ipfw2.h revision 200567
11558Srgrimes/* 21558Srgrimes * Copyright (c) 2002-2003 Luigi Rizzo 31558Srgrimes * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 41558Srgrimes * Copyright (c) 1994 Ugen J.S.Antsilevich 51558Srgrimes * 61558Srgrimes * Idea and grammar partially left from: 71558Srgrimes * Copyright (c) 1993 Daniel Boulet 81558Srgrimes * 91558Srgrimes * Redistribution and use in source forms, with and without modification, 101558Srgrimes * are permitted provided that this entire comment appears intact. 111558Srgrimes * 121558Srgrimes * Redistribution in binary form may occur without any restrictions. 131558Srgrimes * Obviously, it would be nice if you gave credit where credit is due 141558Srgrimes * but requiring it would be too onerous. 151558Srgrimes * 161558Srgrimes * This software is provided ``AS IS'' without any warranties of any kind. 171558Srgrimes * 181558Srgrimes * NEW command line interface for IP firewall facility 191558Srgrimes * 201558Srgrimes * $FreeBSD: head/sbin/ipfw/ipfw2.h 200567 2009-12-15 09:46:27Z luigi $ 211558Srgrimes */ 221558Srgrimes 231558Srgrimes/* 241558Srgrimes * Options that can be set on the command line. 251558Srgrimes * When reading commands from a file, a subset of the options can also 261558Srgrimes * be applied globally by specifying them before the file name. 271558Srgrimes * After that, each line can contain its own option that changes 281558Srgrimes * the global value. 291558Srgrimes * XXX The context is not restored after each line. 301558Srgrimes */ 311558Srgrimes 321558Srgrimesstruct cmdline_opts { 331558Srgrimes /* boolean options: */ 34114589Sobrien int do_value_as_ip; /* show table value as IP */ 351558Srgrimes int do_resolv; /* try to resolve all ip to names */ 367585Sbde int do_time; /* Show time stamps */ 371558Srgrimes int do_quiet; /* Be quiet in add and flush */ 381558Srgrimes int do_pipe; /* this cmd refers to a pipe */ 391558Srgrimes int do_nat; /* this cmd refers to a nat config */ 401558Srgrimes int do_dynamic; /* display dynamic rules */ 411558Srgrimes int do_expired; /* display expired dynamic rules */ 4241477Sjulian int do_compact; /* show rules in compact mode */ 43114589Sobrien int do_force; /* do not ask for confirmation */ 4441477Sjulian int show_sets; /* display the set each rule belongs to */ 4593103Smarkm int test_only; /* only check syntax */ 4693103Smarkm int comment_only; /* only print action and comment */ 4793103Smarkm int verbose; /* be verbose on some commands */ 481558Srgrimes 4955275Speter /* The options below can have multiple values. */ 5075557Smckusick 511558Srgrimes int do_sort; /* field to sort results (0 = no) */ 521558Srgrimes /* valid fields are 1 and above */ 5340918Smjacob 5486514Siedowse int use_set; /* work with specified set number */ 5598542Smckusick /* 0 means all sets, otherwise apply to set use_set - 1 */ 5623675Speter 571558Srgrimes}; 5823675Speter 591558Srgrimesextern struct cmdline_opts co; 6023675Speter 6123675Speter/* 6255725Speter * _s_x is a structure that stores a string <-> token pairs, used in 631558Srgrimes * various places in the parser. Entries are stored in arrays, 64120901Smckusick * with an entry with s=NULL as terminator. 6555725Speter * The search routines are match_token() and match_value(). 66101037Smux * Often, an element with x=0 contains an error string. 