1f1220db8SAlexander V. Chernikov /* 21a33e799SAlexander V. Chernikov * Copyright (c) 2014 Yandex LLC 31a33e799SAlexander V. Chernikov * Copyright (c) 2014 Alexander V. Chernikov 4f1220db8SAlexander V. Chernikov * 5f1220db8SAlexander V. Chernikov * Redistribution and use in source forms, with and without modification, 6f1220db8SAlexander V. Chernikov * are permitted provided that this entire comment appears intact. 7f1220db8SAlexander V. Chernikov * 8f1220db8SAlexander V. Chernikov * Redistribution in binary form may occur without any restrictions. 9f1220db8SAlexander V. Chernikov * Obviously, it would be nice if you gave credit where credit is due 10f1220db8SAlexander V. Chernikov * but requiring it would be too onerous. 11f1220db8SAlexander V. Chernikov * 12f1220db8SAlexander V. Chernikov * This software is provided ``AS IS'' without any warranties of any kind. 13f1220db8SAlexander V. Chernikov * 141a33e799SAlexander V. Chernikov * in-kernel ipfw tables support. 15f1220db8SAlexander V. Chernikov * 169fe15d06SAlexander V. Chernikov * $FreeBSD$ 17f1220db8SAlexander V. Chernikov */ 18f1220db8SAlexander V. Chernikov 19f1220db8SAlexander V. Chernikov 20f1220db8SAlexander V. Chernikov #include <sys/types.h> 21f1220db8SAlexander V. Chernikov #include <sys/param.h> 22f1220db8SAlexander V. Chernikov #include <sys/socket.h> 23f1220db8SAlexander V. Chernikov #include <sys/sysctl.h> 24f1220db8SAlexander V. Chernikov 25f1220db8SAlexander V. Chernikov #include <ctype.h> 26f1220db8SAlexander V. Chernikov #include <err.h> 27f1220db8SAlexander V. Chernikov #include <errno.h> 28f1220db8SAlexander V. Chernikov #include <netdb.h> 29f1220db8SAlexander V. Chernikov #include <stdio.h> 30f1220db8SAlexander V. Chernikov #include <stdlib.h> 31f1220db8SAlexander V. Chernikov #include <string.h> 32f1220db8SAlexander V. Chernikov #include <sysexits.h> 33f1220db8SAlexander V. Chernikov 34f1220db8SAlexander V. Chernikov #include <net/if.h> 35f1220db8SAlexander V. Chernikov #include <netinet/in.h> 36f1220db8SAlexander V. Chernikov #include <netinet/ip_fw.h> 37f1220db8SAlexander V. Chernikov #include <arpa/inet.h> 382530ed9eSAndrey V. Elsukov #include <netdb.h> 39f1220db8SAlexander V. Chernikov 40f1220db8SAlexander V. Chernikov #include "ipfw2.h" 41f1220db8SAlexander V. Chernikov 42ac35ff17SAlexander V. Chernikov static void table_modify_record(ipfw_obj_header *oh, int ac, char *av[], 433a845e10SAlexander V. Chernikov int add, int quiet, int update, int atomic); 44ac35ff17SAlexander V. Chernikov static int table_flush(ipfw_obj_header *oh); 45ac35ff17SAlexander V. Chernikov static int table_destroy(ipfw_obj_header *oh); 46ac35ff17SAlexander V. Chernikov static int table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i); 47adf3b2b9SAlexander V. Chernikov static int table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i); 4846d52008SAlexander V. Chernikov static int table_do_swap(ipfw_obj_header *oh, char *second); 49adf3b2b9SAlexander V. Chernikov static void table_create(ipfw_obj_header *oh, int ac, char *av[]); 50adf3b2b9SAlexander V. Chernikov static void table_modify(ipfw_obj_header *oh, int ac, char *av[]); 51adf3b2b9SAlexander V. Chernikov static void table_lookup(ipfw_obj_header *oh, int ac, char *av[]); 524f43138aSAlexander V. Chernikov static void table_lock(ipfw_obj_header *oh, int lock); 5346d52008SAlexander V. Chernikov static int table_swap(ipfw_obj_header *oh, char *second); 54ac35ff17SAlexander V. Chernikov static int table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i); 55f1220db8SAlexander V. Chernikov static int table_show_info(ipfw_xtable_info *i, void *arg); 56f1220db8SAlexander V. Chernikov 57421c5838SAndrey V. Elsukov static int table_destroy_one(ipfw_xtable_info *i, void *arg); 58f1220db8SAlexander V. Chernikov static int table_flush_one(ipfw_xtable_info *i, void *arg); 59f1220db8SAlexander V. Chernikov static int table_show_one(ipfw_xtable_info *i, void *arg); 60720ee730SAlexander V. Chernikov static int table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh); 61f1220db8SAlexander V. Chernikov static void table_show_list(ipfw_obj_header *oh, int need_header); 6281d3153dSAlexander V. Chernikov static void table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent); 63f1220db8SAlexander V. Chernikov 64ac35ff17SAlexander V. Chernikov static void tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, 650cba2b28SAlexander V. Chernikov char *key, int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi); 66ac35ff17SAlexander V. Chernikov static void tentry_fill_value(ipfw_obj_header *oh, ipfw_obj_tentry *tent, 670cba2b28SAlexander V. Chernikov char *arg, uint8_t type, uint32_t vmask); 680cba2b28SAlexander V. Chernikov static void table_show_value(char *buf, size_t bufsize, ipfw_table_value *v, 690cba2b28SAlexander V. Chernikov uint32_t vmask, int print_ip); 70ac35ff17SAlexander V. Chernikov 71f1220db8SAlexander V. Chernikov typedef int (table_cb_t)(ipfw_xtable_info *i, void *arg); 72f1220db8SAlexander V. Chernikov static int tables_foreach(table_cb_t *f, void *arg, int sort); 73f1220db8SAlexander V. Chernikov 74f1220db8SAlexander V. Chernikov #ifndef s6_addr32 75f1220db8SAlexander V. Chernikov #define s6_addr32 __u6_addr.__u6_addr32 76f1220db8SAlexander V. Chernikov #endif 77f1220db8SAlexander V. Chernikov 78ac35ff17SAlexander V. Chernikov static struct _s_x tabletypes[] = { 79c21034b7SAlexander V. Chernikov { "addr", IPFW_TABLE_ADDR }, 80ac35ff17SAlexander V. Chernikov { "iface", IPFW_TABLE_INTERFACE }, 81b23d5de9SAlexander V. Chernikov { "number", IPFW_TABLE_NUMBER }, 82914bffb6SAlexander V. Chernikov { "flow", IPFW_TABLE_FLOW }, 83ac35ff17SAlexander V. Chernikov { NULL, 0 } 84ac35ff17SAlexander V. Chernikov }; 85ac35ff17SAlexander V. Chernikov 86ac35ff17SAlexander V. Chernikov static struct _s_x tablevaltypes[] = { 870cba2b28SAlexander V. Chernikov { "skipto", IPFW_VTYPE_SKIPTO }, 880cba2b28SAlexander V. Chernikov { "pipe", IPFW_VTYPE_PIPE }, 890cba2b28SAlexander V. Chernikov { "fib", IPFW_VTYPE_FIB }, 900cba2b28SAlexander V. Chernikov { "nat", IPFW_VTYPE_NAT }, 910cba2b28SAlexander V. Chernikov { "dscp", IPFW_VTYPE_DSCP }, 920cba2b28SAlexander V. Chernikov { "tag", IPFW_VTYPE_TAG }, 930cba2b28SAlexander V. Chernikov { "divert", IPFW_VTYPE_DIVERT }, 940cba2b28SAlexander V. Chernikov { "netgraph", IPFW_VTYPE_NETGRAPH }, 950cba2b28SAlexander V. Chernikov { "limit", IPFW_VTYPE_LIMIT }, 960cba2b28SAlexander V. Chernikov { "ipv4", IPFW_VTYPE_NH4 }, 970cba2b28SAlexander V. Chernikov { "ipv6", IPFW_VTYPE_NH6 }, 98adf3b2b9SAlexander V. Chernikov { NULL, 0 } 99adf3b2b9SAlexander V. Chernikov }; 100adf3b2b9SAlexander V. Chernikov 101ac35ff17SAlexander V. Chernikov static struct _s_x tablecmds[] = { 102ac35ff17SAlexander V. Chernikov { "add", TOK_ADD }, 103ac35ff17SAlexander V. Chernikov { "delete", TOK_DEL }, 10446d52008SAlexander V. Chernikov { "create", TOK_CREATE }, 105ac35ff17SAlexander V. Chernikov { "destroy", TOK_DESTROY }, 106ac35ff17SAlexander V. Chernikov { "flush", TOK_FLUSH }, 107adf3b2b9SAlexander V. Chernikov { "modify", TOK_MODIFY }, 10846d52008SAlexander V. Chernikov { "swap", TOK_SWAP }, 109ac35ff17SAlexander V. Chernikov { "info", TOK_INFO }, 110358b9d09SAlexander V. Chernikov { "detail", TOK_DETAIL }, 111ac35ff17SAlexander V. Chernikov { "list", TOK_LIST }, 11281d3153dSAlexander V. Chernikov { "lookup", TOK_LOOKUP }, 1133a845e10SAlexander V. Chernikov { "atomic", TOK_ATOMIC }, 1144f43138aSAlexander V. Chernikov { "lock", TOK_LOCK }, 1154f43138aSAlexander V. Chernikov { "unlock", TOK_UNLOCK }, 116ac35ff17SAlexander V. Chernikov { NULL, 0 } 117ac35ff17SAlexander V. Chernikov }; 118ac35ff17SAlexander V. Chernikov 119f1220db8SAlexander V. Chernikov static int 120f1220db8SAlexander V. Chernikov lookup_host (char *host, struct in_addr *ipaddr) 121f1220db8SAlexander V. Chernikov { 122f1220db8SAlexander V. Chernikov struct hostent *he; 123f1220db8SAlexander V. Chernikov 124f1220db8SAlexander V. Chernikov if (!inet_aton(host, ipaddr)) { 125f1220db8SAlexander V. Chernikov if ((he = gethostbyname(host)) == NULL) 126f1220db8SAlexander V. Chernikov return(-1); 127f1220db8SAlexander V. Chernikov *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 128f1220db8SAlexander V. Chernikov } 129f1220db8SAlexander V. Chernikov return(0); 130f1220db8SAlexander V. Chernikov } 131f1220db8SAlexander V. Chernikov 132f1220db8SAlexander V. Chernikov /* 133f1220db8SAlexander V. Chernikov * This one handles all table-related commands 134ac35ff17SAlexander V. Chernikov * ipfw table NAME create ... 135be695df9SAlexander V. Chernikov * ipfw table NAME modify ... 136421c5838SAndrey V. Elsukov * ipfw table {NAME | all} destroy 137be695df9SAlexander V. Chernikov * ipfw table NAME swap NAME 138be695df9SAlexander V. Chernikov * ipfw table NAME lock 139be695df9SAlexander V. Chernikov * ipfw table NAME unlock 140ac35ff17SAlexander V. Chernikov * ipfw table NAME add addr[/masklen] [value] 141be695df9SAlexander V. Chernikov * ipfw table NAME add [addr[/masklen] value] [addr[/masklen] value] .. 142be695df9SAlexander V. Chernikov * ipfw table NAME delete addr[/masklen] [addr[/masklen]] .. 143be695df9SAlexander V. Chernikov * ipfw table NAME lookup addr 144ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} flush 145ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} list 146ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} info 147be695df9SAlexander V. Chernikov * ipfw table {NAME | all} detail 148f1220db8SAlexander V. Chernikov */ 149f1220db8SAlexander V. Chernikov void 150f1220db8SAlexander V. Chernikov ipfw_table_handler(int ac, char *av[]) 151f1220db8SAlexander V. Chernikov { 152ac35ff17SAlexander V. Chernikov int do_add, is_all; 1533a845e10SAlexander V. Chernikov int atomic, error, tcmd; 154ac35ff17SAlexander V. Chernikov ipfw_xtable_info i; 155ac35ff17SAlexander V. Chernikov ipfw_obj_header oh; 156f1220db8SAlexander V. Chernikov char *tablename; 157d8caf56eSAndrey V. Elsukov uint8_t set; 158358b9d09SAlexander V. Chernikov void *arg; 159f1220db8SAlexander V. Chernikov 160ac35ff17SAlexander V. Chernikov memset(&oh, 0, sizeof(oh)); 161ac35ff17SAlexander V. Chernikov is_all = 0; 16256707beeSMark Johnston if (g_co.use_set != 0) 16356707beeSMark Johnston set = g_co.use_set - 1; 164ac35ff17SAlexander V. Chernikov else 165ac35ff17SAlexander V. Chernikov set = 0; 166f1220db8SAlexander V. Chernikov 167f1220db8SAlexander V. Chernikov ac--; av++; 1689d099b4fSAlexander V. Chernikov NEED1("table needs name"); 169f1220db8SAlexander V. Chernikov tablename = *av; 170f1220db8SAlexander V. Chernikov 171ac35ff17SAlexander V. Chernikov if (table_check_name(tablename) == 0) { 172ac35ff17SAlexander V. Chernikov table_fill_ntlv(&oh.ntlv, *av, set, 1); 173ac35ff17SAlexander V. Chernikov oh.idx = 1; 174ac35ff17SAlexander V. Chernikov } else { 175ac35ff17SAlexander V. Chernikov if (strcmp(tablename, "all") == 0) 176ac35ff17SAlexander V. Chernikov is_all = 1; 177ac35ff17SAlexander V. Chernikov else 178ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "table name %s is invalid", tablename); 179ac35ff17SAlexander V. Chernikov } 180ac35ff17SAlexander V. Chernikov ac--; av++; 1819d099b4fSAlexander V. Chernikov NEED1("table needs command"); 182ac35ff17SAlexander V. Chernikov 183be695df9SAlexander V. Chernikov tcmd = get_token(tablecmds, *av, "table command"); 1843a845e10SAlexander V. Chernikov /* Check if atomic operation was requested */ 1853a845e10SAlexander V. Chernikov atomic = 0; 1863a845e10SAlexander V. Chernikov if (tcmd == TOK_ATOMIC) { 1873a845e10SAlexander V. Chernikov ac--; av++; 1883a845e10SAlexander V. Chernikov NEED1("atomic needs command"); 189be695df9SAlexander V. Chernikov tcmd = get_token(tablecmds, *av, "table command"); 1903a845e10SAlexander V. Chernikov switch (tcmd) { 1913a845e10SAlexander V. Chernikov case TOK_ADD: 1923a845e10SAlexander V. Chernikov break; 1933a845e10SAlexander V. Chernikov default: 1943a845e10SAlexander V. Chernikov errx(EX_USAGE, "atomic is not compatible with %s", *av); 1953a845e10SAlexander V. Chernikov } 1963a845e10SAlexander V. Chernikov atomic = 1; 1973a845e10SAlexander V. Chernikov } 198ac35ff17SAlexander V. Chernikov 199ac35ff17SAlexander V. Chernikov switch (tcmd) { 200ac35ff17SAlexander V. Chernikov case TOK_LIST: 201ac35ff17SAlexander V. Chernikov case TOK_INFO: 202358b9d09SAlexander V. Chernikov case TOK_DETAIL: 203ac35ff17SAlexander V. Chernikov case TOK_FLUSH: 204421c5838SAndrey V. Elsukov case TOK_DESTROY: 205ac35ff17SAlexander V. Chernikov break; 206ac35ff17SAlexander V. Chernikov default: 207ac35ff17SAlexander V. Chernikov if (is_all != 0) 208ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "table name required"); 209ac35ff17SAlexander V. Chernikov } 210ac35ff17SAlexander V. Chernikov 211ac35ff17SAlexander V. Chernikov switch (tcmd) { 212ac35ff17SAlexander V. Chernikov case TOK_ADD: 213ac35ff17SAlexander V. Chernikov case TOK_DEL: 214f1220db8SAlexander V. Chernikov do_add = **av == 'a'; 215f1220db8SAlexander V. Chernikov ac--; av++; 21656707beeSMark Johnston table_modify_record(&oh, ac, av, do_add, g_co.do_quiet, 21756707beeSMark Johnston g_co.do_quiet, atomic); 218ac35ff17SAlexander V. Chernikov break; 219ac35ff17SAlexander V. Chernikov case TOK_CREATE: 220f1220db8SAlexander V. Chernikov ac--; av++; 221ac35ff17SAlexander V. Chernikov table_create(&oh, ac, av); 222ac35ff17SAlexander V. Chernikov break; 223adf3b2b9SAlexander V. Chernikov case TOK_MODIFY: 224adf3b2b9SAlexander V. Chernikov ac--; av++; 225adf3b2b9SAlexander V. Chernikov table_modify(&oh, ac, av); 226adf3b2b9SAlexander V. Chernikov break; 227ac35ff17SAlexander V. Chernikov case TOK_DESTROY: 228421c5838SAndrey V. Elsukov if (is_all == 0) { 22976d03257SAndrey V. Elsukov if (table_destroy(&oh) == 0) 23076d03257SAndrey V. Elsukov break; 23176d03257SAndrey V. Elsukov if (errno != ESRCH) 232421c5838SAndrey V. Elsukov err(EX_OSERR, "failed to destroy table %s", 233421c5838SAndrey V. Elsukov tablename); 23476d03257SAndrey V. Elsukov /* ESRCH isn't fatal, warn if not quiet mode */ 23556707beeSMark Johnston if (g_co.do_quiet == 0) 23676d03257SAndrey V. Elsukov warn("failed to destroy table %s", tablename); 237421c5838SAndrey V. Elsukov } else { 238421c5838SAndrey V. Elsukov error = tables_foreach(table_destroy_one, &oh, 1); 239421c5838SAndrey V. Elsukov if (error != 0) 240421c5838SAndrey