ipfw2.h revision 265699
1193267Sjkim/* 2193267Sjkim * Copyright (c) 2002-2003 Luigi Rizzo 3193267Sjkim * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4193267Sjkim * Copyright (c) 1994 Ugen J.S.Antsilevich 5193267Sjkim * 6193267Sjkim * Idea and grammar partially left from: 7217355Sjkim * Copyright (c) 1993 Daniel Boulet 8229989Sjkim * 9193267Sjkim * Redistribution and use in source forms, with and without modification, 10193267Sjkim * are permitted provided that this entire comment appears intact. 11217355Sjkim * 12217355Sjkim * Redistribution in binary form may occur without any restrictions. 13217355Sjkim * Obviously, it would be nice if you gave credit where credit is due 14217355Sjkim * but requiring it would be too onerous. 15217355Sjkim * 16217355Sjkim * This software is provided ``AS IS'' without any warranties of any kind. 17217355Sjkim * 18217355Sjkim * NEW command line interface for IP firewall facility 19217355Sjkim * 20217355Sjkim * $FreeBSD: stable/9/sbin/ipfw/ipfw2.h 265699 2014-05-08 19:11:14Z melifaro $ 21217355Sjkim */ 22217355Sjkim 23217355Sjkim/* 24217355Sjkim * Options that can be set on the command line. 25193267Sjkim * When reading commands from a file, a subset of the options can also 26217355Sjkim * be applied globally by specifying them before the file name. 27217355Sjkim * After that, each line can contain its own option that changes 28217355Sjkim * the global value. 29193267Sjkim * XXX The context is not restored after each line. 30217355Sjkim */ 31217355Sjkim 32217355Sjkimstruct cmdline_opts { 33217355Sjkim /* boolean options: */ 34217355Sjkim int do_value_as_ip; /* show table value as IP */ 35217355Sjkim int do_resolv; /* try to resolve all ip to names */ 36217355Sjkim int do_time; /* Show time stamps */ 37217355Sjkim int do_quiet; /* Be quiet in add and flush */ 38217355Sjkim int do_pipe; /* this cmd refers to a pipe/queue/sched */ 39217355Sjkim int do_nat; /* this cmd refers to a nat config */ 40217355Sjkim int do_dynamic; /* display dynamic rules */ 41217355Sjkim int do_expired; /* display expired dynamic rules */ 42217355Sjkim int do_compact; /* show rules in compact mode */ 43193267Sjkim int do_force; /* do not ask for confirmation */ 44193267Sjkim int show_sets; /* display the set each rule belongs to */ 45193267Sjkim int test_only; /* only check syntax */ 46213800Sjkim int comment_only; /* only print action and comment */ 47213800Sjkim int verbose; /* be verbose on some commands */ 48209734Sjkim 49209734Sjkim /* The options below can have multiple values. */ 50193267Sjkim 51228110Sjkim int do_sort; /* field to sort results (0 = no) */ 52228110Sjkim /* valid fields are 1 and above */ 53228110Sjkim 54228110Sjkim int use_set; /* work with specified set number */ 55228110Sjkim /* 0 means all sets, otherwise apply to set use_set - 1 */ 56223480Sjkim 57193267Sjkim}; 58193267Sjkim 59193267Sjkimextern struct cmdline_opts co; 60193267Sjkim 61193267Sjkim/* 62193267Sjkim * _s_x is a structure that stores a string <-> token pairs, used in 63193267Sjkim * various places in the parser. Entries are stored in arrays, 64209734Sjkim * with an entry with s=NULL as terminator. 