1f1220db8SAlexander V. Chernikov /* 21a33e799SAlexander V. Chernikov * Copyright (c) 2014 Yandex LLC 31a33e799SAlexander V. Chernikov * Copyright (c) 2014 Alexander V. Chernikov 4f1220db8SAlexander V. Chernikov * 5f1220db8SAlexander V. Chernikov * Redistribution and use in source forms, with and without modification, 6f1220db8SAlexander V. Chernikov * are permitted provided that this entire comment appears intact. 7f1220db8SAlexander V. Chernikov * 8f1220db8SAlexander V. Chernikov * Redistribution in binary form may occur without any restrictions. 9f1220db8SAlexander V. Chernikov * Obviously, it would be nice if you gave credit where credit is due 10f1220db8SAlexander V. Chernikov * but requiring it would be too onerous. 11f1220db8SAlexander V. Chernikov * 12f1220db8SAlexander V. Chernikov * This software is provided ``AS IS'' without any warranties of any kind. 13f1220db8SAlexander V. Chernikov * 141a33e799SAlexander V. Chernikov * in-kernel ipfw tables support. 15f1220db8SAlexander V. Chernikov * 169fe15d06SAlexander V. Chernikov * $FreeBSD$ 17f1220db8SAlexander V. Chernikov */ 18f1220db8SAlexander V. Chernikov 19f1220db8SAlexander V. Chernikov 20f1220db8SAlexander V. Chernikov #include <sys/types.h> 21f1220db8SAlexander V. Chernikov #include <sys/param.h> 22f1220db8SAlexander V. Chernikov #include <sys/socket.h> 23f1220db8SAlexander V. Chernikov #include <sys/sysctl.h> 24f1220db8SAlexander V. Chernikov 25f1220db8SAlexander V. Chernikov #include <ctype.h> 26f1220db8SAlexander V. Chernikov #include <err.h> 27f1220db8SAlexander V. Chernikov #include <errno.h> 28f1220db8SAlexander V. Chernikov #include <netdb.h> 29f1220db8SAlexander V. Chernikov #include <stdio.h> 30f1220db8SAlexander V. Chernikov #include <stdlib.h> 31f1220db8SAlexander V. Chernikov #include <string.h> 32f1220db8SAlexander V. Chernikov #include <sysexits.h> 33f1220db8SAlexander V. Chernikov 34f1220db8SAlexander V. Chernikov #include <net/if.h> 35f1220db8SAlexander V. Chernikov #include <netinet/in.h> 36f1220db8SAlexander V. Chernikov #include <netinet/ip_fw.h> 37f1220db8SAlexander V. Chernikov #include <arpa/inet.h> 382530ed9eSAndrey V. Elsukov #include <netdb.h> 39f1220db8SAlexander V. Chernikov 40f1220db8SAlexander V. Chernikov #include "ipfw2.h" 41f1220db8SAlexander V. Chernikov 42ac35ff17SAlexander V. Chernikov static void table_modify_record(ipfw_obj_header *oh, int ac, char *av[], 433a845e10SAlexander V. Chernikov int add, int quiet, int update, int atomic); 44ac35ff17SAlexander V. Chernikov static int table_flush(ipfw_obj_header *oh); 45ac35ff17SAlexander V. Chernikov static int table_destroy(ipfw_obj_header *oh); 46ac35ff17SAlexander V. Chernikov static int table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i); 47adf3b2b9SAlexander V. Chernikov static int table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i); 4846d52008SAlexander V. Chernikov static int table_do_swap(ipfw_obj_header *oh, char *second); 49adf3b2b9SAlexander V. Chernikov static void table_create(ipfw_obj_header *oh, int ac, char *av[]); 50adf3b2b9SAlexander V. Chernikov static void table_modify(ipfw_obj_header *oh, int ac, char *av[]); 51adf3b2b9SAlexander V. Chernikov static void table_lookup(ipfw_obj_header *oh, int ac, char *av[]); 524f43138aSAlexander V. Chernikov static void table_lock(ipfw_obj_header *oh, int lock); 5346d52008SAlexander V. Chernikov static int table_swap(ipfw_obj_header *oh, char *second); 54ac35ff17SAlexander V. Chernikov static int table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i); 55f1220db8SAlexander V. Chernikov static int table_show_info(ipfw_xtable_info *i, void *arg); 562acdf79fSAndrey V. Elsukov static void table_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, 572acdf79fSAndrey V. Elsukov uint32_t set, uint16_t uidx); 58f1220db8SAlexander V. Chernikov 59f1220db8SAlexander V. Chernikov static int table_flush_one(ipfw_xtable_info *i, void *arg); 60f1220db8SAlexander V. Chernikov static int table_show_one(ipfw_xtable_info *i, void *arg); 61720ee730SAlexander V. Chernikov static int table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh); 62f1220db8SAlexander V. Chernikov static void table_show_list(ipfw_obj_header *oh, int need_header); 6381d3153dSAlexander V. Chernikov static void table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent); 64f1220db8SAlexander V. Chernikov 65ac35ff17SAlexander V. Chernikov static void tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, 660cba2b28SAlexander V. Chernikov char *key, int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi); 67ac35ff17SAlexander V. Chernikov static void tentry_fill_value(ipfw_obj_header *oh, ipfw_obj_tentry *tent, 680cba2b28SAlexander V. Chernikov char *arg, uint8_t type, uint32_t vmask); 690cba2b28SAlexander V. Chernikov static void table_show_value(char *buf, size_t bufsize, ipfw_table_value *v, 700cba2b28SAlexander V. Chernikov uint32_t vmask, int print_ip); 71ac35ff17SAlexander V. Chernikov 72f1220db8SAlexander V. Chernikov typedef int (table_cb_t)(ipfw_xtable_info *i, void *arg); 73f1220db8SAlexander V. Chernikov static int tables_foreach(table_cb_t *f, void *arg, int sort); 74f1220db8SAlexander V. Chernikov 75f1220db8SAlexander V. Chernikov #ifndef s6_addr32 76f1220db8SAlexander V. Chernikov #define s6_addr32 __u6_addr.__u6_addr32 77f1220db8SAlexander V. Chernikov #endif 78f1220db8SAlexander V. Chernikov 79ac35ff17SAlexander V. Chernikov static struct _s_x tabletypes[] = { 80c21034b7SAlexander V. Chernikov { "addr", IPFW_TABLE_ADDR }, 81ac35ff17SAlexander V. Chernikov { "iface", IPFW_TABLE_INTERFACE }, 82b23d5de9SAlexander V. Chernikov { "number", IPFW_TABLE_NUMBER }, 83914bffb6SAlexander V. Chernikov { "flow", IPFW_TABLE_FLOW }, 84ac35ff17SAlexander V. Chernikov { NULL, 0 } 85ac35ff17SAlexander V. Chernikov }; 86ac35ff17SAlexander V. Chernikov 87ac35ff17SAlexander V. Chernikov static struct _s_x tablevaltypes[] = { 880cba2b28SAlexander V. Chernikov { "skipto", IPFW_VTYPE_SKIPTO }, 890cba2b28SAlexander V. Chernikov { "pipe", IPFW_VTYPE_PIPE }, 900cba2b28SAlexander V. Chernikov { "fib", IPFW_VTYPE_FIB }, 910cba2b28SAlexander V. Chernikov { "nat", IPFW_VTYPE_NAT }, 920cba2b28SAlexander V. Chernikov { "dscp", IPFW_VTYPE_DSCP }, 930cba2b28SAlexander V. Chernikov { "tag", IPFW_VTYPE_TAG }, 940cba2b28SAlexander V. Chernikov { "divert", IPFW_VTYPE_DIVERT }, 950cba2b28SAlexander V. Chernikov { "netgraph", IPFW_VTYPE_NETGRAPH }, 960cba2b28SAlexander V. Chernikov { "limit", IPFW_VTYPE_LIMIT }, 970cba2b28SAlexander V. Chernikov { "ipv4", IPFW_VTYPE_NH4 }, 980cba2b28SAlexander V. Chernikov { "ipv6", IPFW_VTYPE_NH6 }, 99adf3b2b9SAlexander V. Chernikov { NULL, 0 } 100adf3b2b9SAlexander V. Chernikov }; 101adf3b2b9SAlexander V. Chernikov 102ac35ff17SAlexander V. Chernikov static struct _s_x tablecmds[] = { 103ac35ff17SAlexander V. Chernikov { "add", TOK_ADD }, 104ac35ff17SAlexander V. Chernikov { "delete", TOK_DEL }, 10546d52008SAlexander V. Chernikov { "create", TOK_CREATE }, 106ac35ff17SAlexander V. Chernikov { "destroy", TOK_DESTROY }, 107ac35ff17SAlexander V. Chernikov { "flush", TOK_FLUSH }, 108adf3b2b9SAlexander V. Chernikov { "modify", TOK_MODIFY }, 10946d52008SAlexander V. Chernikov { "swap", TOK_SWAP }, 110ac35ff17SAlexander V. Chernikov { "info", TOK_INFO }, 111358b9d09SAlexander V. Chernikov { "detail", TOK_DETAIL }, 112ac35ff17SAlexander V. Chernikov { "list", TOK_LIST }, 11381d3153dSAlexander V. Chernikov { "lookup", TOK_LOOKUP }, 1143a845e10SAlexander V. Chernikov { "atomic", TOK_ATOMIC }, 1154f43138aSAlexander V. Chernikov { "lock", TOK_LOCK }, 1164f43138aSAlexander V. Chernikov { "unlock", TOK_UNLOCK }, 117ac35ff17SAlexander V. Chernikov { NULL, 0 } 118ac35ff17SAlexander V. Chernikov }; 119ac35ff17SAlexander V. Chernikov 120f1220db8SAlexander V. Chernikov static int 121f1220db8SAlexander V. Chernikov lookup_host (char *host, struct in_addr *ipaddr) 122f1220db8SAlexander V. Chernikov { 123f1220db8SAlexander V. Chernikov struct hostent *he; 124f1220db8SAlexander V. Chernikov 125f1220db8SAlexander V. Chernikov if (!inet_aton(host, ipaddr)) { 126f1220db8SAlexander V. Chernikov if ((he = gethostbyname(host)) == NULL) 127f1220db8SAlexander V. Chernikov return(-1); 128f1220db8SAlexander V. Chernikov *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 129f1220db8SAlexander V. Chernikov } 130f1220db8SAlexander V. Chernikov return(0); 131f1220db8SAlexander V. Chernikov } 132f1220db8SAlexander V. Chernikov 133f1220db8SAlexander V. Chernikov /* 134f1220db8SAlexander V. Chernikov * This one handles all table-related commands 135ac35ff17SAlexander V. Chernikov * ipfw table NAME create ... 136be695df9SAlexander V. Chernikov * ipfw table NAME modify ... 137ac35ff17SAlexander V. Chernikov * ipfw table NAME destroy 138be695df9SAlexander V. Chernikov * ipfw table NAME swap NAME 139be695df9SAlexander V. Chernikov * ipfw table NAME lock 140be695df9SAlexander V. Chernikov * ipfw table NAME unlock 141ac35ff17SAlexander V. Chernikov * ipfw table NAME add addr[/masklen] [value] 142be695df9SAlexander V. Chernikov * ipfw table NAME add [addr[/masklen] value] [addr[/masklen] value] .. 143be695df9SAlexander V. Chernikov * ipfw table NAME delete addr[/masklen] [addr[/masklen]] .. 144be695df9SAlexander V. Chernikov * ipfw table NAME lookup addr 145ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} flush 146ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} list 147ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} info 148be695df9SAlexander V. Chernikov * ipfw table {NAME | all} detail 149f1220db8SAlexander V. Chernikov */ 150f1220db8SAlexander V. Chernikov void 151f1220db8SAlexander V. Chernikov ipfw_table_handler(int ac, char *av[]) 152f1220db8SAlexander V. Chernikov { 153ac35ff17SAlexander V. Chernikov int do_add, is_all; 1543a845e10SAlexander V. Chernikov int atomic, error, tcmd; 155ac35ff17SAlexander V. Chernikov ipfw_xtable_info i; 156ac35ff17SAlexander V. Chernikov ipfw_obj_header oh; 157f1220db8SAlexander V. Chernikov char *tablename; 158ac35ff17SAlexander V. Chernikov uint32_t set; 159358b9d09SAlexander V. Chernikov void *arg; 160f1220db8SAlexander V. Chernikov 161ac35ff17SAlexander V. Chernikov memset(&oh, 0, sizeof(oh)); 162ac35ff17SAlexander V. Chernikov is_all = 0; 163ac35ff17SAlexander V. Chernikov if (co.use_set != 0) 164ac35ff17SAlexander V. Chernikov set = co.use_set - 1; 165ac35ff17SAlexander V. Chernikov else 166ac35ff17SAlexander V. Chernikov set = 0; 167f1220db8SAlexander V. Chernikov 168f1220db8SAlexander V. Chernikov ac--; av++; 1699d099b4fSAlexander V. Chernikov NEED1("table needs name"); 170f1220db8SAlexander V. Chernikov tablename = *av; 171f1220db8SAlexander V. Chernikov 172ac35ff17SAlexander V. Chernikov if (table_check_name(tablename) == 0) { 173ac35ff17SAlexander V. Chernikov table_fill_ntlv(&oh.ntlv, *av, set, 1); 174ac35ff17SAlexander V. Chernikov oh.idx = 1; 175ac35ff17SAlexander V. Chernikov } else { 176ac35ff17SAlexander V. Chernikov if (strcmp(tablename, "all") == 0) 177ac35ff17SAlexander V. Chernikov is_all = 1; 178ac35ff17SAlexander V. Chernikov else 179ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "table name %s is invalid", tablename); 180ac35ff17SAlexander V. Chernikov } 181ac35ff17SAlexander V. Chernikov ac--; av++; 1829d099b4fSAlexander V. Chernikov NEED1("table needs command"); 183ac35ff17SAlexander V. Chernikov 184be695df9SAlexander V. Chernikov tcmd = get_token(tablecmds, *av, "table command"); 1853a845e10SAlexander V. Chernikov /* Check if atomic operation was requested */ 1863a845e10SAlexander V. Chernikov atomic = 0; 1873a845e10SAlexander V. Chernikov if (tcmd == TOK_ATOMIC) { 1883a845e10SAlexander V. Chernikov ac--; av++; 1893a845e10SAlexander V. Chernikov NEED1("atomic needs command"); 190be695df9SAlexander V. Chernikov tcmd = get_token(tablecmds, *av, "table command"); 1913a845e10SAlexander V. Chernikov switch (tcmd) { 1923a845e10SAlexander V. Chernikov case TOK_ADD: 1933a845e10SAlexander V. Chernikov break; 1943a845e10SAlexander V. Chernikov default: 1953a845e10SAlexander V. Chernikov errx(EX_USAGE, "atomic is not compatible with %s", *av); 1963a845e10SAlexander V. Chernikov } 1973a845e10SAlexander V. Chernikov atomic = 1; 1983a845e10SAlexander V. Chernikov } 199ac35ff17SAlexander V. Chernikov 200ac35ff17SAlexander V. Chernikov switch (tcmd) { 201ac35ff17SAlexander V. Chernikov case TOK_LIST: 202ac35ff17SAlexander V. Chernikov case TOK_INFO: 203358b9d09SAlexander V. Chernikov case TOK_DETAIL: 204ac35ff17SAlexander V. Chernikov case TOK_FLUSH: 205ac35ff17SAlexander V. Chernikov break; 206ac35ff17SAlexander V. Chernikov default: 207ac35ff17SAlexander V. Chernikov if (is_all != 0) 208ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "table name required"); 209ac35ff17SAlexander V. Chernikov } 210ac35ff17SAlexander V. Chernikov 211ac35ff17SAlexander V. Chernikov switch (tcmd) { 212ac35ff17SAlexander V. Chernikov case TOK_ADD: 213ac35ff17SAlexander V. Chernikov case TOK_DEL: 214f1220db8SAlexander V. Chernikov do_add = **av == 'a'; 215f1220db8SAlexander V. Chernikov ac--; av++; 2163a845e10SAlexander V. Chernikov table_modify_record(&oh, ac, av, do_add, co.do_quiet, 2173a845e10SAlexander V. Chernikov co.do_quiet, atomic); 218ac35ff17SAlexander V. Chernikov break; 219ac35ff17SAlexander V. Chernikov case TOK_CREATE: 220f1220db8SAlexander V. Chernikov ac--; av++; 221ac35ff17SAlexander V. Chernikov table_create(&oh, ac, av); 222ac35ff17SAlexander V. Chernikov break; 223adf3b2b9SAlexander V. Chernikov case TOK_MODIFY: 224adf3b2b9SAlexander V. Chernikov ac--; av++; 225adf3b2b9SAlexander V. Chernikov table_modify(&oh, ac, av); 226adf3b2b9SAlexander V. Chernikov break; 227ac35ff17SAlexander V. Chernikov case TOK_DESTROY: 22876d03257SAndrey V. Elsukov if (table_destroy(&oh) == 0) 22976d03257SAndrey V. Elsukov break; 23076d03257SAndrey V. Elsukov if (errno != ESRCH) 231ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to destroy table %s", tablename); 23276d03257SAndrey V. Elsukov /* ESRCH isn't fatal, warn if not quiet mode */ 23376d03257SAndrey V. Elsukov if (co.do_quiet == 0) 23476d03257SAndrey V. Elsukov warn("failed to destroy table %s", tablename); 235ac35ff17SAlexander V. Chernikov break; 236ac35ff17SAlexander V. Chernikov case TOK_FLUSH: 237f1220db8SAlexander V. Chernikov if (is_all == 0) { 23876d03257SAndrey V. Elsukov if ((error = table_flush(&oh)) == 0) 23976d03257SAndrey V. Elsukov break; 24076d03257SAndrey V. Elsukov if (errno != ESRCH) 241f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to flush table %s info", 242f1220db8SAlexander V. Chernikov tablename); 24376d03257SAndrey V. Elsukov /* ESRCH isn't fatal, warn if not quiet mode */ 24476d03257SAndrey V. Elsukov if (co.do_quiet == 0) 24576d03257SAndrey V. Elsukov warn("failed to flush table %s info", 24676d03257SAndrey V. Elsukov tablename); 247f1220db8SAlexander V. Chernikov } else { 248ac35ff17SAlexander V. Chernikov error = tables_foreach(table_flush_one, &oh, 1); 249f1220db8SAlexander V. Chernikov if (error != 0) 250f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to flush tables list"); 25176d03257SAndrey V. Elsukov /* XXX: we ignore errors here */ 252f1220db8SAlexander V. Chernikov } 253ac35ff17SAlexander V. Chernikov break; 25446d52008SAlexander V. Chernikov case TOK_SWAP: 25546d52008SAlexander V. Chernikov ac--; av++; 25646d52008SAlexander V. Chernikov NEED1("second table name required"); 25746d52008SAlexander V. Chernikov table_swap(&oh, *av); 25846d52008SAlexander V. Chernikov break; 2594f43138aSAlexander V. Chernikov case TOK_LOCK: 2604f43138aSAlexander V. Chernikov case TOK_UNLOCK: 2614f43138aSAlexander V. Chernikov table_lock(&oh, (tcmd == TOK_LOCK)); 2624f43138aSAlexander V. Chernikov break; 263358b9d09SAlexander V. Chernikov case TOK_DETAIL: 264ac35ff17SAlexander V. Chernikov case TOK_INFO: 265358b9d09SAlexander V. Chernikov arg = (tcmd == TOK_DETAIL) ? (void *)1 : NULL; 266f1220db8SAlexander V. Chernikov if (is_all == 0) { 267ac35ff17SAlexander V. Chernikov if ((error = table_get_info(&oh, &i)) != 0) 268f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to request table info"); 269358b9d09SAlexander V. Chernikov table_show_info(&i, arg); 270f1220db8SAlexander V. Chernikov } else { 271358b9d09SAlexander V. Chernikov error = tables_foreach(table_show_info, arg, 1); 272f1220db8SAlexander V. Chernikov if (error != 0) 273f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to request tables list"); 274f1220db8SAlexander V. Chernikov } 275ac35ff17SAlexander V. Chernikov break; 276ac35ff17SAlexander V. Chernikov case TOK_LIST: 277ac35ff17SAlexander V. Chernikov if (is_all == 0) { 278ac35ff17SAlexander V. Chernikov ipfw_xtable_info i; 279ac35ff17SAlexander V. Chernikov if ((error = table_get_info(&oh, &i)) != 0) 280ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to request table info"); 281ac35ff17SAlexander V. Chernikov table_show_one(&i, NULL); 282f1220db8SAlexander V. Chernikov } else { 283ac35ff17SAlexander V. Chernikov error = tables_foreach(table_show_one, NULL, 1); 284ac35ff17SAlexander V. Chernikov if (error != 0) 285ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to request tables list"); 286f1220db8SAlexander V. Chernikov } 287ac35ff17SAlexander V. Chernikov break; 28881d3153dSAlexander V. Chernikov case TOK_LOOKUP: 28981d3153dSAlexander V. Chernikov ac--; av++; 29081d3153dSAlexander V. Chernikov table_lookup(&oh, ac, av); 29181d3153dSAlexander V. Chernikov break; 292f1220db8SAlexander V. Chernikov } 293f1220db8SAlexander V. Chernikov } 294f1220db8SAlexander V. Chernikov 295f1220db8SAlexander V. Chernikov static void 2962acdf79fSAndrey V. Elsukov table_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint32_t set, 2972acdf79fSAndrey V. Elsukov uint16_t uidx) 298f1220db8SAlexander V. Chernikov { 299f1220db8SAlexander V. Chernikov 300563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 301f1220db8SAlexander V. Chernikov ntlv->head.length = sizeof(ipfw_obj_ntlv); 302f1220db8SAlexander V. Chernikov ntlv->idx = uidx; 303ac35ff17SAlexander V. Chernikov ntlv->set = set; 304f1220db8SAlexander V. Chernikov strlcpy(ntlv->name, name, sizeof(ntlv->name)); 305f1220db8SAlexander V. Chernikov } 306f1220db8SAlexander V. Chernikov 307f1220db8SAlexander V. Chernikov static void 308f1220db8SAlexander V. Chernikov table_fill_objheader(ipfw_obj_header *oh, ipfw_xtable_info *i) 309f1220db8SAlexander V. Chernikov { 310f1220db8SAlexander V. Chernikov 311f1220db8SAlexander V. Chernikov oh->idx = 1; 31281d3153dSAlexander V. Chernikov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 313ac35ff17SAlexander V. Chernikov } 314ac35ff17SAlexander V. Chernikov 315ac35ff17SAlexander V. Chernikov static struct _s_x tablenewcmds[] = { 316ac35ff17SAlexander V. Chernikov { "type", TOK_TYPE }, 317ac35ff17SAlexander V. Chernikov { "valtype", TOK_VALTYPE }, 318ac35ff17SAlexander V. Chernikov { "algo", TOK_ALGO }, 3194c0c07a5SAlexander V. Chernikov { "limit", TOK_LIMIT }, 3204f43138aSAlexander V. Chernikov { "locked", TOK_LOCK }, 321ac35ff17SAlexander V. Chernikov { NULL, 0 } 322ac35ff17SAlexander V. Chernikov }; 323ac35ff17SAlexander V. Chernikov 324914bffb6SAlexander V. Chernikov static struct _s_x flowtypecmds[] = { 325914bffb6SAlexander V. Chernikov { "src-ip", IPFW_TFFLAG_SRCIP }, 326914bffb6SAlexander V. Chernikov { "proto", IPFW_TFFLAG_PROTO }, 327914bffb6SAlexander V. Chernikov { "src-port", IPFW_TFFLAG_SRCPORT }, 328914bffb6SAlexander V. Chernikov { "dst-ip", IPFW_TFFLAG_DSTIP }, 329914bffb6SAlexander V. Chernikov { "dst-port", IPFW_TFFLAG_DSTPORT }, 330914bffb6SAlexander V. Chernikov { NULL, 0 } 331914bffb6SAlexander V. Chernikov }; 332914bffb6SAlexander V. Chernikov 333914bffb6SAlexander V. Chernikov int 334914bffb6SAlexander V. Chernikov table_parse_type(uint8_t ttype, char *p, uint8_t *tflags) 335914bffb6SAlexander V. Chernikov { 3360cba2b28SAlexander V. Chernikov uint32_t fset, fclear; 3370cba2b28SAlexander V. Chernikov char *e; 338914bffb6SAlexander V. Chernikov 339914bffb6SAlexander V. Chernikov /* Parse type options */ 340914bffb6SAlexander V. Chernikov switch(ttype) { 341914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 342914bffb6SAlexander V. Chernikov fset = fclear = 0; 3430cba2b28SAlexander V. Chernikov if (fill_flags(flowtypecmds, p, &e, &fset, &fclear) != 0) 3440cba2b28SAlexander V. Chernikov errx(EX_USAGE, 3450cba2b28SAlexander V. Chernikov "unable to parse flow option %s", e); 346914bffb6SAlexander V. Chernikov *tflags = fset; 347914bffb6SAlexander V. Chernikov break; 348914bffb6SAlexander V. Chernikov default: 349914bffb6SAlexander V. Chernikov return (EX_USAGE); 350914bffb6SAlexander V. Chernikov } 351914bffb6SAlexander V. Chernikov 352914bffb6SAlexander V. Chernikov return (0); 353914bffb6SAlexander V. Chernikov } 354914bffb6SAlexander V. Chernikov 355914bffb6SAlexander V. Chernikov void 356914bffb6SAlexander V. Chernikov table_print_type(char *tbuf, size_t size, uint8_t type, uint8_t tflags) 357914bffb6SAlexander V. Chernikov { 358914bffb6SAlexander V. Chernikov const char *tname; 359914bffb6SAlexander V. Chernikov int l; 360914bffb6SAlexander V. Chernikov 361914bffb6SAlexander V. Chernikov if ((tname = match_value(tabletypes, type)) == NULL) 362914bffb6SAlexander V. Chernikov tname = "unknown"; 363914bffb6SAlexander V. Chernikov 364914bffb6SAlexander V. Chernikov l = snprintf(tbuf, size, "%s", tname); 365914bffb6SAlexander V. Chernikov tbuf += l; 366914bffb6SAlexander V. Chernikov size -= l; 367914bffb6SAlexander V. Chernikov 368914bffb6SAlexander V. Chernikov switch(type) { 369914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 370914bffb6SAlexander V. Chernikov if (tflags != 0) { 371914bffb6SAlexander V. Chernikov *tbuf++ = ':'; 372914bffb6SAlexander V. Chernikov l--; 373914bffb6SAlexander V. Chernikov print_flags_buffer(tbuf, size, flowtypecmds, tflags); 374914bffb6SAlexander V. Chernikov } 375914bffb6SAlexander V. Chernikov break; 376914bffb6SAlexander V. Chernikov } 377914bffb6SAlexander V. Chernikov } 378914bffb6SAlexander V. Chernikov 379ac35ff17SAlexander V. Chernikov /* 380ac35ff17SAlexander V. Chernikov * Creates new table 381ac35ff17SAlexander V. Chernikov * 382c21034b7SAlexander V. Chernikov * ipfw table NAME create [ type { addr | iface | number | flow } ] 383ac35ff17SAlexander V. Chernikov * [ algo algoname ] 384ac35ff17SAlexander V. Chernikov */ 385ac35ff17SAlexander V. Chernikov static void 386ac35ff17SAlexander V. Chernikov table_create(ipfw_obj_header *oh, int ac, char *av[]) 387ac35ff17SAlexander V. Chernikov { 388ac35ff17SAlexander V. Chernikov ipfw_xtable_info xi; 389ac35ff17SAlexander V. Chernikov int error, tcmd, val; 3900cba2b28SAlexander V. Chernikov uint32_t fset, fclear; 3910cba2b28SAlexander V. Chernikov char *e, *p; 392ac35ff17SAlexander V. Chernikov char tbuf[128]; 393ac35ff17SAlexander V. Chernikov 394ac35ff17SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 395ac35ff17SAlexander V. Chernikov 396ac35ff17SAlexander V. Chernikov while (ac > 0) { 397be695df9SAlexander V. Chernikov tcmd = get_token(tablenewcmds, *av, "option"); 398ac35ff17SAlexander V. Chernikov ac--; av++; 399ac35ff17SAlexander V. Chernikov 400ac35ff17SAlexander V. Chernikov switch (tcmd) { 4014c0c07a5SAlexander V. Chernikov case TOK_LIMIT: 4024c0c07a5SAlexander V. Chernikov NEED1("limit value required"); 4034c0c07a5SAlexander V. Chernikov xi.limit = strtol(*av, NULL, 10); 4044c0c07a5SAlexander V. Chernikov ac--; av++; 4054c0c07a5SAlexander V. Chernikov break; 406ac35ff17SAlexander V. Chernikov case TOK_TYPE: 407ac35ff17SAlexander V. Chernikov NEED1("table type required"); 408914bffb6SAlexander V. Chernikov /* Type may have suboptions after ':' */ 409914bffb6SAlexander V. Chernikov if ((p = strchr(*av, ':')) != NULL) 410914bffb6SAlexander V. Chernikov *p++ = '\0'; 411ac35ff17SAlexander V. Chernikov val = match_token(tabletypes, *av); 412914bffb6SAlexander V. Chernikov if (val == -1) { 413914bffb6SAlexander V. Chernikov concat_tokens(tbuf, sizeof(tbuf), tabletypes, 414914bffb6SAlexander V. Chernikov ", "); 415914bffb6SAlexander V. Chernikov errx(EX_USAGE, 416914bffb6SAlexander V. Chernikov "Unknown tabletype: %s. Supported: %s", 417ac35ff17SAlexander V. Chernikov *av, tbuf); 418914bffb6SAlexander V. Chernikov } 419914bffb6SAlexander V. Chernikov xi.type = val; 420914bffb6SAlexander V. Chernikov if (p != NULL) { 421914bffb6SAlexander V. Chernikov error = table_parse_type(val, p, &xi.tflags); 422914bffb6SAlexander V. Chernikov