1187767Sluigi/* 2187767Sluigi * Copyright (c) 2002-2003 Luigi Rizzo 3187767Sluigi * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4187767Sluigi * Copyright (c) 1994 Ugen J.S.Antsilevich 5187767Sluigi * 6187767Sluigi * Idea and grammar partially left from: 7187767Sluigi * Copyright (c) 1993 Daniel Boulet 8187767Sluigi * 9187767Sluigi * Redistribution and use in source forms, with and without modification, 10187767Sluigi * are permitted provided that this entire comment appears intact. 11187767Sluigi * 12187767Sluigi * Redistribution in binary form may occur without any restrictions. 13187767Sluigi * Obviously, it would be nice if you gave credit where credit is due 14187767Sluigi * but requiring it would be too onerous. 15187767Sluigi * 16187767Sluigi * This software is provided ``AS IS'' without any warranties of any kind. 17187767Sluigi * 18187767Sluigi * NEW command line interface for IP firewall facility 19187767Sluigi * 20187767Sluigi * $FreeBSD: stable/11/sbin/ipfw/ipfw2.h 359695 2020-04-07 16:29:11Z eugen $ 21187767Sluigi */ 22187767Sluigi 23187767Sluigi/* 24187767Sluigi * Options that can be set on the command line. 25187767Sluigi * When reading commands from a file, a subset of the options can also 26187767Sluigi * be applied globally by specifying them before the file name. 27187767Sluigi * After that, each line can contain its own option that changes 28187767Sluigi * the global value. 29187767Sluigi * XXX The context is not restored after each line. 30187767Sluigi */ 31187767Sluigi 32187767Sluigistruct cmdline_opts { 33187767Sluigi /* boolean options: */ 34187767Sluigi int do_value_as_ip; /* show table value as IP */ 35187767Sluigi int do_resolv; /* try to resolve all ip to names */ 36187767Sluigi int do_time; /* Show time stamps */ 37187767Sluigi int do_quiet; /* Be quiet in add and flush */ 38204591Sluigi int do_pipe; /* this cmd refers to a pipe/queue/sched */ 39187767Sluigi int do_nat; /* this cmd refers to a nat config */ 40187767Sluigi int do_compact; /* show rules in compact mode */ 41187767Sluigi int do_force; /* do not ask for confirmation */ 42187767Sluigi int show_sets; /* display the set each rule belongs to */ 43187767Sluigi int test_only; /* only check syntax */ 44187767Sluigi int comment_only; /* only print action and comment */ 45187767Sluigi int verbose; /* be verbose on some commands */ 46187767Sluigi 47187767Sluigi /* The options below can have multiple values. */ 48187767Sluigi 49346205Sae int do_dynamic; /* 1 - display dynamic rules */ 50346205Sae /* 2 - display/delete only dynamic rules */ 51187767Sluigi int do_sort; /* field to sort results (0 = no) */ 52187767Sluigi /* valid fields are 1 and above */ 53187767Sluigi 54187767Sluigi int use_set; /* work with specified set number */ 55187767Sluigi /* 0 means all sets, otherwise apply to set use_set - 1 */ 56187767Sluigi 57187767Sluigi}; 58187767Sluigi 59332400Saeenum { 60332400Sae TIMESTAMP_NONE = 0, 61332400Sae TIMESTAMP_STRING, 62332400Sae TIMESTAMP_NUMERIC, 63332400Sae}; 64332400Sae 65187767Sluigiextern struct cmdline_opts co; 66187767Sluigi 67187767Sluigi/* 68187767Sluigi * _s_x is a structure that stores a string <-> token pairs, used in 69187767Sluigi * various places in the parser. Entries are stored in arrays, 70187767Sluigi * with an entry with s=NULL as terminator. 71187767Sluigi * The search routines are match_token() and match_value(). 