sbin/ipfw/tables.c

   1 /*
   2  * Copyright (c) 2014 Yandex LLC
   3  * Copyright (c) 2014 Alexander V. Chernikov
   4  *
   5  * Redistribution and use in source forms, with and without modification,
   6  * are permitted provided that this entire comment appears intact.
   7  *
   8  * Redistribution in binary form may occur without any restrictions.
   9  * Obviously, it would be nice if you gave credit where credit is due
  10  * but requiring it would be too onerous.
  11  *
  12  * This software is provided ``AS IS'' without any warranties of any kind.
  13  *
  14  * in-kernel ipfw tables support.
  15  *
  16  * $FreeBSD$
  17  */
  18
  19
  20 #include <sys/types.h>
  21 #include <sys/param.h>
  22 #include <sys/socket.h>
  23 #include <sys/sysctl.h>
  24
  25 #include <ctype.h>
  26 #include <err.h>
  27 #include <errno.h>
  28 #include <netdb.h>
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <sysexits.h>
  33
  34 #include <net/ethernet.h>
  35 #include <net/if.h>
  36 #include <netinet/in.h>
  37 #include <netinet/ip_fw.h>
  38 #include <arpa/inet.h>
  39 #include <netdb.h>
  40
  41 #include "ipfw2.h"
  42
  43 static void table_modify_record(ipfw_obj_header *oh, int ac, char *av[],
  44     int add, int quiet, int update, int atomic);
  45 static int table_flush(ipfw_obj_header *oh);
  46 static int table_destroy(ipfw_obj_header *oh);
  47 static int table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i);
  48 static int table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i);
  49 static int table_do_swap(ipfw_obj_header *oh, char *second);
  50 static void table_create(ipfw_obj_header *oh, int ac, char *av[]);
  51 static void table_modify(ipfw_obj_header *oh, int ac, char *av[]);
  52 static void table_lookup(ipfw_obj_header *oh, int ac, char *av[]);
  53 static void table_lock(ipfw_obj_header *oh, int lock);
  54 static int table_swap(ipfw_obj_header *oh, char *second);
  55 static int table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i);
  56 static int table_show_info(ipfw_xtable_info *i, void *arg);
  57
  58 static int table_destroy_one(ipfw_xtable_info *i, void *arg);
  59 static int table_flush_one(ipfw_xtable_info *i, void *arg);
  60 static int table_show_one(ipfw_xtable_info *i, void *arg);
  61 static int table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh);
  62 static void table_show_list(ipfw_obj_header *oh, int need_header);
  63 static void table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent);
  64
  65 static void tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent,
  66     char *key, int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi);
  67 static void tentry_fill_value(ipfw_obj_header *oh, ipfw_obj_tentry *tent,
  68     char *arg, uint8_t type, uint32_t vmask);
  69 static void table_show_value(char *buf, size_t bufsize, ipfw_table_value *v,
  70     uint32_t vmask, int print_ip);
  71
  72 typedef int (table_cb_t)(ipfw_xtable_info *i, void *arg);
  73 static int tables_foreach(table_cb_t *f, void *arg, int sort);
  74
  75 #ifndef s6_addr32
  76 #define s6_addr32 __u6_addr.__u6_addr32
  77 #endif
  78
  79 static struct _s_x tabletypes[] = {
  80       { "addr",         IPFW_TABLE_ADDR },
  81       { "mac",          IPFW_TABLE_MAC },
  82       { "iface",        IPFW_TABLE_INTERFACE },
  83       { "number",       IPFW_TABLE_NUMBER },
  84       { "flow",         IPFW_TABLE_FLOW },
  85       { NULL, 0 }
  86 };
  87
  88 /* Default algorithms for various table types */
  89 static struct _s_x tablealgos[] = {
  90       { "addr:radix",   IPFW_TABLE_ADDR },
  91       { "flow:hash",    IPFW_TABLE_FLOW },
  92       { "iface:array",  IPFW_TABLE_INTERFACE },
  93       { "number:array", IPFW_TABLE_NUMBER },
  94       { NULL, 0 }
  95 };
  96
  97 static struct _s_x tablevaltypes[] = {
  98       { "skipto",       IPFW_VTYPE_SKIPTO },
  99       { "pipe",         IPFW_VTYPE_PIPE },
 100       { "fib",          IPFW_VTYPE_FIB },
 101       { "nat",          IPFW_VTYPE_NAT },
 102       { "dscp",         IPFW_VTYPE_DSCP },
 103       { "tag",          IPFW_VTYPE_TAG },
 104       { "divert",       IPFW_VTYPE_DIVERT },
 105       { "netgraph",     IPFW_VTYPE_NETGRAPH },
 106       { "limit",        IPFW_VTYPE_LIMIT },
 107       { "ipv4",         IPFW_VTYPE_NH4 },
 108       { "ipv6",         IPFW_VTYPE_NH6 },
 109       { "mark",         IPFW_VTYPE_MARK },
 110       { NULL, 0 }
 111 };
 112
 113 static struct _s_x tablecmds[] = {
 114       { "add",          TOK_ADD },
 115       { "delete",       TOK_DEL },
 116       { "create",       TOK_CREATE },
 117       { "destroy",      TOK_DESTROY },
 118       { "flush",        TOK_FLUSH },
 119       { "modify",       TOK_MODIFY },
 120       { "swap",         TOK_SWAP },
 121       { "info",         TOK_INFO },
 122       { "detail",       TOK_DETAIL },
 123       { "list",         TOK_LIST },
 124       { "lookup",       TOK_LOOKUP },
 125       { "atomic",       TOK_ATOMIC },
 126       { "lock",         TOK_LOCK },
 127       { "unlock",       TOK_UNLOCK },
 128       { NULL, 0 }
 129 };
 130
 131 static int
 132 lookup_host (char *host, struct in_addr *ipaddr)
 133 {
 134         struct hostent *he;
 135
 136         if (!inet_aton(host, ipaddr)) {
 137                 if ((he = gethostbyname(host)) == NULL)
 138                         return(-1);
 139                 *ipaddr = *(struct in_addr *)he->h_addr_list[0];
 140         }
 141         return(0);
 142 }
 143
 144 /*
 145  * This one handles all table-related commands
 146  *      ipfw table NAME create ...
 147  *      ipfw table NAME modify ...
 148  *      ipfw table {NAME | all} destroy
 149  *      ipfw table NAME swap NAME
 150  *      ipfw table NAME lock
 151  *      ipfw table NAME unlock
 152  *      ipfw table NAME add addr[/masklen] [value]
 153  *      ipfw table NAME add [addr[/masklen] value] [addr[/masklen] value] ..
 154  *      ipfw table NAME delete addr[/masklen] [addr[/masklen]] ..
 155  *      ipfw table NAME lookup addr
 156  *      ipfw table {NAME | all} flush
 157  *      ipfw table {NAME | all} list
 158  *      ipfw table {NAME | all} info
 159  *      ipfw table {NAME | all} detail
 160  */
 161 void
 162 ipfw_table_handler(int ac, char *av[])
 163 {
 164         int do_add, is_all;
 165         int atomic, error, tcmd;
 166         ipfw_xtable_info i;
 167         ipfw_obj_header oh;
 168         char *tablename;
 169         uint8_t set;
 170         void *arg;
 171
 172         memset(&oh, 0, sizeof(oh));
 173         is_all = 0;
 174         if (g_co.use_set != 0)
 175                 set = g_co.use_set - 1;
 176         else
 177                 set = 0;
 178
 179         ac--; av++;
 180         NEED1("table needs name");
 181         tablename = *av;
 182
 183         if (table_check_name(tablename) == 0) {
 184                 table_fill_ntlv(&oh.ntlv, *av, set, 1);
 185                 oh.idx = 1;
 186         } else {
 187                 if (strcmp(tablename, "all") == 0)
 188                         is_all = 1;
 189                 else
 190                         errx(EX_USAGE, "table name %s is invalid", tablename);
 191         }
 192         ac--; av++;
 193         NEED1("table needs command");
 194
 195         tcmd = get_token(tablecmds, *av, "table command");
 196         /* Check if atomic operation was requested */
 197         atomic = 0;
 198         if (tcmd == TOK_ATOMIC) {
 199                 ac--; av++;
 200                 NEED1("atomic needs command");
 201                 tcmd = get_token(tablecmds, *av, "table command");
 202                 switch (tcmd) {
 203                 case TOK_ADD:
 204                         break;
 205                 default:
 206                         errx(EX_USAGE, "atomic is not compatible with %s", *av);
 207                 }
 208                 atomic = 1;
 209         }
 210
 211         switch (tcmd) {
 212         case TOK_LIST:
 213         case TOK_INFO:
 214         case TOK_DETAIL:
 215         case TOK_FLUSH:
 216         case TOK_DESTROY:
 217                 break;
 218         default:
 219                 if (is_all != 0)
 220                         errx(EX_USAGE, "table name required");
 221         }
 222
 223         switch (tcmd) {
 224         case TOK_ADD:
 225         case TOK_DEL:
 226                 do_add = **av == 'a';
 227                 ac--; av++;
 228                 table_modify_record(&oh, ac, av, do_add, g_co.do_quiet,
 229                     g_co.do_quiet, atomic);
 230                 break;
 231         case TOK_CREATE:
 232                 ac--; av++;
 233                 table_create(&oh, ac, av);
 234                 break;
 235         case TOK_MODIFY:
 236                 ac--; av++;
 237                 table_modify(&oh, ac, av);
 238                 break;
 239         case TOK_DESTROY:
 240                 if (is_all == 0) {
 241                         if (table_destroy(&oh) == 0)
 242                                 break;
 243                         if (errno != ESRCH)
 244                                 err(EX_OSERR, "failed to destroy table %s",
 245                                     tablename);
 246                         /* ESRCH isn't fatal, warn if not quiet mode */
 247                         if (g_co.do_quiet == 0)
 248                                 warn("failed to destroy table %s", tablename);
 249                 } else {
 250                         error = tables_foreach(table_destroy_one, &oh, 1);
 251                         if (error != 0)
 252                                 err(EX_OSERR,
 253                                     "failed to destroy tables list");
 254                 }
 255                 break;
 256         case TOK_FLUSH:
 257                 if (is_all == 0) {
 258                         if ((error = table_flush(&oh)) == 0)
 259                                 break;
 260                         if (errno != ESRCH)
 261                                 err(EX_OSERR, "failed to flush table %s info",
 262                                     tablename);
 263                         /* ESRCH isn't fatal, warn if not quiet mode */
 264                         if (g_co.do_quiet == 0)
