ipfw2.h revision 359649
1/* 2 * Copyright (c) 2002-2003 Luigi Rizzo 3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4 * Copyright (c) 1994 Ugen J.S.Antsilevich 5 * 6 * Idea and grammar partially left from: 7 * Copyright (c) 1993 Daniel Boulet 8 * 9 * Redistribution and use in source forms, with and without modification, 10 * are permitted provided that this entire comment appears intact. 11 * 12 * Redistribution in binary form may occur without any restrictions. 13 * Obviously, it would be nice if you gave credit where credit is due 14 * but requiring it would be too onerous. 15 * 16 * This software is provided ``AS IS'' without any warranties of any kind. 17 * 18 * NEW command line interface for IP firewall facility 19 * 20 * $FreeBSD: stable/11/sbin/ipfw/ipfw2.h 359649 2020-04-06 06:38:54Z ae $ 21 */ 22 23/* 24 * Options that can be set on the command line. 25 * When reading commands from a file, a subset of the options can also 26 * be applied globally by specifying them before the file name. 27 * After that, each line can contain its own option that changes 28 * the global value. 29 * XXX The context is not restored after each line. 30 */ 31 32struct cmdline_opts { 33 /* boolean options: */ 34 int do_value_as_ip; /* show table value as IP */ 35 int do_resolv; /* try to resolve all ip to names */ 36 int do_time; /* Show time stamps */ 37 int do_quiet; /* Be quiet in add and flush */ 38 int do_pipe; /* this cmd refers to a pipe/queue/sched */ 39 int do_nat; /* this cmd refers to a nat config */ 40 int do_compact; /* show rules in compact mode */ 41 int do_force; /* do not ask for confirmation */ 42 int show_sets; /* display the set each rule belongs to */ 43 int test_only; /* only check syntax */ 44 int comment_only; /* only print action and comment */ 45 int verbose; /* be verbose on some commands */ 46 47 /* The options below can have multiple values. */ 48 49 int do_dynamic; /* 1 - display dynamic rules */ 50 /* 2 - display/delete only dynamic rules */ 51 int do_sort; /* field to sort results (0 = no) */ 52 /* valid fields are 1 and above */ 53 54 int use_set; /* work with specified set number */ 55 /* 0 means all sets, otherwise apply to set use_set - 1 */ 56 57}; 58 59enum { 60 TIMESTAMP_NONE = 0, 61 TIMESTAMP_STRING, 62 TIMESTAMP_NUMERIC, 63}; 64 65extern struct cmdline_opts co; 66 67/* 68 * _s_x is a structure that stores a string <-> token pairs, used in 69 * various places in the parser. Entries are stored in arrays, 70 * with an entry with s=NULL as terminator. 71 * The search routines are match_token() and match_value(). 72 * Often, an element with x=0 contains an error string. 