72187767Sluigi * Often, an element with x=0 contains an error string. 73187767Sluigi * 74187767Sluigi */ 75187767Sluigistruct _s_x { 76187767Sluigi char const *s; 77187767Sluigi int x; 78187767Sluigi}; 79187767Sluigi 80270424Smelifaroextern struct _s_x f_ipdscp[]; 81270424Smelifaro 82187769Sluigienum tokens { 83187769Sluigi TOK_NULL=0, 84187769Sluigi 85187769Sluigi TOK_OR, 86187769Sluigi TOK_NOT, 87187769Sluigi TOK_STARTBRACE, 88187769Sluigi TOK_ENDBRACE, 89187769Sluigi 90332229Stuexen TOK_ABORT6, 91332229Stuexen TOK_ABORT, 92187769Sluigi TOK_ACCEPT, 93187769Sluigi TOK_COUNT, 94298016Sae TOK_EACTION, 95187769Sluigi TOK_PIPE, 96204591Sluigi TOK_LINK, 97187769Sluigi TOK_QUEUE, 98204591Sluigi TOK_FLOWSET, 99204591Sluigi TOK_SCHED, 100187769Sluigi TOK_DIVERT, 101187769Sluigi TOK_TEE, 102187769Sluigi TOK_NETGRAPH, 103187769Sluigi TOK_NGTEE, 104187769Sluigi TOK_FORWARD, 105187769Sluigi TOK_SKIPTO, 106187769Sluigi TOK_DENY, 107187769Sluigi TOK_REJECT, 108187769Sluigi TOK_RESET, 109187769Sluigi TOK_UNREACH, 110187769Sluigi TOK_CHECKSTATE, 111187769Sluigi TOK_NAT, 112190633Spiso TOK_REASS, 113223666Sae TOK_CALL, 114223666Sae TOK_RETURN, 115187769Sluigi 116187769Sluigi TOK_ALTQ, 117187769Sluigi TOK_LOG, 118187769Sluigi TOK_TAG, 119187769Sluigi TOK_UNTAG, 120187769Sluigi 121187769Sluigi TOK_TAGGED, 122187769Sluigi TOK_UID, 123187769Sluigi TOK_GID, 124187769Sluigi TOK_JAIL, 125187769Sluigi TOK_IN, 126187769Sluigi TOK_LIMIT, 127337461Sae TOK_SETLIMIT, 128187769Sluigi TOK_KEEPSTATE, 129337461Sae TOK_RECORDSTATE, 130187769Sluigi TOK_LAYER2, 131187769Sluigi TOK_OUT, 132187769Sluigi TOK_DIVERTED, 133187769Sluigi TOK_DIVERTEDLOOPBACK, 134187769Sluigi TOK_DIVERTEDOUTPUT, 135187769Sluigi TOK_XMIT, 136187769Sluigi TOK_RECV, 137187769Sluigi TOK_VIA, 138187769Sluigi TOK_FRAG, 139187769Sluigi TOK_IPOPTS, 140187769Sluigi TOK_IPLEN, 141187769Sluigi TOK_IPID, 142187769Sluigi TOK_IPPRECEDENCE, 143205169Sluigi TOK_DSCP, 144187769Sluigi TOK_IPTOS, 145187769Sluigi TOK_IPTTL, 146187769Sluigi TOK_IPVER, 147187769Sluigi TOK_ESTAB, 148187769Sluigi TOK_SETUP, 149187769Sluigi TOK_TCPDATALEN, 150187769Sluigi TOK_TCPFLAGS, 151187769Sluigi TOK_TCPOPTS, 152187769Sluigi TOK_TCPSEQ, 153187769Sluigi TOK_TCPACK, 154349573Sae TOK_TCPMSS, 155187769Sluigi TOK_TCPWIN, 156187769Sluigi TOK_ICMPTYPES, 157187769Sluigi TOK_MAC, 158187769Sluigi TOK_MACTYPE, 159187769Sluigi TOK_VERREVPATH, 160187769Sluigi TOK_VERSRCREACH, 161187769Sluigi TOK_ANTISPOOF, 162187769Sluigi TOK_IPSEC, 163187769Sluigi TOK_COMMENT, 164187769Sluigi 165187769Sluigi TOK_PLR, 166187769Sluigi TOK_NOERROR, 167187769Sluigi TOK_BUCKETS, 168187769Sluigi TOK_DSTIP, 169187769Sluigi TOK_SRCIP, 170187769Sluigi TOK_DSTPORT, 171187769Sluigi TOK_SRCPORT, 172187769Sluigi TOK_ALL, 173187769Sluigi TOK_MASK, 174204591Sluigi TOK_FLOW_MASK, 175204591Sluigi TOK_SCHED_MASK, 176187769Sluigi TOK_BW, 177187769Sluigi TOK_DELAY, 178204591Sluigi TOK_PROFILE, 179194930Soleg TOK_BURST, 180187769Sluigi TOK_RED, 181187769Sluigi TOK_GRED, 182266941Shiren TOK_ECN, 183187769Sluigi TOK_DROPTAIL, 184187769Sluigi TOK_PROTO, 185300779Struckman#ifdef NEW_AQM 186300779Struckman /* AQM tokens*/ 187300779Struckman TOK_NO_ECN, 188300779Struckman TOK_CODEL, 189300779Struckman TOK_FQ_CODEL, 190300779Struckman TOK_TARGET, 191300779Struckman TOK_INTERVAL, 192300779Struckman TOK_FLOWS, 193300779Struckman TOK_QUANTUM, 194300779Struckman 195300779Struckman TOK_PIE, 196300779Struckman TOK_FQ_PIE, 