65193267Sjkim * The search routines are match_token() and match_value(). 66193267Sjkim * Often, an element with x=0 contains an error string. 67193267Sjkim * 68193267Sjkim */ 69193267Sjkimstruct _s_x { 70193267Sjkim char const *s; 71193267Sjkim int x; 72193267Sjkim}; 73193267Sjkim 74193267Sjkimenum tokens { 75193267Sjkim TOK_NULL=0, 76193267Sjkim 77193267Sjkim TOK_OR, 78193267Sjkim TOK_NOT, 79193267Sjkim TOK_STARTBRACE, 80193267Sjkim TOK_ENDBRACE, 81193267Sjkim 82193267Sjkim TOK_ACCEPT, 83193267Sjkim TOK_COUNT, 84193267Sjkim TOK_PIPE, 85193267Sjkim TOK_LINK, 86193267Sjkim TOK_QUEUE, 87213800Sjkim TOK_FLOWSET, 88193267Sjkim TOK_SCHED, 89213800Sjkim TOK_DIVERT, 90213800Sjkim TOK_TEE, 91213800Sjkim TOK_NETGRAPH, 92213800Sjkim TOK_NGTEE, 93213800Sjkim TOK_FORWARD, 94193267Sjkim TOK_SKIPTO, 95193267Sjkim TOK_DENY, 96193267Sjkim TOK_REJECT, 97193267Sjkim TOK_RESET, 98193267Sjkim TOK_UNREACH, 99193267Sjkim TOK_CHECKSTATE, 100193267Sjkim TOK_NAT, 101193267Sjkim TOK_REASS, 102213800Sjkim TOK_CALL, 103193267Sjkim TOK_RETURN, 104193267Sjkim 105193267Sjkim TOK_ALTQ, 106193267Sjkim TOK_LOG, 107213800Sjkim TOK_TAG, 108213800Sjkim TOK_UNTAG, 109193267Sjkim 110193267Sjkim TOK_TAGGED, 111193267Sjkim TOK_UID, 112193267Sjkim TOK_GID, 113193267Sjkim TOK_JAIL, 114193267Sjkim TOK_IN, 115193267Sjkim TOK_LIMIT, 116193267Sjkim TOK_KEEPSTATE, 117213800Sjkim TOK_LAYER2, 118213800Sjkim TOK_OUT, 119193267Sjkim TOK_DIVERTED, 120193267Sjkim TOK_DIVERTEDLOOPBACK, 121193267Sjkim TOK_DIVERTEDOUTPUT, 122193267Sjkim TOK_XMIT, 123193267Sjkim TOK_RECV, 124193267Sjkim TOK_VIA, 125193267Sjkim TOK_FRAG, 126193267Sjkim TOK_IPOPTS, 127193267Sjkim TOK_IPLEN, 128193267Sjkim TOK_IPID, 129193267Sjkim TOK_IPPRECEDENCE, 130193267Sjkim TOK_DSCP, 131193267Sjkim TOK_IPTOS, 132193267Sjkim TOK_IPTTL, 133213800Sjkim TOK_IPVER, 134193267Sjkim TOK_ESTAB, 135193267Sjkim TOK_SETUP, 136193267Sjkim TOK_TCPDATALEN, 137193267Sjkim TOK_TCPFLAGS, 138193267Sjkim TOK_TCPOPTS, 139193267Sjkim TOK_TCPSEQ, 140193267Sjkim TOK_TCPACK, 141193267Sjkim TOK_TCPWIN, 142193267Sjkim TOK_ICMPTYPES, 143193267Sjkim TOK_MAC, 144193267Sjkim TOK_MACTYPE, 145193267Sjkim TOK_VERREVPATH, 146193267Sjkim TOK_VERSRCREACH, 147193267Sjkim TOK_ANTISPOOF, 148193267Sjkim TOK_IPSEC, 149193267Sjkim TOK_COMMENT, 150213800Sjkim 151213800Sjkim TOK_PLR, 152193267Sjkim TOK_NOERROR, 153213800Sjkim TOK_BUCKETS, 154193267Sjkim TOK_DSTIP, 155193267Sjkim TOK_SRCIP, 156193267Sjkim