V. Elsukov err(EX_OSERR, 241421c5838SAndrey V. Elsukov "failed to destroy tables list"); 242421c5838SAndrey V. Elsukov } 243ac35ff17SAlexander V. Chernikov break; 244ac35ff17SAlexander V. Chernikov case TOK_FLUSH: 245f1220db8SAlexander V. Chernikov if (is_all == 0) { 24676d03257SAndrey V. Elsukov if ((error = table_flush(&oh)) == 0) 24776d03257SAndrey V. Elsukov break; 24876d03257SAndrey V. Elsukov if (errno != ESRCH) 249f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to flush table %s info", 250f1220db8SAlexander V. Chernikov tablename); 25176d03257SAndrey V. Elsukov /* ESRCH isn't fatal, warn if not quiet mode */ 25256707beeSMark Johnston if (g_co.do_quiet == 0) 25376d03257SAndrey V. Elsukov warn("failed to flush table %s info", 25476d03257SAndrey V. Elsukov tablename); 255f1220db8SAlexander V. Chernikov } else { 256ac35ff17SAlexander V. Chernikov error = tables_foreach(table_flush_one, &oh, 1); 257f1220db8SAlexander V. Chernikov if (error != 0) 258f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to flush tables list"); 25976d03257SAndrey V. Elsukov /* XXX: we ignore errors here */ 260f1220db8SAlexander V. Chernikov } 261ac35ff17SAlexander V. Chernikov break; 26246d52008SAlexander V. Chernikov case TOK_SWAP: 26346d52008SAlexander V. Chernikov ac--; av++; 26446d52008SAlexander V. Chernikov NEED1("second table name required"); 26546d52008SAlexander V. Chernikov table_swap(&oh, *av); 26646d52008SAlexander V. Chernikov break; 2674f43138aSAlexander V. Chernikov case TOK_LOCK: 2684f43138aSAlexander V. Chernikov case TOK_UNLOCK: 2694f43138aSAlexander V. Chernikov table_lock(&oh, (tcmd == TOK_LOCK)); 2704f43138aSAlexander V. Chernikov break; 271358b9d09SAlexander V. Chernikov case TOK_DETAIL: 272ac35ff17SAlexander V. Chernikov case TOK_INFO: 273358b9d09SAlexander V. Chernikov arg = (tcmd == TOK_DETAIL) ? (void *)1 : NULL; 274f1220db8SAlexander V. Chernikov if (is_all == 0) { 275ac35ff17SAlexander V. Chernikov if ((error = table_get_info(&oh, &i)) != 0) 276f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to request table info"); 277358b9d09SAlexander V. Chernikov table_show_info(&i, arg); 278f1220db8SAlexander V. Chernikov } else { 279358b9d09SAlexander V. Chernikov error = tables_foreach(table_show_info, arg, 1); 280f1220db8SAlexander V. Chernikov if (error != 0) 281f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to request tables list"); 282f1220db8SAlexander V. Chernikov } 283ac35ff17SAlexander V. Chernikov break; 284ac35ff17SAlexander V. Chernikov case TOK_LIST: 28510e3bebfSBryan Drewery arg = is_all ? (void*)1 : NULL; 286ac35ff17SAlexander V. Chernikov if (is_all == 0) { 287ac35ff17SAlexander V. Chernikov if ((error = table_get_info(&oh, &i)) != 0) 288ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to request table info"); 2892b3d6647SBryan Drewery table_show_one(&i, arg); 290f1220db8SAlexander V. Chernikov } else { 2912b3d6647SBryan Drewery error = tables_foreach(table_show_one, arg, 1); 292ac35ff17SAlexander V. Chernikov if (error != 0) 293ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to request tables list"); 294f1220db8SAlexander V. Chernikov } 295ac35ff17SAlexander V. Chernikov break; 29681d3153dSAlexander V. Chernikov case TOK_LOOKUP: 29781d3153dSAlexander V. Chernikov ac--; av++; 29881d3153dSAlexander V. Chernikov table_lookup(&oh, ac, av); 29981d3153dSAlexander V. Chernikov break; 300f1220db8SAlexander V. Chernikov } 301f1220db8SAlexander V. Chernikov } 302f1220db8SAlexander V. Chernikov 303d8caf56eSAndrey V. Elsukov void 304d8caf56eSAndrey V. Elsukov table_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set, 3052acdf79fSAndrey V. Elsukov uint16_t uidx) 306f1220db8SAlexander V. Chernikov { 307f1220db8SAlexander V. Chernikov 308563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 309f1220db8SAlexander V. Chernikov ntlv->head.length = sizeof(ipfw_obj_ntlv); 310f1220db8SAlexander V. Chernikov ntlv->idx = uidx; 311ac35ff17SAlexander V. Chernikov ntlv->set = set; 312f1220db8SAlexander V. Chernikov strlcpy(ntlv->name, name, sizeof(ntlv->name)); 313f1220db8SAlexander V. Chernikov } 314f1220db8SAlexander V. Chernikov 315f1220db8SAlexander V. Chernikov static void 316f1220db8SAlexander V. Chernikov table_fill_objheader(ipfw_obj_header *oh, ipfw_xtable_info *i) 317f1220db8SAlexander V. Chernikov { 318f1220db8SAlexander V. Chernikov 319f1220db8SAlexander V. Chernikov oh->idx = 1; 32081d3153dSAlexander V. Chernikov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 321ac35ff17SAlexander V. Chernikov } 322ac35ff17SAlexander V. Chernikov 323ac35ff17SAlexander V. Chernikov static struct _s_x tablenewcmds[] = { 324ac35ff17SAlexander V. Chernikov { "type", TOK_TYPE }, 325ac35ff17SAlexander V. Chernikov { "valtype", TOK_VALTYPE }, 326ac35ff17SAlexander V. Chernikov { "algo", TOK_ALGO }, 3274c0c07a5SAlexander V. Chernikov { "limit", TOK_LIMIT }, 3284f43138aSAlexander V. Chernikov { "locked", TOK_LOCK }, 32905ab1ef6SAndrey V. Elsukov { "missing", TOK_MISSING }, 33005ab1ef6SAndrey V. Elsukov { "or-flush", TOK_ORFLUSH }, 331ac35ff17SAlexander V. Chernikov { NULL, 0 } 332ac35ff17SAlexander V. Chernikov }; 333ac35ff17SAlexander V. Chernikov 334914bffb6SAlexander V. Chernikov static struct _s_x flowtypecmds[] = { 335914bffb6SAlexander V. Chernikov { "src-ip", IPFW_TFFLAG_SRCIP }, 336914bffb6SAlexander V. Chernikov { "proto", IPFW_TFFLAG_PROTO }, 337914bffb6SAlexander V. Chernikov { "src-port", IPFW_TFFLAG_SRCPORT }, 338914bffb6SAlexander V. Chernikov { "dst-ip", IPFW_TFFLAG_DSTIP }, 339914bffb6SAlexander V. Chernikov { "dst-port", IPFW_TFFLAG_DSTPORT }, 340914bffb6SAlexander V. Chernikov { NULL, 0 } 341914bffb6SAlexander V. Chernikov }; 342914bffb6SAlexander V. Chernikov 34356707beeSMark Johnston static int 344914bffb6SAlexander V. Chernikov table_parse_type(uint8_t ttype, char *p, uint8_t *tflags) 345914bffb6SAlexander V. Chernikov { 3460cba2b28SAlexander V. Chernikov uint32_t fset, fclear; 3470cba2b28SAlexander V. Chernikov char *e; 348914bffb6SAlexander V. Chernikov 349914bffb6SAlexander V. Chernikov /* Parse type options */ 350914bffb6SAlexander V. Chernikov switch(ttype) { 351914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 352914bffb6SAlexander V. Chernikov fset = fclear = 0; 3530cba2b28SAlexander V. Chernikov if (fill_flags(flowtypecmds, p, &e, &fset, &fclear) != 0) 3540cba2b28SAlexander V. Chernikov errx(EX_USAGE, 3550cba2b28SAlexander V. Chernikov "unable to parse flow option %s", e); 356914bffb6SAlexander V. Chernikov *tflags = fset; 357914bffb6SAlexander V. Chernikov break; 358914bffb6SAlexander V. Chernikov default: 359914bffb6SAlexander V. Chernikov return (EX_USAGE); 360914bffb6SAlexander V. Chernikov } 361914bffb6SAlexander V. Chernikov 362914bffb6SAlexander V. Chernikov return (0); 363914bffb6SAlexander V. Chernikov } 364914bffb6SAlexander V. Chernikov 36556707beeSMark Johnston static void 366914bffb6SAlexander V. Chernikov table_print_type(char *tbuf, size_t size, uint8_t type, uint8_t tflags) 367914bffb6SAlexander V. Chernikov { 368914bffb6SAlexander V. Chernikov const char *tname; 369914bffb6SAlexander V. Chernikov int l; 370914bffb6SAlexander V. Chernikov 371914bffb6SAlexander V. Chernikov if ((tname = match_value(tabletypes, type)) == NULL) 372914bffb6SAlexander V. Chernikov tname = "unknown"; 373914bffb6SAlexander V. Chernikov 374914bffb6SAlexander V. Chernikov l = snprintf(tbuf, size, "%s", tname); 375914bffb6SAlexander V. Chernikov tbuf += l; 376914bffb6SAlexander V. Chernikov size -= l; 377914bffb6SAlexander V. Chernikov 378914bffb6SAlexander V. Chernikov switch(type) { 379914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 380914bffb6SAlexander V. Chernikov if (tflags != 0) { 381914bffb6SAlexander V. Chernikov *tbuf++ = ':'; 382914bffb6SAlexander V. Chernikov l--; 383914bffb6SAlexander V. Chernikov print_flags_buffer(tbuf, size, flowtypecmds, tflags); 384914bffb6SAlexander V. Chernikov } 385914bffb6SAlexander V. Chernikov break; 386914bffb6SAlexander V. Chernikov } 387914bffb6SAlexander V. Chernikov } 388914bffb6SAlexander V. Chernikov 389ac35ff17SAlexander V. Chernikov /* 390ac35ff17SAlexander V. Chernikov * Creates new table 391ac35ff17SAlexander V. Chernikov * 392c21034b7SAlexander V. Chernikov * ipfw table NAME create [ type { addr | iface | number | flow } ] 39305ab1ef6SAndrey V. Elsukov * [ algo algoname ] [missing] [or-flush] 394ac35ff17SAlexander V. Chernikov */ 395ac35ff17SAlexander V. Chernikov static void 396ac35ff17SAlexander V. Chernikov table_create(ipfw_obj_header *oh, int ac, char *av[]) 397ac35ff17SAlexander V. Chernikov { 39805ab1ef6SAndrey V. Elsukov ipfw_xtable_info xi, xie; 39905ab1ef6SAndrey V. Elsukov int error, missing, orflush, tcmd, val; 4000cba2b28SAlexander V. Chernikov uint32_t fset, fclear; 4010cba2b28SAlexander V. Chernikov char *e, *p; 402ac35ff17SAlexander V. Chernikov char tbuf[128]; 403ac35ff17SAlexander V. Chernikov 40405ab1ef6SAndrey V. Elsukov missing = orflush = 0; 405ac35ff17SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 406ac35ff17SAlexander V. Chernikov while (ac > 0) { 407be695df9SAlexander V. Chernikov tcmd = get_token(tablenewcmds, *av, "option"); 408ac35ff17SAlexander V. Chernikov ac--; av++; 409ac35ff17SAlexander V. Chernikov 410ac35ff17SAlexander V. Chernikov switch (tcmd) { 4114c0c07a5SAlexander V. Chernikov case TOK_LIMIT: 4124c0c07a5SAlexander V. Chernikov NEED1("limit value required"); 4134c0c07a5SAlexander V. Chernikov xi.limit = strtol(*av, NULL, 10); 4144c0c07a5SAlexander V. Chernikov ac--; av++; 4154c0c07a5SAlexander V. Chernikov break; 416ac35ff17SAlexander V. Chernikov case TOK_TYPE: 417ac35ff17SAlexander V. Chernikov NEED1("table type required"); 418914bffb6SAlexander V. Chernikov /* Type may have suboptions after ':' */ 419914bffb6SAlexander V. Chernikov if ((p = strchr(*av, ':')) != NULL) 420914bffb6SAlexander V. Chernikov *p++ = '\0'; 421ac35ff17SAlexander V. Chernikov val = match_token(tabletypes, *av); 422914bffb6SAlexander V. Chernikov if (val == -1) { 423914bffb6SAlexander V. Chernikov concat_tokens(tbuf, sizeof(tbuf), tabletypes, 424914bffb6SAlexander V. Chernikov ", "); 425914bffb6SAlexander V. Chernikov errx(EX_USAGE, 426914bffb6SAlexander V. Chernikov "Unknown tabletype: %s. Supported: %s", 427ac35ff17SAlexander V. Chernikov *av, tbuf); 428914bffb6SAlexander V. Chernikov } 429914bffb6SAlexander V. Chernikov xi.type = val; 430914bffb6SAlexander V. Chernikov if (p != NULL) { 431914bffb6SAlexander V. Chernikov error = table_parse_type(val, p, &xi.tflags); 432914bffb6SAlexander V. Chernikov if (error != 0) 433914bffb6SAlexander V. Chernikov errx(EX_USAGE, 434914bffb6SAlexander V. Chernikov "Unsupported suboptions: %s", p); 435914bffb6SAlexander V. Chernikov } 436914bffb6SAlexander V. Chernikov ac--; av++; 437ac35ff17SAlexander V. Chernikov break; 438ac35ff17SAlexander V. Chernikov case TOK_VALTYPE: 439ac35ff17SAlexander V. Chernikov NEED1("table value type required"); 4400cba2b28SAlexander V. Chernikov fset = fclear = 0; 4410cba2b28SAlexander V. Chernikov val = fill_flags(tablevaltypes, *av, &e, &fset, &fclear); 442ac35ff17SAlexander V. Chernikov if (val != -1) { 4430cba2b28SAlexander V. Chernikov xi.vmask = fset; 444ac35ff17SAlexander V. Chernikov ac--; av++; 445ac35ff17SAlexander V. Chernikov break; 446ac35ff17SAlexander V. Chernikov } 447ac35ff17SAlexander V. Chernikov concat_tokens(tbuf, sizeof(tbuf), tablevaltypes, ", "); 448ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "Unknown value type: %s. Supported: %s", 4490cba2b28SAlexander V. Chernikov e, tbuf); 450adf3b2b9SAlexander V. Chernikov break; 451ac35ff17SAlexander V. Chernikov case TOK_ALGO: 452ac35ff17SAlexander V. Chernikov NEED1("table algorithm name required"); 453ac35ff17SAlexander V. Chernikov if (strlen(*av) > sizeof(xi.algoname)) 454ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "algorithm name too long"); 455ac35ff17SAlexander V. Chernikov strlcpy(xi.algoname, *av, sizeof(xi.algoname)); 456ac35ff17SAlexander V. Chernikov ac--; av++; 457ac35ff17SAlexander V. Chernikov break; 4584f43138aSAlexander V. Chernikov case TOK_LOCK: 4594f43138aSAlexander V. Chernikov xi.flags |= IPFW_TGFLAGS_LOCKED; 4604f43138aSAlexander V. Chernikov break; 46105ab1ef6SAndrey V. Elsukov case TOK_ORFLUSH: 46205ab1ef6SAndrey V. Elsukov orflush = 1; 46305ab1ef6SAndrey V. Elsukov /* FALLTHROUGH */ 46405ab1ef6SAndrey V. Elsukov case TOK_MISSING: 46505ab1ef6SAndrey V. Elsukov missing = 1; 46605ab1ef6SAndrey V. Elsukov break; 467ac35ff17SAlexander V. Chernikov } 468ac35ff17SAlexander V. Chernikov } 469ac35ff17SAlexander V. Chernikov 470463a577bSEitan Adler /* Set some defaults to preserve compatibility. */ 471fd0869d5SAlexander V. Chernikov if (xi.algoname[0] == '\0' && xi.type == 0) 472c21034b7SAlexander V. Chernikov xi.type = IPFW_TABLE_ADDR; 4730cba2b28SAlexander V. Chernikov if (xi.vmask == 0) 4740cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 475fd0869d5SAlexander V. Chernikov 47605ab1ef6SAndrey V. Elsukov error = table_do_create(oh, &xi); 47705ab1ef6SAndrey V. Elsukov 47805ab1ef6SAndrey V. Elsukov if (error == 0) 47905ab1ef6SAndrey V. Elsukov return; 48005ab1ef6SAndrey V. Elsukov 48105ab1ef6SAndrey V. Elsukov if (errno != EEXIST || missing == 0) 482ac35ff17SAlexander V. Chernikov err(EX_OSERR, "Table creation failed"); 48305ab1ef6SAndrey V. Elsukov 48405ab1ef6SAndrey V. Elsukov /* Check that existing table is the same we are trying to create */ 48505ab1ef6SAndrey V. Elsukov if (table_get_info(oh, &xie) != 0) 48605ab1ef6SAndrey V. Elsukov err(EX_OSERR, "Existing table check failed"); 48705ab1ef6SAndrey V. Elsukov 48805ab1ef6SAndrey V. Elsukov if (xi.limit != xie.limit || xi.type != xie.type || 48905ab1ef6SAndrey V. Elsukov xi.tflags != xie.tflags || xi.vmask != xie.vmask || ( 49005ab1ef6SAndrey V. Elsukov xi.algoname[0] != '\0' && strcmp(xi.algoname, 49105ab1ef6SAndrey V. Elsukov xie.algoname) != 0) || xi.flags != xie.flags) 49205ab1ef6SAndrey V. Elsukov errx(EX_DATAERR, "The existing table is not compatible " 49305ab1ef6SAndrey V. Elsukov "with one you are creating."); 49405ab1ef6SAndrey V. Elsukov 49505ab1ef6SAndrey V. Elsukov /* Flush existing table if instructed to do so */ 49605ab1ef6SAndrey V. Elsukov if (orflush != 0 && table_flush(oh) != 0) 49705ab1ef6SAndrey V. Elsukov err(EX_OSERR, "Table flush on creation failed"); 498f1220db8SAlexander V. Chernikov } 499f1220db8SAlexander V. Chernikov 500f1220db8SAlexander V. Chernikov /* 501ac35ff17SAlexander V. Chernikov * Creates new table 502ac35ff17SAlexander V. Chernikov * 503ac35ff17SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 504ac35ff17SAlexander V. Chernikov * 505f1220db8SAlexander V. Chernikov * Returns 0 on success. 