2 * Copyright (c) 2002-2003 Luigi Rizzo
3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
4 * Copyright (c) 1994 Ugen J.S.Antsilevich
6 * Idea and grammar partially left from:
7 * Copyright (c) 1993 Daniel Boulet
9 * Redistribution and use in source forms, with and without modification,
10 * are permitted provided that this entire comment appears intact.
12 * Redistribution in binary form may occur without any restrictions.
13 * Obviously, it would be nice if you gave credit where credit is due
14 * but requiring it would be too onerous.
16 * This software is provided ``AS IS'' without any warranties of any kind.
18 * NEW command line interface for IP firewall facility
24 * Options that can be set on the command line.
25 * When reading commands from a file, a subset of the options can also
26 * be applied globally by specifying them before the file name.
27 * After that, each line can contain its own option that changes
29 * XXX The context is not restored after each line.
33 /* boolean options: */
34 int do_value_as_ip; /* show table value as IP */
35 int do_resolv; /* try to resolve all ip to names */
36 int do_time; /* Show time stamps */
37 int do_quiet; /* Be quiet in add and flush */
38 int do_pipe; /* this cmd refers to a pipe/queue/sched */
39 int do_nat; /* this cmd refers to a nat config */
40 int do_compact; /* show rules in compact mode */
41 int do_force; /* do not ask for confirmation */
42 int show_sets; /* display the set each rule belongs to */
43 int test_only; /* only check syntax */
44 int comment_only; /* only print action and comment */
45 int verbose; /* be verbose on some commands */
47 /* The options below can have multiple values. */
49 int do_dynamic; /* 1 - display dynamic rules */
50 /* 2 - display/delete only dynamic rules */
51 int do_sort; /* field to sort results (0 = no) */
52 /* valid fields are 1 and above */
54 uint32_t use_set; /* work with specified set number */
55 /* 0 means all sets, otherwise apply to set use_set - 1 */
65 extern struct cmdline_opts g_co;
68 * _s_x is a structure that stores a string <-> token pairs, used in
69 * various places in the parser. Entries are stored in arrays,
70 * with an entry with s=NULL as terminator.
71 * The search routines are match_token() and match_value().
72 * Often, an element with x=0 contains an error string.
80 extern struct _s_x f_ipdscp[];
133 TOK_DIVERTEDLOOPBACK,
210 /* dummynet tokens */
299 /* NAT64 CLAT tokens */
317 * the following macro returns an error message if we run out of
320 #define NEED(_p, msg) {if (!_p) errx(EX_USAGE, msg);}
321 #define NEED1(msg) {if (!(*av)) errx(EX_USAGE, msg);}
324 char *buf; /* allocated buffer */
325 char *ptr; /* current pointer */
326 size_t size; /* total buffer size */
327 size_t avail; /* available storage */
328 size_t needed; /* length needed */
331 int pr_u64(struct buf_pr *bp, void *pd, int width);
332 int bp_alloc(struct buf_pr *b, size_t size);
333 void bp_free(struct buf_pr *b);
334 int bprintf(struct buf_pr *b, const char *format, ...);
337 /* memory allocation support */
338 void *safe_calloc(size_t number, size_t size);
339 void *safe_realloc(void *ptr, size_t size);
341 /* string comparison functions used for historical compatibility */
342 int _substrcmp(const char *str1, const char* str2);
343 int _substrcmp2(const char *str1, const char* str2, const char* str3);
344 int stringnum_cmp(const char *a, const char *b);
346 /* utility functions */
347 int match_token(struct _s_x *table, const char *string);
348 int match_token_relaxed(struct _s_x *table, const char *string);
349 int get_token(struct _s_x *table, const char *string, const char *errbase);
350 char const *match_value(struct _s_x *p, int value);
351 size_t concat_tokens(char *buf, size_t bufsize, struct _s_x *table,
352 const char *delimiter);
353 int fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set,
355 void print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set);
357 struct _ip_fw3_opheader;
358 int do_cmd(int optname, void *optval, uintptr_t optlen);
359 int do_set3(int optname, struct _ip_fw3_opheader *op3, size_t optlen);
360 int do_get3(int optname, struct _ip_fw3_opheader *op3, size_t *optlen);
363 void n2mask(struct in6_addr *mask, int n);
364 int contigmask(const uint8_t *p, int len);
367 * Forward declarations to avoid include way too many headers.