 265                                 warn("failed to flush table %s info",
 266                                     tablename);
 267                 } else {
 268                         error = tables_foreach(table_flush_one, &oh, 1);
 269                         if (error != 0)
 270                                 err(EX_OSERR, "failed to flush tables list");
 271                         /* XXX: we ignore errors here */
 272                 }
 273                 break;
 274         case TOK_SWAP:
 275                 ac--; av++;
 276                 NEED1("second table name required");
 277                 table_swap(&oh, *av);
 278                 break;
 279         case TOK_LOCK:
 280         case TOK_UNLOCK:
 281                 table_lock(&oh, (tcmd == TOK_LOCK));
 282                 break;
 283         case TOK_DETAIL:
 284         case TOK_INFO:
 285                 arg = (tcmd == TOK_DETAIL) ? (void *)1 : NULL;
 286                 if (is_all == 0) {
 287                         if ((error = table_get_info(&oh, &i)) != 0)
 288                                 err(EX_OSERR, "failed to request table info");
 289                         table_show_info(&i, arg);
 290                 } else {
 291                         error = tables_foreach(table_show_info, arg, 1);
 292                         if (error != 0)
 293                                 err(EX_OSERR, "failed to request tables list");
 294                 }
 295                 break;
 296         case TOK_LIST:
 297                 arg = is_all ? (void*)1 : NULL;
 298                 if (is_all == 0) {
 299                         if ((error = table_get_info(&oh, &i)) != 0)
 300                                 err(EX_OSERR, "failed to request table info");
 301                         table_show_one(&i, arg);
 302                 } else {
 303                         error = tables_foreach(table_show_one, arg, 1);
 304                         if (error != 0)
 305                                 err(EX_OSERR, "failed to request tables list");
 306                 }
 307                 break;
 308         case TOK_LOOKUP:
 309                 ac--; av++;
 310                 table_lookup(&oh, ac, av);
 311                 break;
 312         }
 313 }
 314
 315 void
 316 table_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set,
 317     uint16_t uidx)
 318 {
 319
 320         ntlv->head.type = IPFW_TLV_TBL_NAME;
 321         ntlv->head.length = sizeof(ipfw_obj_ntlv);
 322         ntlv->idx = uidx;
 323         ntlv->set = set;
 324         strlcpy(ntlv->name, name, sizeof(ntlv->name));
 325 }
 326
 327 static void
 328 table_fill_objheader(ipfw_obj_header *oh, ipfw_xtable_info *i)
 329 {
 330
 331         oh->idx = 1;
 332         table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1);
 333 }
 334
 335 static struct _s_x tablenewcmds[] = {
 336       { "type",         TOK_TYPE },
 337       { "valtype",      TOK_VALTYPE },
 338       { "algo",         TOK_ALGO },
 339       { "limit",        TOK_LIMIT },
 340       { "locked",       TOK_LOCK },
 341       { "missing",      TOK_MISSING },
 342       { "or-flush",     TOK_ORFLUSH },
 343       { NULL, 0 }
 344 };
 345
 346 static struct _s_x flowtypecmds[] = {
 347       { "src-ip",       IPFW_TFFLAG_SRCIP },
 348       { "proto",        IPFW_TFFLAG_PROTO },
 349       { "src-port",     IPFW_TFFLAG_SRCPORT },
 350       { "dst-ip",       IPFW_TFFLAG_DSTIP },
 351       { "dst-port",     IPFW_TFFLAG_DSTPORT },
 352       { NULL, 0 }
 353 };
 354
 355 static int
 356 table_parse_type(uint8_t ttype, char *p, uint8_t *tflags)
 357 {
 358         uint32_t fset, fclear;
 359         char *e;
 360
 361         /* Parse type options */
 362         switch(ttype) {
 363         case IPFW_TABLE_FLOW:
 364                 fset = fclear = 0;
 365                 if (fill_flags(flowtypecmds, p, &e, &fset, &fclear) != 0)
 366                         errx(EX_USAGE,
 367                             "unable to parse flow option %s", e);
 368                 *tflags = fset;
 369                 break;
 370         default:
 371                 return (EX_USAGE);
 372         }
 373
 374         return (0);
 375 }
 376
 377 static void
 378 table_print_type(char *tbuf, size_t size, uint8_t type, uint8_t tflags)
 379 {
 380         const char *tname;
 381         int l;
 382
 383         if ((tname = match_value(tabletypes, type)) == NULL)
 384                 tname = "unknown";
 385
 386         l = snprintf(tbuf, size, "%s", tname);
 387         tbuf += l;
 388         size -= l;
 389
 390         switch(type) {
 391         case IPFW_TABLE_FLOW:
 392                 if (tflags != 0) {
 393                         *tbuf++ = ':';
 394                         l--;
 395                         print_flags_buffer(tbuf, size, flowtypecmds, tflags);
 396                 }
 397                 break;
 398         }
 399 }
 400
 401 /*
 402  * Creates new table
 403  *
 404  * ipfw table NAME create [ type { addr | iface | number | flow } ]
 405  *     [ algo algoname ] [missing] [or-flush]
 406  */
 407 static void
 408 table_create(ipfw_obj_header *oh, int ac, char *av[])
 409 {
 410         ipfw_xtable_info xi, xie;
 411         int error, missing, orflush, tcmd, val;
 412         uint32_t fset, fclear;
 413         char *e, *p;
 414         char tbuf[128];
 415
 416         missing = orflush = 0;
 417         memset(&xi, 0, sizeof(xi));
 418         while (ac > 0) {
 419                 tcmd = get_token(tablenewcmds, *av, "option");
 420                 ac--; av++;
 421
 422                 switch (tcmd) {
 423                 case TOK_LIMIT:
 424                         NEED1("limit value required");
 425                         xi.limit = strtol(*av, NULL, 10);
 426                         ac--; av++;
 427                         break;
 428                 case TOK_TYPE:
 429                         NEED1("table type required");
 430                         /* Type may have suboptions after ':' */
 431                         if ((p = strchr(*av, ':')) != NULL)
 432                                 *p++ = '\0';
 433                         val = match_token(tabletypes, *av);
 434                         if (val == -1) {
 435                                 concat_tokens(tbuf, sizeof(tbuf), tabletypes,
 436                                     ", ");
 437                                 errx(EX_USAGE,
 438                                     "Unknown tabletype: %s. Supported: %s",
 439                                     *av, tbuf);
 440                         }
 441                         xi.type = val;
 442                         if (p != NULL) {
 443                                 error = table_parse_type(val, p, &xi.tflags);
 444                                 if (error != 0)
 445                                         errx(EX_USAGE,
 446                                             "Unsupported suboptions: %s", p);
 447                         }
 448                         ac--; av++;
 449                         break;
 450                 case TOK_VALTYPE:
 451                         NEED1("table value type required");
 452                         fset = fclear = 0;
 453                         val = fill_flags(tablevaltypes, *av, &e, &fset, &fclear);
 454                         if (val != -1) {
 455                                 xi.vmask = fset;
 456                                 ac--; av++;
 457                                 break;
 458                         }
 459                         concat_tokens(tbuf, sizeof(tbuf), tablevaltypes, ", ");
 460                         errx(EX_USAGE, "Unknown value type: %s. Supported: %s",
 461                             e, tbuf);
 462                         break;
 463                 case TOK_ALGO:
 464                         NEED1("table algorithm name required");
 465                         if (strlen(*av) > sizeof(xi.algoname))
 466                                 errx(EX_USAGE, "algorithm name too long");
 467                         strlcpy(xi.algoname, *av, sizeof(xi.algoname));
 468                         ac--; av++;
 469                         break;
 470                 case TOK_LOCK:
 471                         xi.flags |= IPFW_TGFLAGS_LOCKED;
 472                         break;
 473                 case TOK_ORFLUSH:
 474                         orflush = 1;
 475                         /* FALLTHROUGH */
 476                 case TOK_MISSING:
 477                         missing = 1;
 478                         break;
 479                 }
 480         }
 481
 482         /* Set some defaults to preserve compatibility. */
 483         if (xi.algoname[0] == '\0') {
 484                 const char *algo;
 485
 486                 if (xi.type == 0)
 487                         xi.type = IPFW_TABLE_ADDR;
 488                 algo = match_value(tablealgos, xi.type);
 489                 if (algo != NULL)
 490                         strlcpy(xi.algoname, algo, sizeof(xi.algoname));
 491         }
 492         if (xi.vmask == 0)
 493                 xi.vmask = IPFW_VTYPE_LEGACY;
 494
 495         error = table_do_create(oh, &xi);
 496
 497         if (error == 0)
 498                 return;
 499
 500         if (errno != EEXIST || missing == 0)
 501                 err(EX_OSERR, "Table creation failed");
 502
 503         /* Check that existing table is the same we are trying to create */
 504         if (table_get_info(oh, &xie) != 0)
 505                 err(EX_OSERR, "Existing table check failed");
 506
 507         if (xi.limit != xie.limit || xi.type != xie.type ||
 508             xi.tflags != xie.tflags || xi.vmask != xie.vmask || (
 509             xi.algoname[0] != '\0' && strcmp(xi.algoname,
 510             xie.algoname) != 0) || xi.flags != xie.flags)
 511                 errx(EX_DATAERR, "The existing table is not compatible "
 512                     "with one you are creating.");
 513
 514         /* Flush existing table if instructed to do so */
 515         if (orflush != 0 && table_flush(oh) != 0)
 516                 err(EX_OSERR, "Table flush on creation failed");
 517 }
 518
 519 /*
 520  * Creates new table
 521  *
 522  * Request: [ ipfw_obj_header ipfw_xtable_info ]
 523  *
 524  * Returns 0 on success.