506f1220db8SAlexander V. Chernikov */ 507f1220db8SAlexander V. Chernikov static int 508ac35ff17SAlexander V. Chernikov table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i) 509f1220db8SAlexander V. Chernikov { 510ac35ff17SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 511ac35ff17SAlexander V. Chernikov int error; 512f1220db8SAlexander V. Chernikov 513ac35ff17SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 514ac35ff17SAlexander V. Chernikov memcpy(tbuf + sizeof(*oh), i, sizeof(*i)); 515ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 516ac35ff17SAlexander V. Chernikov 517ac35ff17SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XCREATE, &oh->opheader, sizeof(tbuf)); 518ac35ff17SAlexander V. Chernikov 519ac35ff17SAlexander V. Chernikov return (error); 520ac35ff17SAlexander V. Chernikov } 521ac35ff17SAlexander V. Chernikov 522ac35ff17SAlexander V. Chernikov /* 523adf3b2b9SAlexander V. Chernikov * Modifies existing table 524adf3b2b9SAlexander V. Chernikov * 5250cba2b28SAlexander V. Chernikov * ipfw table NAME modify [ limit number ] 526adf3b2b9SAlexander V. Chernikov */ 527adf3b2b9SAlexander V. Chernikov static void 528adf3b2b9SAlexander V. Chernikov table_modify(ipfw_obj_header *oh, int ac, char *av[]) 529adf3b2b9SAlexander V. Chernikov { 530adf3b2b9SAlexander V. Chernikov ipfw_xtable_info xi; 531b6462881SAlexander V. Chernikov int tcmd; 532adf3b2b9SAlexander V. Chernikov 533adf3b2b9SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 534adf3b2b9SAlexander V. Chernikov 535adf3b2b9SAlexander V. Chernikov while (ac > 0) { 536be695df9SAlexander V. Chernikov tcmd = get_token(tablenewcmds, *av, "option"); 537adf3b2b9SAlexander V. Chernikov ac--; av++; 538adf3b2b9SAlexander V. Chernikov 539adf3b2b9SAlexander V. Chernikov switch (tcmd) { 540adf3b2b9SAlexander V. Chernikov case TOK_LIMIT: 541adf3b2b9SAlexander V. Chernikov NEED1("limit value required"); 542adf3b2b9SAlexander V. Chernikov xi.limit = strtol(*av, NULL, 10); 543adf3b2b9SAlexander V. Chernikov xi.mflags |= IPFW_TMFLAGS_LIMIT; 544adf3b2b9SAlexander V. Chernikov ac--; av++; 545adf3b2b9SAlexander V. Chernikov break; 5460cba2b28SAlexander V. Chernikov default: 5476ef82c0aSAlan Somers errx(EX_USAGE, "cmd is not supported for modification"); 548adf3b2b9SAlexander V. Chernikov } 549adf3b2b9SAlexander V. Chernikov } 550adf3b2b9SAlexander V. Chernikov 551b6462881SAlexander V. Chernikov if (table_do_modify(oh, &xi) != 0) 552adf3b2b9SAlexander V. Chernikov err(EX_OSERR, "Table modification failed"); 553adf3b2b9SAlexander V. Chernikov } 554adf3b2b9SAlexander V. Chernikov 555adf3b2b9SAlexander V. Chernikov /* 556adf3b2b9SAlexander V. Chernikov * Modifies existing table. 557adf3b2b9SAlexander V. Chernikov * 558adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 559adf3b2b9SAlexander V. Chernikov * 560adf3b2b9SAlexander V. Chernikov * Returns 0 on success. 561adf3b2b9SAlexander V. Chernikov */ 562adf3b2b9SAlexander V. Chernikov static int 563adf3b2b9SAlexander V. Chernikov table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i) 564adf3b2b9SAlexander V. Chernikov { 565adf3b2b9SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 566adf3b2b9SAlexander V. Chernikov int error; 567adf3b2b9SAlexander V. Chernikov 568adf3b2b9SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 569adf3b2b9SAlexander V. Chernikov memcpy(tbuf + sizeof(*oh), i, sizeof(*i)); 570adf3b2b9SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 571adf3b2b9SAlexander V. Chernikov 572adf3b2b9SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XMODIFY, &oh->opheader, sizeof(tbuf)); 573adf3b2b9SAlexander V. Chernikov 574adf3b2b9SAlexander V. Chernikov return (error); 575adf3b2b9SAlexander V. Chernikov } 5764f43138aSAlexander V. Chernikov 5774f43138aSAlexander V. Chernikov /* 5784f43138aSAlexander V. Chernikov * Locks or unlocks given table 5794f43138aSAlexander V. Chernikov */ 5804f43138aSAlexander V. Chernikov static void 5814f43138aSAlexander V. Chernikov table_lock(ipfw_obj_header *oh, int lock) 5824f43138aSAlexander V. Chernikov { 5834f43138aSAlexander V. Chernikov ipfw_xtable_info xi; 5844f43138aSAlexander V. Chernikov 5854f43138aSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 5864f43138aSAlexander V. Chernikov 5874f43138aSAlexander V. Chernikov xi.mflags |= IPFW_TMFLAGS_LOCK; 5884f43138aSAlexander V. Chernikov xi.flags |= (lock != 0) ? IPFW_TGFLAGS_LOCKED : 0; 5894f43138aSAlexander V. Chernikov 590b6462881SAlexander V. Chernikov if (table_do_modify(oh, &xi) != 0) 5914f43138aSAlexander V. Chernikov err(EX_OSERR, "Table %s failed", lock != 0 ? "lock" : "unlock"); 5924f43138aSAlexander V. Chernikov } 5934f43138aSAlexander V. Chernikov 594adf3b2b9SAlexander V. Chernikov /* 595ac35ff17SAlexander V. Chernikov * Destroys given table specified by @oh->ntlv. 596ac35ff17SAlexander V. Chernikov * Returns 0 on success. 597ac35ff17SAlexander V. Chernikov */ 598ac35ff17SAlexander V. Chernikov static int 599ac35ff17SAlexander V. Chernikov table_destroy(ipfw_obj_header *oh) 600ac35ff17SAlexander V. Chernikov { 601ac35ff17SAlexander V. Chernikov 602ac35ff17SAlexander V. Chernikov if (do_set3(IP_FW_TABLE_XDESTROY, &oh->opheader, sizeof(*oh)) != 0) 603f1220db8SAlexander V. Chernikov return (-1); 604f1220db8SAlexander V. Chernikov 605f1220db8SAlexander V. Chernikov return (0); 606f1220db8SAlexander V. Chernikov } 607f1220db8SAlexander V. Chernikov 608421c5838SAndrey V. Elsukov static int 609421c5838SAndrey V. Elsukov table_destroy_one(ipfw_xtable_info *i, void *arg) 610421c5838SAndrey V. Elsukov { 611421c5838SAndrey V. Elsukov ipfw_obj_header *oh; 612421c5838SAndrey V. Elsukov 613421c5838SAndrey V. Elsukov oh = (ipfw_obj_header *)arg; 614421c5838SAndrey V. Elsukov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 615421c5838SAndrey V. Elsukov if (table_destroy(oh) != 0) { 61656707beeSMark Johnston if (g_co.do_quiet == 0) 617421c5838SAndrey V. Elsukov warn("failed to destroy table(%s) in set %u", 618421c5838SAndrey V. Elsukov i->tablename, i->set); 619421c5838SAndrey V. Elsukov return (-1); 620421c5838SAndrey V. Elsukov } 621421c5838SAndrey V. Elsukov return (0); 622421c5838SAndrey V. Elsukov } 623421c5838SAndrey V. Elsukov 624f1220db8SAlexander V. Chernikov /* 625ac35ff17SAlexander V. Chernikov * Flushes given table specified by @oh->ntlv. 626f1220db8SAlexander V. Chernikov * Returns 0 on success. 627f1220db8SAlexander V. Chernikov */ 628f1220db8SAlexander V. Chernikov static int 629ac35ff17SAlexander V. Chernikov table_flush(ipfw_obj_header *oh) 630f1220db8SAlexander V. Chernikov { 631f1220db8SAlexander V. Chernikov 632ac35ff17SAlexander V. Chernikov if (do_set3(IP_FW_TABLE_XFLUSH, &oh->opheader, sizeof(*oh)) != 0) 633f1220db8SAlexander V. Chernikov return (-1); 634f1220db8SAlexander V. Chernikov 635f1220db8SAlexander V. Chernikov return (0); 636f1220db8SAlexander V. Chernikov } 637f1220db8SAlexander V. Chernikov 63846d52008SAlexander V. Chernikov static int 63946d52008SAlexander V. Chernikov table_do_swap(ipfw_obj_header *oh, char *second) 64046d52008SAlexander V. Chernikov { 64146d52008SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ntlv)]; 64246d52008SAlexander V. Chernikov int error; 64346d52008SAlexander V. Chernikov 64446d52008SAlexander V. Chernikov memset(tbuf, 0, sizeof(tbuf)); 64546d52008SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 64646d52008SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 64746d52008SAlexander V. Chernikov table_fill_ntlv((ipfw_obj_ntlv *)(oh + 1), second, oh->ntlv.set, 1); 64846d52008SAlexander V. Chernikov 64946d52008SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XSWAP, &oh->opheader, sizeof(tbuf)); 65046d52008SAlexander V. Chernikov 65146d52008SAlexander V. Chernikov return (error); 65246d52008SAlexander V. Chernikov } 65346d52008SAlexander V. Chernikov 65446d52008SAlexander V. Chernikov /* 65546d52008SAlexander V. Chernikov * Swaps given table with @second one. 65646d52008SAlexander V. Chernikov */ 65746d52008SAlexander V. Chernikov static int 65846d52008SAlexander V. Chernikov table_swap(ipfw_obj_header *oh, char *second) 65946d52008SAlexander V. Chernikov { 66046d52008SAlexander V. Chernikov 66146d52008SAlexander V. Chernikov if (table_check_name(second) != 0) 66246d52008SAlexander V. Chernikov errx(EX_USAGE, "table name %s is invalid", second); 66346d52008SAlexander V. Chernikov 66476d03257SAndrey V. Elsukov if (table_do_swap(oh, second) == 0) 66576d03257SAndrey V. Elsukov return (0); 66646d52008SAlexander V. Chernikov 66776d03257SAndrey V. Elsukov switch (errno) { 66846d52008SAlexander V. Chernikov case EINVAL: 66946d52008SAlexander V. Chernikov errx(EX_USAGE, "Unable to swap table: check types"); 67046d52008SAlexander V. Chernikov case EFBIG: 67146d52008SAlexander V. Chernikov errx(EX_USAGE, "Unable to swap table: check limits"); 67246d52008SAlexander V. Chernikov } 67346d52008SAlexander V. Chernikov 67446d52008SAlexander V. Chernikov return (0); 67546d52008SAlexander V. Chernikov } 67646d52008SAlexander V. Chernikov 67746d52008SAlexander V. Chernikov 678f1220db8SAlexander V. Chernikov /* 679ac35ff17SAlexander V. Chernikov * Retrieves table in given table specified by @oh->ntlv. 680f1220db8SAlexander V. Chernikov * it inside @i. 681f1220db8SAlexander V. Chernikov * Returns 0 on success. 682f1220db8SAlexander V. Chernikov */ 683f1220db8SAlexander V. Chernikov static int 684ac35ff17SAlexander V. Chernikov table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i) 685f1220db8SAlexander V. Chernikov { 686f1220db8SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 687f1220db8SAlexander V. Chernikov size_t sz; 688f1220db8SAlexander V. Chernikov 689f1220db8SAlexander V. Chernikov sz = sizeof(tbuf); 690f1220db8SAlexander V. Chernikov memset(tbuf, 0, sizeof(tbuf)); 691ac35ff17SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 692f1220db8SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 693f1220db8SAlexander V. Chernikov 694b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XINFO, &oh->opheader, &sz) != 0) 695b6462881SAlexander V. Chernikov return (errno); 696f1220db8SAlexander V. Chernikov 697f1220db8SAlexander V. Chernikov if (sz < sizeof(tbuf)) 698ac35ff17SAlexander V. Chernikov return (EINVAL); 699f1220db8SAlexander V. Chernikov 700f1220db8SAlexander V. Chernikov *i = *(ipfw_xtable_info *)(oh + 1); 701f1220db8SAlexander V. Chernikov 702f1220db8SAlexander V. Chernikov return (0); 703f1220db8SAlexander V. Chernikov } 704f1220db8SAlexander V. Chernikov 7055f379342SAlexander V. Chernikov static struct _s_x tablealgoclass[] = { 7065f379342SAlexander V. Chernikov { "hash", IPFW_TACLASS_HASH }, 7075f379342SAlexander V. Chernikov { "array", IPFW_TACLASS_ARRAY }, 7085f379342SAlexander V. Chernikov { "radix", IPFW_TACLASS_RADIX }, 7095f379342SAlexander V. Chernikov { NULL, 0 } 7105f379342SAlexander V. Chernikov }; 7115f379342SAlexander V. Chernikov 7125f379342SAlexander V. Chernikov struct ta_cldata { 7135f379342SAlexander V. Chernikov uint8_t taclass; 7145f379342SAlexander V. Chernikov uint8_t spare4; 7155f379342SAlexander V. Chernikov uint16_t itemsize; 7165f379342SAlexander V. Chernikov uint16_t itemsize6; 7175f379342SAlexander V. Chernikov uint32_t size; 7185f379342SAlexander V. Chernikov uint32_t count; 7195f379342SAlexander V. Chernikov }; 7205f379342SAlexander V. Chernikov 7215f379342SAlexander V. Chernikov /* 7225f379342SAlexander V. Chernikov * Print global/per-AF table @i algorithm info. 7235f379342SAlexander V. Chernikov */ 7245f379342SAlexander V. Chernikov static void 72556707beeSMark Johnston table_show_tainfo(ipfw_xtable_info *i __unused, struct ta_cldata *d, 7265f379342SAlexander V. Chernikov const char *af, const char *taclass) 7275f379342SAlexander V. Chernikov { 7285f379342SAlexander V. Chernikov 7295f379342SAlexander V. Chernikov switch (d->taclass) { 7305f379342SAlexander V. Chernikov case IPFW_TACLASS_HASH: 7315f379342SAlexander V. Chernikov case IPFW_TACLASS_ARRAY: 7325f379342SAlexander V. Chernikov printf(" %salgorithm %s info\n", af, taclass); 7335f379342SAlexander V. Chernikov if (d->itemsize == d->itemsize6) 7345f379342SAlexander V. Chernikov printf(" size: %u items: %u itemsize: %u\n", 7355f379342SAlexander V. Chernikov d->size, d->count, d->itemsize); 7365f379342SAlexander V. Chernikov else 7375f379342SAlexander V. Chernikov printf(" size: %u items: %u " 7385f379342SAlexander V. Chernikov "itemsize4: %u itemsize6: %u\n", 7395f379342SAlexander V. Chernikov d->size, d->count, 7405f379342SAlexander V. Chernikov d->itemsize, d->itemsize6); 7415f379342SAlexander V. Chernikov break; 7425f379342SAlexander V. Chernikov case IPFW_TACLASS_RADIX: 7435f379342SAlexander V. Chernikov printf(" %salgorithm %s info\n", af, taclass); 7445f379342SAlexander V. Chernikov if (d->itemsize == d->itemsize6) 7455f379342SAlexander V. Chernikov printf(" items: %u itemsize: %u\n", 7465f379342SAlexander V. Chernikov d->count, d->itemsize); 7475f379342SAlexander V. Chernikov else 7485f379342SAlexander V. Chernikov printf(" items: %u " 7495f379342SAlexander V. Chernikov "itemsize4: %u itemsize6: %u\n", 7505f379342SAlexander V. Chernikov d->count, d->itemsize, d->itemsize6); 7515f379342SAlexander V. Chernikov break; 7525f379342SAlexander V. Chernikov default: 7535f379342SAlexander V. Chernikov printf(" algo class: %s\n", taclass); 7545f379342SAlexander V. Chernikov } 7555f379342SAlexander V. Chernikov } 7565f379342SAlexander V. Chernikov 7570cba2b28SAlexander V. Chernikov static void 7580cba2b28SAlexander V. Chernikov table_print_valheader(char *buf, size_t bufsize, uint32_t vmask) 7590cba2b28SAlexander V. Chernikov { 7600cba2b28SAlexander V. Chernikov 7610cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 7620cba2b28SAlexander V. Chernikov snprintf(buf, bufsize, "legacy"); 7630cba2b28SAlexander V. Chernikov return; 7640cba2b28SAlexander V. Chernikov } 7650cba2b28SAlexander V. Chernikov 7668a6dbb64SAlexander V. Chernikov memset(buf, 0, bufsize); 7670cba2b28SAlexander V. Chernikov print_flags_buffer(buf, bufsize, tablevaltypes, vmask); 7680cba2b28SAlexander