*lav++, &endptr, 10); 2982 if (*endptr == '-') 2983 fo->last = strtoul(endptr+1, &endptr, 10); 2984 if (*endptr) 2985 /* already warned */ 2986 continue; 2987 list_dyn_range(co, fo, &bp, dynbase, dynsz); 2988 } 2989 } 2990 2991 bp_free(&bp); 2992 return (exitval); 2993 } 2994 2995 2996 /* 2997 * Retrieves current ipfw configuration of given type 2998 * and stores its pointer to @pcfg. 2999 * 3000 * Caller is responsible for freeing @pcfg. 3001 * 3002 * Returns 0 on success. 3003 */ 3004 3005 static int 3006 ipfw_get_config(struct cmdline_opts *co, struct format_opts *fo, 3007 ipfw_cfg_lheader **pcfg, size_t *psize) 3008 { 3009 ipfw_cfg_lheader *cfg; 3010 size_t sz; 3011 int i; 3012 3013 3014 if (co->test_only != 0) { 3015 fprintf(stderr, "Testing only, list disabled\n"); 3016 return (0); 3017 } 3018 3019 /* Start with some data size */ 3020 sz = 4096; 3021 cfg = NULL; 3022 3023 for (i = 0; i < 16; i++) { 3024 if (cfg != NULL) 3025 free(cfg); 3026 if ((cfg = calloc(1, sz)) == NULL) 3027 return (ENOMEM); 3028 3029 cfg->flags = fo->flags; 3030 cfg->start_rule = fo->first; 3031 cfg->end_rule = fo->last; 3032 3033 if (do_get3(IP_FW_XGET, &cfg->opheader, &sz) != 0) { 3034 if (errno != ENOMEM) { 3035 free(cfg); 3036 return (errno); 3037 } 3038 3039 /* Buffer size is not enough. Try to increase */ 3040 sz = sz * 2; 3041 if (sz < cfg->size) 3042 sz = cfg->size; 3043 continue; 3044 } 3045 3046 *pcfg = cfg; 3047 *psize = sz; 3048 return (0); 3049 } 3050 3051 free(cfg); 3052 return (ENOMEM); 3053 } 3054 3055 static int 3056 lookup_host (char *host, struct in_addr *ipaddr) 3057 { 3058 struct hostent *he; 3059 3060 if (!inet_aton(host, ipaddr)) { 3061 if ((he = gethostbyname(host)) == NULL) 3062 return(-1); 3063 *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 3064 } 3065 return(0); 3066 } 3067 3068 struct tidx { 3069 ipfw_obj_ntlv *idx; 3070 uint32_t count; 3071 uint32_t size; 3072 uint16_t counter; 3073 uint8_t set; 3074 }; 3075 3076 int 3077 ipfw_check_object_name(const char *name) 3078 { 3079 int c, i, l; 3080 3081 /* 3082 * Check that name is null-terminated and contains 3083 * valid symbols only. Valid mask is: 3084 * [a-zA-Z0-9\-_\.]{1,63} 3085 */ 3086 l = strlen(name); 3087 if (l == 0 || l >= 64) 3088 return (EINVAL); 3089 for (i = 0; i < l; i++) { 3090 c = name[i]; 3091 if (isalpha(c) || isdigit(c) || c == '_' || 3092 c == '-' || c == '.') 3093 continue; 3094 return (EINVAL); 3095 } 3096 return (0); 3097 } 3098 3099 static const char *default_state_name = "default"; 3100 3101 static int 3102 state_check_name(const char *name) 3103 { 3104 3105 if (ipfw_check_object_name(name) != 0) 3106 return (EINVAL); 3107 if (strcmp(name, "any") == 0) 3108 return (EINVAL); 3109 return (0); 3110 } 3111 3112 static int 3113 eaction_check_name(const char *name) 3114 { 3115 3116 if (ipfw_check_object_name(name) != 0) 3117 return (EINVAL); 3118 /* Restrict some 'special' names */ 3119 if (match_token(rule_actions, name) != -1 && 3120 match_token(rule_action_params, name) != -1) 3121 return (EINVAL); 3122 return (0); 3123 } 3124 3125 static uint16_t 3126 pack_object(struct tidx *tstate, const char *name, int otype) 3127 { 3128 ipfw_obj_ntlv *ntlv; 3129 uint32_t i; 3130 3131 for (i = 0; i < tstate->count; i++) { 3132 if (strcmp(tstate->idx[i].name, name) != 0) 3133 continue; 3134 if (tstate->idx[i].set != tstate->set) 3135 continue; 3136 if (tstate->idx[i].head.type != otype) 3137 continue; 3138 3139 return (tstate->idx[i].idx); 3140 } 3141 3142 if (tstate->count + 1 > tstate->size) { 3143 tstate->size += 4; 3144 tstate->idx = realloc(tstate->idx, tstate->size * 3145 sizeof(ipfw_obj_ntlv)); 3146 if (tstate->idx == NULL) 3147 return (0); 3148 } 3149 3150 ntlv = &tstate->idx[i]; 3151 memset(ntlv, 0, sizeof(ipfw_obj_ntlv)); 3152 strlcpy(ntlv->name, name, sizeof(ntlv->name)); 3153 ntlv->head.type = otype; 3154 ntlv->head.length = sizeof(ipfw_obj_ntlv); 3155 ntlv->set = tstate->set; 3156 ntlv->idx = ++tstate->counter; 3157 tstate->count++; 3158 3159 return (ntlv->idx); 3160 } 3161 3162 static uint16_t 3163 pack_table(struct tidx *tstate, const char *name) 3164 { 3165 3166 if (table_check_name(name) != 0) 3167 return (0); 3168 3169 return (pack_object(tstate, name, IPFW_TLV_TBL_NAME)); 3170 } 3171 3172 void 3173 fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode, 3174 struct tidx *tstate) 3175 { 3176 uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; 3177 uint16_t uidx; 3178 char *p; 3179 3180 if ((p = strchr(av + 6, ')')) == NULL) 3181 errx(EX_DATAERR, "forgotten parenthesis: '%s'", av); 3182 *p = '\0'; 3183 p = strchr(av + 6, ','); 3184 if (p) 3185 *p++ = '\0'; 3186 3187 if ((uidx = pack_table(tstate, av + 6)) == 0) 3188 errx(EX_DATAERR, "Invalid table name: %s", av + 6); 3189 3190 cmd->opcode = opcode; 3191 cmd->arg1 = uidx; 3192 if (p) { 3193 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 3194 d[0] = strtoul(p, NULL, 0); 3195 } else 3196 cmd->len |= F_INSN_SIZE(ipfw_insn); 3197 } 3198 3199 3200 /* 3201 * fills the addr and mask fields in the instruction as appropriate from av. 3202 * Update length as appropriate. 3203 * The following formats are allowed: 3204 * me returns O_IP_*_ME 3205 * 1.2.3.4 single IP address 3206 * 1.2.3.4:5.6.7.8 address:mask 3207 * 1.2.3.4/24 address/mask 3208 * 1.2.3.4/26{1,6,5,4,23} set of addresses in a subnet 3209 * We can have multiple comma-separated address/mask entries. 3210 */ 3211 static void 3212 fill_ip(ipfw_insn_ip *cmd, char *av, int cblen, struct tidx *tstate) 3213 { 3214 int len = 0; 3215 uint32_t *d = ((ipfw_insn_u32 *)cmd)->d; 3216 3217 cmd->o.len &= ~F_LEN_MASK; /* zero len */ 3218 3219 if (_substrcmp(av, "any") == 0) 3220 return; 3221 3222 if (_substrcmp(av, "me") == 0) { 3223 cmd->o.len |= F_INSN_SIZE(ipfw_insn); 3224 return; 3225 } 3226 3227 if (strncmp(av, "table(", 6) == 0) { 3228 fill_table(&cmd->o, av, O_IP_DST_LOOKUP, tstate); 3229 return; 3230 } 3231 3232 while (av) { 3233 /* 3234 * After the address we can have '/' or ':' indicating a mask, 3235 * ',' indicating another address follows, '{' indicating a 3236 * set of addresses of unspecified size. 3237 */ 3238 char *t = NULL, *p = strpbrk(av, "/:,{"); 3239 int masklen; 3240 char md, nd = '\0'; 3241 3242 CHECK_LENGTH(cblen, (int)F_INSN_SIZE(ipfw_insn) + 2 + len); 3243 3244 if (p) { 3245 md = *p; 3246 *p++ = '\0'; 3247 if ((t = strpbrk(p, ",{")) != NULL) { 3248 nd = *t; 3249 *t = '\0'; 3250 } 3251 } else 3252 md = '\0'; 3253 3254 if (lookup_host(av, (struct in_addr *)&d[0]) != 0) 3255 errx(EX_NOHOST, "hostname ``%s'' unknown", av); 3256 switch (md) { 3257 case ':': 3258 if (!inet_aton(p, (struct in_addr *)&d[1])) 3259 errx(EX_DATAERR, "bad netmask ``%s''", p); 3260 break; 3261 case '/': 3262 masklen = atoi(p); 3263 if (masklen == 0) 3264 d[1] = htonl(0U); /* mask */ 3265 else if (masklen > 32) 3266 errx(EX_DATAERR, "bad width ``%s''", p); 3267 else 3268 d[1] = htonl(~0U << (32 - masklen)); 3269 break; 3270 case '{': /* no mask, assume /24 and put back the '{' */ 3271 d[1] = htonl(~0U << (32 - 24)); 3272 *(--p) = md; 3273 break; 3274 3275 case ',': /* single address plus continuation */ 3276 *(--p) = md; 3277 /* FALLTHROUGH */ 3278 case 0: /* initialization value */ 3279 default: 3280 d[1] = htonl(~0U); /* force /32 */ 3281 break; 3282 } 3283 d[0] &= d[1]; /* mask base address with mask */ 3284 if (t) 3285 *t = nd; 3286 /* find next separator */ 3287 if (p) 3288 p = strpbrk(p, ",{"); 3289 if (p && *p == '{') { 3290 /* 3291 * We have a set of addresses. They are stored as follows: 3292 * arg1 is the set size (powers of 2, 2..256) 3293 * addr is the base address IN HOST FORMAT 3294 * mask.. is an array of arg1 bits (rounded up to 3295 * the next multiple of 32) with bits set 3296 * for each host in the map. 3297 */ 3298 uint32_t *map = (uint32_t *)&cmd->mask; 3299 int low, high; 3300 int i = contigmask((uint8_t *)&(d[1]), 32); 3301 3302 if (len > 0) 3303 errx(EX_DATAERR, "address set cannot be in a list"); 3304 if (i < 24 || i > 31) 3305 errx(EX_DATAERR, "invalid set with mask %d\n", i); 3306 cmd->o.arg1 = 1<<(32-i); /* map length */ 3307 d[0] = ntohl(d[0]); /* base addr in host format */ 3308 cmd->o.opcode = O_IP_DST_SET; /* default */ 3309 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + (cmd->o.arg1+31)/32; 3310 for (i = 0; i < (cmd->o.arg1+31)/32 ; i++) 3311 map[i] = 0; /* clear map */ 3312 3313 av = p + 1; 3314 low = d[0] & 0xff; 3315 high = low + cmd->o.arg1 - 1; 3316 /* 3317 * Here, i stores the previous value when we specify a range 3318 * of addresses within a mask, e.g. 45-63. i = -1 means we 3319 * have no previous value. 3320 */ 3321 i = -1; /* previous value in a range */ 3322 while (isdigit(*av)) { 3323 char *s; 3324 int a = strtol(av, &s, 0); 3325 3326 if (s == av) { /* no parameter */ 3327 if (*av != '}') 3328 errx(EX_DATAERR, "set not closed\n"); 3329 if (i != -1) 3330 errx(EX_DATAERR, "incomplete range %d-", i); 3331 break; 3332 } 3333 if (a < low || a > high) 3334 errx(EX_DATAERR, "addr %d out of range [%d-%d]\n", 3335 a, low, high); 3336 a -= low; 3337 if (i == -1) /* no previous in range */ 3338 i = a; 3339 else { /* check that range is valid */ 3340 if (i > a) 3341 errx(EX_DATAERR, "invalid range %d-%d", 3342 i+low, a+low); 3343 if (*s == '-') 3344 errx(EX_DATAERR, "double '-' in range"); 3345 } 3346 for (; i <= a; i++) 3347 map[i/32] |= 1<<(i & 31); 3348 i = -1; 3349 if (*s == '-') 3350 i = a; 3351 else if (*s == '}') 3352 break; 3353 av = s+1; 3354 } 3355 return; 3356 } 3357 av = p; 3358 if (av) /* then *av must be a ',' */ 3359 av++; 3360 3361 /* Check this entry */ 3362 if (d[1] == 0) { /* "any", specified as x.x.x.x/0 */ 3363 /* 3364 * 'any' turns the entire list into a NOP. 3365 * 'not any' never matches, so it is removed from the 3366 * list unless it is the only item, in which case we 3367 * report an error. 