 525  */
 526 static int
 527 table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i)
 528 {
 529         char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)];
 530         int error;
 531
 532         memcpy(tbuf, oh, sizeof(*oh));
 533         memcpy(tbuf + sizeof(*oh), i, sizeof(*i));
 534         oh = (ipfw_obj_header *)tbuf;
 535
 536         error = do_set3(IP_FW_TABLE_XCREATE, &oh->opheader, sizeof(tbuf));
 537
 538         return (error);
 539 }
 540
 541 /*
 542  * Modifies existing table
 543  *
 544  * ipfw table NAME modify [ limit number ]
 545  */
 546 static void
 547 table_modify(ipfw_obj_header *oh, int ac, char *av[])
 548 {
 549         ipfw_xtable_info xi;
 550         int tcmd;
 551
 552         memset(&xi, 0, sizeof(xi));
 553
 554         while (ac > 0) {
 555                 tcmd = get_token(tablenewcmds, *av, "option");
 556                 ac--; av++;
 557
 558                 switch (tcmd) {
 559                 case TOK_LIMIT:
 560                         NEED1("limit value required");
 561                         xi.limit = strtol(*av, NULL, 10);
 562                         xi.mflags |= IPFW_TMFLAGS_LIMIT;
 563                         ac--; av++;
 564                         break;
 565                 default:
 566                         errx(EX_USAGE, "cmd is not supported for modification");
 567                 }
 568         }
 569
 570         if (table_do_modify(oh, &xi) != 0)
 571                 err(EX_OSERR, "Table modification failed");
 572 }
 573
 574 /*
 575  * Modifies existing table.
 576  *
 577  * Request: [ ipfw_obj_header ipfw_xtable_info ]
 578  *
 579  * Returns 0 on success.
 580  */
 581 static int
 582 table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i)
 583 {
 584         char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)];
 585         int error;
 586
 587         memcpy(tbuf, oh, sizeof(*oh));
 588         memcpy(tbuf + sizeof(*oh), i, sizeof(*i));
 589         oh = (ipfw_obj_header *)tbuf;
 590
 591         error = do_set3(IP_FW_TABLE_XMODIFY, &oh->opheader, sizeof(tbuf));
 592
 593         return (error);
 594 }
 595
 596 /*
 597  * Locks or unlocks given table
 598  */
 599 static void
 600 table_lock(ipfw_obj_header *oh, int lock)
 601 {
 602         ipfw_xtable_info xi;
 603
 604         memset(&xi, 0, sizeof(xi));
 605
 606         xi.mflags |= IPFW_TMFLAGS_LOCK;
 607         xi.flags |= (lock != 0) ? IPFW_TGFLAGS_LOCKED : 0;
 608
 609         if (table_do_modify(oh, &xi) != 0)
 610                 err(EX_OSERR, "Table %s failed", lock != 0 ? "lock" : "unlock");
 611 }
 612
 613 /*
 614  * Destroys given table specified by @oh->ntlv.
 615  * Returns 0 on success.
 616  */
 617 static int
 618 table_destroy(ipfw_obj_header *oh)
 619 {
 620
 621         if (do_set3(IP_FW_TABLE_XDESTROY, &oh->opheader, sizeof(*oh)) != 0)
 622                 return (-1);
 623
 624         return (0);
 625 }
 626
 627 static int
 628 table_destroy_one(ipfw_xtable_info *i, void *arg)
 629 {
 630         ipfw_obj_header *oh;
 631
 632         oh = (ipfw_obj_header *)arg;
 633         table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1);
 634         if (table_destroy(oh) != 0) {
 635                 if (g_co.do_quiet == 0)
 636                         warn("failed to destroy table(%s) in set %u",
 637                             i->tablename, i->set);
 638                 return (-1);
 639         }
 640         return (0);
 641 }
 642
 643 /*
 644  * Flushes given table specified by @oh->ntlv.
 645  * Returns 0 on success.
 646  */
 647 static int
 648 table_flush(ipfw_obj_header *oh)
 649 {
 650
 651         if (do_set3(IP_FW_TABLE_XFLUSH, &oh->opheader, sizeof(*oh)) != 0)
 652                 return (-1);
 653
 654         return (0);
 655 }
 656
 657 static int
 658 table_do_swap(ipfw_obj_header *oh, char *second)
 659 {
 660         char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ntlv)];
 661         int error;
 662
 663         memset(tbuf, 0, sizeof(tbuf));
 664         memcpy(tbuf, oh, sizeof(*oh));
 665         oh = (ipfw_obj_header *)tbuf;
 666         table_fill_ntlv((ipfw_obj_ntlv *)(oh + 1), second, oh->ntlv.set, 1);
 667
 668         error = do_set3(IP_FW_TABLE_XSWAP, &oh->opheader, sizeof(tbuf));
 669
 670         return (error);
 671 }
 672
 673 /*
 674  * Swaps given table with @second one.
 675  */
 676 static int
 677 table_swap(ipfw_obj_header *oh, char *second)
 678 {
 679
 680         if (table_check_name(second) != 0)
 681                 errx(EX_USAGE, "table name %s is invalid", second);
 682
 683         if (table_do_swap(oh, second) == 0)
 684                 return (0);
 685
 686         switch (errno) {
 687         case EINVAL:
 688                 errx(EX_USAGE, "Unable to swap table: check types");
 689         case EFBIG:
 690                 errx(EX_USAGE, "Unable to swap table: check limits");
 691         }
 692
 693         return (0);
 694 }
 695
 696
 697 /*
 698  * Retrieves table in given table specified by @oh->ntlv.
 699  * it inside @i.
 700  * Returns 0 on success.
 701  */
 702 static int
 703 table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i)
 704 {
 705         char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)];
 706         size_t sz;
 707
 708         sz = sizeof(tbuf);
 709         memset(tbuf, 0, sizeof(tbuf));
 710         memcpy(tbuf, oh, sizeof(*oh));
 711         oh = (ipfw_obj_header *)tbuf;
 712
 713         if (do_get3(IP_FW_TABLE_XINFO, &oh->opheader, &sz) != 0)
 714                 return (errno);
 715
 716         if (sz < sizeof(tbuf))
 717                 return (EINVAL);
 718
 719         *i = *(ipfw_xtable_info *)(oh + 1);
 720
 721         return (0);
 722 }
 723
 724 static struct _s_x tablealgoclass[] = {
 725       { "hash",         IPFW_TACLASS_HASH },
 726       { "array",        IPFW_TACLASS_ARRAY },
 727       { "radix",        IPFW_TACLASS_RADIX },
 728       { NULL, 0 }
 729 };
 730
 731 struct ta_cldata {
 732         uint8_t         taclass;
 733         uint8_t         spare4;
 734         uint16_t        itemsize;
 735         uint16_t        itemsize6;
 736         uint32_t        size;
 737         uint32_t        count;
 738 };
 739
 740 /*
 741  * Print global/per-AF table @i algorithm info.
 742  */
 743 static void
 744 table_show_tainfo(ipfw_xtable_info *i __unused, struct ta_cldata *d,
 745     const char *af, const char *taclass)
 746 {
 747
 748         switch (d->taclass) {
 749         case IPFW_TACLASS_HASH:
 750         case IPFW_TACLASS_ARRAY:
 751                 printf(" %salgorithm %s info\n", af, taclass);
 752                 if (d->itemsize == d->itemsize6)
 753                         printf("  size: %u items: %u itemsize: %u\n",
 754                             d->size, d->count, d->itemsize);
 755                 else
 756                         printf("  size: %u items: %u "
 757                             "itemsize4: %u itemsize6: %u\n",
 758                             d->size, d->count,
 759                             d->itemsize, d->itemsize6);
 760                 break;
 761         case IPFW_TACLASS_RADIX:
 762                 printf(" %salgorithm %s info\n", af, taclass);
 763                 if (d->itemsize == d->itemsize6)
 764                         printf("  items: %u itemsize: %u\n",
 765                             d->count, d->itemsize);
 766                 else
 767                         printf("  items: %u "
 768                             "itemsize4: %u itemsize6: %u\n",
 769                             d->count, d->itemsize, d->itemsize6);
 770                 break;
 771         default:
 772                 printf(" algo class: %s\n", taclass);
 773         }
 774 }
 775
 776 static void
 777 table_print_valheader(char *buf, size_t bufsize, uint32_t vmask)
 778 {
 779
 780         if (vmask == IPFW_VTYPE_LEGACY) {
 781                 snprintf(buf, bufsize, "legacy");
 782                 return;
 783         }
 784
 785         memset(buf, 0, bufsize);
 786         print_flags_buffer(buf, bufsize, tablevaltypes, vmask);
 787 }
 788
 789 /*
 790  * Prints table info struct @i in human-readable form.
