17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * Copyright (C) 1993-2001 by Darren Reed.
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing.
57c478bd9Sstevel@tonic-gate *
6ea8244dcSJohn Ojemann * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
77c478bd9Sstevel@tonic-gate * Use is subject to license terms.
8*94bdecd9SRob Gulewich *
9*94bdecd9SRob Gulewich * Copyright (c) 2014, Joyent, Inc. All rights reserved.
107c478bd9Sstevel@tonic-gate */
117c478bd9Sstevel@tonic-gate
127c478bd9Sstevel@tonic-gate #ifdef __FreeBSD__
137c478bd9Sstevel@tonic-gate # ifndef __FreeBSD_cc_version
147c478bd9Sstevel@tonic-gate # include <osreldate.h>
157c478bd9Sstevel@tonic-gate # else
167c478bd9Sstevel@tonic-gate # if __FreeBSD_cc_version < 430000
177c478bd9Sstevel@tonic-gate # include <osreldate.h>
187c478bd9Sstevel@tonic-gate # endif
197c478bd9Sstevel@tonic-gate # endif
207c478bd9Sstevel@tonic-gate #endif
217c478bd9Sstevel@tonic-gate #include "ipf.h"
227c478bd9Sstevel@tonic-gate #include <fcntl.h>
237c478bd9Sstevel@tonic-gate #include <sys/ioctl.h>
247c478bd9Sstevel@tonic-gate #include "netinet/ipl.h"
25*94bdecd9SRob Gulewich #include "ipfzone.h"
267c478bd9Sstevel@tonic-gate
277c478bd9Sstevel@tonic-gate #if !defined(lint)
287c478bd9Sstevel@tonic-gate static const char sccsid[] = "@(#)ipf.c 1.23 6/5/96 (C) 1993-2000 Darren Reed";
29ab25eeb5Syz155240 static const char rcsid[] = "@(#)$Id: ipf.c,v 1.35.2.3 2004/12/15 18:27:17 darrenr Exp $";
307c478bd9Sstevel@tonic-gate #endif
317c478bd9Sstevel@tonic-gate
327c478bd9Sstevel@tonic-gate #if !defined(__SVR4) && defined(__GNUC__)
337c478bd9Sstevel@tonic-gate extern char *index __P((const char *, int));
347c478bd9Sstevel@tonic-gate #endif
357c478bd9Sstevel@tonic-gate
367c478bd9Sstevel@tonic-gate extern char *optarg;
377c478bd9Sstevel@tonic-gate extern int optind;
387c478bd9Sstevel@tonic-gate extern frentry_t *frtop;
397c478bd9Sstevel@tonic-gate
407c478bd9Sstevel@tonic-gate
41ab25eeb5Syz155240 void ipf_frsync __P((void));
427c478bd9Sstevel@tonic-gate void zerostats __P((void));
437c478bd9Sstevel@tonic-gate int main __P((int, char *[]));
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate int opts = 0;
467c478bd9Sstevel@tonic-gate int outputc = 0;
477c478bd9Sstevel@tonic-gate int use_inet6 = 0;
487c478bd9Sstevel@tonic-gate
497c478bd9Sstevel@tonic-gate static void procfile __P((char *, char *)), flushfilter __P((char *));
507c478bd9Sstevel@tonic-gate static void set_state __P((u_int)), showstats __P((friostat_t *));
517c478bd9Sstevel@tonic-gate static void packetlogon __P((char *)), swapactive __P((void));
527c478bd9Sstevel@tonic-gate static int opendevice __P((char *, int));
537c478bd9Sstevel@tonic-gate static void closedevice __P((void));
547c478bd9Sstevel@tonic-gate static char *ipfname = IPL_NAME;
557c478bd9Sstevel@tonic-gate static void usage __P((void));
567c478bd9Sstevel@tonic-gate static int showversion __P((void));
577c478bd9Sstevel@tonic-gate static int get_flags __P((void));
587c478bd9Sstevel@tonic-gate static void ipf_interceptadd __P((int, ioctlfunc_t, void *));
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate static int fd = -1;
617c478bd9Sstevel@tonic-gate static ioctlfunc_t iocfunctions[IPL_LOGSIZE] = { ioctl, ioctl, ioctl,
627c478bd9Sstevel@tonic-gate ioctl, ioctl, ioctl,
637c478bd9Sstevel@tonic-gate ioctl, ioctl };
647c478bd9Sstevel@tonic-gate
657c478bd9Sstevel@tonic-gate
usage()667c478bd9Sstevel@tonic-gate static void usage()
677c478bd9Sstevel@tonic-gate {
68*94bdecd9SRob Gulewich fprintf(stderr, "usage: ipf [-6AdDEGInoPrRsvVyzZ] %s %s %s",
69ab25eeb5Syz155240 "[-l block|pass|nomatch|state|nat]", "[-cc] [-F i|o|a|s|S|u]",
70*94bdecd9SRob Gulewich "[-f filename] [-T <tuneopts>] [zonename]\n");
717c478bd9Sstevel@tonic-gate exit(1);
727c478bd9Sstevel@tonic-gate }
737c478bd9Sstevel@tonic-gate
747c478bd9Sstevel@tonic-gate
main(argc,argv)757c478bd9Sstevel@tonic-gate int main(argc,argv)
767c478bd9Sstevel@tonic-gate int argc;
777c478bd9Sstevel@tonic-gate char *argv[];
787c478bd9Sstevel@tonic-gate {
797c478bd9Sstevel@tonic-gate int c;
80*94bdecd9SRob Gulewich const char *optstr = "6Ac:dDEf:F:GIl:noPrRsT:vVyzZ";
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate if (argc < 2)
837c478bd9Sstevel@tonic-gate usage();
847c478bd9Sstevel@tonic-gate
85*94bdecd9SRob Gulewich /*
86*94bdecd9SRob Gulewich * We need to set the zone name before calling the functions
87*94bdecd9SRob Gulewich * in the switch statement below. Note that ipf.c differs from the other
88*94bdecd9SRob Gulewich * tools in the ipfilter suite: the zone name is specified as the
89*94bdecd9SRob Gulewich * last argument, while the other tools use the -z option. ipf
90*94bdecd9SRob Gulewich * already has a -z option, so the last argument is used instead.