6786514Siedowse * 6823675Speter */ 691558Srgrimesstruct _s_x { 701558Srgrimes char const *s; 7192839Simp int x; 72100935Sphk}; 7392839Simp 7492839Simpenum tokens { 7523675Speter TOK_NULL=0, 767585Sbde 7792839Simp TOK_OR, 781558Srgrimes TOK_NOT, 791558Srgrimes TOK_STARTBRACE, 8041474Sjulian TOK_ENDBRACE, 8166861Sadrian 821558Srgrimes TOK_ACCEPT, 831558Srgrimes TOK_COUNT, 8466861Sadrian TOK_PIPE, 8575927Smckusick TOK_QUEUE, 861558Srgrimes TOK_DIVERT, 871558Srgrimes TOK_TEE, 8866861Sadrian TOK_NETGRAPH, 891558Srgrimes TOK_NGTEE, 901558Srgrimes TOK_FORWARD, 911558Srgrimes TOK_SKIPTO, 921558Srgrimes TOK_DENY, 9374556Smckusick TOK_REJECT, 9474556Smckusick TOK_RESET, 9574556Smckusick TOK_UNREACH, 9674556Smckusick TOK_CHECKSTATE, 971558Srgrimes TOK_NAT, 9866861Sadrian TOK_REASS, 991558Srgrimes 10098542Smckusick TOK_ALTQ, 10198542Smckusick TOK_LOG, 10298542Smckusick TOK_TAG, 1031558Srgrimes TOK_UNTAG, 1048871Srgrimes 1051558Srgrimes TOK_TAGGED, 1061558Srgrimes TOK_UID, 1071558Srgrimes TOK_GID, 1081558Srgrimes TOK_JAIL, 1092153Sdg TOK_IN, 11066861Sadrian TOK_LIMIT, 1112153Sdg TOK_KEEPSTATE, 1122153Sdg TOK_LAYER2, 11375927Smckusick TOK_OUT, 11475927Smckusick TOK_DIVERTED, 11575927Smckusick TOK_DIVERTEDLOOPBACK, 11675927Smckusick TOK_DIVERTEDOUTPUT, 1171558Srgrimes TOK_XMIT, 1181558Srgrimes TOK_RECV, 1191558Srgrimes TOK_VIA, 12023675Speter TOK_FRAG, 1211558Srgrimes TOK_IPOPTS, 1221558Srgrimes TOK_IPLEN, 1231558Srgrimes TOK_IPID, 1241558Srgrimes TOK_IPPRECEDENCE, 1251558Srgrimes TOK_IPTOS, 1261558Srgrimes TOK_IPTTL, 1271558Srgrimes TOK_IPVER, 1281558Srgrimes TOK_ESTAB, 12966861Sadrian TOK_SETUP, 13066861Sadrian TOK_TCPDATALEN, 13166861Sadrian TOK_TCPFLAGS, 13266861Sadrian TOK_TCPOPTS, 1331558Srgrimes TOK_TCPSEQ, 1341558Srgrimes TOK_TCPACK, 1351558Srgrimes TOK_TCPWIN, 1361558Srgrimes TOK_ICMPTYPES, 1371558Srgrimes TOK_MAC, 1381558Srgrimes TOK_MACTYPE, 13966861Sadrian TOK_VERREVPATH, 1401558Srgrimes TOK_VERSRCREACH, 1411558Srgrimes TOK_ANTISPOOF, 1421558Srgrimes TOK_IPSEC, 1431558Srgrimes TOK_COMMENT, 14466861Sadrian 14566861Sadrian TOK_PLR, 14666861Sadrian TOK_NOERROR, 14766861Sadrian TOK_BUCKETS, 1481558Srgrimes TOK_DSTIP, 1491558Srgrimes TOK_SRCIP, 1501558Srgrimes TOK_DSTPORT, 1511558Srgrimes TOK_SRCPORT, 15270050Siedowse TOK_ALL, 15341474Sjulian TOK_MASK, 15441474Sjulian TOK_BW, 155102231Strhodes TOK_DELAY, 15641474Sjulian TOK_PIPE_PROFILE, 15741474Sjulian TOK_BURST, 15841474Sjulian TOK_RED, 15941474Sjulian TOK_GRED, 16041474Sjulian TOK_DROPTAIL, 16166861Sadrian TOK_PROTO, 16286514Siedowse TOK_WEIGHT, 16341474Sjulian TOK_IP, 1641558Srgrimes TOK_IF, 16566861Sadrian TOK_ALOG, 1661558Srgrimes TOK_DENY_INC, 1671558Srgrimes TOK_SAME_PORTS, 1681558Srgrimes TOK_UNREG_ONLY, 16923675Speter TOK_RESET_ADDR, 170100935Sphk TOK_ALIAS_REV, 1711558Srgrimes TOK_PROXY_ONLY, 1721558Srgrimes TOK_REDIR_ADDR, 1731558Srgrimes TOK_REDIR_PORT, 1741558Srgrimes TOK_REDIR_PROTO, 1751558Srgrimes 1761558Srgrimes TOK_IPV6, 17723675Speter TOK_FLOWID, 1781558Srgrimes TOK_ICMP6TYPES, 1791558Srgrimes TOK_EXT6HDR, 1801558Srgrimes TOK_DSTIP6, 1811558Srgrimes TOK_SRCIP6, 182102231Strhodes 1831558Srgrimes TOK_IPV4, 1841558Srgrimes TOK_UNREACH6, 18523675Speter TOK_RESET6, 18692839Simp 1871558Srgrimes TOK_FIB, 18898542Smckusick TOK_SETFIB, 18974556Smckusick TOK_LOOKUP, 1901558Srgrimes}; 19174556Smckusick/* 1921558Srgrimes * the following macro returns an error message if we run out of 193120901Smckusick * arguments. 