sbin/ipfw/ipfw2.c

   1 /*
   2  * Copyright (c) 2002-2003 Luigi Rizzo
   3  * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
   4  * Copyright (c) 1994 Ugen J.S.Antsilevich
   5  *
   6  * Idea and grammar partially left from:
   7  * Copyright (c) 1993 Daniel Boulet
   8  *
   9  * Redistribution and use in source forms, with and without modification,
  10  * are permitted provided that this entire comment appears intact.
  11  *
  12  * Redistribution in binary form may occur without any restrictions.
  13  * Obviously, it would be nice if you gave credit where credit is due
  14  * but requiring it would be too onerous.
  15  *
  16  * This software is provided ``AS IS'' without any warranties of any kind.
  17  *
  18  * NEW command line interface for IP firewall facility
  19  *
  20  * $FreeBSD$
  21  */
  22
  23 #include <sys/types.h>
  24 #include <sys/param.h>
  25 #include <sys/socket.h>
  26 #include <sys/sockio.h>
  27 #include <sys/sysctl.h>
  28
  29 #include "ipfw2.h"
  30
  31 #include <ctype.h>
  32 #include <err.h>
  33 #include <errno.h>
  34 #include <grp.h>
  35 #include <netdb.h>
  36 #include <pwd.h>
  37 #include <stdio.h>
  38 #include <stdarg.h>
  39 #include <stdlib.h>
  40 #include <string.h>
  41 #include <sysexits.h>
  42 #include <time.h>       /* ctime */
  43 #include <timeconv.h>   /* _long_to_time */
  44 #include <unistd.h>
  45 #include <fcntl.h>
  46 #include <stddef.h>     /* offsetof */
  47
  48 #include <net/ethernet.h>
  49 #include <net/if.h>             /* only IFNAMSIZ */
  50 #include <netinet/in.h>
  51 #include <netinet/in_systm.h>   /* only n_short, n_long */
  52 #include <netinet/ip.h>
  53 #include <netinet/ip_icmp.h>
  54 #include <netinet/ip_fw.h>
  55 #include <netinet/tcp.h>
  56 #include <arpa/inet.h>
  57
  58 struct cmdline_opts co; /* global options */
  59
  60 struct format_opts {
  61         int bcwidth;
  62         int pcwidth;
  63         int show_counters;
  64         int show_time;          /* show timestamp */
  65         uint32_t set_mask;      /* enabled sets mask */
  66         uint32_t flags;         /* request flags */
  67         uint32_t first;         /* first rule to request */
  68         uint32_t last;          /* last rule to request */
  69         uint32_t dcnt;          /* number of dynamic states */
  70         ipfw_obj_ctlv *tstate;  /* table state data */
  71 };
  72
  73 int resvd_set_number = RESVD_SET;
  74
  75 int ipfw_socket = -1;
  76
  77 #define CHECK_LENGTH(v, len) do {                               \
  78         if ((v) < (len))                                        \
  79                 errx(EX_DATAERR, "Rule too long");              \
  80         } while (0)
  81 /*
  82  * Check if we have enough space in cmd buffer. Note that since
  83  * first 8? u32 words are reserved by reserved header, full cmd
  84  * buffer can't be used, so we need to protect from buffer overrun
  85  * only. At the beginnig, cblen is less than actual buffer size by
  86  * size of ipfw_insn_u32 instruction + 1 u32 work. This eliminates need
  87  * for checking small instructions fitting in given range.
  88  * We also (ab)use the fact that ipfw_insn is always the first field
  89  * for any custom instruction.
  90  */
  91 #define CHECK_CMDLEN    CHECK_LENGTH(cblen, F_LEN((ipfw_insn *)cmd))
  92
  93 #define GET_UINT_ARG(arg, min, max, tok, s_x) do {                      \
  94         if (!av[0])                                                     \
  95                 errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \
  96         if (_substrcmp(*av, "tablearg") == 0) {                         \
  97                 arg = IP_FW_TARG;                                       \
  98                 break;                                                  \
  99         }                                                               \
 100                                                                         \
 101         {                                                               \
 102         long _xval;                                                     \
 103         char *end;                                                      \
 104                                                                         \
 105         _xval = strtol(*av, &end, 10);                                  \
 106                                                                         \
 107         if (!isdigit(**av) || *end != '\0' || (_xval == 0 && errno == EINVAL)) \
 108                 errx(EX_DATAERR, "%s: invalid argument: %s",            \
 109                     match_value(s_x, tok), *av);                        \
 110                                                                         \
 111         if (errno == ERANGE || _xval < min || _xval > max)              \
 112                 errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \
 113                     match_value(s_x, tok), min, max, *av);              \
 114                                                                         \
 115         if (_xval == IP_FW_TARG)                                        \
 116                 errx(EX_DATAERR, "%s: illegal argument value: %s",      \
 117                     match_value(s_x, tok), *av);                        \
 118         arg = _xval;                                                    \
 119         }                                                               \
 120 } while (0)
 121
 122 static struct _s_x f_tcpflags[] = {
 123         { "syn", TH_SYN },
 124         { "fin", TH_FIN },
 125         { "ack", TH_ACK },
 126         { "psh", TH_PUSH },
 127         { "rst", TH_RST },
 128         { "urg", TH_URG },
 129         { "tcp flag", 0 },
 130         { NULL, 0 }
 131 };
 132
 133 static struct _s_x f_tcpopts[] = {
 134         { "mss",        IP_FW_TCPOPT_MSS },
 135         { "maxseg",     IP_FW_TCPOPT_MSS },
 136         { "window",     IP_FW_TCPOPT_WINDOW },
 137         { "sack",       IP_FW_TCPOPT_SACK },
 138         { "ts",         IP_FW_TCPOPT_TS },
 139         { "timestamp",  IP_FW_TCPOPT_TS },
 140         { "cc",         IP_FW_TCPOPT_CC },
 141         { "tcp option", 0 },
 142         { NULL, 0 }
 143 };
 144
 145 /*
 146  * IP options span the range 0 to 255 so we need to remap them
 147  * (though in fact only the low 5 bits are significant).
 148  */
 149 static struct _s_x f_ipopts[] = {
 150         { "ssrr",       IP_FW_IPOPT_SSRR},
 151         { "lsrr",       IP_FW_IPOPT_LSRR},
 152         { "rr",         IP_FW_IPOPT_RR},
 153         { "ts",         IP_FW_IPOPT_TS},
 154         { "ip option",  0 },
 155         { NULL, 0 }
 156 };
 157
 158 static struct _s_x f_iptos[] = {
 159         { "lowdelay",   IPTOS_LOWDELAY},
 160         { "throughput", IPTOS_THROUGHPUT},
 161         { "reliability", IPTOS_RELIABILITY},
 162         { "mincost",    IPTOS_MINCOST},
 163         { "congestion", IPTOS_ECN_CE},
 164         { "ecntransport", IPTOS_ECN_ECT0},
 165         { "ip tos option", 0},
 166         { NULL, 0 }
 167 };
 168
 169 struct _s_x f_ipdscp[] = {
 170         { "af11", IPTOS_DSCP_AF11 >> 2 },       /* 001010 */
 171         { "af12", IPTOS_DSCP_AF12 >> 2 },       /* 001100 */
 172         { "af13", IPTOS_DSCP_AF13 >> 2 },       /* 001110 */
 173         { "af21", IPTOS_DSCP_AF21 >> 2 },       /* 010010 */
 174         { "af22", IPTOS_DSCP_AF22 >> 2 },       /* 010100 */
 175         { "af23", IPTOS_DSCP_AF23 >> 2 },       /* 010110 */
 176         { "af31", IPTOS_DSCP_AF31 >> 2 },       /* 011010 */
 177         { "af32", IPTOS_DSCP_AF32 >> 2 },       /* 011100 */
 178         { "af33", IPTOS_DSCP_AF33 >> 2 },       /* 011110 */
 179         { "af41", IPTOS_DSCP_AF41 >> 2 },       /* 100010 */
 180         { "af42", IPTOS_DSCP_AF42 >> 2 },       /* 100100 */
 181         { "af43", IPTOS_DSCP_AF43 >> 2 },       /* 100110 */
 182         { "be", IPTOS_DSCP_CS0 >> 2 },  /* 000000 */
 183         { "ef", IPTOS_DSCP_EF >> 2 },   /* 101110 */
 184         { "cs0", IPTOS_DSCP_CS0 >> 2 }, /* 000000 */
 185         { "cs1", IPTOS_DSCP_CS1 >> 2 }, /* 001000 */
 186         { "cs2", IPTOS_DSCP_CS2 >> 2 }, /* 010000 */
 187         { "cs3", IPTOS_DSCP_CS3 >> 2 }, /* 011000 */
 188         { "cs4", IPTOS_DSCP_CS4 >> 2 }, /* 100000 */
 189         { "cs5", IPTOS_DSCP_CS5 >> 2 }, /* 101000 */
 190         { "cs6", IPTOS_DSCP_CS6 >> 2 }, /* 110000 */
 191         { "cs7", IPTOS_DSCP_CS7 >> 2 }, /* 100000 */
 192         { NULL, 0 }
 193 };
 194
 195 static struct _s_x limit_masks[] = {
 196         {"all",         DYN_SRC_ADDR|DYN_SRC_PORT|DYN_DST_ADDR|DYN_DST_PORT},
 197         {"src-addr",    DYN_SRC_ADDR},
 198         {"src-port",    DYN_SRC_PORT},
 199         {"dst-addr",    DYN_DST_ADDR},
 200         {"dst-port",    DYN_DST_PORT},
 201         {NULL,          0}
 202 };
 203
 204 /*
 205  * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines
 206  * This is only used in this code.
 207  */
 208 #define IPPROTO_ETHERTYPE       0x1000
 209 static struct _s_x ether_types[] = {
 210     /*
 211      * Note, we cannot use "-:&/" in the names because they are field
 212      * separators in the type specifications. Also, we use s = NULL as
 213      * end-delimiter, because a type of 0 can be legal.
 214      */
 215         { "ip",         0x0800 },
 216         { "ipv4",       0x0800 },
 217         { "ipv6",       0x86dd },
 218         { "arp",        0x0806 },
 219         { "rarp",       0x8035 },
 220         { "vlan",       0x8100 },
 221         { "loop",       0x9000 },
 222         { "trail",      0x1000 },
 223         { "at",         0x809b },
 224         { "atalk",      0x809b },
 225         { "aarp",       0x80f3 },
 226         { "pppoe_disc", 0x8863 },
 227         { "pppoe_sess", 0x8864 },
 228         { "ipx_8022",   0x00E0 },
 229         { "ipx_8023",   0x0000 },
 230         { "ipx_ii",     0x8137 },
 231         { "ipx_snap",   0x8137 },
 232         { "ipx",        0x8137 },
 233         { "ns",         0x0600 },
 234         { NULL,         0 }
 235 };
 236
 237
 238 static struct _s_x rule_actions[] = {
 239         { "accept",             TOK_ACCEPT },
 240         { "pass",               TOK_ACCEPT },
 241         { "allow",              TOK_ACCEPT },
 242         { "permit",             TOK_ACCEPT },
 243         { "count",              TOK_COUNT },
 244         { "pipe",               TOK_PIPE },
 245         { "queue",              TOK_QUEUE },
 246         { "divert",             TOK_DIVERT },
 247         { "tee",                TOK_TEE },
 248         { "netgraph",           TOK_NETGRAPH },
 249         { "ngtee",              TOK_NGTEE },
 250         { "fwd",                TOK_FORWARD },
 251         { "forward",            TOK_FORWARD },
 252         { "skipto",             TOK_SKIPTO },
 253         { "deny",               TOK_DENY },
 254         { "drop",               TOK_DENY },
 255         { "reject",             TOK_REJECT },
 256         { "reset6",             TOK_RESET6 },
 257         { "reset",              TOK_RESET },
 258         { "unreach6",           TOK_UNREACH6 },
 259         { "unreach",            TOK_UNREACH },
 260         { "check-state",        TOK_CHECKSTATE },
 261         { "//",                 TOK_COMMENT },
 262         { "nat",                TOK_NAT },
 263         { "reass",              TOK_REASS },
 264         { "setfib",             TOK_SETFIB },
 265         { "setdscp",            TOK_SETDSCP },
 266         { "call",               TOK_CALL },
 267         { "return",             TOK_RETURN },
 268         { NULL, 0 }     /* terminator */
 269 };
 270
 271 static struct _s_x rule_action_params[] = {
 272         { "altq",               TOK_ALTQ },
 273         { "log",                TOK_LOG },
 274         { "tag",                TOK_TAG },
 275         { "untag",              TOK_UNTAG },
 276         { NULL, 0 }     /* terminator */
 277 };
 278
 279 /*
 280  * The 'lookup' instruction accepts one of the following arguments.
 281  * -1 is a terminator for the list.
 282  * Arguments are passed as v[1] in O_DST_LOOKUP options.
 283  */
 284 static int lookup_key[] = {
 285         TOK_DSTIP, TOK_SRCIP, TOK_DSTPORT, TOK_SRCPORT,
 286         TOK_UID, TOK_JAIL, TOK_DSCP, -1 };
 287
 288 static struct _s_x rule_options[] = {
 289         { "tagged",             TOK_TAGGED },
 290         { "uid",                TOK_UID },
 291         { "gid",                TOK_GID },
 292         { "jail",               TOK_JAIL },
 293         { "in",                 TOK_IN },
 294         { "limit",              TOK_LIMIT },
 295         { "keep-state",         TOK_KEEPSTATE },
 296         { "bridged",            TOK_LAYER2 },
 297         { "layer2",             TOK_LAYER2 },
 298         { "out",                TOK_OUT },
 299         { "diverted",           TOK_DIVERTED },
 300         { "diverted-loopback",  TOK_DIVERTEDLOOPBACK },
 301         { "diverted-output",    TOK_DIVERTEDOUTPUT },
 302         { "xmit",               TOK_XMIT },
 303         { "recv",               TOK_RECV },
 304         { "via",                TOK_VIA },
 305         { "fragment",           TOK_FRAG },
 306         { "frag",               TOK_FRAG },
 307         { "fib",                TOK_FIB },
 308         { "ipoptions",          TOK_IPOPTS },
 309         { "ipopts",             TOK_IPOPTS },
 310         { "iplen",              TOK_IPLEN },
 311         { "ipid",               TOK_IPID },
 312         { "ipprecedence",       TOK_IPPRECEDENCE },
 313         { "dscp",               TOK_DSCP },
 314         { "iptos",              TOK_IPTOS },
 315         { "ipttl",              TOK_IPTTL },
 316         { "ipversion",          TOK_IPVER },
 317         { "ipver",              TOK_IPVER },
 318         { "estab",              TOK_ESTAB },
 319         { "established",        TOK_ESTAB },
 320         { "setup",              TOK_SETUP },
 321         { "sockarg",            TOK_SOCKARG },
 322         { "tcpdatalen",         TOK_TCPDATALEN },
 323         { "tcpflags",           TOK_TCPFLAGS },
 324         { "tcpflgs",            TOK_TCPFLAGS },
 325         { "tcpoptions",         TOK_TCPOPTS },
 326         { "tcpopts",            TOK_TCPOPTS },
 327         { "tcpseq",             TOK_TCPSEQ },
 328         { "tcpack",             TOK_TCPACK },
 329         { "tcpwin",             TOK_TCPWIN },
 330         { "icmptype",           TOK_ICMPTYPES },
 331         { "icmptypes",          TOK_ICMPTYPES },
 332         { "dst-ip",             TOK_DSTIP },
 333         { "src-ip",             TOK_SRCIP },
 334         { "dst-port",           TOK_DSTPORT },
 335         { "src-port",           TOK_SRCPORT },
 336         { "proto",              TOK_PROTO },
 337         { "MAC",                TOK_MAC },
 338         { "mac",                TOK_MAC },
 339         { "mac-type",           TOK_MACTYPE },
 340         { "verrevpath",         TOK_VERREVPATH },
 341         { "versrcreach",        TOK_VERSRCREACH },
 342         { "antispoof",          TOK_ANTISPOOF },
 343         { "ipsec",              TOK_IPSEC },
 344         { "icmp6type",          TOK_ICMP6TYPES },
 345         { "icmp6types",         TOK_ICMP6TYPES },
 346         { "ext6hdr",            TOK_EXT6HDR},
 347         { "flow-id",            TOK_FLOWID},
 348         { "ipv6",               TOK_IPV6},
 349         { "ip6",                TOK_IPV6},
 350         { "ipv4",               TOK_IPV4},
 351         { "ip4",                TOK_IPV4},
 352         { "dst-ipv6",           TOK_DSTIP6},
 353         { "dst-ip6",            TOK_DSTIP6},
 354         { "src-ipv6",           TOK_SRCIP6},
 355         { "src-ip6",            TOK_SRCIP6},
 356         { "lookup",             TOK_LOOKUP},
 357         { "flow",               TOK_FLOW},
 358         { "//",                 TOK_COMMENT },
 359
 360         { "not",                TOK_NOT },              /* pseudo option */
 361         { "!", /* escape ? */   TOK_NOT },              /* pseudo option */
 362         { "or",                 TOK_OR },               /* pseudo option */
 363         { "|", /* escape */     TOK_OR },               /* pseudo option */
 364         { "{",                  TOK_STARTBRACE },       /* pseudo option */
 365         { "(",                  TOK_STARTBRACE },       /* pseudo option */
 366         { "}",                  TOK_ENDBRACE },         /* pseudo option */
 367         { ")",                  TOK_ENDBRACE },         /* pseudo option */
 368         { NULL, 0 }     /* terminator */
 369 };
 370
 371 void bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg);
 372 static int ipfw_get_config(struct cmdline_opts *co, struct format_opts *fo,
 373     ipfw_cfg_lheader **pcfg, size_t *psize);
 374 static int ipfw_show_config(struct cmdline_opts *co, struct format_opts *fo,
 375     ipfw_cfg_lheader *cfg, size_t sz, int ac, char **av);
 376 static void ipfw_list_tifaces(void);
 377
 378 struct tidx;
 379 static uint16_t pack_object(struct tidx *tstate, char *name, int otype);
 380 static uint16_t pack_table(struct tidx *tstate, char *name);
 381
 382 static char *table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx);
 383 static void object_sort_ctlv(ipfw_obj_ctlv *ctlv);
 384
 385 /*
 386  * Simple string buffer API.
 387  * Used to simplify buffer passing between function and for
 388  * transparent overrun handling.
 389  */
 390
 391 /*
 392  * Allocates new buffer of given size @sz.
 393  *
 394  * Returns 0 on success.
 395  */
 396 int
 397 bp_alloc(struct buf_pr *b, size_t size)
 398 {
 399         memset(b, 0, sizeof(struct buf_pr));
 400
 401         if ((b->buf = calloc(1, size)) == NULL)
 402                 return (ENOMEM);
 403
 404         b->ptr = b->buf;
 405         b->size = size;
 406         b->avail = b->size;
 407
 408         return (0);
 409 }
 410
 411 void
 412 bp_free(struct buf_pr *b)
 413 {
 414
 415         free(b->buf);
 416 }
 417
 418 /*
 419  * Flushes buffer so new writer start from beginning.
 420  */
 421 void
 422 bp_flush(struct buf_pr *b)
 423 {
 424
 425         b->ptr = b->buf;
 426         b->avail = b->size;
 427 }
 428
 429 /*
 430  * Print message specified by @format and args.
 431  * Automatically manage buffer space and transparently handle
 432  * buffer overruns.
 433  *
 434  * Returns number of bytes that should have been printed.
 435  */
 436 int
 437 bprintf(struct buf_pr *b, char *format, ...)
 438 {
 439         va_list args;
 440         int i;
 441
 442         va_start(args, format);
 443
 444         i = vsnprintf(b->ptr, b->avail, format, args);
 445         va_end(args);
 446
 447         if (i > b->avail || i < 0) {
 448                 /* Overflow or print error */
 449                 b->avail = 0;
 450         } else {
 451                 b->ptr += i;
 452                 b->avail -= i;
 453         }
 454
 455         b->needed += i;
 456
 457         return (i);
 458 }
 459
 460 /*
 461  * Special values printer for tablearg-aware opcodes.
 462  */
 463 void
 464 bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg)
 465 {
 466
 467         if (str != NULL)
 468                 bprintf(bp, "%s", str);
 469         if (arg == IP_FW_TARG)
 470                 bprintf(bp, "tablearg");
 471         else
 472                 bprintf(bp, "%u", arg);
 473 }
 474
 475 /*
 476  * Helper routine to print a possibly unaligned uint64_t on
 477  * various platform. If width > 0, print the value with
 478  * the desired width, followed by a space;
 479  * otherwise, return the required width.
 480  */
 481 int
 482 pr_u64(struct buf_pr *b, uint64_t *pd, int width)
 483 {
 484 #ifdef TCC
 485 #define U64_FMT "I64"
 486 #else
 487 #define U64_FMT "llu"
 488 #endif
 489         uint64_t u;
 490         unsigned long long d;
 491
 492         bcopy (pd, &u, sizeof(u));
 493         d = u;
 494         return (width > 0) ?
 495                 bprintf(b, "%*" U64_FMT " ", width, d) :
 496                 snprintf(NULL, 0, "%" U64_FMT, d) ;
 497 #undef U64_FMT
 498 }
 499
 500
 501 void *
 502 safe_calloc(size_t number, size_t size)
 503 {
 504         void *ret = calloc(number, size);
 505
 506         if (ret == NULL)
 507                 err(EX_OSERR, "calloc");
 508         return ret;
 509 }
 510
 511 void *
 512 safe_realloc(void *ptr, size_t size)
 513 {
 514         void *ret = realloc(ptr, size);
 515
 516         if (ret == NULL)
 517                 err(EX_OSERR, "realloc");
 518         return ret;
 519 }
 520
 521 /*
 522  * Compare things like interface or table names.
 523  */
 524 int
 525 stringnum_cmp(const char *a, const char *b)
 526 {
 527         int la, lb;
 528
 529         la = strlen(a);
 530         lb = strlen(b);
 531
 532         if (la > lb)
 533                 return (1);
 534         else if (la < lb)
 535                 return (-01);
 536
 537         return (strcmp(a, b));
 538 }
 539
 540
 541 /*
 542  * conditionally runs the command.
 543  * Selected options or negative -> getsockopt
 544  */
 545 int
 546 do_cmd(int optname, void *optval, uintptr_t optlen)
 547 {
 548         int i;
 549
 550         if (co.test_only)
 551                 return 0;
 552
 553         if (ipfw_socket == -1)
 554                 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 555         if (ipfw_socket < 0)
 556                 err(EX_UNAVAILABLE, "socket");
 557
 558         if (optname == IP_FW_GET || optname == IP_DUMMYNET_GET ||
 559             optname == IP_FW_ADD || optname == IP_FW3 ||
 560             optname == IP_FW_NAT_GET_CONFIG ||
 561             optname < 0 ||
 562             optname == IP_FW_NAT_GET_LOG) {
 563                 if (optname < 0)
 564                         optname = -optname;
 565                 i = getsockopt(ipfw_socket, IPPROTO_IP, optname, optval,
 566                         (socklen_t *)optlen);
 567         } else {
 568                 i = setsockopt(ipfw_socket, IPPROTO_IP, optname, optval, optlen);
 569         }
 570         return i;
 571 }
 572
 573 /*
 574  * do_set3 - pass ipfw control cmd to kernel
 575  * @optname: option name
 576  * @optval: pointer to option data
 577  * @optlen: option length
 578  *
 579  * Assumes op3 header is already embedded.
 580  * Calls setsockopt() with IP_FW3 as kernel-visible opcode.
 581  * Returns 0 on success or errno otherwise.
 582  */
 583 int
 584 do_set3(int optname, ip_fw3_opheader *op3, uintptr_t optlen)
 585 {
 586
 587         if (co.test_only)
 588                 return (0);
 589
 590         if (ipfw_socket == -1)
 591                 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 592         if (ipfw_socket < 0)
 593                 err(EX_UNAVAILABLE, "socket");
 594
 595         op3->opcode = optname;
 596
 597         return (setsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3, optlen));
 598 }
 599
 600 /*
 601  * do_get3 - pass ipfw control cmd to kernel
 602  * @optname: option name
 603  * @optval: pointer to option data
 604  * @optlen: pointer to option length
 605  *
 606  * Assumes op3 header is already embedded.
