ipfw2.h revision 359695 
1/*
2 * Copyright (c) 2002-2003 Luigi Rizzo
3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
4 * Copyright (c) 1994 Ugen J.S.Antsilevich
5 *
6 * Idea and grammar partially left from:
7 * Copyright (c) 1993 Daniel Boulet
8 *
9 * Redistribution and use in source forms, with and without modification,
10 * are permitted provided that this entire comment appears intact.
11 *
12 * Redistribution in binary form may occur without any restrictions.
13 * Obviously, it would be nice if you gave credit where credit is due
14 * but requiring it would be too onerous.
15 *
16 * This software is provided ``AS IS'' without any warranties of any kind.
17 *
18 * NEW command line interface for IP firewall facility
19 *
20 * $FreeBSD: stable/11/sbin/ipfw/ipfw2.h 359695 2020-04-07 16:29:11Z eugen $
21 */
22
23/*
24 * Options that can be set on the command line.
25 * When reading commands from a file, a subset of the options can also
26 * be applied globally by specifying them before the file name.
27 * After that, each line can contain its own option that changes
28 * the global value.
29 * XXX The context is not restored after each line.
30 */
31
32struct cmdline_opts {
33	/* boolean options: */
34	int	do_value_as_ip;	/* show table value as IP */
35	int	do_resolv;	/* try to resolve all ip to names */
36	int	do_time;	/* Show time stamps */
37	int	do_quiet;	/* Be quiet in add and flush */
38	int	do_pipe;	/* this cmd refers to a pipe/queue/sched */
39	int	do_nat; 	/* this cmd refers to a nat config */
40	int	do_compact;	/* show rules in compact mode */
41	int	do_force;	/* do not ask for confirmation */
42	int	show_sets;	/* display the set each rule belongs to */
43	int	test_only;	/* only check syntax */
44	int	comment_only;	/* only print action and comment */
45	int	verbose;	/* be verbose on some commands */
46
47	/* The options below can have multiple values. */
48
49	int	do_dynamic;	/* 1 - display dynamic rules */
50				/* 2 - display/delete only dynamic rules */
51	int	do_sort;	/* field to sort results (0 = no) */
52		/* valid fields are 1 and above */
53
54	int	use_set;	/* work with specified set number */
55		/* 0 means all sets, otherwise apply to set use_set - 1 */
56
57};
58
59enum {
60	TIMESTAMP_NONE = 0,
61	TIMESTAMP_STRING,
62	TIMESTAMP_NUMERIC,
63};
64
65extern struct cmdline_opts co;
66
67/*
68 * _s_x is a structure that stores a string <-> token pairs, used in
69 * various places in the parser. Entries are stored in arrays,
70 * with an entry with s=NULL as terminator.
71 * The search routines are match_token() and match_value().
72 * Often, an element with x=0 contains an error string.
73 *
74 */
75struct _s_x {
76	char const *s;
77	int x;
78};
79
80extern struct _s_x f_ipdscp[];
81
82enum tokens {
83	TOK_NULL=0,
84
85	TOK_OR,