73 * 74 */ 75struct _s_x { 76 char const *s; 77 int x; 78}; 79 80extern struct _s_x f_ipdscp[]; 81 82enum tokens { 83 TOK_NULL=0, 84 85 TOK_OR, 86 TOK_NOT, 87 TOK_STARTBRACE, 88 TOK_ENDBRACE, 89 90 TOK_ABORT6, 91 TOK_ABORT, 92 TOK_ACCEPT, 93 TOK_COUNT, 94 TOK_EACTION, 95 TOK_PIPE, 96 TOK_LINK, 97 TOK_QUEUE, 98 TOK_FLOWSET, 99 TOK_SCHED, 100 TOK_DIVERT, 101 TOK_TEE, 102 TOK_NETGRAPH, 103 TOK_NGTEE, 104 TOK_FORWARD, 105 TOK_SKIPTO, 106 TOK_DENY, 107 TOK_REJECT, 108 TOK_RESET, 109 TOK_UNREACH, 110 TOK_CHECKSTATE, 111 TOK_NAT, 112 TOK_REASS, 113 TOK_CALL, 114 TOK_RETURN, 115 116 TOK_ALTQ, 117 TOK_LOG, 118 TOK_TAG, 119 TOK_UNTAG, 120 121 TOK_TAGGED, 122 TOK_UID, 123 TOK_GID, 124 TOK_JAIL, 125 TOK_IN, 126 TOK_LIMIT, 127 TOK_SETLIMIT, 128 TOK_KEEPSTATE, 129 TOK_RECORDSTATE, 130 TOK_LAYER2, 131 TOK_OUT, 132 TOK_DIVERTED, 133 TOK_DIVERTEDLOOPBACK, 134 TOK_DIVERTEDOUTPUT, 135 TOK_XMIT, 136 TOK_RECV, 137 TOK_VIA, 138 TOK_FRAG, 139 TOK_IPOPTS, 140 TOK_IPLEN, 141 TOK_IPID, 142 TOK_IPPRECEDENCE, 143 TOK_DSCP, 144 TOK_IPTOS, 145 TOK_IPTTL, 146 TOK_IPVER, 147 TOK_ESTAB, 148 TOK_SETUP, 149 TOK_TCPDATALEN, 150 TOK_TCPFLAGS, 151 TOK_TCPOPTS, 152 TOK_TCPSEQ, 153 TOK_TCPACK, 154 TOK_TCPMSS, 155 TOK_TCPWIN, 156 TOK_ICMPTYPES, 157 TOK_MAC, 158 TOK_MACTYPE, 159 TOK_VERREVPATH, 160 TOK_VERSRCREACH, 161 TOK_ANTISPOOF, 162 TOK_IPSEC, 163 TOK_COMMENT, 164 165 TOK_PLR, 166 TOK_NOERROR, 167 TOK_BUCKETS, 168 TOK_DSTIP, 169 TOK_SRCIP, 170 TOK_DSTPORT, 171 TOK_SRCPORT, 172 TOK_ALL, 173 TOK_MASK, 174 TOK_FLOW_MASK, 175 TOK_SCHED_MASK, 176 TOK_BW, 177 TOK_DELAY, 178 TOK_PROFILE, 179 TOK_BURST, 180 TOK_RED, 181 TOK_GRED, 182 TOK_ECN, 183 TOK_DROPTAIL, 184 TOK_PROTO, 185#ifdef NEW_AQM 186 /* AQM tokens*/ 187 TOK_NO_ECN, 188 TOK_CODEL, 189 TOK_FQ_CODEL, 190 TOK_TARGET, 191 TOK_INTERVAL, 192 TOK_FLOWS, 193 TOK_QUANTUM, 194 195 TOK_PIE, 196 TOK_FQ_PIE, 197 TOK_TUPDATE, 198 TOK_MAX_BURST, 199 TOK_MAX_ECNTH, 200 TOK_ALPHA, 201 TOK_BETA, 202 TOK_CAPDROP, 203 TOK_NO_CAPDROP, 204 TOK_ONOFF, 205 TOK_DRE, 206 TOK_TS, 207 TOK_DERAND, 208 TOK_NO_DERAND, 209#endif 210 /* dummynet tokens */ 211 TOK_WEIGHT, 212 TOK_LMAX, 213 TOK_PRI, 214 TOK_TYPE, 215 TOK_SLOTSIZE, 216 217 TOK_IP, 218 TOK_IF, 219 TOK_ALOG, 220 TOK_DENY_INC, 221 TOK_SAME_PORTS, 222 TOK_UNREG_ONLY, 223 TOK_SKIP_GLOBAL, 224 TOK_RESET_ADDR, 225 TOK_ALIAS_REV, 226 TOK_PROXY_ONLY, 227 TOK_REDIR_ADDR, 228 TOK_REDIR_PORT, 229 TOK_REDIR_PROTO, 230 231 TOK_IPV6, 232 TOK_FLOWID, 233 TOK_ICMP6TYPES, 234 TOK_EXT6HDR, 235 TOK_DSTIP6, 236 TOK_SRCIP6, 237 238 TOK_IPV4, 239 TOK_UNREACH6, 240 TOK_RESET6, 241 242 TOK_FIB, 243 TOK_SETFIB, 244 TOK_LOOKUP, 245 TOK_SOCKARG, 246 TOK_SETDSCP, 247 TOK_FLOW, 248 TOK_IFLIST, 249 /* Table tokens */ 250 TOK_CREATE, 251 TOK_DESTROY, 252 TOK_LIST, 253 TOK_INFO, 254 TOK_DETAIL, 255 TOK_MODIFY, 256 TOK_FLUSH, 257 TOK_SWAP, 258 TOK_ADD, 259 TOK_DEL, 260 TOK_VALTYPE, 261 TOK_ALGO, 262 TOK_TALIST, 263 TOK_ATOMIC, 264 TOK_LOCK, 265 TOK_UNLOCK, 266 TOK_VLIST, 267 TOK_OLIST, 268 TOK_MISSING, 269 TOK_ORFLUSH, 270 271 /* NAT64 tokens */ 272 TOK_NAT64STL, 273 TOK_NAT64LSN, 274 TOK_STATS, 275 TOK_STATES, 276 TOK_CONFIG, 277 TOK_TABLE4, 278 TOK_TABLE6, 279 TOK_PREFIX4, 280 TOK_PREFIX6, 281 TOK_AGG_LEN, 282 