if (error != 0) 423914bffb6SAlexander V. Chernikov errx(EX_USAGE, 424914bffb6SAlexander V. Chernikov "Unsupported suboptions: %s", p); 425914bffb6SAlexander V. Chernikov } 426914bffb6SAlexander V. Chernikov ac--; av++; 427ac35ff17SAlexander V. Chernikov break; 428ac35ff17SAlexander V. Chernikov case TOK_VALTYPE: 429ac35ff17SAlexander V. Chernikov NEED1("table value type required"); 4300cba2b28SAlexander V. Chernikov fset = fclear = 0; 4310cba2b28SAlexander V. Chernikov val = fill_flags(tablevaltypes, *av, &e, &fset, &fclear); 432ac35ff17SAlexander V. Chernikov if (val != -1) { 4330cba2b28SAlexander V. Chernikov xi.vmask = fset; 434ac35ff17SAlexander V. Chernikov ac--; av++; 435ac35ff17SAlexander V. Chernikov break; 436ac35ff17SAlexander V. Chernikov } 437ac35ff17SAlexander V. Chernikov concat_tokens(tbuf, sizeof(tbuf), tablevaltypes, ", "); 438ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "Unknown value type: %s. Supported: %s", 4390cba2b28SAlexander V. Chernikov e, tbuf); 440adf3b2b9SAlexander V. Chernikov break; 441ac35ff17SAlexander V. Chernikov case TOK_ALGO: 442ac35ff17SAlexander V. Chernikov NEED1("table algorithm name required"); 443ac35ff17SAlexander V. Chernikov if (strlen(*av) > sizeof(xi.algoname)) 444ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "algorithm name too long"); 445ac35ff17SAlexander V. Chernikov strlcpy(xi.algoname, *av, sizeof(xi.algoname)); 446ac35ff17SAlexander V. Chernikov ac--; av++; 447ac35ff17SAlexander V. Chernikov break; 4484f43138aSAlexander V. Chernikov case TOK_LOCK: 4494f43138aSAlexander V. Chernikov xi.flags |= IPFW_TGFLAGS_LOCKED; 4504f43138aSAlexander V. Chernikov break; 451ac35ff17SAlexander V. Chernikov } 452ac35ff17SAlexander V. Chernikov } 453ac35ff17SAlexander V. Chernikov 454463a577bSEitan Adler /* Set some defaults to preserve compatibility. */ 455fd0869d5SAlexander V. Chernikov if (xi.algoname[0] == '\0' && xi.type == 0) 456c21034b7SAlexander V. Chernikov xi.type = IPFW_TABLE_ADDR; 4570cba2b28SAlexander V. Chernikov if (xi.vmask == 0) 4580cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 459fd0869d5SAlexander V. Chernikov 460ac35ff17SAlexander V. Chernikov if ((error = table_do_create(oh, &xi)) != 0) 461ac35ff17SAlexander V. Chernikov err(EX_OSERR, "Table creation failed"); 462f1220db8SAlexander V. Chernikov } 463f1220db8SAlexander V. Chernikov 464f1220db8SAlexander V. Chernikov /* 465ac35ff17SAlexander V. Chernikov * Creates new table 466ac35ff17SAlexander V. Chernikov * 467ac35ff17SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 468ac35ff17SAlexander V. Chernikov * 469f1220db8SAlexander V. Chernikov * Returns 0 on success. 470f1220db8SAlexander V. Chernikov */ 471f1220db8SAlexander V. Chernikov static int 472ac35ff17SAlexander V. Chernikov table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i) 473f1220db8SAlexander V. Chernikov { 474ac35ff17SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 475ac35ff17SAlexander V. Chernikov int error; 476f1220db8SAlexander V. Chernikov 477ac35ff17SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 478ac35ff17SAlexander V. Chernikov memcpy(tbuf + sizeof(*oh), i, sizeof(*i)); 479ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 480ac35ff17SAlexander V. Chernikov 481ac35ff17SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XCREATE, &oh->opheader, sizeof(tbuf)); 482ac35ff17SAlexander V. Chernikov 483ac35ff17SAlexander V. Chernikov return (error); 484ac35ff17SAlexander V. Chernikov } 485ac35ff17SAlexander V. Chernikov 486ac35ff17SAlexander V. Chernikov /* 487adf3b2b9SAlexander V. Chernikov * Modifies existing table 488adf3b2b9SAlexander V. Chernikov * 4890cba2b28SAlexander V. Chernikov * ipfw table NAME modify [ limit number ] 490adf3b2b9SAlexander V. Chernikov */ 491adf3b2b9SAlexander V. Chernikov static void 492adf3b2b9SAlexander V. Chernikov table_modify(ipfw_obj_header *oh, int ac, char *av[]) 493adf3b2b9SAlexander V. Chernikov { 494adf3b2b9SAlexander V. Chernikov ipfw_xtable_info xi; 495b6462881SAlexander V. Chernikov int tcmd; 496adf3b2b9SAlexander V. Chernikov 497adf3b2b9SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 498adf3b2b9SAlexander V. Chernikov 499adf3b2b9SAlexander V. Chernikov while (ac > 0) { 500be695df9SAlexander V. Chernikov tcmd = get_token(tablenewcmds, *av, "option"); 501adf3b2b9SAlexander V. Chernikov ac--; av++; 502adf3b2b9SAlexander V. Chernikov 503adf3b2b9SAlexander V. Chernikov switch (tcmd) { 504adf3b2b9SAlexander V. Chernikov case TOK_LIMIT: 505adf3b2b9SAlexander V. Chernikov NEED1("limit value required"); 506adf3b2b9SAlexander V. Chernikov xi.limit = strtol(*av, NULL, 10); 507adf3b2b9SAlexander V. Chernikov xi.mflags |= IPFW_TMFLAGS_LIMIT; 508adf3b2b9SAlexander V. Chernikov ac--; av++; 509adf3b2b9SAlexander V. Chernikov break; 5100cba2b28SAlexander V. Chernikov default: 5110cba2b28SAlexander V. Chernikov errx(EX_USAGE, "cmd is not supported for modificatiob"); 512adf3b2b9SAlexander V. Chernikov } 513adf3b2b9SAlexander V. Chernikov } 514adf3b2b9SAlexander V. Chernikov 515b6462881SAlexander V. Chernikov if (table_do_modify(oh, &xi) != 0) 516adf3b2b9SAlexander V. Chernikov err(EX_OSERR, "Table modification failed"); 517adf3b2b9SAlexander V. Chernikov } 518adf3b2b9SAlexander V. Chernikov 519adf3b2b9SAlexander V. Chernikov /* 520adf3b2b9SAlexander V. Chernikov * Modifies existing table. 521adf3b2b9SAlexander V. Chernikov * 522adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 523adf3b2b9SAlexander V. Chernikov * 524adf3b2b9SAlexander V. Chernikov * Returns 0 on success. 525adf3b2b9SAlexander V. Chernikov */ 526adf3b2b9SAlexander V. Chernikov static int 527adf3b2b9SAlexander V. Chernikov table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i) 528adf3b2b9SAlexander V. Chernikov { 529adf3b2b9SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 530adf3b2b9SAlexander V. Chernikov int error; 531adf3b2b9SAlexander V. Chernikov 532adf3b2b9SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 533adf3b2b9SAlexander V. Chernikov memcpy(tbuf + sizeof(*oh), i, sizeof(*i)); 534adf3b2b9SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 535adf3b2b9SAlexander V. Chernikov 536adf3b2b9SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XMODIFY, &oh->opheader, sizeof(tbuf)); 537adf3b2b9SAlexander V. Chernikov 538adf3b2b9SAlexander V. Chernikov return (error); 539adf3b2b9SAlexander V. Chernikov } 5404f43138aSAlexander V. Chernikov 5414f43138aSAlexander V. Chernikov /* 5424f43138aSAlexander V. Chernikov * Locks or unlocks given table 5434f43138aSAlexander V. Chernikov */ 5444f43138aSAlexander V. Chernikov static void 5454f43138aSAlexander V. Chernikov table_lock(ipfw_obj_header *oh, int lock) 5464f43138aSAlexander V. Chernikov { 5474f43138aSAlexander V. Chernikov ipfw_xtable_info xi; 5484f43138aSAlexander V. Chernikov 5494f43138aSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 5504f43138aSAlexander V. Chernikov 5514f43138aSAlexander V. Chernikov xi.mflags |= IPFW_TMFLAGS_LOCK; 5524f43138aSAlexander V. Chernikov xi.flags |= (lock != 0) ? IPFW_TGFLAGS_LOCKED : 0; 5534f43138aSAlexander V. Chernikov 554b6462881SAlexander V. Chernikov if (table_do_modify(oh, &xi) != 0) 5554f43138aSAlexander V. Chernikov err(EX_OSERR, "Table %s failed", lock != 0 ? "lock" : "unlock"); 5564f43138aSAlexander V. Chernikov } 5574f43138aSAlexander V. Chernikov 558adf3b2b9SAlexander V. Chernikov /* 559ac35ff17SAlexander V. Chernikov * Destroys given table specified by @oh->ntlv. 560ac35ff17SAlexander V. Chernikov * Returns 0 on success. 561ac35ff17SAlexander V. Chernikov */ 562ac35ff17SAlexander V. Chernikov static int 563ac35ff17SAlexander V. Chernikov table_destroy(ipfw_obj_header *oh) 564ac35ff17SAlexander V. Chernikov { 565ac35ff17SAlexander V. Chernikov 566ac35ff17SAlexander V. Chernikov if (do_set3(IP_FW_TABLE_XDESTROY, &oh->opheader, sizeof(*oh)) != 0) 567f1220db8SAlexander V. Chernikov return (-1); 568f1220db8SAlexander V. Chernikov 569f1220db8SAlexander V. Chernikov return (0); 570f1220db8SAlexander V. Chernikov } 571f1220db8SAlexander V. Chernikov 572f1220db8SAlexander V. Chernikov /* 573ac35ff17SAlexander V. Chernikov * Flushes given table specified by @oh->ntlv. 574f1220db8SAlexander V. Chernikov * Returns 0 on success. 575f1220db8SAlexander V. Chernikov */ 576f1220db8SAlexander V. Chernikov static int 577ac35ff17SAlexander V. Chernikov table_flush(ipfw_obj_header *oh) 578f1220db8SAlexander V. Chernikov { 579f1220db8SAlexander V. Chernikov 580ac35ff17SAlexander V. Chernikov if (do_set3(IP_FW_TABLE_XFLUSH, &oh->opheader, sizeof(*oh)) != 0) 581f1220db8SAlexander V. Chernikov return (-1); 582f1220db8SAlexander V. Chernikov 583f1220db8SAlexander V. Chernikov return (0); 584f1220db8SAlexander V. Chernikov } 585f1220db8SAlexander V. Chernikov 58646d52008SAlexander V. Chernikov static int 58746d52008SAlexander V. Chernikov table_do_swap(ipfw_obj_header *oh, char *second) 58846d52008SAlexander V. Chernikov { 58946d52008SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ntlv)]; 59046d52008SAlexander V. Chernikov int error; 59146d52008SAlexander V. Chernikov 59246d52008SAlexander V. Chernikov memset(tbuf, 0, sizeof(tbuf)); 59346d52008SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 59446d52008SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 59546d52008SAlexander V. Chernikov table_fill_ntlv((ipfw_obj_ntlv *)(oh + 1), second, oh->ntlv.set, 1); 59646d52008SAlexander V. Chernikov 59746d52008SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XSWAP, &oh->opheader, sizeof(tbuf)); 59846d52008SAlexander V. Chernikov 59946d52008SAlexander V. Chernikov return (error); 60046d52008SAlexander V. Chernikov } 60146d52008SAlexander V. Chernikov 60246d52008SAlexander V. Chernikov /* 60346d52008SAlexander V. Chernikov * Swaps given table with @second one. 60446d52008SAlexander V. Chernikov */ 60546d52008SAlexander V. Chernikov static int 60646d52008SAlexander V. Chernikov table_swap(ipfw_obj_header *oh, char *second) 60746d52008SAlexander V. Chernikov { 60846d52008SAlexander V. Chernikov 60946d52008SAlexander V. Chernikov if (table_check_name(second) != 0) 61046d52008SAlexander V. Chernikov errx(EX_USAGE, "table name %s is invalid", second); 61146d52008SAlexander V. Chernikov 61276d03257SAndrey V. Elsukov if (table_do_swap(oh, second) == 0) 61376d03257SAndrey V. Elsukov return (0); 61446d52008SAlexander V. Chernikov 61576d03257SAndrey V. Elsukov switch (errno) { 61646d52008SAlexander V. Chernikov case EINVAL: 61746d52008SAlexander V. Chernikov errx(EX_USAGE, "Unable to swap table: check types"); 61846d52008SAlexander V. Chernikov case EFBIG: 61946d52008SAlexander V. Chernikov errx(EX_USAGE, "Unable to swap table: check limits"); 62046d52008SAlexander V. Chernikov } 62146d52008SAlexander V. Chernikov 62246d52008SAlexander V. Chernikov return (0); 62346d52008SAlexander V. Chernikov } 62446d52008SAlexander V. Chernikov 62546d52008SAlexander V. Chernikov 626f1220db8SAlexander V. Chernikov /* 627ac35ff17SAlexander V. Chernikov * Retrieves table in given table specified by @oh->ntlv. 628f1220db8SAlexander V. Chernikov * it inside @i. 629f1220db8SAlexander V. Chernikov * Returns 0 on success. 