197300779Struckman TOK_TUPDATE, 198300779Struckman TOK_MAX_BURST, 199300779Struckman TOK_MAX_ECNTH, 200300779Struckman TOK_ALPHA, 201300779Struckman TOK_BETA, 202300779Struckman TOK_CAPDROP, 203300779Struckman TOK_NO_CAPDROP, 204300779Struckman TOK_ONOFF, 205300779Struckman TOK_DRE, 206300779Struckman TOK_TS, 207300779Struckman TOK_DERAND, 208300779Struckman TOK_NO_DERAND, 209300779Struckman#endif 210204591Sluigi /* dummynet tokens */ 211187769Sluigi TOK_WEIGHT, 212204591Sluigi TOK_LMAX, 213204591Sluigi TOK_PRI, 214204591Sluigi TOK_TYPE, 215204591Sluigi TOK_SLOTSIZE, 216204591Sluigi 217187769Sluigi TOK_IP, 218187769Sluigi TOK_IF, 219332210Stuexen TOK_ALOG, 220332210Stuexen TOK_DENY_INC, 221332210Stuexen TOK_SAME_PORTS, 222332210Stuexen TOK_UNREG_ONLY, 223359695Seugen TOK_UNREG_CGN, 224223080Sae TOK_SKIP_GLOBAL, 225332210Stuexen TOK_RESET_ADDR, 226332210Stuexen TOK_ALIAS_REV, 227332210Stuexen TOK_PROXY_ONLY, 228187769Sluigi TOK_REDIR_ADDR, 229187769Sluigi TOK_REDIR_PORT, 230220804Sglebius TOK_REDIR_PROTO, 231187769Sluigi 232187769Sluigi TOK_IPV6, 233187769Sluigi TOK_FLOWID, 234187769Sluigi TOK_ICMP6TYPES, 235187769Sluigi TOK_EXT6HDR, 236187769Sluigi TOK_DSTIP6, 237187769Sluigi TOK_SRCIP6, 238187769Sluigi 239187769Sluigi TOK_IPV4, 240187769Sluigi TOK_UNREACH6, 241187769Sluigi TOK_RESET6, 242187769Sluigi 243187769Sluigi TOK_FIB, 244187769Sluigi TOK_SETFIB, 245200567Sluigi TOK_LOOKUP, 246215179Sluigi TOK_SOCKARG, 247248552Smelifaro TOK_SETDSCP, 248272840Smelifaro TOK_FLOW, 249272840Smelifaro TOK_IFLIST, 250272840Smelifaro /* Table tokens */ 251272840Smelifaro TOK_CREATE, 252272840Smelifaro TOK_DESTROY, 253272840Smelifaro TOK_LIST, 254272840Smelifaro TOK_INFO, 255272840Smelifaro TOK_DETAIL, 256272840Smelifaro TOK_MODIFY, 257272840Smelifaro TOK_FLUSH, 258272840Smelifaro TOK_SWAP, 259272840Smelifaro TOK_ADD, 260272840Smelifaro TOK_DEL, 261272840Smelifaro TOK_VALTYPE, 262272840Smelifaro TOK_ALGO, 263272840Smelifaro TOK_TALIST, 264272840Smelifaro TOK_ATOMIC, 265272840Smelifaro TOK_LOCK, 266272840Smelifaro TOK_UNLOCK, 267272840Smelifaro TOK_VLIST, 268290330Sae TOK_OLIST, 269349575Sae TOK_MISSING, 270349575Sae TOK_ORFLUSH, 271316446Sae 272316446Sae /* NAT64 tokens */ 273316446Sae TOK_NAT64STL, 274316446Sae TOK_NAT64LSN, 275316444Sae TOK_STATS, 276316446Sae TOK_STATES, 277316446Sae TOK_CONFIG, 278316446Sae TOK_TABLE4, 279316446Sae TOK_TABLE6, 280316446Sae TOK_PREFIX4, 281316446Sae TOK_PREFIX6, 282316446Sae TOK_AGG_LEN, 283316446Sae TOK_AGG_COUNT, 284316446Sae TOK_MAX_PORTS, 285316446Sae TOK_JMAXLEN, 286316446Sae TOK_PORT_RANGE, 287316446Sae TOK_HOST_DEL_AGE, 288316446Sae TOK_PG_DEL_AGE, 289316446Sae TOK_TCP_SYN_AGE, 290316446Sae TOK_TCP_CLOSE_AGE, 291316446Sae TOK_TCP_EST_AGE, 292316446Sae TOK_UDP_AGE, 293316446Sae TOK_ICMP_AGE, 294316446Sae TOK_LOGOFF, 295346210Sae TOK_PRIVATE, 296346210Sae TOK_PRIVATEOFF, 297316444Sae 298346212Sae /* NAT64 CLAT tokens */ 299346212Sae TOK_NAT64CLAT, 300346212Sae TOK_PLAT_PREFIX, 301346212Sae TOK_CLAT_PREFIX, 302346212Sae 303316444Sae /* NPTv6 tokens */ 304316444Sae TOK_NPTV6, 305316444Sae TOK_INTPREFIX, 306316444Sae TOK_EXTPREFIX, 307316444Sae TOK_PREFIXLEN, 308317045Sae 309317045Sae TOK_TCPSETMSS, 310337461Sae 311337461Sae TOK_SKIPACTION, 312187769Sluigi}; 313272840Smelifaro 314187767Sluigi/* 315187767Sluigi * the following macro returns an error message if we run out of 316187767Sluigi * arguments. 317187767Sluigi */ 318204591Sluigi#define NEED(_p, msg) {if (!