V. Chernikov } 7690cba2b28SAlexander V. Chernikov 770f1220db8SAlexander V. Chernikov /* 771f1220db8SAlexander V. Chernikov * Prints table info struct @i in human-readable form. 772f1220db8SAlexander V. Chernikov */ 773f1220db8SAlexander V. Chernikov static int 774f1220db8SAlexander V. Chernikov table_show_info(ipfw_xtable_info *i, void *arg) 775f1220db8SAlexander V. Chernikov { 7760cba2b28SAlexander V. Chernikov const char *vtype; 7775f379342SAlexander V. Chernikov ipfw_ta_tinfo *tainfo; 7785f379342SAlexander V. Chernikov int afdata, afitem; 7795f379342SAlexander V. Chernikov struct ta_cldata d; 780adf3b2b9SAlexander V. Chernikov char ttype[64], tvtype[64]; 781f1220db8SAlexander V. Chernikov 782914bffb6SAlexander V. Chernikov table_print_type(ttype, sizeof(ttype), i->type, i->tflags); 7830cba2b28SAlexander V. Chernikov table_print_valheader(tvtype, sizeof(tvtype), i->vmask); 784ac35ff17SAlexander V. Chernikov 785914bffb6SAlexander V. Chernikov printf("--- table(%s), set(%u) ---\n", i->tablename, i->set); 7864f43138aSAlexander V. Chernikov if ((i->flags & IPFW_TGFLAGS_LOCKED) != 0) 7874f43138aSAlexander V. Chernikov printf(" kindex: %d, type: %s, locked\n", i->kidx, ttype); 7884f43138aSAlexander V. Chernikov else 789914bffb6SAlexander V. Chernikov printf(" kindex: %d, type: %s\n", i->kidx, ttype); 7900cba2b28SAlexander V. Chernikov printf(" references: %u, valtype: %s\n", i->refcnt, tvtype); 7919d099b4fSAlexander V. Chernikov printf(" algorithm: %s\n", i->algoname); 792f1220db8SAlexander V. Chernikov printf(" items: %u, size: %u\n", i->count, i->size); 7934c0c07a5SAlexander V. Chernikov if (i->limit > 0) 7944c0c07a5SAlexander V. Chernikov printf(" limit: %u\n", i->limit); 795f1220db8SAlexander V. Chernikov 796358b9d09SAlexander V. Chernikov /* Print algo-specific info if requested & set */ 797358b9d09SAlexander V. Chernikov if (arg == NULL) 798358b9d09SAlexander V. Chernikov return (0); 799358b9d09SAlexander V. Chernikov 8005f379342SAlexander V. Chernikov if ((i->ta_info.flags & IPFW_TATFLAGS_DATA) == 0) 8015f379342SAlexander V. Chernikov return (0); 8025f379342SAlexander V. Chernikov tainfo = &i->ta_info; 8035f379342SAlexander V. Chernikov 8045f379342SAlexander V. Chernikov afdata = 0; 8055f379342SAlexander V. Chernikov afitem = 0; 8065f379342SAlexander V. Chernikov if (tainfo->flags & IPFW_TATFLAGS_AFDATA) 8075f379342SAlexander V. Chernikov afdata = 1; 8085f379342SAlexander V. Chernikov if (tainfo->flags & IPFW_TATFLAGS_AFITEM) 8095f379342SAlexander V. Chernikov afitem = 1; 8105f379342SAlexander V. Chernikov 8115f379342SAlexander V. Chernikov memset(&d, 0, sizeof(d)); 8125f379342SAlexander V. Chernikov d.taclass = tainfo->taclass4; 8135f379342SAlexander V. Chernikov d.size = tainfo->size4; 8145f379342SAlexander V. Chernikov d.count = tainfo->count4; 8155f379342SAlexander V. Chernikov d.itemsize = tainfo->itemsize4; 8165f379342SAlexander V. Chernikov if (afdata == 0 && afitem != 0) 8175f379342SAlexander V. Chernikov d.itemsize6 = tainfo->itemsize6; 8185f379342SAlexander V. Chernikov else 8195f379342SAlexander V. Chernikov d.itemsize6 = d.itemsize; 8205f379342SAlexander V. Chernikov if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL) 8215f379342SAlexander V. Chernikov vtype = "unknown"; 8225f379342SAlexander V. Chernikov 8235f379342SAlexander V. Chernikov if (afdata == 0) { 8245f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "", vtype); 8255f379342SAlexander V. Chernikov } else { 8265f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "IPv4 ", vtype); 8275f379342SAlexander V. Chernikov memset(&d, 0, sizeof(d)); 8285f379342SAlexander V. Chernikov d.taclass = tainfo->taclass6; 8295f379342SAlexander V. Chernikov if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL) 8305f379342SAlexander V. Chernikov vtype = "unknown"; 8315f379342SAlexander V. Chernikov d.size = tainfo->size6; 8325f379342SAlexander V. Chernikov d.count = tainfo->count6; 8335f379342SAlexander V. Chernikov d.itemsize = tainfo->itemsize6; 8345f379342SAlexander V. Chernikov d.itemsize6 = d.itemsize; 8355f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "IPv6 ", vtype); 8365f379342SAlexander V. Chernikov } 8375f379342SAlexander V. Chernikov 838f1220db8SAlexander V. Chernikov return (0); 839f1220db8SAlexander V. Chernikov } 840f1220db8SAlexander V. Chernikov 841f1220db8SAlexander V. Chernikov 842f1220db8SAlexander V. Chernikov /* 843f1220db8SAlexander V. Chernikov * Function wrappers which can be used either 844f1220db8SAlexander V. Chernikov * as is or as foreach function parameter. 845f1220db8SAlexander V. Chernikov */ 846f1220db8SAlexander V. Chernikov 847f1220db8SAlexander V. Chernikov static int 848f1220db8SAlexander V. Chernikov table_show_one(ipfw_xtable_info *i, void *arg) 849f1220db8SAlexander V. Chernikov { 850f1220db8SAlexander V. Chernikov ipfw_obj_header *oh; 85181d3153dSAlexander V. Chernikov int error; 85210e3bebfSBryan Drewery int is_all; 85310e3bebfSBryan Drewery 85410e3bebfSBryan Drewery is_all = arg == NULL ? 0 : 1; 855f1220db8SAlexander V. Chernikov 856720ee730SAlexander V. Chernikov if ((error = table_do_get_list(i, &oh)) != 0) { 85781d3153dSAlexander V. Chernikov err(EX_OSERR, "Error requesting table %s list", i->tablename); 85881d3153dSAlexander V. Chernikov return (error); 85981d3153dSAlexander V. Chernikov } 86081d3153dSAlexander V. Chernikov 8612b3d6647SBryan Drewery table_show_list(oh, is_all); 862f1220db8SAlexander V. Chernikov 863f1220db8SAlexander V. Chernikov free(oh); 864f1220db8SAlexander V. Chernikov return (0); 865f1220db8SAlexander V. Chernikov } 866f1220db8SAlexander V. Chernikov 867f1220db8SAlexander V. Chernikov static int 868f1220db8SAlexander V. Chernikov table_flush_one(ipfw_xtable_info *i, void *arg) 869f1220db8SAlexander V. Chernikov { 870ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 871f1220db8SAlexander V. Chernikov 872ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)arg; 873ac35ff17SAlexander V. Chernikov 874ac35ff17SAlexander V. Chernikov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 875ac35ff17SAlexander V. Chernikov 876ac35ff17SAlexander V. Chernikov return (table_flush(oh)); 877f1220db8SAlexander V. Chernikov } 878f1220db8SAlexander V. Chernikov 879ac35ff17SAlexander V. Chernikov static int 880ac35ff17SAlexander V. Chernikov table_do_modify_record(int cmd, ipfw_obj_header *oh, 8813a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, int count, int atomic) 882ac35ff17SAlexander V. Chernikov { 883db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 8843a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent_base; 8853a845e10SAlexander V. Chernikov caddr_t pbuf; 886db785d31SAlexander V. Chernikov char xbuf[sizeof(*oh) + sizeof(ipfw_obj_ctlv) + sizeof(*tent)]; 8873a845e10SAlexander V. Chernikov int error, i; 8883a845e10SAlexander V. Chernikov size_t sz; 889ac35ff17SAlexander V. Chernikov 8903a845e10SAlexander V. Chernikov sz = sizeof(*ctlv) + sizeof(*tent) * count; 8913a845e10SAlexander V. Chernikov if (count == 1) { 892ac35ff17SAlexander V. Chernikov memset(xbuf, 0, sizeof(xbuf)); 8933a845e10SAlexander V. Chernikov pbuf = xbuf; 8943a845e10SAlexander V. Chernikov } else { 8953a845e10SAlexander V. Chernikov if ((pbuf = calloc(1, sizeof(*oh) + sz)) == NULL) 8963a845e10SAlexander V. Chernikov return (ENOMEM); 8973a845e10SAlexander V. Chernikov } 8983a845e10SAlexander V. Chernikov 8993a845e10SAlexander V. Chernikov memcpy(pbuf, oh, sizeof(*oh)); 9003a845e10SAlexander V. Chernikov oh = (ipfw_obj_header *)pbuf; 901ac35ff17SAlexander V. Chernikov oh->opheader.version = 1; 902ac35ff17SAlexander V. Chernikov 903db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 9043a845e10SAlexander V. Chernikov ctlv->count = count; 9053a845e10SAlexander V. Chernikov ctlv->head.length = sz; 9063a845e10SAlexander V. Chernikov if (atomic != 0) 9073a845e10SAlexander V. Chernikov ctlv->flags |= IPFW_CTF_ATOMIC; 908db785d31SAlexander V. Chernikov 9093a845e10SAlexander V. Chernikov tent_base = tent; 9103a845e10SAlexander V. Chernikov memcpy(ctlv + 1, tent, sizeof(*tent) * count); 911db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 9123a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, tent++) { 913ac35ff17SAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 9143a845e10SAlexander V. Chernikov tent->idx = oh->idx; 9153a845e10SAlexander V. Chernikov } 916ac35ff17SAlexander V. Chernikov 9173a845e10SAlexander V. Chernikov sz += sizeof(*oh); 9183a845e10SAlexander V. Chernikov error = do_get3(cmd, &oh->opheader, &sz); 919092f8ba3SAndrey V. Elsukov if (error != 0) 920092f8ba3SAndrey V. Elsukov error = errno; 9213a845e10SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 9223a845e10SAlexander V. Chernikov /* Copy result back to provided buffer */ 9233a845e10SAlexander V. Chernikov memcpy(tent_base, ctlv + 1, sizeof(*tent) * count); 9243a845e10SAlexander V. Chernikov 9253a845e10SAlexander V. Chernikov if (pbuf != xbuf) 9263a845e10SAlexander V. Chernikov free(pbuf); 927ac35ff17SAlexander V. Chernikov 928ac35ff17SAlexander V. Chernikov return (error); 929ac35ff17SAlexander V. Chernikov } 930ac35ff17SAlexander V. Chernikov 931ac35ff17SAlexander V. Chernikov static void 9323a845e10SAlexander V. Chernikov table_modify_record(ipfw_obj_header *oh, int ac, char *av[], int add, 9333a845e10SAlexander V. Chernikov int quiet, int update, int atomic) 934ac35ff17SAlexander V. Chernikov { 9353a845e10SAlexander V. Chernikov ipfw_obj_tentry *ptent, tent, *tent_buf; 93681d3153dSAlexander V. Chernikov ipfw_xtable_info xi; 93756707beeSMark Johnston const char *etxt, *px, *texterr; 9380cba2b28SAlexander V. Chernikov uint8_t type; 9390cba2b28SAlexander V. Chernikov uint32_t vmask; 9403a845e10SAlexander V. Chernikov int cmd, count, error, i, ignored; 941ac35ff17SAlexander V. Chernikov 942ac35ff17SAlexander V. Chernikov if (ac == 0) 943ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "address required"); 944ac35ff17SAlexander V. Chernikov 945ac35ff17SAlexander V. Chernikov if (add != 0) { 946ac35ff17SAlexander V. Chernikov cmd = IP_FW_TABLE_XADD; 9474c0c07a5SAlexander V. Chernikov texterr = "Adding record failed"; 948ac35ff17SAlexander V. Chernikov } else { 949ac35ff17SAlexander V. Chernikov cmd = IP_FW_TABLE_XDEL; 9504c0c07a5SAlexander V. Chernikov texterr = "Deleting record failed"; 951ac35ff17SAlexander V. Chernikov } 952ac35ff17SAlexander V. Chernikov 9533a845e10SAlexander V. Chernikov /* 9543a845e10SAlexander V. Chernikov * Calculate number of entries: 9553a845e10SAlexander V. Chernikov * Assume [key val] x N for add 9563a845e10SAlexander V. Chernikov * and 9573a845e10SAlexander V. Chernikov * key x N for delete 9583a845e10SAlexander V. Chernikov */ 9593a845e10SAlexander V. Chernikov count = (add != 0) ? ac / 2 + 1 : ac; 9603a845e10SAlexander V. Chernikov 9613a845e10SAlexander V. Chernikov if (count <= 1) { 9623a845e10SAlexander V. Chernikov /* Adding single entry with/without value */ 9633a845e10SAlexander V. Chernikov memset(&tent, 0, sizeof(tent)); 9643a845e10SAlexander V. Chernikov tent_buf = &tent; 9653a845e10SAlexander V. Chernikov } else { 9663a845e10SAlexander V. Chernikov 9673a845e10SAlexander V. Chernikov if ((tent_buf = calloc(count, sizeof(tent))) == NULL) 9683a845e10SAlexander V. Chernikov errx(EX_OSERR, 9693a845e10SAlexander V. Chernikov "Unable to allocate memory for all entries"); 9703a845e10SAlexander V. Chernikov } 9713a845e10SAlexander V. Chernikov ptent = tent_buf; 9723a845e10SAlexander V. Chernikov 9733a845e10SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 9743a845e10SAlexander V. Chernikov count = 0; 9753a845e10SAlexander V. Chernikov while (ac > 0) { 9760cba2b28SAlexander V. Chernikov tentry_fill_key(oh, ptent, *av, add, &type, &vmask, &xi); 9773a845e10SAlexander V. Chernikov 9783a845e10SAlexander V. Chernikov /* 979463a577bSEitan Adler * Compatibility layer: auto-create table if not exists. 9803a845e10SAlexander V. Chernikov */ 9813a845e10SAlexander V. Chernikov if (xi.tablename[0] == '\0') { 9823a845e10SAlexander V. Chernikov xi.type = type; 9830cba2b28SAlexander V. Chernikov xi.vmask = vmask; 9843a845e10SAlexander V. Chernikov strlcpy(xi.tablename, oh->ntlv.name, 9853a845e10SAlexander V. Chernikov sizeof(xi.tablename)); 986e62cd31fSAndrey V. Elsukov if (quiet == 0) 987e62cd31fSAndrey V. Elsukov warnx("DEPRECATED: inserting data into " 988e62cd31fSAndrey V. Elsukov "non-existent table %s. (auto-created)", 9893a845e10SAlexander V. Chernikov xi.tablename); 9903a845e10SAlexander V. Chernikov table_do_create(oh, &xi); 9913a845e10SAlexander V. Chernikov } 9923a845e10SAlexander V. Chernikov 9933a845e10SAlexander V. Chernikov oh->ntlv.type = type; 9943a845e10SAlexander V. Chernikov ac--; av++; 9953a845e10SAlexander V. Chernikov 9963a845e10SAlexander V. Chernikov if (add != 0 && ac > 0) { 9970cba2b28SAlexander V. Chernikov tentry_fill_value(oh, ptent, *av, type, vmask); 9983a845e10SAlexander V. Chernikov ac--; av++; 9993a845e10SAlexander V. Chernikov } 10003a845e10SAlexander V. Chernikov 10013a845e10SAlexander V. Chernikov if (update != 0) 10023a845e10SAlexander V. Chernikov ptent->head.flags |= IPFW_TF_UPDATE; 10033a845e10SAlexander V. Chernikov 10043a845e10SAlexander V. Chernikov count++; 10053a845e10SAlexander V. Chernikov ptent++; 10063a845e10SAlexander V. Chernikov } 10073a845e10SAlexander V. Chernikov 10083a845e10SAlexander V. Chernikov error = table_do_modify_record(cmd, oh, tent_buf, count, atomic); 10093a845e10SAlexander V. Chernikov 10103a845e10SAlexander V. Chernikov /* 10113a845e10SAlexander V. Chernikov * Compatibility stuff: do not yell on duplicate keys or 10123a845e10SAlexander V. Chernikov * failed deletions. 