630f1220db8SAlexander V. Chernikov */ 631f1220db8SAlexander V. Chernikov static int 632ac35ff17SAlexander V. Chernikov table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i) 633f1220db8SAlexander V. Chernikov { 634f1220db8SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 635f1220db8SAlexander V. Chernikov size_t sz; 636f1220db8SAlexander V. Chernikov 637f1220db8SAlexander V. Chernikov sz = sizeof(tbuf); 638f1220db8SAlexander V. Chernikov memset(tbuf, 0, sizeof(tbuf)); 639ac35ff17SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 640f1220db8SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 641f1220db8SAlexander V. Chernikov 642b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XINFO, &oh->opheader, &sz) != 0) 643b6462881SAlexander V. Chernikov return (errno); 644f1220db8SAlexander V. Chernikov 645f1220db8SAlexander V. Chernikov if (sz < sizeof(tbuf)) 646ac35ff17SAlexander V. Chernikov return (EINVAL); 647f1220db8SAlexander V. Chernikov 648f1220db8SAlexander V. Chernikov *i = *(ipfw_xtable_info *)(oh + 1); 649f1220db8SAlexander V. Chernikov 650f1220db8SAlexander V. Chernikov return (0); 651f1220db8SAlexander V. Chernikov } 652f1220db8SAlexander V. Chernikov 6535f379342SAlexander V. Chernikov static struct _s_x tablealgoclass[] = { 6545f379342SAlexander V. Chernikov { "hash", IPFW_TACLASS_HASH }, 6555f379342SAlexander V. Chernikov { "array", IPFW_TACLASS_ARRAY }, 6565f379342SAlexander V. Chernikov { "radix", IPFW_TACLASS_RADIX }, 6575f379342SAlexander V. Chernikov { NULL, 0 } 6585f379342SAlexander V. Chernikov }; 6595f379342SAlexander V. Chernikov 6605f379342SAlexander V. Chernikov struct ta_cldata { 6615f379342SAlexander V. Chernikov uint8_t taclass; 6625f379342SAlexander V. Chernikov uint8_t spare4; 6635f379342SAlexander V. Chernikov uint16_t itemsize; 6645f379342SAlexander V. Chernikov uint16_t itemsize6; 6655f379342SAlexander V. Chernikov uint32_t size; 6665f379342SAlexander V. Chernikov uint32_t count; 6675f379342SAlexander V. Chernikov }; 6685f379342SAlexander V. Chernikov 6695f379342SAlexander V. Chernikov /* 6705f379342SAlexander V. Chernikov * Print global/per-AF table @i algorithm info. 6715f379342SAlexander V. Chernikov */ 6725f379342SAlexander V. Chernikov static void 6735f379342SAlexander V. Chernikov table_show_tainfo(ipfw_xtable_info *i, struct ta_cldata *d, 6745f379342SAlexander V. Chernikov const char *af, const char *taclass) 6755f379342SAlexander V. Chernikov { 6765f379342SAlexander V. Chernikov 6775f379342SAlexander V. Chernikov switch (d->taclass) { 6785f379342SAlexander V. Chernikov case IPFW_TACLASS_HASH: 6795f379342SAlexander V. Chernikov case IPFW_TACLASS_ARRAY: 6805f379342SAlexander V. Chernikov printf(" %salgorithm %s info\n", af, taclass); 6815f379342SAlexander V. Chernikov if (d->itemsize == d->itemsize6) 6825f379342SAlexander V. Chernikov printf(" size: %u items: %u itemsize: %u\n", 6835f379342SAlexander V. Chernikov d->size, d->count, d->itemsize); 6845f379342SAlexander V. Chernikov else 6855f379342SAlexander V. Chernikov printf(" size: %u items: %u " 6865f379342SAlexander V. Chernikov "itemsize4: %u itemsize6: %u\n", 6875f379342SAlexander V. Chernikov d->size, d->count, 6885f379342SAlexander V. Chernikov d->itemsize, d->itemsize6); 6895f379342SAlexander V. Chernikov break; 6905f379342SAlexander V. Chernikov case IPFW_TACLASS_RADIX: 6915f379342SAlexander V. Chernikov printf(" %salgorithm %s info\n", af, taclass); 6925f379342SAlexander V. Chernikov if (d->itemsize == d->itemsize6) 6935f379342SAlexander V. Chernikov printf(" items: %u itemsize: %u\n", 6945f379342SAlexander V. Chernikov d->count, d->itemsize); 6955f379342SAlexander V. Chernikov else 6965f379342SAlexander V. Chernikov printf(" items: %u " 6975f379342SAlexander V. Chernikov "itemsize4: %u itemsize6: %u\n", 6985f379342SAlexander V. Chernikov d->count, d->itemsize, d->itemsize6); 6995f379342SAlexander V. Chernikov break; 7005f379342SAlexander V. Chernikov default: 7015f379342SAlexander V. Chernikov printf(" algo class: %s\n", taclass); 7025f379342SAlexander V. Chernikov } 7035f379342SAlexander V. Chernikov } 7045f379342SAlexander V. Chernikov 7050cba2b28SAlexander V. Chernikov static void 7060cba2b28SAlexander V. Chernikov table_print_valheader(char *buf, size_t bufsize, uint32_t vmask) 7070cba2b28SAlexander V. Chernikov { 7080cba2b28SAlexander V. Chernikov 7090cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 7100cba2b28SAlexander V. Chernikov snprintf(buf, bufsize, "legacy"); 7110cba2b28SAlexander V. Chernikov return; 7120cba2b28SAlexander V. Chernikov } 7130cba2b28SAlexander V. Chernikov 7148a6dbb64SAlexander V. Chernikov memset(buf, 0, bufsize); 7150cba2b28SAlexander V. Chernikov print_flags_buffer(buf, bufsize, tablevaltypes, vmask); 7160cba2b28SAlexander V. Chernikov } 7170cba2b28SAlexander V. Chernikov 718f1220db8SAlexander V. Chernikov /* 719f1220db8SAlexander V. Chernikov * Prints table info struct @i in human-readable form. 720f1220db8SAlexander V. Chernikov */ 721f1220db8SAlexander V. Chernikov static int 722f1220db8SAlexander V. Chernikov table_show_info(ipfw_xtable_info *i, void *arg) 723f1220db8SAlexander V. Chernikov { 7240cba2b28SAlexander V. Chernikov const char *vtype; 7255f379342SAlexander V. Chernikov ipfw_ta_tinfo *tainfo; 7265f379342SAlexander V. Chernikov int afdata, afitem; 7275f379342SAlexander V. Chernikov struct ta_cldata d; 728adf3b2b9SAlexander V. Chernikov char ttype[64], tvtype[64]; 729f1220db8SAlexander V. Chernikov 730914bffb6SAlexander V. Chernikov table_print_type(ttype, sizeof(ttype), i->type, i->tflags); 7310cba2b28SAlexander V. Chernikov table_print_valheader(tvtype, sizeof(tvtype), i->vmask); 732ac35ff17SAlexander V. Chernikov 733914bffb6SAlexander V. Chernikov printf("--- table(%s), set(%u) ---\n", i->tablename, i->set); 7344f43138aSAlexander V. Chernikov if ((i->flags & IPFW_TGFLAGS_LOCKED) != 0) 7354f43138aSAlexander V. Chernikov printf(" kindex: %d, type: %s, locked\n", i->kidx, ttype); 7364f43138aSAlexander V. Chernikov else 737914bffb6SAlexander V. Chernikov printf(" kindex: %d, type: %s\n", i->kidx, ttype); 7380cba2b28SAlexander V. Chernikov printf(" references: %u, valtype: %s\n", i->refcnt, tvtype); 7399d099b4fSAlexander V. Chernikov printf(" algorithm: %s\n", i->algoname); 740f1220db8SAlexander V. Chernikov printf(" items: %u, size: %u\n", i->count, i->size); 7414c0c07a5SAlexander V. Chernikov if (i->limit > 0) 7424c0c07a5SAlexander V. Chernikov printf(" limit: %u\n", i->limit); 743f1220db8SAlexander V. Chernikov 744358b9d09SAlexander V. Chernikov /* Print algo-specific info if requested & set */ 745358b9d09SAlexander V. Chernikov if (arg == NULL) 746358b9d09SAlexander V. Chernikov return (0); 747358b9d09SAlexander V. Chernikov 7485f379342SAlexander V. Chernikov if ((i->ta_info.flags & IPFW_TATFLAGS_DATA) == 0) 7495f379342SAlexander V. Chernikov return (0); 7505f379342SAlexander V. Chernikov tainfo = &i->ta_info; 7515f379342SAlexander V. Chernikov 7525f379342SAlexander V. Chernikov afdata = 0; 7535f379342SAlexander V. Chernikov afitem = 0; 7545f379342SAlexander V. Chernikov if (tainfo->flags & IPFW_TATFLAGS_AFDATA) 7555f379342SAlexander V. Chernikov afdata = 1; 7565f379342SAlexander V. Chernikov if (tainfo->flags & IPFW_TATFLAGS_AFITEM) 7575f379342SAlexander V. Chernikov afitem = 1; 7585f379342SAlexander V. Chernikov 7595f379342SAlexander V. Chernikov memset(&d, 0, sizeof(d)); 7605f379342SAlexander V. Chernikov d.taclass = tainfo->taclass4; 7615f379342SAlexander V. Chernikov d.size = tainfo->size4; 7625f379342SAlexander V. Chernikov d.count = tainfo->count4; 7635f379342SAlexander V. Chernikov d.itemsize = tainfo->itemsize4; 7645f379342SAlexander V. Chernikov if (afdata == 0 && afitem != 0) 7655f379342SAlexander V. Chernikov d.itemsize6 = tainfo->itemsize6; 7665f379342SAlexander V. Chernikov else 7675f379342SAlexander V. Chernikov d.itemsize6 = d.itemsize; 7685f379342SAlexander V. Chernikov if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL) 7695f379342SAlexander V. Chernikov vtype = "unknown"; 7705f379342SAlexander V. Chernikov 7715f379342SAlexander V. Chernikov if (afdata == 0) { 7725f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "", vtype); 7735f379342SAlexander V. Chernikov } else { 7745f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "IPv4 ", vtype); 7755f379342SAlexander V. Chernikov memset(&d, 0, sizeof(d)); 7765f379342SAlexander V. Chernikov d.taclass = tainfo->taclass6; 7775f379342SAlexander V. Chernikov if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL) 7785f379342SAlexander V. Chernikov vtype = "unknown"; 7795f379342SAlexander V. Chernikov d.size = tainfo->size6; 7805f379342SAlexander V. Chernikov d.count = tainfo->count6; 7815f379342SAlexander V. Chernikov d.itemsize = tainfo->itemsize6; 7825f379342SAlexander V. Chernikov d.itemsize6 = d.itemsize; 7835f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "IPv6 ", vtype); 7845f379342SAlexander V. Chernikov } 7855f379342SAlexander V. Chernikov 786f1220db8SAlexander V. Chernikov return (0); 787f1220db8SAlexander V. Chernikov } 788f1220db8SAlexander V. Chernikov 789f1220db8SAlexander V. Chernikov 790f1220db8SAlexander V. Chernikov /* 791f1220db8SAlexander V. Chernikov * Function wrappers which can be used either 792f1220db8SAlexander V. Chernikov * as is or as foreach function parameter. 793f1220db8SAlexander V. Chernikov */ 794f1220db8SAlexander V. Chernikov 795f1220db8SAlexander V. Chernikov static int 796f1220db8SAlexander V. Chernikov table_show_one(ipfw_xtable_info *i, void *arg) 797f1220db8SAlexander V. Chernikov { 798f1220db8SAlexander V. Chernikov ipfw_obj_header *oh; 79981d3153dSAlexander V. Chernikov int error; 800f1220db8SAlexander V. Chernikov 801720ee730SAlexander V. Chernikov if ((error = table_do_get_list(i, &oh)) != 0) { 80281d3153dSAlexander V. Chernikov err(EX_OSERR, "Error requesting table %s list", i->tablename); 80381d3153dSAlexander V. Chernikov return (error); 80481d3153dSAlexander V. Chernikov } 80581d3153dSAlexander V. Chernikov 806f1220db8SAlexander V. Chernikov table_show_list(oh, 1); 807f1220db8SAlexander V. Chernikov 808f1220db8SAlexander V. Chernikov free(oh); 809f1220db8SAlexander V. Chernikov return (0); 810f1220db8SAlexander V. Chernikov } 811f1220db8SAlexander V. Chernikov 812f1220db8SAlexander V. Chernikov static int 813f1220db8SAlexander V. Chernikov table_flush_one(ipfw_xtable_info *i, void *arg) 814f1220db8SAlexander V. Chernikov { 815ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 816f1220db8SAlexander V. Chernikov 817ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)arg; 818ac35ff17SAlexander V. Chernikov 819ac35ff17SAlexander V. Chernikov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 820ac35ff17SAlexander V. Chernikov 821ac35ff17SAlexander V. Chernikov return (table_flush(oh)); 822f1220db8SAlexander V. Chernikov } 823f1220db8SAlexander V. Chernikov 824ac35ff17SAlexander V. Chernikov static int 825ac35ff17SAlexander V. Chernikov table_do_modify_record(int cmd, ipfw_obj_header *oh, 8263a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, int count, int atomic) 827ac35ff17SAlexander V. Chernikov { 828db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 8293a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent_base; 8303a845e10SAlexander V. Chernikov caddr_t pbuf; 831db785d31SAlexander V. Chernikov char xbuf[sizeof(*oh) + sizeof(ipfw_obj_ctlv) + sizeof(*tent)]; 8323a845e10SAlexander V. Chernikov int error, i; 8333a845e10SAlexander V. Chernikov size_t sz; 834ac35ff17SAlexander V. Chernikov 8353a845e10SAlexander V. Chernikov sz = sizeof(*ctlv) + sizeof(*tent) * count; 8363a845e10SAlexander V. Chernikov if (count == 1) { 837ac35ff17SAlexander V. Chernikov memset(xbuf, 0, sizeof(xbuf)); 8383a845e10SAlexander V. Chernikov pbuf = xbuf; 8393a845e10SAlexander V. Chernikov } else { 8403a845e10SAlexander V. Chernikov if ((pbuf = calloc(1, sizeof(*oh) + sz)) == NULL) 8413a845e10SAlexander V. Chernikov return (ENOMEM); 8423a845e10SAlexander V. Chernikov } 8433a845e10SAlexander V. Chernikov 8443a845e10SAlexander V. Chernikov memcpy(pbuf, oh, sizeof(*oh)); 8453a845e10SAlexander V. Chernikov oh = (ipfw_obj_header *)pbuf; 846ac35ff17SAlexander V. Chernikov oh->opheader.version = 1; 847ac35ff17SAlexander V. Chernikov 848db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 8493a845e10SAlexander V. Chernikov ctlv->count = count; 8503a845e10SAlexander V. Chernikov ctlv->head.length = sz; 8513a845e10SAlexander V. Chernikov if (atomic != 0) 8523a845e10SAlexander V. Chernikov ctlv->flags |= IPFW_CTF_ATOMIC; 853db785d31SAlexander V. Chernikov 8543a845e10SAlexander V. Chernikov tent_base = tent; 8553a845e10SAlexander V. Chernikov memcpy(ctlv + 1, tent, sizeof(*tent) * count); 856db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 8573a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, tent++) { 858ac35ff17SAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 8593a845e10SAlexander V. Chernikov tent->idx = oh->idx; 8603a845e10SAlexander V. Chernikov } 861ac35ff17SAlexander V. Chernikov 8623a845e10SAlexander V. Chernikov sz += sizeof(*oh); 8633a845e10SAlexander V. Chernikov error = do_get3(cmd, &oh->opheader, &sz); 8643a845e10SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 8653a845e10SAlexander V. Chernikov /* Copy result back to