TOK_DSTPORT, 157193267Sjkim TOK_SRCPORT, 158193267Sjkim TOK_ALL, 159193267Sjkim TOK_MASK, 160193267Sjkim TOK_FLOW_MASK, 161193267Sjkim TOK_SCHED_MASK, 162193267Sjkim TOK_BW, 163193267Sjkim TOK_DELAY, 164193267Sjkim TOK_PROFILE, 165193267Sjkim TOK_BURST, 166193267Sjkim TOK_RED, 167193267Sjkim TOK_GRED, 168193267Sjkim TOK_DROPTAIL, 169193267Sjkim TOK_PROTO, 170193267Sjkim /* dummynet tokens */ 171193267Sjkim TOK_WEIGHT, 172193267Sjkim TOK_LMAX, 173193267Sjkim TOK_PRI, 174193267Sjkim TOK_TYPE, 175193267Sjkim TOK_SLOTSIZE, 176193267Sjkim 177193267Sjkim TOK_IP, 178193267Sjkim TOK_IF, 179193267Sjkim TOK_ALOG, 180213800Sjkim TOK_DENY_INC, 181213800Sjkim TOK_SAME_PORTS, 182213800Sjkim TOK_UNREG_ONLY, 183193267Sjkim TOK_SKIP_GLOBAL, 184213800Sjkim TOK_RESET_ADDR, 185193267Sjkim TOK_ALIAS_REV, 186193267Sjkim TOK_PROXY_ONLY, 187193267Sjkim TOK_REDIR_ADDR, 188193267Sjkim TOK_REDIR_PORT, 189193267Sjkim TOK_REDIR_PROTO, 190193267Sjkim 191193267Sjkim TOK_IPV6, 192193267Sjkim TOK_FLOWID, 193193267Sjkim TOK_ICMP6TYPES, 194193267Sjkim TOK_EXT6HDR, 195193267Sjkim TOK_DSTIP6, 196193267Sjkim TOK_SRCIP6, 197193267Sjkim 198193267Sjkim TOK_IPV4, 199193267Sjkim TOK_UNREACH6, 200193267Sjkim TOK_RESET6, 201193267Sjkim 202193267Sjkim TOK_FIB, 203193267Sjkim TOK_SETFIB, 204193267Sjkim TOK_LOOKUP, 205193267Sjkim TOK_SOCKARG, 206193267Sjkim TOK_SETDSCP, 207193267Sjkim}; 208193267Sjkim/* 209193267Sjkim * the following macro returns an error message if we run out of 210193267Sjkim * arguments. 211193267Sjkim */ 212193267Sjkim#define NEED(_p, msg) {if (!_p) errx(EX_USAGE, msg);} 213193267Sjkim#define NEED1(msg) {if (!(*av)) errx(EX_USAGE, msg);} 214193267Sjkim 215193267Sjkimint pr_u64(uint64_t *pd, int width); 216193267Sjkim 217231844Sjkim/* memory allocation support */ 218231844Sjkimvoid *safe_calloc(size_t number, size_t size); 219231844Sjkimvoid *safe_realloc(void *ptr, size_t size); 220231844Sjkim 221231844Sjkim/* string comparison functions used for historical compatibility */ 222231844Sjkimint _substrcmp(const char *str1, const char* str2); 223231844Sjkimint _substrcmp2(const char *str1, const char* str2, const char* str3); 224231844Sjkim 225231844Sjkim/* utility functions */ 226231844Sjkimint match_token(struct _s_x *table, char *string); 227231844Sjkimchar const *match_value(struct _s_x *p, int value); 228231844Sjkim 229231844Sjkimint do_cmd(int optname, void *optval, uintptr_t optlen); 230231844Sjkim 231231844Sjkimuint32_t ipfw_get_tables_max(void); 232231844Sjkim 233231844Sjkimstruct in6_addr; 234231844Sjkimvoid n2mask(struct in6_addr *mask, int n); 235231844Sjkimint contigmask(uint8_t *p, int len); 236231844Sjkim 237231844Sjkim/* 238231844Sjkim * Forward declarations to avoid include way too many headers. 