 791  */
 792 static int
 793 table_show_info(ipfw_xtable_info *i, void *arg)
 794 {
 795         const char *vtype;
 796         ipfw_ta_tinfo *tainfo;
 797         int afdata, afitem;
 798         struct ta_cldata d;
 799         char ttype[64], tvtype[64];
 800
 801         table_print_type(ttype, sizeof(ttype), i->type, i->tflags);
 802         table_print_valheader(tvtype, sizeof(tvtype), i->vmask);
 803
 804         printf("--- table(%s), set(%u) ---\n", i->tablename, i->set);
 805         if ((i->flags & IPFW_TGFLAGS_LOCKED) != 0)
 806                 printf(" kindex: %d, type: %s, locked\n", i->kidx, ttype);
 807         else
 808                 printf(" kindex: %d, type: %s\n", i->kidx, ttype);
 809         printf(" references: %u, valtype: %s\n", i->refcnt, tvtype);
 810         printf(" algorithm: %s\n", i->algoname);
 811         printf(" items: %u, size: %u\n", i->count, i->size);
 812         if (i->limit > 0)
 813                 printf(" limit: %u\n", i->limit);
 814
 815         /* Print algo-specific info if requested & set  */
 816         if (arg == NULL)
 817                 return (0);
 818
 819         if ((i->ta_info.flags & IPFW_TATFLAGS_DATA) == 0)
 820                 return (0);
 821         tainfo = &i->ta_info;
 822
 823         afdata = 0;
 824         afitem = 0;
 825         if (tainfo->flags & IPFW_TATFLAGS_AFDATA)
 826                 afdata = 1;
 827         if (tainfo->flags & IPFW_TATFLAGS_AFITEM)
 828                 afitem = 1;
 829
 830         memset(&d, 0, sizeof(d));
 831         d.taclass = tainfo->taclass4;
 832         d.size = tainfo->size4;
 833         d.count = tainfo->count4;
 834         d.itemsize = tainfo->itemsize4;
 835         if (afdata == 0 && afitem != 0)
 836                 d.itemsize6 = tainfo->itemsize6;
 837         else
 838                 d.itemsize6 = d.itemsize;
 839         if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL)
 840                 vtype = "unknown";
 841
 842         if (afdata == 0) {
 843                 table_show_tainfo(i, &d, "", vtype);
 844         } else {
 845                 table_show_tainfo(i, &d, "IPv4 ", vtype);
 846                 memset(&d, 0, sizeof(d));
 847                 d.taclass = tainfo->taclass6;
 848                 if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL)
 849                         vtype = "unknown";
 850                 d.size = tainfo->size6;
 851                 d.count = tainfo->count6;
 852                 d.itemsize = tainfo->itemsize6;
 853                 d.itemsize6 = d.itemsize;
 854                 table_show_tainfo(i, &d, "IPv6 ", vtype);
 855         }
 856
 857         return (0);
 858 }
 859
 860
 861 /*
 862  * Function wrappers which can be used either
 863  * as is or as foreach function parameter.
 864  */
 865
 866 static int
 867 table_show_one(ipfw_xtable_info *i, void *arg)
 868 {
 869         ipfw_obj_header *oh = NULL;
 870         int error;
 871         int is_all;
 872
 873         is_all = arg == NULL ? 0 : 1;
 874
 875         if ((error = table_do_get_list(i, &oh)) != 0) {
 876                 err(EX_OSERR, "Error requesting table %s list", i->tablename);
 877                 return (error);
 878         }
 879
 880         table_show_list(oh, is_all);
 881
 882         free(oh);
 883         return (0);
 884 }
 885
 886 static int
 887 table_flush_one(ipfw_xtable_info *i, void *arg)
 888 {
 889         ipfw_obj_header *oh;
 890
 891         oh = (ipfw_obj_header *)arg;
 892
 893         table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1);
 894
 895         return (table_flush(oh));
 896 }
 897
 898 static int
 899 table_do_modify_record(int cmd, ipfw_obj_header *oh,
 900     ipfw_obj_tentry *tent, int count, int atomic)
 901 {
 902         ipfw_obj_ctlv *ctlv;
 903         ipfw_obj_tentry *tent_base;
 904         caddr_t pbuf;
 905         char xbuf[sizeof(*oh) + sizeof(ipfw_obj_ctlv) + sizeof(*tent)];
 906         int error, i;
 907         size_t sz;
 908
 909         sz = sizeof(*ctlv) + sizeof(*tent) * count;
 910         if (count == 1) {
 911                 memset(xbuf, 0, sizeof(xbuf));
 912                 pbuf = xbuf;
 913         } else {
 914                 if ((pbuf = calloc(1, sizeof(*oh) + sz)) == NULL)
 915                         return (ENOMEM);
 916         }
 917
 918         memcpy(pbuf, oh, sizeof(*oh));
 919         oh = (ipfw_obj_header *)pbuf;
 920         oh->opheader.version = 1; /* Current version */
 921
 922         ctlv = (ipfw_obj_ctlv *)(oh + 1);
 923         ctlv->count = count;
 924         ctlv->head.length = sz;
 925         if (atomic != 0)
 926                 ctlv->flags |= IPFW_CTF_ATOMIC;
 927
 928         tent_base = tent;
 929         memcpy(ctlv + 1, tent, sizeof(*tent) * count);
 930         tent = (ipfw_obj_tentry *)(ctlv + 1);
 931         for (i = 0; i < count; i++, tent++) {
 932                 tent->head.length = sizeof(ipfw_obj_tentry);
 933                 tent->idx = oh->idx;
 934         }
 935
 936         sz += sizeof(*oh);
 937         error = do_get3(cmd, &oh->opheader, &sz);
 938         if (error != 0)
 939                 error = errno;
 940         tent = (ipfw_obj_tentry *)(ctlv + 1);
 941         /* Copy result back to provided buffer */
 942         memcpy(tent_base, ctlv + 1, sizeof(*tent) * count);
 943
 944         if (pbuf != xbuf)
 945                 free(pbuf);
 946
 947         return (error);
 948 }
 949
 950 static void
 951 table_modify_record(ipfw_obj_header *oh, int ac, char *av[], int add,
 952     int quiet, int update, int atomic)
 953 {
 954         ipfw_obj_tentry *ptent, tent, *tent_buf;
 955         ipfw_xtable_info xi;
 956         const char *etxt, *px, *texterr;
 957         uint8_t type;
 958         uint32_t vmask;
 959         int cmd, count, error, i, ignored;
 960
 961         if (ac == 0)
 962                 errx(EX_USAGE, "address required");
 963
 964         if (add != 0) {
 965                 cmd = IP_FW_TABLE_XADD;
 966                 texterr = "Adding record failed";
 967         } else {
 968                 cmd = IP_FW_TABLE_XDEL;
 969                 texterr = "Deleting record failed";
 970         }
 971
 972         /*
 973          * Calculate number of entries:
 974          * Assume [key val] x N for add
 975          * and
 976          * key x N for delete
 977          */
 978         count = (add != 0) ? ac / 2 + 1 : ac;
 979
 980         if (count <= 1) {
 981                 /* Adding single entry with/without value */
 982                 memset(&tent, 0, sizeof(tent));
 983                 tent_buf = &tent;
 984         } else {
 985
 986                 if ((tent_buf = calloc(count, sizeof(tent))) == NULL)
 987                         errx(EX_OSERR,
 988                             "Unable to allocate memory for all entries");
 989         }
 990         ptent = tent_buf;
 991
 992         memset(&xi, 0, sizeof(xi));
 993         count = 0;
 994         while (ac > 0) {
 995                 tentry_fill_key(oh, ptent, *av, add, &type, &vmask, &xi);
 996
 997                 /*
 998                  * Compatibility layer: auto-create table if not exists.
 999                  */
1000                 if (xi.tablename[0] == '\0') {
1001                         xi.type = type;
1002                         xi.vmask = vmask;
1003                         strlcpy(xi.tablename, oh->ntlv.name,
1004                             sizeof(xi.tablename));
1005                         if (quiet == 0)
1006                                 warnx("DEPRECATED: inserting data into "
1007                                     "non-existent table %s. (auto-created)",
1008                                     xi.tablename);
1009                         table_do_create(oh, &xi);
1010                 }
1011
1012                 oh->ntlv.type = type;
1013                 ac--; av++;
1014
1015                 if (add != 0 && ac > 0) {
1016                         tentry_fill_value(oh, ptent, *av, type, vmask);
1017                         ac--; av++;
1018                 }
1019
1020                 if (update != 0)
1021                         ptent->head.flags |= IPFW_TF_UPDATE;
1022
1023                 count++;
1024                 ptent++;
1025         }
1026
1027         error = table_do_modify_record(cmd, oh, tent_buf, count, atomic);
1028
1029         /*
1030          * Compatibility stuff: do not yell on duplicate keys or
1031          * failed deletions.