3368 */ 3369 if (cmd->o.len & F_NOT) { /* "not any" never matches */ 3370 if (av == NULL && len == 0) /* only this entry */ 3371 errx(EX_DATAERR, "not any never matches"); 3372 } 3373 /* else do nothing and skip this entry */ 3374 return; 3375 } 3376 /* A single IP can be stored in an optimized format */ 3377 if (d[1] == (uint32_t)~0 && av == NULL && len == 0) { 3378 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32); 3379 return; 3380 } 3381 len += 2; /* two words... */ 3382 d += 2; 3383 } /* end while */ 3384 if (len + 1 > F_LEN_MASK) 3385 errx(EX_DATAERR, "address list too long"); 3386 cmd->o.len |= len+1; 3387 } 3388 3389 3390 /* n2mask sets n bits of the mask */ 3391 void 3392 n2mask(struct in6_addr *mask, int n) 3393 { 3394 static int minimask[9] = 3395 { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff }; 3396 u_char *p; 3397 3398 memset(mask, 0, sizeof(struct in6_addr)); 3399 p = (u_char *) mask; 3400 for (; n > 0; p++, n -= 8) { 3401 if (n >= 8) 3402 *p = 0xff; 3403 else 3404 *p = minimask[n]; 3405 } 3406 return; 3407 } 3408 3409 static void 3410 fill_flags_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, 3411 struct _s_x *flags, char *p) 3412 { 3413 char *e; 3414 uint32_t set = 0, clear = 0; 3415 3416 if (fill_flags(flags, p, &e, &set, &clear) != 0) 3417 errx(EX_DATAERR, "invalid flag %s", e); 3418 3419 cmd->opcode = opcode; 3420 cmd->len = (cmd->len & (F_NOT | F_OR)) | 1; 3421 cmd->arg1 = (set & 0xff) | ( (clear & 0xff) << 8); 3422 } 3423 3424 3425 void 3426 ipfw_delete(char *av[]) 3427 { 3428 ipfw_range_tlv rt; 3429 char *sep; 3430 int i, j; 3431 int exitval = EX_OK; 3432 int do_set = 0; 3433 3434 av++; 3435 NEED1("missing rule specification"); 3436 if ( *av && _substrcmp(*av, "set") == 0) { 3437 /* Do not allow using the following syntax: 3438 * ipfw set N delete set M 3439 */ 3440 if (g_co.use_set) 3441 errx(EX_DATAERR, "invalid syntax"); 3442 do_set = 1; /* delete set */ 3443 av++; 3444 } 3445 3446 /* Rule number */ 3447 while (*av && isdigit(**av)) { 3448 i = strtol(*av, &sep, 10); 3449 j = i; 3450 if (*sep== '-') 3451 j = strtol(sep + 1, NULL, 10); 3452 av++; 3453 if (g_co.do_nat) { 3454 exitval = ipfw_delete_nat(i); 3455 } else if (g_co.do_pipe) { 3456 exitval = ipfw_delete_pipe(g_co.do_pipe, i); 3457 } else { 3458 memset(&rt, 0, sizeof(rt)); 3459 if (do_set != 0) { 3460 rt.set = i & 31; 3461 rt.flags = IPFW_RCFLAG_SET; 3462 } else { 3463 rt.start_rule = i & 0xffff; 3464 rt.end_rule = j & 0xffff; 3465 if (rt.start_rule == 0 && rt.end_rule == 0) 3466 rt.flags |= IPFW_RCFLAG_ALL; 3467 else 3468 rt.flags |= IPFW_RCFLAG_RANGE; 3469 if (g_co.use_set != 0) { 3470 rt.set = g_co.use_set - 1; 3471 rt.flags |= IPFW_RCFLAG_SET; 3472 } 3473 } 3474 if (g_co.do_dynamic == 2) 3475 rt.flags |= IPFW_RCFLAG_DYNAMIC; 3476 i = do_range_cmd(IP_FW_XDEL, &rt); 3477 if (i != 0) { 3478 exitval = EX_UNAVAILABLE; 3479 if (g_co.do_quiet) 3480 continue; 3481 warn("rule %u: setsockopt(IP_FW_XDEL)", 3482 rt.start_rule); 3483 } else if (rt.new_set == 0 && do_set == 0 && 3484 g_co.do_dynamic != 2) { 3485 exitval = EX_UNAVAILABLE; 3486 if (g_co.do_quiet) 3487 continue; 3488 if (rt.start_rule != rt.end_rule) 3489 warnx("no rules rules in %u-%u range", 3490 rt.start_rule, rt.end_rule); 3491 else 3492 warnx("rule %u not found", 3493 rt.start_rule); 3494 } 3495 } 3496 } 3497 if (exitval != EX_OK && g_co.do_force == 0) 3498 exit(exitval); 3499 } 3500 3501 3502 /* 3503 * fill the interface structure. We do not check the name as we can 3504 * create interfaces dynamically, so checking them at insert time 3505 * makes relatively little sense. 3506 * Interface names containing '*', '?', or '[' are assumed to be shell 3507 * patterns which match interfaces. 3508 */ 3509 static void 3510 fill_iface(ipfw_insn_if *cmd, char *arg, int cblen, struct tidx *tstate) 3511 { 3512 char *p; 3513 uint16_t uidx; 3514 3515 cmd->name[0] = '\0'; 3516 cmd->o.len |= F_INSN_SIZE(ipfw_insn_if); 3517 3518 CHECK_CMDLEN; 3519 3520 /* Parse the interface or address */ 3521 if (strcmp(arg, "any") == 0) 3522 cmd->o.len = 0; /* effectively ignore this command */ 3523 else if (strncmp(arg, "table(", 6) == 0) { 3524 if ((p = strchr(arg + 6, ')')) == NULL) 3525 errx(EX_DATAERR, "forgotten parenthesis: '%s'", arg); 3526 *p = '\0'; 3527 p = strchr(arg + 6, ','); 3528 if (p) 3529 *p++ = '\0'; 3530 if ((uidx = pack_table(tstate, arg + 6)) == 0) 3531 errx(EX_DATAERR, "Invalid table name: %s", arg + 6); 3532 3533 cmd->name[0] = '\1'; /* Special value indicating table */ 3534 cmd->p.kidx = uidx; 3535 } else if (!isdigit(*arg)) { 3536 strlcpy(cmd->name, arg, sizeof(cmd->name)); 3537 cmd->p.glob = strpbrk(arg, "*?[") != NULL ? 1 : 0; 3538 } else if (!inet_aton(arg, &cmd->p.ip)) 3539 errx(EX_DATAERR, "bad ip address ``%s''", arg); 3540 } 3541 3542 static void 3543 get_mac_addr_mask(const char *p, uint8_t *addr, uint8_t *mask) 3544 { 3545 int i; 3546 size_t l; 3547 char *ap, *ptr, *optr; 3548 struct ether_addr *mac; 3549 const char *macset = "0123456789abcdefABCDEF:"; 3550 3551 if (strcmp(p, "any") == 0) { 3552 for (i = 0; i < ETHER_ADDR_LEN; i++) 3553 addr[i] = mask[i] = 0; 3554 return; 3555 } 3556 3557 optr = ptr = strdup(p); 3558 if ((ap = strsep(&ptr, "&/")) != NULL && *ap != 0) { 3559 l = strlen(ap); 3560 if (strspn(ap, macset) != l || (mac = ether_aton(ap)) == NULL) 3561 errx(EX_DATAERR, "Incorrect MAC address"); 3562 bcopy(mac, addr, ETHER_ADDR_LEN); 3563 } else 3564 errx(EX_DATAERR, "Incorrect MAC address"); 3565 3566 if (ptr != NULL) { /* we have mask? */ 3567 if (p[ptr - optr - 1] == '/') { /* mask len */ 3568 long ml = strtol(ptr, &ap, 10); 3569 if (*ap != 0 || ml > ETHER_ADDR_LEN * 8 || ml < 0) 3570 errx(EX_DATAERR, "Incorrect mask length"); 3571 for (i = 0; ml > 0 && i < ETHER_ADDR_LEN; ml -= 8, i++) 3572 mask[i] = (ml >= 8) ? 0xff: (~0) << (8 - ml); 3573 } else { /* mask */ 3574 l = strlen(ptr); 3575 if (strspn(ptr, macset) != l || 3576 (mac = ether_aton(ptr)) == NULL) 3577 errx(EX_DATAERR, "Incorrect mask"); 3578 bcopy(mac, mask, ETHER_ADDR_LEN); 3579 } 3580 } else { /* default mask: ff:ff:ff:ff:ff:ff */ 3581 for (i = 0; i < ETHER_ADDR_LEN; i++) 3582 mask[i] = 0xff; 3583 } 3584 for (i = 0; i < ETHER_ADDR_LEN; i++) 3585 addr[i] &= mask[i]; 3586 3587 free(optr); 3588 } 3589 3590 /* 3591 * helper function, updates the pointer to cmd with the length 3592 * of the current command, and also cleans up the first word of 3593 * the new command in case it has been clobbered before. 3594 */ 3595 static ipfw_insn * 3596 next_cmd(ipfw_insn *cmd, int *len) 3597 { 3598 *len -= F_LEN(cmd); 3599 CHECK_LENGTH(*len, 0); 3600 cmd += F_LEN(cmd); 3601 bzero(cmd, sizeof(*cmd)); 3602 return cmd; 3603 } 3604 3605 /* 3606 * Takes arguments and copies them into a comment 3607 */ 3608 static void 3609 fill_comment(ipfw_insn *cmd, char **av, int cblen) 3610 { 3611 int i, l; 3612 char *p = (char *)(cmd + 1); 3613 3614 cmd->opcode = O_NOP; 3615 cmd->len = (cmd->len & (F_NOT | F_OR)); 3616 3617 /* Compute length of comment string. */ 3618 for (i = 0, l = 0; av[i] != NULL; i++) 3619 l += strlen(av[i]) + 1; 3620 if (l == 0) 3621 return; 3622 if (l > 84) 3623 errx(EX_DATAERR, 3624 "comment too long (max 80 chars)"); 3625 l = 1 + (l+3)/4; 3626 cmd->len = (cmd->len & (F_NOT | F_OR)) | l; 3627 CHECK_CMDLEN; 3628 3629 for (i = 0; av[i] != NULL; i++) { 3630 strcpy(p, av[i]); 3631 p += strlen(av[i]); 3632 *p++ = ' '; 3633 } 3634 *(--p) = '\0'; 3635 } 3636 3637 /* 3638 * A function to fill simple commands of size 1. 3639 * Existing flags are preserved. 