provided buffer */ 8663a845e10SAlexander V. Chernikov memcpy(tent_base, ctlv + 1, sizeof(*tent) * count); 8673a845e10SAlexander V. Chernikov 8683a845e10SAlexander V. Chernikov if (pbuf != xbuf) 8693a845e10SAlexander V. Chernikov free(pbuf); 870ac35ff17SAlexander V. Chernikov 871ac35ff17SAlexander V. Chernikov return (error); 872ac35ff17SAlexander V. Chernikov } 873ac35ff17SAlexander V. Chernikov 874ac35ff17SAlexander V. Chernikov static void 8753a845e10SAlexander V. Chernikov table_modify_record(ipfw_obj_header *oh, int ac, char *av[], int add, 8763a845e10SAlexander V. Chernikov int quiet, int update, int atomic) 877ac35ff17SAlexander V. Chernikov { 8783a845e10SAlexander V. Chernikov ipfw_obj_tentry *ptent, tent, *tent_buf; 87981d3153dSAlexander V. Chernikov ipfw_xtable_info xi; 8800cba2b28SAlexander V. Chernikov uint8_t type; 8810cba2b28SAlexander V. Chernikov uint32_t vmask; 8823a845e10SAlexander V. Chernikov int cmd, count, error, i, ignored; 8833a845e10SAlexander V. Chernikov char *texterr, *etxt, *px; 884ac35ff17SAlexander V. Chernikov 885ac35ff17SAlexander V. Chernikov if (ac == 0) 886ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "address required"); 887ac35ff17SAlexander V. Chernikov 888ac35ff17SAlexander V. Chernikov if (add != 0) { 889ac35ff17SAlexander V. Chernikov cmd = IP_FW_TABLE_XADD; 8904c0c07a5SAlexander V. Chernikov texterr = "Adding record failed"; 891ac35ff17SAlexander V. Chernikov } else { 892ac35ff17SAlexander V. Chernikov cmd = IP_FW_TABLE_XDEL; 8934c0c07a5SAlexander V. Chernikov texterr = "Deleting record failed"; 894ac35ff17SAlexander V. Chernikov } 895ac35ff17SAlexander V. Chernikov 8963a845e10SAlexander V. Chernikov /* 8973a845e10SAlexander V. Chernikov * Calculate number of entries: 8983a845e10SAlexander V. Chernikov * Assume [key val] x N for add 8993a845e10SAlexander V. Chernikov * and 9003a845e10SAlexander V. Chernikov * key x N for delete 9013a845e10SAlexander V. Chernikov */ 9023a845e10SAlexander V. Chernikov count = (add != 0) ? ac / 2 + 1 : ac; 9033a845e10SAlexander V. Chernikov 9043a845e10SAlexander V. Chernikov if (count <= 1) { 9053a845e10SAlexander V. Chernikov /* Adding single entry with/without value */ 9063a845e10SAlexander V. Chernikov memset(&tent, 0, sizeof(tent)); 9073a845e10SAlexander V. Chernikov tent_buf = &tent; 9083a845e10SAlexander V. Chernikov } else { 9093a845e10SAlexander V. Chernikov 9103a845e10SAlexander V. Chernikov if ((tent_buf = calloc(count, sizeof(tent))) == NULL) 9113a845e10SAlexander V. Chernikov errx(EX_OSERR, 9123a845e10SAlexander V. Chernikov "Unable to allocate memory for all entries"); 9133a845e10SAlexander V. Chernikov } 9143a845e10SAlexander V. Chernikov ptent = tent_buf; 9153a845e10SAlexander V. Chernikov 9163a845e10SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 9173a845e10SAlexander V. Chernikov count = 0; 9183a845e10SAlexander V. Chernikov while (ac > 0) { 9190cba2b28SAlexander V. Chernikov tentry_fill_key(oh, ptent, *av, add, &type, &vmask, &xi); 9203a845e10SAlexander V. Chernikov 9213a845e10SAlexander V. Chernikov /* 922463a577bSEitan Adler * Compatibility layer: auto-create table if not exists. 9233a845e10SAlexander V. Chernikov */ 9243a845e10SAlexander V. Chernikov if (xi.tablename[0] == '\0') { 9253a845e10SAlexander V. Chernikov xi.type = type; 9260cba2b28SAlexander V. Chernikov xi.vmask = vmask; 9273a845e10SAlexander V. Chernikov strlcpy(xi.tablename, oh->ntlv.name, 9283a845e10SAlexander V. Chernikov sizeof(xi.tablename)); 929e62cd31fSAndrey V. Elsukov if (quiet == 0) 930e62cd31fSAndrey V. Elsukov warnx("DEPRECATED: inserting data into " 931e62cd31fSAndrey V. Elsukov "non-existent table %s. (auto-created)", 9323a845e10SAlexander V. Chernikov xi.tablename); 9333a845e10SAlexander V. Chernikov table_do_create(oh, &xi); 9343a845e10SAlexander V. Chernikov } 9353a845e10SAlexander V. Chernikov 9363a845e10SAlexander V. Chernikov oh->ntlv.type = type; 9373a845e10SAlexander V. Chernikov ac--; av++; 9383a845e10SAlexander V. Chernikov 9393a845e10SAlexander V. Chernikov if (add != 0 && ac > 0) { 9400cba2b28SAlexander V. Chernikov tentry_fill_value(oh, ptent, *av, type, vmask); 9413a845e10SAlexander V. Chernikov ac--; av++; 9423a845e10SAlexander V. Chernikov } 9433a845e10SAlexander V. Chernikov 9443a845e10SAlexander V. Chernikov if (update != 0) 9453a845e10SAlexander V. Chernikov ptent->head.flags |= IPFW_TF_UPDATE; 9463a845e10SAlexander V. Chernikov 9473a845e10SAlexander V. Chernikov count++; 9483a845e10SAlexander V. Chernikov ptent++; 9493a845e10SAlexander V. Chernikov } 9503a845e10SAlexander V. Chernikov 9513a845e10SAlexander V. Chernikov error = table_do_modify_record(cmd, oh, tent_buf, count, atomic); 9523a845e10SAlexander V. Chernikov 9533a845e10SAlexander V. Chernikov /* 9543a845e10SAlexander V. Chernikov * Compatibility stuff: do not yell on duplicate keys or 9553a845e10SAlexander V. Chernikov * failed deletions. 9563a845e10SAlexander V. Chernikov */ 9573a845e10SAlexander V. Chernikov if (error == 0 || (error == EEXIST && add != 0) || 9583a845e10SAlexander V. Chernikov (error == ENOENT && add == 0)) { 9593a845e10SAlexander V. Chernikov if (quiet != 0) { 9603a845e10SAlexander V. Chernikov if (tent_buf != &tent) 9613a845e10SAlexander V. Chernikov free(tent_buf); 9623a845e10SAlexander V. Chernikov return; 9633a845e10SAlexander V. Chernikov } 9643a845e10SAlexander V. Chernikov } 9653a845e10SAlexander V. Chernikov 9663a845e10SAlexander V. Chernikov /* Report results back */ 9673a845e10SAlexander V. Chernikov ptent = tent_buf; 9683a845e10SAlexander V. Chernikov for (i = 0; i < count; ptent++, i++) { 9693a845e10SAlexander V. Chernikov ignored = 0; 9703a845e10SAlexander V. Chernikov switch (ptent->result) { 9713a845e10SAlexander V. Chernikov case IPFW_TR_ADDED: 9723a845e10SAlexander V. Chernikov px = "added"; 9733a845e10SAlexander V. Chernikov break; 9743a845e10SAlexander V. Chernikov case IPFW_TR_DELETED: 9753a845e10SAlexander V. Chernikov px = "deleted"; 9763a845e10SAlexander V. Chernikov break; 9773a845e10SAlexander V. Chernikov case IPFW_TR_UPDATED: 9783a845e10SAlexander V. Chernikov px = "updated"; 9793a845e10SAlexander V. Chernikov break; 9803a845e10SAlexander V. Chernikov case IPFW_TR_LIMIT: 9813a845e10SAlexander V. Chernikov px = "limit"; 9823a845e10SAlexander V. Chernikov ignored = 1; 9833a845e10SAlexander V. Chernikov break; 9843a845e10SAlexander V. Chernikov case IPFW_TR_ERROR: 9853a845e10SAlexander V. Chernikov px = "error"; 9863a845e10SAlexander V. Chernikov ignored = 1; 9873a845e10SAlexander V. Chernikov break; 9883a845e10SAlexander V. Chernikov case IPFW_TR_NOTFOUND: 9893a845e10SAlexander V. Chernikov px = "notfound"; 9903a845e10SAlexander V. Chernikov ignored = 1; 9913a845e10SAlexander V. Chernikov break; 9923a845e10SAlexander V. Chernikov case IPFW_TR_EXISTS: 9933a845e10SAlexander V. Chernikov px = "exists"; 9943a845e10SAlexander V. Chernikov ignored = 1; 9953a845e10SAlexander V. Chernikov break; 9963a845e10SAlexander V. Chernikov case IPFW_TR_IGNORED: 9973a845e10SAlexander V. Chernikov px = "ignored"; 9983a845e10SAlexander V. Chernikov ignored = 1; 9993a845e10SAlexander V. Chernikov break; 10003a845e10SAlexander V. Chernikov default: 10013a845e10SAlexander V. Chernikov px = "unknown"; 10023a845e10SAlexander V. Chernikov ignored = 1; 10033a845e10SAlexander V. Chernikov } 10043a845e10SAlexander V. Chernikov 10053a845e10SAlexander V. Chernikov if (error != 0 && atomic != 0 && ignored == 0) 10063a845e10SAlexander V. Chernikov printf("%s(reverted): ", px); 10073a845e10SAlexander V. Chernikov else 10083a845e10SAlexander V. Chernikov printf("%s: ", px); 10093a845e10SAlexander V. Chernikov 10103a845e10SAlexander V. Chernikov table_show_entry(&xi, ptent); 10113a845e10SAlexander V. Chernikov } 10123a845e10SAlexander V. Chernikov 10133a845e10SAlexander V. Chernikov if (tent_buf != &tent) 10143a845e10SAlexander V. Chernikov free(tent_buf); 10153a845e10SAlexander V. Chernikov 10163a845e10SAlexander V. Chernikov if (error == 0) 10174c0c07a5SAlexander V. Chernikov return; 101868bde59eSAlexander V. Chernikov /* Get real OS error */ 101968bde59eSAlexander V. Chernikov error = errno; 10204c0c07a5SAlexander V. Chernikov 10214c0c07a5SAlexander V. Chernikov /* Try to provide more human-readable error */ 10224c0c07a5SAlexander V. Chernikov switch (error) { 10234c0c07a5SAlexander V. Chernikov case EEXIST: 10244c0c07a5SAlexander V. Chernikov etxt = "record already exists"; 10254c0c07a5SAlexander V. Chernikov break; 10264c0c07a5SAlexander V. Chernikov case EFBIG: 10274c0c07a5SAlexander V. Chernikov etxt = "limit hit"; 10284c0c07a5SAlexander V. Chernikov break; 10294c0c07a5SAlexander V. Chernikov case ESRCH: 10304c0c07a5SAlexander V. Chernikov etxt = "table not found"; 10314c0c07a5SAlexander V. Chernikov break; 10324c0c07a5SAlexander V. Chernikov case ENOENT: 10334c0c07a5SAlexander V. Chernikov etxt = "record not found"; 10344c0c07a5SAlexander V. Chernikov break; 10354f43138aSAlexander V. Chernikov case EACCES: 10364f43138aSAlexander V. Chernikov etxt = "table is locked"; 10374f43138aSAlexander V. Chernikov break; 10384c0c07a5SAlexander V. Chernikov default: 10394c0c07a5SAlexander V. Chernikov etxt = strerror(error); 10404c0c07a5SAlexander V. Chernikov } 10414c0c07a5SAlexander V. Chernikov 10424c0c07a5SAlexander V. Chernikov errx(EX_OSERR, "%s: %s", texterr, etxt); 1043ac35ff17SAlexander V. Chernikov } 1044ac35ff17SAlexander V. Chernikov 104581d3153dSAlexander V. Chernikov static int 104681d3153dSAlexander V. Chernikov table_do_lookup(ipfw_obj_header *oh, char *key, ipfw_xtable_info *xi, 104781d3153dSAlexander V. Chernikov ipfw_obj_tentry *xtent) 104881d3153dSAlexander V. Chernikov { 104981d3153dSAlexander V. Chernikov char xbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_tentry)]; 105081d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 10510cba2b28SAlexander V. Chernikov uint8_t type; 10520cba2b28SAlexander V. Chernikov uint32_t vmask; 105381d3153dSAlexander V. Chernikov size_t sz; 105481d3153dSAlexander V. Chernikov 105581d3153dSAlexander V. Chernikov memcpy(xbuf, oh, sizeof(*oh)); 105681d3153dSAlexander V. Chernikov oh = (ipfw_obj_header *)xbuf; 105781d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 105881d3153dSAlexander V. Chernikov 105981d3153dSAlexander V. Chernikov memset(tent, 0, sizeof(*tent)); 106081d3153dSAlexander V. Chernikov tent->head.length = sizeof(*tent); 106181d3153dSAlexander V. Chernikov tent->idx = 1; 106281d3153dSAlexander V. Chernikov 10630cba2b28SAlexander V. Chernikov tentry_fill_key(oh, tent, key, 0, &type, &vmask, xi); 106481d3153dSAlexander V. Chernikov oh->ntlv.type = type; 106581d3153dSAlexander V. Chernikov 106681d3153dSAlexander V. Chernikov sz = sizeof(xbuf); 1067b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XFIND, &oh->opheader, &sz) != 0) 1068b6462881SAlexander V. Chernikov return (errno); 106981d3153dSAlexander V. Chernikov 107081d3153dSAlexander V. Chernikov if (sz < sizeof(xbuf)) 107181d3153dSAlexander V. Chernikov return (EINVAL); 107281d3153dSAlexander V. Chernikov 107381d3153dSAlexander V. Chernikov *xtent = *tent; 107481d3153dSAlexander V. Chernikov 107581d3153dSAlexander V. Chernikov return (0); 107681d3153dSAlexander V. Chernikov } 107781d3153dSAlexander V. Chernikov 107881d3153dSAlexander V. Chernikov static void 107981d3153dSAlexander V. Chernikov table_lookup(ipfw_obj_header *oh, int ac, char *av[]) 108081d3153dSAlexander V. Chernikov { 108181d3153dSAlexander V. Chernikov ipfw_obj_tentry xtent; 108281d3153dSAlexander V. Chernikov ipfw_xtable_info xi; 1083914bffb6SAlexander V. Chernikov char key[64]; 108481d3153dSAlexander V. Chernikov int error; 108581d3153dSAlexander V. Chernikov 108681d3153dSAlexander V. Chernikov if (ac == 0) 108781d3153dSAlexander V. Chernikov errx(EX_USAGE, "address required"); 108881d3153dSAlexander V. Chernikov 1089914bffb6SAlexander V. Chernikov strlcpy(key, *av, sizeof(key)); 1090914bffb6SAlexander V. Chernikov 10913a845e10SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 1092914bffb6SAlexander V. Chernikov error = table_do_lookup(oh, key, &xi, &xtent); 109381d3153dSAlexander V. Chernikov 109481d3153dSAlexander V. Chernikov switch (error) { 109581d3153dSAlexander V. Chernikov case 0: 109681d3153dSAlexander