1032          */
1033         if (error == 0 || (error == EEXIST && add != 0) ||
1034             (error == ENOENT && add == 0)) {
1035                 if (quiet != 0) {
1036                         if (tent_buf != &tent)
1037                                 free(tent_buf);
1038                         return;
1039                 }
1040         }
1041
1042         /* Report results back */
1043         ptent = tent_buf;
1044         for (i = 0; i < count; ptent++, i++) {
1045                 ignored = 0;
1046                 switch (ptent->result) {
1047                 case IPFW_TR_ADDED:
1048                         px = "added";
1049                         break;
1050                 case IPFW_TR_DELETED:
1051                         px = "deleted";
1052                         break;
1053                 case IPFW_TR_UPDATED:
1054                         px = "updated";
1055                         break;
1056                 case IPFW_TR_LIMIT:
1057                         px = "limit";
1058                         ignored = 1;
1059                         break;
1060                 case IPFW_TR_ERROR:
1061                         px = "error";
1062                         ignored = 1;
1063                         break;
1064                 case IPFW_TR_NOTFOUND:
1065                         px = "notfound";
1066                         ignored = 1;
1067                         break;
1068                 case IPFW_TR_EXISTS:
1069                         px = "exists";
1070                         ignored = 1;
1071                         break;
1072                 case IPFW_TR_IGNORED:
1073                         px = "ignored";
1074                         ignored = 1;
1075                         break;
1076                 default:
1077                         px = "unknown";
1078                         ignored = 1;
1079                 }
1080
1081                 if (error != 0 && atomic != 0 && ignored == 0)
1082                         printf("%s(reverted): ", px);
1083                 else
1084                         printf("%s: ", px);
1085
1086                 table_show_entry(&xi, ptent);
1087         }
1088
1089         if (tent_buf != &tent)
1090                 free(tent_buf);
1091
1092         if (error == 0)
1093                 return;
1094         /* Get real OS error */
1095         error = errno;
1096
1097         /* Try to provide more human-readable error */
1098         switch (error) {
1099         case EEXIST:
1100                 etxt = "record already exists";
1101                 break;
1102         case EFBIG:
1103                 etxt = "limit hit";
1104                 break;
1105         case ESRCH:
1106                 etxt = "table not found";
1107                 break;
1108         case ENOENT:
1109                 etxt = "record not found";
1110                 break;
1111         case EACCES:
1112                 etxt = "table is locked";
1113                 break;
1114         default:
1115                 etxt = strerror(error);
1116         }
1117
1118         errx(EX_OSERR, "%s: %s", texterr, etxt);
1119 }
1120
1121 static int
1122 table_do_lookup(ipfw_obj_header *oh, char *key, ipfw_xtable_info *xi,
1123     ipfw_obj_tentry *xtent)
1124 {
1125         char xbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_tentry)];
1126         ipfw_obj_tentry *tent;
1127         uint8_t type;
1128         uint32_t vmask;
1129         size_t sz;
1130
1131         memcpy(xbuf, oh, sizeof(*oh));
1132         oh = (ipfw_obj_header *)xbuf;
1133         tent = (ipfw_obj_tentry *)(oh + 1);
1134
1135         memset(tent, 0, sizeof(*tent));
1136         tent->head.length = sizeof(*tent);
1137         tent->idx = 1;
1138
1139         tentry_fill_key(oh, tent, key, 0, &type, &vmask, xi);
1140         oh->ntlv.type = type;
1141
1142         sz = sizeof(xbuf);
1143         if (do_get3(IP_FW_TABLE_XFIND, &oh->opheader, &sz) != 0)
1144                 return (errno);
1145
1146         if (sz < sizeof(xbuf))
1147                 return (EINVAL);
1148
1149         *xtent = *tent;
1150
1151         return (0);
1152 }
1153
1154 static void
1155 table_lookup(ipfw_obj_header *oh, int ac, char *av[])
1156 {
1157         ipfw_obj_tentry xtent;
1158         ipfw_xtable_info xi;
1159         char key[64];
1160         int error;
1161
1162         if (ac == 0)
1163                 errx(EX_USAGE, "address required");
1164
1165         strlcpy(key, *av, sizeof(key));
1166
1167         memset(&xi, 0, sizeof(xi));
1168         error = table_do_lookup(oh, key, &xi, &xtent);
1169
1170         switch (error) {
1171         case 0:
1172                 break;
1173         case ESRCH:
1174                 errx(EX_UNAVAILABLE, "Table %s not found", oh->ntlv.name);
1175         case ENOENT:
1176                 errx(EX_UNAVAILABLE, "Entry %s not found", *av);
1177         case ENOTSUP:
1178                 errx(EX_UNAVAILABLE, "Table %s algo does not support "
1179                     "\"lookup\" method", oh->ntlv.name);
1180         default:
1181                 err(EX_OSERR, "getsockopt(IP_FW_TABLE_XFIND)");
1182         }
1183
1184         table_show_entry(&xi, &xtent);
1185 }
1186
1187 static void
1188 tentry_fill_key_type(char *arg, ipfw_obj_tentry *tentry, uint8_t type,
1189     uint8_t tflags)
1190 {
1191         char *p, *pp;
1192         int mask, af;
1193         struct in6_addr *paddr, tmp;
1194         struct ether_addr *mac;
1195         struct tflow_entry *tfe;
1196         uint32_t key, *pkey;
1197         uint16_t port;
1198         struct protoent *pent;
1199         struct servent *sent;
1200         int masklen;
1201
1202         mask = masklen = 0;
1203         af = 0;
1204         paddr = (struct in6_addr *)&tentry->k;
1205
1206         switch (type) {
1207         case IPFW_TABLE_ADDR:
1208                 /* Remove / if exists */
1209                 if ((p = strchr(arg, '/')) != NULL) {
1210                         *p = '\0';
1211                         mask = atoi(p + 1);
1212                 }
1213
1214                 if (inet_pton(AF_INET, arg, paddr) == 1) {
1215                         if (p != NULL && mask > 32)
1216                                 errx(EX_DATAERR, "bad IPv4 mask width: %s",
1217                                     p + 1);
1218
1219                         masklen = p ? mask : 32;
1220                         af = AF_INET;
1221                 } else if (inet_pton(AF_INET6, arg, paddr) == 1) {
1222                         if (IN6_IS_ADDR_V4COMPAT(paddr))
1223                                 errx(EX_DATAERR,
1224                                     "Use IPv4 instead of v4-compatible");
1225                         if (p != NULL && mask > 128)
1226                                 errx(EX_DATAERR, "bad IPv6 mask width: %s",
1227                                     p + 1);
1228
1229                         masklen = p ? mask : 128;
1230                         af = AF_INET6;
1231                 } else {
1232                         /* Assume FQDN */
1233                         if (lookup_host(arg, (struct in_addr *)paddr) != 0)
1234                                 errx(EX_NOHOST, "hostname ``%s'' unknown", arg);
1235
1236                         masklen = 32;
1237                         type = IPFW_TABLE_ADDR;
1238                         af = AF_INET;
1239                 }
1240                 break;
1241         case IPFW_TABLE_MAC:
1242                 /* Remove / if exists */
1243                 if ((p = strchr(arg, '/')) != NULL) {
1244                         *p = '\0';
1245                         mask = atoi(p + 1);
1246                 }
1247
1248                 if (p != NULL && mask > 8 * ETHER_ADDR_LEN)
1249                         errx(EX_DATAERR, "bad MAC mask width: %s",
1250                             p + 1);
1251
1252                 if ((mac = ether_aton(arg)) == NULL)
1253                         errx(EX_DATAERR, "Incorrect MAC address");
1254
1255                 memcpy(tentry->k.mac, mac->octet, ETHER_ADDR_LEN);
1256                 masklen = p ? mask : 8 * ETHER_ADDR_LEN;
1257                 af = AF_LINK;
1258                 break;
1259         case IPFW_TABLE_INTERFACE:
1260                 /* Assume interface name. Copy significant data only */
1261                 mask = MIN(strlen(arg), IF_NAMESIZE - 1);
1262                 memcpy(paddr, arg, mask);
1263                 /* Set mask to exact match */
1264                 masklen = 8 * IF_NAMESIZE;
1265                 break;
1266         case IPFW_TABLE_NUMBER:
1267                 /* Port or any other key */
1268                 key = strtol(arg, &p, 10);
1269                 if (*p != '\0')
1270                         errx(EX_DATAERR, "Invalid number: %s", arg);
1271
1272                 pkey = (uint32_t *)paddr;
1273                 *pkey = key;
1274                 masklen = 32;
1275                 break;
1276         case IPFW_TABLE_FLOW:
1277                 /* Assume [src-ip][,proto][,src-port][,dst-ip][,dst-port] */
1278                 tfe = &tentry->k.flow;
1279                 af = 0;
1280
1281                 /* Handle <ipv4|ipv6> */
1282                 if ((tflags & IPFW_TFFLAG_SRCIP) != 0) {
1283                         if ((p = strchr(arg, ',')) != NULL)
1284                                 *p++ = '\0';
1285                         /* Determine family using temporary storage */
1286                         if (inet_pton(AF_INET, arg, &tmp) == 1) {