10133a845e10SAlexander V. Chernikov */ 10143a845e10SAlexander V. Chernikov if (error == 0 || (error == EEXIST && add != 0) || 10153a845e10SAlexander V. Chernikov (error == ENOENT && add == 0)) { 10163a845e10SAlexander V. Chernikov if (quiet != 0) { 10173a845e10SAlexander V. Chernikov if (tent_buf != &tent) 10183a845e10SAlexander V. Chernikov free(tent_buf); 10193a845e10SAlexander V. Chernikov return; 10203a845e10SAlexander V. Chernikov } 10213a845e10SAlexander V. Chernikov } 10223a845e10SAlexander V. Chernikov 10233a845e10SAlexander V. Chernikov /* Report results back */ 10243a845e10SAlexander V. Chernikov ptent = tent_buf; 10253a845e10SAlexander V. Chernikov for (i = 0; i < count; ptent++, i++) { 10263a845e10SAlexander V. Chernikov ignored = 0; 10273a845e10SAlexander V. Chernikov switch (ptent->result) { 10283a845e10SAlexander V. Chernikov case IPFW_TR_ADDED: 10293a845e10SAlexander V. Chernikov px = "added"; 10303a845e10SAlexander V. Chernikov break; 10313a845e10SAlexander V. Chernikov case IPFW_TR_DELETED: 10323a845e10SAlexander V. Chernikov px = "deleted"; 10333a845e10SAlexander V. Chernikov break; 10343a845e10SAlexander V. Chernikov case IPFW_TR_UPDATED: 10353a845e10SAlexander V. Chernikov px = "updated"; 10363a845e10SAlexander V. Chernikov break; 10373a845e10SAlexander V. Chernikov case IPFW_TR_LIMIT: 10383a845e10SAlexander V. Chernikov px = "limit"; 10393a845e10SAlexander V. Chernikov ignored = 1; 10403a845e10SAlexander V. Chernikov break; 10413a845e10SAlexander V. Chernikov case IPFW_TR_ERROR: 10423a845e10SAlexander V. Chernikov px = "error"; 10433a845e10SAlexander V. Chernikov ignored = 1; 10443a845e10SAlexander V. Chernikov break; 10453a845e10SAlexander V. Chernikov case IPFW_TR_NOTFOUND: 10463a845e10SAlexander V. Chernikov px = "notfound"; 10473a845e10SAlexander V. Chernikov ignored = 1; 10483a845e10SAlexander V. Chernikov break; 10493a845e10SAlexander V. Chernikov case IPFW_TR_EXISTS: 10503a845e10SAlexander V. Chernikov px = "exists"; 10513a845e10SAlexander V. Chernikov ignored = 1; 10523a845e10SAlexander V. Chernikov break; 10533a845e10SAlexander V. Chernikov case IPFW_TR_IGNORED: 10543a845e10SAlexander V. Chernikov px = "ignored"; 10553a845e10SAlexander V. Chernikov ignored = 1; 10563a845e10SAlexander V. Chernikov break; 10573a845e10SAlexander V. Chernikov default: 10583a845e10SAlexander V. Chernikov px = "unknown"; 10593a845e10SAlexander V. Chernikov ignored = 1; 10603a845e10SAlexander V. Chernikov } 10613a845e10SAlexander V. Chernikov 10623a845e10SAlexander V. Chernikov if (error != 0 && atomic != 0 && ignored == 0) 10633a845e10SAlexander V. Chernikov printf("%s(reverted): ", px); 10643a845e10SAlexander V. Chernikov else 10653a845e10SAlexander V. Chernikov printf("%s: ", px); 10663a845e10SAlexander V. Chernikov 10673a845e10SAlexander V. Chernikov table_show_entry(&xi, ptent); 10683a845e10SAlexander V. Chernikov } 10693a845e10SAlexander V. Chernikov 10703a845e10SAlexander V. Chernikov if (tent_buf != &tent) 10713a845e10SAlexander V. Chernikov free(tent_buf); 10723a845e10SAlexander V. Chernikov 10733a845e10SAlexander V. Chernikov if (error == 0) 10744c0c07a5SAlexander V. Chernikov return; 107568bde59eSAlexander V. Chernikov /* Get real OS error */ 107668bde59eSAlexander V. Chernikov error = errno; 10774c0c07a5SAlexander V. Chernikov 10784c0c07a5SAlexander V. Chernikov /* Try to provide more human-readable error */ 10794c0c07a5SAlexander V. Chernikov switch (error) { 10804c0c07a5SAlexander V. Chernikov case EEXIST: 10814c0c07a5SAlexander V. Chernikov etxt = "record already exists"; 10824c0c07a5SAlexander V. Chernikov break; 10834c0c07a5SAlexander V. Chernikov case EFBIG: 10844c0c07a5SAlexander V. Chernikov etxt = "limit hit"; 10854c0c07a5SAlexander V. Chernikov break; 10864c0c07a5SAlexander V. Chernikov case ESRCH: 10874c0c07a5SAlexander V. Chernikov etxt = "table not found"; 10884c0c07a5SAlexander V. Chernikov break; 10894c0c07a5SAlexander V. Chernikov case ENOENT: 10904c0c07a5SAlexander V. Chernikov etxt = "record not found"; 10914c0c07a5SAlexander V. Chernikov break; 10924f43138aSAlexander V. Chernikov case EACCES: 10934f43138aSAlexander V. Chernikov etxt = "table is locked"; 10944f43138aSAlexander V. Chernikov break; 10954c0c07a5SAlexander V. Chernikov default: 10964c0c07a5SAlexander V. Chernikov etxt = strerror(error); 10974c0c07a5SAlexander V. Chernikov } 10984c0c07a5SAlexander V. Chernikov 10994c0c07a5SAlexander V. Chernikov errx(EX_OSERR, "%s: %s", texterr, etxt); 1100ac35ff17SAlexander V. Chernikov } 1101ac35ff17SAlexander V. Chernikov 110281d3153dSAlexander V. Chernikov static int 110381d3153dSAlexander V. Chernikov table_do_lookup(ipfw_obj_header *oh, char *key, ipfw_xtable_info *xi, 110481d3153dSAlexander V. Chernikov ipfw_obj_tentry *xtent) 110581d3153dSAlexander V. Chernikov { 110681d3153dSAlexander V. Chernikov char xbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_tentry)]; 110781d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 11080cba2b28SAlexander V. Chernikov uint8_t type; 11090cba2b28SAlexander V. Chernikov uint32_t vmask; 111081d3153dSAlexander V. Chernikov size_t sz; 111181d3153dSAlexander V. Chernikov 111281d3153dSAlexander V. Chernikov memcpy(xbuf, oh, sizeof(*oh)); 111381d3153dSAlexander V. Chernikov oh = (ipfw_obj_header *)xbuf; 111481d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 111581d3153dSAlexander V. Chernikov 111681d3153dSAlexander V. Chernikov memset(tent, 0, sizeof(*tent)); 111781d3153dSAlexander V. Chernikov tent->head.length = sizeof(*tent); 111881d3153dSAlexander V. Chernikov tent->idx = 1; 111981d3153dSAlexander V. Chernikov 11200cba2b28SAlexander V. Chernikov tentry_fill_key(oh, tent, key, 0, &type, &vmask, xi); 112181d3153dSAlexander V. Chernikov oh->ntlv.type = type; 112281d3153dSAlexander V. Chernikov 112381d3153dSAlexander V. Chernikov sz = sizeof(xbuf); 1124b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XFIND, &oh->opheader, &sz) != 0) 1125b6462881SAlexander V. Chernikov return (errno); 112681d3153dSAlexander V. Chernikov 112781d3153dSAlexander V. Chernikov if (sz < sizeof(xbuf)) 112881d3153dSAlexander V. Chernikov return (EINVAL); 112981d3153dSAlexander V. Chernikov 113081d3153dSAlexander V. Chernikov *xtent = *tent; 113181d3153dSAlexander V. Chernikov 113281d3153dSAlexander V. Chernikov return (0); 113381d3153dSAlexander V. Chernikov } 113481d3153dSAlexander V. Chernikov 113581d3153dSAlexander V. Chernikov static void 113681d3153dSAlexander V. Chernikov table_lookup(ipfw_obj_header *oh, int ac, char *av[]) 113781d3153dSAlexander V. Chernikov { 113881d3153dSAlexander V. Chernikov ipfw_obj_tentry xtent; 113981d3153dSAlexander V. Chernikov ipfw_xtable_info xi; 1140914bffb6SAlexander V. Chernikov char key[64]; 114181d3153dSAlexander V. Chernikov int error; 114281d3153dSAlexander V. Chernikov 114381d3153dSAlexander V. Chernikov if (ac == 0) 114481d3153dSAlexander V. Chernikov errx(EX_USAGE, "address required"); 114581d3153dSAlexander V. Chernikov 1146914bffb6SAlexander V. Chernikov strlcpy(key, *av, sizeof(key)); 1147914bffb6SAlexander V. Chernikov 11483a845e10SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 1149914bffb6SAlexander V. Chernikov error = table_do_lookup(oh, key, &xi, &xtent); 115081d3153dSAlexander V. Chernikov 115181d3153dSAlexander V. Chernikov switch (error) { 115281d3153dSAlexander V. Chernikov case 0: 115381d3153dSAlexander V. Chernikov break; 115481d3153dSAlexander V. Chernikov case ESRCH: 115581d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Table %s not found", oh->ntlv.name); 115681d3153dSAlexander V. Chernikov case ENOENT: 115781d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Entry %s not found", *av); 115881d3153dSAlexander V. Chernikov case ENOTSUP: 115981d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Table %s algo does not support " 116081d3153dSAlexander V. Chernikov "\"lookup\" method", oh->ntlv.name); 116181d3153dSAlexander V. Chernikov default: 116281d3153dSAlexander V. Chernikov err(EX_OSERR, "getsockopt(IP_FW_TABLE_XFIND)"); 116381d3153dSAlexander V. Chernikov } 116481d3153dSAlexander V. Chernikov 116581d3153dSAlexander V. Chernikov table_show_entry(&xi, &xtent); 116681d3153dSAlexander V. Chernikov } 1167ac35ff17SAlexander V. Chernikov 1168ac35ff17SAlexander V. Chernikov static void 1169914bffb6SAlexander V. Chernikov tentry_fill_key_type(char *arg, ipfw_obj_tentry *tentry, uint8_t type, 1170914bffb6SAlexander V. Chernikov uint8_t tflags) 1171ac35ff17SAlexander V. Chernikov { 1172914bffb6SAlexander V. Chernikov char *p, *pp; 1173ac35ff17SAlexander V. Chernikov int mask, af; 1174914bffb6SAlexander V. Chernikov struct in6_addr *paddr, tmp; 1175914bffb6SAlexander V. Chernikov struct tflow_entry *tfe; 1176ac35ff17SAlexander V. Chernikov uint32_t key, *pkey; 1177914bffb6SAlexander V. Chernikov uint16_t port; 1178914bffb6SAlexander V. Chernikov struct protoent *pent; 1179914bffb6SAlexander V. Chernikov struct servent *sent; 1180ac35ff17SAlexander V. Chernikov int masklen; 1181ac35ff17SAlexander V. Chernikov 1182ac35ff17SAlexander V. Chernikov masklen = 0; 1183ac35ff17SAlexander V. Chernikov af = 0; 1184ac35ff17SAlexander V. Chernikov paddr = (struct in6_addr *)&tentry->k; 1185ac35ff17SAlexander V. Chernikov 1186ac35ff17SAlexander V. Chernikov switch (type) { 1187c21034b7SAlexander V. Chernikov case IPFW_TABLE_ADDR: 1188ac35ff17SAlexander V. Chernikov /* Remove / if exists */ 1189ac35ff17SAlexander V. Chernikov if ((p = strchr(arg, '/')) != NULL) { 1190ac35ff17SAlexander V. Chernikov *p = '\0'; 1191ac35ff17SAlexander V. Chernikov mask = atoi(p + 1); 1192ac35ff17SAlexander V. Chernikov } 1193ac35ff17SAlexander V. Chernikov 1194ac35ff17SAlexander V. Chernikov if (inet_pton(AF_INET, arg, paddr) == 1) { 1195ac35ff17SAlexander V. Chernikov if (p != NULL && mask > 32) 1196ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "bad IPv4 mask width: %s", 1197ac35ff17SAlexander V. Chernikov p + 1); 1198ac35ff17SAlexander V. Chernikov 1199ac35ff17SAlexander V. Chernikov masklen = p ? mask : 32; 1200ac35ff17SAlexander V. Chernikov af = AF_INET; 1201ac35ff17SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, paddr) == 1) { 1202ac35ff17SAlexander V. Chernikov if (IN6_IS_ADDR_V4COMPAT(paddr)) 1203ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, 1204ac35ff17SAlexander V. Chernikov "Use IPv4 instead of v4-compatible"); 1205ac35ff17SAlexander V. Chernikov if (p != NULL && mask > 128) 1206ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "bad IPv6 mask width: %s", 1207ac35ff17SAlexander V. Chernikov p + 1); 1208ac35ff17SAlexander V. Chernikov 1209ac35ff17SAlexander V. Chernikov masklen = p ? mask : 128; 1210ac35ff17SAlexander V. Chernikov af = AF_INET6; 1211ac35ff17SAlexander V. Chernikov } else { 1212ac35ff17SAlexander V. Chernikov /* Assume FQDN */ 1213ac35ff17SAlexander V. Chernikov if (lookup_host(arg, (struct in_addr *)paddr) != 0) 1214ac35ff17SAlexander V. Chernikov errx(EX_NOHOST, "hostname ``%s'' unknown", arg); 1215ac35ff17SAlexander V. Chernikov 1216ac35ff17SAlexander V. Chernikov masklen = 32; 1217c21034b7SAlexander V. Chernikov type = IPFW_TABLE_ADDR; 1218ac35ff17SAlexander V. Chernikov af = AF_INET; 1219ac35ff17SAlexander V. Chernikov } 1220ac35ff17SAlexander V. Chernikov break; 1221ac35ff17SAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 1222ac35ff17SAlexander V. Chernikov /* Assume interface name. Copy significant data only */ 1223ac35ff17SAlexander V. Chernikov mask = MIN(strlen(arg), IF_NAMESIZE - 1); 1224ac35ff17SAlexander V. Chernikov memcpy(paddr, arg, mask); 1225ac35ff17SAlexander V. Chernikov /* Set mask to exact match */ 1226ac35ff17SAlexander V. Chernikov masklen = 8 * IF_NAMESIZE; 1227ac35ff17SAlexander V. Chernikov break; 1228b23d5de9SAlexander V. Chernikov case IPFW_TABLE_NUMBER: 1229ac35ff17SAlexander V. Chernikov /* Port or any other key */ 1230ac35ff17SAlexander V. Chernikov key = strtol(arg, &p, 10); 1231ac35ff17SAlexander V. Chernikov if (*p != '\0') 1232ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "Invalid number: %s", arg); 1233ac35ff17SAlexander V. Chernikov 1234ac35ff17SAlexander V. Chernikov pkey = (uint32_t *)paddr; 1235ac35ff17SAlexander V. Chernikov *pkey = key; 1236ac35ff17SAlexander V. Chernikov masklen = 32; 1237ac35ff17SAlexander V. Chernikov break; 1238914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 1239914bffb6SAlexander V. Chernikov /* Assume [src-ip][,proto][,src-port][,dst-ip][,dst-port] */ 1240914bffb6SAlexander V. Chernikov tfe = &tentry->k.flow; 1241914bffb6SAlexander V. Chernikov af = 0; 1242914bffb6SAlexander V. Chernikov 1243914bffb6SAlexander V. Chernikov /* Handle <ipv4|ipv6> */ 1244914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_SRCIP) != 0) { 1245914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1246914bffb6SAlexander V. Chernikov *p++ = '\0'; 1247914bffb6SAlexander V. Chernikov /* Determine family using temporary storage */ 1248914bffb6SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &tmp) == 1) { 1249914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET) 1250914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1251914bffb6SAlexander V. Chernikov "Inconsistent address family\n"); 1252914bffb6SAlexander V. Chernikov af = AF_INET; 1253914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a4.sip, &tmp, 4); 1254914bffb6SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, &tmp) == 1) { 1255914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET6) 1256914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1257914bffb6SAlexander V. Chernikov "Inconsistent address family\n"); 1258914bffb6SAlexander V. Chernikov af = AF_INET6; 1259914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a6.sip6, &tmp, 16); 1260914bffb6SAlexander V. Chernikov } 1261914bffb6SAlexander V. Chernikov 1262914bffb6SAlexander V. Chernikov arg = p; 1263914bffb6SAlexander V. Chernikov } 1264914bffb6SAlexander V. Chernikov 1265914bffb6SAlexander V. Chernikov /* Handle <proto-num|proto-name> */ 1266914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_PROTO) != 0) { 126735df97d0SAlexander V. Chernikov if (arg == NULL) 126835df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: proto missing"); 1269914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1270914bffb6SAlexander V. Chernikov *p++ = '\0'; 1271914bffb6SAlexander V. Chernikov 1272914bffb6SAlexander V. Chernikov key = strtol(arg, &pp, 10); 1273914bffb6SAlexander V. Chernikov if (*pp != '\0') { 1274914bffb6SAlexander V. Chernikov if ((pent = getprotobyname(arg)) == NULL) 1275914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown proto: %s", 1276914bffb6SAlexander V. Chernikov arg); 1277914bffb6SAlexander V. Chernikov else 1278914bffb6SAlexander V. Chernikov key = pent->p_proto; 1279914bffb6SAlexander V. Chernikov } 1280914bffb6SAlexander V. Chernikov 1281914bffb6SAlexander V. Chernikov if (key > 255) 1282914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Bad protocol number: %u",key); 1283914bffb6SAlexander V. Chernikov 1284914bffb6SAlexander V. Chernikov tfe->proto = key; 1285914bffb6SAlexander