 607  * Calls getsockopt() with IP_FW3 as kernel-visible opcode.
 608  * Returns 0 on success or errno otherwise.
 609  */
 610 int
 611 do_get3(int optname, ip_fw3_opheader *op3, size_t *optlen)
 612 {
 613         int error;
 614
 615         if (co.test_only)
 616                 return (0);
 617
 618         if (ipfw_socket == -1)
 619                 ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 620         if (ipfw_socket < 0)
 621                 err(EX_UNAVAILABLE, "socket");
 622
 623         op3->opcode = optname;
 624
 625         error = getsockopt(ipfw_socket, IPPROTO_IP, IP_FW3, op3,
 626             (socklen_t *)optlen);
 627
 628         return (error);
 629 }
 630
 631 /**
 632  * match_token takes a table and a string, returns the value associated
 633  * with the string (-1 in case of failure).
 634  */
 635 int
 636 match_token(struct _s_x *table, char *string)
 637 {
 638         struct _s_x *pt;
 639         uint i = strlen(string);
 640
 641         for (pt = table ; i && pt->s != NULL ; pt++)
 642                 if (strlen(pt->s) == i && !bcmp(string, pt->s, i))
 643                         return pt->x;
 644         return (-1);
 645 }
 646
 647 /**
 648  * match_token takes a table and a string, returns the value associated
 649  * with the string for the best match.
 650  *
 651  * Returns:
 652  * value from @table for matched records
 653  * -1 for non-matched records
 654  * -2 if more than one records match @string.
 655  */
 656 int
 657 match_token_relaxed(struct _s_x *table, char *string)
 658 {
 659         struct _s_x *pt, *m;
 660         int i, c;
 661
 662         i = strlen(string);
 663         c = 0;
 664
 665         for (pt = table ; i != 0 && pt->s != NULL ; pt++) {
 666                 if (strncmp(pt->s, string, i) != 0)
 667                         continue;
 668                 m = pt;
 669                 c++;
 670         }
 671
 672         if (c == 1)
 673                 return (m->x);
 674
 675         return (c > 0 ? -2: -1);
 676 }
 677
 678 /**
 679  * match_value takes a table and a value, returns the string associated
 680  * with the value (NULL in case of failure).
 681  */
 682 char const *
 683 match_value(struct _s_x *p, int value)
 684 {
 685         for (; p->s != NULL; p++)
 686                 if (p->x == value)
 687                         return p->s;
 688         return NULL;
 689 }
 690
 691 size_t
 692 concat_tokens(char *buf, size_t bufsize, struct _s_x *table, char *delimiter)
 693 {
 694         struct _s_x *pt;
 695         int l;
 696         size_t sz;
 697
 698         for (sz = 0, pt = table ; pt->s != NULL; pt++) {
 699                 l = snprintf(buf + sz, bufsize - sz, "%s%s",
 700                     (sz == 0) ? "" : delimiter, pt->s);
 701                 sz += l;
 702                 bufsize += l;
 703                 if (sz > bufsize)
 704                         return (bufsize);
 705         }
 706
 707         return (sz);
 708 }
 709
 710 /*
 711  * helper function to process a set of flags and set bits in the
 712  * appropriate masks.
 713  */
 714 int
 715 fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set,
 716     uint32_t *clear)
 717 {
 718         char *q;        /* points to the separator */
 719         int val;
 720         uint32_t *which;        /* mask we are working on */
 721
 722         while (p && *p) {
 723                 if (*p == '!') {
 724                         p++;
 725                         which = clear;
 726                 } else
 727                         which = set;
 728                 q = strchr(p, ',');
 729                 if (q)
 730                         *q++ = '\0';
 731                 val = match_token(flags, p);
 732                 if (val <= 0) {
 733                         if (e != NULL)
 734                                 *e = p;
 735                         return (-1);
 736                 }
 737                 *which |= (uint32_t)val;
 738                 p = q;
 739         }
 740         return (0);
 741 }
 742
 743 void
 744 print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set)
 745 {
 746         char const *comma = "";
 747         int i, l;
 748
 749         for (i = 0; list[i].x != 0; i++) {
 750                 if ((set & list[i].x) == 0)
 751                         continue;
 752
 753                 set &= ~list[i].x;
 754                 l = snprintf(buf, sz, "%s%s", comma, list[i].s);
 755                 if (l >= sz)
 756                         return;
 757                 comma = ",";
 758                 buf += l;
 759                 sz -=l;
 760         }
 761 }
 762
 763 /*
 764  * _substrcmp takes two strings and returns 1 if they do not match,
 765  * and 0 if they match exactly or the first string is a sub-string
 766  * of the second.  A warning is printed to stderr in the case that the
 767  * first string is a sub-string of the second.
 768  *
 769  * This function will be removed in the future through the usual
 770  * deprecation process.
 771  */
 772 int
 773 _substrcmp(const char *str1, const char* str2)
 774 {
 775
 776         if (strncmp(str1, str2, strlen(str1)) != 0)
 777                 return 1;
 778
 779         if (strlen(str1) != strlen(str2))
 780                 warnx("DEPRECATED: '%s' matched '%s' as a sub-string",
 781                     str1, str2);
 782         return 0;
 783 }
 784
 785 /*
 786  * _substrcmp2 takes three strings and returns 1 if the first two do not match,
 787  * and 0 if they match exactly or the second string is a sub-string
 788  * of the first.  A warning is printed to stderr in the case that the
 789  * first string does not match the third.
 790  *
 791  * This function exists to warn about the bizarre construction
 792  * strncmp(str, "by", 2) which is used to allow people to use a shortcut
 793  * for "bytes".  The problem is that in addition to accepting "by",
 794  * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any
 795  * other string beginning with "by".
 796  *
 797  * This function will be removed in the future through the usual
 798  * deprecation process.
 799  */
 800 int
 801 _substrcmp2(const char *str1, const char* str2, const char* str3)
 802 {
 803
 804         if (strncmp(str1, str2, strlen(str2)) != 0)
 805                 return 1;
 806
 807         if (strcmp(str1, str3) != 0)
 808                 warnx("DEPRECATED: '%s' matched '%s'",
 809                     str1, str3);
 810         return 0;
 811 }
 812
 813 /*
 814  * prints one port, symbolic or numeric
 815  */
 816 static void
 817 print_port(struct buf_pr *bp, int proto, uint16_t port)
 818 {
 819
 820         if (proto == IPPROTO_ETHERTYPE) {
 821                 char const *s;
 822
 823                 if (co.do_resolv && (s = match_value(ether_types, port)) )
 824                         bprintf(bp, "%s", s);
 825                 else
 826                         bprintf(bp, "0x%04x", port);
 827         } else {
 828                 struct servent *se = NULL;
 829                 if (co.do_resolv) {
 830                         struct protoent *pe = getprotobynumber(proto);
 831
 832                         se = getservbyport(htons(port), pe ? pe->p_name : NULL);
 833                 }
 834                 if (se)
 835                         bprintf(bp, "%s", se->s_name);
 836                 else
 837                         bprintf(bp, "%d", port);
 838         }
 839 }
 840
 841 static struct _s_x _port_name[] = {
 842         {"dst-port",    O_IP_DSTPORT},
 843         {"src-port",    O_IP_SRCPORT},
 844         {"ipid",        O_IPID},
 845         {"iplen",       O_IPLEN},
 846         {"ipttl",       O_IPTTL},
 847         {"mac-type",    O_MAC_TYPE},
 848         {"tcpdatalen",  O_TCPDATALEN},
 849         {"tcpwin",      O_TCPWIN},
 850         {"tagged",      O_TAGGED},
 851         {NULL,          0}
 852 };
 853
 854 /*
 855  * Print the values in a list 16-bit items of the types above.
 856  * XXX todo: add support for mask.
 857  */
 858 static void
 859 print_newports(struct buf_pr *bp, ipfw_insn_u16 *cmd, int proto, int opcode)
 860 {
 861         uint16_t *p = cmd->ports;
 862         int i;
 863         char const *sep;
 864
 865         if (opcode != 0) {
 866                 sep = match_value(_port_name, opcode);
 867                 if (sep == NULL)
 868                         sep = "???";
 869                 bprintf(bp, " %s", sep);
 870         }
 871         sep = " ";
 872         for (i = F_LEN((ipfw_insn *)cmd) - 1; i > 0; i--, p += 2) {
 873                 bprintf(bp, "%s", sep);
 874                 print_port(bp, proto, p[0]);
 875                 if (p[0] != p[1]) {
 876                         bprintf(bp, "-");
 877                         print_port(bp, proto, p[1]);
 878                 }
 879                 sep = ",";
 880         }
 881 }
 882
 883 /*
 884  * Like strtol, but also translates service names into port numbers
 885  * for some protocols.
 886  * In particular:
 887  *      proto == -1 disables the protocol check;
 888  *      proto == IPPROTO_ETHERTYPE looks up an internal table
 889  *      proto == <some value in /etc/protocols> matches the values there.
 890  * Returns *end == s in case the parameter is not found.
 891  */
 892 static int
 893 strtoport(char *s, char **end, int base, int proto)
 894 {
 895         char *p, *buf;
 896         char *s1;
 897         int i;
 898
 899         *end = s;               /* default - not found */
 900         if (*s == '\0')
 901                 return 0;       /* not found */
 902
 903         if (isdigit(*s))
 904                 return strtol(s, end, base);
 905
 906         /*
 907          * find separator. '\\' escapes the next char.
 908          */
 909         for (s1 = s; *s1 && (isalnum(*s1) || *s1 == '\\') ; s1++)
 910                 if (*s1 == '\\' && s1[1] != '\0')
 911                         s1++;
 912
 913         buf = safe_calloc(s1 - s + 1, 1);
 914
 915         /*
 916          * copy into a buffer skipping backslashes
 917          */
 918         for (p = s, i = 0; p != s1 ; p++)
 919                 if (*p != '\\')
 920                         buf[i++] = *p;
 921         buf[i++] = '\0';
 922
 923         if (proto == IPPROTO_ETHERTYPE) {
 924                 i = match_token(ether_types, buf);
 925                 free(buf);
 926                 if (i != -1) {  /* found */
 927                         *end = s1;
 928                         return i;
 929                 }
 930         } else {
 931                 struct protoent *pe = NULL;
 932                 struct servent *se;
 933
 934                 if (proto != 0)
 935                         pe = getprotobynumber(proto);
 936                 setservent(1);
 937                 se = getservbyname(buf, pe ? pe->p_name : NULL);
 938                 free(buf);
 939                 if (se != NULL) {
 940                         *end = s1;
 941                         return ntohs(se->s_port);
 942                 }
 943         }
 944         return 0;       /* not found */
 945 }
 946
 947 /*
 948  * Fill the body of the command with the list of port ranges.
 949  */
 950 static int
 951 fill_newports(ipfw_insn_u16 *cmd, char *av, int proto, int cblen)
 952 {
 953         uint16_t a, b, *p = cmd->ports;
 954         int i = 0;
 955         char *s = av;
 956
 957         while (*s) {
 958                 a = strtoport(av, &s, 0, proto);
 959                 if (s == av)                    /* empty or invalid argument */
 960                         return (0);
 961
 962                 CHECK_LENGTH(cblen, i + 2);
 963
 964                 switch (*s) {
 965                 case '-':                       /* a range */
 966                         av = s + 1;
 967                         b = strtoport(av, &s, 0, proto);
 968                         /* Reject expressions like '1-abc' or '1-2-3'. */
 969                         if (s == av || (*s != ',' && *s != '\0'))
 970                                 return (0);
 971                         p[0] = a;
 972                         p[1] = b;
 973                         break;
 974                 case ',':                       /* comma separated list */
 975                 case '\0':
 976                         p[0] = p[1] = a;
 977                         break;
 978                 default:
 979                         warnx("port list: invalid separator <%c> in <%s>",
 980                                 *s, av);
 981                         return (0);
 982                 }
 983
 984                 i++;
 985                 p += 2;
 986                 av = s + 1;
 987         }
 988         if (i > 0) {
 989                 if (i + 1 > F_LEN_MASK)
 990                         errx(EX_DATAERR, "too many ports/ranges\n");
 991                 cmd->o.len |= i + 1;    /* leave F_NOT and F_OR untouched */
 992         }
 993         return (i);
 994 }
 995
 996 /*
 997  * Fill the body of the command with the list of DiffServ codepoints.
 998  */
 999 static void
1000 fill_dscp(ipfw_insn *cmd, char *av, int cblen)
1001 {
1002         uint32_t *low, *high;
1003         char *s = av, *a;
1004         int code;
1005
1006         cmd->opcode = O_DSCP;
1007         cmd->len |= F_INSN_SIZE(ipfw_insn_u32) + 1;
1008
1009         CHECK_CMDLEN;
1010
1011         low = (uint32_t *)(cmd + 1);
1012         high = low + 1;
1013
1014         *low = 0;
1015         *high = 0;
1016
1017         while (s != NULL) {
1018                 a = strchr(s, ',');
1019
1020                 if (a != NULL)
1021                         *a++ = '\0';
1022
1023                 if (isalpha(*s)) {
1024                         if ((code = match_token(f_ipdscp, s)) == -1)
1025                                 errx(EX_DATAERR, "Unknown DSCP code");
1026                 } else {
1027                         code = strtoul(s, NULL, 10);
1028                         if (code < 0 || code > 63)
1029                                 errx(EX_DATAERR, "Invalid DSCP value");
1030                 }
1031
1032                 if (code > 32)
1033                         *high |= 1 << (code - 32);
1034                 else
1035                         *low |= 1 << code;
1036
1037                 s = a;
1038         }
1039 }
1040
1041 static struct _s_x icmpcodes[] = {
1042       { "net",                  ICMP_UNREACH_NET },
1043       { "host",                 ICMP_UNREACH_HOST },
1044       { "protocol",             ICMP_UNREACH_PROTOCOL },
1045       { "port",                 ICMP_UNREACH_PORT },
1046       { "needfrag",             ICMP_UNREACH_NEEDFRAG },
1047       { "srcfail",              ICMP_UNREACH_SRCFAIL },
1048       { "net-unknown",          ICMP_UNREACH_NET_UNKNOWN },
1049       { "host-unknown",         ICMP_UNREACH_HOST_UNKNOWN },
1050       { "isolated",             ICMP_UNREACH_ISOLATED },
1051       { "net-prohib",           ICMP_UNREACH_NET_PROHIB },
1052       { "host-prohib",          ICMP_UNREACH_HOST_PROHIB },
1053       { "tosnet",               ICMP_UNREACH_TOSNET },
1054       { "toshost",              ICMP_UNREACH_TOSHOST },
1055       { "filter-prohib",        ICMP_UNREACH_FILTER_PROHIB },
1056       { "host-precedence",      ICMP_UNREACH_HOST_PRECEDENCE },
1057       { "precedence-cutoff",    ICMP_UNREACH_PRECEDENCE_CUTOFF },
1058       { NULL, 0 }
1059 };
1060
1061 static void
1062 fill_reject_code(u_short *codep, char *str)
1063 {
1064         int val;
1065         char *s;
1066
1067         val = strtoul(str, &s, 0);
1068         if (s == str || *s != '\0' || val >= 0x100)
1069                 val = match_token(icmpcodes, str);
1070         if (val < 0)
1071                 errx(EX_DATAERR, "unknown ICMP unreachable code ``%s''", str);
1072         *codep = val;
1073         return;
1074 }
1075
1076 static void
1077 print_reject_code(struct buf_pr *bp, uint16_t code)
1078 {
1079         char const *s;
1080
1081         if ((s = match_value(icmpcodes, code)) != NULL)
1082                 bprintf(bp, "unreach %s", s);
1083         else
1084                 bprintf(bp, "unreach %u", code);
1085 }
1086
1087 /*
1088  * Returns the number of bits set (from left) in a contiguous bitmask,
1089  * or -1 if the mask is not contiguous.
1090  * XXX this needs a proper fix.
1091  * This effectively works on masks in big-endian (network) format.
1092  * when compiled on little endian architectures.
1093  *
1094  * First bit is bit 7 of the first byte -- note, for MAC addresses,
1095  * the first bit on the wire is bit 0 of the first byte.
1096  * len is the max length in bits.
1097  */
1098 int
1099 contigmask(uint8_t *p, int len)
1100 {
1101         int i, n;
1102
1103         for (i=0; i<len ; i++)
1104                 if ( (p[i/8] & (1 << (7 - (i%8)))) == 0) /* first bit unset */
1105                         break;
1106         for (n=i+1; n < len; n++)
1107                 if ( (p[n/8] & (1 << (7 - (n%8)))) != 0)
1108                         return -1; /* mask not contiguous */
1109         return i;
1110 }
1111
1112 /*
1113  * print flags set/clear in the two bitmasks passed as parameters.
1114  * There is a specialized check for f_tcpflags.
1115  */
1116 static void
1117 print_flags(struct buf_pr *bp, char const *name, ipfw_insn *cmd,
1118     struct _s_x *list)
1119 {
1120         char const *comma = "";
1121         int i;
1122         uint8_t set = cmd->arg1 & 0xff;
1123         uint8_t clear = (cmd->arg1 >> 8) & 0xff;
1124
1125         if (list == f_tcpflags && set == TH_SYN && clear == TH_ACK) {
1126                 bprintf(bp, " setup");
1127                 return;
1128         }
1129
1130         bprintf(bp, " %s ", name);
1131         for (i=0; list[i].x != 0; i++) {
1132                 if (set & list[i].x) {
1133                         set &= ~list[i].x;
1134                         bprintf(bp, "%s%s", comma, list[i].s);
1135                         comma = ",";
1136                 }
1137                 if (clear & list[i].x) {
1138                         clear &= ~list[i].x;
1139                         bprintf(bp, "%s!%s", comma, list[i].s);
1140                         comma = ",";
1141                 }
1142         }
1143 }
1144
1145
1146 /*
1147  * Print the ip address contained in a command.
1148  */
1149 static void
1150 print_ip(struct buf_pr *bp, struct format_opts *fo, ipfw_insn_ip *cmd,
1151     char const *s)
1152 {
1153         struct hostent *he = NULL;
1154         struct in_addr *ia;
1155         uint32_t len = F_LEN((ipfw_insn *)cmd);
1156         uint32_t *a = ((ipfw_insn_u32 *)cmd)->d;
1157         char *t;
1158
1159         if (cmd->o.opcode == O_IP_DST_LOOKUP && len > F_INSN_SIZE(ipfw_insn_u32)) {
1160                 uint32_t d = a[1];
1161                 const char *arg = "<invalid>";
1162
1163                 if (d < sizeof(lookup_key)/sizeof(lookup_key[0]))
1164                         arg = match_value(rule_options, lookup_key[d]);
1165                 t = table_search_ctlv(fo->tstate, ((ipfw_insn *)cmd)->arg1);
1166                 bprintf(bp, "%s lookup %s %s", cmd->o.len & F_NOT ? " not": "",
1167                         arg, t);
1168                 return;
1169         }
1170         bprintf(bp, "%s%s ", cmd->o.len & F_NOT ? " not": "", s);
1171
1172         if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) {
1173                 bprintf(bp, "me");
1174                 return;
1175         }
1176         if (cmd->o.opcode == O_IP_SRC_LOOKUP ||
1177             cmd->o.opcode == O_IP_DST_LOOKUP) {
1178                 t = table_search_ctlv(fo->tstate, ((ipfw_insn *)cmd)->arg1);
1179                 bprintf(bp, "table(%s", t);
1180                 if (len == F_INSN_SIZE(ipfw_insn_u32))
1181                         bprintf(bp, ",%u", *a);
1182                 bprintf(bp, ")");
1183                 return;
1184         }
1185         if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) {
1186                 uint32_t x, *map = (uint32_t *)&(cmd->mask);
1187                 int i, j;
1188                 char comma = '{';
1189
1190                 x = cmd->o.arg1 - 1;
1191                 x = htonl( ~x );
1192                 cmd->addr.s_addr = htonl(cmd->addr.s_addr);
1193                 bprintf(bp, "%s/%d", inet_ntoa(cmd->addr),
1194                         contigmask((uint8_t *)&x, 32));
1195                 x = cmd->addr.s_addr = htonl(cmd->addr.s_addr);
1196                 x &= 0xff; /* base */
1197                 /*
1198                  * Print bits and ranges.
1199                  * Locate first bit set (i), then locate first bit unset (j).
1200                  * If we have 3+ consecutive bits set, then print them as a
1201                  * range, otherwise only print the initial bit and rescan.
1202                  */
1203                 for (i=0; i < cmd->o.arg1; i++)
1204                         if (map[i/32] & (1<<(i & 31))) {
1205                                 for (j=i+1; j < cmd->o.arg1; j++)
1206                                         if (!(map[ j/32] & (1<<(j & 31))))
1207                                                 break;
1208                                 bprintf(bp, "%c%d", comma, i+x);
1209                                 if (j>i+2) { /* range has at least 3 elements */
1210                                         bprintf(bp, "-%d", j-1+x);
1211                                         i = j-1;
1212                                 }
1213                                 comma = ',';
1214                         }
1215                 bprintf(bp, "}");
1216                 return;
1217         }
1218         /*
1219          * len == 2 indicates a single IP, whereas lists of 1 or more
1220          * addr/mask pairs have len = (2n+1). We convert len to n so we
1221          * use that to count the number of entries.
1222          */
1223     for (len = len / 2; len > 0; len--, a += 2) {
1224         int mb =        /* mask length */
1225             (cmd->o.opcode == O_IP_SRC || cmd->o.opcode == O_IP_DST) ?
1226                 32 : contigmask((uint8_t *)&(a[1]), 32);
1227         if (mb == 32 && co.do_resolv)
1228                 he = gethostbyaddr((char *)&(a[0]), sizeof(u_long), AF_INET);
1229         if (he != NULL)         /* resolved to name */
1230                 bprintf(bp, "%s", he->h_name);
1231         else if (mb == 0)       /* any */
1232                 bprintf(bp, "any");
1233         else {          /* numeric IP followed by some kind of mask */
1234                 ia = (struct in_addr *)&a[0];
1235                 bprintf(bp, "%s", inet_ntoa(*ia));
1236                 if (mb < 0) {
1237                         ia = (struct in_addr *)&a[1];
1238                         bprintf(bp, ":%s", inet_ntoa(*ia));
1239                 } else if (mb < 32)
1240                         bprintf(bp, "/%d", mb);
1241         }
1242         if (len > 1)
1243                 bprintf(bp, ",");
1244     }
1245 }
1246
1247 /*
1248  * prints a MAC address/mask pair
1249  */
1250 static void
1251 print_mac(struct buf_pr *bp, uint8_t *addr, uint8_t *mask)
1252 {
1253         int l = contigmask(mask, 48);
1254
1255         if (l == 0)
1256                 bprintf(bp, " any");
1257         else {
1258                 bprintf(bp, " %02x:%02x:%02x:%02x:%02x:%02x",
1259                     addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
1260                 if (l == -1)
1261                         bprintf(bp, "&%02x:%02x:%02x:%02x:%02x:%02x",
1262                             mask[0], mask[1], mask[2],
1263                             mask[3], mask[4], mask[5]);
1264                 else if (l < 48)
1265                         bprintf(bp, "/%d", l);
1266         }
1267 }
1268
1269 static void
1270 fill_icmptypes(ipfw_insn_u32 *cmd, char *av)
1271 {
1272         uint8_t type;
1273
1274         cmd->d[0] = 0;
1275         while (*av) {
1276                 if (*av == ',')
1277                         av++;
1278
1279                 type = strtoul(av, &av, 0);
1280
1281                 if (*av != ',' && *av != '\0')
1282                         errx(EX_DATAERR, "invalid ICMP type");
1283
1284                 if (type > 31)
1285                         errx(EX_DATAERR, "ICMP type out of range");
1286
1287                 cmd->d[0] |= 1 << type;
1288         }
1289         cmd->o.opcode = O_ICMPTYPE;
1290         cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32);
1291 }
1292
1293 static void
1294 print_icmptypes(struct buf_pr *bp, ipfw_insn_u32 *cmd)
1295 {
1296         int i;
1297         char sep= ' ';
1298
1299         bprintf(bp, " icmptypes");
1300         for (i = 0; i < 32; i++) {
1301                 if ( (cmd->d[0] & (1 << (i))) == 0)
1302                         continue;
1303                 bprintf(bp, "%c%d", sep, i);
1304                 sep = ',';
1305         }
1306 }
1307
1308 static void
1309 print_dscp(struct buf_pr *bp, ipfw_insn_u32 *cmd)
1310 {
1311         int i, c;
1312         uint32_t *v;
1313         char sep= ' ';
1314         const char *code;
1315
1316         bprintf(bp, " dscp");
1317         i = 0;
1318         c = 0;
1319         v = cmd->d;
1320         while (i < 64) {
1321                 if (*v & (1 << i)) {
1322                         if ((code = match_value(f_ipdscp, i)) != NULL)
1323                                 bprintf(bp, "%c%s", sep, code);
1324                         else
1325                                 bprintf(bp, "%c%d", sep, i);
1326                         sep = ',';
1327                 }
1328
1329                 if ((++i % 32) == 0)
1330                         v++;
1331         }
1332 }
1333
1334 /*
1335  * show_ipfw() prints the body of an ipfw rule.