1287                                 if (af != 0 && af != AF_INET)
1288                                         errx(EX_DATAERR,
1289                                             "Inconsistent address family\n");
1290                                 af = AF_INET;
1291                                 memcpy(&tfe->a.a4.sip, &tmp, 4);
1292                         } else if (inet_pton(AF_INET6, arg, &tmp) == 1) {
1293                                 if (af != 0 && af != AF_INET6)
1294                                         errx(EX_DATAERR,
1295                                             "Inconsistent address family\n");
1296                                 af = AF_INET6;
1297                                 memcpy(&tfe->a.a6.sip6, &tmp, 16);
1298                         }
1299
1300                         arg = p;
1301                 }
1302
1303                 /* Handle <proto-num|proto-name> */
1304                 if ((tflags & IPFW_TFFLAG_PROTO) != 0) {
1305                         if (arg == NULL)
1306                                 errx(EX_DATAERR, "invalid key: proto missing");
1307                         if ((p = strchr(arg, ',')) != NULL)
1308                                 *p++ = '\0';
1309
1310                         key = strtol(arg, &pp, 10);
1311                         if (*pp != '\0') {
1312                                 if ((pent = getprotobyname(arg)) == NULL)
1313                                         errx(EX_DATAERR, "Unknown proto: %s",
1314                                             arg);
1315                                 else
1316                                         key = pent->p_proto;
1317                         }
1318
1319                         if (key > 255)
1320                                 errx(EX_DATAERR, "Bad protocol number: %u",key);
1321
1322                         tfe->proto = key;
1323
1324                         arg = p;
1325                 }
1326
1327                 /* Handle <port-num|service-name> */
1328                 if ((tflags & IPFW_TFFLAG_SRCPORT) != 0) {
1329                         if (arg == NULL)
1330                                 errx(EX_DATAERR, "invalid key: src port missing");
1331                         if ((p = strchr(arg, ',')) != NULL)
1332                                 *p++ = '\0';
1333
1334                         port = htons(strtol(arg, &pp, 10));
1335                         if (*pp != '\0') {
1336                                 if ((sent = getservbyname(arg, NULL)) == NULL)
1337                                         errx(EX_DATAERR, "Unknown service: %s",
1338                                             arg);
1339                                 port = sent->s_port;
1340                         }
1341                         tfe->sport = port;
1342                         arg = p;
1343                 }
1344
1345                 /* Handle <ipv4|ipv6>*/
1346                 if ((tflags & IPFW_TFFLAG_DSTIP) != 0) {
1347                         if (arg == NULL)
1348                                 errx(EX_DATAERR, "invalid key: dst ip missing");
1349                         if ((p = strchr(arg, ',')) != NULL)
1350                                 *p++ = '\0';
1351                         /* Determine family using temporary storage */
1352                         if (inet_pton(AF_INET, arg, &tmp) == 1) {
1353                                 if (af != 0 && af != AF_INET)
1354                                         errx(EX_DATAERR,
1355                                             "Inconsistent address family");
1356                                 af = AF_INET;
1357                                 memcpy(&tfe->a.a4.dip, &tmp, 4);
1358                         } else if (inet_pton(AF_INET6, arg, &tmp) == 1) {
1359                                 if (af != 0 && af != AF_INET6)
1360                                         errx(EX_DATAERR,
1361                                             "Inconsistent address family");
1362                                 af = AF_INET6;
1363                                 memcpy(&tfe->a.a6.dip6, &tmp, 16);
1364                         }
1365
1366                         arg = p;
1367                 }
1368
1369                 /* Handle <port-num|service-name> */
1370                 if ((tflags & IPFW_TFFLAG_DSTPORT) != 0) {
1371                         if (arg == NULL)
1372                                 errx(EX_DATAERR, "invalid key: dst port missing");
1373                         if ((p = strchr(arg, ',')) != NULL)
1374                                 *p++ = '\0';
1375
1376                         port = htons(strtol(arg, &pp, 10));
1377                         if (*pp != '\0') {
1378                                 if ((sent = getservbyname(arg, NULL)) == NULL)
1379                                         errx(EX_DATAERR, "Unknown service: %s",
1380                                             arg);
1381                                 port = sent->s_port;
1382                         }
1383                         tfe->dport = port;
1384                         arg = p;
1385                 }
1386
1387                 tfe->af = af;
1388
1389                 break;
1390
1391         default:
1392                 errx(EX_DATAERR, "Unsupported table type: %d", type);
1393         }
1394
1395         tentry->subtype = af;
1396         tentry->masklen = masklen;
1397 }
1398
1399 /*
1400  * Tries to guess table key type.
1401  * This procedure is used in legacy table auto-create
1402  * code AND in `ipfw -n` ruleset checking.
1403  *
1404  * Imported from old table_fill_xentry() parse code.
1405  */
1406 static int
1407 guess_key_type(char *key, uint8_t *ptype)
1408 {
1409         char *p;
1410         struct in6_addr addr;
1411         uint32_t kv;
1412
1413         if (ishexnumber(*key) != 0 || *key == ':') {
1414                 /* Remove / if exists */
1415                 if ((p = strchr(key, '/')) != NULL)
1416                         *p = '\0';
1417
1418                 if ((inet_pton(AF_INET, key, &addr) == 1) ||
1419                     (inet_pton(AF_INET6, key, &addr) == 1)) {
1420                         *ptype = IPFW_TABLE_CIDR;
1421                         if (p != NULL)
1422                                 *p = '/';
1423                         return (0);
1424                 } else {
1425                         /* Port or any other key */
1426                         /* Skip non-base 10 entries like 'fa1' */
1427                         kv = strtol(key, &p, 10);
1428                         if (*p == '\0') {
1429                                 *ptype = IPFW_TABLE_NUMBER;
1430                                 return (0);
1431                         } else if ((p != key) && (*p == '.')) {
1432                                 /*
1433                                  * Warn on IPv4 address strings
1434                                  * which are "valid" for inet_aton() but not
1435                                  * in inet_pton().
1436                                  *
1437                                  * Typical examples: '10.5' or '10.0.0.05'
1438                                  */
1439                                 return (1);
1440                         }
1441                 }
1442         }
1443
1444         if (strchr(key, '.') == NULL) {
1445                 *ptype = IPFW_TABLE_INTERFACE;
1446                 return (0);
1447         }
1448
1449         if (lookup_host(key, (struct in_addr *)&addr) != 0)
1450                 return (1);
1451
1452         *ptype = IPFW_TABLE_CIDR;
1453         return (0);
1454 }
1455
1456 static void
1457 tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, char *key,
1458     int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi)
1459 {
1460         uint8_t type, tflags;
1461         uint32_t vmask;
1462         int error;
1463
1464         type = 0;
1465         tflags = 0;
1466         vmask = 0;
1467
1468         if (xi->tablename[0] == '\0')
1469                 error = table_get_info(oh, xi);
1470         else
1471                 error = 0;
1472
1473         if (error == 0) {
1474                 if (g_co.test_only == 0) {
1475                         /* Table found */
1476                         type = xi->type;
1477                         tflags = xi->tflags;
1478                         vmask = xi->vmask;
1479                 } else {
1480                         /*
1481                          * We're running `ipfw -n`
1482                          * Compatibility layer: try to guess key type
1483                          * before failing.
1484                          */
1485                         if (guess_key_type(key, &type) != 0) {
1486                                 /* Inknown key */
1487                                 errx(EX_USAGE, "Cannot guess "
1488                                     "key '%s' type", key);
1489                         }
1490                         vmask = IPFW_VTYPE_LEGACY;
1491                 }
1492         } else {
1493                 if (error != ESRCH)
1494                         errx(EX_OSERR, "Error requesting table %s info",
1495                             oh->ntlv.name);
1496                 if (add == 0)
1497                         errx(EX_DATAERR, "Table %s does not exist",
1498                             oh->ntlv.name);
1499                 /*
1500                  * Table does not exist
1501                  * Compatibility layer: try to guess key type before failing.