V. Chernikov 1286914bffb6SAlexander V. Chernikov arg = p; 1287914bffb6SAlexander V. Chernikov } 1288914bffb6SAlexander V. Chernikov 1289914bffb6SAlexander V. Chernikov /* Handle <port-num|service-name> */ 1290914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_SRCPORT) != 0) { 129135df97d0SAlexander V. Chernikov if (arg == NULL) 129235df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: src port missing"); 1293914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1294914bffb6SAlexander V. Chernikov *p++ = '\0'; 1295914bffb6SAlexander V. Chernikov 129652772a85SAndrey V. Elsukov port = htons(strtol(arg, &pp, 10)); 129752772a85SAndrey V. Elsukov if (*pp != '\0') { 1298914bffb6SAlexander V. Chernikov if ((sent = getservbyname(arg, NULL)) == NULL) 1299914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown service: %s", 1300914bffb6SAlexander V. Chernikov arg); 130152772a85SAndrey V. Elsukov port = sent->s_port; 1302914bffb6SAlexander V. Chernikov } 1303914bffb6SAlexander V. Chernikov tfe->sport = port; 1304914bffb6SAlexander V. Chernikov arg = p; 1305914bffb6SAlexander V. Chernikov } 1306914bffb6SAlexander V. Chernikov 1307914bffb6SAlexander V. Chernikov /* Handle <ipv4|ipv6>*/ 1308914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_DSTIP) != 0) { 130935df97d0SAlexander V. Chernikov if (arg == NULL) 131035df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: dst ip missing"); 1311914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1312914bffb6SAlexander V. Chernikov *p++ = '\0'; 1313914bffb6SAlexander V. Chernikov /* Determine family using temporary storage */ 1314914bffb6SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &tmp) == 1) { 1315914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET) 1316914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1317914bffb6SAlexander V. Chernikov "Inconsistent address family"); 1318914bffb6SAlexander V. Chernikov af = AF_INET; 1319914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a4.dip, &tmp, 4); 1320914bffb6SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, &tmp) == 1) { 1321914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET6) 1322914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1323914bffb6SAlexander V. Chernikov "Inconsistent address family"); 1324914bffb6SAlexander V. Chernikov af = AF_INET6; 1325914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a6.dip6, &tmp, 16); 1326914bffb6SAlexander V. Chernikov } 1327914bffb6SAlexander V. Chernikov 1328914bffb6SAlexander V. Chernikov arg = p; 1329914bffb6SAlexander V. Chernikov } 1330914bffb6SAlexander V. Chernikov 1331914bffb6SAlexander V. Chernikov /* Handle <port-num|service-name> */ 1332914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_DSTPORT) != 0) { 133335df97d0SAlexander V. Chernikov if (arg == NULL) 133435df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: dst port missing"); 1335914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1336914bffb6SAlexander V. Chernikov *p++ = '\0'; 1337914bffb6SAlexander V. Chernikov 133852772a85SAndrey V. Elsukov port = htons(strtol(arg, &pp, 10)); 133952772a85SAndrey V. Elsukov if (*pp != '\0') { 1340914bffb6SAlexander V. Chernikov if ((sent = getservbyname(arg, NULL)) == NULL) 1341914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown service: %s", 1342914bffb6SAlexander V. Chernikov arg); 134352772a85SAndrey V. Elsukov port = sent->s_port; 1344914bffb6SAlexander V. Chernikov } 1345914bffb6SAlexander V. Chernikov tfe->dport = port; 1346914bffb6SAlexander V. Chernikov arg = p; 1347914bffb6SAlexander V. Chernikov } 1348914bffb6SAlexander V. Chernikov 1349914bffb6SAlexander V. Chernikov tfe->af = af; 1350914bffb6SAlexander V. Chernikov 1351914bffb6SAlexander V. Chernikov break; 1352914bffb6SAlexander V. Chernikov 1353ac35ff17SAlexander V. Chernikov default: 1354ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "Unsupported table type: %d", type); 1355ac35ff17SAlexander V. Chernikov } 1356ac35ff17SAlexander V. Chernikov 1357ac35ff17SAlexander V. Chernikov tentry->subtype = af; 1358ac35ff17SAlexander V. Chernikov tentry->masklen = masklen; 1359ac35ff17SAlexander V. Chernikov } 1360ac35ff17SAlexander V. Chernikov 13618755aff6SAlexander V. Chernikov /* 13628755aff6SAlexander V. Chernikov * Tries to guess table key type. 13638755aff6SAlexander V. Chernikov * This procedure is used in legacy table auto-create 13648755aff6SAlexander V. Chernikov * code AND in `ipfw -n` ruleset checking. 13658755aff6SAlexander V. Chernikov * 13668755aff6SAlexander V. Chernikov * Imported from old table_fill_xentry() parse code. 13678755aff6SAlexander V. Chernikov */ 13688755aff6SAlexander V. Chernikov static int 13698755aff6SAlexander V. Chernikov guess_key_type(char *key, uint8_t *ptype) 13708755aff6SAlexander V. Chernikov { 13718755aff6SAlexander V. Chernikov char *p; 13728755aff6SAlexander V. Chernikov struct in6_addr addr; 13738755aff6SAlexander V. Chernikov uint32_t kv; 13748755aff6SAlexander V. Chernikov 13758755aff6SAlexander V. Chernikov if (ishexnumber(*key) != 0 || *key == ':') { 13768755aff6SAlexander V. Chernikov /* Remove / if exists */ 13778755aff6SAlexander V. Chernikov if ((p = strchr(key, '/')) != NULL) 13788755aff6SAlexander V. Chernikov *p = '\0'; 13798755aff6SAlexander V. Chernikov 13808755aff6SAlexander V. Chernikov if ((inet_pton(AF_INET, key, &addr) == 1) || 13818755aff6SAlexander V. Chernikov (inet_pton(AF_INET6, key, &addr) == 1)) { 13828755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_CIDR; 13838755aff6SAlexander V. Chernikov if (p != NULL) 13848755aff6SAlexander V. Chernikov *p = '/'; 13858755aff6SAlexander V. Chernikov return (0); 13868755aff6SAlexander V. Chernikov } else { 13878755aff6SAlexander V. Chernikov /* Port or any other key */ 13888755aff6SAlexander V. Chernikov /* Skip non-base 10 entries like 'fa1' */ 13898755aff6SAlexander V. Chernikov kv = strtol(key, &p, 10); 13908755aff6SAlexander V. Chernikov if (*p == '\0') { 13918755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 13928755aff6SAlexander V. Chernikov return (0); 13938755aff6SAlexander V. Chernikov } else if ((p != key) && (*p == '.')) { 13948755aff6SAlexander V. Chernikov /* 13958755aff6SAlexander V. Chernikov * Warn on IPv4 address strings 13968755aff6SAlexander V. Chernikov * which are "valid" for inet_aton() but not 13978755aff6SAlexander V. Chernikov * in inet_pton(). 13988755aff6SAlexander V. Chernikov * 13998755aff6SAlexander V. Chernikov * Typical examples: '10.5' or '10.0.0.05' 14008755aff6SAlexander V. Chernikov */ 14018755aff6SAlexander V. Chernikov return (1); 14028755aff6SAlexander V. Chernikov } 14038755aff6SAlexander V. Chernikov } 14048755aff6SAlexander V. Chernikov } 14058755aff6SAlexander V. Chernikov 14068755aff6SAlexander V. Chernikov if (strchr(key, '.') == NULL) { 14078755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 14088755aff6SAlexander V. Chernikov return (0); 14098755aff6SAlexander V. Chernikov } 14108755aff6SAlexander V. Chernikov 14118755aff6SAlexander V. Chernikov if (lookup_host(key, (struct in_addr *)&addr) != 0) 14128755aff6SAlexander V. Chernikov return (1); 14138755aff6SAlexander V. Chernikov 14148755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_CIDR; 14158755aff6SAlexander V. Chernikov return (0); 14168755aff6SAlexander V. Chernikov } 14178755aff6SAlexander V. Chernikov 1418ac35ff17SAlexander V. Chernikov static void 1419ac35ff17SAlexander V. Chernikov tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, char *key, 14200cba2b28SAlexander V. Chernikov int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi) 1421ac35ff17SAlexander V. Chernikov { 14220cba2b28SAlexander V. Chernikov uint8_t type, tflags; 14230cba2b28SAlexander V. Chernikov uint32_t vmask; 1424ac35ff17SAlexander V. Chernikov int error; 1425ac35ff17SAlexander V. Chernikov 1426ac35ff17SAlexander V. Chernikov type = 0; 1427914bffb6SAlexander V. Chernikov tflags = 0; 14280cba2b28SAlexander V. Chernikov vmask = 0; 1429ac35ff17SAlexander V. Chernikov 14303a845e10SAlexander V. Chernikov if (xi->tablename[0] == '\0') 143181d3153dSAlexander V. Chernikov error = table_get_info(oh, xi); 14323a845e10SAlexander V. Chernikov else 14333a845e10SAlexander V. Chernikov error = 0; 143481d3153dSAlexander V. Chernikov 143581d3153dSAlexander V. Chernikov if (error == 0) { 143656707beeSMark Johnston if (g_co.test_only == 0) { 14378755aff6SAlexander V. Chernikov /* Table found */ 143881d3153dSAlexander V. Chernikov type = xi->type; 1439914bffb6SAlexander V. Chernikov tflags = xi->tflags; 14400cba2b28SAlexander V. Chernikov vmask = xi->vmask; 144181d3153dSAlexander V. Chernikov } else { 14428755aff6SAlexander V. Chernikov /* 1443463a577bSEitan Adler * We're running `ipfw -n` 1444463a577bSEitan Adler * Compatibility layer: try to guess key type 14458755aff6SAlexander V. Chernikov * before failing. 14468755aff6SAlexander V. Chernikov */ 14478755aff6SAlexander V. Chernikov if (guess_key_type(key, &type) != 0) { 14488755aff6SAlexander V. Chernikov /* Inknown key */ 14498755aff6SAlexander V. Chernikov errx(EX_USAGE, "Cannot guess " 14508755aff6SAlexander V. Chernikov "key '%s' type", key); 14518755aff6SAlexander V. Chernikov } 14528755aff6SAlexander V. Chernikov vmask = IPFW_VTYPE_LEGACY; 14538755aff6SAlexander V. Chernikov } 14548755aff6SAlexander V. Chernikov } else { 145581d3153dSAlexander V. Chernikov if (error != ESRCH) 145681d3153dSAlexander V. Chernikov errx(EX_OSERR, "Error requesting table %s info", 145781d3153dSAlexander V. Chernikov oh->ntlv.name); 145835df97d0SAlexander V. Chernikov if (add == 0) 145935df97d0SAlexander V. Chernikov errx(EX_DATAERR, "Table %s does not exist", 146035df97d0SAlexander V. Chernikov oh->ntlv.name); 1461ac35ff17SAlexander V. Chernikov /* 14628755aff6SAlexander V. Chernikov * Table does not exist 1463463a577bSEitan Adler * Compatibility layer: try to guess key type before failing. 1464ac35ff17SAlexander V. Chernikov */ 14658755aff6SAlexander V. Chernikov if (guess_key_type(key, &type) != 0) { 146681d3153dSAlexander V. Chernikov /* Inknown key */ 146781d3153dSAlexander V. Chernikov errx(EX_USAGE, "Table %s does not exist, cannot guess " 1468db785d31SAlexander V. Chernikov "key '%s' type", oh->ntlv.name, key); 146981d3153dSAlexander V. Chernikov } 14708755aff6SAlexander V. Chernikov 14718755aff6SAlexander V. Chernikov vmask = IPFW_VTYPE_LEGACY; 1472ac35ff17SAlexander V. Chernikov } 1473ac35ff17SAlexander V. Chernikov 1474914bffb6SAlexander V. Chernikov tentry_fill_key_type(key, tent, type, tflags); 1475ac35ff17SAlexander V. Chernikov 1476ac35ff17SAlexander V. Chernikov *ptype = type; 14770cba2b28SAlexander V. Chernikov *pvmask = vmask; 14780cba2b28SAlexander V. Chernikov } 14790cba2b28SAlexander V. Chernikov 14800cba2b28SAlexander V. Chernikov static void 14810cba2b28SAlexander V. Chernikov set_legacy_value(uint32_t val, ipfw_table_value *v) 14820cba2b28SAlexander V. Chernikov { 14830cba2b28SAlexander V. Chernikov v->tag = val; 14840cba2b28SAlexander V. Chernikov v->pipe = val; 14850cba2b28SAlexander V. Chernikov v->divert = val; 14860cba2b28SAlexander V. Chernikov v->skipto = val; 14870cba2b28SAlexander V. Chernikov v->netgraph = val; 14880cba2b28SAlexander V. Chernikov v->fib = val; 14890cba2b28SAlexander V. Chernikov v->nat = val; 14900cba2b28SAlexander V. Chernikov v->nh4 = val; 14910cba2b28SAlexander V. Chernikov v->dscp = (uint8_t)val; 14920cba2b28SAlexander V. Chernikov v->limit = val; 1493ac35ff17SAlexander V. Chernikov } 1494ac35ff17SAlexander V. Chernikov 1495ac35ff17SAlexander V. Chernikov static void 149656707beeSMark Johnston tentry_fill_value(ipfw_obj_header *oh __unused, ipfw_obj_tentry *tent, 149756707beeSMark Johnston char *arg, uint8_t type __unused, uint32_t vmask) 1498ac35ff17SAlexander V. Chernikov { 14992530ed9eSAndrey V. Elsukov struct addrinfo hints, *res; 150056707beeSMark Johnston struct in_addr ipaddr; 150156707beeSMark Johnston const char *etype; 150256707beeSMark Johnston char *comma, *e, *n, *p; 1503b7684f4bSMarcelo Araujo uint32_t a4, flag, val; 15040cba2b28SAlexander V. Chernikov ipfw_table_value *v; 15050cba2b28SAlexander V. Chernikov uint32_t i; 1506d91c61c3SAlexander V. Chernikov int dval; 1507ac35ff17SAlexander V. Chernikov 15080cba2b28SAlexander V. Chernikov v = &tent->v.value; 15090cba2b28SAlexander V. Chernikov 15100cba2b28SAlexander V. Chernikov /* Compat layer: keep old behavior for legacy value types */ 15110cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 1512adf3b2b9SAlexander V. Chernikov /* Try to interpret as number first */ 15130cba2b28SAlexander V. Chernikov val = strtoul(arg, &p, 0); 15140cba2b28SAlexander V. Chernikov if (*p == '\0') { 15150cba2b28SAlexander V. Chernikov set_legacy_value(val, v); 1516adf3b2b9SAlexander V. Chernikov return; 15170cba2b28SAlexander V. Chernikov } 1518adf3b2b9SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &val) == 1) { 15190cba2b28SAlexander V. Chernikov set_legacy_value(ntohl(val), v); 1520adf3b2b9SAlexander V. Chernikov return; 1521adf3b2b9SAlexander V. Chernikov } 1522adf3b2b9SAlexander V. Chernikov /* Try hostname */ 15234e0a8b61SConrad Meyer if (lookup_host(arg, &ipaddr) == 0) { 15244e0a8b61SConrad Meyer set_legacy_value(ntohl(ipaddr.s_addr), v); 1525adf3b2b9SAlexander V. Chernikov return; 15260cba2b28SAlexander V. Chernikov } 1527adf3b2b9SAlexander V. Chernikov errx(EX_OSERR, "Unable to parse value %s", arg); 15280cba2b28SAlexander V. Chernikov } 15290cba2b28SAlexander V. Chernikov 15300cba2b28SAlexander V. Chernikov /* 15310cba2b28SAlexander V. Chernikov * Shorthands: handle single value if vmask consists 15320cba2b28SAlexander V. Chernikov * of numbers only. e.g.: 15330cba2b28SAlexander V. Chernikov * vmask = "fib,skipto" -> treat input "1" as "1,1" 15340cba2b28SAlexander V. Chernikov */ 15350cba2b28SAlexander V. Chernikov 15360cba2b28SAlexander V. Chernikov n = arg; 15370cba2b28SAlexander V. Chernikov etype = NULL; 153856707beeSMark Johnston for (i = 1; i < (1u << 31); i *= 2) { 15390cba2b28SAlexander V. Chernikov if ((flag = (vmask & i)) == 0) 15400cba2b28SAlexander V. Chernikov continue; 15410cba2b28SAlexander V. Chernikov vmask &= ~flag; 15420cba2b28SAlexander V. Chernikov 15430cba2b28SAlexander V. Chernikov if ((comma = strchr(n, ',')) != NULL) 15440cba2b28SAlexander V. Chernikov *comma = '\0'; 15450cba2b28SAlexander V. Chernikov 