3640 */ 3641 static void 3642 fill_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, int flags, uint16_t arg) 3643 { 3644 cmd->opcode = opcode; 3645 cmd->len = ((cmd->len | flags) & (F_NOT | F_OR)) | 1; 3646 cmd->arg1 = arg; 3647 } 3648 3649 /* 3650 * Fetch and add the MAC address and type, with masks. This generates one or 3651 * two microinstructions, and returns the pointer to the last one. 3652 */ 3653 static ipfw_insn * 3654 add_mac(ipfw_insn *cmd, char *av[], int cblen) 3655 { 3656 ipfw_insn_mac *mac; 3657 3658 if ( ( av[0] == NULL ) || ( av[1] == NULL ) ) 3659 errx(EX_DATAERR, "MAC dst src"); 3660 3661 cmd->opcode = O_MACADDR2; 3662 cmd->len = (cmd->len & (F_NOT | F_OR)) | F_INSN_SIZE(ipfw_insn_mac); 3663 CHECK_CMDLEN; 3664 3665 mac = (ipfw_insn_mac *)cmd; 3666 get_mac_addr_mask(av[0], mac->addr, mac->mask); /* dst */ 3667 get_mac_addr_mask(av[1], &(mac->addr[ETHER_ADDR_LEN]), 3668 &(mac->mask[ETHER_ADDR_LEN])); /* src */ 3669 return cmd; 3670 } 3671 3672 static ipfw_insn * 3673 add_mactype(ipfw_insn *cmd, char *av, int cblen) 3674 { 3675 if (!av) 3676 errx(EX_DATAERR, "missing MAC type"); 3677 if (strcmp(av, "any") != 0) { /* we have a non-null type */ 3678 fill_newports((ipfw_insn_u16 *)cmd, av, IPPROTO_ETHERTYPE, 3679 cblen); 3680 cmd->opcode = O_MAC_TYPE; 3681 return cmd; 3682 } else 3683 return NULL; 3684 } 3685 3686 static ipfw_insn * 3687 add_proto0(ipfw_insn *cmd, char *av, u_char *protop) 3688 { 3689 struct protoent *pe; 3690 char *ep; 3691 int proto; 3692 3693 proto = strtol(av, &ep, 10); 3694 if (*ep != '\0' || proto <= 0) { 3695 if ((pe = getprotobyname(av)) == NULL) 3696 return NULL; 3697 proto = pe->p_proto; 3698 } 3699 3700 fill_cmd(cmd, O_PROTO, 0, proto); 3701 *protop = proto; 3702 return cmd; 3703 } 3704 3705 static ipfw_insn * 3706 add_proto(ipfw_insn *cmd, char *av, u_char *protop) 3707 { 3708 u_char proto = IPPROTO_IP; 3709 3710 if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 3711 ; /* do not set O_IP4 nor O_IP6 */ 3712 else if (strcmp(av, "ip4") == 0) 3713 /* explicit "just IPv4" rule */ 3714 fill_cmd(cmd, O_IP4, 0, 0); 3715 else if (strcmp(av, "ip6") == 0) { 3716 /* explicit "just IPv6" rule */ 3717 proto = IPPROTO_IPV6; 3718 fill_cmd(cmd, O_IP6, 0, 0); 3719 } else 3720 return add_proto0(cmd, av, protop); 3721 3722 *protop = proto; 3723 return cmd; 3724 } 3725 3726 static ipfw_insn * 3727 add_proto_compat(ipfw_insn *cmd, char *av, u_char *protop) 3728 { 3729 u_char proto = IPPROTO_IP; 3730 3731 if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0) 3732 ; /* do not set O_IP4 nor O_IP6 */ 3733 else if (strcmp(av, "ipv4") == 0 || strcmp(av, "ip4") == 0) 3734 /* explicit "just IPv4" rule */ 3735 fill_cmd(cmd, O_IP4, 0, 0); 3736 else if (strcmp(av, "ipv6") == 0 || strcmp(av, "ip6") == 0) { 3737 /* explicit "just IPv6" rule */ 3738 proto = IPPROTO_IPV6; 3739 fill_cmd(cmd, O_IP6, 0, 0); 3740 } else 3741 return add_proto0(cmd, av, protop); 3742 3743 *protop = proto; 3744 return cmd; 3745 } 3746 3747 static ipfw_insn * 3748 add_srcip(ipfw_insn *cmd, char *av, int cblen, struct tidx *tstate) 3749 { 3750 fill_ip((ipfw_insn_ip *)cmd, av, cblen, tstate); 3751 if (cmd->opcode == O_IP_DST_SET) /* set */ 3752 cmd->opcode = O_IP_SRC_SET; 3753 else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 3754 cmd->opcode = O_IP_SRC_LOOKUP; 3755 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 3756 cmd->opcode = O_IP_SRC_ME; 3757 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 3758 cmd->opcode = O_IP_SRC; 3759 else /* addr/mask */ 3760 cmd->opcode = O_IP_SRC_MASK; 3761 return cmd; 3762 } 3763 3764 static ipfw_insn * 3765 add_dstip(ipfw_insn *cmd, char *av, int cblen, struct tidx *tstate) 3766 { 3767 fill_ip((ipfw_insn_ip *)cmd, av, cblen, tstate); 3768 if (cmd->opcode == O_IP_DST_SET) /* set */ 3769 ; 3770 else if (cmd->opcode == O_IP_DST_LOOKUP) /* table */ 3771 ; 3772 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn)) /* me */ 3773 cmd->opcode = O_IP_DST_ME; 3774 else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32)) /* one IP */ 3775 cmd->opcode = O_IP_DST; 3776 else /* addr/mask */ 3777 cmd->opcode = O_IP_DST_MASK; 3778 return cmd; 3779 } 3780 3781 static ipfw_insn * 3782 add_srcmac(ipfw_insn *cmd, char *av, struct tidx *tstate) 3783 { 3784 3785 if (strncmp(av, "table(", 6) == 0) 3786 fill_table(cmd, av, O_MAC_SRC_LOOKUP, tstate); 3787 else 3788 errx(EX_DATAERR, "only mac table lookup is supported %s", av); 3789 return cmd; 3790 } 3791 3792 static ipfw_insn * 3793 add_dstmac(ipfw_insn *cmd, char *av, struct tidx *tstate) 3794 { 3795 3796 if (strncmp(av, "table(", 6) == 0) 3797 fill_table(cmd, av, O_MAC_DST_LOOKUP, tstate); 3798 else 3799 errx(EX_DATAERR, "only mac table lookup is supported %s", av); 3800 return cmd; 3801 } 3802 3803 3804 static struct _s_x f_reserved_keywords[] = { 3805 { "altq", TOK_OR }, 3806 { "//", TOK_OR }, 3807 { "diverted", TOK_OR }, 3808 { "dst-port", TOK_OR }, 3809 { "src-port", TOK_OR }, 3810 { "established", TOK_OR }, 3811 { "keep-state", TOK_OR }, 3812 { "frag", TOK_OR }, 3813 { "icmptypes", TOK_OR }, 3814 { "in", TOK_OR }, 3815 { "out", TOK_OR }, 3816 { "ip6", TOK_OR }, 3817 { "any", TOK_OR }, 3818 { "to", TOK_OR }, 3819 { "via", TOK_OR }, 3820 { "{", TOK_OR }, 3821 { NULL, 0 } /* terminator */ 3822 }; 3823 3824 static ipfw_insn * 3825 add_ports(ipfw_insn *cmd, char *av, u_char proto, int opcode, int cblen) 3826 { 3827 3828 if (match_token(f_reserved_keywords, av) != -1) 3829 return (NULL); 3830 3831 if (fill_newports((ipfw_insn_u16 *)cmd, av, proto, cblen)) { 3832 /* XXX todo: check that we have a protocol with ports */ 3833 cmd->opcode = opcode; 3834 return cmd; 3835 } 3836 return NULL; 3837 } 3838 3839 static ipfw_insn * 3840 add_src(ipfw_insn *cmd, char *av, u_char proto, int cblen, struct tidx *tstate) 3841 { 3842 struct in6_addr a; 3843 char *host, *ch, buf[INET6_ADDRSTRLEN]; 3844 ipfw_insn *ret = NULL; 3845 size_t len; 3846 3847 /* Copy first address in set if needed */ 3848 if ((ch = strpbrk(av, "/,")) != NULL) { 3849 len = ch - av; 3850 strlcpy(buf, av, sizeof(buf)); 3851 if (len < sizeof(buf)) 3852 buf[len] = '\0'; 3853 host = buf; 3854 } else 3855 host = av; 3856 3857 if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 3858 inet_pton(AF_INET6, host, &a) == 1) 3859 ret = add_srcip6(cmd, av, cblen, tstate); 3860 /* XXX: should check for IPv4, not !IPv6 */ 3861 if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 3862 inet_pton(AF_INET6, host, &a) != 1)) 3863 ret = add_srcip(cmd, av, cblen, tstate); 3864 if (ret == NULL && strcmp(av, "any") != 0) 3865 ret = cmd; 3866 3867 return ret; 3868 } 3869 3870 static ipfw_insn * 3871 add_dst(ipfw_insn *cmd, char *av, u_char proto, int cblen, struct tidx *tstate) 3872 { 3873 struct in6_addr a; 3874 char *host, *ch, buf[INET6_ADDRSTRLEN]; 3875 ipfw_insn *ret = NULL; 3876 size_t len; 3877 3878 /* Copy first address in set if needed */ 3879 if ((ch = strpbrk(av, "/,")) != NULL) { 3880 len = ch - av; 3881 strlcpy(buf, av, sizeof(buf)); 3882 if (len < sizeof(buf)) 3883 buf[len] = '\0'; 3884 host = buf; 3885 } else 3886 host = av; 3887 3888 if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || 3889 inet_pton(AF_INET6, host, &a) == 1) 3890 ret = add_dstip6(cmd, av, cblen, tstate); 3891 /* XXX: should check for IPv4, not !IPv6 */ 3892 if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 || 3893 inet_pton(AF_INET6, host, &a) != 1)) 3894 ret = add_dstip(cmd, av, cblen, tstate); 3895 if (ret == NULL && strcmp(av, "any") != 0) 3896 ret = cmd; 3897 3898 return ret; 3899 } 3900 3901 /* 3902 * Parse arguments and assemble the microinstructions which make up a rule. 3903 * Rules are added into the 'rulebuf' and then copied in the correct order 3904 * into the actual rule. 3905 * 3906 * The syntax for a rule starts with the action, followed by 3907 * optional action parameters, and the various match patterns. 3908 * In the assembled microcode, the first opcode must be an O_PROBE_STATE 3909 * (generated if the rule includes a keep-state option), then the 3910 * various match patterns, log/altq actions, and the actual action. 3911 * 3912 */ 3913 static void 3914 compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate) 3915 { 3916 /* 3917 * rules are added into the 'rulebuf' and then copied in 3918 * the correct order into the actual rule. 3919 * Some things that need to go out of order (prob, action etc.) 3920 * go into actbuf[]. 3921 */ 3922 static uint32_t actbuf[255], cmdbuf[255]; 3923 int rblen, ablen, cblen; 3924 3925 ipfw_insn *src, *dst, *cmd, *action, *prev=NULL; 3926 ipfw_insn *first_cmd; /* first match pattern */ 3927 3928 struct ip_fw_rule *rule; 3929 3930 /* 3931 * various flags used to record that we entered some fields. 3932 */ 3933 ipfw_insn *have_state = NULL; /* any state-related option */ 3934 int have_rstate = 0; 3935 ipfw_insn *have_log = NULL, *have_altq = NULL, *have_tag = NULL; 3936 ipfw_insn *have_skipcmd = NULL; 3937 size_t len; 3938 3939 int i; 3940 3941 int open_par = 0; /* open parenthesis ( */ 3942 3943 /* proto is here because it is used to fetch ports */ 3944 u_char proto = IPPROTO_IP; /* default protocol */ 3945 3946 double match_prob = 1; /* match probability, default is always match */ 3947 3948 bzero(actbuf, sizeof(actbuf)); /* actions go here */ 3949 bzero(cmdbuf, sizeof(cmdbuf)); 3950 bzero(rbuf, *rbufsize); 3951 3952 rule = (struct ip_fw_rule *)rbuf; 3953 cmd = (ipfw_insn *)cmdbuf; 3954 action = (ipfw_insn *)actbuf; 3955 3956 rblen = *rbufsize / sizeof(uint32_t); 3957 rblen -= sizeof(struct ip_fw_rule) / sizeof(uint32_t); 3958 ablen = sizeof(actbuf) / sizeof(actbuf[0]); 3959 cblen = sizeof(cmdbuf) / sizeof(cmdbuf[0]); 3960 cblen -= F_INSN_SIZE(ipfw_insn_u32) + 1; 3961 3962 #define CHECK_RBUFLEN(len) { CHECK_LENGTH(rblen, len); rblen -= len; } 3963 #define CHECK_ACTLEN CHECK_LENGTH(ablen, action->len) 3964 3965 av++; 3966 3967 /* [rule N] -- Rule number optional */ 3968 if (av[0] && isdigit(**av)) { 3969 rule->rulenum = atoi(*av); 3970 av++; 3971 } 3972 3973 /* [set N] -- set number (0..RESVD_SET), optional */ 3974 if (av[0] && av[1] && _substrcmp(*av, "set") == 0) { 3975 int set = strtoul(av[1], NULL, 10); 3976 if (set < 0 || set > RESVD_SET) 3977 errx(EX_DATAERR, "illegal set %s", av[1]); 3978 rule->set = set; 3979 tstate->set = set; 3980 av += 2; 3981 } 3982 3983 /* [prob D] -- match probability, optional */ 3984 if (av[0] && av[1] && _substrcmp(*av, "prob") == 0) { 3985 match_prob = strtod(av[1], NULL); 3986 3987 if (match_prob <= 0 || match_prob > 1) 3988 errx(EX_DATAERR, "illegal match prob. %s", av[1]); 3989 av += 2; 3990 } 3991 3992 /* action -- mandatory */ 3993 NEED1("missing action"); 3994 i = match_token(rule_actions, *av); 3995 av++; 3996 action->len = 1; /* default */ 3997 CHECK_ACTLEN; 3998 switch(i) { 3999 case TOK_CHECKSTATE: 4000 have_state = action; 4001 action->opcode = O_CHECK_STATE; 4002 if (*av == NULL || 4003 match_token(rule_options, *av) == TOK_COMMENT) { 4004 action->arg1 = pack_object(tstate, 4005 default_state_name, IPFW_TLV_STATE_NAME); 4006 break; 4007 } 4008 if (*av[0] == ':') { 4009 if (strcmp(*av + 1, "any") == 0) 4010 action->arg1 = 0; 4011 else if (state_check_name(*av + 1) == 0) 4012 action->arg1 = pack_object(tstate, *av + 1, 4013 IPFW_TLV_STATE_NAME); 4014 else 4015 errx(EX_DATAERR, "Invalid state name %s", 4016 *av); 4017 av++; 4018 break; 4019 } 4020 errx(EX_DATAERR, "Invalid state name %s", *av); 4021 break; 4022 4023 case TOK_ABORT: 4024 action->opcode = O_REJECT; 4025 action->arg1 = ICMP_REJECT_ABORT; 4026 break; 4027 4028 case TOK_ABORT6: 4029 action->opcode = O_UNREACH6; 4030 action->arg1 = ICMP6_UNREACH_ABORT; 4031 break; 4032 4033 case TOK_ACCEPT: 4034 action->opcode = O_ACCEPT; 4035 break; 4036 4037 case TOK_DENY: 4038 action->opcode = O_DENY; 4039 action->arg1 = 0; 4040 break; 4041 4042 case TOK_REJECT: 4043 action->opcode = O_REJECT; 4044 action->arg1 = ICMP_UNREACH_HOST; 4045 break; 4046 4047 case TOK_RESET: 4048 action->opcode = O_REJECT; 4049 action->arg1 = ICMP_REJECT_RST; 4050 break; 4051 4052 case TOK_RESET6: 4053 action->opcode = O_UNREACH6; 4054 action->arg1 = ICMP6_UNREACH_RST; 4055 break; 4056 4057 case TOK_UNREACH: 4058 action->opcode = O_REJECT; 4059 NEED1("missing reject code"); 4060 fill_reject_code(&action->arg1, *av); 4061 av++; 4062 if (action->arg1 == ICMP_UNREACH_NEEDFRAG && isdigit(**av)) { 4063 uint16_t mtu; 4064 4065 mtu = strtoul(*av, NULL, 10); 4066 if (mtu < 68 || mtu >= IP_MAXPACKET) 4067 errx(EX_DATAERR, "illegal argument for %s", 4068 *(av - 1)); 4069 action->len = F_INSN_SIZE(ipfw_insn_u16); 4070 ((ipfw_insn_u16 *)action)->ports[0] = mtu; 4071 av++; 4072 } 4073 break; 4074 4075 case TOK_UNREACH6: 4076 action->opcode = O_UNREACH6; 4077 NEED1("missing unreach code"); 4078 fill_unreach6_code(&action->arg1, *av); 4079 av++; 4080 break; 4081 4082 case TOK_COUNT: 4083 action->opcode = O_COUNT; 4084 break; 4085 4086 case TOK_NAT: 4087 action->opcode = O_NAT; 4088 action->len = F_INSN_SIZE(ipfw_insn_nat); 4089 CHECK_ACTLEN; 4090 if (*av != NULL && _substrcmp(*av, "global") == 0) { 4091 action->arg1 = IP_FW_NAT44_GLOBAL; 4092 av++; 4093 break; 4094 } else 4095 goto chkarg; 4096 case TOK_QUEUE: 4097 action->opcode = O_QUEUE; 4098 goto chkarg; 4099 case TOK_PIPE: 4100 action->opcode = O_PIPE; 4101 goto chkarg; 4102 case TOK_SKIPTO: 4103 action->opcode = O_SKIPTO; 4104 goto chkarg; 4105 case TOK_NETGRAPH: 4106 action->opcode = O_NETGRAPH; 4107 goto chkarg; 4108 case TOK_NGTEE: 4109 action->opcode = O_NGTEE; 4110 goto chkarg; 4111 case TOK_DIVERT: 4112 action->opcode = O_DIVERT; 4113 goto chkarg; 4114 case TOK_TEE: 4115 action->opcode = O_TEE; 4116 goto chkarg; 4117 case TOK_CALL: 4118 action->opcode = O_CALLRETURN; 4119 chkarg: 4120 if (!av[0]) 4121 errx(EX_USAGE, "missing argument for %s", *(av - 1)); 4122 if (isdigit(**av)) { 4123 action->arg1 = strtoul(*av, NULL, 10); 4124 if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG) 4125 errx(EX_DATAERR, "illegal argument for %s", 4126 *(av - 1)); 4127 } else if (_substrcmp(*av, "tablearg") == 0) { 4128 action->arg1 = IP_FW_TARG; 4129 } else if (i == TOK_DIVERT || i == TOK_TEE) { 4130 struct servent *s; 4131 setservent(1); 4132 s = getservbyname(av[0], "divert"); 4133 if (s != NULL) 4134 action->arg1 = ntohs(s->s_port); 4135 else 4136 errx(EX_DATAERR, "illegal divert/tee port"); 4137 } else 4138 errx(EX_DATAERR, "illegal argument for %s", *(av - 1)); 4139 av++; 4140 break; 4141 4142 case TOK_FORWARD: { 4143 /* 4144 * Locate the address-port separator (':' or ','). 4145 * Could be one of the following: 4146 * hostname:port 4147 * IPv4 a.b.c.d,port 4148 * IPv4 a.b.c.d:port 4149 * IPv6 w:x:y::z,port 4150 * IPv6 [w:x:y::z]:port 4151 */ 4152 struct sockaddr_storage result; 4153 struct addrinfo *res; 4154 char *s, *end; 4155 int family; 4156 u_short port_number = 0; 4157 4158 NEED1("missing forward address[:port]"); 4159 4160 if (strncmp(*av, "tablearg", 8) == 0 && 4161 ((*av)[8] == '\0' || (*av)[8] == ',' || (*av)[8] == ':')) 4162 memcpy(++(*av), "0.0.0.0", 7); 4163 4164 /* 4165 * Are we an bracket-enclosed IPv6 address? 4166 */ 4167 if (strchr(*av, '[')) 4168 (*av)++; 4169 4170 /* 4171 * locate the address-port separator (':' or ',') 4172 */ 4173 s = strchr(*av, ','); 4174 if (s == NULL) { 4175 s = strchr(*av, ']'); 4176 /* Prevent erroneous parsing on brackets. */ 4177 if (s != NULL) 4178 *(s++) = '\0'; 4179 else 4180 s = *av; 4181 4182 /* Distinguish between IPv4:port and IPv6 cases. */ 4183 s = strchr(s, ':'); 4184 if (s && strchr(s+1, ':')) 4185 s = NULL; /* no port */ 4186 } 4187 4188 if (s != NULL) { 4189 /* Terminate host portion and set s to start of port. */ 4190 *(s++) = '\0'; 4191 i = strtoport(s, &end, 0 /* base */, 0 /* proto */); 4192 if (s == end) 4193 errx(EX_DATAERR, 4194 "illegal forwarding port ``%s''", s); 4195 port_number = (u_short)i; 4196 } 4197 4198 /* 4199 * Resolve the host name or address to a family and a 4200 * network representation of the address. 4201 */ 4202 if (getaddrinfo(*av, NULL, NULL, &res)) 4203 errx(EX_DATAERR, NULL); 4204 /* Just use the first host in the answer. */ 4205 family = res->ai_family; 4206 memcpy(&result, res->ai_addr, res->ai_addrlen); 4207 freeaddrinfo(res); 4208 4209 if (family == PF_INET) { 4210 ipfw_insn_sa *p = (ipfw_insn_sa *)action; 4211 4212 action->opcode = O_FORWARD_IP; 4213 action->len = F_INSN_SIZE(ipfw_insn_sa); 4214 CHECK_ACTLEN; 4215 4216 /* 4217 * In the kernel we assume AF_INET and use only 4218 * sin_port and sin_addr. Remember to set sin_len as 4219 * the routing code seems to use it too. 4220 */ 4221 p->sa.sin_len = sizeof(struct sockaddr_in); 4222 p->sa.sin_family = AF_INET; 4223 p->sa.sin_port = port_number; 4224 p->sa.sin_addr.s_addr = 4225 ((struct sockaddr_in *)&result)->sin_addr.s_addr; 4226 } else if (family == PF_INET6) { 4227 ipfw_insn_sa6 *p = (ipfw_insn_sa6 *)action; 4228 4229 action->opcode = O_FORWARD_IP6; 4230 action->len = F_INSN_SIZE(ipfw_insn_sa6); 4231 CHECK_ACTLEN; 4232 4233 p->sa.sin6_len = sizeof(struct sockaddr_in6); 4234 p->sa.sin6_family = AF_INET6; 4235 p->sa.sin6_port = port_number; 4236 p->sa.sin6_flowinfo = 0; 4237 p->sa.sin6_scope_id = 4238 ((struct sockaddr_in6 *)&result)->sin6_scope_id; 4239 bcopy(&((struct sockaddr_in6*)&result)->sin6_addr, 4240 &p->sa.sin6_addr, sizeof(p->sa.sin6_addr)); 4241 } else { 4242 errx(EX_DATAERR, "Invalid address family in forward action"); 4243 } 4244 av++; 4245 break; 4246 } 4247 case TOK_COMMENT: 4248 /* pretend it is a 'count' rule followed by the comment */ 4249 action->opcode = O_COUNT; 4250 av--; /* go back... */ 4251 break; 4252 4253 case TOK_SETFIB: 4254 { 4255 int numfibs; 4256 size_t intsize = sizeof(int); 4257 4258 action->opcode = O_SETFIB; 4259 NEED1("missing fib number"); 4260 if (_substrcmp(*av, "tablearg") == 0) { 4261 action->arg1 = IP_FW_TARG; 4262 } else { 4263 action->arg1 = strtoul(*av, NULL, 10); 4264 if (sysctlbyname("net.fibs", &numfibs, &intsize, 4265 NULL, 0) == -1) 4266 errx(EX_DATAERR, "fibs not supported.\n"); 4267 if (action->arg1 >= numfibs) /* Temporary */ 4268 errx(EX_DATAERR, "fib too large.\n"); 4269 /* Add high-order bit to fib to make room for tablearg*/ 4270 action->arg1 |= 0x8000; 4271 } 4272 av++; 4273 break; 4274 } 4275 4276 case TOK_SETDSCP: 4277 { 4278 int code; 4279 4280 action->opcode = O_SETDSCP; 4281 NEED1("missing DSCP code"); 4282 if (_substrcmp(*av, "tablearg") == 0) { 4283 action->arg1 = IP_FW_TARG; 4284 } else { 4285 if (isalpha(*av[0])) { 4286 if ((code = match_token(f_ipdscp, *av)) == -1) 4287 errx(EX_DATAERR, "Unknown DSCP code"); 4288 action->arg1 = code; 4289 } else 4290 action->arg1 = strtoul(*av, NULL, 10); 4291 /* 4292 * Add high-order bit to DSCP to make room 4293 * for tablearg 4294 */ 4295 action->arg1 |= 0x8000; 4296 } 4297 av++; 4298 break; 4299 } 4300 4301 case TOK_REASS: 4302 action->opcode = O_REASS; 4303 break; 4304 4305 case TOK_RETURN: 4306 fill_cmd(action, O_CALLRETURN, F_NOT, 0); 4307 break; 4308 4309 case TOK_SETMARK: { 4310 action->opcode = O_SETMARK; 4311 action->len = F_INSN_SIZE(ipfw_insn_u32); 4312 NEED1("missing mark"); 4313 if (strcmp(*av, "tablearg") == 0) { 4314 action->arg1 = IP_FW_TARG; 4315 } else { 4316 ((ipfw_insn_u32 *)action)->d[0] = 4317 strtoul(*av, NULL, 0); 4318 /* This is not a tablearg */ 4319 action->arg1 |= 0x8000; 4320 } 4321 av++; 4322 CHECK_CMDLEN; 4323 break; 4324 } 4325 4326 case TOK_TCPSETMSS: { 4327 u_long mss; 4328 uint16_t idx; 4329 4330 idx = pack_object(tstate, "tcp-setmss", IPFW_TLV_EACTION); 4331 if (idx == 0) 4332 errx(EX_DATAERR, "pack_object failed"); 4333 fill_cmd(action, O_EXTERNAL_ACTION, 0, idx); 4334 NEED1("Missing MSS value"); 4335 action = next_cmd(action, &ablen); 4336 action->len = 1; 4337 CHECK_ACTLEN; 4338 mss = strtoul(*av, NULL, 10); 4339 if (mss == 0 || mss > UINT16_MAX) 4340 errx(EX_USAGE, "invalid MSS value %s", *av); 4341 fill_cmd(action, O_EXTERNAL_DATA, 0, (uint16_t)mss); 4342 av++; 4343 break; 4344 } 4345 4346 default: 4347 av--; 4348 if (match_token(rule_eactions, *av) == -1) 4349 errx(EX_DATAERR, "invalid action %s\n", *av); 4350 /* 4351 * External actions support. 