_p) errx(EX_USAGE, msg);} 319204591Sluigi#define NEED1(msg) {if (!(*av)) errx(EX_USAGE, msg);} 320187767Sluigi 321270424Smelifarostruct buf_pr { 322270424Smelifaro char *buf; /* allocated buffer */ 323270424Smelifaro char *ptr; /* current pointer */ 324270424Smelifaro size_t size; /* total buffer size */ 325270424Smelifaro size_t avail; /* available storage */ 326270424Smelifaro size_t needed; /* length needed */ 327270424Smelifaro}; 328187787Sluigi 329270424Smelifaroint pr_u64(struct buf_pr *bp, uint64_t *pd, int width); 330270424Smelifaroint bp_alloc(struct buf_pr *b, size_t size); 331270424Smelifarovoid bp_free(struct buf_pr *b); 332270424Smelifaroint bprintf(struct buf_pr *b, char *format, ...); 333270424Smelifaro 334270424Smelifaro 335187767Sluigi/* memory allocation support */ 336187767Sluigivoid *safe_calloc(size_t number, size_t size); 337187767Sluigivoid *safe_realloc(void *ptr, size_t size); 338187767Sluigi 339187770Sluigi/* string comparison functions used for historical compatibility */ 340187767Sluigiint _substrcmp(const char *str1, const char* str2); 341187769Sluigiint _substrcmp2(const char *str1, const char* str2, const char* str3); 342272840Smelifaroint stringnum_cmp(const char *a, const char *b); 343187767Sluigi 344187770Sluigi/* utility functions */ 345298016Saeint match_token(struct _s_x *table, const char *string); 346298016Saeint match_token_relaxed(struct _s_x *table, const char *string); 347298016Saeint get_token(struct _s_x *table, const char *string, const char *errbase); 348187770Sluigichar const *match_value(struct _s_x *p, int value); 349272840Smelifarosize_t concat_tokens(char *buf, size_t bufsize, struct _s_x *table, 350272840Smelifaro char *delimiter); 351272840Smelifaroint fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set, 352272840Smelifaro uint32_t *clear); 353272840Smelifarovoid print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set); 354187770Sluigi 355272840Smelifarostruct _ip_fw3_opheader; 356187769Sluigiint do_cmd(int optname, void *optval, uintptr_t optlen); 357316274Saeint do_set3(int optname, struct _ip_fw3_opheader *op3, size_t optlen); 358272840Smelifaroint do_get3(int optname, struct _ip_fw3_opheader *op3, size_t *optlen); 359187769Sluigi 360187769Sluigistruct in6_addr; 361187769Sluigivoid n2mask(struct in6_addr *mask, int n); 362187770Sluigiint contigmask(uint8_t *p, int len); 363187769Sluigi 364187819Sluigi/* 365187819Sluigi * Forward declarations to avoid include way too many headers. 366187819Sluigi * C does not allow duplicated typedefs, so we use the base struct 367187819Sluigi * that the typedef points to. 368187819Sluigi * Should the typedefs use a different type, the compiler will 369187819Sluigi * still detect the change when compiling the body of the 370187819Sluigi * functions involved, so we do not lose error checking. 371187819Sluigi */ 372187819Sluigistruct _ipfw_insn; 373187983Sluigistruct _ipfw_insn_altq; 374187819Sluigistruct _ipfw_insn_u32; 375187819Sluigistruct _ipfw_insn_ip6; 376187819Sluigistruct _ipfw_insn_icmp6; 377187769Sluigi 378187767Sluigi/* 379187767Sluigi * The reserved set numer. This is a constant in ip_fw.h 380187767Sluigi * but we store it in a variable so other files do not depend 381187767Sluigi * in that header just for one constant. 