91*94bdecd9SRob Gulewich */
92*94bdecd9SRob Gulewich getzonearg(argc, argv, optstr);
93*94bdecd9SRob Gulewich
94*94bdecd9SRob Gulewich while ((c = getopt(argc, argv, optstr)) != -1) {
957c478bd9Sstevel@tonic-gate switch (c)
967c478bd9Sstevel@tonic-gate {
977c478bd9Sstevel@tonic-gate case '?' :
987c478bd9Sstevel@tonic-gate usage();
997c478bd9Sstevel@tonic-gate break;
1007c478bd9Sstevel@tonic-gate #ifdef USE_INET6
1017c478bd9Sstevel@tonic-gate case '6' :
1027c478bd9Sstevel@tonic-gate use_inet6 = 1;
1037c478bd9Sstevel@tonic-gate break;
1047c478bd9Sstevel@tonic-gate #endif
1057c478bd9Sstevel@tonic-gate case 'A' :
1067c478bd9Sstevel@tonic-gate opts &= ~OPT_INACTIVE;
1077c478bd9Sstevel@tonic-gate break;
108ab25eeb5Syz155240 case 'c' :
109ab25eeb5Syz155240 if (strcmp(optarg, "c") == 0)
1107c478bd9Sstevel@tonic-gate outputc = 1;
1117c478bd9Sstevel@tonic-gate break;
1127c478bd9Sstevel@tonic-gate case 'E' :
1137c478bd9Sstevel@tonic-gate set_state((u_int)1);
1147c478bd9Sstevel@tonic-gate break;
1157c478bd9Sstevel@tonic-gate case 'D' :
1167c478bd9Sstevel@tonic-gate set_state((u_int)0);
1177c478bd9Sstevel@tonic-gate break;
1187c478bd9Sstevel@tonic-gate case 'd' :
1197c478bd9Sstevel@tonic-gate opts ^= OPT_DEBUG;
1207c478bd9Sstevel@tonic-gate break;
1217c478bd9Sstevel@tonic-gate case 'f' :
1227c478bd9Sstevel@tonic-gate procfile(argv[0], optarg);
1237c478bd9Sstevel@tonic-gate break;
1247c478bd9Sstevel@tonic-gate case 'F' :
1257c478bd9Sstevel@tonic-gate flushfilter(optarg);
1267c478bd9Sstevel@tonic-gate break;
127*94bdecd9SRob Gulewich case 'G' :
128*94bdecd9SRob Gulewich /* Already handled by getzonearg() above */
129*94bdecd9SRob Gulewich break;
1307c478bd9Sstevel@tonic-gate case 'I' :
1317c478bd9Sstevel@tonic-gate opts ^= OPT_INACTIVE;
1327c478bd9Sstevel@tonic-gate break;
1337c478bd9Sstevel@tonic-gate case 'l' :
1347c478bd9Sstevel@tonic-gate packetlogon(optarg);
1357c478bd9Sstevel@tonic-gate break;
1367c478bd9Sstevel@tonic-gate case 'n' :
1377c478bd9Sstevel@tonic-gate opts ^= OPT_DONOTHING;
1387c478bd9Sstevel@tonic-gate break;
1397c478bd9Sstevel@tonic-gate case 'o' :
1407c478bd9Sstevel@tonic-gate break;
1417c478bd9Sstevel@tonic-gate case 'P' :
1427c478bd9Sstevel@tonic-gate ipfname = IPAUTH_NAME;
1437c478bd9Sstevel@tonic-gate break;
144ab25eeb5Syz155240 case 'R' :
145ab25eeb5Syz155240 opts ^= OPT_NORESOLVE;
146ab25eeb5Syz155240 break;
1477c478bd9Sstevel@tonic-gate case 'r' :
1487c478bd9Sstevel@tonic-gate opts ^= OPT_REMOVE;
1497c478bd9Sstevel@tonic-gate break;
1507c478bd9Sstevel@tonic-gate case 's' :
1517c478bd9Sstevel@tonic-gate swapactive();
1527c478bd9Sstevel@tonic-gate break;
1537c478bd9Sstevel@tonic-gate case 'T' :
154ab25eeb5Syz155240 if (opendevice(ipfname, 1) >= 0)
155ab25eeb5Syz155240 ipf_dotuning(fd, optarg, ioctl);
1567c478bd9Sstevel@tonic-gate break;
1577c478bd9Sstevel@tonic-gate case 'v' :
1587c478bd9Sstevel@tonic-gate opts += OPT_VERBOSE;
1597c478bd9Sstevel@tonic-gate break;
1607c478bd9Sstevel@tonic-gate case 'V' :
1617c478bd9Sstevel@tonic-gate if (showversion())
1627c478bd9Sstevel@tonic-gate exit(1);
1637c478bd9Sstevel@tonic-gate break;
1647c478bd9Sstevel@tonic-gate case 'y' :
165ab25eeb5Syz155240 ipf_frsync();
1667c478bd9Sstevel@tonic-gate break;
1677c478bd9Sstevel@tonic-gate case 'z' :
1687c478bd9Sstevel@tonic-gate opts ^= OPT_ZERORULEST;
1697c478bd9Sstevel@tonic-gate break;
1707c478bd9Sstevel@tonic-gate case 'Z' :