V. Chernikov break; 109781d3153dSAlexander V. Chernikov case ESRCH: 109881d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Table %s not found", oh->ntlv.name); 109981d3153dSAlexander V. Chernikov case ENOENT: 110081d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Entry %s not found", *av); 110181d3153dSAlexander V. Chernikov case ENOTSUP: 110281d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Table %s algo does not support " 110381d3153dSAlexander V. Chernikov "\"lookup\" method", oh->ntlv.name); 110481d3153dSAlexander V. Chernikov default: 110581d3153dSAlexander V. Chernikov err(EX_OSERR, "getsockopt(IP_FW_TABLE_XFIND)"); 110681d3153dSAlexander V. Chernikov } 110781d3153dSAlexander V. Chernikov 110881d3153dSAlexander V. Chernikov table_show_entry(&xi, &xtent); 110981d3153dSAlexander V. Chernikov } 1110ac35ff17SAlexander V. Chernikov 1111ac35ff17SAlexander V. Chernikov static void 1112914bffb6SAlexander V. Chernikov tentry_fill_key_type(char *arg, ipfw_obj_tentry *tentry, uint8_t type, 1113914bffb6SAlexander V. Chernikov uint8_t tflags) 1114ac35ff17SAlexander V. Chernikov { 1115914bffb6SAlexander V. Chernikov char *p, *pp; 1116ac35ff17SAlexander V. Chernikov int mask, af; 1117914bffb6SAlexander V. Chernikov struct in6_addr *paddr, tmp; 1118914bffb6SAlexander V. Chernikov struct tflow_entry *tfe; 1119ac35ff17SAlexander V. Chernikov uint32_t key, *pkey; 1120914bffb6SAlexander V. Chernikov uint16_t port; 1121914bffb6SAlexander V. Chernikov struct protoent *pent; 1122914bffb6SAlexander V. Chernikov struct servent *sent; 1123ac35ff17SAlexander V. Chernikov int masklen; 1124ac35ff17SAlexander V. Chernikov 1125ac35ff17SAlexander V. Chernikov masklen = 0; 1126ac35ff17SAlexander V. Chernikov af = 0; 1127ac35ff17SAlexander V. Chernikov paddr = (struct in6_addr *)&tentry->k; 1128ac35ff17SAlexander V. Chernikov 1129ac35ff17SAlexander V. Chernikov switch (type) { 1130c21034b7SAlexander V. Chernikov case IPFW_TABLE_ADDR: 1131ac35ff17SAlexander V. Chernikov /* Remove / if exists */ 1132ac35ff17SAlexander V. Chernikov if ((p = strchr(arg, '/')) != NULL) { 1133ac35ff17SAlexander V. Chernikov *p = '\0'; 1134ac35ff17SAlexander V. Chernikov mask = atoi(p + 1); 1135ac35ff17SAlexander V. Chernikov } 1136ac35ff17SAlexander V. Chernikov 1137ac35ff17SAlexander V. Chernikov if (inet_pton(AF_INET, arg, paddr) == 1) { 1138ac35ff17SAlexander V. Chernikov if (p != NULL && mask > 32) 1139ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "bad IPv4 mask width: %s", 1140ac35ff17SAlexander V. Chernikov p + 1); 1141ac35ff17SAlexander V. Chernikov 1142ac35ff17SAlexander V. Chernikov masklen = p ? mask : 32; 1143ac35ff17SAlexander V. Chernikov af = AF_INET; 1144ac35ff17SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, paddr) == 1) { 1145ac35ff17SAlexander V. Chernikov if (IN6_IS_ADDR_V4COMPAT(paddr)) 1146ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, 1147ac35ff17SAlexander V. Chernikov "Use IPv4 instead of v4-compatible"); 1148ac35ff17SAlexander V. Chernikov if (p != NULL && mask > 128) 1149ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "bad IPv6 mask width: %s", 1150ac35ff17SAlexander V. Chernikov p + 1); 1151ac35ff17SAlexander V. Chernikov 1152ac35ff17SAlexander V. Chernikov masklen = p ? mask : 128; 1153ac35ff17SAlexander V. Chernikov af = AF_INET6; 1154ac35ff17SAlexander V. Chernikov } else { 1155ac35ff17SAlexander V. Chernikov /* Assume FQDN */ 1156ac35ff17SAlexander V. Chernikov if (lookup_host(arg, (struct in_addr *)paddr) != 0) 1157ac35ff17SAlexander V. Chernikov errx(EX_NOHOST, "hostname ``%s'' unknown", arg); 1158ac35ff17SAlexander V. Chernikov 1159ac35ff17SAlexander V. Chernikov masklen = 32; 1160c21034b7SAlexander V. Chernikov type = IPFW_TABLE_ADDR; 1161ac35ff17SAlexander V. Chernikov af = AF_INET; 1162ac35ff17SAlexander V. Chernikov } 1163ac35ff17SAlexander V. Chernikov break; 1164ac35ff17SAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 1165ac35ff17SAlexander V. Chernikov /* Assume interface name. Copy significant data only */ 1166ac35ff17SAlexander V. Chernikov mask = MIN(strlen(arg), IF_NAMESIZE - 1); 1167ac35ff17SAlexander V. Chernikov memcpy(paddr, arg, mask); 1168ac35ff17SAlexander V. Chernikov /* Set mask to exact match */ 1169ac35ff17SAlexander V. Chernikov masklen = 8 * IF_NAMESIZE; 1170ac35ff17SAlexander V. Chernikov break; 1171b23d5de9SAlexander V. Chernikov case IPFW_TABLE_NUMBER: 1172ac35ff17SAlexander V. Chernikov /* Port or any other key */ 1173ac35ff17SAlexander V. Chernikov key = strtol(arg, &p, 10); 1174ac35ff17SAlexander V. Chernikov if (*p != '\0') 1175ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "Invalid number: %s", arg); 1176ac35ff17SAlexander V. Chernikov 1177ac35ff17SAlexander V. Chernikov pkey = (uint32_t *)paddr; 1178ac35ff17SAlexander V. Chernikov *pkey = key; 1179ac35ff17SAlexander V. Chernikov masklen = 32; 1180ac35ff17SAlexander V. Chernikov break; 1181914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 1182914bffb6SAlexander V. Chernikov /* Assume [src-ip][,proto][,src-port][,dst-ip][,dst-port] */ 1183914bffb6SAlexander V. Chernikov tfe = &tentry->k.flow; 1184914bffb6SAlexander V. Chernikov af = 0; 1185914bffb6SAlexander V. Chernikov 1186914bffb6SAlexander V. Chernikov /* Handle <ipv4|ipv6> */ 1187914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_SRCIP) != 0) { 1188914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1189914bffb6SAlexander V. Chernikov *p++ = '\0'; 1190914bffb6SAlexander V. Chernikov /* Determine family using temporary storage */ 1191914bffb6SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &tmp) == 1) { 1192914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET) 1193914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1194914bffb6SAlexander V. Chernikov "Inconsistent address family\n"); 1195914bffb6SAlexander V. Chernikov af = AF_INET; 1196914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a4.sip, &tmp, 4); 1197914bffb6SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, &tmp) == 1) { 1198914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET6) 1199914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1200914bffb6SAlexander V. Chernikov "Inconsistent address family\n"); 1201914bffb6SAlexander V. Chernikov af = AF_INET6; 1202914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a6.sip6, &tmp, 16); 1203914bffb6SAlexander V. Chernikov } 1204914bffb6SAlexander V. Chernikov 1205914bffb6SAlexander V. Chernikov arg = p; 1206914bffb6SAlexander V. Chernikov } 1207914bffb6SAlexander V. Chernikov 1208914bffb6SAlexander V. Chernikov /* Handle <proto-num|proto-name> */ 1209914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_PROTO) != 0) { 121035df97d0SAlexander V. Chernikov if (arg == NULL) 121135df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: proto missing"); 1212914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1213914bffb6SAlexander V. Chernikov *p++ = '\0'; 1214914bffb6SAlexander V. Chernikov 1215914bffb6SAlexander V. Chernikov key = strtol(arg, &pp, 10); 1216914bffb6SAlexander V. Chernikov if (*pp != '\0') { 1217914bffb6SAlexander V. Chernikov if ((pent = getprotobyname(arg)) == NULL) 1218914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown proto: %s", 1219914bffb6SAlexander V. Chernikov arg); 1220914bffb6SAlexander V. Chernikov else 1221914bffb6SAlexander V. Chernikov key = pent->p_proto; 1222914bffb6SAlexander V. Chernikov } 1223914bffb6SAlexander V. Chernikov 1224914bffb6SAlexander V. Chernikov if (key > 255) 1225914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Bad protocol number: %u",key); 1226914bffb6SAlexander V. Chernikov 1227914bffb6SAlexander V. Chernikov tfe->proto = key; 1228914bffb6SAlexander V. Chernikov 1229914bffb6SAlexander V. Chernikov arg = p; 1230914bffb6SAlexander V. Chernikov } 1231914bffb6SAlexander V. Chernikov 1232914bffb6SAlexander V. Chernikov /* Handle <port-num|service-name> */ 1233914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_SRCPORT) != 0) { 123435df97d0SAlexander V. Chernikov if (arg == NULL) 123535df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: src port missing"); 1236914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1237914bffb6SAlexander V. Chernikov *p++ = '\0'; 1238914bffb6SAlexander V. Chernikov 1239914bffb6SAlexander V. Chernikov if ((port = htons(strtol(arg, NULL, 10))) == 0) { 1240914bffb6SAlexander V. Chernikov if ((sent = getservbyname(arg, NULL)) == NULL) 1241914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown service: %s", 1242914bffb6SAlexander V. Chernikov arg); 1243914bffb6SAlexander V. Chernikov else 1244914bffb6SAlexander V. Chernikov key = sent->s_port; 1245914bffb6SAlexander V. Chernikov } 1246914bffb6SAlexander V. Chernikov 1247914bffb6SAlexander V. Chernikov tfe->sport = port; 1248914bffb6SAlexander V. Chernikov 1249914bffb6SAlexander V. Chernikov arg = p; 1250914bffb6SAlexander V. Chernikov } 1251914bffb6SAlexander V. Chernikov 1252914bffb6SAlexander V. Chernikov /* Handle <ipv4|ipv6>*/ 1253914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_DSTIP) != 0) { 125435df97d0SAlexander V. Chernikov if (arg == NULL) 125535df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: dst ip missing"); 1256914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1257914bffb6SAlexander V. Chernikov *p++ = '\0'; 1258914bffb6SAlexander V. Chernikov /* Determine family using temporary storage */ 1259914bffb6SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &tmp) == 1) { 1260914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET) 1261914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1262914bffb6SAlexander V. Chernikov "Inconsistent address family"); 1263914bffb6SAlexander V. Chernikov af = AF_INET; 1264914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a4.dip, &tmp, 4); 1265914bffb6SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, &tmp) == 1) { 1266914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET6) 1267914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1268914bffb6SAlexander V. Chernikov "Inconsistent address family"); 1269914bffb6SAlexander V. Chernikov af = AF_INET6; 1270914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a6.dip6, &tmp, 16); 1271914bffb6SAlexander V. Chernikov } 1272914bffb6SAlexander V. Chernikov 1273914bffb6SAlexander V. Chernikov arg = p; 1274914bffb6SAlexander V. Chernikov } 1275914bffb6SAlexander V. Chernikov 1276914bffb6SAlexander V. Chernikov /* Handle <port-num|service-name> */ 1277914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_DSTPORT) != 0) { 127835df97d0SAlexander V. Chernikov if (arg == NULL) 127935df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: dst port missing"); 1280914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1281914bffb6SAlexander V. Chernikov *p++ = '\0'; 1282914bffb6SAlexander V. Chernikov 1283914bffb6SAlexander V. Chernikov if ((port = htons(strtol(arg, NULL, 10))) == 0) { 1284914bffb6SAlexander V. Chernikov if ((sent = getservbyname(arg, NULL)) == NULL) 1285914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown service: %s", 1286914bffb6SAlexander V. Chernikov arg); 1287914bffb6SAlexander V. Chernikov else 1288914bffb6SAlexander V. Chernikov key = sent->s_port; 1289914bffb6SAlexander V. Chernikov } 1290914bffb6SAlexander V. Chernikov 1291914bffb6SAlexander V. Chernikov tfe->dport = port; 1292914bffb6SAlexander V. Chernikov 1293914bffb6SAlexander V. Chernikov arg = p; 1294914bffb6SAlexander V. Chernikov } 1295914bffb6SAlexander V. Chernikov 1296914bffb6SAlexander V. Chernikov tfe->af = af; 1297914bffb6SAlexander V. Chernikov 1298914bffb6SAlexander V. Chernikov break; 1299914bffb6SAlexander V. Chernikov 1300ac35ff17SAlexander V. Chernikov default: 1301ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "Unsupported table type: %d", type); 1302ac35ff17SAlexander V. Chernikov } 1303ac35ff17SAlexander V. Chernikov 1304ac35ff17SAlexander V. Chernikov tentry->subtype = af; 1305ac35ff17SAlexander V. Chernikov tentry->masklen = masklen; 1306ac35ff17SAlexander V. Chernikov } 1307ac35ff17SAlexander V. Chernikov 13088755aff6SAlexander V. Chernikov /* 13098755aff6SAlexander V. Chernikov * Tries to guess table key type. 13108755aff6SAlexander V. Chernikov * This procedure is used in legacy table auto-create 13118755aff6SAlexander V. Chernikov * code AND in `ipfw -n` ruleset checking. 