1336  * Because the standard rule has at least proto src_ip dst_ip, we use
1337  * a helper function to produce these entries if not provided explicitly.
1338  * The first argument is the list of fields we have, the second is
1339  * the list of fields we want to be printed.
1340  *
1341  * Special cases if we have provided a MAC header:
1342  *   + if the rule does not contain IP addresses/ports, do not print them;
1343  *   + if the rule does not contain an IP proto, print "all" instead of "ip";
1344  *
1345  * Once we have 'have_options', IP header fields are printed as options.
1346  */
1347 #define HAVE_PROTO      0x0001
1348 #define HAVE_SRCIP      0x0002
1349 #define HAVE_DSTIP      0x0004
1350 #define HAVE_PROTO4     0x0008
1351 #define HAVE_PROTO6     0x0010
1352 #define HAVE_IP         0x0100
1353 #define HAVE_OPTIONS    0x8000
1354
1355 static void
1356 show_prerequisites(struct buf_pr *bp, int *flags, int want, int cmd)
1357 {
1358         (void)cmd;      /* UNUSED */
1359         if (co.comment_only)
1360                 return;
1361         if ( (*flags & HAVE_IP) == HAVE_IP)
1362                 *flags |= HAVE_OPTIONS;
1363
1364         if ( !(*flags & HAVE_OPTIONS)) {
1365                 if ( !(*flags & HAVE_PROTO) && (want & HAVE_PROTO)) {
1366                         if ( (*flags & HAVE_PROTO4))
1367                                 bprintf(bp, " ip4");
1368                         else if ( (*flags & HAVE_PROTO6))
1369                                 bprintf(bp, " ip6");
1370                         else
1371                                 bprintf(bp, " ip");
1372                 }
1373                 if ( !(*flags & HAVE_SRCIP) && (want & HAVE_SRCIP))
1374                         bprintf(bp, " from any");
1375                 if ( !(*flags & HAVE_DSTIP) && (want & HAVE_DSTIP))
1376                         bprintf(bp, " to any");
1377         }
1378         *flags |= want;
1379 }
1380
1381 static void
1382 show_static_rule(struct cmdline_opts *co, struct format_opts *fo,
1383     struct buf_pr *bp, struct ip_fw_rule *rule, struct ip_fw_bcounter *cntr)
1384 {
1385         static int twidth = 0;
1386         int l;
1387         ipfw_insn *cmd, *tagptr = NULL;
1388         const char *comment = NULL;     /* ptr to comment if we have one */
1389         int proto = 0;          /* default */
1390         int flags = 0;  /* prerequisites */
1391         ipfw_insn_log *logptr = NULL; /* set if we find an O_LOG */
1392         ipfw_insn_altq *altqptr = NULL; /* set if we find an O_ALTQ */
1393         int or_block = 0;       /* we are in an or block */
1394         uint32_t uval;
1395
1396         if ((fo->set_mask & (1 << rule->set)) == 0) {
1397                 /* disabled mask */
1398                 if (!co->show_sets)
1399                         return;
1400                 else
1401                         bprintf(bp, "# DISABLED ");
1402         }
1403         bprintf(bp, "%05u ", rule->rulenum);
1404
1405         /* Print counters if enabled */
1406         if (fo->pcwidth > 0 || fo->bcwidth > 0) {
1407                 pr_u64(bp, &cntr->pcnt, fo->pcwidth);
1408                 pr_u64(bp, &cntr->bcnt, fo->bcwidth);
1409         }
1410
1411         if (co->do_time == 2)
1412                 bprintf(bp, "%10u ", cntr->timestamp);
1413         else if (co->do_time == 1) {
1414                 char timestr[30];
1415                 time_t t = (time_t)0;
1416
1417                 if (twidth == 0) {
1418                         strcpy(timestr, ctime(&t));
1419                         *strchr(timestr, '\n') = '\0';
1420                         twidth = strlen(timestr);
1421                 }
1422                 if (cntr->timestamp > 0) {
1423                         t = _long_to_time(cntr->timestamp);
1424
1425                         strcpy(timestr, ctime(&t));
1426                         *strchr(timestr, '\n') = '\0';
1427                         bprintf(bp, "%s ", timestr);
1428                 } else {
1429                         bprintf(bp, "%*s", twidth, " ");
1430                 }
1431         }
1432
1433         if (co->show_sets)
1434                 bprintf(bp, "set %d ", rule->set);
1435
1436         /*
1437          * print the optional "match probability"
1438          */
1439         if (rule->cmd_len > 0) {
1440                 cmd = rule->cmd ;
1441                 if (cmd->opcode == O_PROB) {
1442                         ipfw_insn_u32 *p = (ipfw_insn_u32 *)cmd;
1443                         double d = 1.0 * p->d[0];
1444
1445                         d = (d / 0x7fffffff);
1446                         bprintf(bp, "prob %f ", d);
1447                 }
1448         }
1449
1450         /*
1451          * first print actions
1452          */
1453         for (l = rule->cmd_len - rule->act_ofs, cmd = ACTION_PTR(rule);
1454                         l > 0 ; l -= F_LEN(cmd), cmd += F_LEN(cmd)) {
1455                 switch(cmd->opcode) {
1456                 case O_CHECK_STATE:
1457                         bprintf(bp, "check-state");
1458                         /* avoid printing anything else */
1459                         flags = HAVE_PROTO | HAVE_SRCIP |
1460                                 HAVE_DSTIP | HAVE_IP;
1461                         break;
1462
1463                 case O_ACCEPT:
1464                         bprintf(bp, "allow");
1465                         break;
1466
1467                 case O_COUNT:
1468                         bprintf(bp, "count");
1469                         break;
1470
1471                 case O_DENY:
1472                         bprintf(bp, "deny");
1473                         break;
1474
1475                 case O_REJECT:
1476                         if (cmd->arg1 == ICMP_REJECT_RST)
1477                                 bprintf(bp, "reset");
1478                         else if (cmd->arg1 == ICMP_UNREACH_HOST)
1479                                 bprintf(bp, "reject");
1480                         else
1481                                 print_reject_code(bp, cmd->arg1);
1482                         break;
1483
1484                 case O_UNREACH6:
1485                         if (cmd->arg1 == ICMP6_UNREACH_RST)
1486                                 bprintf(bp, "reset6");
1487                         else
1488                                 print_unreach6_code(cmd->arg1);
1489                         break;
1490
1491                 case O_SKIPTO:
1492                         bprint_uint_arg(bp, "skipto ", cmd->arg1);
1493                         break;
1494
1495                 case O_PIPE:
1496                         bprint_uint_arg(bp, "pipe ", cmd->arg1);
1497                         break;
1498
1499                 case O_QUEUE:
1500                         bprint_uint_arg(bp, "queue ", cmd->arg1);
1501                         break;
1502
1503                 case O_DIVERT:
1504                         bprint_uint_arg(bp, "divert ", cmd->arg1);
1505                         break;
1506
1507                 case O_TEE:
1508                         bprint_uint_arg(bp, "tee ", cmd->arg1);
1509                         break;
1510
1511                 case O_NETGRAPH:
1512                         bprint_uint_arg(bp, "netgraph ", cmd->arg1);
1513                         break;
1514
1515                 case O_NGTEE:
1516                         bprint_uint_arg(bp, "ngtee ", cmd->arg1);
1517                         break;
1518
1519                 case O_FORWARD_IP:
1520                     {
1521                         ipfw_insn_sa *s = (ipfw_insn_sa *)cmd;
1522
1523                         if (s->sa.sin_addr.s_addr == INADDR_ANY) {
1524                                 bprintf(bp, "fwd tablearg");
1525                         } else {
1526                                 bprintf(bp, "fwd %s",inet_ntoa(s->sa.sin_addr));
1527                         }
1528                         if (s->sa.sin_port)
1529                                 bprintf(bp, ",%d", s->sa.sin_port);
1530                     }
1531                         break;
1532
1533                 case O_FORWARD_IP6:
1534                     {
1535                         char buf[INET6_ADDRSTRLEN + IF_NAMESIZE + 2];
1536                         ipfw_insn_sa6 *s = (ipfw_insn_sa6 *)cmd;
1537
1538                         bprintf(bp, "fwd ");
1539                         if (getnameinfo((const struct sockaddr *)&s->sa,
1540                             sizeof(struct sockaddr_in6), buf, sizeof(buf),
1541                             NULL, 0, NI_NUMERICHOST) == 0)
1542                                 bprintf(bp, "%s", buf);
1543                         if (s->sa.sin6_port)
1544                                 bprintf(bp, ",%d", s->sa.sin6_port);
1545                     }
1546                         break;
1547
1548                 case O_LOG: /* O_LOG is printed last */
1549                         logptr = (ipfw_insn_log *)cmd;
1550                         break;
1551
1552                 case O_ALTQ: /* O_ALTQ is printed after O_LOG */
1553                         altqptr = (ipfw_insn_altq *)cmd;
1554                         break;
1555
1556                 case O_TAG:
1557                         tagptr = cmd;
1558                         break;
1559
1560                 case O_NAT:
1561                         if (cmd->arg1 != 0)
1562                                 bprint_uint_arg(bp, "nat ", cmd->arg1);
1563                         else
1564                                 bprintf(bp, "nat global");
1565                         break;
1566
1567                 case O_SETFIB:
1568                         bprint_uint_arg(bp, "setfib ", cmd->arg1 & 0x7FFF);
1569                         break;
1570
1571                 case O_SETDSCP:
1572                     {
1573                         const char *code;
1574
1575                         if (cmd->arg1 == IP_FW_TARG) {
1576                                 bprint_uint_arg(bp, "setdscp ", cmd->arg1);
1577                                 break;
1578                         }
1579                         uval = cmd->arg1 & 0x3F;
1580                         if ((code = match_value(f_ipdscp, uval)) != NULL)
1581                                 bprintf(bp, "setdscp %s", code);
1582                         else
1583                                 bprint_uint_arg(bp, "setdscp ", uval);
1584                     }
1585                         break;
1586
1587                 case O_REASS:
1588                         bprintf(bp, "reass");
1589                         break;
1590
1591                 case O_CALLRETURN:
1592                         if (cmd->len & F_NOT)
1593                                 bprintf(bp, "return");
1594                         else
1595                                 bprint_uint_arg(bp, "call ", cmd->arg1);
1596                         break;
1597
1598                 default:
1599                         bprintf(bp, "** unrecognized action %d len %d ",
1600                                 cmd->opcode, cmd->len);
1601                 }
1602         }
1603         if (logptr) {
1604                 if (logptr->max_log > 0)
1605                         bprintf(bp, " log logamount %d", logptr->max_log);
1606                 else
1607                         bprintf(bp, " log");
1608         }
1609 #ifndef NO_ALTQ
1610         if (altqptr) {
1611                 print_altq_cmd(bp, altqptr);
1612         }
1613 #endif
1614         if (tagptr) {
1615                 if (tagptr->len & F_NOT)
1616                         bprint_uint_arg(bp, " untag ", tagptr->arg1);
1617                 else
1618                         bprint_uint_arg(bp, " tag ", tagptr->arg1);
1619         }
1620
1621         /*
1622          * then print the body.
1623          */
1624         for (l = rule->act_ofs, cmd = rule->cmd;
1625                         l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) {
1626                 if ((cmd->len & F_OR) || (cmd->len & F_NOT))
1627                         continue;
1628                 if (cmd->opcode == O_IP4) {
1629                         flags |= HAVE_PROTO4;
1630                         break;
1631                 } else if (cmd->opcode == O_IP6) {
1632                         flags |= HAVE_PROTO6;
1633                         break;
1634                 }
1635         }
1636         if (rule->flags & IPFW_RULE_NOOPT) {    /* empty rules before options */
1637                 if (!co->do_compact) {
1638                         show_prerequisites(bp, &flags, HAVE_PROTO, 0);
1639                         bprintf(bp, " from any to any");
1640                 }
1641                 flags |= HAVE_IP | HAVE_OPTIONS | HAVE_PROTO |
1642                          HAVE_SRCIP | HAVE_DSTIP;
1643         }
1644
1645         if (co->comment_only)
1646                 comment = "...";
1647
1648         for (l = rule->act_ofs, cmd = rule->cmd;
1649                         l > 0 ; l -= F_LEN(cmd) , cmd += F_LEN(cmd)) {
1650                 /* useful alias */
1651                 ipfw_insn_u32 *cmd32 = (ipfw_insn_u32 *)cmd;
1652
1653                 if (co->comment_only) {
1654                         if (cmd->opcode != O_NOP)
1655                                 continue;
1656                         bprintf(bp, " // %s\n", (char *)(cmd + 1));
1657                         return;
1658                 }
1659
1660                 show_prerequisites(bp, &flags, 0, cmd->opcode);
1661
1662                 switch(cmd->opcode) {
1663                 case O_PROB:
1664                         break;  /* done already */
1665
1666                 case O_PROBE_STATE:
1667                         break; /* no need to print anything here */
1668
1669                 case O_IP_SRC:
1670                 case O_IP_SRC_LOOKUP:
1671                 case O_IP_SRC_MASK:
1672                 case O_IP_SRC_ME:
1673                 case O_IP_SRC_SET:
1674                         show_prerequisites(bp, &flags, HAVE_PROTO, 0);
1675                         if (!(flags & HAVE_SRCIP))
1676                                 bprintf(bp, " from");
1677                         if ((cmd->len & F_OR) && !or_block)
1678                                 bprintf(bp, " {");
1679                         print_ip(bp, fo, (ipfw_insn_ip *)cmd,
1680                                 (flags & HAVE_OPTIONS) ? " src-ip" : "");
1681                         flags |= HAVE_SRCIP;
1682                         break;
1683
1684                 case O_IP_DST:
1685                 case O_IP_DST_LOOKUP:
1686                 case O_IP_DST_MASK:
1687                 case O_IP_DST_ME:
1688                 case O_IP_DST_SET:
1689                         show_prerequisites(bp, &flags, HAVE_PROTO|HAVE_SRCIP, 0);
1690                         if (!(flags & HAVE_DSTIP))
1691                                 bprintf(bp, " to");
1692                         if ((cmd->len & F_OR) && !or_block)
1693                                 bprintf(bp, " {");
1694                         print_ip(bp, fo, (ipfw_insn_ip *)cmd,
1695                                 (flags & HAVE_OPTIONS) ? " dst-ip" : "");
1696                         flags |= HAVE_DSTIP;
1697                         break;
1698
1699                 case O_IP6_SRC:
1700                 case O_IP6_SRC_MASK:
1701                 case O_IP6_SRC_ME:
1702                         show_prerequisites(bp, &flags, HAVE_PROTO, 0);
1703                         if (!(flags & HAVE_SRCIP))
1704                                 bprintf(bp, " from");
1705                         if ((cmd->len & F_OR) && !or_block)
1706                                 bprintf(bp, " {");
1707                         print_ip6(bp, (ipfw_insn_ip6 *)cmd,
1708                             (flags & HAVE_OPTIONS) ? " src-ip6" : "");
1709                         flags |= HAVE_SRCIP | HAVE_PROTO;
1710                         break;
1711
1712                 case O_IP6_DST:
1713                 case O_IP6_DST_MASK:
1714                 case O_IP6_DST_ME:
1715                         show_prerequisites(bp, &flags, HAVE_PROTO|HAVE_SRCIP, 0);
1716                         if (!(flags & HAVE_DSTIP))
1717                                 bprintf(bp, " to");
1718                         if ((cmd->len & F_OR) && !or_block)
1719                                 bprintf(bp, " {");
1720                         print_ip6(bp, (ipfw_insn_ip6 *)cmd,
1721                             (flags & HAVE_OPTIONS) ? " dst-ip6" : "");
1722                         flags |= HAVE_DSTIP;
1723                         break;
1724
1725                 case O_FLOW6ID:
1726                         print_flow6id(bp, (ipfw_insn_u32 *) cmd );
1727                         flags |= HAVE_OPTIONS;
1728                         break;
1729
1730                 case O_IP_DSTPORT:
1731                         show_prerequisites(bp, &flags,
1732                                 HAVE_PROTO | HAVE_SRCIP |
1733                                 HAVE_DSTIP | HAVE_IP, 0);
1734                 case O_IP_SRCPORT:
1735                         if (flags & HAVE_DSTIP)
1736                                 flags |= HAVE_IP;
1737                         show_prerequisites(bp, &flags,
1738                                 HAVE_PROTO | HAVE_SRCIP, 0);
1739                         if ((cmd->len & F_OR) && !or_block)
1740                                 bprintf(bp, " {");
1741                         if (cmd->len & F_NOT)
1742                                 bprintf(bp, " not");
1743                         print_newports(bp, (ipfw_insn_u16 *)cmd, proto,
1744                                 (flags & HAVE_OPTIONS) ? cmd->opcode : 0);
1745                         break;
1746
1747                 case O_PROTO: {
1748                         struct protoent *pe = NULL;
1749
1750                         if ((cmd->len & F_OR) && !or_block)
1751                                 bprintf(bp, " {");
1752                         if (cmd->len & F_NOT)
1753                                 bprintf(bp, " not");
1754                         proto = cmd->arg1;
1755                         pe = getprotobynumber(cmd->arg1);
1756                         if ((flags & (HAVE_PROTO4 | HAVE_PROTO6)) &&
1757                             !(flags & HAVE_PROTO))
1758                                 show_prerequisites(bp, &flags,
1759                                     HAVE_PROTO | HAVE_IP | HAVE_SRCIP |
1760                                     HAVE_DSTIP | HAVE_OPTIONS, 0);
1761                         if (flags & HAVE_OPTIONS)
1762                                 bprintf(bp, " proto");
1763                         if (pe)
1764                                 bprintf(bp, " %s", pe->p_name);
1765                         else
1766                                 bprintf(bp, " %u", cmd->arg1);
1767                         }
1768                         flags |= HAVE_PROTO;
1769                         break;
1770
1771                 default: /*options ... */
1772                         if (!(cmd->len & (F_OR|F_NOT)))
1773                                 if (((cmd->opcode == O_IP6) &&
1774                                     (flags & HAVE_PROTO6)) ||
1775                                     ((cmd->opcode == O_IP4) &&
1776                                     (flags & HAVE_PROTO4)))
1777                                         break;
1778                         show_prerequisites(bp, &flags, HAVE_PROTO | HAVE_SRCIP |
1779                                     HAVE_DSTIP | HAVE_IP | HAVE_OPTIONS, 0);
1780                         if ((cmd->len & F_OR) && !or_block)
1781                                 bprintf(bp, " {");
1782                         if (cmd->len & F_NOT && cmd->opcode != O_IN)
1783                                 bprintf(bp, " not");
1784                         switch(cmd->opcode) {
1785                         case O_MACADDR2: {
1786                                 ipfw_insn_mac *m = (ipfw_insn_mac *)cmd;
1787
1788                                 bprintf(bp, " MAC");
1789                                 print_mac(bp, m->addr, m->mask);
1790                                 print_mac(bp, m->addr + 6, m->mask + 6);
1791                                 }
1792                                 break;
1793
1794                         case O_MAC_TYPE:
1795                                 print_newports(bp, (ipfw_insn_u16 *)cmd,
1796                                                 IPPROTO_ETHERTYPE, cmd->opcode);
1797                                 break;
1798
1799
1800                         case O_FRAG:
1801                                 bprintf(bp, " frag");
1802                                 break;
1803
1804                         case O_FIB:
1805                                 bprintf(bp, " fib %u", cmd->arg1 );
1806                                 break;
1807                         case O_SOCKARG:
1808                                 bprintf(bp, " sockarg");
1809                                 break;
1810
1811                         case O_IN:
1812                                 bprintf(bp, cmd->len & F_NOT ? " out" : " in");
1813                                 break;
1814
1815                         case O_DIVERTED:
1816                                 switch (cmd->arg1) {
1817                                 case 3:
1818                                         bprintf(bp, " diverted");
1819                                         break;
1820                                 case 1:
1821                                         bprintf(bp, " diverted-loopback");
1822                                         break;
1823                                 case 2:
1824                                         bprintf(bp, " diverted-output");
1825                                         break;
1826                                 default:
1827                                         bprintf(bp, " diverted-?<%u>", cmd->arg1);
1828                                         break;
1829                                 }
1830                                 break;
1831
1832                         case O_LAYER2:
1833                                 bprintf(bp, " layer2");
1834                                 break;
1835                         case O_XMIT:
1836                         case O_RECV:
1837                         case O_VIA:
1838                             {
1839                                 char const *s, *t;
1840                                 ipfw_insn_if *cmdif = (ipfw_insn_if *)cmd;
1841
1842                                 if (cmd->opcode == O_XMIT)
1843                                         s = "xmit";
1844                                 else if (cmd->opcode == O_RECV)
1845                                         s = "recv";
1846                                 else /* if (cmd->opcode == O_VIA) */
1847                                         s = "via";
1848                                 if (cmdif->name[0] == '\0')
1849                                         bprintf(bp, " %s %s", s,
1850                                             inet_ntoa(cmdif->p.ip));
1851                                 else if (cmdif->name[0] == '\1') {
1852                                         /* interface table */
1853                                         t = table_search_ctlv(fo->tstate,
1854                                             cmdif->p.kidx);
1855                                         bprintf(bp, " %s table(%s)", s, t);
1856                                 } else
1857                                         bprintf(bp, " %s %s", s, cmdif->name);
1858
1859                                 break;
1860                             }
1861                         case O_IP_FLOW_LOOKUP:
1862                             {
1863                                 char *t;
1864
1865                                 t = table_search_ctlv(fo->tstate, cmd->arg1);
1866                                 bprintf(bp, " flow table(%s", t);
1867                                 if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32))
1868                                         bprintf(bp, ",%u",
1869                                             ((ipfw_insn_u32 *)cmd)->d[0]);
1870                                 bprintf(bp, ")");
1871                                 break;
1872                             }
1873                         case O_IPID:
1874                                 if (F_LEN(cmd) == 1)
1875                                     bprintf(bp, " ipid %u", cmd->arg1 );
1876                                 else
1877                                     print_newports(bp, (ipfw_insn_u16 *)cmd, 0,
1878                                         O_IPID);
1879                                 break;
1880
1881                         case O_IPTTL:
1882                                 if (F_LEN(cmd) == 1)
1883                                     bprintf(bp, " ipttl %u", cmd->arg1 );
1884                                 else
1885                                     print_newports(bp, (ipfw_insn_u16 *)cmd, 0,
1886                                         O_IPTTL);
1887                                 break;
1888
1889                         case O_IPVER:
1890                                 bprintf(bp, " ipver %u", cmd->arg1 );
1891                                 break;
1892
1893                         case O_IPPRECEDENCE:
1894                                 bprintf(bp, " ipprecedence %u", cmd->arg1 >> 5);
1895                                 break;
1896
1897                         case O_DSCP:
1898                                 print_dscp(bp, (ipfw_insn_u32 *)cmd);
1899                                 break;
1900
1901                         case O_IPLEN:
1902                                 if (F_LEN(cmd) == 1)
1903                                     bprintf(bp, " iplen %u", cmd->arg1 );
1904                                 else
1905                                     print_newports(bp, (ipfw_insn_u16 *)cmd, 0,
1906                                         O_IPLEN);
1907                                 break;
1908
1909                         case O_IPOPT:
1910                                 print_flags(bp, "ipoptions", cmd, f_ipopts);
1911                                 break;
1912
1913                         case O_IPTOS:
1914                                 print_flags(bp, "iptos", cmd, f_iptos);
1915                                 break;
1916
1917                         case O_ICMPTYPE:
1918                                 print_icmptypes(bp, (ipfw_insn_u32 *)cmd);
1919                                 break;
1920
1921                         case O_ESTAB:
1922                                 bprintf(bp, " established");
1923                                 break;
1924
1925                         case O_TCPDATALEN:
1926                                 if (F_LEN(cmd) == 1)
1927                                     bprintf(bp, " tcpdatalen %u", cmd->arg1 );
1928                                 else
1929                                     print_newports(bp, (ipfw_insn_u16 *)cmd, 0,
1930                                         O_TCPDATALEN);
1931                                 break;
1932
1933                         case O_TCPFLAGS:
1934                                 print_flags(bp, "tcpflags", cmd, f_tcpflags);
1935                                 break;
1936
1937                         case O_TCPOPTS:
1938                                 print_flags(bp, "tcpoptions", cmd, f_tcpopts);
1939                                 break;
1940
1941                         case O_TCPWIN:
1942                                 if (F_LEN(cmd) == 1)
1943                                     bprintf(bp, " tcpwin %u", cmd->arg1);
1944                                 else
1945                                     print_newports(bp, (ipfw_insn_u16 *)cmd, 0,
1946                                         O_TCPWIN);
1947                                 break;
1948
1949                         case O_TCPACK:
1950                                 bprintf(bp, " tcpack %d", ntohl(cmd32->d[0]));
1951                                 break;
1952
1953                         case O_TCPSEQ:
1954                                 bprintf(bp, " tcpseq %d", ntohl(cmd32->d[0]));
1955                                 break;