1717c478bd9Sstevel@tonic-gate zerostats();
1727c478bd9Sstevel@tonic-gate break;
1737c478bd9Sstevel@tonic-gate }
1747c478bd9Sstevel@tonic-gate }
1757c478bd9Sstevel@tonic-gate
1767c478bd9Sstevel@tonic-gate if (optind < 2)
1777c478bd9Sstevel@tonic-gate usage();
1787c478bd9Sstevel@tonic-gate
1797c478bd9Sstevel@tonic-gate if (fd != -1)
1807c478bd9Sstevel@tonic-gate (void) close(fd);
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gate return(0);
1837c478bd9Sstevel@tonic-gate /* NOTREACHED */
1847c478bd9Sstevel@tonic-gate }
1857c478bd9Sstevel@tonic-gate
1867c478bd9Sstevel@tonic-gate
opendevice(ipfdev,check)1877c478bd9Sstevel@tonic-gate static int opendevice(ipfdev, check)
1887c478bd9Sstevel@tonic-gate char *ipfdev;
1897c478bd9Sstevel@tonic-gate int check;
1907c478bd9Sstevel@tonic-gate {
1917c478bd9Sstevel@tonic-gate if (opts & OPT_DONOTHING)
1927c478bd9Sstevel@tonic-gate return -2;
1937c478bd9Sstevel@tonic-gate
1947c478bd9Sstevel@tonic-gate if (check && checkrev(ipfname) == -1) {
1957c478bd9Sstevel@tonic-gate fprintf(stderr, "User/kernel version check failed\n");
1967c478bd9Sstevel@tonic-gate return -2;
1977c478bd9Sstevel@tonic-gate }
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate if (!ipfdev)
2007c478bd9Sstevel@tonic-gate ipfdev = ipfname;
2017c478bd9Sstevel@tonic-gate
2027c478bd9Sstevel@tonic-gate if (fd == -1)
2037c478bd9Sstevel@tonic-gate if ((fd = open(ipfdev, O_RDWR)) == -1)
2047c478bd9Sstevel@tonic-gate if ((fd = open(ipfdev, O_RDONLY)) == -1)
2057c478bd9Sstevel@tonic-gate perror("open device");
206*94bdecd9SRob Gulewich
207*94bdecd9SRob Gulewich if (setzone(fd) != 0) {
208*94bdecd9SRob Gulewich close(fd);
209*94bdecd9SRob Gulewich return -2;
210*94bdecd9SRob Gulewich }
211*94bdecd9SRob Gulewich
2127c478bd9Sstevel@tonic-gate return fd;
2137c478bd9Sstevel@tonic-gate }
2147c478bd9Sstevel@tonic-gate
2157c478bd9Sstevel@tonic-gate
closedevice()2167c478bd9Sstevel@tonic-gate static void closedevice()
2177c478bd9Sstevel@tonic-gate {
2187c478bd9Sstevel@tonic-gate close(fd);
2197c478bd9Sstevel@tonic-gate fd = -1;
2207c478bd9Sstevel@tonic-gate }
2217c478bd9Sstevel@tonic-gate
2227c478bd9Sstevel@tonic-gate
get_flags()2237c478bd9Sstevel@tonic-gate static int get_flags()
2247c478bd9Sstevel@tonic-gate {
2257c478bd9Sstevel@tonic-gate int i;
2267c478bd9Sstevel@tonic-gate
2277c478bd9Sstevel@tonic-gate if ((opendevice(ipfname, 1) != -2) &&
2287c478bd9Sstevel@tonic-gate (ioctl(fd, SIOCGETFF, &i) == -1)) {
2297c478bd9Sstevel@tonic-gate perror("SIOCGETFF");
2307c478bd9Sstevel@tonic-gate return 0;
2317c478bd9Sstevel@tonic-gate }
2327c478bd9Sstevel@tonic-gate return i;
2337c478bd9Sstevel@tonic-gate }
2347c478bd9Sstevel@tonic-gate
2357c478bd9Sstevel@tonic-gate
set_state(enable)2367c478bd9Sstevel@tonic-gate static void set_state(enable)
2377c478bd9Sstevel@tonic-gate u_int enable;
2387c478bd9Sstevel@tonic-gate {
2397c478bd9Sstevel@tonic-gate if (opendevice(ipfname, 0) != -2)
2407c478bd9Sstevel@tonic-gate if (ioctl(fd, SIOCFRENB, &enable) == -1) {
2417c478bd9Sstevel@tonic-gate if (errno == EBUSY)
2427c478bd9Sstevel@tonic-gate fprintf(stderr,
2437c478bd9Sstevel@tonic-gate "IP FIlter: already initialized\n");
2447c478bd9Sstevel@tonic-gate else
2457c478bd9Sstevel@tonic-gate perror("SIOCFRENB");
2467c478bd9Sstevel@tonic-gate }
2477c478bd9Sstevel@tonic-gate return;
2487c478bd9Sstevel@tonic-gate }