13128755aff6SAlexander V. Chernikov * 13138755aff6SAlexander V. Chernikov * Imported from old table_fill_xentry() parse code. 13148755aff6SAlexander V. Chernikov */ 13158755aff6SAlexander V. Chernikov static int 13168755aff6SAlexander V. Chernikov guess_key_type(char *key, uint8_t *ptype) 13178755aff6SAlexander V. Chernikov { 13188755aff6SAlexander V. Chernikov char *p; 13198755aff6SAlexander V. Chernikov struct in6_addr addr; 13208755aff6SAlexander V. Chernikov uint32_t kv; 13218755aff6SAlexander V. Chernikov 13228755aff6SAlexander V. Chernikov if (ishexnumber(*key) != 0 || *key == ':') { 13238755aff6SAlexander V. Chernikov /* Remove / if exists */ 13248755aff6SAlexander V. Chernikov if ((p = strchr(key, '/')) != NULL) 13258755aff6SAlexander V. Chernikov *p = '\0'; 13268755aff6SAlexander V. Chernikov 13278755aff6SAlexander V. Chernikov if ((inet_pton(AF_INET, key, &addr) == 1) || 13288755aff6SAlexander V. Chernikov (inet_pton(AF_INET6, key, &addr) == 1)) { 13298755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_CIDR; 13308755aff6SAlexander V. Chernikov if (p != NULL) 13318755aff6SAlexander V. Chernikov *p = '/'; 13328755aff6SAlexander V. Chernikov return (0); 13338755aff6SAlexander V. Chernikov } else { 13348755aff6SAlexander V. Chernikov /* Port or any other key */ 13358755aff6SAlexander V. Chernikov /* Skip non-base 10 entries like 'fa1' */ 13368755aff6SAlexander V. Chernikov kv = strtol(key, &p, 10); 13378755aff6SAlexander V. Chernikov if (*p == '\0') { 13388755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 13398755aff6SAlexander V. Chernikov return (0); 13408755aff6SAlexander V. Chernikov } else if ((p != key) && (*p == '.')) { 13418755aff6SAlexander V. Chernikov /* 13428755aff6SAlexander V. Chernikov * Warn on IPv4 address strings 13438755aff6SAlexander V. Chernikov * which are "valid" for inet_aton() but not 13448755aff6SAlexander V. Chernikov * in inet_pton(). 13458755aff6SAlexander V. Chernikov * 13468755aff6SAlexander V. Chernikov * Typical examples: '10.5' or '10.0.0.05' 13478755aff6SAlexander V. Chernikov */ 13488755aff6SAlexander V. Chernikov return (1); 13498755aff6SAlexander V. Chernikov } 13508755aff6SAlexander V. Chernikov } 13518755aff6SAlexander V. Chernikov } 13528755aff6SAlexander V. Chernikov 13538755aff6SAlexander V. Chernikov if (strchr(key, '.') == NULL) { 13548755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 13558755aff6SAlexander V. Chernikov return (0); 13568755aff6SAlexander V. Chernikov } 13578755aff6SAlexander V. Chernikov 13588755aff6SAlexander V. Chernikov if (lookup_host(key, (struct in_addr *)&addr) != 0) 13598755aff6SAlexander V. Chernikov return (1); 13608755aff6SAlexander V. Chernikov 13618755aff6SAlexander V. Chernikov *ptype = IPFW_TABLE_CIDR; 13628755aff6SAlexander V. Chernikov return (0); 13638755aff6SAlexander V. Chernikov } 13648755aff6SAlexander V. Chernikov 1365ac35ff17SAlexander V. Chernikov static void 1366ac35ff17SAlexander V. Chernikov tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, char *key, 13670cba2b28SAlexander V. Chernikov int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi) 1368ac35ff17SAlexander V. Chernikov { 13690cba2b28SAlexander V. Chernikov uint8_t type, tflags; 13700cba2b28SAlexander V. Chernikov uint32_t vmask; 1371ac35ff17SAlexander V. Chernikov int error; 1372ac35ff17SAlexander V. Chernikov 1373ac35ff17SAlexander V. Chernikov type = 0; 1374914bffb6SAlexander V. Chernikov tflags = 0; 13750cba2b28SAlexander V. Chernikov vmask = 0; 1376ac35ff17SAlexander V. Chernikov 13773a845e10SAlexander V. Chernikov if (xi->tablename[0] == '\0') 137881d3153dSAlexander V. Chernikov error = table_get_info(oh, xi); 13793a845e10SAlexander V. Chernikov else 13803a845e10SAlexander V. Chernikov error = 0; 138181d3153dSAlexander V. Chernikov 138281d3153dSAlexander V. Chernikov if (error == 0) { 13838755aff6SAlexander V. Chernikov if (co.test_only == 0) { 13848755aff6SAlexander V. Chernikov /* Table found */ 138581d3153dSAlexander V. Chernikov type = xi->type; 1386914bffb6SAlexander V. Chernikov tflags = xi->tflags; 13870cba2b28SAlexander V. Chernikov vmask = xi->vmask; 138881d3153dSAlexander V. Chernikov } else { 13898755aff6SAlexander V. Chernikov /* 1390463a577bSEitan Adler * We're running `ipfw -n` 1391463a577bSEitan Adler * Compatibility layer: try to guess key type 13928755aff6SAlexander V. Chernikov * before failing. 13938755aff6SAlexander V. Chernikov */ 13948755aff6SAlexander V. Chernikov if (guess_key_type(key, &type) != 0) { 13958755aff6SAlexander V. Chernikov /* Inknown key */ 13968755aff6SAlexander V. Chernikov errx(EX_USAGE, "Cannot guess " 13978755aff6SAlexander V. Chernikov "key '%s' type", key); 13988755aff6SAlexander V. Chernikov } 13998755aff6SAlexander V. Chernikov vmask = IPFW_VTYPE_LEGACY; 14008755aff6SAlexander V. Chernikov } 14018755aff6SAlexander V. Chernikov } else { 140281d3153dSAlexander V. Chernikov if (error != ESRCH) 140381d3153dSAlexander V. Chernikov errx(EX_OSERR, "Error requesting table %s info", 140481d3153dSAlexander V. Chernikov oh->ntlv.name); 140535df97d0SAlexander V. Chernikov if (add == 0) 140635df97d0SAlexander V. Chernikov errx(EX_DATAERR, "Table %s does not exist", 140735df97d0SAlexander V. Chernikov oh->ntlv.name); 1408ac35ff17SAlexander V. Chernikov /* 14098755aff6SAlexander V. Chernikov * Table does not exist 1410463a577bSEitan Adler * Compatibility layer: try to guess key type before failing. 1411ac35ff17SAlexander V. Chernikov */ 14128755aff6SAlexander V. Chernikov if (guess_key_type(key, &type) != 0) { 141381d3153dSAlexander V. Chernikov /* Inknown key */ 141481d3153dSAlexander V. Chernikov errx(EX_USAGE, "Table %s does not exist, cannot guess " 1415db785d31SAlexander V. Chernikov "key '%s' type", oh->ntlv.name, key); 141681d3153dSAlexander V. Chernikov } 14178755aff6SAlexander V. Chernikov 14188755aff6SAlexander V. Chernikov vmask = IPFW_VTYPE_LEGACY; 1419ac35ff17SAlexander V. Chernikov } 1420ac35ff17SAlexander V. Chernikov 1421914bffb6SAlexander V. Chernikov tentry_fill_key_type(key, tent, type, tflags); 1422ac35ff17SAlexander V. Chernikov 1423ac35ff17SAlexander V. Chernikov *ptype = type; 14240cba2b28SAlexander V. Chernikov *pvmask = vmask; 14250cba2b28SAlexander V. Chernikov } 14260cba2b28SAlexander V. Chernikov 14270cba2b28SAlexander V. Chernikov static void 14280cba2b28SAlexander V. Chernikov set_legacy_value(uint32_t val, ipfw_table_value *v) 14290cba2b28SAlexander V. Chernikov { 14300cba2b28SAlexander V. Chernikov v->tag = val; 14310cba2b28SAlexander V. Chernikov v->pipe = val; 14320cba2b28SAlexander V. Chernikov v->divert = val; 14330cba2b28SAlexander V. Chernikov v->skipto = val; 14340cba2b28SAlexander V. Chernikov v->netgraph = val; 14350cba2b28SAlexander V. Chernikov v->fib = val; 14360cba2b28SAlexander V. Chernikov v->nat = val; 14370cba2b28SAlexander V. Chernikov v->nh4 = val; 14380cba2b28SAlexander V. Chernikov v->dscp = (uint8_t)val; 14390cba2b28SAlexander V. Chernikov v->limit = val; 1440ac35ff17SAlexander V. Chernikov } 1441ac35ff17SAlexander V. Chernikov 1442ac35ff17SAlexander V. Chernikov static void 1443ac35ff17SAlexander V. Chernikov tentry_fill_value(ipfw_obj_header *oh, ipfw_obj_tentry *tent, char *arg, 14440cba2b28SAlexander V. Chernikov uint8_t type, uint32_t vmask) 1445ac35ff17SAlexander V. Chernikov { 14462530ed9eSAndrey V. Elsukov struct addrinfo hints, *res; 1447b7684f4bSMarcelo Araujo uint32_t a4, flag, val; 14480cba2b28SAlexander V. Chernikov ipfw_table_value *v; 14490cba2b28SAlexander V. Chernikov uint32_t i; 1450d91c61c3SAlexander V. Chernikov int dval; 14510cba2b28SAlexander V. Chernikov char *comma, *e, *etype, *n, *p; 1452ac35ff17SAlexander V. Chernikov 14530cba2b28SAlexander V. Chernikov v = &tent->v.value; 14540cba2b28SAlexander V. Chernikov 14550cba2b28SAlexander V. Chernikov /* Compat layer: keep old behavior for legacy value types */ 14560cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 1457adf3b2b9SAlexander V. Chernikov /* Try to interpret as number first */ 14580cba2b28SAlexander V. Chernikov val = strtoul(arg, &p, 0); 14590cba2b28SAlexander V. Chernikov if (*p == '\0') { 14600cba2b28SAlexander V. Chernikov set_legacy_value(val, v); 1461adf3b2b9SAlexander V. Chernikov return; 14620cba2b28SAlexander V. Chernikov } 1463adf3b2b9SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &val) == 1) { 14640cba2b28SAlexander V. Chernikov set_legacy_value(ntohl(val), v); 1465adf3b2b9SAlexander V. Chernikov return; 1466adf3b2b9SAlexander V. Chernikov } 1467adf3b2b9SAlexander V. Chernikov /* Try hostname */ 14680cba2b28SAlexander V. Chernikov if (lookup_host(arg, (struct in_addr *)&val) == 0) { 14690cba2b28SAlexander V. Chernikov set_legacy_value(val, v); 1470adf3b2b9SAlexander V. Chernikov return; 14710cba2b28SAlexander V. Chernikov } 1472adf3b2b9SAlexander V. Chernikov errx(EX_OSERR, "Unable to parse value %s", arg); 14730cba2b28SAlexander V. Chernikov } 14740cba2b28SAlexander V. Chernikov 14750cba2b28SAlexander V. Chernikov /* 14760cba2b28SAlexander V. Chernikov * Shorthands: handle single value if vmask consists 14770cba2b28SAlexander V. Chernikov * of numbers only. e.g.: 14780cba2b28SAlexander V. Chernikov * vmask = "fib,skipto" -> treat input "1" as "1,1" 14790cba2b28SAlexander V. Chernikov */ 14800cba2b28SAlexander V. Chernikov 14810cba2b28SAlexander V. Chernikov n = arg; 14820cba2b28SAlexander V. Chernikov etype = NULL; 14830cba2b28SAlexander V. Chernikov for (i = 1; i < (1 << 31); i *= 2) { 14840cba2b28SAlexander V. Chernikov if ((flag = (vmask & i)) == 0) 14850cba2b28SAlexander V. Chernikov continue; 14860cba2b28SAlexander V. Chernikov vmask &= ~flag; 14870cba2b28SAlexander V. Chernikov 14880cba2b28SAlexander V. Chernikov if ((comma = strchr(n, ',')) != NULL) 14890cba2b28SAlexander V. Chernikov *comma = '\0'; 14900cba2b28SAlexander V. Chernikov 14910cba2b28SAlexander V. Chernikov switch (flag) { 14920cba2b28SAlexander V. Chernikov case IPFW_VTYPE_TAG: 14930cba2b28SAlexander V. Chernikov v->tag = strtol(n, &e, 10); 14940cba2b28SAlexander V. Chernikov if (*e != '\0') 14950cba2b28SAlexander V. Chernikov etype = "tag"; 1496ac35ff17SAlexander V. Chernikov break; 14970cba2b28SAlexander V. Chernikov case IPFW_VTYPE_PIPE: 14980cba2b28SAlexander V. Chernikov v->pipe = strtol(n, &e, 10); 14990cba2b28SAlexander V. Chernikov if (*e != '\0') 15000cba2b28SAlexander V. Chernikov etype = "pipe"; 1501ac35ff17SAlexander V. Chernikov break; 15020cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DIVERT: 15030cba2b28SAlexander V. Chernikov v->divert = strtol(n, &e, 10); 15040cba2b28SAlexander V. Chernikov if (*e != '\0') 15050cba2b28SAlexander V. Chernikov etype = "divert"; 15060cba2b28SAlexander V. Chernikov break; 15070cba2b28SAlexander V. Chernikov case IPFW_VTYPE_SKIPTO: 15080cba2b28SAlexander V. Chernikov v->skipto = strtol(n, &e, 10); 15090cba2b28SAlexander V. Chernikov if (*e != '\0') 15100cba2b28SAlexander V. Chernikov etype = "skipto"; 15110cba2b28SAlexander V. Chernikov break; 15120cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NETGRAPH: 15130cba2b28SAlexander V. Chernikov v->netgraph = strtol(n, &e, 10); 15140cba2b28SAlexander V. Chernikov if (*e != '\0') 15150cba2b28SAlexander V. Chernikov etype = "netgraph"; 15160cba2b28SAlexander V. Chernikov break; 15170cba2b28SAlexander V. Chernikov case IPFW_VTYPE_FIB: 15180cba2b28SAlexander V. Chernikov v->fib = strtol(n, &e, 10); 15190cba2b28SAlexander V. Chernikov if (*e != '\0') 15200cba2b28SAlexander V. Chernikov etype = "fib"; 15210cba2b28SAlexander V. Chernikov break; 15220cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NAT: 15230cba2b28SAlexander V. Chernikov v->nat = strtol(n, &e, 10); 15240cba2b28SAlexander V. Chernikov if (*e != '\0') 15250cba2b28SAlexander V. Chernikov etype = "nat"; 15260cba2b28SAlexander V. Chernikov break; 15270cba2b28SAlexander V. Chernikov case IPFW_VTYPE_LIMIT: 15280cba2b28SAlexander V. Chernikov v->limit = strtol(n, &e, 10); 15290cba2b28SAlexander V. Chernikov if (*e != '\0') 15300cba2b28SAlexander V. Chernikov etype = "limit"; 15310cba2b28SAlexander V. Chernikov break; 