4352 * XXX: we support only syntax with instance name. 4353 * For known external actions (from rule_eactions list) 4354 * we can handle syntax directly. But with `eaction' 4355 * keyword we can use only `eaction <name> <instance>' 4356 * syntax. 4357 */ 4358 case TOK_EACTION: { 4359 uint16_t idx; 4360 4361 NEED1("Missing eaction name"); 4362 if (eaction_check_name(*av) != 0) 4363 errx(EX_DATAERR, "Invalid eaction name %s", *av); 4364 idx = pack_object(tstate, *av, IPFW_TLV_EACTION); 4365 if (idx == 0) 4366 errx(EX_DATAERR, "pack_object failed"); 4367 fill_cmd(action, O_EXTERNAL_ACTION, 0, idx); 4368 av++; 4369 NEED1("Missing eaction instance name"); 4370 action = next_cmd(action, &ablen); 4371 action->len = 1; 4372 CHECK_ACTLEN; 4373 if (eaction_check_name(*av) != 0) 4374 errx(EX_DATAERR, "Invalid eaction instance name %s", 4375 *av); 4376 /* 4377 * External action instance object has TLV type depended 4378 * from the external action name object index. Since we 4379 * currently don't know this index, use zero as TLV type. 4380 */ 4381 idx = pack_object(tstate, *av, 0); 4382 if (idx == 0) 4383 errx(EX_DATAERR, "pack_object failed"); 4384 fill_cmd(action, O_EXTERNAL_INSTANCE, 0, idx); 4385 av++; 4386 } 4387 } 4388 action = next_cmd(action, &ablen); 4389 4390 /* 4391 * [altq queuename] -- altq tag, optional 4392 * [log [logamount N]] -- log, optional 4393 * 4394 * If they exist, it go first in the cmdbuf, but then it is 4395 * skipped in the copy section to the end of the buffer. 4396 */ 4397 while (av[0] != NULL && (i = match_token(rule_action_params, *av)) != -1) { 4398 av++; 4399 switch (i) { 4400 case TOK_LOG: 4401 { 4402 ipfw_insn_log *c = (ipfw_insn_log *)cmd; 4403 int l; 4404 4405 if (have_log) 4406 errx(EX_DATAERR, 4407 "log cannot be specified more than once"); 4408 have_log = (ipfw_insn *)c; 4409 cmd->len = F_INSN_SIZE(ipfw_insn_log); 4410 CHECK_CMDLEN; 4411 cmd->opcode = O_LOG; 4412 if (av[0] && _substrcmp(*av, "logamount") == 0) { 4413 av++; 4414 NEED1("logamount requires argument"); 4415 l = atoi(*av); 4416 if (l < 0) 4417 errx(EX_DATAERR, 4418 "logamount must be positive"); 4419 c->max_log = l; 4420 av++; 4421 } else { 4422 len = sizeof(c->max_log); 4423 if (sysctlbyname("net.inet.ip.fw.verbose_limit", 4424 &c->max_log, &len, NULL, 0) == -1) { 4425 if (g_co.test_only) { 4426 c->max_log = 0; 4427 break; 4428 } 4429 errx(1, "sysctlbyname(\"%s\")", 4430 "net.inet.ip.fw.verbose_limit"); 4431 } 4432 } 4433 } 4434 break; 4435 4436 #ifndef NO_ALTQ 4437 case TOK_ALTQ: 4438 { 4439 ipfw_insn_altq *a = (ipfw_insn_altq *)cmd; 4440 4441 NEED1("missing altq queue name"); 4442 if (have_altq) 4443 errx(EX_DATAERR, 4444 "altq cannot be specified more than once"); 4445 have_altq = (ipfw_insn *)a; 4446 cmd->len = F_INSN_SIZE(ipfw_insn_altq); 4447 CHECK_CMDLEN; 4448 cmd->opcode = O_ALTQ; 4449 a->qid = altq_name_to_qid(*av); 4450 av++; 4451 } 4452 break; 4453 #endif 4454 4455 case TOK_TAG: 4456 case TOK_UNTAG: { 4457 uint16_t tag; 4458 4459 if (have_tag) 4460 errx(EX_USAGE, "tag and untag cannot be " 4461 "specified more than once"); 4462 GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, i, 4463 rule_action_params); 4464 have_tag = cmd; 4465 fill_cmd(cmd, O_TAG, (i == TOK_TAG) ? 0: F_NOT, tag); 4466 av++; 4467 break; 4468 } 4469 4470 default: 4471 abort(); 4472 } 4473 cmd = next_cmd(cmd, &cblen); 4474 } 4475 4476 if (have_state) { /* must be a check-state, we are done */ 4477 if (*av != NULL && 4478 match_token(rule_options, *av) == TOK_COMMENT) { 4479 /* check-state has a comment */ 4480 av++; 4481 fill_comment(cmd, av, cblen); 4482 cmd = next_cmd(cmd, &cblen); 4483 av[0] = NULL; 4484 } 4485 goto done; 4486 } 4487 4488 #define OR_START(target) \ 4489 if (av[0] && (*av[0] == '(' || *av[0] == '{')) { \ 4490 if (open_par) \ 4491 errx(EX_USAGE, "nested \"(\" not allowed\n"); \ 4492 prev = NULL; \ 4493 open_par = 1; \ 4494 if ( (av[0])[1] == '\0') { \ 4495 av++; \ 4496 } else \ 4497 (*av)++; \ 4498 } \ 4499 target: \ 4500 4501 4502 #define CLOSE_PAR \ 4503 if (open_par) { \ 4504 if (av[0] && ( \ 4505 strcmp(*av, ")") == 0 || \ 4506 strcmp(*av, "}") == 0)) { \ 4507 prev = NULL; \ 4508 open_par = 0; \ 4509 av++; \ 4510 } else \ 4511 errx(EX_USAGE, "missing \")\"\n"); \ 4512 } 4513 4514 #define NOT_BLOCK \ 4515 if (av[0] && _substrcmp(*av, "not") == 0) { \ 4516 if (cmd->len & F_NOT) \ 4517 errx(EX_USAGE, "double \"not\" not allowed\n"); \ 4518 cmd->len |= F_NOT; \ 4519 av++; \ 4520 } 4521 4522 #define OR_BLOCK(target) \ 4523 if (av[0] && _substrcmp(*av, "or") == 0) { \ 4524 if (prev == NULL || open_par == 0) \ 4525 errx(EX_DATAERR, "invalid OR block"); \ 4526 prev->len |= F_OR; \ 4527 av++; \ 4528 goto target; \ 4529 } \ 4530 CLOSE_PAR; 4531 4532 first_cmd = cmd; 4533 4534 #if 0 4535 /* 4536 * MAC addresses, optional. 4537 * If we have this, we skip the part "proto from src to dst" 4538 * and jump straight to the option parsing. 4539 */ 4540 NOT_BLOCK; 4541 NEED1("missing protocol"); 4542 if (_substrcmp(*av, "MAC") == 0 || 4543 _substrcmp(*av, "mac") == 0) { 4544 av++; /* the "MAC" keyword */ 4545 add_mac(cmd, av); /* exits in case of errors */ 4546 cmd = next_cmd(cmd); 4547 av += 2; /* dst-mac and src-mac */ 4548 NOT_BLOCK; 4549 NEED1("missing mac type"); 4550 if (add_mactype(cmd, av[0])) 4551 cmd = next_cmd(cmd); 4552 av++; /* any or mac-type */ 4553 goto read_options; 4554 } 4555 #endif 4556 4557 /* 4558 * protocol, mandatory 4559 */ 4560 OR_START(get_proto); 4561 NOT_BLOCK; 4562 NEED1("missing protocol"); 4563 if (add_proto_compat(cmd, *av, &proto)) { 4564 av++; 4565 if (F_LEN(cmd) != 0) { 4566 prev = cmd; 4567 cmd = next_cmd(cmd, &cblen); 4568 } 4569 } else if (first_cmd != cmd) { 4570 errx(EX_DATAERR, "invalid protocol ``%s''", *av); 4571 } else { 4572 rule->flags |= IPFW_RULE_JUSTOPTS; 4573 goto read_options; 4574 } 4575 OR_BLOCK(get_proto); 4576 4577 first_cmd = cmd; /* update pointer to use in compact form */ 4578 4579 /* 4580 * "from", mandatory 4581 */ 4582 if ((av[0] == NULL) || _substrcmp(*av, "from") != 0) 4583 errx(EX_USAGE, "missing ``from''"); 4584 av++; 4585 4586 /* 4587 * source IP, mandatory 4588 */ 4589 OR_START(source_ip); 4590 NOT_BLOCK; /* optional "not" */ 4591 NEED1("missing source address"); 4592 if (add_src(cmd, *av, proto, cblen, tstate)) { 4593 av++; 4594 if (F_LEN(cmd) != 0) { /* ! any */ 4595 prev = cmd; 4596 cmd = next_cmd(cmd, &cblen); 4597 } 4598 } else 4599 errx(EX_USAGE, "bad source address %s", *av); 4600 OR_BLOCK(source_ip); 4601 4602 /* 4603 * source ports, optional 4604 */ 4605 NOT_BLOCK; /* optional "not" */ 4606 if ( av[0] != NULL ) { 4607 if (_substrcmp(*av, "any") == 0 || 4608 add_ports(cmd, *av, proto, O_IP_SRCPORT, cblen)) { 4609 av++; 4610 if (F_LEN(cmd) != 0) 4611 cmd = next_cmd(cmd, &cblen); 4612 } 4613 } 4614 4615 /* 4616 * "to", mandatory 4617 */ 4618 if ( (av[0] == NULL) || _substrcmp(*av, "to") != 0 ) 4619 errx(EX_USAGE, "missing ``to''"); 4620 av++; 4621 4622 /* 4623 * destination, mandatory 4624 */ 4625 OR_START(dest_ip); 4626 NOT_BLOCK; /* optional "not" */ 4627 NEED1("missing dst address"); 4628 if (add_dst(cmd, *av, proto, cblen, tstate)) { 4629 av++; 4630 if (F_LEN(cmd) != 0) { /* ! any */ 4631 prev = cmd; 4632 cmd = next_cmd(cmd, &cblen); 4633 } 4634 } else 4635 errx( EX_USAGE, "bad destination address %s", *av); 4636 OR_BLOCK(dest_ip); 4637 4638 /* 4639 * dest. ports, optional 4640 */ 4641 NOT_BLOCK; /* optional "not" */ 4642 if (av[0]) { 4643 if (_substrcmp(*av, "any") == 0 || 4644 add_ports(cmd, *av, proto, O_IP_DSTPORT, cblen)) { 4645 av++; 4646 if (F_LEN(cmd) != 0) 4647 cmd = next_cmd(cmd, &cblen); 4648 } 4649 } 4650 if (first_cmd == cmd) 4651 rule->flags |= IPFW_RULE_NOOPT; 4652 4653 read_options: 4654 prev = NULL; 4655 while ( av[0] != NULL ) { 4656 char *s; 4657 ipfw_insn_u32 *cmd32; /* alias for cmd */ 4658 4659 s = *av; 4660 cmd32 = (ipfw_insn_u32 *)cmd; 4661 4662 if (*s == '!') { /* alternate syntax for NOT */ 4663 if (cmd->len & F_NOT) 4664 errx(EX_USAGE, "double \"not\" not allowed\n"); 4665 cmd->len = F_NOT; 4666 s++; 4667 } 4668 i = match_token(rule_options, s); 4669 av++; 4670 switch(i) { 4671 case TOK_NOT: 4672 if (cmd->len & F_NOT) 4673 errx(EX_USAGE, "double \"not\" not allowed\n"); 4674 cmd->len = F_NOT; 4675 break; 4676 4677 case TOK_OR: 4678 if (open_par == 0 || prev == NULL) 4679 errx(EX_USAGE, "invalid \"or\" block\n"); 4680 prev->len |= F_OR; 4681 break; 4682 4683 case TOK_STARTBRACE: 4684 if (open_par) 4685 errx(EX_USAGE, "+nested \"(\" not allowed\n"); 4686 open_par = 1; 4687 break; 4688 4689 case TOK_ENDBRACE: 4690 if (!open_par) 4691 errx(EX_USAGE, "+missing \")\"\n"); 4692 open_par = 0; 4693 prev = NULL; 4694 break; 4695 4696 case TOK_IN: 4697 fill_cmd(cmd, O_IN, 0, 0); 4698 break; 4699 4700 case TOK_OUT: 4701 cmd->len ^= F_NOT; /* toggle F_NOT */ 4702 fill_cmd(cmd, O_IN, 0, 0); 4703 break; 4704 4705 case TOK_DIVERTED: 4706 fill_cmd(cmd, O_DIVERTED, 0, 3); 4707 break; 4708 4709 case TOK_DIVERTEDLOOPBACK: 4710 fill_cmd(cmd, O_DIVERTED, 0, 1); 4711 break; 4712 4713 case TOK_DIVERTEDOUTPUT: 4714 fill_cmd(cmd, O_DIVERTED, 0, 2); 4715 break; 4716 4717 case TOK_FRAG: { 4718 uint32_t set = 0, clear = 0; 4719 4720 if (*av != NULL && fill_flags(f_ipoff, *av, NULL, 4721 &set, &clear) == 0) 4722 av++; 4723 else { 4724 /* 4725 * Compatibility: no argument after "frag" 4726 * keyword equals to "frag offset". 