2497c478bd9Sstevel@tonic-gate
2507c478bd9Sstevel@tonic-gate
procfile(name,file)2517c478bd9Sstevel@tonic-gate static void procfile(name, file)
2527c478bd9Sstevel@tonic-gate char *name, *file;
2537c478bd9Sstevel@tonic-gate {
2547c478bd9Sstevel@tonic-gate (void) opendevice(ipfname, 1);
2557c478bd9Sstevel@tonic-gate
2567c478bd9Sstevel@tonic-gate initparse();
2577c478bd9Sstevel@tonic-gate
2587c478bd9Sstevel@tonic-gate ipf_parsefile(fd, ipf_interceptadd, iocfunctions, file);
2597c478bd9Sstevel@tonic-gate
2607c478bd9Sstevel@tonic-gate if (outputc) {
2617c478bd9Sstevel@tonic-gate printC(0);
2627c478bd9Sstevel@tonic-gate printC(1);
2637c478bd9Sstevel@tonic-gate emit(-1, -1, NULL, NULL);
2647c478bd9Sstevel@tonic-gate }
2657c478bd9Sstevel@tonic-gate }
2667c478bd9Sstevel@tonic-gate
2677c478bd9Sstevel@tonic-gate
ipf_interceptadd(fd,ioctlfunc,ptr)2687c478bd9Sstevel@tonic-gate static void ipf_interceptadd(fd, ioctlfunc, ptr)
2697c478bd9Sstevel@tonic-gate int fd;
2707c478bd9Sstevel@tonic-gate ioctlfunc_t ioctlfunc;
2717c478bd9Sstevel@tonic-gate void *ptr;
2727c478bd9Sstevel@tonic-gate {
2737c478bd9Sstevel@tonic-gate if (outputc)
2747c478bd9Sstevel@tonic-gate printc(ptr);
2757c478bd9Sstevel@tonic-gate
2767c478bd9Sstevel@tonic-gate ipf_addrule(fd, ioctlfunc, ptr);
2777c478bd9Sstevel@tonic-gate }
2787c478bd9Sstevel@tonic-gate
2797c478bd9Sstevel@tonic-gate
packetlogon(opt)2807c478bd9Sstevel@tonic-gate static void packetlogon(opt)
2817c478bd9Sstevel@tonic-gate char *opt;
2827c478bd9Sstevel@tonic-gate {
283ab25eeb5Syz155240 int flag, xfd, logopt, change = 0;
2847c478bd9Sstevel@tonic-gate
2857c478bd9Sstevel@tonic-gate flag = get_flags();
2867c478bd9Sstevel@tonic-gate if (flag != 0) {
2877c478bd9Sstevel@tonic-gate if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE)
2887c478bd9Sstevel@tonic-gate printf("log flag is currently %#x\n", flag);
2897c478bd9Sstevel@tonic-gate }
2907c478bd9Sstevel@tonic-gate
2917c478bd9Sstevel@tonic-gate flag &= ~(FF_LOGPASS|FF_LOGNOMATCH|FF_LOGBLOCK);
2927c478bd9Sstevel@tonic-gate
2937c478bd9Sstevel@tonic-gate if (strstr(opt, "pass")) {
2947c478bd9Sstevel@tonic-gate flag |= FF_LOGPASS;
2957c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
2967c478bd9Sstevel@tonic-gate printf("set log flag: pass\n");
297ab25eeb5Syz155240 change = 1;
2987c478bd9Sstevel@tonic-gate }
2997c478bd9Sstevel@tonic-gate if (strstr(opt, "nomatch")) {
3007c478bd9Sstevel@tonic-gate flag |= FF_LOGNOMATCH;
3017c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
3027c478bd9Sstevel@tonic-gate printf("set log flag: nomatch\n");
303ab25eeb5Syz155240 change = 1;
3047c478bd9Sstevel@tonic-gate }
3057c478bd9Sstevel@tonic-gate if (strstr(opt, "block") || index(opt, 'd')) {
3067c478bd9Sstevel@tonic-gate flag |= FF_LOGBLOCK;
3077c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
3087c478bd9Sstevel@tonic-gate printf("set log flag: block\n");
309ab25eeb5Syz155240 change = 1;
310ab25eeb5Syz155240 }
311ab25eeb5Syz155240 if (strstr(opt, "none")) {
312ab25eeb5Syz155240 if (opts & OPT_VERBOSE)
313ab25eeb5Syz155240 printf("disable all log flags\n");
314ab25eeb5Syz155240 change = 1;
3157c478bd9Sstevel@tonic-gate }
3167c478bd9Sstevel@tonic-gate
317ab25eeb5Syz155240 if (change == 1) {
318ab25eeb5Syz155240 if (opendevice(ipfname, 1) != -2 &&
319ab25eeb5Syz155240 (ioctl(fd, SIOCSETFF, &flag) != 0))
3207c478bd9Sstevel@tonic-gate perror("ioctl(SIOCSETFF)");