194120901Smckusick */ 19598542Smckusick#define NEED1(msg) {if (!ac) errx(EX_USAGE, msg);} 196101037Smux 19798542Smckusickunsigned long long align_uint64(const uint64_t *pll); 198101037Smux 1991558Srgrimes/* memory allocation support */ 2001558Srgrimesvoid *safe_calloc(size_t number, size_t size); 2011558Srgrimesvoid *safe_realloc(void *ptr, size_t size); 2021558Srgrimes 20375927Smckusick/* string comparison functions used for historical compatibility */ 20475927Smckusickint _substrcmp(const char *str1, const char* str2); 205102231Strhodesint _substrcmp2(const char *str1, const char* str2, const char* str3); 20675927Smckusick 20775927Smckusick/* utility functions */ 20875927Smckusickint match_token(struct _s_x *table, char *string); 20975927Smckusickchar const *match_value(struct _s_x *p, int value); 21075927Smckusick 21175927Smckusickint do_cmd(int optname, void *optval, uintptr_t optlen); 21275927Smckusick 21375927Smckusickstruct in6_addr; 21475927Smckusickvoid n2mask(struct in6_addr *mask, int n); 21575927Smckusickint contigmask(uint8_t *p, int len); 21675927Smckusick 21775927Smckusick/* 21875927Smckusick * Forward declarations to avoid include way too many headers. 21975557Smckusick * C does not allow duplicated typedefs, so we use the base struct 22075927Smckusick * that the typedef points to. 22175927Smckusick * Should the typedefs use a different type, the compiler will 22275927Smckusick * still detect the change when compiling the body of the 22375927Smckusick * functions involved, so we do not lose error checking. 22475927Smckusick */ 22575927Smckusickstruct _ipfw_insn; 22675927Smckusickstruct _ipfw_insn_altq; 22775927Smckusickstruct _ipfw_insn_u32; 22875927Smckusickstruct _ipfw_insn_ip6; 22975927Smckusickstruct _ipfw_insn_icmp6; 23075927Smckusick 23175927Smckusick/* 23275927Smckusick * The reserved set numer. This is a constant in ip_fw.h 23375927Smckusick * but we store it in a variable so other files do not depend 23475927Smckusick * in that header just for one constant. 23575927Smckusick */ 23674556Smckusickextern int resvd_set_number; 23774556Smckusick 238102231Strhodes/* first-level command handlers */ 23974556Smckusickvoid ipfw_add(int ac, char *av[]); 24074556Smckusickvoid ipfw_show_nat(int ac, char **av); 24174556Smckusickvoid ipfw_config_pipe(int ac, char **av); 24274556Smckusickvoid ipfw_config_nat(int ac, char **av); 24374556Smckusickvoid ipfw_sets_handler(int ac, char *av[]); 24474556Smckusickvoid ipfw_table_handler(int ac, char *av[]); 24574556Smckusickvoid ipfw_sysctl_handler(int ac, char *av[], int which); 24675557Smckusickvoid ipfw_delete(int ac, char *av[]); 24774556Smckusickvoid ipfw_flush(int force); 24874556Smckusickvoid ipfw_zero(int ac, char *av[], int optname); 24975557Smckusickvoid ipfw_list(int ac, char *av[], int show_counters); 25075557Smckusick 25174556Smckusick/* altq.c */ 25274556Smckusickvoid altq_set_enabled(int enabled); 25375557Smckusicku_int32_t altq_name_to_qid(const char *name); 25475557Smckusick 25575557Smckusickvoid print_altq_cmd(struct _ipfw_insn_altq *altqptr); 25675557Smckusick 25775557Smckusick/* dummynet.c */ 25875557Smckusickvoid ipfw_list_pipes(void *data, uint nbytes, int ac, char *av[]); 25975557Smckusickint ipfw_delete_pipe(int pipe_or_queue, int n); 26075557Smckusick 26175557Smckusick/* ipv6.c */ 26275557Smckusickvoid print_unreach6_code(uint16_t code); 26375557Smckusickvoid print_ip6(struct _ipfw_insn_ip6 *cmd, char const *s); 264102231Strhodesvoid print_flow6id(struct _ipfw_insn_u32 *cmd); 26575557Smckusickvoid print_icmp6types(struct _ipfw_insn_u32 *cmd); 26675557Smckusickvoid print_ext6hdr(struct _ipfw_insn *cmd ); 267118302Sru 26875557Smckusickstruct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av); 26975557Smckusickstruct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av); 27075557Smckusick 27175557Smckusickvoid fill_flow6(struct _ipfw_insn_u32 *cmd, char *av ); 27275557Smckusickvoid fill_unreach6_code(u_short *codep, char *str); 27375557Smckusickvoid fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av); 27475557Smckusickint fill_ext6hdr(struct _ipfw_insn *cmd, char *av); 275120901Smckusick