TOK_AGG_COUNT, 283 TOK_MAX_PORTS, 284 TOK_JMAXLEN, 285 TOK_PORT_RANGE, 286 TOK_HOST_DEL_AGE, 287 TOK_PG_DEL_AGE, 288 TOK_TCP_SYN_AGE, 289 TOK_TCP_CLOSE_AGE, 290 TOK_TCP_EST_AGE, 291 TOK_UDP_AGE, 292 TOK_ICMP_AGE, 293 TOK_LOGOFF, 294 TOK_PRIVATE, 295 TOK_PRIVATEOFF, 296 297 /* NAT64 CLAT tokens */ 298 TOK_NAT64CLAT, 299 TOK_PLAT_PREFIX, 300 TOK_CLAT_PREFIX, 301 302 /* NPTv6 tokens */ 303 TOK_NPTV6, 304 TOK_INTPREFIX, 305 TOK_EXTPREFIX, 306 TOK_PREFIXLEN, 307 308 TOK_TCPSETMSS, 309 310 TOK_SKIPACTION, 311}; 312 313/* 314 * the following macro returns an error message if we run out of 315 * arguments. 316 */ 317#define NEED(_p, msg) {if (!_p) errx(EX_USAGE, msg);} 318#define NEED1(msg) {if (!(*av)) errx(EX_USAGE, msg);} 319 320struct buf_pr { 321 char *buf; /* allocated buffer */ 322 char *ptr; /* current pointer */ 323 size_t size; /* total buffer size */ 324 size_t avail; /* available storage */ 325 size_t needed; /* length needed */ 326}; 327 328int pr_u64(struct buf_pr *bp, uint64_t *pd, int width); 329int bp_alloc(struct buf_pr *b, size_t size); 330void bp_free(struct buf_pr *b); 331int bprintf(struct buf_pr *b, char *format, ...); 332 333 334/* memory allocation support */ 335void *safe_calloc(size_t number, size_t size); 336void *safe_realloc(void *ptr, size_t size); 337 338/* string comparison functions used for historical compatibility */ 339int _substrcmp(const char *str1, const char* str2); 340int _substrcmp2(const char *str1, const char* str2, const char* str3); 341int stringnum_cmp(const char *a, const char *b); 342 343/* utility functions */ 344int match_token(struct _s_x *table, const char *string); 345int match_token_relaxed(struct _s_x *table, const char *string); 346int get_token(struct _s_x *table, const char *string, const char *errbase); 347char const *match_value(struct _s_x *p, int value); 348size_t concat_tokens(char *buf, size_t bufsize, struct _s_x *table, 349 char *delimiter); 350int fill_flags(struct _s_x *flags, char *p, char **e, uint32_t *set, 351 uint32_t *clear); 352void print_flags_buffer(char *buf, size_t sz, struct _s_x *list, uint32_t set); 353 354struct _ip_fw3_opheader; 355int do_cmd(int optname, void *optval, uintptr_t optlen); 356int do_set3(int optname, struct _ip_fw3_opheader *op3, size_t optlen); 357int do_get3(int optname, struct _ip_fw3_opheader *op3, size_t *optlen); 358 359struct in6_addr; 360void n2mask(struct in6_addr *mask, int n); 361int contigmask(uint8_t *p, int len); 362 363/* 364 * Forward declarations to avoid include way too many headers. 365 * C does not allow duplicated typedefs, so we use the base struct 366 * that the typedef points to. 367 * Should the typedefs use a different type, the compiler will 368 * still detect the change when compiling the body of the 369 * functions involved, so we do not lose error checking. 