321ab25eeb5Syz155240 }
3227c478bd9Sstevel@tonic-gate
3237c478bd9Sstevel@tonic-gate if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
3247c478bd9Sstevel@tonic-gate flag = get_flags();
325ab25eeb5Syz155240 printf("log flags are now %#x\n", flag);
3267c478bd9Sstevel@tonic-gate }
3277c478bd9Sstevel@tonic-gate
3287c478bd9Sstevel@tonic-gate if (strstr(opt, "state")) {
3297c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
3307c478bd9Sstevel@tonic-gate printf("set state log flag\n");
3317c478bd9Sstevel@tonic-gate xfd = open(IPSTATE_NAME, O_RDWR);
332*94bdecd9SRob Gulewich if (xfd >= 0 && setzone(xfd) != 0) {
333*94bdecd9SRob Gulewich close(xfd);
334*94bdecd9SRob Gulewich xfd = -1;
335*94bdecd9SRob Gulewich }
336*94bdecd9SRob Gulewich
3377c478bd9Sstevel@tonic-gate if (xfd >= 0) {
3387c478bd9Sstevel@tonic-gate logopt = 0;
3397c478bd9Sstevel@tonic-gate if (ioctl(xfd, SIOCGETLG, &logopt))
3407c478bd9Sstevel@tonic-gate perror("ioctl(SIOCGETLG)");
3417c478bd9Sstevel@tonic-gate else {
3427c478bd9Sstevel@tonic-gate logopt = 1 - logopt;
3437c478bd9Sstevel@tonic-gate if (ioctl(xfd, SIOCSETLG, &logopt))
3447c478bd9Sstevel@tonic-gate perror("ioctl(SIOCSETLG)");
3457c478bd9Sstevel@tonic-gate }
3467c478bd9Sstevel@tonic-gate close(xfd);
3477c478bd9Sstevel@tonic-gate }
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate
3507c478bd9Sstevel@tonic-gate if (strstr(opt, "nat")) {
3517c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
3527c478bd9Sstevel@tonic-gate printf("set nat log flag\n");
3537c478bd9Sstevel@tonic-gate xfd = open(IPNAT_NAME, O_RDWR);
354*94bdecd9SRob Gulewich if (xfd >= 0 && setzone(xfd) != 0) {
355*94bdecd9SRob Gulewich close(xfd);
356*94bdecd9SRob Gulewich xfd = -1;
357*94bdecd9SRob Gulewich }
358*94bdecd9SRob Gulewich
3597c478bd9Sstevel@tonic-gate if (xfd >= 0) {
3607c478bd9Sstevel@tonic-gate logopt = 0;
3617c478bd9Sstevel@tonic-gate if (ioctl(xfd, SIOCGETLG, &logopt))
3627c478bd9Sstevel@tonic-gate perror("ioctl(SIOCGETLG)");
3637c478bd9Sstevel@tonic-gate else {
3647c478bd9Sstevel@tonic-gate logopt = 1 - logopt;
3657c478bd9Sstevel@tonic-gate if (ioctl(xfd, SIOCSETLG, &logopt))
3667c478bd9Sstevel@tonic-gate perror("ioctl(SIOCSETLG)");
3677c478bd9Sstevel@tonic-gate }
3687c478bd9Sstevel@tonic-gate close(xfd);
3697c478bd9Sstevel@tonic-gate }
3707c478bd9Sstevel@tonic-gate }
3717c478bd9Sstevel@tonic-gate }
3727c478bd9Sstevel@tonic-gate
3737c478bd9Sstevel@tonic-gate
flushfilter(arg)3747c478bd9Sstevel@tonic-gate static void flushfilter(arg)
3757c478bd9Sstevel@tonic-gate char *arg;
3767c478bd9Sstevel@tonic-gate {
3777c478bd9Sstevel@tonic-gate int fl = 0, rem;
3787c478bd9Sstevel@tonic-gate
3797c478bd9Sstevel@tonic-gate if (!arg || !*arg)
3807c478bd9Sstevel@tonic-gate return;
3817c478bd9Sstevel@tonic-gate if (!strcmp(arg, "s") || !strcmp(arg, "S")) {
3827c478bd9Sstevel@tonic-gate if (*arg == 'S')
383ea8244dcSJohn Ojemann fl = FLUSH_TABLE_ALL;
3847c478bd9Sstevel@tonic-gate else
385ea8244dcSJohn Ojemann fl = FLUSH_TABLE_CLOSING;
3867c478bd9Sstevel@tonic-gate rem = fl;
3877c478bd9Sstevel@tonic-gate
3887c478bd9Sstevel@tonic-gate closedevice();
389ab25eeb5Syz155240 if (opendevice(IPSTATE_NAME, 1) == -2)
390ab25eeb5Syz155240 exit(1);
3917663b816Sml37995
392ab25eeb5Syz155240 if (!(opts & OPT_DONOTHING)) {
3937663b816Sml37995 if (use_inet6) {
394ab25eeb5Syz155240 if (ioctl(fd, SIOCIPFL6, &fl) == -1) {
