ipfw2.h revision 187770
1290650Shselasky/* 2322151Shselasky * Copyright (c) 2002-2003 Luigi Rizzo 3290650Shselasky * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4290650Shselasky * Copyright (c) 1994 Ugen J.S.Antsilevich 5290650Shselasky * 6290650Shselasky * Idea and grammar partially left from: 7290650Shselasky * Copyright (c) 1993 Daniel Boulet 8290650Shselasky * 9290650Shselasky * Redistribution and use in source forms, with and without modification, 10290650Shselasky * are permitted provided that this entire comment appears intact. 11290650Shselasky * 12290650Shselasky * Redistribution in binary form may occur without any restrictions. 13290650Shselasky * Obviously, it would be nice if you gave credit where credit is due 14290650Shselasky * but requiring it would be too onerous. 15290650Shselasky * 16290650Shselasky * This software is provided ``AS IS'' without any warranties of any kind. 17290650Shselasky * 18290650Shselasky * NEW command line interface for IP firewall facility 19290650Shselasky * 20290650Shselasky * $FreeBSD: head/sbin/ipfw/ipfw2.h 187770 2009-01-27 12:01:30Z luigi $ 21290650Shselasky */ 22290650Shselasky 23290650Shselasky/* 24290650Shselasky * Options that can be set on the command line. 25290650Shselasky * When reading commands from a file, a subset of the options can also 26290650Shselasky * be applied globally by specifying them before the file name. 27290650Shselasky * After that, each line can contain its own option that changes 28290650Shselasky * the global value. 29290650Shselasky * XXX The context is not restored after each line. 30290650Shselasky */ 31290650Shselasky 32290650Shselaskystruct cmdline_opts { 33290650Shselasky /* boolean options: */ 34290650Shselasky int do_value_as_ip; /* show table value as IP */ 35290650Shselasky int do_resolv; /* try to resolve all ip to names */ 36302270Shselasky int do_time; /* Show time stamps */ 37290650Shselasky int do_quiet; /* Be quiet in add and flush */ 38290650Shselasky int do_pipe; /* this cmd refers to a pipe */ 39290650Shselasky int do_nat; /* this cmd refers to a nat config */ 40290650Shselasky int do_dynamic; /* display dynamic rules */ 41290650Shselasky int do_expired; /* display expired dynamic rules */ 42290650Shselasky int do_compact; /* show rules in compact mode */ 43290650Shselasky int do_force; /* do not ask for confirmation */ 44290650Shselasky int show_sets; /* display the set each rule belongs to */ 45306244Shselasky int test_only; /* only check syntax */ 46322145Shselasky int comment_only; /* only print action and comment */ 47306244Shselasky int verbose; /* be verbose on some commands */ 48290650Shselasky 49290650Shselasky /* The options below can have multiple values. */ 50290650Shselasky 51290650Shselasky int do_sort; /* field to sort results (0 = no) */ 52290650Shselasky /* valid fields are 1 and above */ 53290650Shselasky 54306244Shselasky int use_set; /* work with specified set number */ 55290650Shselasky /* 0 means all sets, otherwise apply to set use_set - 1 */ 56290650Shselasky 57290650Shselasky}; 58290650Shselasky 59290650Shselaskyextern struct cmdline_opts co; 60290650Shselasky 61290650Shselasky/* 62290650Shselasky * _s_x is a structure that stores a string <-> token pairs, used in 63290650Shselasky * various places in the parser. Entries are stored in arrays, 64290650Shselasky * with an entry with s=NULL as terminator. 65290650Shselasky * The search routines are match_token() and match_value(). 66290650Shselasky * Often, an element with x=0 contains an error string. 