86	TOK_NOT,
87	TOK_STARTBRACE,
88	TOK_ENDBRACE,
89
90	TOK_ABORT6,
91	TOK_ABORT,
92	TOK_ACCEPT,
93	TOK_COUNT,
94	TOK_EACTION,
95	TOK_PIPE,
96	TOK_LINK,
97	TOK_QUEUE,
98	TOK_FLOWSET,
99	TOK_SCHED,
100	TOK_DIVERT,
101	TOK_TEE,
102	TOK_NETGRAPH,
103	TOK_NGTEE,
104	TOK_FORWARD,
105	TOK_SKIPTO,
106	TOK_DENY,
107	TOK_REJECT,
108	TOK_RESET,
109	TOK_UNREACH,
110	TOK_CHECKSTATE,
111	TOK_NAT,
112	TOK_REASS,
113	TOK_CALL,
114	TOK_RETURN,
115
116	TOK_ALTQ,
117	TOK_LOG,
118	TOK_TAG,
119	TOK_UNTAG,
120
121	TOK_TAGGED,
122	TOK_UID,
123	TOK_GID,
124	TOK_JAIL,
125	TOK_IN,
126	TOK_LIMIT,
127	TOK_SETLIMIT,
128	TOK_KEEPSTATE,
129	TOK_RECORDSTATE,
130	TOK_LAYER2,
131	TOK_OUT,
132	TOK_DIVERTED,
133	TOK_DIVERTEDLOOPBACK,
134	TOK_DIVERTEDOUTPUT,
135	TOK_XMIT,
136	TOK_RECV,
137	TOK_VIA,
138	TOK_FRAG,
139	TOK_IPOPTS,
140	TOK_IPLEN,
141	TOK_IPID,
142	TOK_IPPRECEDENCE,
143	TOK_DSCP,
144	TOK_IPTOS,
145	TOK_IPTTL,
146	TOK_IPVER,
147	TOK_ESTAB,
148	TOK_SETUP,
149	TOK_TCPDATALEN,
150	TOK_TCPFLAGS,
151	TOK_TCPOPTS,
152	TOK_TCPSEQ,
153	TOK_TCPACK,
154	TOK_TCPMSS,
155	TOK_TCPWIN,
156	TOK_ICMPTYPES,
157	TOK_MAC,
158	TOK_MACTYPE,
159	TOK_VERREVPATH,
160	TOK_VERSRCREACH,
161	TOK_ANTISPOOF,
162	TOK_IPSEC,
163	TOK_COMMENT,
164
165	TOK_PLR,
166	TOK_NOERROR,
167	TOK_BUCKETS,
168	TOK_DSTIP,
169	TOK_SRCIP,
170	TOK_DSTPORT,
171	TOK_SRCPORT,
172	TOK_ALL,
173	TOK_MASK,
174	TOK_FLOW_MASK,
175	TOK_SCHED_MASK,
176	TOK_BW,
177	TOK_DELAY,
178	TOK_PROFILE,
179	TOK_BURST,
180	TOK_RED,
181	TOK_GRED,
182	TOK_ECN,
183	TOK_DROPTAIL,
184	TOK_PROTO,
185#ifdef NEW_AQM
186	/* AQM tokens*/
187	TOK_NO_ECN,
188	TOK_CODEL,
189	TOK_FQ_CODEL,
190	TOK_TARGET,
191	TOK_INTERVAL,
192	TOK_FLOWS,
193	TOK_QUANTUM,
194
195	TOK_PIE,
196	TOK_FQ_PIE,
197	TOK_TUPDATE,
198	TOK_MAX_BURST,
199	TOK_MAX_ECNTH,
200	TOK_ALPHA,
201	TOK_BETA,
202	TOK_CAPDROP,
203	TOK_NO_CAPDROP,
204	TOK_ONOFF,
205	TOK_DRE,
206	TOK_TS,
207	TOK_DERAND,
208	TOK_NO_DERAND,
209#endif
210	/* dummynet tokens */
211	TOK_WEIGHT,
212	TOK_LMAX,
213	TOK_PRI,
214	TOK_TYPE,
215	TOK_SLOTSIZE,
216
217	TOK_IP,
218	TOK_IF,
219	TOK_ALOG,
220	TOK_DENY_INC,
221	TOK_SAME_PORTS,
222	TOK_UNREG_ONLY,
223	TOK_UNREG_CGN,
224	TOK_SKIP_GLOBAL,
225	TOK_RESET_ADDR,
226	TOK_ALIAS_REV,
227	TOK_PROXY_ONLY,
228	TOK_REDIR_ADDR,
229	TOK_REDIR_PORT,
230	TOK_REDIR_PROTO,
231
232	TOK_IPV6,
233	TOK_FLOWID,
234	TOK_ICMP6TYPES,
235	TOK_EXT6HDR,
236	TOK_DSTIP6,
237	TOK_SRCIP6,
238
239	TOK_IPV4,
240	TOK_UNREACH6,
241	TOK_RESET6,
242
243	TOK_FIB,
244	TOK_SETFIB,
245	TOK_LOOKUP,
246	TOK_SOCKARG,
247	TOK_SETDSCP,
248	TOK_FLOW,
249	TOK_IFLIST,
250	/* Table tokens */
251	TOK_CREATE,
252	TOK_DESTROY,
253	TOK_LIST,
254	TOK_INFO,
255	TOK_DETAIL,
256	TOK_MODIFY,
257	TOK_FLUSH,
258	TOK_SWAP,
259	TOK_ADD,
260	TOK_DEL,
261	TOK_VALTYPE,
262	TOK_ALGO,
263	TOK_TALIST,
264	TOK_ATOMIC,
265	TOK_LOCK,
266	TOK_UNLOCK,