395ab25eeb5Syz155240 perror("ioctl(SIOCIPFL6)");
396ab25eeb5Syz155240 exit(1);
397ab25eeb5Syz155240 }
3987663b816Sml37995 } else {
399ab25eeb5Syz155240 if (ioctl(fd, SIOCIPFFL, &fl) == -1) {
400ab25eeb5Syz155240 perror("ioctl(SIOCIPFFL)");
401ab25eeb5Syz155240 exit(1);
4027663b816Sml37995 }
4037663b816Sml37995 }
404ab25eeb5Syz155240 }
4057c478bd9Sstevel@tonic-gate if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
4067c478bd9Sstevel@tonic-gate printf("remove flags %s (%d)\n", arg, rem);
4077c478bd9Sstevel@tonic-gate printf("removed %d filter rules\n", fl);
4087c478bd9Sstevel@tonic-gate }
4097c478bd9Sstevel@tonic-gate closedevice();
4107c478bd9Sstevel@tonic-gate return;
4117c478bd9Sstevel@tonic-gate }
4127c478bd9Sstevel@tonic-gate
4137c478bd9Sstevel@tonic-gate #ifdef SIOCIPFFA
4147c478bd9Sstevel@tonic-gate if (!strcmp(arg, "u")) {
4157c478bd9Sstevel@tonic-gate closedevice();
4167c478bd9Sstevel@tonic-gate /*
4177c478bd9Sstevel@tonic-gate * Flush auth rules and packets
4187c478bd9Sstevel@tonic-gate */
4197c478bd9Sstevel@tonic-gate if (opendevice(IPL_AUTH, 1) == -1)
4207c478bd9Sstevel@tonic-gate perror("open(IPL_AUTH)");
4217c478bd9Sstevel@tonic-gate else {
4227c478bd9Sstevel@tonic-gate if (ioctl(fd, SIOCIPFFA, &fl) == -1)
4237c478bd9Sstevel@tonic-gate perror("ioctl(SIOCIPFFA)");
4247c478bd9Sstevel@tonic-gate }
4257c478bd9Sstevel@tonic-gate closedevice();
4267c478bd9Sstevel@tonic-gate return;
4277c478bd9Sstevel@tonic-gate }
4287c478bd9Sstevel@tonic-gate #endif
4297c478bd9Sstevel@tonic-gate
4307c478bd9Sstevel@tonic-gate if (strchr(arg, 'i') || strchr(arg, 'I'))
4317c478bd9Sstevel@tonic-gate fl = FR_INQUE;
4327c478bd9Sstevel@tonic-gate if (strchr(arg, 'o') || strchr(arg, 'O'))
4337c478bd9Sstevel@tonic-gate fl = FR_OUTQUE;
4347c478bd9Sstevel@tonic-gate if (strchr(arg, 'a') || strchr(arg, 'A'))
4357c478bd9Sstevel@tonic-gate fl = FR_OUTQUE|FR_INQUE;
4367c478bd9Sstevel@tonic-gate if (opts & OPT_INACTIVE)
4377c478bd9Sstevel@tonic-gate fl |= FR_INACTIVE;
4387c478bd9Sstevel@tonic-gate rem = fl;
4397c478bd9Sstevel@tonic-gate
440ab25eeb5Syz155240 if (opendevice(ipfname, 1) == -2)
441ab25eeb5Syz155240 exit(1);
442ab25eeb5Syz155240
443ab25eeb5Syz155240 if (!(opts & OPT_DONOTHING)) {
4447663b816Sml37995 if (use_inet6) {
445ab25eeb5Syz155240 if (ioctl(fd, SIOCIPFL6, &fl) == -1) {
446ab25eeb5Syz155240 perror("ioctl(SIOCIPFL6)");
447ab25eeb5Syz155240 exit(1);
448ab25eeb5Syz155240 }
4497663b816Sml37995 } else {
450ab25eeb5Syz155240 if (ioctl(fd, SIOCIPFFL, &fl) == -1) {
451ab25eeb5Syz155240 perror("ioctl(SIOCIPFFL)");
452ab25eeb5Syz155240 exit(1);
453ab25eeb5Syz155240 }
4547663b816Sml37995 }
4557663b816Sml37995 }
4567663b816Sml37995
4577c478bd9Sstevel@tonic-gate if ((opts & (OPT_DONOTHING|OPT_VERBOSE)) == OPT_VERBOSE) {
4587c478bd9Sstevel@tonic-gate printf("remove flags %s%s (%d)\n", (rem & FR_INQUE) ? "I" : "",
4597c478bd9Sstevel@tonic-gate (rem & FR_OUTQUE) ? "O" : "", rem);
4607c478bd9Sstevel@tonic-gate printf("removed %d filter rules\n", fl);
4617c478bd9Sstevel@tonic-gate }
4627c478bd9Sstevel@tonic-gate return;
4637c478bd9Sstevel@tonic-gate }
4647c478bd9Sstevel@tonic-gate
4657c478bd9Sstevel@tonic-gate
swapactive()4667c478bd9Sstevel@tonic-gate static void swapactive()
4677c478bd9Sstevel@tonic-gate {
4687c478bd9Sstevel@tonic-gate int in = 2;
4697c478bd9Sstevel@tonic-gate
