1/*
2 * Copyright (c) 2002-2003 Luigi Rizzo
3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
4 * Copyright (c) 1994 Ugen J.S.Antsilevich
5 *
6 * Idea and grammar partially left from:
7 * Copyright (c) 1993 Daniel Boulet
8 *
9 * Redistribution and use in source forms, with and without modification,
10 * are permitted provided that this entire comment appears intact.
11 *
12 * Redistribution in binary form may occur without any restrictions.
13 * Obviously, it would be nice if you gave credit where credit is due
14 * but requiring it would be too onerous.
15 *
16 * This software is provided ``AS IS'' without any warranties of any kind.
17 *
18 * NEW command line interface for IP firewall facility
19 *
20 * $FreeBSD: head/sbin/ipfw/ipfw2.h 204591 2010-03-02 17:40:48Z luigi $
21 */
22
23/*
24 * Options that can be set on the command line.
25 * When reading commands from a file, a subset of the options can also
26 * be applied globally by specifying them before the file name.
27 * After that, each line can contain its own option that changes
28 * the global value.
29 * XXX The context is not restored after each line.
30 */
31
32struct cmdline_opts {
33 /* boolean options: */
34 int do_value_as_ip; /* show table value as IP */
35 int do_resolv; /* try to resolve all ip to names */
36 int do_time; /* Show time stamps */
37 int do_quiet; /* Be quiet in add and flush */
38 int do_pipe; /* this cmd refers to a pipe/queue/sched */
39 int do_nat; /* this cmd refers to a nat config */
40 int do_dynamic; /* display dynamic rules */
41 int do_expired; /* display expired dynamic rules */
42 int do_compact; /* show rules in compact mode */
43 int do_force; /* do not ask for confirmation */
44 int show_sets; /* display the set each rule belongs to */
45 int test_only; /* only check syntax */
46 int comment_only; /* only print action and comment */
47 int verbose; /* be verbose on some commands */
48
49 /* The options below can have multiple values. */
50
51 int do_sort; /* field to sort results (0 = no) */
52 /* valid fields are 1 and above */
53
54 int use_set; /* work with specified set number */
55 /* 0 means all sets, otherwise apply to set use_set - 1 */
56
57};
58
59extern struct cmdline_opts co;
60
61/*
62 * _s_x is a structure that stores a string <-> token pairs, used in
63 * various places in the parser. Entries are stored in arrays,
64 * with an entry with s=NULL as terminator.
65 * The search routines are match_token() and match_value().
66 * Often, an element with x=0 contains an error string.
67 *
68 */
69struct _s_x {
70 char const *s;
71 int x;
72};
73
74enum tokens {
75 TOK_NULL=0,
76
77 TOK_OR,
78 TOK_NOT,
79 TOK_STARTBRACE,
80 TOK_ENDBRACE,
81
82 TOK_ACCEPT,
83 TOK_COUNT,
84 TOK_PIPE,
85 TOK_LINK,
86 TOK_QUEUE,
87 TOK_FLOWSET,
88 TOK_SCHED,
89 TOK_DIVERT,
90 TOK_TEE,
91 TOK_NETGRAPH,
92 TOK_NGTEE,
93 TOK_FORWARD,
94 TOK_SKIPTO,
95 TOK_DENY,
96 TOK_REJECT,
97 TOK_RESET,
98 TOK_UNREACH,
99 TOK_CHECKSTATE,
100 TOK_NAT,
101 TOK_REASS,
102
103 TOK_ALTQ,
104 TOK_LOG,
105 TOK_TAG,
106 TOK_UNTAG,
107
108 TOK_TAGGED,
109 TOK_UID,
110 TOK_GID,
111 TOK_JAIL,
112 TOK_IN,
113 TOK_LIMIT,
114 TOK_KEEPSTATE,
115 TOK_LAYER2,
116 TOK_OUT,
117 TOK_DIVERTED,
118 TOK_DIVERTEDLOOPBACK,
119 TOK_DIVERTEDOUTPUT,
120 TOK_XMIT,
121 TOK_RECV,
122 TOK_VIA,
123 TOK_FRAG,
124 TOK_IPOPTS,
125 TOK_IPLEN,
126 TOK_IPID,
127 TOK_IPPRECEDENCE,
128 TOK_IPTOS,
129 TOK_IPTTL,
130 TOK_IPVER,
131 TOK_ESTAB,
132 TOK_SETUP,
133 TOK_TCPDATALEN,
134 TOK_TCPFLAGS,
135 TOK_TCPOPTS,
136 TOK_TCPSEQ,
137 TOK_TCPACK,
138 TOK_TCPWIN,
139 TOK_ICMPTYPES,
140 TOK_MAC,
141 TOK_MACTYPE,
142 TOK_VERREVPATH,
143 TOK_VERSRCREACH,
144 TOK_ANTISPOOF,
145 TOK_IPSEC,
146 TOK_COMMENT,
147
148 TOK_PLR,
149 TOK_NOERROR,
150 TOK_BUCKETS,
151 TOK_DSTIP,
152 TOK_SRCIP,
153 TOK_DSTPORT,
154 TOK_SRCPORT,
155 TOK_ALL,
156 TOK_MASK,