1502                  */
1503                 if (guess_key_type(key, &type) != 0) {
1504                         /* Inknown key */
1505                         errx(EX_USAGE, "Table %s does not exist, cannot guess "
1506                             "key '%s' type", oh->ntlv.name, key);
1507                 }
1508
1509                 vmask = IPFW_VTYPE_LEGACY;
1510         }
1511
1512         tentry_fill_key_type(key, tent, type, tflags);
1513
1514         *ptype = type;
1515         *pvmask = vmask;
1516 }
1517
1518 static void
1519 set_legacy_value(uint32_t val, ipfw_table_value *v)
1520 {
1521         v->tag = val;
1522         v->pipe = val;
1523         v->divert = val;
1524         v->skipto = val;
1525         v->netgraph = val;
1526         v->fib = val;
1527         v->nat = val;
1528         v->nh4 = val;
1529         v->dscp = (uint8_t)val;
1530         v->limit = val;
1531 }
1532
1533 static void
1534 tentry_fill_value(ipfw_obj_header *oh __unused, ipfw_obj_tentry *tent,
1535     char *arg, uint8_t type __unused, uint32_t vmask)
1536 {
1537         struct addrinfo hints, *res;
1538         struct in_addr ipaddr;
1539         const char *etype;
1540         char *comma, *e, *n, *p;
1541         uint32_t a4, flag, val;
1542         ipfw_table_value *v;
1543         uint32_t i;
1544         int dval;
1545
1546         v = &tent->v.value;
1547
1548         /* Compat layer: keep old behavior for legacy value types */
1549         if (vmask == IPFW_VTYPE_LEGACY) {
1550                 /* Try to interpret as number first */
1551                 val = strtoul(arg, &p, 0);
1552                 if (*p == '\0') {
1553                         set_legacy_value(val, v);
1554                         return;
1555                 }
1556                 if (inet_pton(AF_INET, arg, &val) == 1) {
1557                         set_legacy_value(ntohl(val), v);
1558                         return;
1559                 }
1560                 /* Try hostname */
1561                 if (lookup_host(arg, &ipaddr) == 0) {
1562                         set_legacy_value(ntohl(ipaddr.s_addr), v);
1563                         return;
1564                 }
1565                 errx(EX_OSERR, "Unable to parse value %s", arg);
1566         }
1567
1568         /*
1569          * Shorthands: handle single value if vmask consists
1570          * of numbers only. e.g.:
1571          * vmask = "fib,skipto" -> treat input "1" as "1,1"
1572          */
1573
1574         n = arg;
1575         etype = NULL;
1576         for (i = 1; i < (1u << 31); i *= 2) {
1577                 if ((flag = (vmask & i)) == 0)
1578                         continue;
1579                 vmask &= ~flag;
1580
1581                 if ((comma = strchr(n, ',')) != NULL)
1582                         *comma = '\0';
1583
1584                 switch (flag) {
1585                 case IPFW_VTYPE_TAG:
1586                         v->tag = strtol(n, &e, 10);
1587                         if (*e != '\0')
1588                                 etype = "tag";
1589                         break;
1590                 case IPFW_VTYPE_PIPE:
1591                         v->pipe = strtol(n, &e, 10);
1592                         if (*e != '\0')
1593                                 etype = "pipe";
1594                         break;
1595                 case IPFW_VTYPE_DIVERT:
1596                         v->divert = strtol(n, &e, 10);
1597                         if (*e != '\0')
1598                                 etype = "divert";
1599                         break;
1600                 case IPFW_VTYPE_SKIPTO:
1601                         v->skipto = strtol(n, &e, 10);
1602                         if (*e != '\0')
1603                                 etype = "skipto";
1604                         break;
1605                 case IPFW_VTYPE_NETGRAPH:
1606                         v->netgraph = strtol(n, &e, 10);
1607                         if (*e != '\0')
1608                                 etype = "netgraph";
1609                         break;
1610                 case IPFW_VTYPE_FIB:
1611                         v->fib = strtol(n, &e, 10);
1612                         if (*e != '\0')
1613                                 etype = "fib";
1614                         break;
1615                 case IPFW_VTYPE_NAT:
1616                         v->nat = strtol(n, &e, 10);
1617                         if (*e != '\0')
1618                                 etype = "nat";
1619                         break;
1620                 case IPFW_VTYPE_LIMIT:
1621                         v->limit = strtol(n, &e, 10);
1622                         if (*e != '\0')
1623                                 etype = "limit";
1624                         break;
1625                 case IPFW_VTYPE_NH4:
1626                         if (strchr(n, '.') != NULL &&
1627                             inet_pton(AF_INET, n, &a4) == 1) {
1628                                 v->nh4 = ntohl(a4);
1629                                 break;
1630                         }
1631                         if (lookup_host(n, &ipaddr) == 0) {
1632                                 v->nh4 = ntohl(ipaddr.s_addr);
1633                                 break;
1634                         }
1635                         etype = "ipv4";
1636                         break;
1637                 case IPFW_VTYPE_DSCP:
1638                         if (isalpha(*n)) {
1639                                 if ((dval = match_token(f_ipdscp, n)) != -1) {
1640                                         v->dscp = dval;
1641                                         break;
1642                                 } else
1643                                         etype = "DSCP code";
1644                         } else {
1645                                 v->dscp = strtol(n, &e, 10);
1646                                 if (v->dscp > 63 || *e != '\0')
1647                                         etype = "DSCP value";
1648                         }
1649                         break;
1650                 case IPFW_VTYPE_NH6:
1651                         if (strchr(n, ':') != NULL) {
1652                                 memset(&hints, 0, sizeof(hints));
1653                                 hints.ai_family = AF_INET6;
1654                                 hints.ai_flags = AI_NUMERICHOST;
1655                                 if (getaddrinfo(n, NULL, &hints, &res) == 0) {
1656                                         v->nh6 = ((struct sockaddr_in6 *)
1657                                             res->ai_addr)->sin6_addr;
1658                                         v->zoneid = ((struct sockaddr_in6 *)
1659                                             res->ai_addr)->sin6_scope_id;
1660                                         freeaddrinfo(res);
1661                                         break;
1662                                 }
1663                         }
1664                         etype = "ipv6";
1665                         break;
1666                 case IPFW_VTYPE_MARK:
1667                         v->mark = strtol(n, &e, 16);
1668                         if (*e != '\0')
1669                                 etype = "mark";
1670                         break;
1671                 }
1672
1673                 if (etype != NULL)
1674                         errx(EX_USAGE, "Unable to parse %s as %s", n, etype);
1675
1676                 if (comma != NULL)
1677                         *comma++ = ',';
1678
1679                 if ((n = comma) != NULL)
1680                         continue;
1681
1682                 /* End of input. */
1683                 if (vmask != 0)
1684                         errx(EX_USAGE, "Not enough fields inside value");
1685         }
1686 }
1687
1688 /*
1689  * Compare table names.
1690  * Honor number comparison.
1691  */
1692 static int
1693 tablename_cmp(const void *a, const void *b)
1694 {
1695         const ipfw_xtable_info *ia, *ib;
1696
1697         ia = (const ipfw_xtable_info *)a;
1698         ib = (const ipfw_xtable_info *)b;
1699
1700         return (stringnum_cmp(ia->tablename, ib->tablename));
1701 }
1702
1703 /*
1704  * Retrieves table list from kernel,
1705  * optionally sorts it and calls requested function for each table.
1706  * Returns 0 on success.
1707  */
1708 static int
1709 tables_foreach(table_cb_t *f, void *arg, int sort)
1710 {
1711         ipfw_obj_lheader *olh;
1712         ipfw_xtable_info *info;
1713         size_t sz;
1714         uint32_t i;
1715         int error;
1716
1717         /* Start with reasonable default */
1718         sz = sizeof(*olh) + 16 * sizeof(ipfw_xtable_info);
1719
1720         for (;;) {
1721                 if ((olh = calloc(1, sz)) == NULL)
1722                         return (ENOMEM);
1723
1724                 olh->size = sz;
1725                 if (do_get3(IP_FW_TABLES_XLIST, &olh->opheader, &sz) != 0) {
1726                         sz = olh->size;
1727                         free(olh);
1728                         if (errno != ENOMEM)
1729                                 return (errno);
1730                         continue;
1731                 }
1732
1733                 if (sort != 0)
1734                         qsort(olh + 1, olh->count, olh->objsize,
1735                             tablename_cmp);
1736
1737                 info = (ipfw_xtable_info *)(olh + 1);
1738                 for (i = 0; i < olh->count; i++) {
1739                         if (g_co.use_set == 0 || info->set == g_co.use_set - 1)
1740                                 error = f(info, arg);
1741                         info = (ipfw_xtable_info *)((caddr_t)info +
1742                             olh->objsize);
1743                 }
1744                 free(olh);
1745                 break;
1746         }
1747         return (0);
1748 }
1749
1750
1751 /*
1752  * Retrieves all entries for given table @i in
1753  * eXtended format. Allocate buffer large enough
1754  * to store result. Called needs to free it later.
1755  *
1756  * Returns 0 on success.
1757  */
1758 static int
1759 table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh)
1760 {
1761         ipfw_obj_header *oh;
1762         size_t sz;
1763         int c;
1764
1765         sz = 0;
1766         oh = NULL;
1767         for (c = 0; c < 8; c++) {
1768                 if (sz < i->size)
1769                         sz = i->size + 44;
1770                 if (oh != NULL)
1771                         free(oh);
1772                 if ((oh = calloc(1, sz)) == NULL)
1773                         continue;
1774                 table_fill_objheader(oh, i);
1775                 oh->opheader.version = 1; /* Current version */
1776                 if (do_get3(IP_FW_TABLE_XLIST, &oh->opheader, &sz) == 0) {
1777                         *poh = oh;
1778                         return (0);
1779                 }
1780
1781                 if (errno != ENOMEM)
1782                         break;
1783         }
1784         free(oh);
1785
1786         return (errno);
1787 }
1788
1789 /*
1790  * Shows all entries from @oh in human-readable format
1791  */
1792 static void
1793 table_show_list(ipfw_obj_header *oh, int need_header)
1794 {
1795         ipfw_obj_tentry *tent;
1796         uint32_t count;
1797         ipfw_xtable_info *i;
1798
1799         i = (ipfw_xtable_info *)(oh + 1);
1800         tent = (ipfw_obj_tentry *)(i + 1);
1801
1802         if (need_header)
1803                 printf("--- table(%s), set(%u) ---\n", i->tablename, i->set);
1804
1805         count = i->count;
1806         while (count > 0) {
1807                 table_show_entry(i, tent);
1808                 tent = (ipfw_obj_tentry *)((caddr_t)tent + tent->head.length);
1809                 count--;
1810         }
1811 }
1812
1813 static void
1814 table_show_value(char *buf, size_t bufsize, ipfw_table_value *v,
1815     uint32_t vmask, int print_ip)
1816 {
1817         char abuf[INET6_ADDRSTRLEN + IF_NAMESIZE + 2];
1818         struct sockaddr_in6 sa6;
1819         uint32_t flag, i, l;
1820         size_t sz;
1821         struct in_addr a4;
1822
1823         sz = bufsize;
1824
1825         /*
1826          * Some shorthands for printing values:
1827          * legacy assumes all values are equal, so keep the first one.