1956
1957                         case O_UID:
1958                             {
1959                                 struct passwd *pwd = getpwuid(cmd32->d[0]);
1960
1961                                 if (pwd)
1962                                         bprintf(bp, " uid %s", pwd->pw_name);
1963                                 else
1964                                         bprintf(bp, " uid %u", cmd32->d[0]);
1965                             }
1966                                 break;
1967
1968                         case O_GID:
1969                             {
1970                                 struct group *grp = getgrgid(cmd32->d[0]);
1971
1972                                 if (grp)
1973                                         bprintf(bp, " gid %s", grp->gr_name);
1974                                 else
1975                                         bprintf(bp, " gid %u", cmd32->d[0]);
1976                             }
1977                                 break;
1978
1979                         case O_JAIL:
1980                                 bprintf(bp, " jail %d", cmd32->d[0]);
1981                                 break;
1982
1983                         case O_VERREVPATH:
1984                                 bprintf(bp, " verrevpath");
1985                                 break;
1986
1987                         case O_VERSRCREACH:
1988                                 bprintf(bp, " versrcreach");
1989                                 break;
1990
1991                         case O_ANTISPOOF:
1992                                 bprintf(bp, " antispoof");
1993                                 break;
1994
1995                         case O_IPSEC:
1996                                 bprintf(bp, " ipsec");
1997                                 break;
1998
1999                         case O_NOP:
2000                                 comment = (char *)(cmd + 1);
2001                                 break;
2002
2003                         case O_KEEP_STATE:
2004                                 bprintf(bp, " keep-state");
2005                                 break;
2006
2007                         case O_LIMIT: {
2008                                 struct _s_x *p = limit_masks;
2009                                 ipfw_insn_limit *c = (ipfw_insn_limit *)cmd;
2010                                 uint8_t x = c->limit_mask;
2011                                 char const *comma = " ";
2012
2013                                 bprintf(bp, " limit");
2014                                 for (; p->x != 0 ; p++)
2015                                         if ((x & p->x) == p->x) {
2016                                                 x &= ~p->x;
2017                                                 bprintf(bp, "%s%s", comma,p->s);
2018                                                 comma = ",";
2019                                         }
2020                                 bprint_uint_arg(bp, " ", c->conn_limit);
2021                                 break;
2022                         }
2023
2024                         case O_IP6:
2025                                 bprintf(bp, " ip6");
2026                                 break;
2027
2028                         case O_IP4:
2029                                 bprintf(bp, " ip4");
2030                                 break;
2031
2032                         case O_ICMP6TYPE:
2033                                 print_icmp6types(bp, (ipfw_insn_u32 *)cmd);
2034                                 break;
2035
2036                         case O_EXT_HDR:
2037                                 print_ext6hdr(bp, (ipfw_insn *)cmd);
2038                                 break;
2039
2040                         case O_TAGGED:
2041                                 if (F_LEN(cmd) == 1)
2042                                         bprint_uint_arg(bp, " tagged ",
2043                                             cmd->arg1);
2044                                 else
2045                                         print_newports(bp, (ipfw_insn_u16 *)cmd,
2046                                             0, O_TAGGED);
2047                                 break;
2048
2049                         default:
2050                                 bprintf(bp, " [opcode %d len %d]",
2051                                     cmd->opcode, cmd->len);
2052                         }
2053                 }
2054                 if (cmd->len & F_OR) {
2055                         bprintf(bp, " or");
2056                         or_block = 1;
2057                 } else if (or_block) {
2058                         bprintf(bp, " }");
2059                         or_block = 0;
2060                 }
2061         }
2062         show_prerequisites(bp, &flags, HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP
2063                                               | HAVE_IP, 0);
2064         if (comment)
2065                 bprintf(bp, " // %s", comment);
2066         bprintf(bp, "\n");
2067 }
2068
2069 static void
2070 show_dyn_state(struct cmdline_opts *co, struct format_opts *fo,
2071     struct buf_pr *bp, ipfw_dyn_rule *d)
2072 {
2073         struct protoent *pe;
2074         struct in_addr a;
2075         uint16_t rulenum;
2076         char buf[INET6_ADDRSTRLEN];
2077
2078         if (!co->do_expired) {
2079                 if (!d->expire && !(d->dyn_type == O_LIMIT_PARENT))
2080                         return;
2081         }
2082         bcopy(&d->rule, &rulenum, sizeof(rulenum));
2083         bprintf(bp, "%05d", rulenum);
2084         if (fo->pcwidth > 0 || fo->bcwidth > 0) {
2085                 bprintf(bp, " ");
2086                 pr_u64(bp, &d->pcnt, fo->pcwidth);
2087                 pr_u64(bp, &d->bcnt, fo->bcwidth);
2088                 bprintf(bp, "(%ds)", d->expire);
2089         }
2090         switch (d->dyn_type) {
2091         case O_LIMIT_PARENT:
2092                 bprintf(bp, " PARENT %d", d->count);
2093                 break;
2094         case O_LIMIT:
2095                 bprintf(bp, " LIMIT");
2096                 break;
2097         case O_KEEP_STATE: /* bidir, no mask */
2098                 bprintf(bp, " STATE");
2099                 break;
2100         }
2101
2102         if ((pe = getprotobynumber(d->id.proto)) != NULL)
2103                 bprintf(bp, " %s", pe->p_name);
2104         else
2105                 bprintf(bp, " proto %u", d->id.proto);
2106
2107         if (d->id.addr_type == 4) {
2108                 a.s_addr = htonl(d->id.src_ip);
2109                 bprintf(bp, " %s %d", inet_ntoa(a), d->id.src_port);
2110
2111                 a.s_addr = htonl(d->id.dst_ip);
2112                 bprintf(bp, " <-> %s %d", inet_ntoa(a), d->id.dst_port);
2113         } else if (d->id.addr_type == 6) {
2114                 bprintf(bp, " %s %d", inet_ntop(AF_INET6, &d->id.src_ip6, buf,
2115                     sizeof(buf)), d->id.src_port);
2116                 bprintf(bp, " <-> %s %d", inet_ntop(AF_INET6, &d->id.dst_ip6,
2117                     buf, sizeof(buf)), d->id.dst_port);
2118         } else
2119                 bprintf(bp, " UNKNOWN <-> UNKNOWN\n");
2120 }
2121
2122 static int
2123 do_range_cmd(int cmd, ipfw_range_tlv *rt)
2124 {
2125         ipfw_range_header rh;
2126         size_t sz;
2127
2128         memset(&rh, 0, sizeof(rh));
2129         memcpy(&rh.range, rt, sizeof(*rt));
2130         rh.range.head.length = sizeof(*rt);
2131         rh.range.head.type = IPFW_TLV_RANGE;
2132         sz = sizeof(rh);
2133
2134         if (do_get3(cmd, &rh.opheader, &sz) != 0)
2135                 return (-1);
2136         /* Save number of matched objects */
2137         rt->new_set = rh.range.new_set;
2138         return (0);
2139 }
2140
2141 /*
2142  * This one handles all set-related commands
2143  *      ipfw set { show | enable | disable }
2144  *      ipfw set swap X Y
2145  *      ipfw set move X to Y
2146  *      ipfw set move rule X to Y
2147  */
2148 void
2149 ipfw_sets_handler(char *av[])
2150 {
2151         uint32_t masks[2];
2152         int i;
2153         uint8_t cmd, rulenum;
2154         ipfw_range_tlv rt;
2155         char *msg;
2156         size_t size;
2157
2158         av++;
2159         memset(&rt, 0, sizeof(rt));
2160
2161         if (av[0] == NULL)
2162                 errx(EX_USAGE, "set needs command");
2163         if (_substrcmp(*av, "show") == 0) {
2164                 struct format_opts fo;
2165                 ipfw_cfg_lheader *cfg;
2166
2167                 memset(&fo, 0, sizeof(fo));
2168                 if (ipfw_get_config(&co, &fo, &cfg, &size) != 0)
2169                         err(EX_OSERR, "requesting config failed");
2170
2171                 for (i = 0, msg = "disable"; i < RESVD_SET; i++)
2172                         if ((cfg->set_mask & (1<<i)) == 0) {
2173                                 printf("%s %d", msg, i);
2174                                 msg = "";
2175                         }
2176                 msg = (cfg->set_mask != (uint32_t)-1) ? " enable" : "enable";
2177                 for (i = 0; i < RESVD_SET; i++)
2178                         if ((cfg->set_mask & (1<<i)) != 0) {
2179                                 printf("%s %d", msg, i);
2180                                 msg = "";
2181                         }
2182                 printf("\n");
2183                 free(cfg);
2184         } else if (_substrcmp(*av, "swap") == 0) {
2185                 av++;
2186                 if ( av[0] == NULL || av[1] == NULL )
2187                         errx(EX_USAGE, "set swap needs 2 set numbers\n");
2188                 rt.set = atoi(av[0]);
2189                 rt.new_set = atoi(av[1]);
2190                 if (!isdigit(*(av[0])) || rt.set > RESVD_SET)
2191                         errx(EX_DATAERR, "invalid set number %s\n", av[0]);
2192                 if (!isdigit(*(av[1])) || rt.new_set > RESVD_SET)
2193                         errx(EX_DATAERR, "invalid set number %s\n", av[1]);
2194                 i = do_range_cmd(IP_FW_SET_SWAP, &rt);
2195         } else if (_substrcmp(*av, "move") == 0) {
2196                 av++;
2197                 if (av[0] && _substrcmp(*av, "rule") == 0) {
2198                         rt.flags = IPFW_RCFLAG_RANGE; /* move rules to new set */
2199                         cmd = IP_FW_XMOVE;
2200                         av++;
2201                 } else
2202                         cmd = IP_FW_SET_MOVE; /* Move set to new one */
2203                 if (av[0] == NULL || av[1] == NULL || av[2] == NULL ||
2204                                 av[3] != NULL ||  _substrcmp(av[1], "to") != 0)
2205                         errx(EX_USAGE, "syntax: set move [rule] X to Y\n");
2206                 rulenum = atoi(av[0]);
2207                 rt.new_set = atoi(av[2]);
2208                 if (cmd == IP_FW_XMOVE) {
2209                         rt.start_rule = rulenum;
2210                         rt.end_rule = rulenum;
2211                 } else
2212                         rt.set = rulenum;
2213                 rt.new_set = atoi(av[2]);
2214                 if (!isdigit(*(av[0])) || (cmd == 3 && rt.set > RESVD_SET) ||
2215                         (cmd == 2 && rt.start_rule == IPFW_DEFAULT_RULE) )
2216                         errx(EX_DATAERR, "invalid source number %s\n", av[0]);
2217                 if (!isdigit(*(av[2])) || rt.new_set > RESVD_SET)
2218                         errx(EX_DATAERR, "invalid dest. set %s\n", av[1]);
2219                 i = do_range_cmd(cmd, &rt);
2220         } else if (_substrcmp(*av, "disable") == 0 ||
2221                    _substrcmp(*av, "enable") == 0 ) {
2222                 int which = _substrcmp(*av, "enable") == 0 ? 1 : 0;
2223
2224                 av++;
2225                 masks[0] = masks[1] = 0;
2226
2227                 while (av[0]) {
2228                         if (isdigit(**av)) {
2229                                 i = atoi(*av);
2230                                 if (i < 0 || i > RESVD_SET)
2231                                         errx(EX_DATAERR,
2232                                             "invalid set number %d\n", i);
2233                                 masks[which] |= (1<<i);
2234                         } else if (_substrcmp(*av, "disable") == 0)
2235                                 which = 0;
2236                         else if (_substrcmp(*av, "enable") == 0)
2237                                 which = 1;
2238                         else
2239                                 errx(EX_DATAERR,
2240                                         "invalid set command %s\n", *av);
2241                         av++;
2242                 }
2243                 if ( (masks[0] & masks[1]) != 0 )
2244                         errx(EX_DATAERR,
2245                             "cannot enable and disable the same set\n");
2246
2247                 rt.set = masks[0];
2248                 rt.new_set = masks[1];
2249                 i = do_range_cmd(IP_FW_SET_ENABLE, &rt);
2250                 if (i)
2251                         warn("set enable/disable: setsockopt(IP_FW_SET_ENABLE)");
2252         } else
2253                 errx(EX_USAGE, "invalid set command %s\n", *av);
2254 }
2255
2256 void
2257 ipfw_sysctl_handler(char *av[], int which)
2258 {
2259         av++;
2260
2261         if (av[0] == NULL) {
2262                 warnx("missing keyword to enable/disable\n");
2263         } else if (_substrcmp(*av, "firewall") == 0) {
2264                 sysctlbyname("net.inet.ip.fw.enable", NULL, 0,
2265                     &which, sizeof(which));
2266                 sysctlbyname("net.inet6.ip6.fw.enable", NULL, 0,
2267                     &which, sizeof(which));
2268         } else if (_substrcmp(*av, "one_pass") == 0) {
2269                 sysctlbyname("net.inet.ip.fw.one_pass", NULL, 0,
2270                     &which, sizeof(which));
2271         } else if (_substrcmp(*av, "debug") == 0) {
2272                 sysctlbyname("net.inet.ip.fw.debug", NULL, 0,
2273                     &which, sizeof(which));
2274         } else if (_substrcmp(*av, "verbose") == 0) {
2275                 sysctlbyname("net.inet.ip.fw.verbose", NULL, 0,
2276                     &which, sizeof(which));
2277         } else if (_substrcmp(*av, "dyn_keepalive") == 0) {
2278                 sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0,
2279                     &which, sizeof(which));
2280 #ifndef NO_ALTQ
2281         } else if (_substrcmp(*av, "altq") == 0) {
2282                 altq_set_enabled(which);
2283 #endif
2284         } else {
2285                 warnx("unrecognize enable/disable keyword: %s\n", *av);
2286         }
2287 }
2288
2289 typedef void state_cb(struct cmdline_opts *co, struct format_opts *fo,
2290     void *arg, void *state);
2291
2292 static void
2293 prepare_format_dyn(struct cmdline_opts *co, struct format_opts *fo,
2294     void *arg, void *_state)
2295 {
2296         ipfw_dyn_rule *d;
2297         int width;
2298         uint8_t set;
2299
2300         d = (ipfw_dyn_rule *)_state;
2301         /* Count _ALL_ states */
2302         fo->dcnt++;
2303
2304         if (fo->show_counters == 0)
2305                 return;
2306
2307         if (co->use_set) {
2308                 /* skip states from another set */
2309                 bcopy((char *)&d->rule + sizeof(uint16_t), &set,
2310                     sizeof(uint8_t));
2311                 if (set != co->use_set - 1)
2312                         return;
2313         }
2314
2315         width = pr_u64(NULL, &d->pcnt, 0);
2316         if (width > fo->pcwidth)
2317                 fo->pcwidth = width;
2318
2319         width = pr_u64(NULL, &d->bcnt, 0);
2320         if (width > fo->bcwidth)
2321                 fo->bcwidth = width;
2322 }
2323
2324 static int
2325 foreach_state(struct cmdline_opts *co, struct format_opts *fo,
2326     caddr_t base, size_t sz, state_cb dyn_bc, void *dyn_arg)
2327 {
2328         int ttype;
2329         state_cb *fptr;
2330         void *farg;
2331         ipfw_obj_tlv *tlv;
2332         ipfw_obj_ctlv *ctlv;
2333
2334         fptr = NULL;
2335         ttype = 0;
2336
2337         while (sz > 0) {
2338                 ctlv = (ipfw_obj_ctlv *)base;
2339                 switch (ctlv->head.type) {
2340                 case IPFW_TLV_DYNSTATE_LIST:
2341                         base += sizeof(*ctlv);
2342                         sz -= sizeof(*ctlv);
2343                         ttype = IPFW_TLV_DYN_ENT;
2344                         fptr = dyn_bc;
2345                         farg = dyn_arg;
2346                         break;
2347                 default:
2348                         return (sz);
2349                 }
2350
2351                 while (sz > 0) {
2352                         tlv = (ipfw_obj_tlv *)base;
2353                         if (tlv->type != ttype)
2354                                 break;
2355
2356                         fptr(co, fo, farg, tlv + 1);
2357                         sz -= tlv->length;
2358                         base += tlv->length;
2359                 }
2360         }
2361
2362         return (sz);
2363 }
2364
2365 static void
2366 prepare_format_opts(struct cmdline_opts *co, struct format_opts *fo,
2367     ipfw_obj_tlv *rtlv, int rcnt, caddr_t dynbase, size_t dynsz)
2368 {
2369         int bcwidth, pcwidth, width;
2370         int n;
2371         struct ip_fw_bcounter *cntr;
2372         struct ip_fw_rule *r;
2373
2374         bcwidth = 0;
2375         pcwidth = 0;
2376         if (fo->show_counters != 0) {
2377                 for (n = 0; n < rcnt; n++,
2378                     rtlv = (ipfw_obj_tlv *)((caddr_t)rtlv + rtlv->length)) {
2379                         cntr = (struct ip_fw_bcounter *)(rtlv + 1);
2380                         r = (struct ip_fw_rule *)((caddr_t)cntr + cntr->size);
2381                         /* skip rules from another set */
2382                         if (co->use_set && r->set != co->use_set - 1)
2383                                 continue;
2384
2385                         /* packet counter */
2386                         width = pr_u64(NULL, &cntr->pcnt, 0);
2387                         if (width > pcwidth)
2388                                 pcwidth = width;
2389
2390                         /* byte counter */
2391                         width = pr_u64(NULL, &cntr->bcnt, 0);
2392                         if (width > bcwidth)
2393                                 bcwidth = width;
2394                 }
2395         }
2396         fo->bcwidth = bcwidth;
2397         fo->pcwidth = pcwidth;
2398
2399         fo->dcnt = 0;
2400         if (co->do_dynamic && dynsz > 0)
2401                 foreach_state(co, fo, dynbase, dynsz, prepare_format_dyn, NULL);
2402 }
2403
2404 static int
2405 list_static_range(struct cmdline_opts *co, struct format_opts *fo,
2406     struct buf_pr *bp, ipfw_obj_tlv *rtlv, int rcnt)
2407 {
2408         int n, seen;
2409         struct ip_fw_rule *r;
2410         struct ip_fw_bcounter *cntr;
2411         int c = 0;
2412
2413         for (n = seen = 0; n < rcnt; n++,
2414             rtlv = (ipfw_obj_tlv *)((caddr_t)rtlv + rtlv->length)) {
2415
2416                 if ((fo->show_counters | fo->show_time) != 0) {
2417                         cntr = (struct ip_fw_bcounter *)(rtlv + 1);
2418                         r = (struct ip_fw_rule *)((caddr_t)cntr + cntr->size);
2419                 } else {
2420                         cntr = NULL;
2421                         r = (struct ip_fw_rule *)(rtlv + 1);
2422                 }
2423                 if (r->rulenum > fo->last)
2424                         break;
2425                 if (co->use_set && r->set != co->use_set - 1)
2426                         continue;
2427                 if (r->rulenum >= fo->first && r->rulenum <= fo->last) {
2428                         show_static_rule(co, fo, bp, r, cntr);
2429                         printf("%s", bp->buf);
2430                         c += rtlv->length;
2431                         bp_flush(bp);
2432                         seen++;
2433                 }
2434         }
2435
2436         return (seen);
2437 }
2438
2439 static void
2440 list_dyn_state(struct cmdline_opts *co, struct format_opts *fo,
2441     void *_arg, void *_state)
2442 {
2443         uint16_t rulenum;
2444         uint8_t set;
2445         ipfw_dyn_rule *d;
2446         struct buf_pr *bp;
2447
2448         d = (ipfw_dyn_rule *)_state;
2449         bp = (struct buf_pr *)_arg;
2450
2451         bcopy(&d->rule, &rulenum, sizeof(rulenum));
2452         if (rulenum > fo->last)
2453                 return;
2454         if (co->use_set) {
2455                 bcopy((char *)&d->rule + sizeof(uint16_t),
2456                       &set, sizeof(uint8_t));
2457                 if (set != co->use_set - 1)
2458                         return;
2459         }
2460         if (rulenum >= fo->first) {
2461                 show_dyn_state(co, fo, bp, d);
2462                 printf("%s\n", bp->buf);
2463                 bp_flush(bp);
2464         }
2465 }
2466
2467 static int
2468 list_dyn_range(struct cmdline_opts *co, struct format_opts *fo,
2469     struct buf_pr *bp, caddr_t base, size_t sz)
2470 {
2471
2472         sz = foreach_state(co, fo, base, sz, list_dyn_state, bp);
2473         return (sz);
2474 }
2475
2476 void
2477 ipfw_list(int ac, char *av[], int show_counters)
2478 {
2479         ipfw_cfg_lheader *cfg;
2480         struct format_opts sfo;
2481         size_t sz;
2482         int error;
2483         int lac;
2484         char **lav;
2485         uint32_t rnum;
2486         char *endptr;
2487
2488         if (co.test_only) {
2489                 fprintf(stderr, "Testing only, list disabled\n");
2490                 return;
2491         }
2492         if (co.do_pipe) {
2493                 dummynet_list(ac, av, show_counters);
2494                 return;
2495         }
2496
2497         ac--;
2498         av++;
2499         memset(&sfo, 0, sizeof(sfo));
2500
2501         /* Determine rule range to request */
2502         if (ac > 0) {
2503                 for (lac = ac, lav = av; lac != 0; lac--) {
2504                         rnum = strtoul(*lav++, &endptr, 10);
2505                         if (sfo.first == 0 || rnum < sfo.first)
2506                                 sfo.first = rnum;
2507
2508                         if (*endptr == '-')
2509                                 rnum = strtoul(endptr + 1, &endptr, 10);
2510                         if (sfo.last == 0 || rnum > sfo.last)
2511                                 sfo.last = rnum;
2512                 }
2513         }
2514
2515         /* get configuraion from kernel */
2516         cfg = NULL;
2517         sfo.show_counters = show_counters;
2518         sfo.show_time = co.do_time;
2519         sfo.flags = IPFW_CFG_GET_STATIC;
2520         if (co.do_dynamic != 0)
2521                 sfo.flags |= IPFW_CFG_GET_STATES;
2522         if ((sfo.show_counters | sfo.show_time) != 0)
2523                 sfo.flags |= IPFW_CFG_GET_COUNTERS;
2524         if (ipfw_get_config(&co, &sfo, &cfg, &sz) != 0)
2525                 err(EX_OSERR, "retrieving config failed");
2526
2527         error = ipfw_show_config(&co, &sfo, cfg, sz, ac, av);
2528
2529         free(cfg);
2530
2531         if (error != EX_OK)
2532                 exit(error);
2533 }
2534
2535 static int
2536 ipfw_show_config(struct cmdline_opts *co, struct format_opts *fo,
2537     ipfw_cfg_lheader *cfg, size_t sz, int ac, char *av[])
2538 {
2539         caddr_t dynbase;
2540         size_t dynsz;
2541         int rcnt;
2542         int exitval = EX_OK;
2543         int lac;
2544         char **lav;
2545         char *endptr;
2546         size_t readsz;
2547         struct buf_pr bp;
2548         ipfw_obj_ctlv *ctlv, *tstate;
2549         ipfw_obj_tlv *rbase;
2550
2551         /*
2552          * Handle tablenames TLV first, if any
2553          */
2554         tstate = NULL;
2555         rbase = NULL;
2556         dynbase = NULL;
2557         dynsz = 0;
2558         readsz = sizeof(*cfg);
2559         rcnt = 0;
2560
2561         fo->set_mask = cfg->set_mask;
2562
2563         ctlv = (ipfw_obj_ctlv *)(cfg + 1);
2564
2565         if (cfg->flags & IPFW_CFG_GET_STATIC) {
2566                 /* We've requested static rules */
2567                 if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {
2568                         object_sort_ctlv(ctlv);
2569                         fo->tstate = ctlv;
2570                         readsz += ctlv->head.length;
2571                         ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv +
2572                             ctlv->head.length);
2573                 }
2574
2575                 if (ctlv->head.type == IPFW_TLV_RULE_LIST) {
2576                         rbase = (ipfw_obj_tlv *)(ctlv + 1);
2577                         rcnt = ctlv->count;
2578                         readsz += ctlv->head.length;
2579                         ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv +
2580                             ctlv->head.length);
2581                 }
2582         }
2583
2584         if ((cfg->flags & IPFW_CFG_GET_STATES) && (readsz != sz))  {
2585                 /* We may have some dynamic states */
2586                 dynsz = sz - readsz;
2587                 /* Skip empty header */
2588                 if (dynsz != sizeof(ipfw_obj_ctlv))
2589                         dynbase = (caddr_t)ctlv;
2590                 else
2591                         dynsz = 0;
2592         }
2593
2594         prepare_format_opts(co, fo, rbase, rcnt, dynbase, dynsz);
2595         bp_alloc(&bp, 4096);
2596
2597         /* if no rule numbers were specified, list all rules */
2598         if (ac == 0) {
2599                 fo->first = 0;
2600                 fo->last = IPFW_DEFAULT_RULE;
2601                 list_static_range(co, fo, &bp, rbase, rcnt);
2602
2603                 if (co->do_dynamic && dynsz > 0) {
2604                         printf("## Dynamic rules (%d %zu):\n", fo->dcnt, dynsz);
2605                         list_dyn_range(co, fo, &bp, dynbase, dynsz);
2606                 }
2607
2608                 bp_free(&bp);
2609                 return (EX_OK);
2610         }
2611
2612         /* display specific rules requested on command line */
2613         for (lac = ac, lav = av; lac != 0; lac--) {
2614                 /* convert command line rule # */
2615                 fo->last = fo->first = strtoul(*lav++, &endptr, 10);
2616                 if (*endptr == '-')
2617                         fo->last = strtoul(endptr + 1, &endptr, 10);
2618                 if (*endptr) {
2619                         exitval = EX_USAGE;
2620                         warnx("invalid rule number: %s", *(lav - 1));
2621                         continue;
2622                 }
2623
2624                 if (list_static_range(co, fo, &bp, rbase, rcnt) == 0) {
2625                         /* give precedence to other error(s) */
2626                         if (exitval == EX_OK)
2627                                 exitval = EX_UNAVAILABLE;
2628                         if (fo->first == fo->last)
2629                                 warnx("rule %u does not exist", fo->first);
2630                         else
2631                                 warnx("no rules in range %u-%u",
2632                                     fo->first, fo->last);
2633                 }
2634         }
2635
2636         if (co->do_dynamic && dynsz > 0) {
2637                 printf("## Dynamic rules:\n");
2638                 for (lac = ac, lav = av; lac != 0; lac--) {
2639                         fo->last = fo->first = strtoul(*lav++, &endptr, 10);
2640                         if (*endptr == '-')
2641                                 fo->last = strtoul(endptr+1, &endptr, 10);
2642                         if (*endptr)
2643                                 /* already warned */
2644                                 continue;
2645                         list_dyn_range(co, fo, &bp, dynbase, dynsz);
2646                 }
2647         }
2648
2649         bp_free(&bp);
2650         return (exitval);
2651 }
2652
2653
2654 /*
2655  * Retrieves current ipfw configuration of given type
2656  * and stores its pointer to @pcfg.