267	TOK_VLIST,
268	TOK_OLIST,
269	TOK_MISSING,
270	TOK_ORFLUSH,
271
272	/* NAT64 tokens */
273	TOK_NAT64STL,
274	TOK_NAT64LSN,
275	TOK_STATS,
276	TOK_STATES,
277	TOK_CONFIG,
278	TOK_TABLE4,
279	TOK_TABLE6,
280	TOK_PREFIX4,
281	TOK_PREFIX6,
282	TOK_AGG_LEN,
283	TOK_AGG_COUNT,
284	TOK_MAX_PORTS,
285	TOK_JMAXLEN,
286	TOK_PORT_RANGE,
287	TOK_HOST_DEL_AGE,
288	TOK_PG_DEL_AGE,
289	TOK_TCP_SYN_AGE,
290	TOK_TCP_CLOSE_AGE,
291	TOK_TCP_EST_AGE,
292	TOK_UDP_AGE,
293	TOK_ICMP_AGE,
294	TOK_LOGOFF,
295	TOK_PRIVATE,
296	TOK_PRIVATEOFF,
297
298	/* NAT64 CLAT tokens */
299	TOK_NAT64CLAT,
300	TOK_PLAT_PREFIX,
301	TOK_CLAT_PREFIX,
302
303	/* NPTv6 tokens */
304	TOK_NPTV6,
305	TOK_INTPREFIX,
306	TOK_EXTPREFIX,
307	TOK_PREFIXLEN,
308
309	TOK_TCPSETMSS,
310
311	TOK_SKIPACTION,
312};
313
314/*
315 * the following macro returns an error message if we run out of
316 * arguments.
317 */
318#define NEED(_p, msg)      {if (!_p) errx(EX_USAGE, msg);}
319#define NEED1(msg)      {if (!(*av)) errx(EX_USAGE, msg);}
320
321struct buf_pr {
322	char	*buf;	/* allocated buffer */
323	char	*ptr;	/* current pointer */
324	size_t	size;	/* total buffer size */
325	size_t	avail;	/* available storage */
326	size_t	needed;	/* length needed */
327};
328
329int pr_u64(struct buf_pr *bp, uint64_t *pd, int width);
330int bp_alloc(struct buf_pr *b, size_t size);
331void bp_free(struct buf_pr *b);
332int bprintf(struct buf_pr *b, char *format, ...);
333
334
335/* memory allocation support */
336void *safe_calloc(size_t number, size_t size);
337void *safe_realloc(void *ptr, size_t size);
338
339/* string comparison functions used for historical compatibility */
340int _substrcmp(const char *str1, const char* str2);
341int _substrcmp2(const char *str1, const char* str2, const char* str3);
342int stringnum_cmp(const char *a, const char *b);
343
344/* utility functions */
345int match_token(struct _s_x *table, const char *string);
346int match_token_relaxed(struct _s_x *table, const char *string);
347int get_token(struct _s_x *table, const char *string, const char *errbase);
348char const *match_value(struct _s_x *p, int value);
349size_t concat_tokens(char *buf, size_t bufsize, struct _s_x *table,
350    char *delimiter);
351int fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set,
352    uint32_t *clear);
353void print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set);
354
355struct _ip_fw3_opheader;
356int do_cmd(int optname, void *optval, uintptr_t optlen);
357int do_set3(int optname, struct _ip_fw3_opheader *op3, size_t optlen);
358int do_get3(int optname, struct _ip_fw3_opheader *op3, size_t *optlen);
359
360struct in6_addr;
361void n2mask(struct in6_addr *mask, int n);
362int contigmask(uint8_t *p, int len);
363
364/*
365 * Forward declarations to avoid include way too many headers.