370 */ 371struct _ipfw_insn; 372struct _ipfw_insn_altq; 373struct _ipfw_insn_u32; 374struct _ipfw_insn_ip6; 375struct _ipfw_insn_icmp6; 376 377/* 378 * The reserved set numer. This is a constant in ip_fw.h 379 * but we store it in a variable so other files do not depend 380 * in that header just for one constant. 381 */ 382extern int resvd_set_number; 383 384/* first-level command handlers */ 385void ipfw_add(char *av[]); 386void ipfw_show_nat(int ac, char **av); 387int ipfw_delete_nat(int i); 388void ipfw_config_pipe(int ac, char **av); 389void ipfw_config_nat(int ac, char **av); 390void ipfw_sets_handler(char *av[]); 391void ipfw_table_handler(int ac, char *av[]); 392void ipfw_sysctl_handler(char *av[], int which); 393void ipfw_delete(char *av[]); 394void ipfw_flush(int force); 395void ipfw_zero(int ac, char *av[], int optname); 396void ipfw_list(int ac, char *av[], int show_counters); 397void ipfw_internal_handler(int ac, char *av[]); 398void ipfw_nat64clat_handler(int ac, char *av[]); 399void ipfw_nat64lsn_handler(int ac, char *av[]); 400void ipfw_nat64stl_handler(int ac, char *av[]); 401void ipfw_nptv6_handler(int ac, char *av[]); 402int ipfw_check_object_name(const char *name); 403int ipfw_check_nat64prefix(const struct in6_addr *prefix, int length); 404 405#ifdef PF 406/* altq.c */ 407void altq_set_enabled(int enabled); 408u_int32_t altq_name_to_qid(const char *name); 409void print_altq_cmd(struct buf_pr *bp, struct _ipfw_insn_altq *altqptr); 410#else 411#define NO_ALTQ 412#endif 413 414/* dummynet.c */ 415void dummynet_list(int ac, char *av[], int show_counters); 416void dummynet_flush(void); 417int ipfw_delete_pipe(int pipe_or_queue, int n); 418 419/* ipv6.c */ 420void print_unreach6_code(struct buf_pr *bp, uint16_t code); 421void print_ip6(struct buf_pr *bp, struct _ipfw_insn_ip6 *cmd); 422void print_flow6id(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd); 423void print_icmp6types(struct buf_pr *bp, struct _ipfw_insn_u32 *cmd); 424void print_ext6hdr(struct buf_pr *bp, struct _ipfw_insn *cmd ); 425 426struct tidx; 427struct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av, int cblen, 428 struct tidx *tstate); 429struct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av, int cblen, 430 struct tidx *tstate); 431 432void fill_flow6(struct _ipfw_insn_u32 *cmd, char *av, int cblen); 433void fill_unreach6_code(u_short *codep, char *str); 434void fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av, int cblen); 435int fill_ext6hdr(struct _ipfw_insn *cmd, char *av); 436 437/* ipfw2.c */ 438void bp_flush(struct buf_pr *b); 439void fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode, 440 struct tidx *tstate); 441 442/* tables.c */ 443struct _ipfw_obj_ctlv; 444struct _ipfw_obj_ntlv; 445int table_check_name(const char *tablename); 446void ipfw_list_ta(int ac, char *av[]); 447void ipfw_list_values(int ac, char *av[]); 448void table_fill_ntlv(struct _ipfw_obj_ntlv *ntlv, const char *name, 449 uint8_t set, uint16_t uidx); 450 451