239231844Sjkim * C does not allow duplicated typedefs, so we use the base struct 240231844Sjkim * that the typedef points to. 241231844Sjkim * Should the typedefs use a different type, the compiler will 242231844Sjkim * still detect the change when compiling the body of the 243231844Sjkim * functions involved, so we do not lose error checking. 244193267Sjkim */ 245193267Sjkimstruct _ipfw_insn; 246193267Sjkimstruct _ipfw_insn_altq; 247193267Sjkimstruct _ipfw_insn_u32; 248193267Sjkimstruct _ipfw_insn_ip6; 249193267Sjkimstruct _ipfw_insn_icmp6; 250193267Sjkim 251193267Sjkim/* 252193267Sjkim * The reserved set numer. This is a constant in ip_fw.h 253193267Sjkim * but we store it in a variable so other files do not depend 254193267Sjkim * in that header just for one constant. 255193267Sjkim */ 256193267Sjkimextern int resvd_set_number; 257193267Sjkim 258193267Sjkim/* first-level command handlers */ 259193267Sjkimvoid ipfw_add(char *av[]); 260193267Sjkimvoid ipfw_show_nat(int ac, char **av); 261193267Sjkimvoid ipfw_config_pipe(int ac, char **av); 262193267Sjkimvoid ipfw_config_nat(int ac, char **av); 263193267Sjkimvoid ipfw_sets_handler(char *av[]); 264193267Sjkimvoid ipfw_table_handler(int ac, char *av[]); 265193267Sjkimvoid ipfw_sysctl_handler(char *av[], int which); 266193267Sjkimvoid ipfw_delete(char *av[]); 267213800Sjkimvoid ipfw_flush(int force); 268193267Sjkimvoid ipfw_zero(int ac, char *av[], int optname); 269193267Sjkimvoid ipfw_list(int ac, char *av[], int show_counters); 270193267Sjkim 271193267Sjkim/* altq.c */ 272193267Sjkimvoid altq_set_enabled(int enabled); 273193267Sjkimu_int32_t altq_name_to_qid(const char *name); 274193267Sjkim 275193267Sjkimvoid print_altq_cmd(struct _ipfw_insn_altq *altqptr); 276193267Sjkim 277193267Sjkim/* dummynet.c */ 278193267Sjkimvoid dummynet_list(int ac, char *av[], int show_counters); 279193267Sjkimvoid dummynet_flush(void); 280193267Sjkimint ipfw_delete_pipe(int pipe_or_queue, int n); 281193267Sjkim 282193267Sjkim/* ipv6.c */ 283193267Sjkimvoid print_unreach6_code(uint16_t code); 284193267Sjkimvoid print_ip6(struct _ipfw_insn_ip6 *cmd, char const *s); 285193267Sjkimvoid print_flow6id(struct _ipfw_insn_u32 *cmd); 286193267Sjkimvoid print_icmp6types(struct _ipfw_insn_u32 *cmd); 287193267Sjkimvoid print_ext6hdr(struct _ipfw_insn *cmd ); 288193267Sjkim 289193267Sjkimstruct _ipfw_insn *add_srcip6(struct _ipfw_insn *cmd, char *av, int cblen); 290193267Sjkimstruct _ipfw_insn *add_dstip6(struct _ipfw_insn *cmd, char *av, int cblen); 291193267Sjkim 292193267Sjkimvoid fill_flow6(struct _ipfw_insn_u32 *cmd, char *av, int cblen); 293213800Sjkimvoid fill_unreach6_code(u_short *codep, char *str); 294213800Sjkimvoid fill_icmp6types(struct _ipfw_insn_icmp6 *cmd, char *av, int cblen); 295193267Sjkimint fill_ext6hdr(struct _ipfw_insn *cmd, char *av); 296193267Sjkim