366 * C does not allow duplicated typedefs, so we use the base struct
367 * that the typedef points to.
368 * Should the typedefs use a different type, the compiler will
369 * still detect the change when compiling the body of the
370 * functions involved, so we do not lose error checking.
371 */
372struct _ipfw_insn;
373struct _ipfw_insn_altq;
374struct _ipfw_insn_u32;
375struct _ipfw_insn_ip6;
376struct _ipfw_insn_icmp6;
377
378/*
379 * The reserved set numer. This is a constant in ip_fw.h
380 * but we store it in a variable so other files do not depend
381 * in that header just for one constant.
382 */
383extern int resvd_set_number;
384
385/* first-level command handlers */
386void ipfw_add(char *av[]);
387void ipfw_show_nat(int ac, char **av);
388int ipfw_delete_nat(int i);
389void ipfw_config_pipe(int ac, char **av);
390void ipfw_config_nat(int ac, char **av);
391void ipfw_sets_handler(char *av[]);
392void ipfw_table_handler(int ac, char *av[]);
393void ipfw_sysctl_handler(char *av[], int which);
394void ipfw_delete(char *av[]);
395void ipfw_flush(int force);
396void ipfw_zero(int ac, char *av[], int optname);
397void ipfw_list(int ac, char *av[], int show_counters);
398void ipfw_internal_handler(int ac, char *av[]);
399void ipfw_nat64clat_handler(int ac, char *av[]);
400void ipfw_nat64lsn_handler(int ac, char *av[]);
401void ipfw_nat64stl_handler(int ac, char *av[]);
402void ipfw_nptv6_handler(int ac, char *av[]);
403int ipfw_check_object_name(const char *name);
404int ipfw_check_nat64prefix(const struct in6_addr *prefix, int length);
405
406#ifdef PF
407/* altq.c */
408void altq_set_enabled(int enabled);
409u_int32_t altq_name_to_qid(const char *name);
410void print_altq_cmd(struct buf_pr *bp, struct _ipfw_insn_altq *altqptr);
411#else
412#define NO_ALTQ
413#endif
414
415/* dummynet.c */
416void dummynet_list(int ac, char *av[], int show_counters);
417void dummynet_flush(void);
418int ipfw_delete_pipe(int pipe_or_queue, int n);
419
420/* ipv6.c */
421void print_unreach6_code(struct buf_pr *bp, uint16_t code);
422void print_ip6(struct buf_pr *bp, struct _ipfw_insn_ip6 *cmd);
423void print_flow6id(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd);
424void print_icmp6types(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd);
425void print_ext6hdr(struct buf_pr *bp, struct _ipfw_insn *cmd );
426
427struct tidx;
428struct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av, int cblen,
429    struct tidx *tstate);
430struct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av, int cblen,
431    struct tidx *tstate);
432
433void fill_flow6(struct _ipfw_insn_u32 *cmd, char *av, int cblen);
434void fill_unreach6_code(u_short *codep, char *str);
435void fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av, int cblen);
436int fill_ext6hdr(struct _ipfw_insn *cmd, char *av);
437
438/* ipfw2.c */
439void bp_flush(struct buf_pr *b);
440void fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode,
441    struct tidx *tstate);
442
443/* tables.c */
444struct _ipfw_obj_ctlv;
445struct _ipfw_obj_ntlv;
446int table_check_name(const char *tablename);
447void ipfw_list_ta(int ac, char *av[]);
448void ipfw_list_values(int ac, char *av[]);
449void table_fill_ntlv(struct _ipfw_obj_ntlv *ntlv, const char *name,
450    uint8_t set, uint16_t uidx);
451
452