2657  *
2658  * Caller is responsible for freeing @pcfg.
2659  *
2660  * Returns 0 on success.
2661  */
2662
2663 static int
2664 ipfw_get_config(struct cmdline_opts *co, struct format_opts *fo,
2665     ipfw_cfg_lheader **pcfg, size_t *psize)
2666 {
2667         ipfw_cfg_lheader *cfg;
2668         size_t sz;
2669         int i;
2670
2671
2672         if (co->test_only != 0) {
2673                 fprintf(stderr, "Testing only, list disabled\n");
2674                 return (0);
2675         }
2676
2677         /* Start with some data size */
2678         sz = 4096;
2679         cfg = NULL;
2680
2681         for (i = 0; i < 16; i++) {
2682                 if (cfg != NULL)
2683                         free(cfg);
2684                 if ((cfg = calloc(1, sz)) == NULL)
2685                         return (ENOMEM);
2686
2687                 cfg->flags = fo->flags;
2688                 cfg->start_rule = fo->first;
2689                 cfg->end_rule = fo->last;
2690
2691                 if (do_get3(IP_FW_XGET, &cfg->opheader, &sz) != 0) {
2692                         if (errno != ENOMEM) {
2693                                 free(cfg);
2694                                 return (errno);
2695                         }
2696
2697                         /* Buffer size is not enough. Try to increase */
2698                         sz = sz * 2;
2699                         if (sz < cfg->size)
2700                                 sz = cfg->size;
2701                         continue;
2702                 }
2703
2704                 *pcfg = cfg;
2705                 *psize = sz;
2706                 return (0);
2707         }
2708
2709         free(cfg);
2710         return (ENOMEM);
2711 }
2712
2713 static int
2714 lookup_host (char *host, struct in_addr *ipaddr)
2715 {
2716         struct hostent *he;
2717
2718         if (!inet_aton(host, ipaddr)) {
2719                 if ((he = gethostbyname(host)) == NULL)
2720                         return(-1);
2721                 *ipaddr = *(struct in_addr *)he->h_addr_list[0];
2722         }
2723         return(0);
2724 }
2725
2726 struct tidx {
2727         ipfw_obj_ntlv *idx;
2728         uint32_t count;
2729         uint32_t size;
2730         uint16_t counter;
2731         uint8_t set;
2732 };
2733
2734 static uint16_t
2735 pack_object(struct tidx *tstate, char *name, int otype)
2736 {
2737         int i;
2738         ipfw_obj_ntlv *ntlv;
2739
2740         for (i = 0; i < tstate->count; i++) {
2741                 if (strcmp(tstate->idx[i].name, name) != 0)
2742                         continue;
2743                 if (tstate->idx[i].set != tstate->set)
2744                         continue;
2745                 if (tstate->idx[i].head.type != otype)
2746                         continue;
2747
2748                 return (tstate->idx[i].idx);
2749         }
2750
2751         if (tstate->count + 1 > tstate->size) {
2752                 tstate->size += 4;
2753                 tstate->idx = realloc(tstate->idx, tstate->size *
2754                     sizeof(ipfw_obj_ntlv));
2755                 if (tstate->idx == NULL)
2756                         return (0);
2757         }
2758
2759         ntlv = &tstate->idx[i];
2760         memset(ntlv, 0, sizeof(ipfw_obj_ntlv));
2761         strlcpy(ntlv->name, name, sizeof(ntlv->name));
2762         ntlv->head.type = otype;
2763         ntlv->head.length = sizeof(ipfw_obj_ntlv);
2764         ntlv->set = tstate->set;
2765         ntlv->idx = ++tstate->counter;
2766         tstate->count++;
2767
2768         return (ntlv->idx);
2769 }
2770
2771 static uint16_t
2772 pack_table(struct tidx *tstate, char *name)
2773 {
2774
2775         if (table_check_name(name) != 0)
2776                 return (0);
2777
2778         return (pack_object(tstate, name, IPFW_TLV_TBL_NAME));
2779 }
2780
2781 static void
2782 fill_table(ipfw_insn *cmd, char *av, uint8_t opcode, struct tidx *tstate)
2783 {
2784         uint32_t *d = ((ipfw_insn_u32 *)cmd)->d;
2785         uint16_t uidx;
2786         char *p;
2787
2788         if ((p = strchr(av + 6, ')')) == NULL)
2789                 errx(EX_DATAERR, "forgotten parenthesis: '%s'", av);
2790         *p = '\0';
2791         p = strchr(av + 6, ',');
2792         if (p)
2793                 *p++ = '\0';
2794
2795         if ((uidx = pack_table(tstate, av + 6)) == 0)
2796                 errx(EX_DATAERR, "Invalid table name: %s", av + 6);
2797
2798         cmd->opcode = opcode;
2799         cmd->arg1 = uidx;
2800         if (p) {
2801                 cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
2802                 d[0] = strtoul(p, NULL, 0);
2803         } else
2804                 cmd->len |= F_INSN_SIZE(ipfw_insn);
2805 }
2806
2807
2808 /*
2809  * fills the addr and mask fields in the instruction as appropriate from av.
2810  * Update length as appropriate.
2811  * The following formats are allowed:
2812  *      me      returns O_IP_*_ME
2813  *      1.2.3.4         single IP address
2814  *      1.2.3.4:5.6.7.8 address:mask
2815  *      1.2.3.4/24      address/mask
2816  *      1.2.3.4/26{1,6,5,4,23}  set of addresses in a subnet
2817  * We can have multiple comma-separated address/mask entries.
2818  */
2819 static void
2820 fill_ip(ipfw_insn_ip *cmd, char *av, int cblen, struct tidx *tstate)
2821 {
2822         int len = 0;
2823         uint32_t *d = ((ipfw_insn_u32 *)cmd)->d;
2824
2825         cmd->o.len &= ~F_LEN_MASK;      /* zero len */
2826
2827         if (_substrcmp(av, "any") == 0)
2828                 return;
2829
2830         if (_substrcmp(av, "me") == 0) {
2831                 cmd->o.len |= F_INSN_SIZE(ipfw_insn);
2832                 return;
2833         }
2834
2835         if (strncmp(av, "table(", 6) == 0) {
2836                 fill_table(&cmd->o, av, O_IP_DST_LOOKUP, tstate);
2837                 return;
2838         }
2839
2840     while (av) {
2841         /*
2842          * After the address we can have '/' or ':' indicating a mask,
2843          * ',' indicating another address follows, '{' indicating a
2844          * set of addresses of unspecified size.
2845          */
2846         char *t = NULL, *p = strpbrk(av, "/:,{");
2847         int masklen;
2848         char md, nd = '\0';
2849
2850         CHECK_LENGTH(cblen, F_INSN_SIZE(ipfw_insn) + 2 + len);
2851
2852         if (p) {
2853                 md = *p;
2854                 *p++ = '\0';
2855                 if ((t = strpbrk(p, ",{")) != NULL) {
2856                         nd = *t;
2857                         *t = '\0';
2858                 }
2859         } else
2860                 md = '\0';
2861
2862         if (lookup_host(av, (struct in_addr *)&d[0]) != 0)
2863                 errx(EX_NOHOST, "hostname ``%s'' unknown", av);
2864         switch (md) {
2865         case ':':
2866                 if (!inet_aton(p, (struct in_addr *)&d[1]))
2867                         errx(EX_DATAERR, "bad netmask ``%s''", p);
2868                 break;
2869         case '/':
2870                 masklen = atoi(p);
2871                 if (masklen == 0)
2872                         d[1] = htonl(0);        /* mask */
2873                 else if (masklen > 32)
2874                         errx(EX_DATAERR, "bad width ``%s''", p);
2875                 else
2876                         d[1] = htonl(~0 << (32 - masklen));
2877                 break;
2878         case '{':       /* no mask, assume /24 and put back the '{' */
2879                 d[1] = htonl(~0 << (32 - 24));
2880                 *(--p) = md;
2881                 break;
2882
2883         case ',':       /* single address plus continuation */
2884                 *(--p) = md;
2885                 /* FALLTHROUGH */
2886         case 0:         /* initialization value */
2887         default:
2888                 d[1] = htonl(~0);       /* force /32 */
2889                 break;
2890         }
2891         d[0] &= d[1];           /* mask base address with mask */
2892         if (t)
2893                 *t = nd;
2894         /* find next separator */
2895         if (p)
2896                 p = strpbrk(p, ",{");
2897         if (p && *p == '{') {
2898                 /*
2899                  * We have a set of addresses. They are stored as follows:
2900                  *   arg1       is the set size (powers of 2, 2..256)
2901                  *   addr       is the base address IN HOST FORMAT
2902                  *   mask..     is an array of arg1 bits (rounded up to
2903                  *              the next multiple of 32) with bits set
2904                  *              for each host in the map.
2905                  */
2906                 uint32_t *map = (uint32_t *)&cmd->mask;
2907                 int low, high;
2908                 int i = contigmask((uint8_t *)&(d[1]), 32);
2909
2910                 if (len > 0)
2911                         errx(EX_DATAERR, "address set cannot be in a list");
2912                 if (i < 24 || i > 31)
2913                         errx(EX_DATAERR, "invalid set with mask %d\n", i);
2914                 cmd->o.arg1 = 1<<(32-i);        /* map length           */
2915                 d[0] = ntohl(d[0]);             /* base addr in host format */
2916                 cmd->o.opcode = O_IP_DST_SET;   /* default */
2917                 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32) + (cmd->o.arg1+31)/32;
2918                 for (i = 0; i < (cmd->o.arg1+31)/32 ; i++)
2919                         map[i] = 0;     /* clear map */
2920
2921                 av = p + 1;
2922                 low = d[0] & 0xff;
2923                 high = low + cmd->o.arg1 - 1;
2924                 /*
2925                  * Here, i stores the previous value when we specify a range
2926                  * of addresses within a mask, e.g. 45-63. i = -1 means we
2927                  * have no previous value.
2928                  */
2929                 i = -1; /* previous value in a range */
2930                 while (isdigit(*av)) {
2931                         char *s;
2932                         int a = strtol(av, &s, 0);
2933
2934                         if (s == av) { /* no parameter */
2935                             if (*av != '}')
2936                                 errx(EX_DATAERR, "set not closed\n");
2937                             if (i != -1)
2938                                 errx(EX_DATAERR, "incomplete range %d-", i);
2939                             break;
2940                         }
2941                         if (a < low || a > high)
2942                             errx(EX_DATAERR, "addr %d out of range [%d-%d]\n",
2943                                 a, low, high);
2944                         a -= low;
2945                         if (i == -1)    /* no previous in range */
2946                             i = a;
2947                         else {          /* check that range is valid */
2948                             if (i > a)
2949                                 errx(EX_DATAERR, "invalid range %d-%d",
2950                                         i+low, a+low);
2951                             if (*s == '-')
2952                                 errx(EX_DATAERR, "double '-' in range");
2953                         }
2954                         for (; i <= a; i++)
2955                             map[i/32] |= 1<<(i & 31);
2956                         i = -1;
2957                         if (*s == '-')
2958                             i = a;
2959                         else if (*s == '}')
2960                             break;
2961                         av = s+1;
2962                 }
2963                 return;
2964         }
2965         av = p;
2966         if (av)                 /* then *av must be a ',' */
2967                 av++;
2968
2969         /* Check this entry */
2970         if (d[1] == 0) { /* "any", specified as x.x.x.x/0 */
2971                 /*
2972                  * 'any' turns the entire list into a NOP.
2973                  * 'not any' never matches, so it is removed from the
2974                  * list unless it is the only item, in which case we
2975                  * report an error.
2976                  */
2977                 if (cmd->o.len & F_NOT) {       /* "not any" never matches */
2978                         if (av == NULL && len == 0) /* only this entry */
2979                                 errx(EX_DATAERR, "not any never matches");
2980                 }
2981                 /* else do nothing and skip this entry */
2982                 return;
2983         }
2984         /* A single IP can be stored in an optimized format */
2985         if (d[1] == (uint32_t)~0 && av == NULL && len == 0) {
2986                 cmd->o.len |= F_INSN_SIZE(ipfw_insn_u32);
2987                 return;
2988         }
2989         len += 2;       /* two words... */
2990         d += 2;
2991     } /* end while */
2992     if (len + 1 > F_LEN_MASK)
2993         errx(EX_DATAERR, "address list too long");
2994     cmd->o.len |= len+1;
2995 }
2996
2997
2998 /* n2mask sets n bits of the mask */
2999 void
3000 n2mask(struct in6_addr *mask, int n)
3001 {
3002         static int      minimask[9] =
3003             { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff };
3004         u_char          *p;
3005
3006         memset(mask, 0, sizeof(struct in6_addr));
3007         p = (u_char *) mask;
3008         for (; n > 0; p++, n -= 8) {
3009                 if (n >= 8)
3010                         *p = 0xff;
3011                 else
3012                         *p = minimask[n];
3013         }
3014         return;
3015 }
3016
3017 static void
3018 fill_flags_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode,
3019         struct _s_x *flags, char *p)
3020 {
3021         char *e;
3022         uint32_t set = 0, clear = 0;
3023
3024         if (fill_flags(flags, p, &e, &set, &clear) != 0)
3025                 errx(EX_DATAERR, "invalid flag %s", e);
3026
3027         cmd->opcode = opcode;
3028         cmd->len =  (cmd->len & (F_NOT | F_OR)) | 1;
3029         cmd->arg1 = (set & 0xff) | ( (clear & 0xff) << 8);
3030 }
3031
3032
3033 void
3034 ipfw_delete(char *av[])
3035 {
3036         int i;
3037         int exitval = EX_OK;
3038         int do_set = 0;
3039         ipfw_range_tlv rt;
3040
3041         av++;
3042         NEED1("missing rule specification");
3043         memset(&rt, 0, sizeof(rt));
3044         if ( *av && _substrcmp(*av, "set") == 0) {
3045                 /* Do not allow using the following syntax:
3046                  *      ipfw set N delete set M
3047                  */
3048                 if (co.use_set)
3049                         errx(EX_DATAERR, "invalid syntax");
3050                 do_set = 1;     /* delete set */
3051                 av++;
3052         }
3053
3054         /* Rule number */
3055         while (*av && isdigit(**av)) {
3056                 i = atoi(*av); av++;
3057                 if (co.do_nat) {
3058                         exitval = do_cmd(IP_FW_NAT_DEL, &i, sizeof i);
3059                         if (exitval) {
3060                                 exitval = EX_UNAVAILABLE;
3061                                 warn("rule %u not available", i);
3062                         }
3063                 } else if (co.do_pipe) {
3064                         exitval = ipfw_delete_pipe(co.do_pipe, i);
3065                 } else {
3066                         if (do_set != 0) {
3067                                 rt.set = i & 31;
3068                                 rt.flags = IPFW_RCFLAG_SET;
3069                         } else {
3070                                 rt.start_rule = i & 0xffff;
3071                                 rt.end_rule = i & 0xffff;
3072                                 if (rt.start_rule == 0 && rt.end_rule == 0)
3073                                         rt.flags |= IPFW_RCFLAG_ALL;
3074                                 else
3075                                         rt.flags |= IPFW_RCFLAG_RANGE;
3076                                 if (co.use_set != 0) {
3077                                         rt.set = co.use_set - 1;
3078                                         rt.flags |= IPFW_RCFLAG_SET;
3079                                 }
3080                         }
3081                         i = do_range_cmd(IP_FW_XDEL, &rt);
3082                         if (i != 0) {
3083                                 exitval = EX_UNAVAILABLE;
3084                                 warn("rule %u: setsockopt(IP_FW_XDEL)",
3085                                     rt.start_rule);
3086                         } else if (rt.new_set == 0) {
3087                                 exitval = EX_UNAVAILABLE;
3088                                 if (rt.start_rule != rt.end_rule)
3089                                         warnx("no rules rules in %u-%u range",
3090                                             rt.start_rule, rt.end_rule);
3091                                 else
3092                                         warnx("rule %u not found",
3093                                             rt.start_rule);
3094                         }
3095                 }
3096         }
3097         if (exitval != EX_OK)
3098                 exit(exitval);
3099 }
3100
3101
3102 /*
3103  * fill the interface structure. We do not check the name as we can
3104  * create interfaces dynamically, so checking them at insert time
3105  * makes relatively little sense.
3106  * Interface names containing '*', '?', or '[' are assumed to be shell
3107  * patterns which match interfaces.
3108  */
3109 static void
3110 fill_iface(ipfw_insn_if *cmd, char *arg, int cblen, struct tidx *tstate)
3111 {
3112         char *p;
3113         uint16_t uidx;
3114
3115         cmd->name[0] = '\0';
3116         cmd->o.len |= F_INSN_SIZE(ipfw_insn_if);
3117
3118         CHECK_CMDLEN;
3119
3120         /* Parse the interface or address */
3121         if (strcmp(arg, "any") == 0)
3122                 cmd->o.len = 0;         /* effectively ignore this command */
3123         else if (strncmp(arg, "table(", 6) == 0) {
3124                 if ((p = strchr(arg + 6, ')')) == NULL)
3125                         errx(EX_DATAERR, "forgotten parenthesis: '%s'", arg);
3126                 *p = '\0';
3127                 p = strchr(arg + 6, ',');
3128                 if (p)
3129                         *p++ = '\0';
3130                 if ((uidx = pack_table(tstate, arg + 6)) == 0)
3131                         errx(EX_DATAERR, "Invalid table name: %s", arg + 6);
3132
3133                 cmd->name[0] = '\1'; /* Special value indicating table */
3134                 cmd->p.kidx = uidx;
3135         } else if (!isdigit(*arg)) {
3136                 strlcpy(cmd->name, arg, sizeof(cmd->name));
3137                 cmd->p.glob = strpbrk(arg, "*?[") != NULL ? 1 : 0;
3138         } else if (!inet_aton(arg, &cmd->p.ip))
3139                 errx(EX_DATAERR, "bad ip address ``%s''", arg);
3140 }
3141
3142 static void
3143 get_mac_addr_mask(const char *p, uint8_t *addr, uint8_t *mask)
3144 {
3145         int i;
3146         size_t l;
3147         char *ap, *ptr, *optr;
3148         struct ether_addr *mac;
3149         const char *macset = "0123456789abcdefABCDEF:";
3150
3151         if (strcmp(p, "any") == 0) {
3152                 for (i = 0; i < ETHER_ADDR_LEN; i++)
3153                         addr[i] = mask[i] = 0;
3154                 return;
3155         }
3156
3157         optr = ptr = strdup(p);
3158         if ((ap = strsep(&ptr, "&/")) != NULL && *ap != 0) {
3159                 l = strlen(ap);
3160                 if (strspn(ap, macset) != l || (mac = ether_aton(ap)) == NULL)
3161                         errx(EX_DATAERR, "Incorrect MAC address");
3162                 bcopy(mac, addr, ETHER_ADDR_LEN);
3163         } else
3164                 errx(EX_DATAERR, "Incorrect MAC address");
3165
3166         if (ptr != NULL) { /* we have mask? */
3167                 if (p[ptr - optr - 1] == '/') { /* mask len */
3168                         long ml = strtol(ptr, &ap, 10);
3169                         if (*ap != 0 || ml > ETHER_ADDR_LEN * 8 || ml < 0)
3170                                 errx(EX_DATAERR, "Incorrect mask length");
3171                         for (i = 0; ml > 0 && i < ETHER_ADDR_LEN; ml -= 8, i++)
3172                                 mask[i] = (ml >= 8) ? 0xff: (~0) << (8 - ml);
3173                 } else { /* mask */
3174                         l = strlen(ptr);
3175                         if (strspn(ptr, macset) != l ||
3176                             (mac = ether_aton(ptr)) == NULL)
3177                                 errx(EX_DATAERR, "Incorrect mask");
3178                         bcopy(mac, mask, ETHER_ADDR_LEN);
3179                 }
3180         } else { /* default mask: ff:ff:ff:ff:ff:ff */
3181                 for (i = 0; i < ETHER_ADDR_LEN; i++)
3182                         mask[i] = 0xff;
3183         }
3184         for (i = 0; i < ETHER_ADDR_LEN; i++)
3185                 addr[i] &= mask[i];
3186
3187         free(optr);
3188 }
3189
3190 /*
3191  * helper function, updates the pointer to cmd with the length
3192  * of the current command, and also cleans up the first word of
3193  * the new command in case it has been clobbered before.