4707c478bd9Sstevel@tonic-gate if (opendevice(ipfname, 1) != -2 && ioctl(fd, SIOCSWAPA, &in) == -1)
4717c478bd9Sstevel@tonic-gate perror("ioctl(SIOCSWAPA)");
4727c478bd9Sstevel@tonic-gate else
4737c478bd9Sstevel@tonic-gate printf("Set %d now inactive\n", in);
4747c478bd9Sstevel@tonic-gate }
4757c478bd9Sstevel@tonic-gate
4767c478bd9Sstevel@tonic-gate
ipf_frsync()477ab25eeb5Syz155240 void ipf_frsync()
4787c478bd9Sstevel@tonic-gate {
4797c478bd9Sstevel@tonic-gate int frsyn = 0;
4807c478bd9Sstevel@tonic-gate
4817c478bd9Sstevel@tonic-gate if (opendevice(ipfname, 1) != -2 && ioctl(fd, SIOCFRSYN, &frsyn) == -1)
4827c478bd9Sstevel@tonic-gate perror("SIOCFRSYN");
4837c478bd9Sstevel@tonic-gate else
4847c478bd9Sstevel@tonic-gate printf("filter sync'd\n");
4857c478bd9Sstevel@tonic-gate }
4867c478bd9Sstevel@tonic-gate
4877c478bd9Sstevel@tonic-gate
zerostats()4887c478bd9Sstevel@tonic-gate void zerostats()
4897c478bd9Sstevel@tonic-gate {
4907c478bd9Sstevel@tonic-gate friostat_t fio;
4917c478bd9Sstevel@tonic-gate friostat_t *fiop = &fio;
4927c478bd9Sstevel@tonic-gate
4937c478bd9Sstevel@tonic-gate if (opendevice(ipfname, 1) != -2) {
4947c478bd9Sstevel@tonic-gate if (ioctl(fd, SIOCFRZST, &fiop) == -1) {
4957c478bd9Sstevel@tonic-gate perror("ioctl(SIOCFRZST)");
4967c478bd9Sstevel@tonic-gate exit(-1);
4977c478bd9Sstevel@tonic-gate }
4987c478bd9Sstevel@tonic-gate showstats(fiop);
4997c478bd9Sstevel@tonic-gate }
5007c478bd9Sstevel@tonic-gate
5017c478bd9Sstevel@tonic-gate }
5027c478bd9Sstevel@tonic-gate
5037c478bd9Sstevel@tonic-gate
5047c478bd9Sstevel@tonic-gate /*
5057c478bd9Sstevel@tonic-gate * read the kernel stats for packets blocked and passed
5067c478bd9Sstevel@tonic-gate */
showstats(fp)5077c478bd9Sstevel@tonic-gate static void showstats(fp)
5087c478bd9Sstevel@tonic-gate friostat_t *fp;
5097c478bd9Sstevel@tonic-gate {
5107c478bd9Sstevel@tonic-gate printf("bad packets:\t\tin %lu\tout %lu\n",
5117c478bd9Sstevel@tonic-gate fp->f_st[0].fr_bad, fp->f_st[1].fr_bad);
5127c478bd9Sstevel@tonic-gate printf(" input packets:\t\tblocked %lu passed %lu nomatch %lu",
5137c478bd9Sstevel@tonic-gate fp->f_st[0].fr_block, fp->f_st[0].fr_pass,
5147c478bd9Sstevel@tonic-gate fp->f_st[0].fr_nom);
5157c478bd9Sstevel@tonic-gate printf(" counted %lu\n", fp->f_st[0].fr_acct);
5167c478bd9Sstevel@tonic-gate printf("output packets:\t\tblocked %lu passed %lu nomatch %lu",
5177c478bd9Sstevel@tonic-gate fp->f_st[1].fr_block, fp->f_st[1].fr_pass,
5187c478bd9Sstevel@tonic-gate fp->f_st[1].fr_nom);
5197c478bd9Sstevel@tonic-gate printf(" counted %lu\n", fp->f_st[0].fr_acct);
5207c478bd9Sstevel@tonic-gate printf(" input packets logged:\tblocked %lu passed %lu\n",
5217c478bd9Sstevel@tonic-gate fp->f_st[0].fr_bpkl, fp->f_st[0].fr_ppkl);
5227c478bd9Sstevel@tonic-gate printf("output packets logged:\tblocked %lu passed %lu\n",
5237c478bd9Sstevel@tonic-gate fp->f_st[1].fr_bpkl, fp->f_st[1].fr_ppkl);
5247c478bd9Sstevel@tonic-gate printf(" packets logged:\tinput %lu-%lu output %lu-%lu\n",
5257c478bd9Sstevel@tonic-gate fp->f_st[0].fr_pkl, fp->f_st[0].fr_skip,
5267c478bd9Sstevel@tonic-gate fp->f_st[1].fr_pkl, fp->f_st[1].fr_skip);
5277c478bd9Sstevel@tonic-gate }
5287c478bd9Sstevel@tonic-gate
5297c478bd9Sstevel@tonic-gate
showversion()5307c478bd9Sstevel@tonic-gate static int showversion()
5317c478bd9Sstevel@tonic-gate {
5327c478bd9Sstevel@tonic-gate struct friostat fio;