67290650Shselasky * 68290650Shselasky */ 69290650Shselaskystruct _s_x { 70290650Shselasky char const *s; 71290650Shselasky int x; 72290650Shselasky}; 73290650Shselasky 74290650Shselaskyenum tokens { 75290650Shselasky TOK_NULL=0, 76290650Shselasky 77290650Shselasky TOK_OR, 78290650Shselasky TOK_NOT, 79290650Shselasky TOK_STARTBRACE, 80290650Shselasky TOK_ENDBRACE, 81290650Shselasky 82290650Shselasky TOK_ACCEPT, 83290650Shselasky TOK_COUNT, 84290650Shselasky TOK_PIPE, 85290650Shselasky TOK_QUEUE, 86290650Shselasky TOK_DIVERT, 87290650Shselasky TOK_TEE, 88306244Shselasky TOK_NETGRAPH, 89306244Shselasky TOK_NGTEE, 90306244Shselasky TOK_FORWARD, 91306244Shselasky TOK_SKIPTO, 92306244Shselasky TOK_DENY, 93306244Shselasky TOK_REJECT, 94306244Shselasky TOK_RESET, 95306244Shselasky TOK_UNREACH, 96306244Shselasky TOK_CHECKSTATE, 97306244Shselasky TOK_NAT, 98290650Shselasky 99290650Shselasky TOK_ALTQ, 100290650Shselasky TOK_LOG, 101306244Shselasky TOK_TAG, 102306244Shselasky TOK_UNTAG, 103306244Shselasky 104306244Shselasky TOK_TAGGED, 105306244Shselasky TOK_UID, 106306244Shselasky TOK_GID, 107306244Shselasky TOK_JAIL, 108306244Shselasky TOK_IN, 109306244Shselasky TOK_LIMIT, 110306244Shselasky TOK_KEEPSTATE, 111306244Shselasky TOK_LAYER2, 112306244Shselasky TOK_OUT, 113306244Shselasky TOK_DIVERTED, 114306244Shselasky TOK_DIVERTEDLOOPBACK, 115306244Shselasky TOK_DIVERTEDOUTPUT, 116306244Shselasky TOK_XMIT, 117306244Shselasky TOK_RECV, 118306244Shselasky TOK_VIA, 119306244Shselasky TOK_FRAG, 120306244Shselasky TOK_IPOPTS, 121290650Shselasky TOK_IPLEN, 122290650Shselasky TOK_IPID, 123290650Shselasky TOK_IPPRECEDENCE, 124308684Shselasky TOK_IPTOS, 125306244Shselasky TOK_IPTTL, 126306244Shselasky TOK_IPVER, 127290650Shselasky TOK_ESTAB, 128290650Shselasky TOK_SETUP, 129290650Shselasky TOK_TCPDATALEN, 130290650Shselasky TOK_TCPFLAGS, 131290650Shselasky TOK_TCPOPTS, 132290650Shselasky TOK_TCPSEQ, 133290650Shselasky TOK_TCPACK, 134290650Shselasky TOK_TCPWIN, 135290650Shselasky TOK_ICMPTYPES, 136290650Shselasky TOK_MAC, 137290650Shselasky TOK_MACTYPE, 138290650Shselasky TOK_VERREVPATH, 139290650Shselasky TOK_VERSRCREACH, 140290650Shselasky TOK_ANTISPOOF, 141290650Shselasky TOK_IPSEC, 142290650Shselasky TOK_COMMENT, 143290650Shselasky 144306244Shselasky TOK_PLR, 145290650Shselasky TOK_NOERROR, 146290650Shselasky TOK_BUCKETS, 147290650Shselasky TOK_DSTIP, 148290650Shselasky TOK_SRCIP, 149290650Shselasky TOK_DSTPORT, 150290650Shselasky TOK_SRCPORT, 151290650Shselasky TOK_ALL, 152290650Shselasky TOK_MASK, 153306244Shselasky TOK_BW, 154306244Shselasky TOK_DELAY, 155306244Shselasky TOK_RED, 156306244Shselasky TOK_GRED, 157306244Shselasky TOK_DROPTAIL, 158306244Shselasky TOK_PROTO, 159290650Shselasky TOK_WEIGHT, 160290650Shselasky TOK_IP, 161290650Shselasky TOK_IF, 162290650Shselasky TOK_ALOG, 163290650Shselasky TOK_DENY_INC, 164290650Shselasky TOK_SAME_PORTS, 165290650Shselasky TOK_UNREG_ONLY, 166290650Shselasky TOK_RESET_ADDR, 167290650Shselasky TOK_ALIAS_REV, 168290650Shselasky TOK_PROXY_ONLY, 169290650Shselasky TOK_REDIR_ADDR, 170290650Shselasky TOK_REDIR_PORT, 171290650Shselasky TOK_REDIR_PROTO, 172290650Shselasky 173290650Shselasky TOK_IPV6, 174290650Shselasky TOK_FLOWID, 175290650Shselasky TOK_ICMP6TYPES, 176290650Shselasky TOK_EXT6HDR, 177290650Shselasky TOK_DSTIP6, 178290650Shselasky TOK_SRCIP6, 179290650Shselasky 180290650Shselasky TOK_IPV4, 181290650Shselasky TOK_UNREACH6, 182306244Shselasky TOK_RESET6, 183306244Shselasky 184306244Shselasky TOK_FIB, 185306244Shselasky TOK_SETFIB, 186290650Shselasky}; 187290650Shselasky/* 188290650Shselasky * the following macro returns an error message if we run out of 189290650Shselasky * arguments. 