3194  */
3195 static ipfw_insn *
3196 next_cmd(ipfw_insn *cmd, int *len)
3197 {
3198         *len -= F_LEN(cmd);
3199         CHECK_LENGTH(*len, 0);
3200         cmd += F_LEN(cmd);
3201         bzero(cmd, sizeof(*cmd));
3202         return cmd;
3203 }
3204
3205 /*
3206  * Takes arguments and copies them into a comment
3207  */
3208 static void
3209 fill_comment(ipfw_insn *cmd, char **av, int cblen)
3210 {
3211         int i, l;
3212         char *p = (char *)(cmd + 1);
3213
3214         cmd->opcode = O_NOP;
3215         cmd->len =  (cmd->len & (F_NOT | F_OR));
3216
3217         /* Compute length of comment string. */
3218         for (i = 0, l = 0; av[i] != NULL; i++)
3219                 l += strlen(av[i]) + 1;
3220         if (l == 0)
3221                 return;
3222         if (l > 84)
3223                 errx(EX_DATAERR,
3224                     "comment too long (max 80 chars)");
3225         l = 1 + (l+3)/4;
3226         cmd->len =  (cmd->len & (F_NOT | F_OR)) | l;
3227         CHECK_CMDLEN;
3228
3229         for (i = 0; av[i] != NULL; i++) {
3230                 strcpy(p, av[i]);
3231                 p += strlen(av[i]);
3232                 *p++ = ' ';
3233         }
3234         *(--p) = '\0';
3235 }
3236
3237 /*
3238  * A function to fill simple commands of size 1.
3239  * Existing flags are preserved.
3240  */
3241 static void
3242 fill_cmd(ipfw_insn *cmd, enum ipfw_opcodes opcode, int flags, uint16_t arg)
3243 {
3244         cmd->opcode = opcode;
3245         cmd->len =  ((cmd->len | flags) & (F_NOT | F_OR)) | 1;
3246         cmd->arg1 = arg;
3247 }
3248
3249 /*
3250  * Fetch and add the MAC address and type, with masks. This generates one or
3251  * two microinstructions, and returns the pointer to the last one.
3252  */
3253 static ipfw_insn *
3254 add_mac(ipfw_insn *cmd, char *av[], int cblen)
3255 {
3256         ipfw_insn_mac *mac;
3257
3258         if ( ( av[0] == NULL ) || ( av[1] == NULL ) )
3259                 errx(EX_DATAERR, "MAC dst src");
3260
3261         cmd->opcode = O_MACADDR2;
3262         cmd->len = (cmd->len & (F_NOT | F_OR)) | F_INSN_SIZE(ipfw_insn_mac);
3263         CHECK_CMDLEN;
3264
3265         mac = (ipfw_insn_mac *)cmd;
3266         get_mac_addr_mask(av[0], mac->addr, mac->mask); /* dst */
3267         get_mac_addr_mask(av[1], &(mac->addr[ETHER_ADDR_LEN]),
3268             &(mac->mask[ETHER_ADDR_LEN])); /* src */
3269         return cmd;
3270 }
3271
3272 static ipfw_insn *
3273 add_mactype(ipfw_insn *cmd, char *av, int cblen)
3274 {
3275         if (!av)
3276                 errx(EX_DATAERR, "missing MAC type");
3277         if (strcmp(av, "any") != 0) { /* we have a non-null type */
3278                 fill_newports((ipfw_insn_u16 *)cmd, av, IPPROTO_ETHERTYPE,
3279                     cblen);
3280                 cmd->opcode = O_MAC_TYPE;
3281                 return cmd;
3282         } else
3283                 return NULL;
3284 }
3285
3286 static ipfw_insn *
3287 add_proto0(ipfw_insn *cmd, char *av, u_char *protop)
3288 {
3289         struct protoent *pe;
3290         char *ep;
3291         int proto;
3292
3293         proto = strtol(av, &ep, 10);
3294         if (*ep != '\0' || proto <= 0) {
3295                 if ((pe = getprotobyname(av)) == NULL)
3296                         return NULL;
3297                 proto = pe->p_proto;
3298         }
3299
3300         fill_cmd(cmd, O_PROTO, 0, proto);
3301         *protop = proto;
3302         return cmd;
3303 }
3304
3305 static ipfw_insn *
3306 add_proto(ipfw_insn *cmd, char *av, u_char *protop)
3307 {
3308         u_char proto = IPPROTO_IP;
3309
3310         if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0)
3311                 ; /* do not set O_IP4 nor O_IP6 */
3312         else if (strcmp(av, "ip4") == 0)
3313                 /* explicit "just IPv4" rule */
3314                 fill_cmd(cmd, O_IP4, 0, 0);
3315         else if (strcmp(av, "ip6") == 0) {
3316                 /* explicit "just IPv6" rule */
3317                 proto = IPPROTO_IPV6;
3318                 fill_cmd(cmd, O_IP6, 0, 0);
3319         } else
3320                 return add_proto0(cmd, av, protop);
3321
3322         *protop = proto;
3323         return cmd;
3324 }
3325
3326 static ipfw_insn *
3327 add_proto_compat(ipfw_insn *cmd, char *av, u_char *protop)
3328 {
3329         u_char proto = IPPROTO_IP;
3330
3331         if (_substrcmp(av, "all") == 0 || strcmp(av, "ip") == 0)
3332                 ; /* do not set O_IP4 nor O_IP6 */
3333         else if (strcmp(av, "ipv4") == 0 || strcmp(av, "ip4") == 0)
3334                 /* explicit "just IPv4" rule */
3335                 fill_cmd(cmd, O_IP4, 0, 0);
3336         else if (strcmp(av, "ipv6") == 0 || strcmp(av, "ip6") == 0) {
3337                 /* explicit "just IPv6" rule */
3338                 proto = IPPROTO_IPV6;
3339                 fill_cmd(cmd, O_IP6, 0, 0);
3340         } else
3341                 return add_proto0(cmd, av, protop);
3342
3343         *protop = proto;
3344         return cmd;
3345 }
3346
3347 static ipfw_insn *
3348 add_srcip(ipfw_insn *cmd, char *av, int cblen, struct tidx *tstate)
3349 {
3350         fill_ip((ipfw_insn_ip *)cmd, av, cblen, tstate);
3351         if (cmd->opcode == O_IP_DST_SET)                        /* set */
3352                 cmd->opcode = O_IP_SRC_SET;
3353         else if (cmd->opcode == O_IP_DST_LOOKUP)                /* table */
3354                 cmd->opcode = O_IP_SRC_LOOKUP;
3355         else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn))          /* me */
3356                 cmd->opcode = O_IP_SRC_ME;
3357         else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32))      /* one IP */
3358                 cmd->opcode = O_IP_SRC;
3359         else                                                    /* addr/mask */
3360                 cmd->opcode = O_IP_SRC_MASK;
3361         return cmd;
3362 }
3363
3364 static ipfw_insn *
3365 add_dstip(ipfw_insn *cmd, char *av, int cblen, struct tidx *tstate)
3366 {
3367         fill_ip((ipfw_insn_ip *)cmd, av, cblen, tstate);
3368         if (cmd->opcode == O_IP_DST_SET)                        /* set */
3369                 ;
3370         else if (cmd->opcode == O_IP_DST_LOOKUP)                /* table */
3371                 ;
3372         else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn))          /* me */
3373                 cmd->opcode = O_IP_DST_ME;
3374         else if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32))      /* one IP */
3375                 cmd->opcode = O_IP_DST;
3376         else                                                    /* addr/mask */
3377                 cmd->opcode = O_IP_DST_MASK;
3378         return cmd;
3379 }
3380
3381 static struct _s_x f_reserved_keywords[] = {
3382         { "altq",       TOK_OR },
3383         { "//",         TOK_OR },
3384         { "diverted",   TOK_OR },
3385         { "dst-port",   TOK_OR },
3386         { "src-port",   TOK_OR },
3387         { "established",        TOK_OR },
3388         { "keep-state", TOK_OR },
3389         { "frag",       TOK_OR },
3390         { "icmptypes",  TOK_OR },
3391         { "in",         TOK_OR },
3392         { "out",        TOK_OR },
3393         { "ip6",        TOK_OR },
3394         { "any",        TOK_OR },
3395         { "to",         TOK_OR },
3396         { "via",        TOK_OR },
3397         { "{",          TOK_OR },
3398         { NULL, 0 }     /* terminator */
3399 };
3400
3401 static ipfw_insn *
3402 add_ports(ipfw_insn *cmd, char *av, u_char proto, int opcode, int cblen)
3403 {
3404
3405         if (match_token(f_reserved_keywords, av) != -1)
3406                 return (NULL);
3407
3408         if (fill_newports((ipfw_insn_u16 *)cmd, av, proto, cblen)) {
3409                 /* XXX todo: check that we have a protocol with ports */
3410                 cmd->opcode = opcode;
3411                 return cmd;
3412         }
3413         return NULL;
3414 }
3415
3416 static ipfw_insn *
3417 add_src(ipfw_insn *cmd, char *av, u_char proto, int cblen, struct tidx *tstate)
3418 {
3419         struct in6_addr a;
3420         char *host, *ch, buf[INET6_ADDRSTRLEN];
3421         ipfw_insn *ret = NULL;
3422         int len;
3423
3424         /* Copy first address in set if needed */
3425         if ((ch = strpbrk(av, "/,")) != NULL) {
3426                 len = ch - av;
3427                 strlcpy(buf, av, sizeof(buf));
3428                 if (len < sizeof(buf))
3429                         buf[len] = '\0';
3430                 host = buf;
3431         } else
3432                 host = av;
3433
3434         if (proto == IPPROTO_IPV6  || strcmp(av, "me6") == 0 ||
3435             inet_pton(AF_INET6, host, &a) == 1)
3436                 ret = add_srcip6(cmd, av, cblen);
3437         /* XXX: should check for IPv4, not !IPv6 */
3438         if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 ||
3439             inet_pton(AF_INET6, host, &a) != 1))
3440                 ret = add_srcip(cmd, av, cblen, tstate);
3441         if (ret == NULL && strcmp(av, "any") != 0)
3442                 ret = cmd;
3443
3444         return ret;
3445 }
3446
3447 static ipfw_insn *
3448 add_dst(ipfw_insn *cmd, char *av, u_char proto, int cblen, struct tidx *tstate)
3449 {
3450         struct in6_addr a;
3451         char *host, *ch, buf[INET6_ADDRSTRLEN];
3452         ipfw_insn *ret = NULL;
3453         int len;
3454
3455         /* Copy first address in set if needed */
3456         if ((ch = strpbrk(av, "/,")) != NULL) {
3457                 len = ch - av;
3458                 strlcpy(buf, av, sizeof(buf));
3459                 if (len < sizeof(buf))
3460                         buf[len] = '\0';
3461                 host = buf;
3462         } else
3463                 host = av;
3464
3465         if (proto == IPPROTO_IPV6  || strcmp(av, "me6") == 0 ||
3466             inet_pton(AF_INET6, host, &a) == 1)
3467                 ret = add_dstip6(cmd, av, cblen);
3468         /* XXX: should check for IPv4, not !IPv6 */
3469         if (ret == NULL && (proto == IPPROTO_IP || strcmp(av, "me") == 0 ||
3470             inet_pton(AF_INET6, host, &a) != 1))
3471                 ret = add_dstip(cmd, av, cblen, tstate);
3472         if (ret == NULL && strcmp(av, "any") != 0)
3473                 ret = cmd;
3474
3475         return ret;
3476 }
3477
3478 /*
3479  * Parse arguments and assemble the microinstructions which make up a rule.
3480  * Rules are added into the 'rulebuf' and then copied in the correct order
3481  * into the actual rule.
3482  *
3483  * The syntax for a rule starts with the action, followed by
3484  * optional action parameters, and the various match patterns.
3485  * In the assembled microcode, the first opcode must be an O_PROBE_STATE
3486  * (generated if the rule includes a keep-state option), then the
3487  * various match patterns, log/altq actions, and the actual action.
3488  *
3489  */
3490 void
3491 compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate)
3492 {
3493         /*
3494          * rules are added into the 'rulebuf' and then copied in
3495          * the correct order into the actual rule.
3496          * Some things that need to go out of order (prob, action etc.)
3497          * go into actbuf[].
3498          */
3499         static uint32_t actbuf[255], cmdbuf[255];
3500         int rblen, ablen, cblen;
3501
3502         ipfw_insn *src, *dst, *cmd, *action, *prev=NULL;
3503         ipfw_insn *first_cmd;   /* first match pattern */
3504
3505         struct ip_fw_rule *rule;
3506
3507         /*
3508          * various flags used to record that we entered some fields.
3509          */
3510         ipfw_insn *have_state = NULL;   /* check-state or keep-state */
3511         ipfw_insn *have_log = NULL, *have_altq = NULL, *have_tag = NULL;
3512         size_t len;
3513
3514         int i;
3515
3516         int open_par = 0;       /* open parenthesis ( */
3517
3518         /* proto is here because it is used to fetch ports */
3519         u_char proto = IPPROTO_IP;      /* default protocol */
3520
3521         double match_prob = 1; /* match probability, default is always match */
3522
3523         bzero(actbuf, sizeof(actbuf));          /* actions go here */
3524         bzero(cmdbuf, sizeof(cmdbuf));
3525         bzero(rbuf, *rbufsize);
3526
3527         rule = (struct ip_fw_rule *)rbuf;
3528         cmd = (ipfw_insn *)cmdbuf;
3529         action = (ipfw_insn *)actbuf;
3530
3531         rblen = *rbufsize / sizeof(uint32_t);
3532         rblen -= sizeof(struct ip_fw_rule) / sizeof(uint32_t);
3533         ablen = sizeof(actbuf) / sizeof(actbuf[0]);
3534         cblen = sizeof(cmdbuf) / sizeof(cmdbuf[0]);
3535         cblen -= F_INSN_SIZE(ipfw_insn_u32) + 1;
3536
3537 #define CHECK_RBUFLEN(len)      { CHECK_LENGTH(rblen, len); rblen -= len; }
3538 #define CHECK_ACTLEN            CHECK_LENGTH(ablen, action->len)
3539
3540         av++;
3541
3542         /* [rule N]     -- Rule number optional */
3543         if (av[0] && isdigit(**av)) {
3544                 rule->rulenum = atoi(*av);
3545                 av++;
3546         }
3547
3548         /* [set N]      -- set number (0..RESVD_SET), optional */
3549         if (av[0] && av[1] && _substrcmp(*av, "set") == 0) {
3550                 int set = strtoul(av[1], NULL, 10);
3551                 if (set < 0 || set > RESVD_SET)
3552                         errx(EX_DATAERR, "illegal set %s", av[1]);
3553                 rule->set = set;
3554                 tstate->set = set;
3555                 av += 2;
3556         }
3557
3558         /* [prob D]     -- match probability, optional */
3559         if (av[0] && av[1] && _substrcmp(*av, "prob") == 0) {
3560                 match_prob = strtod(av[1], NULL);
3561
3562                 if (match_prob <= 0 || match_prob > 1)
3563                         errx(EX_DATAERR, "illegal match prob. %s", av[1]);
3564                 av += 2;
3565         }
3566
3567         /* action       -- mandatory */
3568         NEED1("missing action");
3569         i = match_token(rule_actions, *av);
3570         av++;
3571         action->len = 1;        /* default */
3572         CHECK_ACTLEN;
3573         switch(i) {
3574         case TOK_CHECKSTATE:
3575                 have_state = action;
3576                 action->opcode = O_CHECK_STATE;
3577                 break;
3578
3579         case TOK_ACCEPT:
3580                 action->opcode = O_ACCEPT;
3581                 break;
3582
3583         case TOK_DENY:
3584                 action->opcode = O_DENY;
3585                 action->arg1 = 0;
3586                 break;
3587
3588         case TOK_REJECT:
3589                 action->opcode = O_REJECT;
3590                 action->arg1 = ICMP_UNREACH_HOST;
3591                 break;
3592
3593         case TOK_RESET:
3594                 action->opcode = O_REJECT;
3595                 action->arg1 = ICMP_REJECT_RST;
3596                 break;
3597
3598         case TOK_RESET6:
3599                 action->opcode = O_UNREACH6;
3600                 action->arg1 = ICMP6_UNREACH_RST;
3601                 break;
3602
3603         case TOK_UNREACH:
3604                 action->opcode = O_REJECT;
3605                 NEED1("missing reject code");
3606                 fill_reject_code(&action->arg1, *av);
3607                 av++;
3608                 break;
3609
3610         case TOK_UNREACH6:
3611                 action->opcode = O_UNREACH6;
3612                 NEED1("missing unreach code");
3613                 fill_unreach6_code(&action->arg1, *av);
3614                 av++;
3615                 break;
3616
3617         case TOK_COUNT:
3618                 action->opcode = O_COUNT;
3619                 break;
3620
3621         case TOK_NAT:
3622                 action->opcode = O_NAT;
3623                 action->len = F_INSN_SIZE(ipfw_insn_nat);
3624                 CHECK_ACTLEN;
3625                 if (_substrcmp(*av, "global") == 0) {
3626                         action->arg1 = 0;
3627                         av++;
3628                         break;
3629                 } else
3630                         goto chkarg;
3631         case TOK_QUEUE:
3632                 action->opcode = O_QUEUE;
3633                 goto chkarg;
3634         case TOK_PIPE:
3635                 action->opcode = O_PIPE;
3636                 goto chkarg;
3637         case TOK_SKIPTO:
3638                 action->opcode = O_SKIPTO;
3639                 goto chkarg;
3640         case TOK_NETGRAPH:
3641                 action->opcode = O_NETGRAPH;
3642                 goto chkarg;
3643         case TOK_NGTEE:
3644                 action->opcode = O_NGTEE;
3645                 goto chkarg;
3646         case TOK_DIVERT:
3647                 action->opcode = O_DIVERT;
3648                 goto chkarg;
3649         case TOK_TEE:
3650                 action->opcode = O_TEE;
3651                 goto chkarg;
3652         case TOK_CALL:
3653                 action->opcode = O_CALLRETURN;
3654 chkarg:
3655                 if (!av[0])
3656                         errx(EX_USAGE, "missing argument for %s", *(av - 1));
3657                 if (isdigit(**av)) {
3658                         action->arg1 = strtoul(*av, NULL, 10);
3659                         if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG)
3660                                 errx(EX_DATAERR, "illegal argument for %s",
3661                                     *(av - 1));
3662                 } else if (_substrcmp(*av, "tablearg") == 0) {
3663                         action->arg1 = IP_FW_TARG;
3664                 } else if (i == TOK_DIVERT || i == TOK_TEE) {
3665                         struct servent *s;
3666                         setservent(1);
3667                         s = getservbyname(av[0], "divert");
3668                         if (s != NULL)
3669                                 action->arg1 = ntohs(s->s_port);
3670                         else
3671                                 errx(EX_DATAERR, "illegal divert/tee port");
3672                 } else
3673                         errx(EX_DATAERR, "illegal argument for %s", *(av - 1));
3674                 av++;
3675                 break;
3676
3677         case TOK_FORWARD: {
3678                 /*
3679                  * Locate the address-port separator (':' or ',').
3680                  * Could be one of the following:
3681                  *      hostname:port
3682                  *      IPv4 a.b.c.d,port
3683                  *      IPv4 a.b.c.d:port
3684                  *      IPv6 w:x:y::z,port
3685                  * The ':' can only be used with hostname and IPv4 address.
3686                  * XXX-BZ Should we also support [w:x:y::z]:port?
3687                  */
3688                 struct sockaddr_storage result;
3689                 struct addrinfo *res;
3690                 char *s, *end;
3691                 int family;
3692                 u_short port_number;
3693
3694                 NEED1("missing forward address[:port]");
3695
3696                 /*
3697                  * locate the address-port separator (':' or ',')
3698                  */
3699                 s = strchr(*av, ',');
3700                 if (s == NULL) {
3701                         /* Distinguish between IPv4:port and IPv6 cases. */
3702                         s = strchr(*av, ':');
3703                         if (s && strchr(s+1, ':'))
3704                                 s = NULL; /* no port */
3705                 }
3706
3707                 port_number = 0;
3708                 if (s != NULL) {
3709                         /* Terminate host portion and set s to start of port. */
3710                         *(s++) = '\0';
3711                         i = strtoport(s, &end, 0 /* base */, 0 /* proto */);
3712                         if (s == end)
3713                                 errx(EX_DATAERR,
3714                                     "illegal forwarding port ``%s''", s);
3715                         port_number = (u_short)i;
3716                 }
3717
3718                 if (_substrcmp(*av, "tablearg") == 0) {
3719                         family = PF_INET;
3720                         ((struct sockaddr_in*)&result)->sin_addr.s_addr =
3721                             INADDR_ANY;
3722                 } else {
3723                         /*
3724                          * Resolve the host name or address to a family and a
3725                          * network representation of the address.
3726                          */
3727                         if (getaddrinfo(*av, NULL, NULL, &res))
3728                                 errx(EX_DATAERR, NULL);
3729                         /* Just use the first host in the answer. */
3730                         family = res->ai_family;
3731                         memcpy(&result, res->ai_addr, res->ai_addrlen);
3732                         freeaddrinfo(res);
3733                 }
3734
3735                 if (family == PF_INET) {
3736                         ipfw_insn_sa *p = (ipfw_insn_sa *)action;
3737
3738                         action->opcode = O_FORWARD_IP;
3739                         action->len = F_INSN_SIZE(ipfw_insn_sa);
3740                         CHECK_ACTLEN;
3741
3742                         /*
3743                          * In the kernel we assume AF_INET and use only
3744                          * sin_port and sin_addr. Remember to set sin_len as
3745                          * the routing code seems to use it too.