4727 */ 4728 set = 0x01; 4729 clear = 0; 4730 } 4731 fill_cmd(cmd, O_FRAG, 0, 4732 (set & 0xff) | ( (clear & 0xff) << 8)); 4733 break; 4734 } 4735 4736 case TOK_LAYER2: 4737 fill_cmd(cmd, O_LAYER2, 0, 0); 4738 break; 4739 4740 case TOK_XMIT: 4741 case TOK_RECV: 4742 case TOK_VIA: 4743 NEED1("recv, xmit, via require interface name" 4744 " or address"); 4745 fill_iface((ipfw_insn_if *)cmd, av[0], cblen, tstate); 4746 av++; 4747 if (F_LEN(cmd) == 0) /* not a valid address */ 4748 break; 4749 if (i == TOK_XMIT) 4750 cmd->opcode = O_XMIT; 4751 else if (i == TOK_RECV) 4752 cmd->opcode = O_RECV; 4753 else if (i == TOK_VIA) 4754 cmd->opcode = O_VIA; 4755 break; 4756 4757 case TOK_ICMPTYPES: 4758 NEED1("icmptypes requires list of types"); 4759 fill_icmptypes((ipfw_insn_u32 *)cmd, *av); 4760 av++; 4761 break; 4762 4763 case TOK_ICMP6TYPES: 4764 NEED1("icmptypes requires list of types"); 4765 fill_icmp6types((ipfw_insn_icmp6 *)cmd, *av, cblen); 4766 av++; 4767 break; 4768 4769 case TOK_IPTTL: 4770 NEED1("ipttl requires TTL"); 4771 if (strpbrk(*av, "-,")) { 4772 if (!add_ports(cmd, *av, 0, O_IPTTL, cblen)) 4773 errx(EX_DATAERR, "invalid ipttl %s", *av); 4774 } else 4775 fill_cmd(cmd, O_IPTTL, 0, strtoul(*av, NULL, 0)); 4776 av++; 4777 break; 4778 4779 case TOK_IPID: 4780 NEED1("ipid requires id"); 4781 if (strpbrk(*av, "-,")) { 4782 if (!add_ports(cmd, *av, 0, O_IPID, cblen)) 4783 errx(EX_DATAERR, "invalid ipid %s", *av); 4784 } else 4785 fill_cmd(cmd, O_IPID, 0, strtoul(*av, NULL, 0)); 4786 av++; 4787 break; 4788 4789 case TOK_IPLEN: 4790 NEED1("iplen requires length"); 4791 if (strpbrk(*av, "-,")) { 4792 if (!add_ports(cmd, *av, 0, O_IPLEN, cblen)) 4793 errx(EX_DATAERR, "invalid ip len %s", *av); 4794 } else 4795 fill_cmd(cmd, O_IPLEN, 0, strtoul(*av, NULL, 0)); 4796 av++; 4797 break; 4798 4799 case TOK_IPVER: 4800 NEED1("ipver requires version"); 4801 fill_cmd(cmd, O_IPVER, 0, strtoul(*av, NULL, 0)); 4802 av++; 4803 break; 4804 4805 case TOK_IPPRECEDENCE: 4806 NEED1("ipprecedence requires value"); 4807 fill_cmd(cmd, O_IPPRECEDENCE, 0, 4808 (strtoul(*av, NULL, 0) & 7) << 5); 4809 av++; 4810 break; 4811 4812 case TOK_DSCP: 4813 NEED1("missing DSCP code"); 4814 fill_dscp(cmd, *av, cblen); 4815 av++; 4816 break; 4817 4818 case TOK_IPOPTS: 4819 NEED1("missing argument for ipoptions"); 4820 fill_flags_cmd(cmd, O_IPOPT, f_ipopts, *av); 4821 av++; 4822 break; 4823 4824 case TOK_IPTOS: 4825 NEED1("missing argument for iptos"); 4826 fill_flags_cmd(cmd, O_IPTOS, f_iptos, *av); 4827 av++; 4828 break; 4829 4830 case TOK_UID: 4831 NEED1("uid requires argument"); 4832 { 4833 char *end; 4834 uid_t uid; 4835 struct passwd *pwd; 4836 4837 cmd->opcode = O_UID; 4838 uid = strtoul(*av, &end, 0); 4839 pwd = (*end == '\0') ? getpwuid(uid) : getpwnam(*av); 4840 if (pwd == NULL) 4841 errx(EX_DATAERR, "uid \"%s\" nonexistent", *av); 4842 cmd32->d[0] = pwd->pw_uid; 4843 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 4844 av++; 4845 } 4846 break; 4847 4848 case TOK_GID: 4849 NEED1("gid requires argument"); 4850 { 4851 char *end; 4852 gid_t gid; 4853 struct group *grp; 4854 4855 cmd->opcode = O_GID; 4856 gid = strtoul(*av, &end, 0); 4857 grp = (*end == '\0') ? getgrgid(gid) : getgrnam(*av); 4858 if (grp == NULL) 4859 errx(EX_DATAERR, "gid \"%s\" nonexistent", *av); 4860 cmd32->d[0] = grp->gr_gid; 4861 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 4862 av++; 4863 } 4864 break; 4865 4866 case TOK_JAIL: 4867 NEED1("jail requires argument"); 4868 { 4869 char *end; 4870 int jid; 4871 4872 cmd->opcode = O_JAIL; 4873 /* 4874 * If av is a number, then we'll just pass it as-is. If 4875 * it's a name, try to resolve that to a jid. 4876 * 4877 * We save the jail_getid(3) call for a fallback because 4878 * it entails an unconditional trip to the kernel to 4879 * either validate a jid or resolve a name to a jid. 4880 * This specific token doesn't currently require a 4881 * jid to be an active jail, so we save a transition 4882 * by simply using a number that we're given. 4883 */ 4884 jid = strtoul(*av, &end, 10); 4885 if (*end != '\0') { 4886 jid = jail_getid(*av); 4887 if (jid < 0) 4888 errx(EX_DATAERR, "%s", jail_errmsg); 4889 } 4890 cmd32->d[0] = (uint32_t)jid; 4891 cmd->len |= F_INSN_SIZE(ipfw_insn_u32); 4892 av++; 4893 } 4894 break; 4895 4896 case TOK_ESTAB: 4897 fill_cmd(cmd, O_ESTAB, 0, 0); 4898 break; 4899 4900 case TOK_SETUP: 4901 fill_cmd(cmd, O_TCPFLAGS, 0, 4902 (TH_SYN) | ( (TH_ACK) & 0xff) <<8 ); 4903 break; 4904 4905 case TOK_TCPDATALEN: 4906 NEED1("tcpdatalen requires length"); 4907 if (strpbrk(*av, "-,")) { 4908 if (!add_ports(cmd, *av, 0, O_TCPDATALEN, cblen)) 4909 errx(EX_DATAERR, "invalid tcpdata len %s", *av); 4910 } else 4911 fill_cmd(cmd, O_TCPDATALEN, 0, 4912 strtoul(*av, NULL, 0)); 4913 av++; 4914 break; 4915 4916 case TOK_TCPOPTS: 4917 NEED1("missing argument for tcpoptions"); 4918 fill_flags_cmd(cmd, O_TCPOPTS, f_tcpopts, *av); 4919 av++; 4920 break; 4921 4922 case TOK_TCPSEQ: 4923 case TOK_TCPACK: 4924 NEED1("tcpseq/tcpack requires argument"); 4925 cmd->len = F_INSN_SIZE(ipfw_insn_u32); 4926 cmd->opcode = (i == TOK_TCPSEQ) ? O_TCPSEQ : O_TCPACK; 4927 cmd32->d[0] = htonl(strtoul(*av, NULL, 0)); 4928 av++; 4929 break; 4930 4931 case TOK_TCPMSS: 4932 case TOK_TCPWIN: 4933 NEED1("tcpmss/tcpwin requires size"); 4934 if (strpbrk(*av, "-,")) { 4935 if (add_ports(cmd, *av, 0, 4936 i == TOK_TCPWIN ? O_TCPWIN : O_TCPMSS, 4937 cblen) == NULL) 4938 errx(EX_DATAERR, "invalid %s size %s", 4939 s, *av); 4940 } else 4941 fill_cmd(cmd, i == TOK_TCPWIN ? O_TCPWIN : 4942 O_TCPMSS, 0, strtoul(*av, NULL, 0)); 4943 av++; 4944 break; 4945 4946 case TOK_TCPFLAGS: 4947 NEED1("missing argument for tcpflags"); 4948 cmd->opcode = O_TCPFLAGS; 4949 fill_flags_cmd(cmd, O_TCPFLAGS, f_tcpflags, *av); 4950 av++; 4951 break; 4952 4953 case TOK_KEEPSTATE: 4954 case TOK_RECORDSTATE: { 4955 uint16_t uidx; 4956 4957 if (open_par) 4958 errx(EX_USAGE, "keep-state or record-state cannot be part " 4959 "of an or block"); 4960 if (have_state) 4961 errx(EX_USAGE, "only one of keep-state, record-state, " 4962 " limit and set-limit is allowed"); 4963 if (*av != NULL && *av[0] == ':') { 4964 if (state_check_name(*av + 1) != 0) 4965 errx(EX_DATAERR, 4966 "Invalid state name %s", *av); 4967 uidx = pack_object(tstate, *av + 1, 4968 IPFW_TLV_STATE_NAME); 4969 av++; 4970 } else 4971 uidx = pack_object(tstate, default_state_name, 4972 IPFW_TLV_STATE_NAME); 4973 have_state = cmd; 4974 have_rstate = i == TOK_RECORDSTATE; 4975 fill_cmd(cmd, O_KEEP_STATE, 0, uidx); 4976 break; 4977 } 4978 4979 case TOK_LIMIT: 4980 case TOK_SETLIMIT: { 4981 ipfw_insn_limit *c = (ipfw_insn_limit *)cmd; 4982 int val; 4983 4984 if (open_par) 4985 errx(EX_USAGE, 4986 "limit or set-limit cannot be part of an or block"); 4987 if (have_state) 4988 errx(EX_USAGE, "only one of keep-state, record-state, " 4989 " limit and set-limit is allowed"); 4990 have_state = cmd; 4991 have_rstate = i == TOK_SETLIMIT; 4992 4993 cmd->len = F_INSN_SIZE(ipfw_insn_limit); 4994 CHECK_CMDLEN; 4995 cmd->opcode = O_LIMIT; 4996 c->limit_mask = c->conn_limit = 0; 4997 4998 while ( av[0] != NULL ) { 4999 if ((val = match_token(limit_masks, *av)) <= 0) 5000 break; 5001 c->limit_mask |= val; 5002 av++; 5003 } 5004 5005 if (c->limit_mask == 0) 5006 errx(EX_USAGE, "limit: missing limit mask"); 5007 5008 GET_UINT_ARG(c->conn_limit, IPFW_ARG_MIN, IPFW_ARG_MAX, 5009 TOK_LIMIT, rule_options); 5010 av++; 5011 5012 if (*av != NULL && *av[0] == ':') { 5013 if (state_check_name(*av + 1) != 0) 5014 errx(EX_DATAERR, 5015 "Invalid state name %s", *av); 5016 cmd->arg1 = pack_object(tstate, *av + 1, 5017 IPFW_TLV_STATE_NAME); 5018 av++; 5019 } else 5020 cmd->arg1 = pack_object(tstate, 5021 default_state_name, IPFW_TLV_STATE_NAME); 5022 break; 5023 } 5024 5025 case TOK_PROTO: 5026 NEED1("missing protocol"); 5027 if (add_proto(cmd, *av, &proto)) { 5028 av++; 5029 } else 5030 errx(EX_DATAERR, "invalid protocol ``%s''", 5031 *av); 5032 break; 5033 5034 case TOK_SRCIP: 5035 NEED1("missing source IP"); 5036 if (add_srcip(cmd, *av, cblen, tstate)) { 5037 av++; 5038 } 5039 break; 5040 5041 case TOK_DSTIP: 5042 NEED1("missing destination IP"); 5043 if (add_dstip(cmd, *av, cblen, tstate)) { 5044 av++; 5045 } 5046 break; 5047 5048 case TOK_SRCIP6: 5049 NEED1("missing source IP6"); 5050 if (add_srcip6(cmd, *av, cblen, tstate)) { 5051 av++; 5052 } 5053 break; 5054 5055 case TOK_DSTIP6: 5056 NEED1("missing destination IP6"); 5057 if (add_dstip6(cmd, *av, cblen, tstate)) { 5058 av++; 5059 } 5060 break; 5061 5062 5063 case TOK_SRCMAC: 5064 NEED1("missing source MAC"); 5065 if (add_srcmac(cmd, *av, tstate)) { 5066 av++; 5067 } 5068 break; 5069 5070 case TOK_DSTMAC: 5071 NEED1("missing destination MAC"); 5072 if (add_dstmac(cmd, *av, tstate)) { 5073 av++; 5074 } 5075 break; 5076 5077 case TOK_SRCPORT: 5078 NEED1("missing source port"); 5079 if (_substrcmp(*av, "any") == 0 || 5080 add_ports(cmd, *av, proto, O_IP_SRCPORT, cblen)) { 5081 av++; 5082 } else 5083 errx(EX_DATAERR, "invalid source port %s", *av); 5084 break; 5085 5086 case TOK_DSTPORT: 5087 NEED1("missing destination port"); 5088 if (_substrcmp(*av, "any") == 0 || 5089 add_ports(cmd, *av, proto, O_IP_DSTPORT, cblen)) { 5090 av++; 5091 } else 5092 errx(EX_DATAERR, "invalid