190290650Shselasky */ 191290650Shselasky#define NEED1(msg) {if (!ac) errx(EX_USAGE, msg);} 192290650Shselasky 193290650Shselasky/* memory allocation support */ 194290650Shselaskyvoid *safe_calloc(size_t number, size_t size); 195290650Shselaskyvoid *safe_realloc(void *ptr, size_t size); 196290650Shselasky 197290650Shselasky/* string comparison functions used for historical compatibility */ 198290650Shselaskyint _substrcmp(const char *str1, const char* str2); 199290650Shselaskyint _substrcmp2(const char *str1, const char* str2, const char* str3); 200290650Shselasky 201290650Shselasky/* utility functions */ 202290650Shselaskyint match_token(struct _s_x *table, char *string); 203290650Shselaskychar const *match_value(struct _s_x *p, int value); 204290650Shselasky 205290650Shselaskyint do_cmd(int optname, void *optval, uintptr_t optlen); 206290650Shselasky 207290650Shselaskystruct in6_addr; 208290650Shselaskyvoid n2mask(struct in6_addr *mask, int n); 209290650Shselaskyint contigmask(uint8_t *p, int len); 210290650Shselasky 211290650Shselasky/* forward declarations to avoid header dependency */ 212290650Shselaskytypedef struct _ipfw_insn ipfw_insn; 213290650Shselaskytypedef struct _ipfw_insn_u32 ipfw_insn_u32; 214290650Shselaskytypedef struct _ipfw_insn_ip6 ipfw_insn_ip6; 215290650Shselaskytypedef struct _ipfw_insn_icmp6 ipfw_insn_icmp6; 216290650Shselasky 217290650Shselasky 218290650Shselasky/* 219290650Shselasky * The reserved set numer. This is a constant in ip_fw.h 220290650Shselasky * but we store it in a variable so other files do not depend 221290650Shselasky * in that header just for one constant. 222290650Shselasky */ 223290650Shselaskyextern int resvd_set_number; 224290650Shselasky 225290650Shselasky/* first-level command handlers */ 226290650Shselaskyvoid ipfw_add(int ac, char *av[]); 227290650Shselaskyvoid ipfw_show_nat(int ac, char **av); 228290650Shselaskyvoid ipfw_config_pipe(int ac, char **av); 229290650Shselaskyvoid ipfw_config_nat(int ac, char **av); 230290650Shselaskyvoid ipfw_sets_handler(int ac, char *av[]); 231290650Shselaskyvoid ipfw_table_handler(int ac, char *av[]); 232290650Shselaskyvoid ipfw_sysctl_handler(int ac, char *av[], int which); 233290650Shselaskyvoid ipfw_delete(int ac, char *av[]); 234290650Shselaskyvoid ipfw_flush(int force); 235290650Shselaskyvoid ipfw_zero(int ac, char *av[], int optname); 236290650Shselaskyvoid ipfw_list(int ac, char *av[], int show_counters); 237290650Shselasky 238290650Shselasky/* dummynet.c */ 239290650Shselaskyvoid ipfw_list_pipes(void *data, uint nbytes, int ac, char *av[]); 240290650Shselaskyint ipfw_delete_pipe(int pipe_or_queue, int n); 241290650Shselasky 242290650Shselasky/* ipv6.c */ 243290650Shselaskyvoid print_unreach6_code(uint16_t code); 244290650Shselaskyvoid print_ip6(ipfw_insn_ip6 *cmd, char const *s); 245290650Shselaskyvoid print_flow6id( ipfw_insn_u32 *cmd); 246290650Shselaskyvoid print_icmp6types(ipfw_insn_u32 *cmd); 247290650Shselaskyvoid print_ext6hdr( ipfw_insn *cmd ); 248290650Shselasky 249290650Shselaskyipfw_insn *add_srcip6(ipfw_insn *cmd, char *av); 250290650Shselaskyipfw_insn *add_dstip6(ipfw_insn *cmd, char *av); 251290650Shselasky 252290650Shselaskyvoid fill_flow6( ipfw_insn_u32 *cmd, char *av ); 253290650Shselaskyvoid fill_unreach6_code(u_short *codep, char *str); 254290650Shselaskyvoid fill_icmp6types(ipfw_insn_icmp6 *cmd, char *av); 255290650Shselaskyint fill_ext6hdr( ipfw_insn *cmd, char *av); 256290650Shselasky