3746                          */
3747                         p->sa.sin_len = sizeof(struct sockaddr_in);
3748                         p->sa.sin_family = AF_INET;
3749                         p->sa.sin_port = port_number;
3750                         p->sa.sin_addr.s_addr =
3751                              ((struct sockaddr_in *)&result)->sin_addr.s_addr;
3752                 } else if (family == PF_INET6) {
3753                         ipfw_insn_sa6 *p = (ipfw_insn_sa6 *)action;
3754
3755                         action->opcode = O_FORWARD_IP6;
3756                         action->len = F_INSN_SIZE(ipfw_insn_sa6);
3757                         CHECK_ACTLEN;
3758
3759                         p->sa.sin6_len = sizeof(struct sockaddr_in6);
3760                         p->sa.sin6_family = AF_INET6;
3761                         p->sa.sin6_port = port_number;
3762                         p->sa.sin6_flowinfo = 0;
3763                         p->sa.sin6_scope_id =
3764                             ((struct sockaddr_in6 *)&result)->sin6_scope_id;
3765                         bcopy(&((struct sockaddr_in6*)&result)->sin6_addr,
3766                             &p->sa.sin6_addr, sizeof(p->sa.sin6_addr));
3767                 } else {
3768                         errx(EX_DATAERR, "Invalid address family in forward action");
3769                 }
3770                 av++;
3771                 break;
3772             }
3773         case TOK_COMMENT:
3774                 /* pretend it is a 'count' rule followed by the comment */
3775                 action->opcode = O_COUNT;
3776                 av--;           /* go back... */
3777                 break;
3778
3779         case TOK_SETFIB:
3780             {
3781                 int numfibs;
3782                 size_t intsize = sizeof(int);
3783
3784                 action->opcode = O_SETFIB;
3785                 NEED1("missing fib number");
3786                 if (_substrcmp(*av, "tablearg") == 0) {
3787                         action->arg1 = IP_FW_TARG;
3788                 } else {
3789                         action->arg1 = strtoul(*av, NULL, 10);
3790                         if (sysctlbyname("net.fibs", &numfibs, &intsize,
3791                             NULL, 0) == -1)
3792                                 errx(EX_DATAERR, "fibs not suported.\n");
3793                         if (action->arg1 >= numfibs)  /* Temporary */
3794                                 errx(EX_DATAERR, "fib too large.\n");
3795                         /* Add high-order bit to fib to make room for tablearg*/
3796                         action->arg1 |= 0x8000;
3797                 }
3798                 av++;
3799                 break;
3800             }
3801
3802         case TOK_SETDSCP:
3803             {
3804                 int code;
3805
3806                 action->opcode = O_SETDSCP;
3807                 NEED1("missing DSCP code");
3808                 if (_substrcmp(*av, "tablearg") == 0) {
3809                         action->arg1 = IP_FW_TARG;
3810                 } else if (isalpha(*av[0])) {
3811                         if ((code = match_token(f_ipdscp, *av)) == -1)
3812                                 errx(EX_DATAERR, "Unknown DSCP code");
3813                         action->arg1 = code;
3814                 } else
3815                         action->arg1 = strtoul(*av, NULL, 10);
3816                 /* Add high-order bit to DSCP to make room for tablearg */
3817                 if (action->arg1 != IP_FW_TARG)
3818                         action->arg1 |= 0x8000;
3819                 av++;
3820                 break;
3821             }
3822
3823         case TOK_REASS:
3824                 action->opcode = O_REASS;
3825                 break;
3826
3827         case TOK_RETURN:
3828                 fill_cmd(action, O_CALLRETURN, F_NOT, 0);
3829                 break;
3830
3831         default:
3832                 errx(EX_DATAERR, "invalid action %s\n", av[-1]);
3833         }
3834         action = next_cmd(action, &ablen);
3835
3836         /*
3837          * [altq queuename] -- altq tag, optional
3838          * [log [logamount N]]  -- log, optional
3839          *
3840          * If they exist, it go first in the cmdbuf, but then it is
3841          * skipped in the copy section to the end of the buffer.
3842          */
3843         while (av[0] != NULL && (i = match_token(rule_action_params, *av)) != -1) {
3844                 av++;
3845                 switch (i) {
3846                 case TOK_LOG:
3847                     {
3848                         ipfw_insn_log *c = (ipfw_insn_log *)cmd;
3849                         int l;
3850
3851                         if (have_log)
3852                                 errx(EX_DATAERR,
3853                                     "log cannot be specified more than once");
3854                         have_log = (ipfw_insn *)c;
3855                         cmd->len = F_INSN_SIZE(ipfw_insn_log);
3856                         CHECK_CMDLEN;
3857                         cmd->opcode = O_LOG;
3858                         if (av[0] && _substrcmp(*av, "logamount") == 0) {
3859                                 av++;
3860                                 NEED1("logamount requires argument");
3861                                 l = atoi(*av);
3862                                 if (l < 0)
3863                                         errx(EX_DATAERR,
3864                                             "logamount must be positive");
3865                                 c->max_log = l;
3866                                 av++;
3867                         } else {
3868                                 len = sizeof(c->max_log);
3869                                 if (sysctlbyname("net.inet.ip.fw.verbose_limit",
3870                                     &c->max_log, &len, NULL, 0) == -1) {
3871                                         if (co.test_only) {
3872                                                 c->max_log = 0;
3873                                                 break;
3874                                         }
3875                                         errx(1, "sysctlbyname(\"%s\")",
3876                                             "net.inet.ip.fw.verbose_limit");
3877                                 }
3878                         }
3879                     }
3880                         break;
3881
3882 #ifndef NO_ALTQ
3883                 case TOK_ALTQ:
3884                     {
3885                         ipfw_insn_altq *a = (ipfw_insn_altq *)cmd;
3886
3887                         NEED1("missing altq queue name");
3888                         if (have_altq)
3889                                 errx(EX_DATAERR,
3890                                     "altq cannot be specified more than once");
3891                         have_altq = (ipfw_insn *)a;
3892                         cmd->len = F_INSN_SIZE(ipfw_insn_altq);
3893                         CHECK_CMDLEN;
3894                         cmd->opcode = O_ALTQ;
3895                         a->qid = altq_name_to_qid(*av);
3896                         av++;
3897                     }
3898                         break;
3899 #endif
3900
3901                 case TOK_TAG:
3902                 case TOK_UNTAG: {
3903                         uint16_t tag;
3904
3905                         if (have_tag)
3906                                 errx(EX_USAGE, "tag and untag cannot be "
3907                                     "specified more than once");
3908                         GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX, i,
3909                            rule_action_params);
3910                         have_tag = cmd;
3911                         fill_cmd(cmd, O_TAG, (i == TOK_TAG) ? 0: F_NOT, tag);
3912                         av++;
3913                         break;
3914                 }
3915
3916                 default:
3917                         abort();
3918                 }
3919                 cmd = next_cmd(cmd, &cblen);
3920         }
3921
3922         if (have_state) /* must be a check-state, we are done */
3923                 goto done;
3924
3925 #define OR_START(target)                                        \
3926         if (av[0] && (*av[0] == '(' || *av[0] == '{')) {        \
3927                 if (open_par)                                   \
3928                         errx(EX_USAGE, "nested \"(\" not allowed\n"); \
3929                 prev = NULL;                                    \
3930                 open_par = 1;                                   \
3931                 if ( (av[0])[1] == '\0') {                      \
3932                         av++;                                   \
3933                 } else                                          \
3934                         (*av)++;                                \
3935         }                                                       \
3936         target:                                                 \
3937
3938
3939 #define CLOSE_PAR                                               \
3940         if (open_par) {                                         \
3941                 if (av[0] && (                                  \
3942                     strcmp(*av, ")") == 0 ||                    \
3943                     strcmp(*av, "}") == 0)) {                   \
3944                         prev = NULL;                            \
3945                         open_par = 0;                           \
3946                         av++;                                   \
3947                 } else                                          \
3948                         errx(EX_USAGE, "missing \")\"\n");      \
3949         }
3950
3951 #define NOT_BLOCK                                               \
3952         if (av[0] && _substrcmp(*av, "not") == 0) {             \
3953                 if (cmd->len & F_NOT)                           \
3954                         errx(EX_USAGE, "double \"not\" not allowed\n"); \
3955                 cmd->len |= F_NOT;                              \
3956                 av++;                                           \
3957         }
3958
3959 #define OR_BLOCK(target)                                        \
3960         if (av[0] && _substrcmp(*av, "or") == 0) {              \
3961                 if (prev == NULL || open_par == 0)              \
3962                         errx(EX_DATAERR, "invalid OR block");   \
3963                 prev->len |= F_OR;                              \
3964                 av++;                                   \
3965                 goto target;                                    \
3966         }                                                       \
3967         CLOSE_PAR;
3968
3969         first_cmd = cmd;
3970
3971 #if 0
3972         /*
3973          * MAC addresses, optional.
3974          * If we have this, we skip the part "proto from src to dst"
3975          * and jump straight to the option parsing.
3976          */
3977         NOT_BLOCK;
3978         NEED1("missing protocol");
3979         if (_substrcmp(*av, "MAC") == 0 ||
3980             _substrcmp(*av, "mac") == 0) {
3981                 av++;                   /* the "MAC" keyword */
3982                 add_mac(cmd, av);       /* exits in case of errors */
3983                 cmd = next_cmd(cmd);
3984                 av += 2;                /* dst-mac and src-mac */
3985                 NOT_BLOCK;
3986                 NEED1("missing mac type");
3987                 if (add_mactype(cmd, av[0]))
3988                         cmd = next_cmd(cmd);
3989                 av++;                   /* any or mac-type */
3990                 goto read_options;
3991         }
3992 #endif
3993
3994         /*
3995          * protocol, mandatory
3996          */
3997     OR_START(get_proto);
3998         NOT_BLOCK;
3999         NEED1("missing protocol");
4000         if (add_proto_compat(cmd, *av, &proto)) {
4001                 av++;
4002                 if (F_LEN(cmd) != 0) {
4003                         prev = cmd;
4004                         cmd = next_cmd(cmd, &cblen);
4005                 }
4006         } else if (first_cmd != cmd) {
4007                 errx(EX_DATAERR, "invalid protocol ``%s''", *av);
4008         } else
4009                 goto read_options;
4010     OR_BLOCK(get_proto);
4011
4012         /*
4013          * "from", mandatory
4014          */
4015         if ((av[0] == NULL) || _substrcmp(*av, "from") != 0)
4016                 errx(EX_USAGE, "missing ``from''");
4017         av++;
4018
4019         /*
4020          * source IP, mandatory
4021          */
4022     OR_START(source_ip);
4023         NOT_BLOCK;      /* optional "not" */
4024         NEED1("missing source address");
4025         if (add_src(cmd, *av, proto, cblen, tstate)) {
4026                 av++;
4027                 if (F_LEN(cmd) != 0) {  /* ! any */
4028                         prev = cmd;
4029                         cmd = next_cmd(cmd, &cblen);
4030                 }
4031         } else
4032                 errx(EX_USAGE, "bad source address %s", *av);
4033     OR_BLOCK(source_ip);
4034
4035         /*
4036          * source ports, optional
4037          */
4038         NOT_BLOCK;      /* optional "not" */
4039         if ( av[0] != NULL ) {
4040                 if (_substrcmp(*av, "any") == 0 ||
4041                     add_ports(cmd, *av, proto, O_IP_SRCPORT, cblen)) {
4042                         av++;
4043                         if (F_LEN(cmd) != 0)
4044                                 cmd = next_cmd(cmd, &cblen);
4045                 }
4046         }
4047
4048         /*
4049          * "to", mandatory
4050          */
4051         if ( (av[0] == NULL) || _substrcmp(*av, "to") != 0 )
4052                 errx(EX_USAGE, "missing ``to''");
4053         av++;
4054
4055         /*
4056          * destination, mandatory
4057          */
4058     OR_START(dest_ip);
4059         NOT_BLOCK;      /* optional "not" */
4060         NEED1("missing dst address");
4061         if (add_dst(cmd, *av, proto, cblen, tstate)) {
4062                 av++;
4063                 if (F_LEN(cmd) != 0) {  /* ! any */
4064                         prev = cmd;
4065                         cmd = next_cmd(cmd, &cblen);
4066                 }
4067         } else
4068                 errx( EX_USAGE, "bad destination address %s", *av);
4069     OR_BLOCK(dest_ip);
4070
4071         /*
4072          * dest. ports, optional
4073          */
4074         NOT_BLOCK;      /* optional "not" */
4075         if (av[0]) {
4076                 if (_substrcmp(*av, "any") == 0 ||
4077                     add_ports(cmd, *av, proto, O_IP_DSTPORT, cblen)) {
4078                         av++;
4079                         if (F_LEN(cmd) != 0)
4080                                 cmd = next_cmd(cmd, &cblen);
4081                 }
4082         }
4083
4084 read_options:
4085         if (av[0] && first_cmd == cmd) {
4086                 /*
4087                  * nothing specified so far, store in the rule to ease
4088                  * printout later.
4089                  */
4090                  rule->flags |= IPFW_RULE_NOOPT;
4091         }
4092         prev = NULL;
4093         while ( av[0] != NULL ) {
4094                 char *s;
4095                 ipfw_insn_u32 *cmd32;   /* alias for cmd */
4096
4097                 s = *av;
4098                 cmd32 = (ipfw_insn_u32 *)cmd;
4099
4100                 if (*s == '!') {        /* alternate syntax for NOT */
4101                         if (cmd->len & F_NOT)
4102                                 errx(EX_USAGE, "double \"not\" not allowed\n");
4103                         cmd->len = F_NOT;
4104                         s++;
4105                 }
4106                 i = match_token(rule_options, s);
4107                 av++;
4108                 switch(i) {
4109                 case TOK_NOT:
4110                         if (cmd->len & F_NOT)
4111                                 errx(EX_USAGE, "double \"not\" not allowed\n");
4112                         cmd->len = F_NOT;
4113                         break;
4114
4115                 case TOK_OR:
4116                         if (open_par == 0 || prev == NULL)
4117                                 errx(EX_USAGE, "invalid \"or\" block\n");
4118                         prev->len |= F_OR;
4119                         break;
4120
4121                 case TOK_STARTBRACE:
4122                         if (open_par)
4123                                 errx(EX_USAGE, "+nested \"(\" not allowed\n");
4124                         open_par = 1;
4125                         break;
4126
4127                 case TOK_ENDBRACE:
4128                         if (!open_par)
4129                                 errx(EX_USAGE, "+missing \")\"\n");
4130                         open_par = 0;
4131                         prev = NULL;
4132                         break;
4133
4134                 case TOK_IN:
4135                         fill_cmd(cmd, O_IN, 0, 0);
4136                         break;
4137
4138                 case TOK_OUT:
4139                         cmd->len ^= F_NOT; /* toggle F_NOT */
4140                         fill_cmd(cmd, O_IN, 0, 0);
4141                         break;
4142
4143                 case TOK_DIVERTED:
4144                         fill_cmd(cmd, O_DIVERTED, 0, 3);
4145                         break;
4146
4147                 case TOK_DIVERTEDLOOPBACK:
4148                         fill_cmd(cmd, O_DIVERTED, 0, 1);
4149                         break;
4150
4151                 case TOK_DIVERTEDOUTPUT:
4152                         fill_cmd(cmd, O_DIVERTED, 0, 2);
4153                         break;
4154
4155                 case TOK_FRAG:
4156                         fill_cmd(cmd, O_FRAG, 0, 0);
4157                         break;
4158
4159                 case TOK_LAYER2:
4160                         fill_cmd(cmd, O_LAYER2, 0, 0);
4161                         break;
4162
4163                 case TOK_XMIT:
4164                 case TOK_RECV:
4165                 case TOK_VIA:
4166                         NEED1("recv, xmit, via require interface name"
4167                                 " or address");
4168                         fill_iface((ipfw_insn_if *)cmd, av[0], cblen, tstate);
4169                         av++;
4170                         if (F_LEN(cmd) == 0)    /* not a valid address */
4171                                 break;
4172                         if (i == TOK_XMIT)
4173                                 cmd->opcode = O_XMIT;
4174                         else if (i == TOK_RECV)
4175                                 cmd->opcode = O_RECV;
4176                         else if (i == TOK_VIA)
4177                                 cmd->opcode = O_VIA;
4178                         break;
4179
4180                 case TOK_ICMPTYPES:
4181                         NEED1("icmptypes requires list of types");
4182                         fill_icmptypes((ipfw_insn_u32 *)cmd, *av);
4183                         av++;
4184                         break;
4185
4186                 case TOK_ICMP6TYPES:
4187                         NEED1("icmptypes requires list of types");
4188                         fill_icmp6types((ipfw_insn_icmp6 *)cmd, *av, cblen);
4189                         av++;
4190                         break;
4191
4192                 case TOK_IPTTL:
4193                         NEED1("ipttl requires TTL");
4194                         if (strpbrk(*av, "-,")) {
4195                             if (!add_ports(cmd, *av, 0, O_IPTTL, cblen))
4196                                 errx(EX_DATAERR, "invalid ipttl %s", *av);
4197                         } else
4198                             fill_cmd(cmd, O_IPTTL, 0, strtoul(*av, NULL, 0));
4199                         av++;
4200                         break;
4201
4202                 case TOK_IPID:
4203                         NEED1("ipid requires id");
4204                         if (strpbrk(*av, "-,")) {
4205                             if (!add_ports(cmd, *av, 0, O_IPID, cblen))
4206                                 errx(EX_DATAERR, "invalid ipid %s", *av);
4207                         } else
4208                             fill_cmd(cmd, O_IPID, 0, strtoul(*av, NULL, 0));
4209                         av++;
4210                         break;
4211
4212                 case TOK_IPLEN:
4213                         NEED1("iplen requires length");
4214                         if (strpbrk(*av, "-,")) {
4215                             if (!add_ports(cmd, *av, 0, O_IPLEN, cblen))
4216                                 errx(EX_DATAERR, "invalid ip len %s", *av);
4217                         } else
4218                             fill_cmd(cmd, O_IPLEN, 0, strtoul(*av, NULL, 0));
4219                         av++;
4220                         break;
4221
4222                 case TOK_IPVER:
4223                         NEED1("ipver requires version");
4224                         fill_cmd(cmd, O_IPVER, 0, strtoul(*av, NULL, 0));
4225                         av++;
4226                         break;
4227
4228                 case TOK_IPPRECEDENCE:
4229                         NEED1("ipprecedence requires value");
4230                         fill_cmd(cmd, O_IPPRECEDENCE, 0,
4231                             (strtoul(*av, NULL, 0) & 7) << 5);
4232                         av++;
4233                         break;
4234
4235                 case TOK_DSCP:
4236                         NEED1("missing DSCP code");
4237                         fill_dscp(cmd, *av, cblen);
4238                         av++;
4239                         break;
4240
4241                 case TOK_IPOPTS:
4242                         NEED1("missing argument for ipoptions");
4243                         fill_flags_cmd(cmd, O_IPOPT, f_ipopts, *av);
4244                         av++;
4245                         break;
4246
4247                 case TOK_IPTOS:
4248                         NEED1("missing argument for iptos");
4249                         fill_flags_cmd(cmd, O_IPTOS, f_iptos, *av);
4250                         av++;
4251                         break;
4252
4253                 case TOK_UID:
4254                         NEED1("uid requires argument");
4255                     {
4256                         char *end;
4257                         uid_t uid;
4258                         struct passwd *pwd;
4259
4260                         cmd->opcode = O_UID;
4261                         uid = strtoul(*av, &end, 0);
4262                         pwd = (*end == '\0') ? getpwuid(uid) : getpwnam(*av);
4263                         if (pwd == NULL)
4264                                 errx(EX_DATAERR, "uid \"%s\" nonexistent", *av);
4265                         cmd32->d[0] = pwd->pw_uid;
4266                         cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
4267                         av++;
4268                     }
4269                         break;
4270
4271                 case TOK_GID:
4272                         NEED1("gid requires argument");
4273                     {
4274                         char *end;
4275                         gid_t gid;
4276                         struct group *grp;
4277
4278                         cmd->opcode = O_GID;
4279                         gid = strtoul(*av, &end, 0);
4280                         grp = (*end == '\0') ? getgrgid(gid) : getgrnam(*av);
4281                         if (grp == NULL)
4282                                 errx(EX_DATAERR, "gid \"%s\" nonexistent", *av);
4283                         cmd32->d[0] = grp->gr_gid;
4284                         cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
4285                         av++;
4286                     }
4287                         break;
4288
4289                 case TOK_JAIL:
4290                         NEED1("jail requires argument");
4291                     {
4292                         char *end;
4293                         int jid;
4294
4295                         cmd->opcode = O_JAIL;
4296                         jid = (int)strtol(*av, &end, 0);
4297                         if (jid < 0 || *end != '\0')
4298                                 errx(EX_DATAERR, "jail requires prison ID");
4299                         cmd32->d[0] = (uint32_t)jid;
4300                         cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
4301                         av++;
4302                     }
4303                         break;
4304
4305                 case TOK_ESTAB:
4306                         fill_cmd(cmd, O_ESTAB, 0, 0);
4307                         break;
4308
4309                 case TOK_SETUP:
4310                         fill_cmd(cmd, O_TCPFLAGS, 0,
4311                                 (TH_SYN) | ( (TH_ACK) & 0xff) <<8 );
4312                         break;
4313
4314                 case TOK_TCPDATALEN:
4315                         NEED1("tcpdatalen requires length");
4316                         if (strpbrk(*av, "-,")) {
4317                             if (!add_ports(cmd, *av, 0, O_TCPDATALEN, cblen))
4318                                 errx(EX_DATAERR, "invalid tcpdata len %s", *av);
4319                         } else
4320                             fill_cmd(cmd, O_TCPDATALEN, 0,
4321                                     strtoul(*av, NULL, 0));
4322                         av++;
4323                         break;
4324
4325                 case TOK_TCPOPTS:
4326                         NEED1("missing argument for tcpoptions");
4327                         fill_flags_cmd(cmd, O_TCPOPTS, f_tcpopts, *av);
4328                         av++;
4329                         break;
4330
4331                 case TOK_TCPSEQ:
4332                 case TOK_TCPACK:
4333                         NEED1("tcpseq/tcpack requires argument");
4334                         cmd->len = F_INSN_SIZE(ipfw_insn_u32);
4335                         cmd->opcode = (i == TOK_TCPSEQ) ? O_TCPSEQ : O_TCPACK;
4336                         cmd32->d[0] = htonl(strtoul(*av, NULL, 0));
4337                         av++;
4338                         break;
4339
4340                 case TOK_TCPWIN:
4341                         NEED1("tcpwin requires length");
4342                         if (strpbrk(*av, "-,")) {
4343                             if (!add_ports(cmd, *av, 0, O_TCPWIN, cblen))
4344                                 errx(EX_DATAERR, "invalid tcpwin len %s", *av);
4345                         } else
4346                             fill_cmd(cmd, O_TCPWIN, 0,
4347                                     strtoul(*av, NULL, 0));
4348                         av++;
4349                         break;
4350
4351                 case TOK_TCPFLAGS:
4352                         NEED1("missing argument for tcpflags");
4353                         cmd->opcode = O_TCPFLAGS;
4354                         fill_flags_cmd(cmd, O_TCPFLAGS, f_tcpflags, *av);
4355                         av++;
4356                         break;
4357
4358                 case TOK_KEEPSTATE:
4359                         if (open_par)
4360                                 errx(EX_USAGE, "keep-state cannot be part "
4361                                     "of an or block");
4362                         if (have_state)
4363                                 errx(EX_USAGE, "only one of keep-state "
4364                                         "and limit is allowed");
4365                         have_state = cmd;
4366                         fill_cmd(cmd, O_KEEP_STATE, 0, 0);
4367                         break;
4368
4369                 case TOK_LIMIT: {
4370                         ipfw_insn_limit *c = (ipfw_insn_limit *)cmd;
4371                         int val;
4372
4373                         if (open_par)
4374                                 errx(EX_USAGE,
4375                                     "limit cannot be part of an or block");
4376                         if (have_state)
4377                                 errx(EX_USAGE, "only one of keep-state and "
4378                                     "limit is allowed");
4379                         have_state = cmd;
4380
4381                         cmd->len = F_INSN_SIZE(ipfw_insn_limit);
4382                         CHECK_CMDLEN;
4383                         cmd->opcode = O_LIMIT;
4384                         c->limit_mask = c->conn_limit = 0;
4385
4386                         while ( av[0] != NULL ) {
4387                                 if ((val = match_token(limit_masks, *av)) <= 0)
4388                                         break;
4389                                 c->limit_mask |= val;
4390                                 av++;
4391                         }
4392
4393                         if (c->limit_mask == 0)
4394                                 errx(EX_USAGE, "limit: missing limit mask");
4395
4396                         GET_UINT_ARG(c->conn_limit, IPFW_ARG_MIN, IPFW_ARG_MAX,
4397                             TOK_LIMIT, rule_options);
4398
4399                         av++;
4400                         break;
4401                 }
4402
4403                 case TOK_PROTO:
4404                         NEED1("missing protocol");
4405                         if (add_proto(cmd, *av, &proto)) {
4406                                 av++;
4407                         } else
4408                                 errx(EX_DATAERR, "invalid protocol ``%s''",
4409                                     *av);
4410                         break;
4411
4412                 case TOK_SRCIP:
4413                         NEED1("missing source IP");
4414                         if (add_srcip(cmd, *av, cblen, tstate)) {
4415                                 av++;
4416                         }
4417                         break;
4418
4419                 case TOK_DSTIP:
4420                         NEED1("missing destination IP");
4421                         if (add_dstip(cmd, *av, cblen, tstate)) {
4422                                 av++;
4423                         }
4424                         break;
4425
4426                 case TOK_SRCIP6:
4427                         NEED1("missing source IP6");
4428                         if (add_srcip6(cmd, *av, cblen)) {
4429                                 av++;
4430                         }
4431                         break;
4432
4433                 case TOK_DSTIP6:
4434                         NEED1("missing destination IP6");
4435                         if (add_dstip6(cmd, *av, cblen)) {
4436                                 av++;
4437                         }
4438                         break;
4439
4440                 case TOK_SRCPORT:
4441                         NEED1("missing source port");
4442                         if (_substrcmp(*av, "any") == 0 ||
4443                             add_ports(cmd, *av, proto, O_IP_SRCPORT, cblen)) {
4444                                 av++;
4445                         } else
4446                                 errx(EX_DATAERR, "invalid source port %s", *av);
4447                         break;
4448
4449                 case TOK_DSTPORT:
4450                         NEED1("missing destination port");
4451                         if (_substrcmp(*av, "any") == 0 ||
4452                             add_ports(cmd, *av, proto, O_IP_DSTPORT, cblen)) {
4453                                 av++;
4454                         } else
4455                                 errx(EX_DATAERR, "invalid destination port %s",
4456                                     *av);
4457                         break;
4458
4459                 case TOK_MAC:
4460                         if (add_mac(cmd, av, cblen))
4461                                 av += 2;
4462                         break;
4463
4464                 case TOK_MACTYPE:
4465                         NEED1("missing mac type");
4466                         if (!add_mactype(cmd, *av, cblen))
4467                                 errx(EX_DATAERR, "invalid mac type %s", *av);
4468                         av++;
4469                         break;
4470
4471                 case TOK_VERREVPATH:
4472                         fill_cmd(cmd, O_VERREVPATH, 0, 0);
4473                         break;
4474
4475                 case TOK_VERSRCREACH:
4476                         fill_cmd(cmd, O_VERSRCREACH, 0, 0);
4477                         break;
4478
4479                 case TOK_ANTISPOOF:
4480                         fill_cmd(cmd, O_ANTISPOOF, 0, 0);
4481                         break;
4482
4483                 case TOK_IPSEC:
4484                         fill_cmd(cmd, O_IPSEC, 0, 0);
4485                         break;
4486
4487                 case TOK_IPV6:
4488                         fill_cmd(cmd, O_IP6, 0, 0);
4489                         break;
4490
4491                 case TOK_IPV4:
4492                         fill_cmd(cmd, O_IP4, 0, 0);
4493                         break;
4494
4495                 case TOK_EXT6HDR:
4496                         fill_ext6hdr( cmd, *av );
4497                         av++;
4498                         break;
4499
4500                 case TOK_FLOWID:
4501                         if (proto != IPPROTO_IPV6 )
4502                                 errx( EX_USAGE, "flow-id filter is active "
4503                                     "only for ipv6 protocol\n");
4504                         fill_flow6( (ipfw_insn_u32 *) cmd, *av, cblen);
4505                         av++;
4506                         break;
4507
4508                 case TOK_COMMENT:
4509                         fill_comment(cmd, av, cblen);
4510                         av[0]=NULL;
4511                         break;
4512
4513                 case TOK_TAGGED:
4514                         if (av[0] && strpbrk(*av, "-,")) {
4515                                 if (!add_ports(cmd, *av, 0, O_TAGGED, cblen))
4516                                         errx(EX_DATAERR, "tagged: invalid tag"
4517                                             " list: %s", *av);
4518                         }
4519                         else {
4520                                 uint16_t tag;
4521
4522                                 GET_UINT_ARG(tag, IPFW_ARG_MIN, IPFW_ARG_MAX,
4523                                     TOK_TAGGED, rule_options);
4524                                 fill_cmd(cmd, O_TAGGED, 0, tag);
4525                         }
4526                         av++;
4527                         break;
4528
4529                 case TOK_FIB:
4530                         NEED1("fib requires fib number");
4531                         fill_cmd(cmd, O_FIB, 0, strtoul(*av, NULL, 0));
4532                         av++;
4533                         break;
4534                 case TOK_SOCKARG:
4535                         fill_cmd(cmd, O_SOCKARG, 0, 0);
4536                         break;
4537
4538                 case TOK_LOOKUP: {
4539                         ipfw_insn_u32 *c = (ipfw_insn_u32 *)cmd;
4540                         int j;
4541
4542                         if (!av[0] || !av[1])
4543                                 errx(EX_USAGE, "format: lookup argument tablenum");
4544                         cmd->opcode = O_IP_DST_LOOKUP;
4545                         cmd->len |= F_INSN_SIZE(ipfw_insn) + 2;
4546                         i = match_token(rule_options, *av);
4547                         for (j = 0; lookup_key[j] >= 0 ; j++) {
4548                                 if (i == lookup_key[j])
4549                                         break;
4550                         }
4551                         if (lookup_key[j] <= 0)
4552                                 errx(EX_USAGE, "format: cannot lookup on %s", *av);
4553                         __PAST_END(c->d, 1) = j; // i converted to option
4554                         av++;
4555
4556                         if ((j = pack_table(tstate, *av)) == 0)
4557                                 errx(EX_DATAERR, "Invalid table name: %s", *av);
4558
4559                         cmd->arg1 = j;
4560                         av++;
4561                     }
4562                         break;
4563                 case TOK_FLOW:
4564                         NEED1("missing table name");
4565                         if (strncmp(*av, "table(", 6) != 0)
4566                                 errx(EX_DATAERR,
4567                                     "enclose table name into \"table()\"");
4568                         fill_table(cmd, *av, O_IP_FLOW_LOOKUP, tstate);
4569                         av++;
4570                         break;
4571
4572                 default:
4573                         errx(EX_USAGE, "unrecognised option [%d] %s\n", i, s);
4574                 }
4575                 if (F_LEN(cmd) > 0) {   /* prepare to advance */
4576                         prev = cmd;
4577                         cmd = next_cmd(cmd, &cblen);
4578                 }
4579         }
4580
4581 done:
4582         /*
4583          * Now copy stuff into the rule.
