ipfw2.h revision 215179
1271965Smarcel/* 2271965Smarcel * Copyright (c) 2002-2003 Luigi Rizzo 3271965Smarcel * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4271965Smarcel * Copyright (c) 1994 Ugen J.S.Antsilevich 5271965Smarcel * 6271965Smarcel * Idea and grammar partially left from: 7271965Smarcel * Copyright (c) 1993 Daniel Boulet 8271965Smarcel * 9271965Smarcel * Redistribution and use in source forms, with and without modification, 10271965Smarcel * are permitted provided that this entire comment appears intact. 11271965Smarcel * 12271965Smarcel * Redistribution in binary form may occur without any restrictions. 13271965Smarcel * Obviously, it would be nice if you gave credit where credit is due 14271965Smarcel * but requiring it would be too onerous. 15271965Smarcel * 16271965Smarcel * This software is provided ``AS IS'' without any warranties of any kind. 17271965Smarcel * 18271965Smarcel * NEW command line interface for IP firewall facility 19271965Smarcel * 20271965Smarcel * $FreeBSD: head/sbin/ipfw/ipfw2.h 215179 2010-11-12 13:05:17Z luigi $ 21271965Smarcel */ 22271965Smarcel 23271965Smarcel/* 24271965Smarcel * Options that can be set on the command line. 25271965Smarcel * When reading commands from a file, a subset of the options can also 26271965Smarcel * be applied globally by specifying them before the file name. 27271965Smarcel * After that, each line can contain its own option that changes 28271965Smarcel * the global value. 29271965Smarcel * XXX The context is not restored after each line. 30271965Smarcel */ 31271965Smarcel 32271965Smarcelstruct cmdline_opts { 33271965Smarcel /* boolean options: */ 34271965Smarcel int do_value_as_ip; /* show table value as IP */ 35271965Smarcel int do_resolv; /* try to resolve all ip to names */ 36271965Smarcel int do_time; /* Show time stamps */ 37271965Smarcel int do_quiet; /* Be quiet in add and flush */ 38271965Smarcel int do_pipe; /* this cmd refers to a pipe/queue/sched */ 39271965Smarcel int do_nat; /* this cmd refers to a nat config */ 40271965Smarcel int do_dynamic; /* display dynamic rules */ 41271965Smarcel int do_expired; /* display expired dynamic rules */ 42271965Smarcel int do_compact; /* show rules in compact mode */ 43271965Smarcel int do_force; /* do not ask for confirmation */ 44271965Smarcel int show_sets; /* display the set each rule belongs to */ 45271965Smarcel int test_only; /* only check syntax */ 46271965Smarcel int comment_only; /* only print action and comment */ 47272072Smarcel int verbose; /* be verbose on some commands */ 48272072Smarcel 49272072Smarcel /* The options below can have multiple values. */ 50272072Smarcel 51271965Smarcel int do_sort; /* field to sort results (0 = no) */ 52271965Smarcel /* valid fields are 1 and above */ 53271965Smarcel 54271965Smarcel int use_set; /* work with specified set number */ 55271965Smarcel /* 0 means all sets, otherwise apply to set use_set - 1 */ 56271965Smarcel 57271965Smarcel}; 58271965Smarcel 59271965Smarcelextern struct cmdline_opts co; 60271965Smarcel 61271965Smarcel/* 62271965Smarcel * _s_x is a structure that stores a string <-> token pairs, used in 63271965Smarcel * various places in the parser. Entries are stored in arrays, 64271965Smarcel * with an entry with s=NULL as terminator. 65271965Smarcel * The search routines are match_token() and match_value(). 66271965Smarcel * Often, an element with x=0 contains an error string. 