15460cba2b28SAlexander V. Chernikov switch (flag) { 15470cba2b28SAlexander V. Chernikov case IPFW_VTYPE_TAG: 15480cba2b28SAlexander V. Chernikov v->tag = strtol(n, &e, 10); 15490cba2b28SAlexander V. Chernikov if (*e != '\0') 15500cba2b28SAlexander V. Chernikov etype = "tag"; 1551ac35ff17SAlexander V. Chernikov break; 15520cba2b28SAlexander V. Chernikov case IPFW_VTYPE_PIPE: 15530cba2b28SAlexander V. Chernikov v->pipe = strtol(n, &e, 10); 15540cba2b28SAlexander V. Chernikov if (*e != '\0') 15550cba2b28SAlexander V. Chernikov etype = "pipe"; 1556ac35ff17SAlexander V. Chernikov break; 15570cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DIVERT: 15580cba2b28SAlexander V. Chernikov v->divert = strtol(n, &e, 10); 15590cba2b28SAlexander V. Chernikov if (*e != '\0') 15600cba2b28SAlexander V. Chernikov etype = "divert"; 15610cba2b28SAlexander V. Chernikov break; 15620cba2b28SAlexander V. Chernikov case IPFW_VTYPE_SKIPTO: 15630cba2b28SAlexander V. Chernikov v->skipto = strtol(n, &e, 10); 15640cba2b28SAlexander V. Chernikov if (*e != '\0') 15650cba2b28SAlexander V. Chernikov etype = "skipto"; 15660cba2b28SAlexander V. Chernikov break; 15670cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NETGRAPH: 15680cba2b28SAlexander V. Chernikov v->netgraph = strtol(n, &e, 10); 15690cba2b28SAlexander V. Chernikov if (*e != '\0') 15700cba2b28SAlexander V. Chernikov etype = "netgraph"; 15710cba2b28SAlexander V. Chernikov break; 15720cba2b28SAlexander V. Chernikov case IPFW_VTYPE_FIB: 15730cba2b28SAlexander V. Chernikov v->fib = strtol(n, &e, 10); 15740cba2b28SAlexander V. Chernikov if (*e != '\0') 15750cba2b28SAlexander V. Chernikov etype = "fib"; 15760cba2b28SAlexander V. Chernikov break; 15770cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NAT: 15780cba2b28SAlexander V. Chernikov v->nat = strtol(n, &e, 10); 15790cba2b28SAlexander V. Chernikov if (*e != '\0') 15800cba2b28SAlexander V. Chernikov etype = "nat"; 15810cba2b28SAlexander V. Chernikov break; 15820cba2b28SAlexander V. Chernikov case IPFW_VTYPE_LIMIT: 15830cba2b28SAlexander V. Chernikov v->limit = strtol(n, &e, 10); 15840cba2b28SAlexander V. Chernikov if (*e != '\0') 15850cba2b28SAlexander V. Chernikov etype = "limit"; 15860cba2b28SAlexander V. Chernikov break; 15870cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH4: 15880cba2b28SAlexander V. Chernikov if (strchr(n, '.') != NULL && 15890cba2b28SAlexander V. Chernikov inet_pton(AF_INET, n, &a4) == 1) { 15900cba2b28SAlexander V. Chernikov v->nh4 = ntohl(a4); 15910cba2b28SAlexander V. Chernikov break; 15920cba2b28SAlexander V. Chernikov } 15934e0a8b61SConrad Meyer if (lookup_host(n, &ipaddr) == 0) { 15944e0a8b61SConrad Meyer v->nh4 = ntohl(ipaddr.s_addr); 15950cba2b28SAlexander V. Chernikov break; 15964e0a8b61SConrad Meyer } 15970cba2b28SAlexander V. Chernikov etype = "ipv4"; 1598ac35ff17SAlexander V. Chernikov break; 1599ac35ff17SAlexander V. Chernikov case IPFW_VTYPE_DSCP: 16000cba2b28SAlexander V. Chernikov if (isalpha(*n)) { 1601d91c61c3SAlexander V. Chernikov if ((dval = match_token(f_ipdscp, n)) != -1) { 1602d91c61c3SAlexander V. Chernikov v->dscp = dval; 1603ac35ff17SAlexander V. Chernikov break; 1604d91c61c3SAlexander V. Chernikov } else 16050cba2b28SAlexander V. Chernikov etype = "DSCP code"; 16060cba2b28SAlexander V. Chernikov } else { 16070cba2b28SAlexander V. Chernikov v->dscp = strtol(n, &e, 10); 16080cba2b28SAlexander V. Chernikov if (v->dscp > 63 || *e != '\0') 16090cba2b28SAlexander V. Chernikov etype = "DSCP value"; 1610ac35ff17SAlexander V. Chernikov } 16110cba2b28SAlexander V. Chernikov break; 16120cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH6: 16132530ed9eSAndrey V. Elsukov if (strchr(n, ':') != NULL) { 16142530ed9eSAndrey V. Elsukov memset(&hints, 0, sizeof(hints)); 16152530ed9eSAndrey V. Elsukov hints.ai_family = AF_INET6; 16162530ed9eSAndrey V. Elsukov hints.ai_flags = AI_NUMERICHOST; 16172530ed9eSAndrey V. Elsukov if (getaddrinfo(n, NULL, &hints, &res) == 0) { 16182530ed9eSAndrey V. Elsukov v->nh6 = ((struct sockaddr_in6 *) 16192530ed9eSAndrey V. Elsukov res->ai_addr)->sin6_addr; 16202530ed9eSAndrey V. Elsukov v->zoneid = ((struct sockaddr_in6 *) 16212530ed9eSAndrey V. Elsukov res->ai_addr)->sin6_scope_id; 16222530ed9eSAndrey V. Elsukov freeaddrinfo(res); 16230cba2b28SAlexander V. Chernikov break; 16242530ed9eSAndrey V. Elsukov } 16252530ed9eSAndrey V. Elsukov } 16260cba2b28SAlexander V. Chernikov etype = "ipv6"; 16270cba2b28SAlexander V. Chernikov break; 16280cba2b28SAlexander V. Chernikov } 16290cba2b28SAlexander V. Chernikov 16300cba2b28SAlexander V. Chernikov if (etype != NULL) 16310cba2b28SAlexander V. Chernikov errx(EX_USAGE, "Unable to parse %s as %s", n, etype); 16320cba2b28SAlexander V. Chernikov 16330cba2b28SAlexander V. Chernikov if (comma != NULL) 16340cba2b28SAlexander V. Chernikov *comma++ = ','; 16350cba2b28SAlexander V. Chernikov 16360cba2b28SAlexander V. Chernikov if ((n = comma) != NULL) 16370cba2b28SAlexander V. Chernikov continue; 16380cba2b28SAlexander V. Chernikov 16390cba2b28SAlexander V. Chernikov /* End of input. */ 16400cba2b28SAlexander V. Chernikov if (vmask != 0) 16410cba2b28SAlexander V. Chernikov errx(EX_USAGE, "Not enough fields inside value"); 16420cba2b28SAlexander V. Chernikov } 1643ac35ff17SAlexander V. Chernikov } 1644f1220db8SAlexander V. Chernikov 1645f1220db8SAlexander V. Chernikov /* 1646f1220db8SAlexander V. Chernikov * Compare table names. 1647f1220db8SAlexander V. Chernikov * Honor number comparison. 1648f1220db8SAlexander V. Chernikov */ 1649f1220db8SAlexander V. Chernikov static int 1650f1220db8SAlexander V. Chernikov tablename_cmp(const void *a, const void *b) 1651f1220db8SAlexander V. Chernikov { 165256707beeSMark Johnston const ipfw_xtable_info *ia, *ib; 1653f1220db8SAlexander V. Chernikov 165456707beeSMark Johnston ia = (const ipfw_xtable_info *)a; 165556707beeSMark Johnston ib = (const ipfw_xtable_info *)b; 1656f1220db8SAlexander V. Chernikov 165768394ec8SAlexander V. Chernikov return (stringnum_cmp(ia->tablename, ib->tablename)); 1658f1220db8SAlexander V. Chernikov } 1659f1220db8SAlexander V. Chernikov 1660f1220db8SAlexander V. Chernikov /* 1661f1220db8SAlexander V. Chernikov * Retrieves table list from kernel, 1662f1220db8SAlexander V. Chernikov * optionally sorts it and calls requested function for each table. 1663f1220db8SAlexander V. Chernikov * Returns 0 on success. 1664f1220db8SAlexander V. Chernikov */ 1665f1220db8SAlexander V. Chernikov static int 1666f1220db8SAlexander V. Chernikov tables_foreach(table_cb_t *f, void *arg, int sort) 1667f1220db8SAlexander V. Chernikov { 166828ea4fa3SAlexander V. Chernikov ipfw_obj_lheader *olh; 1669f1220db8SAlexander V. Chernikov ipfw_xtable_info *info; 1670f1220db8SAlexander V. Chernikov size_t sz; 167156707beeSMark Johnston uint32_t i; 167256707beeSMark Johnston int error; 1673f1220db8SAlexander V. Chernikov 167428ea4fa3SAlexander V. Chernikov /* Start with reasonable default */ 167528ea4fa3SAlexander V. Chernikov sz = sizeof(*olh) + 16 * sizeof(ipfw_xtable_info); 1676f1220db8SAlexander V. Chernikov 167728ea4fa3SAlexander V. Chernikov for (;;) { 1678f1220db8SAlexander V. Chernikov if ((olh = calloc(1, sz)) == NULL) 1679f1220db8SAlexander V. Chernikov return (ENOMEM); 1680f1220db8SAlexander V. Chernikov 1681f1220db8SAlexander V. Chernikov olh->size = sz; 1682b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLES_XLIST, &olh->opheader, &sz) != 0) { 168328ea4fa3SAlexander V. Chernikov sz = olh->size; 168468bde59eSAlexander V. Chernikov free(olh); 168568bde59eSAlexander V. Chernikov if (errno != ENOMEM) 1686b6462881SAlexander V. Chernikov return (errno); 168768bde59eSAlexander V. Chernikov continue; 1688f1220db8SAlexander V. Chernikov } 1689f1220db8SAlexander V. Chernikov 1690f1220db8SAlexander V. Chernikov if (sort != 0) 1691e028ccdaSAndrey V. Elsukov qsort(olh + 1, olh->count, olh->objsize, 1692e028ccdaSAndrey V. Elsukov tablename_cmp); 1693f1220db8SAlexander V. Chernikov 1694f1220db8SAlexander V. Chernikov info = (ipfw_xtable_info *)(olh + 1); 1695f1220db8SAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 169656707beeSMark Johnston if (g_co.use_set == 0 || info->set == g_co.use_set - 1) 1697e028ccdaSAndrey V. Elsukov error = f(info, arg); 1698e028ccdaSAndrey V. Elsukov info = (ipfw_xtable_info *)((caddr_t)info + 1699e028ccdaSAndrey V. Elsukov olh->objsize); 1700f1220db8SAlexander V. Chernikov } 1701f1220db8SAlexander V. Chernikov free(olh); 170228ea4fa3SAlexander V. Chernikov break; 170328ea4fa3SAlexander V. Chernikov } 1704f1220db8SAlexander V. Chernikov return (0); 1705f1220db8SAlexander V. Chernikov } 1706f1220db8SAlexander V. Chernikov 170728ea4fa3SAlexander V. Chernikov 1708f1220db8SAlexander V. Chernikov /* 1709f1220db8SAlexander V. Chernikov * Retrieves all entries for given table @i in 1710720ee730SAlexander V. Chernikov * eXtended format. Allocate buffer large enough 1711720ee730SAlexander V. Chernikov * to store result. Called needs to free it later. 1712f1220db8SAlexander V. Chernikov * 1713f1220db8SAlexander V. Chernikov * Returns 0 on success. 1714f1220db8SAlexander V. Chernikov */ 1715f1220db8SAlexander V. Chernikov static int 1716720ee730SAlexander V. Chernikov table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh) 1717f1220db8SAlexander V. Chernikov { 1718720ee730SAlexander V. Chernikov ipfw_obj_header *oh; 1719f1220db8SAlexander V. Chernikov size_t sz; 1720b6462881SAlexander V. Chernikov int c; 1721f1220db8SAlexander V. Chernikov 172281d3153dSAlexander V. Chernikov sz = 0; 1723720ee730SAlexander V. Chernikov oh = NULL; 1724720ee730SAlexander V. Chernikov for (c = 0; c < 8; c++) { 172581d3153dSAlexander V. Chernikov if (sz < i->size) 1726720ee730SAlexander V. Chernikov sz = i->size + 44; 1727720ee730SAlexander V. Chernikov if (oh != NULL) 1728720ee730SAlexander V. Chernikov free(oh); 1729720ee730SAlexander V. Chernikov if ((oh = calloc(1, sz)) == NULL) 1730720ee730SAlexander V. Chernikov continue; 1731720ee730SAlexander V. Chernikov table_fill_objheader(oh, i); 1732d3a4f924SAlexander V. Chernikov oh->opheader.version = 1; /* Current version */ 1733b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XLIST, &oh->opheader, &sz) == 0) { 1734720ee730SAlexander V. Chernikov *poh = oh; 1735720ee730SAlexander V. Chernikov return (0); 173681d3153dSAlexander V. Chernikov } 1737f1220db8SAlexander V. Chernikov 1738b6462881SAlexander V. Chernikov if (errno != ENOMEM) 1739720ee730SAlexander V. Chernikov break; 1740720ee730SAlexander V. Chernikov } 1741720ee730SAlexander V. Chernikov free(oh); 1742720ee730SAlexander V. Chernikov 1743b6462881SAlexander V. Chernikov return (errno); 1744f1220db8SAlexander V. Chernikov } 1745f1220db8SAlexander V. Chernikov 1746f1220db8SAlexander V. Chernikov /* 1747f1220db8SAlexander V. Chernikov * Shows all entries from @oh in human-readable format 1748f1220db8SAlexander V. Chernikov */ 1749f1220db8SAlexander V. Chernikov static void 1750f1220db8SAlexander V. Chernikov table_show_list(ipfw_obj_header *oh, int need_header) 1751f1220db8SAlexander V. Chernikov { 175281d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 175381d3153dSAlexander V. Chernikov uint32_t count; 1754f1220db8SAlexander V. Chernikov ipfw_xtable_info *i; 1755f1220db8SAlexander V. Chernikov 1756f1220db8SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 175781d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(i + 1); 1758f1220db8SAlexander V. Chernikov 1759f1220db8SAlexander V. Chernikov if (need_header) 1760f1220db8SAlexander V. Chernikov printf("--- table(%s), set(%u) ---\n", i->tablename, i->set); 1761f1220db8SAlexander V. Chernikov 1762f1220db8SAlexander V. Chernikov count = i->count; 1763f1220db8SAlexander V. Chernikov while (count > 0) { 176481d3153dSAlexander V. Chernikov table_show_entry(i, tent); 176581d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)((caddr_t)tent + tent->head.length); 176681d3153dSAlexander V. Chernikov count--; 176781d3153dSAlexander V. Chernikov } 176881d3153dSAlexander V. Chernikov } 176981d3153dSAlexander V. Chernikov 177081d3153dSAlexander V. Chernikov static void 17710cba2b28SAlexander V. Chernikov table_show_value(char *buf, size_t bufsize, ipfw_table_value *v, 17720cba2b28SAlexander V. Chernikov uint32_t vmask, int print_ip) 17730cba2b28SAlexander V. Chernikov { 17742530ed9eSAndrey V. Elsukov char abuf[INET6_ADDRSTRLEN + IF_NAMESIZE + 2]; 17752530ed9eSAndrey V. Elsukov struct sockaddr_in6 sa6; 17760cba2b28SAlexander V. Chernikov uint32_t flag, i, l; 17770cba2b28SAlexander V. Chernikov size_t sz; 17780cba2b28SAlexander V. Chernikov struct in_addr a4; 17790cba2b28SAlexander V. Chernikov 17800cba2b28SAlexander V. Chernikov sz = bufsize; 17810cba2b28SAlexander V. Chernikov 17820cba2b28SAlexander V. Chernikov /* 17830cba2b28SAlexander V. Chernikov * Some shorthands for printing values: 17840cba2b28SAlexander V. Chernikov * legacy assumes all values are equal, so keep the first one. 17850cba2b28SAlexander V. Chernikov */ 17860cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 17870cba2b28SAlexander V. Chernikov if (print_ip != 0) { 17880cba2b28SAlexander V. Chernikov flag = htonl(v->tag); 17890cba2b28SAlexander V. Chernikov inet_ntop(AF_INET, &flag, buf, sz); 17900cba2b28SAlexander V. Chernikov } else 17910cba2b28SAlexander V. Chernikov snprintf(buf, sz, "%u", v->tag); 17920cba2b28SAlexander V. Chernikov return; 17930cba2b28SAlexander V. Chernikov } 17940cba2b28SAlexander V. Chernikov 179556707beeSMark Johnston for (i = 1; i < (1u << 31); i *= 2) { 17960cba2b28SAlexander V. Chernikov if ((flag = (vmask & i)) == 0) 17970cba2b28SAlexander V. Chernikov continue; 17980cba2b28SAlexander V. Chernikov l = 0; 17990cba2b28SAlexander V. Chernikov 18000cba2b28SAlexander V. Chernikov switch (flag) { 18010cba2b28SAlexander V. Chernikov case IPFW_VTYPE_TAG: 18020cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->tag); 18030cba2b28SAlexander V. Chernikov break; 18040cba2b28SAlexander V. Chernikov case IPFW_VTYPE_PIPE: 18050cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->pipe); 18060cba2b28SAlexander V. Chernikov break; 18070cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DIVERT: 18080cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->divert); 18090cba2b28SAlexander V. Chernikov break; 18100cba2b28SAlexander V. Chernikov case IPFW_VTYPE_SKIPTO: 