destination port %s", 5093 *av); 5094 break; 5095 5096 case TOK_MAC: 5097 if (add_mac(cmd, av, cblen)) 5098 av += 2; 5099 break; 5100 5101 case TOK_MACTYPE: 5102 NEED1("missing mac type"); 5103 if (!add_mactype(cmd, *av, cblen)) 5104 errx(EX_DATAERR, "invalid mac type %s", *av); 5105 av++; 5106 break; 5107 5108 case TOK_VERREVPATH: 5109 fill_cmd(cmd, O_VERREVPATH, 0, 0); 5110 break; 5111 5112 case TOK_VERSRCREACH: 5113 fill_cmd(cmd, O_VERSRCREACH, 0, 0); 5114 break; 5115 5116 case TOK_ANTISPOOF: 5117 fill_cmd(cmd, O_ANTISPOOF, 0, 0); 5118 break; 5119 5120 case TOK_IPSEC: 5121 fill_cmd(cmd, O_IPSEC, 0, 0); 5122 break; 5123 5124 case TOK_IPV6: 5125 fill_cmd(cmd, O_IP6, 0, 0); 5126 break; 5127 5128 case TOK_IPV4: 5129 fill_cmd(cmd, O_IP4, 0, 0); 5130 break; 5131 5132 case TOK_EXT6HDR: 5133 NEED1("missing extension header"); 5134 fill_ext6hdr( cmd, *av ); 5135 av++; 5136 break; 5137 5138 case TOK_FLOWID: 5139 if (proto != IPPROTO_IPV6 ) 5140 errx( EX_USAGE, "flow-id filter is active " 5141 "only for ipv6 protocol\n"); 5142 fill_flow6( (ipfw_insn_u32 *) cmd, *av, cblen); 5143 av++; 5144 break; 5145 5146 case TOK_COMMENT: 5147 fill_comment(cmd, av, cblen); 5148 av[0]=NULL; 5149 break; 5150 5151 case TOK_TAGGED: 5152 if (av[0] && strpbrk(*av, "-,")) { 5153 if (!add_ports(cmd, *av, 0, O_TAGGED, cblen)) 5154 errx(EX_DATAERR, "tagged: invalid tag" 5155 " list: %s", *av); 5156 } 5157 else { 5158 uint16_t tag; 5159 5160 GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, 5161 TOK_TAGGED, rule_options); 5162 fill_cmd(cmd, O_TAGGED, 0, tag); 5163 } 5164 av++; 5165 break; 5166 5167 case TOK_FIB: 5168 NEED1("fib requires fib number"); 5169 fill_cmd(cmd, O_FIB, 0, strtoul(*av, NULL, 0)); 5170 av++; 5171 break; 5172 case TOK_SOCKARG: 5173 fill_cmd(cmd, O_SOCKARG, 0, 0); 5174 break; 5175 5176 case TOK_LOOKUP: { 5177 ipfw_insn_u32 *c = (ipfw_insn_u32 *)cmd; 5178 5179 if (!av[0] || !av[1]) 5180 errx(EX_USAGE, "format: lookup argument tablenum"); 5181 cmd->opcode = O_IP_DST_LOOKUP; 5182 cmd->len |= F_INSN_SIZE(ipfw_insn) + 2; 5183 i = match_token(lookup_keys, *av); 5184 if (i == -1) 5185 errx(EX_USAGE, "format: cannot lookup on %s", *av); 5186 __PAST_END(c->d, 1) = i; 5187 av++; 5188 5189 if ((i = pack_table(tstate, *av)) == 0) 5190 errx(EX_DATAERR, "Invalid table name: %s", *av); 5191 5192 cmd->arg1 = i; 5193 av++; 5194 } 5195 break; 5196 case TOK_FLOW: 5197 NEED1("missing table name"); 5198 if (strncmp(*av, "table(", 6) != 0) 5199 errx(EX_DATAERR, 5200 "enclose table name into \"table()\""); 5201 fill_table(cmd, *av, O_IP_FLOW_LOOKUP, tstate); 5202 av++; 5203 break; 5204 5205 case TOK_SKIPACTION: 5206 if (have_skipcmd) 5207 errx(EX_USAGE, "only one defer-action " 5208 "is allowed"); 5209 have_skipcmd = cmd; 5210 fill_cmd(cmd, O_SKIP_ACTION, 0, 0); 5211 break; 5212 5213 case TOK_MARK: 5214 NEED1("missing mark value:mask"); 5215 fill_mark(cmd, *av, cblen); 5216 av++; 5217 break; 5218 5219 default: 5220 errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s); 5221 } 5222 if (F_LEN(cmd) > 0) { /* prepare to advance */ 5223 prev = cmd; 5224 cmd = next_cmd(cmd, &cblen); 5225 } 5226 } 5227 5228 done: 5229 5230 if (!have_state && have_skipcmd) 5231 warnx("Rule contains \"defer-immediate-action\" " 5232 "and doesn't contain any state-related options."); 5233 5234 /* 5235 * Now copy stuff into the rule. 5236 * If we have a keep-state option, the first instruction 5237 * must be a PROBE_STATE (which is generated here). 5238 * If we have a LOG option, it was stored as the first command, 5239 * and now must be moved to the top of the action part. 5240 */ 5241 dst = (ipfw_insn *)rule->cmd; 5242 5243 /* 5244 * First thing to write into the command stream is the match probability. 5245 */ 5246 if (match_prob != 1) { /* 1 means always match */ 5247 dst->opcode = O_PROB; 5248 dst->len = 2; 5249 *((int32_t *)(dst+1)) = (int32_t)(match_prob * 0x7fffffff); 5250 dst += dst->len; 5251 } 5252 5253 /* 5254 * generate O_PROBE_STATE if necessary 5255 */ 5256 if (have_state && have_state->opcode != O_CHECK_STATE && !have_rstate) { 5257 fill_cmd(dst, O_PROBE_STATE, 0, have_state->arg1); 5258 dst = next_cmd(dst, &rblen); 5259 } 5260 5261 /* 5262 * copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT, O_ALTQ, O_TAG, 5263 * O_SKIP_ACTION 5264 */ 5265 for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) { 5266 i = F_LEN(src); 5267 CHECK_RBUFLEN(i); 5268 5269 switch (src->opcode) { 5270 case O_LOG: 5271 case O_KEEP_STATE: 5272 case O_LIMIT: 5273 case O_ALTQ: 5274 case O_TAG: 5275 case O_SKIP_ACTION: 5276 break; 5277 default: 5278 bcopy(src, dst, i * sizeof(uint32_t)); 5279 dst += i; 5280 } 5281 } 5282 5283 /* 5284 * put back the have_state command as last opcode 5285 */ 5286 if (have_state && have_state->opcode != O_CHECK_STATE) { 5287 i = F_LEN(have_state); 5288 CHECK_RBUFLEN(i); 5289 bcopy(have_state, dst, i * sizeof(uint32_t)); 5290 dst += i; 5291 } 5292 5293 /* 5294 * put back the have_skipcmd command as very last opcode 5295 */ 5296 if (have_skipcmd) { 5297 i = F_LEN(have_skipcmd); 5298 CHECK_RBUFLEN(i); 5299 bcopy(have_skipcmd, dst, i * sizeof(uint32_t)); 5300 dst += i; 5301 } 5302 5303 /* 5304 * start action section 5305 */ 5306 rule->act_ofs = dst - rule->cmd; 5307 5308 /* put back O_LOG, O_ALTQ, O_TAG if necessary */ 5309 if (have_log) { 5310 i = F_LEN(have_log); 5311 CHECK_RBUFLEN(i); 5312 bcopy(have_log, dst, i * sizeof(uint32_t)); 5313 dst += i; 5314 } 5315 if (have_altq) { 5316 i = F_LEN(have_altq); 5317 CHECK_RBUFLEN(i); 5318 bcopy(have_altq, dst, i * sizeof(uint32_t)); 5319 dst += i; 5320 } 5321 if (have_tag) { 5322 i = F_LEN(have_tag); 5323 CHECK_RBUFLEN(i); 5324 bcopy(have_tag, dst, i * sizeof(uint32_t)); 5325 dst += i; 5326 } 5327 5328 /* 5329 * copy all other actions 5330 */ 5331 for (src = (ipfw_insn *)actbuf; src != action; src += i) { 5332 i = F_LEN(src); 5333 CHECK_RBUFLEN(i); 5334 bcopy(src, dst, i * sizeof(uint32_t)); 5335 dst += i; 5336 } 5337 5338 rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd); 5339 *rbufsize = (char *)dst - (char *)rule; 5340 } 5341 5342 static int 5343 compare_ntlv(const void *_a, const void *_b) 5344 { 5345 const ipfw_obj_ntlv *a, *b; 5346 5347 a = (const ipfw_obj_ntlv *)_a; 5348 b = (const ipfw_obj_ntlv *)_b; 5349 5350 if (a->set < b->set) 5351 return (-1); 5352 else if (a->set > b->set) 5353 return (1); 5354 5355 if (a->idx < b->idx) 5356 return (-1); 5357 else if (a->idx > b->idx) 5358 return (1); 5359 5360 if (a->head.type < b->head.type) 5361 return (-1); 5362 else if (a->head.type > b->head.type) 5363 return (1); 5364 5365 return (0); 5366 } 5367 5368 /* 5369 * Provide kernel with sorted list of referenced objects 5370 */ 5371 static void 5372 object_sort_ctlv(ipfw_obj_ctlv *ctlv) 5373 { 5374 5375 qsort(ctlv + 1, ctlv->count, ctlv->objsize, compare_ntlv); 5376 } 5377 5378 struct object_kt { 5379 uint16_t uidx; 5380 uint16_t type; 5381 }; 5382 static int 5383 compare_object_kntlv(const void *k, const void *v) 5384 { 5385 const ipfw_obj_ntlv *ntlv; 5386 struct object_kt key; 5387 5388 key = *((const struct object_kt *)k); 5389 ntlv = (const ipfw_obj_ntlv *)v; 5390 5391 if (key.uidx < ntlv->idx) 5392 return (-1); 5393 else if (key.uidx > ntlv->idx) 5394 return (1); 5395 5396 if (key.type < ntlv->head.type) 5397 return (-1); 5398 else if (key.type > ntlv->head.type) 5399 return (1); 5400 5401 return (0); 5402 } 5403 5404 /* 5405 * Finds object name in @ctlv by @idx and @type. 5406 * Uses the following facts: 5407 * 1) All TLVs are the same size 5408 * 2) Kernel implementation provides already sorted list. 5409 * 5410 * Returns table name or NULL. 5411 */ 5412 static char * 5413 object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx, uint16_t type) 5414 { 5415 ipfw_obj_ntlv *ntlv; 5416 struct object_kt key; 5417 5418 key.uidx = idx; 5419 key.type = type; 5420 5421 ntlv = bsearch(&key, (ctlv + 1), ctlv->count, ctlv->objsize, 5422 compare_object_kntlv); 5423 5424 if (ntlv != NULL) 5425 return (ntlv->name); 5426 5427 return (NULL); 5428 } 5429 5430 static char * 5431 table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx) 5432 { 5433 5434 return (object_search_ctlv(ctlv, idx, IPFW_TLV_TBL_NAME)); 5435 } 5436 5437 /* 5438 * Adds one or more rules to ipfw chain. 5439 * Data layout: 5440 * Request: 5441 * [ 5442 * ip_fw3_opheader 5443 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional *1) 5444 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) [ ip_fw_rule ip_fw_insn ] x N ] (*2) (*3) 5445 * ] 5446 * Reply: 5447 * [ 5448 * ip_fw3_opheader 5449 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional) 5450 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) [ ip_fw_rule ip_fw_insn ] x N ] 5451 * ] 5452 * 5453 * Rules in reply are modified to store their actual ruleset number. 5454 * 5455 * (*1) TLVs inside IPFW_TLV_TBL_LIST needs to be sorted ascending 5456 * according to their idx field and there has to be no duplicates. 5457 * (*2) Numbered rules inside IPFW_TLV_RULE_LIST needs to be sorted ascending. 5458 * (*3) Each ip_fw structure needs to be aligned to u64 boundary. 