157 TOK_FLOW_MASK,
158 TOK_SCHED_MASK,
159 TOK_BW,
160 TOK_DELAY,
161 TOK_PROFILE,
162 TOK_BURST,
163 TOK_RED,
164 TOK_GRED,
165 TOK_DROPTAIL,
166 TOK_PROTO,
167 /* dummynet tokens */
168 TOK_WEIGHT,
169 TOK_LMAX,
170 TOK_PRI,
171 TOK_TYPE,
172 TOK_SLOTSIZE,
173
174 TOK_IP,
175 TOK_IF,
176 TOK_ALOG,
177 TOK_DENY_INC,
178 TOK_SAME_PORTS,
179 TOK_UNREG_ONLY,
180 TOK_RESET_ADDR,
181 TOK_ALIAS_REV,
182 TOK_PROXY_ONLY,
183 TOK_REDIR_ADDR,
184 TOK_REDIR_PORT,
185 TOK_REDIR_PROTO,
186
187 TOK_IPV6,
188 TOK_FLOWID,
189 TOK_ICMP6TYPES,
190 TOK_EXT6HDR,
191 TOK_DSTIP6,
192 TOK_SRCIP6,
193
194 TOK_IPV4,
195 TOK_UNREACH6,
196 TOK_RESET6,
197
198 TOK_FIB,
199 TOK_SETFIB,
200 TOK_LOOKUP,
201};
202/*
203 * the following macro returns an error message if we run out of
204 * arguments.
205 */
206#define NEED(_p, msg) {if (!_p) errx(EX_USAGE, msg);}
207#define NEED1(msg) {if (!(*av)) errx(EX_USAGE, msg);}
208
209unsigned long long align_uint64(const uint64_t *pll);
210
211/* memory allocation support */
212void *safe_calloc(size_t number, size_t size);
213void *safe_realloc(void *ptr, size_t size);
214
215/* string comparison functions used for historical compatibility */
216int _substrcmp(const char *str1, const char* str2);
217int _substrcmp2(const char *str1, const char* str2, const char* str3);
218
219/* utility functions */
220int match_token(struct _s_x *table, char *string);
221char const *match_value(struct _s_x *p, int value);
222
223int do_cmd(int optname, void *optval, uintptr_t optlen);
224
225struct in6_addr;
226void n2mask(struct in6_addr *mask, int n);
227int contigmask(uint8_t *p, int len);
228
229/*
230 * Forward declarations to avoid include way too many headers.
231 * C does not allow duplicated typedefs, so we use the base struct
232 * that the typedef points to.
233 * Should the typedefs use a different type, the compiler will
234 * still detect the change when compiling the body of the
235 * functions involved, so we do not lose error checking.
236 */
237struct _ipfw_insn;
238struct _ipfw_insn_altq;
239struct _ipfw_insn_u32;
240struct _ipfw_insn_ip6;
241struct _ipfw_insn_icmp6;
242
243/*
244 * The reserved set numer. This is a constant in ip_fw.h
245 * but we store it in a variable so other files do not depend
246 * in that header just for one constant.
247 */
248extern int resvd_set_number;
249
250/* first-level command handlers */
251void ipfw_add(char *av[]);
252void ipfw_show_nat(int ac, char **av);
253void ipfw_config_pipe(int ac, char **av);
254void ipfw_config_nat(int ac, char **av);
255void ipfw_sets_handler(char *av[]);
256void ipfw_table_handler(int ac, char *av[]);
257void ipfw_sysctl_handler(char *av[], int which);
258void ipfw_delete(char *av[]);
259void ipfw_flush(int force);
260void ipfw_zero(int ac, char *av[], int optname);
261void ipfw_list(int ac, char *av[], int show_counters);
262
263/* altq.c */
264void altq_set_enabled(int enabled);
265u_int32_t altq_name_to_qid(const char *name);
266
267void print_altq_cmd(struct _ipfw_insn_altq *altqptr);
268
269/* dummynet.c */
270void dummynet_list(int ac, char *av[], int show_counters);
271void dummynet_flush(void);
272int ipfw_delete_pipe(int pipe_or_queue, int n);
273
274/* ipv6.c */
275void print_unreach6_code(uint16_t code);
276void print_ip6(struct _ipfw_insn_ip6 *cmd, char const *s);
277void print_flow6id(struct _ipfw_insn_u32 *cmd);
278void print_icmp6types(struct _ipfw_insn_u32 *cmd);
279void print_ext6hdr(struct _ipfw_insn *cmd );
280
281struct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av);
282struct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av);
283
284void fill_flow6(struct _ipfw_insn_u32 *cmd, char *av );
285void fill_unreach6_code(u_short *codep, char *str);
286void fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av);
287int fill_ext6hdr(struct _ipfw_insn *cmd, char *av);