18110cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->skipto); 18120cba2b28SAlexander V. Chernikov break; 18130cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NETGRAPH: 18140cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->netgraph); 18150cba2b28SAlexander V. Chernikov break; 18160cba2b28SAlexander V. Chernikov case IPFW_VTYPE_FIB: 18170cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->fib); 18180cba2b28SAlexander V. Chernikov break; 18190cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NAT: 18200cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->nat); 18210cba2b28SAlexander V. Chernikov break; 18220cba2b28SAlexander V. Chernikov case IPFW_VTYPE_LIMIT: 18230cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->limit); 18240cba2b28SAlexander V. Chernikov break; 18250cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH4: 18260cba2b28SAlexander V. Chernikov a4.s_addr = htonl(v->nh4); 18270cba2b28SAlexander V. Chernikov inet_ntop(AF_INET, &a4, abuf, sizeof(abuf)); 18280cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%s,", abuf); 18290cba2b28SAlexander V. Chernikov break; 18300cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DSCP: 18310cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->dscp); 18320cba2b28SAlexander V. Chernikov break; 18330cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH6: 18342530ed9eSAndrey V. Elsukov sa6.sin6_family = AF_INET6; 18352530ed9eSAndrey V. Elsukov sa6.sin6_len = sizeof(sa6); 18362530ed9eSAndrey V. Elsukov sa6.sin6_addr = v->nh6; 18372530ed9eSAndrey V. Elsukov sa6.sin6_port = 0; 18382530ed9eSAndrey V. Elsukov sa6.sin6_scope_id = v->zoneid; 18392530ed9eSAndrey V. Elsukov if (getnameinfo((const struct sockaddr *)&sa6, 18402530ed9eSAndrey V. Elsukov sa6.sin6_len, abuf, sizeof(abuf), NULL, 0, 18412530ed9eSAndrey V. Elsukov NI_NUMERICHOST) == 0) 18420cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%s,", abuf); 18430cba2b28SAlexander V. Chernikov break; 18440cba2b28SAlexander V. Chernikov } 18450cba2b28SAlexander V. Chernikov 18460cba2b28SAlexander V. Chernikov buf += l; 18470cba2b28SAlexander V. Chernikov sz -= l; 18480cba2b28SAlexander V. Chernikov } 18490cba2b28SAlexander V. Chernikov 18500cba2b28SAlexander V. Chernikov if (sz != bufsize) 18510cba2b28SAlexander V. Chernikov *(buf - 1) = '\0'; 18520cba2b28SAlexander V. Chernikov } 18530cba2b28SAlexander V. Chernikov 18540cba2b28SAlexander V. Chernikov static void 185581d3153dSAlexander V. Chernikov table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent) 185681d3153dSAlexander V. Chernikov { 185756707beeSMark Johnston char tbuf[128], pval[128]; 185856707beeSMark Johnston const char *comma; 1859914bffb6SAlexander V. Chernikov void *paddr; 1860914bffb6SAlexander V. Chernikov struct tflow_entry *tfe; 186181d3153dSAlexander V. Chernikov 18620cba2b28SAlexander V. Chernikov table_show_value(pval, sizeof(pval), &tent->v.value, i->vmask, 186356707beeSMark Johnston g_co.do_value_as_ip); 1864914bffb6SAlexander V. Chernikov 1865f1220db8SAlexander V. Chernikov switch (i->type) { 1866c21034b7SAlexander V. Chernikov case IPFW_TABLE_ADDR: 1867f1220db8SAlexander V. Chernikov /* IPv4 or IPv6 prefixes */ 186881d3153dSAlexander V. Chernikov inet_ntop(tent->subtype, &tent->k, tbuf, sizeof(tbuf)); 1869914bffb6SAlexander V. Chernikov printf("%s/%u %s\n", tbuf, tent->masklen, pval); 1870f1220db8SAlexander V. Chernikov break; 1871f1220db8SAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 1872f1220db8SAlexander V. Chernikov /* Interface names */ 1873914bffb6SAlexander V. Chernikov printf("%s %s\n", tent->k.iface, pval); 1874b23d5de9SAlexander V. Chernikov break; 1875b23d5de9SAlexander V. Chernikov case IPFW_TABLE_NUMBER: 1876b23d5de9SAlexander V. Chernikov /* numbers */ 1877914bffb6SAlexander V. Chernikov printf("%u %s\n", tent->k.key, pval); 1878b23d5de9SAlexander V. Chernikov break; 1879914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 1880914bffb6SAlexander V. Chernikov /* flows */ 1881914bffb6SAlexander V. Chernikov tfe = &tent->k.flow; 1882914bffb6SAlexander V. Chernikov comma = ""; 1883914bffb6SAlexander V. Chernikov 1884914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_SRCIP) != 0) { 1885914bffb6SAlexander V. Chernikov if (tfe->af == AF_INET) 1886914bffb6SAlexander V. Chernikov paddr = &tfe->a.a4.sip; 1887914bffb6SAlexander V. Chernikov else 1888914bffb6SAlexander V. Chernikov paddr = &tfe->a.a6.sip6; 1889914bffb6SAlexander V. Chernikov 1890914bffb6SAlexander V. Chernikov inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf)); 1891914bffb6SAlexander V. Chernikov printf("%s%s", comma, tbuf); 1892914bffb6SAlexander V. Chernikov comma = ","; 1893914bffb6SAlexander V. Chernikov } 1894914bffb6SAlexander V. Chernikov 1895914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_PROTO) != 0) { 1896914bffb6SAlexander V. Chernikov printf("%s%d", comma, tfe->proto); 1897914bffb6SAlexander V. Chernikov comma = ","; 1898914bffb6SAlexander V. Chernikov } 1899914bffb6SAlexander V. Chernikov 1900914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_SRCPORT) != 0) { 1901914bffb6SAlexander V. Chernikov printf("%s%d", comma, ntohs(tfe->sport)); 1902914bffb6SAlexander V. Chernikov comma = ","; 1903914bffb6SAlexander V. Chernikov } 1904914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_DSTIP) != 0) { 1905914bffb6SAlexander V. Chernikov if (tfe->af == AF_INET) 1906914bffb6SAlexander V. Chernikov paddr = &tfe->a.a4.dip; 1907914bffb6SAlexander V. Chernikov else 1908914bffb6SAlexander V. Chernikov paddr = &tfe->a.a6.dip6; 1909914bffb6SAlexander V. Chernikov 1910914bffb6SAlexander V. Chernikov inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf)); 1911914bffb6SAlexander V. Chernikov printf("%s%s", comma, tbuf); 1912914bffb6SAlexander V. Chernikov comma = ","; 1913914bffb6SAlexander V. Chernikov } 1914914bffb6SAlexander V. Chernikov 1915914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_DSTPORT) != 0) { 1916914bffb6SAlexander V. Chernikov printf("%s%d", comma, ntohs(tfe->dport)); 1917914bffb6SAlexander V. Chernikov comma = ","; 1918914bffb6SAlexander V. Chernikov } 1919914bffb6SAlexander V. Chernikov 1920914bffb6SAlexander V. Chernikov printf(" %s\n", pval); 1921f1220db8SAlexander V. Chernikov } 1922f1220db8SAlexander V. Chernikov } 1923f1220db8SAlexander V. Chernikov 19249d099b4fSAlexander V. Chernikov static int 19250cba2b28SAlexander V. Chernikov table_do_get_stdlist(uint16_t opcode, ipfw_obj_lheader **polh) 19269d099b4fSAlexander V. Chernikov { 19279d099b4fSAlexander V. Chernikov ipfw_obj_lheader req, *olh; 19289d099b4fSAlexander V. Chernikov size_t sz; 19299d099b4fSAlexander V. Chernikov 19309d099b4fSAlexander V. Chernikov memset(&req, 0, sizeof(req)); 19319d099b4fSAlexander V. Chernikov sz = sizeof(req); 19329d099b4fSAlexander V. Chernikov 1933b6462881SAlexander V. Chernikov if (do_get3(opcode, &req.opheader, &sz) != 0) 1934b6462881SAlexander V. Chernikov if (errno != ENOMEM) 1935b6462881SAlexander V. Chernikov return (errno); 19369d099b4fSAlexander V. Chernikov 19379d099b4fSAlexander V. Chernikov sz = req.size; 19389d099b4fSAlexander V. Chernikov if ((olh = calloc(1, sz)) == NULL) 19399d099b4fSAlexander V. Chernikov return (ENOMEM); 19409d099b4fSAlexander V. Chernikov 19419d099b4fSAlexander V. Chernikov olh->size = sz; 1942b6462881SAlexander V. Chernikov if (do_get3(opcode, &olh->opheader, &sz) != 0) { 19439d099b4fSAlexander V. Chernikov free(olh); 1944b6462881SAlexander V. Chernikov return (errno); 19459d099b4fSAlexander V. Chernikov } 19469d099b4fSAlexander V. Chernikov 19479d099b4fSAlexander V. Chernikov *polh = olh; 19489d099b4fSAlexander V. Chernikov return (0); 19499d099b4fSAlexander V. Chernikov } 19509d099b4fSAlexander V. Chernikov 19510cba2b28SAlexander V. Chernikov static int 19520cba2b28SAlexander V. Chernikov table_do_get_algolist(ipfw_obj_lheader **polh) 19530cba2b28SAlexander V. Chernikov { 19540cba2b28SAlexander V. Chernikov 19550cba2b28SAlexander V. Chernikov return (table_do_get_stdlist(IP_FW_TABLES_ALIST, polh)); 19560cba2b28SAlexander V. Chernikov } 19570cba2b28SAlexander V. Chernikov 19580cba2b28SAlexander V. Chernikov static int 19590cba2b28SAlexander V. Chernikov table_do_get_vlist(ipfw_obj_lheader **polh) 19600cba2b28SAlexander V. Chernikov { 19610cba2b28SAlexander V. Chernikov 19620cba2b28SAlexander V. Chernikov return (table_do_get_stdlist(IP_FW_TABLE_VLIST, polh)); 19630cba2b28SAlexander V. Chernikov } 19640cba2b28SAlexander V. Chernikov 19659d099b4fSAlexander V. Chernikov void 196656707beeSMark Johnston ipfw_list_ta(int ac __unused, char *av[] __unused) 19679d099b4fSAlexander V. Chernikov { 19689d099b4fSAlexander V. Chernikov ipfw_obj_lheader *olh; 19699d099b4fSAlexander V. Chernikov ipfw_ta_info *info; 19709d099b4fSAlexander V. Chernikov const char *atype; 197156707beeSMark Johnston uint32_t i; 197256707beeSMark Johnston int error; 19739d099b4fSAlexander V. Chernikov 19749d099b4fSAlexander V. Chernikov error = table_do_get_algolist(&olh); 19759d099b4fSAlexander V. Chernikov if (error != 0) 19769d099b4fSAlexander V. Chernikov err(EX_OSERR, "Unable to request algorithm list"); 19779d099b4fSAlexander V. Chernikov 19789d099b4fSAlexander V. Chernikov info = (ipfw_ta_info *)(olh + 1); 19799d099b4fSAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 19809d099b4fSAlexander V. Chernikov if ((atype = match_value(tabletypes, info->type)) == NULL) 19819d099b4fSAlexander V. Chernikov atype = "unknown"; 19828ce7a2bcSAlexander V. Chernikov printf("--- %s ---\n", info->algoname); 19838ce7a2bcSAlexander V. Chernikov printf(" type: %s\n refcount: %u\n", atype, info->refcnt); 19849d099b4fSAlexander V. Chernikov 19859d099b4fSAlexander V. Chernikov info = (ipfw_ta_info *)((caddr_t)info + olh->objsize); 19869d099b4fSAlexander V. Chernikov } 19879d099b4fSAlexander V. Chernikov 19889d099b4fSAlexander V. Chernikov free(olh); 19899d099b4fSAlexander V. Chernikov } 19909d099b4fSAlexander V. Chernikov 19910cba2b28SAlexander V. Chernikov 19920cba2b28SAlexander V. Chernikov /* Copy of current kernel table_value structure */ 19930cba2b28SAlexander V. Chernikov struct _table_value { 19940cba2b28SAlexander V. Chernikov uint32_t tag; /* O_TAG/O_TAGGED */ 19950cba2b28SAlexander V. Chernikov uint32_t pipe; /* O_PIPE/O_QUEUE */ 19960cba2b28SAlexander V. Chernikov uint16_t divert; /* O_DIVERT/O_TEE */ 19970cba2b28SAlexander V. Chernikov uint16_t skipto; /* skipto, CALLRET */ 19980cba2b28SAlexander V. Chernikov uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */ 19990cba2b28SAlexander V. Chernikov uint32_t fib; /* O_SETFIB */ 20000cba2b28SAlexander V. Chernikov uint32_t nat; /* O_NAT */ 20010cba2b28SAlexander V. Chernikov uint32_t nh4; 20020cba2b28SAlexander V. Chernikov uint8_t dscp; 20032530ed9eSAndrey V. Elsukov uint8_t spare0; 20042530ed9eSAndrey V. Elsukov uint16_t spare1; 20050cba2b28SAlexander V. Chernikov /* -- 32 bytes -- */ 20060cba2b28SAlexander V. Chernikov struct in6_addr nh6; 20070cba2b28SAlexander V. Chernikov uint32_t limit; /* O_LIMIT */ 20082530ed9eSAndrey V. Elsukov uint32_t zoneid; 20090cba2b28SAlexander V. Chernikov uint64_t refcnt; /* Number of references */ 20100cba2b28SAlexander V. Chernikov }; 20110cba2b28SAlexander V. Chernikov 201256707beeSMark Johnston static int 20130cba2b28SAlexander V. Chernikov compare_values(const void *_a, const void *_b) 20140cba2b28SAlexander V. Chernikov { 201556707beeSMark Johnston const struct _table_value *a, *b; 20160cba2b28SAlexander V. Chernikov 201756707beeSMark Johnston a = (const struct _table_value *)_a; 201856707beeSMark Johnston b = (const struct _table_value *)_b; 20190cba2b28SAlexander V. Chernikov 20200cba2b28SAlexander V. Chernikov if (a->spare1 < b->spare1) 20210cba2b28SAlexander V. Chernikov return (-1); 20220cba2b28SAlexander V. Chernikov else if (a->spare1 > b->spare1) 20230cba2b28SAlexander V. Chernikov return (1); 20240cba2b28SAlexander V. Chernikov 20250cba2b28SAlexander V. Chernikov return (0); 20260cba2b28SAlexander V. Chernikov } 20270cba2b28SAlexander V. Chernikov 20280cba2b28SAlexander V. Chernikov void 202956707beeSMark Johnston ipfw_list_values(int ac __unused, char *av[] __unused) 20300cba2b28SAlexander V. Chernikov { 203156707beeSMark Johnston char buf[128]; 20320cba2b28SAlexander V. Chernikov ipfw_obj_lheader *olh; 20330cba2b28SAlexander V. Chernikov struct _table_value *v; 203456707beeSMark Johnston uint32_t i, vmask; 203556707beeSMark Johnston int error; 20360cba2b28SAlexander V. Chernikov 20370cba2b28SAlexander V. Chernikov error = table_do_get_vlist(&olh); 20380cba2b28SAlexander V. Chernikov if (error != 0) 20390cba2b28SAlexander V. Chernikov err(EX_OSERR, "Unable to request value list"); 20400cba2b28SAlexander V. Chernikov 20410cba2b28SAlexander V. Chernikov vmask = 0x7FFFFFFF; /* Similar to IPFW_VTYPE_LEGACY */ 20420cba2b28SAlexander V. Chernikov 20430cba2b28SAlexander V. Chernikov table_print_valheader(buf, sizeof(buf), vmask); 20440cba2b28SAlexander V. Chernikov printf("HEADER: %s\n", buf); 20450cba2b28SAlexander V. Chernikov v = (struct _table_value *)(olh + 1); 20460cba2b28SAlexander V. Chernikov qsort(v, olh->count, olh->objsize, compare_values); 20470cba2b28SAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 20480cba2b28SAlexander V. Chernikov table_show_value(buf, sizeof(buf), (ipfw_table_value *)v, 20490cba2b28SAlexander V. Chernikov vmask, 0); 2050d3de6c1dSAlexander V. Chernikov printf("[%u] refs=%lu %s\n", v->spare1, (u_long)v->refcnt, buf); 20510cba2b28SAlexander V. Chernikov v = (struct _table_value *)((caddr_t)v + olh->objsize); 20520cba2b28SAlexander V. Chernikov } 20530cba2b28SAlexander V. Chernikov 20540cba2b28SAlexander V. Chernikov free(olh); 20550cba2b28SAlexander V. Chernikov } 20560cba2b28SAlexander V. Chernikov 20576c2997ffSAlexander V. Chernikov int 20582acdf79fSAndrey V. Elsukov table_check_name(const char *tablename) 20596c2997ffSAlexander V. Chernikov { 20606c2997ffSAlexander V. Chernikov 20612acdf79fSAndrey V. Elsukov if (ipfw_check_object_name(tablename) != 0) 20626c2997ffSAlexander V. Chernikov return (EINVAL); 2063ac35ff17SAlexander V. Chernikov /* Restrict some 'special' names */ 2064ac35ff17SAlexander V. Chernikov if (strcmp(tablename, "all") == 0) 2065ac35ff17SAlexander V. Chernikov return (EINVAL); 20666c2997ffSAlexander V. Chernikov return (0); 20676c2997ffSAlexander V. Chernikov } 20686c2997ffSAlexander V. Chernikov 2069