368 * C does not allow duplicated typedefs, so we use the base struct
369 * that the typedef points to.
370 * Should the typedefs use a different type, the compiler will
371 * still detect the change when compiling the body of the
372 * functions involved, so we do not lose error checking.
375 struct _ipfw_insn_altq;
376 struct _ipfw_insn_u32;
377 struct _ipfw_insn_ip6;
378 struct _ipfw_insn_icmp6;
381 * The reserved set numer. This is a constant in ip_fw.h
382 * but we store it in a variable so other files do not depend
383 * in that header just for one constant.
385 extern int resvd_set_number;
387 /* first-level command handlers */
388 void ipfw_add(char *av[]);
389 void ipfw_show_nat(int ac, char **av);
390 int ipfw_delete_nat(int i);
391 void ipfw_config_pipe(int ac, char **av);
392 void ipfw_config_nat(int ac, char **av);
393 void ipfw_sets_handler(char *av[]);
394 void ipfw_table_handler(int ac, char *av[]);
395 void ipfw_sysctl_handler(char *av[], int which);
396 void ipfw_delete(char *av[]);
397 void ipfw_flush(int force);
398 void ipfw_zero(int ac, char *av[], int optname);
399 void ipfw_list(int ac, char *av[], int show_counters);
400 void ipfw_internal_handler(int ac, char *av[]);
401 void ipfw_nat64clat_handler(int ac, char *av[]);
402 void ipfw_nat64lsn_handler(int ac, char *av[]);
403 void ipfw_nat64stl_handler(int ac, char *av[]);
404 void ipfw_nptv6_handler(int ac, char *av[]);
405 int ipfw_check_object_name(const char *name);
406 int ipfw_check_nat64prefix(const struct in6_addr *prefix, int length);
410 void altq_set_enabled(int enabled);
411 u_int32_t altq_name_to_qid(const char *name);
412 void print_altq_cmd(struct buf_pr *bp, const struct _ipfw_insn_altq *altqptr);
418 void dummynet_list(int ac, char *av[], int show_counters);
419 void dummynet_flush(void);
420 int ipfw_delete_pipe(int pipe_or_queue, int n);
423 void print_unreach6_code(struct buf_pr *bp, uint16_t code);
424 void print_ip6(struct buf_pr *bp, const struct _ipfw_insn_ip6 *cmd);
425 void print_flow6id(struct buf_pr *bp, const struct _ipfw_insn_u32 *cmd);
426 void print_icmp6types(struct buf_pr *bp, const struct _ipfw_insn_u32 *cmd);
427 void print_ext6hdr(struct buf_pr *bp, const struct _ipfw_insn *cmd);
430 struct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av, int cblen,
431 struct tidx *tstate);
432 struct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av, int cblen,
433 struct tidx *tstate);
435 void fill_flow6(struct _ipfw_insn_u32 *cmd, char *av, int cblen);
436 void fill_unreach6_code(u_short *codep, char *str);
437 void fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av, int cblen);
438 int fill_ext6hdr(struct _ipfw_insn *cmd, char *av);
441 void bp_flush(struct buf_pr *b);
442 void fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode,
443 struct tidx *tstate);
446 struct _ipfw_obj_ctlv;
447 struct _ipfw_obj_ntlv;
448 int table_check_name(const char *tablename);
449 void ipfw_list_ta(int ac, char *av[]);
450 void ipfw_list_values(int ac, char *av[]);
451 void table_fill_ntlv(struct _ipfw_obj_ntlv *ntlv, const char *name,
452 uint8_t set, uint16_t uidx);