xref: /freebsd/sbin/ipfw/ipfw2.h (revision 39ee7a7a6bdd1557b1c3532abf60d139798ac88b)
1 /*
2  * Copyright (c) 2002-2003 Luigi Rizzo
3  * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
4  * Copyright (c) 1994 Ugen J.S.Antsilevich
5  *
6  * Idea and grammar partially left from:
7  * Copyright (c) 1993 Daniel Boulet
8  *
9  * Redistribution and use in source forms, with and without modification,
10  * are permitted provided that this entire comment appears intact.
11  *
12  * Redistribution in binary form may occur without any restrictions.
13  * Obviously, it would be nice if you gave credit where credit is due
14  * but requiring it would be too onerous.
15  *
16  * This software is provided ``AS IS'' without any warranties of any kind.
17  *
18  * NEW command line interface for IP firewall facility
19  *
20  * $FreeBSD$
21  */
22 
23 /*
24  * Options that can be set on the command line.
25  * When reading commands from a file, a subset of the options can also
26  * be applied globally by specifying them before the file name.
27  * After that, each line can contain its own option that changes
28  * the global value.
29  * XXX The context is not restored after each line.
30  */
31 
32 struct cmdline_opts {
33 	/* boolean options: */
34 	int	do_value_as_ip;	/* show table value as IP */
35 	int	do_resolv;	/* try to resolve all ip to names */
36 	int	do_time;	/* Show time stamps */
37 	int	do_quiet;	/* Be quiet in add and flush */
38 	int	do_pipe;	/* this cmd refers to a pipe/queue/sched */
39 	int	do_nat; 	/* this cmd refers to a nat config */
40 	int	do_dynamic;	/* display dynamic rules */
41 	int	do_expired;	/* display expired dynamic rules */
42 	int	do_compact;	/* show rules in compact mode */
43 	int	do_force;	/* do not ask for confirmation */
44 	int	show_sets;	/* display the set each rule belongs to */
45 	int	test_only;	/* only check syntax */
46 	int	comment_only;	/* only print action and comment */
47 	int	verbose;	/* be verbose on some commands */
48 
49 	/* The options below can have multiple values. */
50 
51 	int	do_sort;	/* field to sort results (0 = no) */
52 		/* valid fields are 1 and above */
53 
54 	int	use_set;	/* work with specified set number */
55 		/* 0 means all sets, otherwise apply to set use_set - 1 */
56 
57 };
58 
59 extern struct cmdline_opts co;
60 
61 /*
62  * _s_x is a structure that stores a string <-> token pairs, used in
63  * various places in the parser. Entries are stored in arrays,
64  * with an entry with s=NULL as terminator.
65  * The search routines are match_token() and match_value().
66  * Often, an element with x=0 contains an error string.
67  *
68  */
69 struct _s_x {