5459 */ 5460 void 5461 ipfw_add(char *av[]) 5462 { 5463 uint32_t rulebuf[1024]; 5464 int rbufsize, default_off, tlen, rlen; 5465 size_t sz; 5466 struct tidx ts; 5467 struct ip_fw_rule *rule; 5468 caddr_t tbuf; 5469 ip_fw3_opheader *op3; 5470 ipfw_obj_ctlv *ctlv, *tstate; 5471 5472 rbufsize = sizeof(rulebuf); 5473 memset(rulebuf, 0, rbufsize); 5474 memset(&ts, 0, sizeof(ts)); 5475 5476 /* Optimize case with no tables */ 5477 default_off = sizeof(ipfw_obj_ctlv) + sizeof(ip_fw3_opheader); 5478 op3 = (ip_fw3_opheader *)rulebuf; 5479 ctlv = (ipfw_obj_ctlv *)(op3 + 1); 5480 rule = (struct ip_fw_rule *)(ctlv + 1); 5481 rbufsize -= default_off; 5482 5483 compile_rule(av, (uint32_t *)rule, &rbufsize, &ts); 5484 /* Align rule size to u64 boundary */ 5485 rlen = roundup2(rbufsize, sizeof(uint64_t)); 5486 5487 tbuf = NULL; 5488 sz = 0; 5489 tstate = NULL; 5490 if (ts.count != 0) { 5491 /* Some tables. We have to alloc more data */ 5492 tlen = ts.count * sizeof(ipfw_obj_ntlv); 5493 sz = default_off + sizeof(ipfw_obj_ctlv) + tlen + rlen; 5494 5495 if ((tbuf = calloc(1, sz)) == NULL) 5496 err(EX_UNAVAILABLE, "malloc() failed for IP_FW_ADD"); 5497 op3 = (ip_fw3_opheader *)tbuf; 5498 /* Tables first */ 5499 ctlv = (ipfw_obj_ctlv *)(op3 + 1); 5500 ctlv->head.type = IPFW_TLV_TBLNAME_LIST; 5501 ctlv->head.length = sizeof(ipfw_obj_ctlv) + tlen; 5502 ctlv->count = ts.count; 5503 ctlv->objsize = sizeof(ipfw_obj_ntlv); 5504 memcpy(ctlv + 1, ts.idx, tlen); 5505 object_sort_ctlv(ctlv); 5506 tstate = ctlv; 5507 /* Rule next */ 5508 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length); 5509 ctlv->head.type = IPFW_TLV_RULE_LIST; 5510 ctlv->head.length = sizeof(ipfw_obj_ctlv) + rlen; 5511 ctlv->count = 1; 5512 memcpy(ctlv + 1, rule, rbufsize); 5513 } else { 5514 /* Simply add header */ 5515 sz = rlen + default_off; 5516 memset(ctlv, 0, sizeof(*ctlv)); 5517 ctlv->head.type = IPFW_TLV_RULE_LIST; 5518 ctlv->head.length = sizeof(ipfw_obj_ctlv) + rlen; 5519 ctlv->count = 1; 5520 } 5521 5522 if (do_get3(IP_FW_XADD, op3, &sz) != 0) 5523 err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_XADD"); 5524 5525 if (!g_co.do_quiet) { 5526 struct format_opts sfo; 5527 struct buf_pr bp; 5528 memset(&sfo, 0, sizeof(sfo)); 5529 sfo.tstate = tstate; 5530 sfo.set_mask = (uint32_t)(-1); 5531 bp_alloc(&bp, 4096); 5532 show_static_rule(&g_co, &sfo, &bp, rule, NULL); 5533 printf("%s", bp.buf); 5534 bp_free(&bp); 5535 } 5536 5537 if (tbuf != NULL) 5538 free(tbuf); 5539 5540 if (ts.idx != NULL) 5541 free(ts.idx); 5542 } 5543 5544 /* 5545 * clear the counters or the log counters. 5546 * optname has the following values: 5547 * 0 (zero both counters and logging) 5548 * 1 (zero logging only) 5549 */ 5550 void 5551 ipfw_zero(int ac, char *av[], int optname) 5552 { 5553 ipfw_range_tlv rt; 5554 char const *errstr; 5555 char const *name = optname ? "RESETLOG" : "ZERO"; 5556 uint32_t arg; 5557 int failed = EX_OK; 5558 5559 optname = optname ? IP_FW_XRESETLOG : IP_FW_XZERO; 5560 av++; ac--; 5561 5562 if (ac == 0) { 5563 /* clear all entries */ 5564 memset(&rt, 0, sizeof(rt)); 5565 rt.flags = IPFW_RCFLAG_ALL; 5566 if (do_range_cmd(optname, &rt) < 0) 5567 err(EX_UNAVAILABLE, "setsockopt(IP_FW_X%s)", name); 5568 if (!g_co.do_quiet) 5569 printf("%s.\n", optname == IP_FW_XZERO ? 5570 "Accounting cleared":"Logging counts reset"); 5571 5572 return; 5573 } 5574 5575 while (ac) { 5576 /* Rule number */ 5577 if (isdigit(**av)) { 5578 arg = strtonum(*av, 0, 0xffff, &errstr); 5579 if (errstr) 5580 errx(EX_DATAERR, 5581 "invalid rule number %s\n", *av); 5582 memset(&rt, 0, sizeof(rt)); 5583 rt.start_rule = arg; 5584 rt.end_rule = arg; 5585 rt.flags |= IPFW_RCFLAG_RANGE; 5586 if (g_co.use_set != 0) { 5587 rt.set = g_co.use_set - 1; 5588 rt.flags |= IPFW_RCFLAG_SET; 5589 } 5590 if (do_range_cmd(optname, &rt) != 0) { 5591 warn("rule %u: setsockopt(IP_FW_X%s)", 5592 arg, name); 5593 failed = EX_UNAVAILABLE; 5594 } else if (rt.new_set == 0) { 5595 printf("Entry %d not found\n", arg); 5596 failed = EX_UNAVAILABLE; 5597 } else if (!g_co.do_quiet) 5598 printf("Entry %d %s.\n", arg, 5599 optname == IP_FW_XZERO ? 5600 "cleared" : "logging count reset"); 5601 } else { 5602 errx(EX_USAGE, "invalid rule number ``%s''", *av); 5603 } 5604 av++; ac--; 5605 } 5606 if (failed != EX_OK) 5607 exit(failed); 5608 } 5609 5610 void 5611 ipfw_flush(int force) 5612 { 5613 ipfw_range_tlv rt; 5614 5615 if (!force && !g_co.do_quiet) { /* need to ask user */ 5616 int c; 5617 5618 printf("Are you sure? [yn] "); 5619 fflush(stdout); 5620 do { 5621 c = toupper(getc(stdin)); 5622 while (c != '\n' && getc(stdin) != '\n') 5623 if (feof(stdin)) 5624 return; /* and do not flush */ 5625 } while (c != 'Y' && c != 'N'); 5626 printf("\n"); 5627 if (c == 'N') /* user said no */ 5628 return; 5629 } 5630 if (g_co.do_pipe) { 5631 dummynet_flush(); 5632 return; 5633 } 5634 /* `ipfw set N flush` - is the same that `ipfw delete set N` */ 5635 memset(&rt, 0, sizeof(rt)); 5636 if (g_co.use_set != 0) { 5637 rt.set = g_co.use_set - 1; 5638 rt.flags = IPFW_RCFLAG_SET; 5639 } else 5640 rt.flags = IPFW_RCFLAG_ALL; 5641 if (do_range_cmd(IP_FW_XDEL, &rt) != 0) 5642 err(EX_UNAVAILABLE, "setsockopt(IP_FW_XDEL)"); 5643 if (!g_co.do_quiet) 5644 printf("Flushed all %s.\n", g_co.do_pipe ? "pipes" : "rules"); 5645 } 5646 5647 static struct _s_x intcmds[] = { 5648 { "talist", TOK_TALIST }, 5649 { "iflist", TOK_IFLIST }, 5650 { "olist", TOK_OLIST }, 5651 { "vlist", TOK_VLIST }, 5652 { NULL, 0 } 5653 }; 5654 5655 static struct _s_x otypes[] = { 5656 { "EACTION", IPFW_TLV_EACTION }, 5657 { "DYNSTATE", IPFW_TLV_STATE_NAME }, 5658 { NULL, 0 } 5659 }; 5660 5661 static const char* 5662 lookup_eaction_name(ipfw_obj_ntlv *ntlv, int cnt, uint16_t type) 5663 { 5664 const char *name; 5665 int i; 5666 5667 name = NULL; 5668 for (i = 0; i < cnt; i++) { 5669 if (ntlv[i].head.type != IPFW_TLV_EACTION) 5670 continue; 5671 if (IPFW_TLV_EACTION_NAME(ntlv[i].idx) != type) 5672 continue; 5673 name = ntlv[i].name; 5674 break; 5675 } 5676 return (name); 5677 } 5678 5679 static void 5680 ipfw_list_objects(int ac __unused, char *av[] __unused) 5681 { 5682 ipfw_obj_lheader req, *olh; 5683 ipfw_obj_ntlv *ntlv; 5684 const char *name; 5685 size_t sz; 5686 uint32_t i; 5687 5688 memset(&req, 0, sizeof(req)); 5689 sz = sizeof(req); 5690 if (do_get3(IP_FW_DUMP_SRVOBJECTS, &req.opheader, &sz) != 0) 5691 if (errno != ENOMEM) 5692 return; 5693 5694 sz = req.size; 5695 if ((olh = calloc(1, sz)) == NULL) 5696 return; 5697 5698 olh->size = sz; 5699 if (do_get3(IP_FW_DUMP_SRVOBJECTS, &olh->opheader, &sz) != 0) { 5700 free(olh); 5701 return; 5702 } 5703 5704 if (olh->count > 0) 5705 printf("Objects list:\n"); 5706 else 5707 printf("There are no objects\n"); 5708 ntlv = (ipfw_obj_ntlv *)(olh + 1); 5709 for (i = 0; i < olh->count; i++) { 5710 name = match_value(otypes, ntlv->head.type); 5711 if (name == NULL) 5712 name = lookup_eaction_name( 5713 (ipfw_obj_ntlv *)(olh + 1), olh->count, 5714 ntlv->head.type); 5715 if (name == NULL) 5716 printf(" kidx: %4d\ttype: %10d\tname: %s\n", 5717 ntlv->idx, ntlv->head.type, ntlv->name); 5718 else 5719 printf(" kidx: %4d\ttype: %10s\tname: %s\n", 5720 ntlv->idx, name, ntlv->name); 5721 ntlv++; 5722 } 5723 free(olh); 5724 } 5725 5726 void 5727 ipfw_internal_handler(int ac, char *av[]) 5728 { 5729 int tcmd; 5730 5731 ac--; av++; 5732 NEED1("internal cmd required"); 5733 5734 if ((tcmd = match_token(intcmds, *av)) == -1) 5735 errx(EX_USAGE, "invalid internal sub-cmd: %s", *av); 5736 5737 switch (tcmd) { 5738 case TOK_IFLIST: 5739 ipfw_list_tifaces(); 5740 break; 5741 case TOK_TALIST: 5742 ipfw_list_ta(ac, av); 5743 break; 5744 case TOK_OLIST: 5745 ipfw_list_objects(ac, av); 5746 break; 5747 case TOK_VLIST: 5748 ipfw_list_values(ac, av); 5749 break; 5750 } 5751 } 5752 5753 static int 5754 ipfw_get_tracked_ifaces(ipfw_obj_lheader **polh) 5755 { 5756 ipfw_obj_lheader req, *olh; 5757 size_t sz; 5758 5759 memset(&req, 0, sizeof(req)); 5760 sz = sizeof(req); 5761 5762 if (do_get3(IP_FW_XIFLIST, &req.opheader, &sz) != 0) { 5763 if (errno != ENOMEM) 5764 return (errno); 5765 } 5766 5767 sz = req.size; 5768 if ((olh = calloc(1, sz)) == NULL) 5769 return (ENOMEM); 5770 5771 olh->size = sz; 5772 if (do_get3(IP_FW_XIFLIST, &olh->opheader, &sz) != 0) { 5773 free(olh); 5774 return (errno); 5775 } 5776 5777 *polh = olh; 5778 return (0); 5779 } 5780 5781 static int 5782 ifinfo_cmp(const void *a, const void *b) 5783 { 5784 const ipfw_iface_info *ia, *ib; 5785 5786 ia = (const ipfw_iface_info *)a; 5787 ib = (const ipfw_iface_info *)b; 5788 5789 return (stringnum_cmp(ia->ifname, ib->ifname)); 5790 } 5791 5792 /* 5793 * Retrieves table list from kernel, 5794 * optionally sorts it and calls requested function for each table. 5795 * Returns 0 on success. 5796 */ 5797 static void 5798 ipfw_list_tifaces(void) 5799 { 5800 ipfw_obj_lheader *olh = NULL; 5801 ipfw_iface_info *info; 5802 uint32_t i; 5803 int error; 5804 5805 if ((error = ipfw_get_tracked_ifaces(&olh)) != 0) 5806 err(EX_OSERR, "Unable to request ipfw tracked interface list"); 5807 5808 qsort(olh + 1, olh->count, olh->objsize, ifinfo_cmp); 5809 5810 info = (ipfw_iface_info *)(olh + 1); 5811 for (i = 0; i < olh->count; i++) { 5812 if (info->flags & IPFW_IFFLAG_RESOLVED) 5813 printf("%s ifindex: %d refcount: %u changes: %u\n", 5814 info->ifname, info->ifindex, info->refcnt, 5815 info->gencnt); 5816 else 5817 printf("%s ifindex: unresolved refcount: %u changes: %u\n", 5818 info->ifname, info->refcnt, info->gencnt); 5819 info = (ipfw_iface_info *)((caddr_t)info + olh->objsize); 5820 } 5821 5822 free(olh); 5823 } 5824