4584          * If we have a keep-state option, the first instruction
4585          * must be a PROBE_STATE (which is generated here).
4586          * If we have a LOG option, it was stored as the first command,
4587          * and now must be moved to the top of the action part.
4588          */
4589         dst = (ipfw_insn *)rule->cmd;
4590
4591         /*
4592          * First thing to write into the command stream is the match probability.
4593          */
4594         if (match_prob != 1) { /* 1 means always match */
4595                 dst->opcode = O_PROB;
4596                 dst->len = 2;
4597                 *((int32_t *)(dst+1)) = (int32_t)(match_prob * 0x7fffffff);
4598                 dst += dst->len;
4599         }
4600
4601         /*
4602          * generate O_PROBE_STATE if necessary
4603          */
4604         if (have_state && have_state->opcode != O_CHECK_STATE) {
4605                 fill_cmd(dst, O_PROBE_STATE, 0, 0);
4606                 dst = next_cmd(dst, &rblen);
4607         }
4608
4609         /* copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT, O_ALTQ, O_TAG */
4610         for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) {
4611                 i = F_LEN(src);
4612                 CHECK_RBUFLEN(i);
4613
4614                 switch (src->opcode) {
4615                 case O_LOG:
4616                 case O_KEEP_STATE:
4617                 case O_LIMIT:
4618                 case O_ALTQ:
4619                 case O_TAG:
4620                         break;
4621                 default:
4622                         bcopy(src, dst, i * sizeof(uint32_t));
4623                         dst += i;
4624                 }
4625         }
4626
4627         /*
4628          * put back the have_state command as last opcode
4629          */
4630         if (have_state && have_state->opcode != O_CHECK_STATE) {
4631                 i = F_LEN(have_state);
4632                 CHECK_RBUFLEN(i);
4633                 bcopy(have_state, dst, i * sizeof(uint32_t));
4634                 dst += i;
4635         }
4636         /*
4637          * start action section
4638          */
4639         rule->act_ofs = dst - rule->cmd;
4640
4641         /* put back O_LOG, O_ALTQ, O_TAG if necessary */
4642         if (have_log) {
4643                 i = F_LEN(have_log);
4644                 CHECK_RBUFLEN(i);
4645                 bcopy(have_log, dst, i * sizeof(uint32_t));
4646                 dst += i;
4647         }
4648         if (have_altq) {
4649                 i = F_LEN(have_altq);
4650                 CHECK_RBUFLEN(i);
4651                 bcopy(have_altq, dst, i * sizeof(uint32_t));
4652                 dst += i;
4653         }
4654         if (have_tag) {
4655                 i = F_LEN(have_tag);
4656                 CHECK_RBUFLEN(i);
4657                 bcopy(have_tag, dst, i * sizeof(uint32_t));
4658                 dst += i;
4659         }
4660
4661         /*
4662          * copy all other actions
4663          */
4664         for (src = (ipfw_insn *)actbuf; src != action; src += i) {
4665                 i = F_LEN(src);
4666                 CHECK_RBUFLEN(i);
4667                 bcopy(src, dst, i * sizeof(uint32_t));
4668                 dst += i;
4669         }
4670
4671         rule->cmd_len = (uint32_t *)dst - (uint32_t *)(rule->cmd);
4672         *rbufsize = (char *)dst - (char *)rule;
4673 }
4674
4675 static int
4676 compare_ntlv(const void *_a, const void *_b)
4677 {
4678         ipfw_obj_ntlv *a, *b;
4679
4680         a = (ipfw_obj_ntlv *)_a;
4681         b = (ipfw_obj_ntlv *)_b;
4682
4683         if (a->set < b->set)
4684                 return (-1);
4685         else if (a->set > b->set)
4686                 return (1);
4687
4688         if (a->idx < b->idx)
4689                 return (-1);
4690         else if (a->idx > b->idx)
4691                 return (1);
4692
4693         if (a->head.type < b->head.type)
4694                 return (-1);
4695         else if (a->head.type > b->head.type)
4696                 return (1);
4697
4698         return (0);
4699 }
4700
4701 /*
4702  * Provide kernel with sorted list of referenced objects
4703  */
4704 static void
4705 object_sort_ctlv(ipfw_obj_ctlv *ctlv)
4706 {
4707
4708         qsort(ctlv + 1, ctlv->count, ctlv->objsize, compare_ntlv);
4709 }
4710
4711 struct object_kt {
4712         uint16_t        uidx;
4713         uint16_t        type;
4714 };
4715 static int
4716 compare_object_kntlv(const void *k, const void *v)
4717 {
4718         ipfw_obj_ntlv *ntlv;
4719         struct object_kt key;
4720
4721         key = *((struct object_kt *)k);
4722         ntlv = (ipfw_obj_ntlv *)v;
4723
4724         if (key.uidx < ntlv->idx)
4725                 return (-1);
4726         else if (key.uidx > ntlv->idx)
4727                 return (1);
4728
4729         if (key.type < ntlv->head.type)
4730                 return (-1);
4731         else if (key.type > ntlv->head.type)
4732                 return (1);
4733
4734         return (0);
4735 }
4736
4737 /*
4738  * Finds object name in @ctlv by @idx and @type.
4739  * Uses the following facts:
4740  * 1) All TLVs are the same size
4741  * 2) Kernel implementation provides already sorted list.
4742  *
4743  * Returns table name or NULL.
4744  */
4745 static char *
4746 object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx, uint16_t type)
4747 {
4748         ipfw_obj_ntlv *ntlv;
4749         struct object_kt key;
4750
4751         key.uidx = idx;
4752         key.type = type;
4753
4754         ntlv = bsearch(&key, (ctlv + 1), ctlv->count, ctlv->objsize,
4755             compare_object_kntlv);
4756
4757         if (ntlv != 0)
4758                 return (ntlv->name);
4759
4760         return (NULL);
4761 }
4762
4763 static char *
4764 table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx)
4765 {
4766
4767         return (object_search_ctlv(ctlv, idx, IPFW_TLV_TBL_NAME));
4768 }
4769
4770 /*
4771  * Adds one or more rules to ipfw chain.
4772  * Data layout:
4773  * Request:
4774  * [
4775  *   ip_fw3_opheader
4776  *   [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional *1)
4777  *   [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) [ ip_fw_rule ip_fw_insn ] x N ] (*2) (*3)
4778  * ]
4779  * Reply:
4780  * [
4781  *   ip_fw3_opheader
4782  *   [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional)
4783  *   [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) [ ip_fw_rule ip_fw_insn ] x N ]
4784  * ]
4785  *
4786  * Rules in reply are modified to store their actual ruleset number.
4787  *
4788  * (*1) TLVs inside IPFW_TLV_TBL_LIST needs to be sorted ascending
4789  * accoring to their idx field and there has to be no duplicates.
4790  * (*2) Numbered rules inside IPFW_TLV_RULE_LIST needs to be sorted ascending.
4791  * (*3) Each ip_fw structure needs to be aligned to u64 boundary.
4792  */
4793 void
4794 ipfw_add(char *av[])
4795 {
4796         uint32_t rulebuf[1024];
4797         int rbufsize, default_off, tlen, rlen;
4798         size_t sz;
4799         struct tidx ts;
4800         struct ip_fw_rule *rule;
4801         caddr_t tbuf;
4802         ip_fw3_opheader *op3;
4803         ipfw_obj_ctlv *ctlv, *tstate;
4804
4805         rbufsize = sizeof(rulebuf);
4806         memset(rulebuf, 0, rbufsize);
4807         memset(&ts, 0, sizeof(ts));
4808
4809         /* Optimize case with no tables */
4810         default_off = sizeof(ipfw_obj_ctlv) + sizeof(ip_fw3_opheader);
4811         op3 = (ip_fw3_opheader *)rulebuf;
4812         ctlv = (ipfw_obj_ctlv *)(op3 + 1);
4813         rule = (struct ip_fw_rule *)(ctlv + 1);
4814         rbufsize -= default_off;
4815
4816         compile_rule(av, (uint32_t *)rule, &rbufsize, &ts);
4817         /* Align rule size to u64 boundary */
4818         rlen = roundup2(rbufsize, sizeof(uint64_t));
4819
4820         tbuf = NULL;
4821         sz = 0;
4822         tstate = NULL;
4823         if (ts.count != 0) {
4824                 /* Some tables. We have to alloc more data */
4825                 tlen = ts.count * sizeof(ipfw_obj_ntlv);
4826                 sz = default_off + sizeof(ipfw_obj_ctlv) + tlen + rlen;
4827
4828                 if ((tbuf = calloc(1, sz)) == NULL)
4829                         err(EX_UNAVAILABLE, "malloc() failed for IP_FW_ADD");
4830                 op3 = (ip_fw3_opheader *)tbuf;
4831                 /* Tables first */
4832                 ctlv = (ipfw_obj_ctlv *)(op3 + 1);
4833                 ctlv->head.type = IPFW_TLV_TBLNAME_LIST;
4834                 ctlv->head.length = sizeof(ipfw_obj_ctlv) + tlen;
4835                 ctlv->count = ts.count;
4836                 ctlv->objsize = sizeof(ipfw_obj_ntlv);
4837                 memcpy(ctlv + 1, ts.idx, tlen);
4838                 object_sort_ctlv(ctlv);
4839                 tstate = ctlv;
4840                 /* Rule next */
4841                 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
4842                 ctlv->head.type = IPFW_TLV_RULE_LIST;
4843                 ctlv->head.length = sizeof(ipfw_obj_ctlv) + rlen;
4844                 ctlv->count = 1;
4845                 memcpy(ctlv + 1, rule, rbufsize);
4846         } else {
4847                 /* Simply add header */
4848                 sz = rlen + default_off;
4849                 memset(ctlv, 0, sizeof(*ctlv));
4850                 ctlv->head.type = IPFW_TLV_RULE_LIST;
4851                 ctlv->head.length = sizeof(ipfw_obj_ctlv) + rlen;
4852                 ctlv->count = 1;
4853         }
4854
4855         if (do_get3(IP_FW_XADD, op3, &sz) != 0)
4856                 err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_XADD");
4857
4858         if (!co.do_quiet) {
4859                 struct format_opts sfo;
4860                 struct buf_pr bp;
4861                 memset(&sfo, 0, sizeof(sfo));
4862                 sfo.tstate = tstate;
4863                 sfo.set_mask = (uint32_t)(-1);
4864                 bp_alloc(&bp, 4096);
4865                 show_static_rule(&co, &sfo, &bp, rule, NULL);
4866                 printf("%s", bp.buf);
4867                 bp_free(&bp);
4868         }
4869
4870         if (tbuf != NULL)
4871                 free(tbuf);
4872
4873         if (ts.idx != NULL)
4874                 free(ts.idx);
4875 }
4876
4877 /*
4878  * clear the counters or the log counters.
4879  * optname has the following values:
4880  *  0 (zero both counters and logging)
4881  *  1 (zero logging only)
4882  */
4883 void
4884 ipfw_zero(int ac, char *av[], int optname)
4885 {
4886         ipfw_range_tlv rt;
4887         uint32_t arg;
4888         int failed = EX_OK;
4889         char const *errstr;
4890         char const *name = optname ? "RESETLOG" : "ZERO";
4891
4892         optname = optname ? IP_FW_XRESETLOG : IP_FW_XZERO;
4893         memset(&rt, 0, sizeof(rt));
4894
4895         av++; ac--;
4896
4897         if (ac == 0) {
4898                 /* clear all entries */
4899                 rt.flags = IPFW_RCFLAG_ALL;
4900                 if (do_range_cmd(optname, &rt) < 0)
4901                         err(EX_UNAVAILABLE, "setsockopt(IP_FW_X%s)", name);
4902                 if (!co.do_quiet)
4903                         printf("%s.\n", optname == IP_FW_XZERO ?
4904                             "Accounting cleared":"Logging counts reset");
4905
4906                 return;
4907         }
4908
4909         while (ac) {
4910                 /* Rule number */
4911                 if (isdigit(**av)) {
4912                         arg = strtonum(*av, 0, 0xffff, &errstr);
4913                         if (errstr)
4914                                 errx(EX_DATAERR,
4915                                     "invalid rule number %s\n", *av);
4916                         rt.start_rule = arg;
4917                         rt.end_rule = arg;
4918                         rt.flags |= IPFW_RCFLAG_RANGE;
4919                         if (co.use_set != 0) {
4920                                 rt.set = co.use_set - 1;
4921                                 rt.flags |= IPFW_RCFLAG_SET;
4922                         }
4923                         if (do_range_cmd(optname, &rt) != 0) {
4924                                 warn("rule %u: setsockopt(IP_FW_X%s)",
4925                                     arg, name);
4926                                 failed = EX_UNAVAILABLE;
4927                         } else if (rt.new_set == 0) {
4928                                 printf("Entry %d not found\n", arg);
4929                                 failed = EX_UNAVAILABLE;
4930                         } else if (!co.do_quiet)
4931                                 printf("Entry %d %s.\n", arg,
4932                                     optname == IP_FW_XZERO ?
4933                                         "cleared" : "logging count reset");
4934                 } else {
4935                         errx(EX_USAGE, "invalid rule number ``%s''", *av);
4936                 }
4937                 av++; ac--;
4938         }
4939         if (failed != EX_OK)
4940                 exit(failed);
4941 }
4942
4943 void
4944 ipfw_flush(int force)
4945 {
4946         ipfw_range_tlv rt;
4947
4948         if (!force && !co.do_quiet) { /* need to ask user */
4949                 int c;
4950
4951                 printf("Are you sure? [yn] ");
4952                 fflush(stdout);
4953                 do {
4954                         c = toupper(getc(stdin));
4955                         while (c != '\n' && getc(stdin) != '\n')
4956                                 if (feof(stdin))
4957                                         return; /* and do not flush */
4958                 } while (c != 'Y' && c != 'N');
4959                 printf("\n");
4960                 if (c == 'N')   /* user said no */
4961                         return;
4962         }
4963         if (co.do_pipe) {
4964                 dummynet_flush();
4965                 return;
4966         }
4967         /* `ipfw set N flush` - is the same that `ipfw delete set N` */
4968         memset(&rt, 0, sizeof(rt));
4969         if (co.use_set != 0) {
4970                 rt.set = co.use_set - 1;
4971                 rt.flags = IPFW_RCFLAG_SET;
4972         } else
4973                 rt.flags = IPFW_RCFLAG_ALL;
4974         if (do_range_cmd(IP_FW_XDEL, &rt) != 0)
4975                         err(EX_UNAVAILABLE, "setsockopt(IP_FW_XDEL)");
4976         if (!co.do_quiet)
4977                 printf("Flushed all %s.\n", co.do_pipe ? "pipes" : "rules");
4978 }
4979
4980 static struct _s_x intcmds[] = {
4981       { "talist",       TOK_TALIST },
4982       { "iflist",       TOK_IFLIST },
4983       { "vlist",        TOK_VLIST },
4984       { NULL, 0 }
4985 };
4986
4987 void
4988 ipfw_internal_handler(int ac, char *av[])
4989 {
4990         int tcmd;
4991
4992         ac--; av++;
4993         NEED1("internal cmd required");
4994
4995         if ((tcmd = match_token(intcmds, *av)) == -1)
4996                 errx(EX_USAGE, "invalid internal sub-cmd: %s", *av);
4997
4998         switch (tcmd) {
4999         case TOK_IFLIST:
5000                 ipfw_list_tifaces();
5001                 break;
5002         case TOK_TALIST:
5003                 ipfw_list_ta(ac, av);
5004                 break;
5005         case TOK_VLIST:
5006                 ipfw_list_values(ac, av);
5007                 break;
5008         }
5009 }
5010
5011 static int
5012 ipfw_get_tracked_ifaces(ipfw_obj_lheader **polh)
5013 {
5014         ipfw_obj_lheader req, *olh;
5015         size_t sz;
5016
5017         memset(&req, 0, sizeof(req));
5018         sz = sizeof(req);
5019
5020         if (do_get3(IP_FW_XIFLIST, &req.opheader, &sz) != 0) {
5021                 if (errno != ENOMEM)
5022                         return (errno);
5023         }
5024
5025         sz = req.size;
5026         if ((olh = calloc(1, sz)) == NULL)
5027                 return (ENOMEM);
5028
5029         olh->size = sz;
5030         if (do_get3(IP_FW_XIFLIST, &olh->opheader, &sz) != 0) {
5031                 free(olh);
5032                 return (errno);
5033         }
5034
5035         *polh = olh;
5036         return (0);
5037 }
5038
5039 static int
5040 ifinfo_cmp(const void *a, const void *b)
5041 {
5042         ipfw_iface_info *ia, *ib;
5043
5044         ia = (ipfw_iface_info *)a;
5045         ib = (ipfw_iface_info *)b;
5046
5047         return (stringnum_cmp(ia->ifname, ib->ifname));
5048 }
5049
5050 /*
5051  * Retrieves table list from kernel,
5052  * optionally sorts it and calls requested function for each table.
5053  * Returns 0 on success.
5054  */
5055 static void
5056 ipfw_list_tifaces()
5057 {
5058         ipfw_obj_lheader *olh;
5059         ipfw_iface_info *info;
5060         int i, error;
5061
5062         if ((error = ipfw_get_tracked_ifaces(&olh)) != 0)
5063                 err(EX_OSERR, "Unable to request ipfw tracked interface list");
5064
5065
5066         qsort(olh + 1, olh->count, olh->objsize, ifinfo_cmp);
5067
5068         info = (ipfw_iface_info *)(olh + 1);
5069         for (i = 0; i < olh->count; i++) {
5070                 if (info->flags & IPFW_IFFLAG_RESOLVED)
5071                         printf("%s ifindex: %d refcount: %u changes: %u\n",
5072                             info->ifname, info->ifindex, info->refcnt,
5073                             info->gencnt);
5074                 else
5075                         printf("%s ifindex: unresolved refcount: %u changes: %u\n",
5076                             info->ifname, info->refcnt, info->gencnt);
5077                 info = (ipfw_iface_info *)((caddr_t)info + olh->objsize);
5078         }
5079
5080         free(olh);
5081 }
5082
5083
5084
5085