70 	char const *s;
71 	int x;
72 };
73 
74 extern struct _s_x f_ipdscp[];
75 
76 enum tokens {
77 	TOK_NULL=0,
78 
79 	TOK_OR,
80 	TOK_NOT,
81 	TOK_STARTBRACE,
82 	TOK_ENDBRACE,
83 
84 	TOK_ACCEPT,
85 	TOK_COUNT,
86 	TOK_PIPE,
87 	TOK_LINK,
88 	TOK_QUEUE,
89 	TOK_FLOWSET,
90 	TOK_SCHED,
91 	TOK_DIVERT,
92 	TOK_TEE,
93 	TOK_NETGRAPH,
94 	TOK_NGTEE,
95 	TOK_FORWARD,
96 	TOK_SKIPTO,
97 	TOK_DENY,
98 	TOK_REJECT,
99 	TOK_RESET,
100 	TOK_UNREACH,
101 	TOK_CHECKSTATE,
102 	TOK_NAT,
103 	TOK_REASS,
104 	TOK_CALL,
105 	TOK_RETURN,
106 
107 	TOK_ALTQ,
108 	TOK_LOG,
109 	TOK_TAG,
110 	TOK_UNTAG,
111 
112 	TOK_TAGGED,
113 	TOK_UID,
114 	TOK_GID,
115 	TOK_JAIL,
116 	TOK_IN,
117 	TOK_LIMIT,
118 	TOK_KEEPSTATE,
119 	TOK_LAYER2,
120 	TOK_OUT,
121 	TOK_DIVERTED,
122 	TOK_DIVERTEDLOOPBACK,
123 	TOK_DIVERTEDOUTPUT,
124 	TOK_XMIT,
125 	TOK_RECV,
126 	TOK_VIA,
127 	TOK_FRAG,
128 	TOK_IPOPTS,
129 	TOK_IPLEN,
130 	TOK_IPID,
131 	TOK_IPPRECEDENCE,
132 	TOK_DSCP,
133 	TOK_IPTOS,
134 	TOK_IPTTL,
135 	TOK_IPVER,
136 	TOK_ESTAB,
137 	TOK_SETUP,
138 	TOK_TCPDATALEN,
139 	TOK_TCPFLAGS,
140 	TOK_TCPOPTS,
141 	TOK_TCPSEQ,
142 	TOK_TCPACK,
143 	TOK_TCPWIN,
144 	TOK_ICMPTYPES,
145 	TOK_MAC,
146 	TOK_MACTYPE,
147 	TOK_VERREVPATH,
148 	TOK_VERSRCREACH,
149 	TOK_ANTISPOOF,
150 	TOK_IPSEC,
151 	TOK_COMMENT,
152 
153 	TOK_PLR,
154 	TOK_NOERROR,
155 	TOK_BUCKETS,
156 	TOK_DSTIP,
157 	TOK_SRCIP,
158 	TOK_DSTPORT,
159 	TOK_SRCPORT,
160 	TOK_ALL,
161 	TOK_MASK,
162 	TOK_FLOW_MASK,
163 	TOK_SCHED_MASK,
164 	TOK_BW,
165 	TOK_DELAY,
166 	TOK_PROFILE,
167 	TOK_BURST,
168 	TOK_RED,
169 	TOK_GRED,
170 	TOK_ECN,
171 	TOK_DROPTAIL,
172 	TOK_PROTO,
173 	/* dummynet tokens */
174 	TOK_WEIGHT,
175 	TOK_LMAX,
176 	TOK_PRI,
177 	TOK_TYPE,
178 	TOK_SLOTSIZE,
179 
180 	TOK_IP,
181 	TOK_IF,
182  	TOK_ALOG,
183  	TOK_DENY_INC,
184  	TOK_SAME_PORTS,
185  	TOK_UNREG_ONLY,
186 	TOK_SKIP_GLOBAL,
187  	TOK_RESET_ADDR,
188  	TOK_ALIAS_REV,
189  	TOK_PROXY_ONLY,
190 	TOK_REDIR_ADDR,
191 	TOK_REDIR_PORT,
192 	TOK_REDIR_PROTO,
193 
194 	TOK_IPV6,
195 	TOK_FLOWID,
196 	TOK_ICMP6TYPES,
197 	TOK_EXT6HDR,
198 	TOK_DSTIP6,
199 	TOK_SRCIP6,
200 
201 	TOK_IPV4,
202 	TOK_UNREACH6,
203 	TOK_RESET6,
204 
205 	TOK_FIB,
206 	TOK_SETFIB,
207 	TOK_LOOKUP,
208 	TOK_SOCKARG,
209 	TOK_SETDSCP,
210 	TOK_FLOW,
211 	TOK_IFLIST,
212 	/* Table tokens */
213 	TOK_CREATE,
214 	TOK_DESTROY,
215 	TOK_LIST,
216 	TOK_INFO,
217 	TOK_DETAIL,
218 	TOK_MODIFY,
219 	TOK_FLUSH,
220 	TOK_SWAP,
221 	TOK_ADD,
222 	TOK_DEL,
223 	TOK_VALTYPE,
224 	TOK_ALGO,
225 	TOK_TALIST,
226 	TOK_ATOMIC,
227 	TOK_LOCK,
228 	TOK_UNLOCK,
229 	TOK_VLIST,
230 };
231 
232 /*
233  * the following macro returns an error message if we run out of
234  * arguments.