1828          */
1829         if (vmask == IPFW_VTYPE_LEGACY) {
1830                 if (print_ip != 0) {
1831                         flag = htonl(v->tag);
1832                         inet_ntop(AF_INET, &flag, buf, sz);
1833                 } else
1834                         snprintf(buf, sz, "%u", v->tag);
1835                 return;
1836         }
1837
1838         for (i = 1; i < (1u << 31); i *= 2) {
1839                 if ((flag = (vmask & i)) == 0)
1840                         continue;
1841                 l = 0;
1842
1843                 switch (flag) {
1844                 case IPFW_VTYPE_TAG:
1845                         l = snprintf(buf, sz, "%u,", v->tag);
1846                         break;
1847                 case IPFW_VTYPE_PIPE:
1848                         l = snprintf(buf, sz, "%u,", v->pipe);
1849                         break;
1850                 case IPFW_VTYPE_DIVERT:
1851                         l = snprintf(buf, sz, "%d,", v->divert);
1852                         break;
1853                 case IPFW_VTYPE_SKIPTO:
1854                         l = snprintf(buf, sz, "%d,", v->skipto);
1855                         break;
1856                 case IPFW_VTYPE_NETGRAPH:
1857                         l = snprintf(buf, sz, "%u,", v->netgraph);
1858                         break;
1859                 case IPFW_VTYPE_FIB:
1860                         l = snprintf(buf, sz, "%u,", v->fib);
1861                         break;
1862                 case IPFW_VTYPE_NAT:
1863                         l = snprintf(buf, sz, "%u,", v->nat);
1864                         break;
1865                 case IPFW_VTYPE_LIMIT:
1866                         l = snprintf(buf, sz, "%u,", v->limit);
1867                         break;
1868                 case IPFW_VTYPE_NH4:
1869                         a4.s_addr = htonl(v->nh4);
1870                         inet_ntop(AF_INET, &a4, abuf, sizeof(abuf));
1871                         l = snprintf(buf, sz, "%s,", abuf);
1872                         break;
1873                 case IPFW_VTYPE_DSCP:
1874                         l = snprintf(buf, sz, "%d,", v->dscp);
1875                         break;
1876                 case IPFW_VTYPE_NH6:
1877                         sa6.sin6_family = AF_INET6;
1878                         sa6.sin6_len = sizeof(sa6);
1879                         sa6.sin6_addr = v->nh6;
1880                         sa6.sin6_port = 0;
1881                         sa6.sin6_scope_id = v->zoneid;
1882                         if (getnameinfo((const struct sockaddr *)&sa6,
1883                             sa6.sin6_len, abuf, sizeof(abuf), NULL, 0,
1884                             NI_NUMERICHOST) == 0)
1885                                 l = snprintf(buf, sz, "%s,", abuf);
1886                         break;
1887                 case IPFW_VTYPE_MARK:
1888                         l = snprintf(buf, sz, "%#x,", v->mark);
1889                         break;
1890                 }
1891
1892                 buf += l;
1893                 sz -= l;
1894         }
1895
1896         if (sz != bufsize)
1897                 *(buf - 1) = '\0';
1898 }
1899
1900 static void
1901 table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent)
1902 {
1903         char tbuf[128], pval[128];
1904         const char *comma;
1905         const u_char *mac;
1906         void *paddr;
1907         struct tflow_entry *tfe;
1908
1909         table_show_value(pval, sizeof(pval), &tent->v.value, i->vmask,
1910             g_co.do_value_as_ip);
1911
1912         switch (i->type) {
1913         case IPFW_TABLE_ADDR:
1914                 /* IPv4 or IPv6 prefixes */
1915                 inet_ntop(tent->subtype, &tent->k, tbuf, sizeof(tbuf));
1916                 printf("%s/%u %s\n", tbuf, tent->masklen, pval);
1917                 break;
1918         case IPFW_TABLE_MAC:
1919                 /* MAC prefixes */
1920                 mac = tent->k.mac;
1921                 printf("%02x:%02x:%02x:%02x:%02x:%02x/%u %s\n",
1922                     mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
1923                     tent->masklen, pval);
1924                 break;
1925         case IPFW_TABLE_INTERFACE:
1926                 /* Interface names */
1927                 printf("%s %s\n", tent->k.iface, pval);
1928                 break;
1929         case IPFW_TABLE_NUMBER:
1930                 /* numbers */
1931                 printf("%u %s\n", tent->k.key, pval);
1932                 break;
1933         case IPFW_TABLE_FLOW:
1934                 /* flows */
1935                 tfe = &tent->k.flow;
1936                 comma = "";
1937
1938                 if ((i->tflags & IPFW_TFFLAG_SRCIP) != 0) {
1939                         if (tfe->af == AF_INET)
1940                                 paddr = &tfe->a.a4.sip;
1941                         else
1942                                 paddr = &tfe->a.a6.sip6;
1943
1944                         inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf));
1945                         printf("%s%s", comma, tbuf);
1946                         comma = ",";
1947                 }
1948
1949                 if ((i->tflags & IPFW_TFFLAG_PROTO) != 0) {
1950                         printf("%s%d", comma, tfe->proto);
1951                         comma = ",";
1952                 }
1953
1954                 if ((i->tflags & IPFW_TFFLAG_SRCPORT) != 0) {
1955                         printf("%s%d", comma, ntohs(tfe->sport));
1956                         comma = ",";
1957                 }
1958                 if ((i->tflags & IPFW_TFFLAG_DSTIP) != 0) {
1959                         if (tfe->af == AF_INET)
1960                                 paddr = &tfe->a.a4.dip;
1961                         else
1962                                 paddr = &tfe->a.a6.dip6;
1963
1964                         inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf));
1965                         printf("%s%s", comma, tbuf);
1966                         comma = ",";
1967                 }
1968
1969                 if ((i->tflags & IPFW_TFFLAG_DSTPORT) != 0) {
1970                         printf("%s%d", comma, ntohs(tfe->dport));
1971                         comma = ",";
1972                 }
1973
1974                 printf(" %s\n", pval);
1975         }
1976 }
1977
1978 static int
1979 table_do_get_stdlist(uint16_t opcode, ipfw_obj_lheader **polh)
1980 {
1981         ipfw_obj_lheader req, *olh;
1982         size_t sz;
1983
1984         memset(&req, 0, sizeof(req));
1985         sz = sizeof(req);
1986
1987         if (do_get3(opcode, &req.opheader, &sz) != 0)
1988                 if (errno != ENOMEM)
1989                         return (errno);
1990
1991         sz = req.size;
1992         if ((olh = calloc(1, sz)) == NULL)
1993                 return (ENOMEM);
1994
1995         olh->size = sz;
1996         if (do_get3(opcode, &olh->opheader, &sz) != 0) {
1997                 free(olh);
1998                 return (errno);
1999         }
2000
2001         *polh = olh;
2002         return (0);
2003 }
2004
2005 static int
2006 table_do_get_algolist(ipfw_obj_lheader **polh)
2007 {
2008
2009         return (table_do_get_stdlist(IP_FW_TABLES_ALIST, polh));
2010 }
2011
2012 static int
2013 table_do_get_vlist(ipfw_obj_lheader **polh)
2014 {
2015
2016         return (table_do_get_stdlist(IP_FW_TABLE_VLIST, polh));
2017 }
2018
2019 void
2020 ipfw_list_ta(int ac __unused, char *av[] __unused)
2021 {
2022         ipfw_obj_lheader *olh;
2023         ipfw_ta_info *info;
2024         const char *atype;
2025         uint32_t i;
2026         int error;
2027
2028         error = table_do_get_algolist(&olh);
2029         if (error != 0)
2030                 err(EX_OSERR, "Unable to request algorithm list");
2031
2032         info = (ipfw_ta_info *)(olh + 1);
2033         for (i = 0; i < olh->count; i++) {
2034                 if ((atype = match_value(tabletypes, info->type)) == NULL)
2035                         atype = "unknown";
2036                 printf("--- %s ---\n", info->algoname);
2037                 printf(" type: %s\n refcount: %u\n", atype, info->refcnt);
2038
2039                 info = (ipfw_ta_info *)((caddr_t)info + olh->objsize);
2040         }
2041
2042         free(olh);
2043 }
2044
2045
2046 static int
2047 compare_values(const void *_a, const void *_b)
2048 {
2049         const ipfw_table_value *a, *b;
2050
2051         a = (const ipfw_table_value *)_a;
2052         b = (const ipfw_table_value *)_b;
2053
2054         if (a->kidx < b->kidx)
2055                 return (-1);
2056         else if (a->kidx > b->kidx)
2057                 return (1);
2058
2059         return (0);
2060 }
2061
2062 void
2063 ipfw_list_values(int ac __unused, char *av[] __unused)
2064 {
2065         char buf[128];
2066         ipfw_obj_lheader *olh;
2067         ipfw_table_value *v;
2068         uint32_t i, vmask;
2069         int error;
2070
2071         error = table_do_get_vlist(&olh);
2072         if (error != 0)
2073                 err(EX_OSERR, "Unable to request value list");
2074
2075         vmask = 0x7FFFFFFF; /* Similar to IPFW_VTYPE_LEGACY */
2076
2077         table_print_valheader(buf, sizeof(buf), vmask);
2078         printf("HEADER: %s\n", buf);
2079         v = (ipfw_table_value *)(olh + 1);
2080         qsort(v, olh->count, olh->objsize, compare_values);
2081         for (i = 0; i < olh->count; i++) {
2082                 table_show_value(buf, sizeof(buf), (ipfw_table_value *)v,
2083                     vmask, 0);
2084                 printf("[%u] refs=%lu %s\n", v->kidx, (u_long)v->refcnt, buf);
2085                 v = (ipfw_table_value *)((caddr_t)v + olh->objsize);
2086         }
2087
2088         free(olh);
2089 }
2090
2091 int
2092 table_check_name(const char *tablename)
2093 {
2094
2095         if (ipfw_check_object_name(tablename) != 0)
2096                 return (EINVAL);
2097         /* Restrict some 'special' names */
2098         if (strcmp(tablename, "all") == 0)
2099                 return (EINVAL);
2100         return (0);
2101 }
2102