67271965Smarcel * 68271965Smarcel */ 69271965Smarcelstruct _s_x { 70271965Smarcel char const *s; 71271965Smarcel int x; 72271965Smarcel}; 73271965Smarcel 74275721Smarcelenum tokens { 75271965Smarcel TOK_NULL=0, 76271965Smarcel 77271965Smarcel TOK_OR, 78271965Smarcel TOK_NOT, 79271965Smarcel TOK_STARTBRACE, 80271965Smarcel TOK_ENDBRACE, 81271965Smarcel 82271965Smarcel TOK_ACCEPT, 83271965Smarcel TOK_COUNT, 84271965Smarcel TOK_PIPE, 85271965Smarcel TOK_LINK, 86271965Smarcel TOK_QUEUE, 87271965Smarcel TOK_FLOWSET, 88271965Smarcel TOK_SCHED, 89271965Smarcel TOK_DIVERT, 90271965Smarcel TOK_TEE, 91271965Smarcel TOK_NETGRAPH, 92271965Smarcel TOK_NGTEE, 93271965Smarcel TOK_FORWARD, 94271965Smarcel TOK_SKIPTO, 95272072Smarcel TOK_DENY, 96271965Smarcel TOK_REJECT, 97271965Smarcel TOK_RESET, 98271965Smarcel TOK_UNREACH, 99271965Smarcel TOK_CHECKSTATE, 100271965Smarcel TOK_NAT, 101271965Smarcel TOK_REASS, 102271965Smarcel 103271965Smarcel TOK_ALTQ, 104271965Smarcel TOK_LOG, 105271965Smarcel TOK_TAG, 106271965Smarcel TOK_UNTAG, 107271965Smarcel 108271965Smarcel TOK_TAGGED, 109271965Smarcel TOK_UID, 110271965Smarcel TOK_GID, 111272072Smarcel TOK_JAIL, 112272072Smarcel TOK_IN, 113271965Smarcel TOK_LIMIT, 114271965Smarcel TOK_KEEPSTATE, 115271965Smarcel TOK_LAYER2, 116271965Smarcel TOK_OUT, 117271965Smarcel TOK_DIVERTED, 118271965Smarcel TOK_DIVERTEDLOOPBACK, 119271965Smarcel TOK_DIVERTEDOUTPUT, 120271965Smarcel TOK_XMIT, 121271965Smarcel TOK_RECV, 122271965Smarcel TOK_VIA, 123271965Smarcel TOK_FRAG, 124271965Smarcel TOK_IPOPTS, 125271965Smarcel TOK_IPLEN, 126271965Smarcel TOK_IPID, 127271965Smarcel TOK_IPPRECEDENCE, 128271965Smarcel TOK_DSCP, 129271965Smarcel TOK_IPTOS, 130271965Smarcel TOK_IPTTL, 131271965Smarcel TOK_IPVER, 132271965Smarcel TOK_ESTAB, 133271965Smarcel TOK_SETUP, 134271965Smarcel TOK_TCPDATALEN, 135272086Smarcel TOK_TCPFLAGS, 136272086Smarcel TOK_TCPOPTS, 137272072Smarcel TOK_TCPSEQ, 138272072Smarcel TOK_TCPACK, 139272072Smarcel TOK_TCPWIN, 140272072Smarcel TOK_ICMPTYPES, 141272072Smarcel TOK_MAC, 142275721Smarcel TOK_MACTYPE, 143272072Smarcel TOK_VERREVPATH, 144271965Smarcel TOK_VERSRCREACH, 145271965Smarcel TOK_ANTISPOOF, 146271965Smarcel TOK_IPSEC, 147271965Smarcel TOK_COMMENT, 148271965Smarcel 149272072Smarcel TOK_PLR, 150272072Smarcel TOK_NOERROR, 151272072Smarcel TOK_BUCKETS, 152272072Smarcel TOK_DSTIP, 153272072Smarcel TOK_SRCIP, 154272072Smarcel TOK_DSTPORT, 155272072Smarcel TOK_SRCPORT, 156272072Smarcel TOK_ALL, 157272072Smarcel TOK_MASK, 158272072Smarcel TOK_FLOW_MASK, 159272072Smarcel TOK_SCHED_MASK, 160272072Smarcel TOK_BW, 161272072Smarcel TOK_DELAY, 162272072Smarcel TOK_PROFILE, 163271965Smarcel TOK_BURST, 164272072Smarcel TOK_RED, 165272072Smarcel TOK_GRED, 166272072Smarcel TOK_DROPTAIL, 167272072Smarcel TOK_PROTO, 168272072Smarcel /* dummynet tokens */ 169272086Smarcel TOK_WEIGHT, 170272086Smarcel TOK_LMAX, 171272086Smarcel TOK_PRI, 172272072Smarcel TOK_TYPE, 173271965Smarcel TOK_SLOTSIZE, 174272072Smarcel 175272072Smarcel TOK_IP, 176272086Smarcel TOK_IF, 177272086Smarcel TOK_ALOG, 178272072Smarcel TOK_DENY_INC, 179271965Smarcel TOK_SAME_PORTS, 180271965Smarcel TOK_UNREG_ONLY, 181271965Smarcel TOK_RESET_ADDR, 182271965Smarcel TOK_ALIAS_REV, 183271965Smarcel TOK_PROXY_ONLY, 184271965Smarcel TOK_REDIR_ADDR, 185271965Smarcel TOK_REDIR_PORT, 186271965Smarcel TOK_REDIR_PROTO, 187271965Smarcel 188272072Smarcel TOK_IPV6, 189272072Smarcel TOK_FLOWID, 190271965Smarcel TOK_ICMP6TYPES, 191271965Smarcel TOK_EXT6HDR, 192272072Smarcel TOK_DSTIP6, 193271965Smarcel TOK_SRCIP6, 194271965Smarcel 195272072Smarcel TOK_IPV4, 196272072Smarcel TOK_UNREACH6, 197272086Smarcel TOK_RESET6, 198271965Smarcel 199272072Smarcel TOK_FIB, 200272072Smarcel TOK_SETFIB, 201272072Smarcel TOK_LOOKUP, 202275721Smarcel TOK_SOCKARG, 203275721Smarcel}; 204271965Smarcel/* 205271965Smarcel * the following macro returns an error message if we run out of 206271965Smarcel * arguments. 207271965Smarcel */ 208271965Smarcel#define NEED(_p, msg) {if (!_p) errx(EX_USAGE, msg);} 209272086Smarcel#define NEED1(msg) {if (!