5337c478bd9Sstevel@tonic-gate ipfobj_t ipfo;
5347c478bd9Sstevel@tonic-gate u_32_t flags;
5357c478bd9Sstevel@tonic-gate char *s;
5367c478bd9Sstevel@tonic-gate int vfd;
5377c478bd9Sstevel@tonic-gate
5387c478bd9Sstevel@tonic-gate bzero((caddr_t)&ipfo, sizeof(ipfo));
5397c478bd9Sstevel@tonic-gate ipfo.ipfo_rev = IPFILTER_VERSION;
5407c478bd9Sstevel@tonic-gate ipfo.ipfo_size = sizeof(fio);
5417c478bd9Sstevel@tonic-gate ipfo.ipfo_ptr = (void *)&fio;
5427c478bd9Sstevel@tonic-gate ipfo.ipfo_type = IPFOBJ_IPFSTAT;
5437c478bd9Sstevel@tonic-gate
5447c478bd9Sstevel@tonic-gate printf("ipf: %s (%d)\n", IPL_VERSION, (int)sizeof(frentry_t));
5457c478bd9Sstevel@tonic-gate
5467c478bd9Sstevel@tonic-gate if ((vfd = open(ipfname, O_RDONLY)) == -1) {
5477c478bd9Sstevel@tonic-gate perror("open device");
5487c478bd9Sstevel@tonic-gate return 1;
5497c478bd9Sstevel@tonic-gate }
5507c478bd9Sstevel@tonic-gate
551*94bdecd9SRob Gulewich if (setzone(vfd) != 0) {
552*94bdecd9SRob Gulewich close(vfd);
553*94bdecd9SRob Gulewich return 1;
554*94bdecd9SRob Gulewich }
555*94bdecd9SRob Gulewich
5567c478bd9Sstevel@tonic-gate if (ioctl(vfd, SIOCGETFS, &ipfo)) {
5577c478bd9Sstevel@tonic-gate perror("ioctl(SIOCGETFS)");
5587c478bd9Sstevel@tonic-gate close(vfd);
5597c478bd9Sstevel@tonic-gate return 1;
5607c478bd9Sstevel@tonic-gate }
5617c478bd9Sstevel@tonic-gate close(vfd);
5627c478bd9Sstevel@tonic-gate flags = get_flags();
5637c478bd9Sstevel@tonic-gate
5647c478bd9Sstevel@tonic-gate printf("Kernel: %-*.*s\n", (int)sizeof(fio.f_version),
5657c478bd9Sstevel@tonic-gate (int)sizeof(fio.f_version), fio.f_version);
5667c478bd9Sstevel@tonic-gate printf("Running: %s\n", (fio.f_running > 0) ? "yes" : "no");
5677c478bd9Sstevel@tonic-gate printf("Log Flags: %#x = ", flags);
5687c478bd9Sstevel@tonic-gate s = "";
5697c478bd9Sstevel@tonic-gate if (flags & FF_LOGPASS) {
5707c478bd9Sstevel@tonic-gate printf("pass");
5717c478bd9Sstevel@tonic-gate s = ", ";
5727c478bd9Sstevel@tonic-gate }
5737c478bd9Sstevel@tonic-gate if (flags & FF_LOGBLOCK) {
5747c478bd9Sstevel@tonic-gate printf("%sblock", s);
5757c478bd9Sstevel@tonic-gate s = ", ";
5767c478bd9Sstevel@tonic-gate }
5777c478bd9Sstevel@tonic-gate if (flags & FF_LOGNOMATCH) {
5787c478bd9Sstevel@tonic-gate printf("%snomatch", s);
5797c478bd9Sstevel@tonic-gate s = ", ";
5807c478bd9Sstevel@tonic-gate }
5817c478bd9Sstevel@tonic-gate if (flags & FF_BLOCKNONIP) {
5827c478bd9Sstevel@tonic-gate printf("%snonip", s);
5837c478bd9Sstevel@tonic-gate s = ", ";
5847c478bd9Sstevel@tonic-gate }
5857c478bd9Sstevel@tonic-gate if (!*s)
5867c478bd9Sstevel@tonic-gate printf("none set");
5877c478bd9Sstevel@tonic-gate putchar('\n');
5887c478bd9Sstevel@tonic-gate
5897c478bd9Sstevel@tonic-gate printf("Default: ");
5907c478bd9Sstevel@tonic-gate if (FR_ISPASS(fio.f_defpass))
5917c478bd9Sstevel@tonic-gate s = "pass";
5927c478bd9Sstevel@tonic-gate else if (FR_ISBLOCK(fio.f_defpass))
5937c478bd9Sstevel@tonic-gate s = "block";
5947c478bd9Sstevel@tonic-gate else
5957c478bd9Sstevel@tonic-gate s = "nomatch -> block";
5967c478bd9Sstevel@tonic-gate printf("%s all, Logging: %savailable\n", s, fio.f_logging ? "" : "un");
5977c478bd9Sstevel@tonic-gate printf("Active list: %d\n", fio.f_active);
598ab25eeb5Syz155240 printf("Feature mask: %#x\n", fio.f_features);
5997c478bd9Sstevel@tonic-gate
6007c478bd9Sstevel@tonic-gate return 0;
6017c478bd9Sstevel@tonic-gate }
602