382187767Sluigi */ 383187767Sluigiextern int resvd_set_number; 384187767Sluigi 385187770Sluigi/* first-level command handlers */ 386204591Sluigivoid ipfw_add(char *av[]); 387187767Sluigivoid ipfw_show_nat(int ac, char **av); 388359649Saeint ipfw_delete_nat(int i); 389187767Sluigivoid ipfw_config_pipe(int ac, char **av); 390187767Sluigivoid ipfw_config_nat(int ac, char **av); 391204591Sluigivoid ipfw_sets_handler(char *av[]); 392187767Sluigivoid ipfw_table_handler(int ac, char *av[]); 393204591Sluigivoid ipfw_sysctl_handler(char *av[], int which); 394204591Sluigivoid ipfw_delete(char *av[]); 395187767Sluigivoid ipfw_flush(int force); 396187767Sluigivoid ipfw_zero(int ac, char *av[], int optname); 397187767Sluigivoid ipfw_list(int ac, char *av[], int show_counters); 398272840Smelifarovoid ipfw_internal_handler(int ac, char *av[]); 399346212Saevoid ipfw_nat64clat_handler(int ac, char *av[]); 400316446Saevoid ipfw_nat64lsn_handler(int ac, char *av[]); 401316446Saevoid ipfw_nat64stl_handler(int ac, char *av[]); 402316444Saevoid ipfw_nptv6_handler(int ac, char *av[]); 403298016Saeint ipfw_check_object_name(const char *name); 404334836Saeint ipfw_check_nat64prefix(const struct in6_addr *prefix, int length); 405187767Sluigi 406261797Sglebius#ifdef PF 407187983Sluigi/* altq.c */ 408187983Sluigivoid altq_set_enabled(int enabled); 409187983Sluigiu_int32_t altq_name_to_qid(const char *name); 410270424Smelifarovoid print_altq_cmd(struct buf_pr *bp, struct _ipfw_insn_altq *altqptr); 411261797Sglebius#else 412261797Sglebius#define NO_ALTQ 413261797Sglebius#endif 414187983Sluigi 415187770Sluigi/* dummynet.c */ 416204591Sluigivoid dummynet_list(int ac, char *av[], int show_counters); 417204591Sluigivoid dummynet_flush(void); 418187769Sluigiint ipfw_delete_pipe(int pipe_or_queue, int n); 419187769Sluigi 420187770Sluigi/* ipv6.c */ 421297981Saevoid print_unreach6_code(struct buf_pr *bp, uint16_t code); 422332763Saevoid print_ip6(struct buf_pr *bp, struct _ipfw_insn_ip6 *cmd); 423270424Smelifarovoid print_flow6id(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd); 424270424Smelifarovoid print_icmp6types(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd); 425270424Smelifarovoid print_ext6hdr(struct buf_pr *bp, struct _ipfw_insn *cmd ); 426187770Sluigi 427308970Saestruct tidx; 428308970Saestruct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av, int cblen, 429308970Sae struct tidx *tstate); 430308970Saestruct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av, int cblen, 431308970Sae struct tidx *tstate); 432187770Sluigi 433247712Smelifarovoid fill_flow6(struct _ipfw_insn_u32 *cmd, char *av, int cblen); 434187770Sluigivoid fill_unreach6_code(u_short *codep, char *str); 435247712Smelifarovoid fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av, int cblen); 436187819Sluigiint fill_ext6hdr(struct _ipfw_insn *cmd, char *av); 437272840Smelifaro 438302979Sae/* ipfw2.c */ 439302979Saevoid bp_flush(struct buf_pr *b); 440308970Saevoid fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode, 441308970Sae struct tidx *tstate); 442302979Sae 443272840Smelifaro/* tables.c */ 444272840Smelifarostruct _ipfw_obj_ctlv; 445316446Saestruct _ipfw_obj_ntlv; 446298016Saeint table_check_name(const char *tablename); 447272840Smelifarovoid ipfw_list_ta(int ac, char *av[]); 448272840Smelifarovoid ipfw_list_values(int ac, char *av[]); 449316446Saevoid table_fill_ntlv(struct _ipfw_obj_ntlv *ntlv, const char *name, 450316446Sae uint8_t set, uint16_t uidx); 451272840Smelifaro 452