235  */
236 #define NEED(_p, msg)      {if (!_p) errx(EX_USAGE, msg);}
237 #define NEED1(msg)      {if (!(*av)) errx(EX_USAGE, msg);}
238 
239 struct buf_pr {
240 	char	*buf;	/* allocated buffer */
241 	char	*ptr;	/* current pointer */
242 	size_t	size;	/* total buffer size */
243 	size_t	avail;	/* available storage */
244 	size_t	needed;	/* length needed */
245 };
246 
247 int pr_u64(struct buf_pr *bp, uint64_t *pd, int width);
248 int bp_alloc(struct buf_pr *b, size_t size);
249 void bp_free(struct buf_pr *b);
250 int bprintf(struct buf_pr *b, char *format, ...);
251 
252 
253 /* memory allocation support */
254 void *safe_calloc(size_t number, size_t size);
255 void *safe_realloc(void *ptr, size_t size);
256 
257 /* string comparison functions used for historical compatibility */
258 int _substrcmp(const char *str1, const char* str2);
259 int _substrcmp2(const char *str1, const char* str2, const char* str3);
260 int stringnum_cmp(const char *a, const char *b);
261 
262 /* utility functions */
263 int match_token(struct _s_x *table, char *string);
264 int match_token_relaxed(struct _s_x *table, char *string);
265 char const *match_value(struct _s_x *p, int value);
266 size_t concat_tokens(char *buf, size_t bufsize, struct _s_x *table,
267     char *delimiter);
268 int fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set,
269     uint32_t *clear);
270 void print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set);
271 
272 struct _ip_fw3_opheader;
273 int do_cmd(int optname, void *optval, uintptr_t optlen);
274 int do_set3(int optname, struct _ip_fw3_opheader *op3, uintptr_t optlen);
275 int do_get3(int optname, struct _ip_fw3_opheader *op3, size_t *optlen);
276 
277 struct in6_addr;
278 void n2mask(struct in6_addr *mask, int n);
279 int contigmask(uint8_t *p, int len);
280 
281 /*
282  * Forward declarations to avoid include way too many headers.
283  * C does not allow duplicated typedefs, so we use the base struct
284  * that the typedef points to.
285  * Should the typedefs use a different type, the compiler will
286  * still detect the change when compiling the body of the
287  * functions involved, so we do not lose error checking.
288  */
289 struct _ipfw_insn;
290 struct _ipfw_insn_altq;
291 struct _ipfw_insn_u32;
292 struct _ipfw_insn_ip6;
293 struct _ipfw_insn_icmp6;
294 
295 /*
296  * The reserved set numer. This is a constant in ip_fw.h
297  * but we store it in a variable so other files do not depend
298  * in that header just for one constant.
299  */
300 extern int resvd_set_number;
301 
302 /* first-level command handlers */
303 void ipfw_add(char *av[]);
304 void ipfw_show_nat(int ac, char **av);
305 void ipfw_config_pipe(int ac, char **av);
306 void ipfw_config_nat(int ac, char **av);
307 void ipfw_sets_handler(char *av[]);
308 void ipfw_table_handler(int ac, char *av[]);
309 void ipfw_sysctl_handler(char *av[], int which);
310 void ipfw_delete(char *av[]);
311 void ipfw_flush(int force);
312 void ipfw_zero(int ac, char *av[], int optname);
313 void ipfw_list(int ac, char *av[], int show_counters);
314 void ipfw_internal_handler(int ac, char *av[]);
315 
316 #ifdef PF
317 /* altq.c */
318 void altq_set_enabled(int enabled);
319 u_int32_t altq_name_to_qid(const char *name);
320 void print_altq_cmd(struct buf_pr *bp, struct _ipfw_insn_altq *altqptr);
321 #else
322 #define NO_ALTQ
323 #endif
324 
325 /* dummynet.c */
326 void dummynet_list(int ac, char *av[], int show_counters);
327 void dummynet_flush(void);
328 int ipfw_delete_pipe(int pipe_or_queue, int n);
329 
330 /* ipv6.c */
331 void print_unreach6_code(uint16_t code);
332 void print_ip6(struct buf_pr *bp, struct _ipfw_insn_ip6 *cmd, char const *s);
333 void print_flow6id(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd);
334 void print_icmp6types(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd);
335 void print_ext6hdr(struct buf_pr *bp, struct _ipfw_insn *cmd );
336 
337 struct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av, int cblen);
338 struct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av, int cblen);
339 
340 void fill_flow6(struct _ipfw_insn_u32 *cmd, char *av, int cblen);
341 void fill_unreach6_code(u_short *codep, char *str);
342 void fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av, int cblen);
343 int fill_ext6hdr(struct _ipfw_insn *cmd, char *av);
344 
345 /* tables.c */
346 struct _ipfw_obj_ctlv;
347 int table_check_name(char *tablename);
348 void ipfw_list_ta(int ac, char *av[]);
349 void ipfw_list_values(int ac, char *av[]);
350 
351