(*av)) errx(EX_USAGE, msg);} 210275721Smarcel 211272086Smarcelint pr_u64(uint64_t *pd, int width); 212272086Smarcel 213271965Smarcel/* memory allocation support */ 214272086Smarcelvoid *safe_calloc(size_t number, size_t size); 215272086Smarcelvoid *safe_realloc(void *ptr, size_t size); 216272086Smarcel 217272086Smarcel/* string comparison functions used for historical compatibility */ 218272086Smarcelint _substrcmp(const char *str1, const char* str2); 219272086Smarcelint _substrcmp2(const char *str1, const char* str2, const char* str3); 220272072Smarcel 221271965Smarcel/* utility functions */ 222271965Smarcelint match_token(struct _s_x *table, char *string); 223271965Smarcelchar const *match_value(struct _s_x *p, int value); 224271965Smarcel 225271965Smarcelint do_cmd(int optname, void *optval, uintptr_t optlen); 226272072Smarcel 227272072Smarcelstruct in6_addr; 228272072Smarcelvoid n2mask(struct in6_addr *mask, int n); 229272086Smarcelint contigmask(uint8_t *p, int len); 230272086Smarcel 231272086Smarcel/* 232272086Smarcel * Forward declarations to avoid include way too many headers. 233272086Smarcel * C does not allow duplicated typedefs, so we use the base struct 234272086Smarcel * that the typedef points to. 235272086Smarcel * Should the typedefs use a different type, the compiler will 236271965Smarcel * still detect the change when compiling the body of the 237271965Smarcel * functions involved, so we do not lose error checking. 238271965Smarcel */ 239272086Smarcelstruct _ipfw_insn; 240271965Smarcelstruct _ipfw_insn_altq; 241272086Smarcelstruct _ipfw_insn_u32; 242272086Smarcelstruct _ipfw_insn_ip6; 243272086Smarcelstruct _ipfw_insn_icmp6; 244272086Smarcel 245272086Smarcel/* 246272086Smarcel * The reserved set numer. This is a constant in ip_fw.h 247272086Smarcel * but we store it in a variable so other files do not depend 248272086Smarcel * in that header just for one constant. 249272086Smarcel */ 250272072Smarcelextern int resvd_set_number; 251272086Smarcel 252272086Smarcel/* first-level command handlers */ 253272086Smarcelvoid ipfw_add(char *av[]); 254272086Smarcelvoid ipfw_show_nat(int ac, char **av); 255272086Smarcelvoid ipfw_config_pipe(int ac, char **av); 256272086Smarcelvoid ipfw_config_nat(int ac, char **av); 257272086Smarcelvoid ipfw_sets_handler(char *av[]); 258272086Smarcelvoid ipfw_table_handler(int ac, char *av[]); 259272086Smarcelvoid ipfw_sysctl_handler(char *av[], int which); 260272086Smarcelvoid ipfw_delete(char *av[]); 261272086Smarcelvoid ipfw_flush(int force); 262272072Smarcelvoid ipfw_zero(int ac, char *av[], int optname); 263272086Smarcelvoid ipfw_list(int ac, char *av[], int show_counters); 264272086Smarcel 265271965Smarcel/* altq.c */ 266271965Smarcelvoid altq_set_enabled(int enabled); 267271965Smarcelu_int32_t altq_name_to_qid(const char *name); 268271965Smarcel 269271965Smarcelvoid print_altq_cmd(struct _ipfw_insn_altq *altqptr); 270271965Smarcel 271271965Smarcel/* dummynet.c */ 272271965Smarcelvoid dummynet_list(int ac, char *av[], int show_counters); 273271965Smarcelvoid dummynet_flush(void); 274271965Smarcelint ipfw_delete_pipe(int pipe_or_queue, int n); 275272072Smarcel 276271965Smarcel/* ipv6.c */ 277271965Smarcelvoid print_unreach6_code(uint16_t code); 278271965Smarcelvoid print_ip6(struct _ipfw_insn_ip6 *cmd, char const *s); 279272072Smarcelvoid print_flow6id(struct _ipfw_insn_u32 *cmd); 280271965Smarcelvoid print_icmp6types(struct _ipfw_insn_u32 *cmd); 281272072Smarcelvoid print_ext6hdr(struct _ipfw_insn *cmd ); 282272072Smarcel 283271965Smarcelstruct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av); 284272072Smarcelstruct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av); 285272072Smarcel 286271965Smarcelvoid fill_flow6(struct _ipfw_insn_u32 *cmd, char *av ); 287271965Smarcelvoid fill_unreach6_code(u_short *codep, char *str); 288271965Smarcelvoid fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av); 289271965Smarcelint fill_ext6hdr(struct _ipfw_insn *cmd, char *av); 290271965Smarcel