15320cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH4: 15330cba2b28SAlexander V. Chernikov if (strchr(n, '.') != NULL && 15340cba2b28SAlexander V. Chernikov inet_pton(AF_INET, n, &a4) == 1) { 15350cba2b28SAlexander V. Chernikov v->nh4 = ntohl(a4); 15360cba2b28SAlexander V. Chernikov break; 15370cba2b28SAlexander V. Chernikov } 15380cba2b28SAlexander V. Chernikov if (lookup_host(n, (struct in_addr *)&v->nh4) == 0) 15390cba2b28SAlexander V. Chernikov break; 15400cba2b28SAlexander V. Chernikov etype = "ipv4"; 1541ac35ff17SAlexander V. Chernikov break; 1542ac35ff17SAlexander V. Chernikov case IPFW_VTYPE_DSCP: 15430cba2b28SAlexander V. Chernikov if (isalpha(*n)) { 1544d91c61c3SAlexander V. Chernikov if ((dval = match_token(f_ipdscp, n)) != -1) { 1545d91c61c3SAlexander V. Chernikov v->dscp = dval; 1546ac35ff17SAlexander V. Chernikov break; 1547d91c61c3SAlexander V. Chernikov } else 15480cba2b28SAlexander V. Chernikov etype = "DSCP code"; 15490cba2b28SAlexander V. Chernikov } else { 15500cba2b28SAlexander V. Chernikov v->dscp = strtol(n, &e, 10); 15510cba2b28SAlexander V. Chernikov if (v->dscp > 63 || *e != '\0') 15520cba2b28SAlexander V. Chernikov etype = "DSCP value"; 1553ac35ff17SAlexander V. Chernikov } 15540cba2b28SAlexander V. Chernikov break; 15550cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH6: 15562530ed9eSAndrey V. Elsukov if (strchr(n, ':') != NULL) { 15572530ed9eSAndrey V. Elsukov memset(&hints, 0, sizeof(hints)); 15582530ed9eSAndrey V. Elsukov hints.ai_family = AF_INET6; 15592530ed9eSAndrey V. Elsukov hints.ai_flags = AI_NUMERICHOST; 15602530ed9eSAndrey V. Elsukov if (getaddrinfo(n, NULL, &hints, &res) == 0) { 15612530ed9eSAndrey V. Elsukov v->nh6 = ((struct sockaddr_in6 *) 15622530ed9eSAndrey V. Elsukov res->ai_addr)->sin6_addr; 15632530ed9eSAndrey V. Elsukov v->zoneid = ((struct sockaddr_in6 *) 15642530ed9eSAndrey V. Elsukov res->ai_addr)->sin6_scope_id; 15652530ed9eSAndrey V. Elsukov freeaddrinfo(res); 15660cba2b28SAlexander V. Chernikov break; 15672530ed9eSAndrey V. Elsukov } 15682530ed9eSAndrey V. Elsukov } 15690cba2b28SAlexander V. Chernikov etype = "ipv6"; 15700cba2b28SAlexander V. Chernikov break; 15710cba2b28SAlexander V. Chernikov } 15720cba2b28SAlexander V. Chernikov 15730cba2b28SAlexander V. Chernikov if (etype != NULL) 15740cba2b28SAlexander V. Chernikov errx(EX_USAGE, "Unable to parse %s as %s", n, etype); 15750cba2b28SAlexander V. Chernikov 15760cba2b28SAlexander V. Chernikov if (comma != NULL) 15770cba2b28SAlexander V. Chernikov *comma++ = ','; 15780cba2b28SAlexander V. Chernikov 15790cba2b28SAlexander V. Chernikov if ((n = comma) != NULL) 15800cba2b28SAlexander V. Chernikov continue; 15810cba2b28SAlexander V. Chernikov 15820cba2b28SAlexander V. Chernikov /* End of input. */ 15830cba2b28SAlexander V. Chernikov if (vmask != 0) 15840cba2b28SAlexander V. Chernikov errx(EX_USAGE, "Not enough fields inside value"); 15850cba2b28SAlexander V. Chernikov } 1586ac35ff17SAlexander V. Chernikov } 1587f1220db8SAlexander V. Chernikov 1588f1220db8SAlexander V. Chernikov /* 1589f1220db8SAlexander V. Chernikov * Compare table names. 1590f1220db8SAlexander V. Chernikov * Honor number comparison. 1591f1220db8SAlexander V. Chernikov */ 1592f1220db8SAlexander V. Chernikov static int 1593f1220db8SAlexander V. Chernikov tablename_cmp(const void *a, const void *b) 1594f1220db8SAlexander V. Chernikov { 1595f1220db8SAlexander V. Chernikov ipfw_xtable_info *ia, *ib; 1596f1220db8SAlexander V. Chernikov 1597f1220db8SAlexander V. Chernikov ia = (ipfw_xtable_info *)a; 1598f1220db8SAlexander V. Chernikov ib = (ipfw_xtable_info *)b; 1599f1220db8SAlexander V. Chernikov 160068394ec8SAlexander V. Chernikov return (stringnum_cmp(ia->tablename, ib->tablename)); 1601f1220db8SAlexander V. Chernikov } 1602f1220db8SAlexander V. Chernikov 1603f1220db8SAlexander V. Chernikov /* 1604f1220db8SAlexander V. Chernikov * Retrieves table list from kernel, 1605f1220db8SAlexander V. Chernikov * optionally sorts it and calls requested function for each table. 1606f1220db8SAlexander V. Chernikov * Returns 0 on success. 1607f1220db8SAlexander V. Chernikov */ 1608f1220db8SAlexander V. Chernikov static int 1609f1220db8SAlexander V. Chernikov tables_foreach(table_cb_t *f, void *arg, int sort) 1610f1220db8SAlexander V. Chernikov { 161128ea4fa3SAlexander V. Chernikov ipfw_obj_lheader *olh; 1612f1220db8SAlexander V. Chernikov ipfw_xtable_info *info; 1613f1220db8SAlexander V. Chernikov size_t sz; 1614f1220db8SAlexander V. Chernikov int i, error; 1615f1220db8SAlexander V. Chernikov 161628ea4fa3SAlexander V. Chernikov /* Start with reasonable default */ 161728ea4fa3SAlexander V. Chernikov sz = sizeof(*olh) + 16 * sizeof(ipfw_xtable_info); 1618f1220db8SAlexander V. Chernikov 161928ea4fa3SAlexander V. Chernikov for (;;) { 1620f1220db8SAlexander V. Chernikov if ((olh = calloc(1, sz)) == NULL) 1621f1220db8SAlexander V. Chernikov return (ENOMEM); 1622f1220db8SAlexander V. Chernikov 1623f1220db8SAlexander V. Chernikov olh->size = sz; 1624b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLES_XLIST, &olh->opheader, &sz) != 0) { 162528ea4fa3SAlexander V. Chernikov sz = olh->size; 162668bde59eSAlexander V. Chernikov free(olh); 162768bde59eSAlexander V. Chernikov if (errno != ENOMEM) 1628b6462881SAlexander V. Chernikov return (errno); 162968bde59eSAlexander V. Chernikov continue; 1630f1220db8SAlexander V. Chernikov } 1631f1220db8SAlexander V. Chernikov 1632f1220db8SAlexander V. Chernikov if (sort != 0) 1633f1220db8SAlexander V. Chernikov qsort(olh + 1, olh->count, olh->objsize, tablename_cmp); 1634f1220db8SAlexander V. Chernikov 1635f1220db8SAlexander V. Chernikov info = (ipfw_xtable_info *)(olh + 1); 1636f1220db8SAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 1637f1220db8SAlexander V. Chernikov error = f(info, arg); /* Ignore errors for now */ 1638f1220db8SAlexander V. Chernikov info = (ipfw_xtable_info *)((caddr_t)info + olh->objsize); 1639f1220db8SAlexander V. Chernikov } 1640f1220db8SAlexander V. Chernikov 1641f1220db8SAlexander V. Chernikov free(olh); 164228ea4fa3SAlexander V. Chernikov break; 164328ea4fa3SAlexander V. Chernikov } 1644f1220db8SAlexander V. Chernikov 1645f1220db8SAlexander V. Chernikov return (0); 1646f1220db8SAlexander V. Chernikov } 1647f1220db8SAlexander V. Chernikov 164828ea4fa3SAlexander V. Chernikov 1649f1220db8SAlexander V. Chernikov /* 1650f1220db8SAlexander V. Chernikov * Retrieves all entries for given table @i in 1651720ee730SAlexander V. Chernikov * eXtended format. Allocate buffer large enough 1652720ee730SAlexander V. Chernikov * to store result. Called needs to free it later. 1653f1220db8SAlexander V. Chernikov * 1654f1220db8SAlexander V. Chernikov * Returns 0 on success. 1655f1220db8SAlexander V. Chernikov */ 1656f1220db8SAlexander V. Chernikov static int 1657720ee730SAlexander V. Chernikov table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh) 1658f1220db8SAlexander V. Chernikov { 1659720ee730SAlexander V. Chernikov ipfw_obj_header *oh; 1660f1220db8SAlexander V. Chernikov size_t sz; 1661b6462881SAlexander V. Chernikov int c; 1662f1220db8SAlexander V. Chernikov 166381d3153dSAlexander V. Chernikov sz = 0; 1664720ee730SAlexander V. Chernikov oh = NULL; 1665720ee730SAlexander V. Chernikov for (c = 0; c < 8; c++) { 166681d3153dSAlexander V. Chernikov if (sz < i->size) 1667720ee730SAlexander V. Chernikov sz = i->size + 44; 1668720ee730SAlexander V. Chernikov if (oh != NULL) 1669720ee730SAlexander V. Chernikov free(oh); 1670720ee730SAlexander V. Chernikov if ((oh = calloc(1, sz)) == NULL) 1671720ee730SAlexander V. Chernikov continue; 1672720ee730SAlexander V. Chernikov table_fill_objheader(oh, i); 1673d3a4f924SAlexander V. Chernikov oh->opheader.version = 1; /* Current version */ 1674b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XLIST, &oh->opheader, &sz) == 0) { 1675720ee730SAlexander V. Chernikov *poh = oh; 1676720ee730SAlexander V. Chernikov return (0); 167781d3153dSAlexander V. Chernikov } 1678f1220db8SAlexander V. Chernikov 1679b6462881SAlexander V. Chernikov if (errno != ENOMEM) 1680720ee730SAlexander V. Chernikov break; 1681720ee730SAlexander V. Chernikov } 1682720ee730SAlexander V. Chernikov free(oh); 1683720ee730SAlexander V. Chernikov 1684b6462881SAlexander V. Chernikov return (errno); 1685f1220db8SAlexander V. Chernikov } 1686f1220db8SAlexander V. Chernikov 1687f1220db8SAlexander V. Chernikov /* 1688f1220db8SAlexander V. Chernikov * Shows all entries from @oh in human-readable format 1689f1220db8SAlexander V. Chernikov */ 1690f1220db8SAlexander V. Chernikov static void 1691f1220db8SAlexander V. Chernikov table_show_list(ipfw_obj_header *oh, int need_header) 1692f1220db8SAlexander V. Chernikov { 169381d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 169481d3153dSAlexander V. Chernikov uint32_t count; 1695f1220db8SAlexander V. Chernikov ipfw_xtable_info *i; 1696f1220db8SAlexander V. Chernikov 1697f1220db8SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 169881d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(i + 1); 1699f1220db8SAlexander V. Chernikov 1700f1220db8SAlexander V. Chernikov if (need_header) 1701f1220db8SAlexander V. Chernikov printf("--- table(%s), set(%u) ---\n", i->tablename, i->set); 1702f1220db8SAlexander V. Chernikov 1703f1220db8SAlexander V. Chernikov count = i->count; 1704f1220db8SAlexander V. Chernikov while (count > 0) { 170581d3153dSAlexander V. Chernikov table_show_entry(i, tent); 170681d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)((caddr_t)tent + tent->head.length); 170781d3153dSAlexander V. Chernikov count--; 170881d3153dSAlexander V. Chernikov } 170981d3153dSAlexander V. Chernikov } 171081d3153dSAlexander V. Chernikov 171181d3153dSAlexander V. Chernikov static void 17120cba2b28SAlexander V. Chernikov table_show_value(char *buf, size_t bufsize, ipfw_table_value *v, 17130cba2b28SAlexander V. Chernikov uint32_t vmask, int print_ip) 17140cba2b28SAlexander V. Chernikov { 17152530ed9eSAndrey V. Elsukov char abuf[INET6_ADDRSTRLEN + IF_NAMESIZE + 2]; 17162530ed9eSAndrey V. Elsukov struct sockaddr_in6 sa6; 17170cba2b28SAlexander V. Chernikov uint32_t flag, i, l; 17180cba2b28SAlexander V. Chernikov size_t sz; 17190cba2b28SAlexander V. Chernikov struct in_addr a4; 17200cba2b28SAlexander V. Chernikov 17210cba2b28SAlexander V. Chernikov sz = bufsize; 17220cba2b28SAlexander V. Chernikov 17230cba2b28SAlexander V. Chernikov /* 17240cba2b28SAlexander V. Chernikov * Some shorthands for printing values: 17250cba2b28SAlexander V. Chernikov * legacy assumes all values are equal, so keep the first one. 17260cba2b28SAlexander V. Chernikov */ 17270cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 17280cba2b28SAlexander V. Chernikov if (print_ip != 0) { 17290cba2b28SAlexander V. Chernikov flag = htonl(v->tag); 17300cba2b28SAlexander V. Chernikov inet_ntop(AF_INET, &flag, buf, sz); 17310cba2b28SAlexander V. Chernikov } else 17320cba2b28SAlexander V. Chernikov snprintf(buf, sz, "%u", v->tag); 17330cba2b28SAlexander V. Chernikov return; 17340cba2b28SAlexander V. Chernikov } 17350cba2b28SAlexander V. Chernikov 17360cba2b28SAlexander V. Chernikov for (i = 1; i < (1 << 31); i *= 2) { 17370cba2b28SAlexander V. Chernikov if ((flag = (vmask & i)) == 0) 17380cba2b28SAlexander V. Chernikov continue; 17390cba2b28SAlexander V. Chernikov l = 0; 17400cba2b28SAlexander V. Chernikov 17410cba2b28SAlexander V. Chernikov switch (flag) { 17420cba2b28SAlexander V. Chernikov case IPFW_VTYPE_TAG: 17430cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->tag); 17440cba2b28SAlexander V. Chernikov break; 17450cba2b28SAlexander V. Chernikov case IPFW_VTYPE_PIPE: 17460cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->pipe); 17470cba2b28SAlexander V. Chernikov break; 17480cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DIVERT: 17490cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->divert); 17500cba2b28SAlexander V. Chernikov break; 17510cba2b28SAlexander V. Chernikov case IPFW_VTYPE_SKIPTO: 17520cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->skipto); 17530cba2b28SAlexander V. Chernikov break; 17540cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NETGRAPH: 17550cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->netgraph); 17560cba2b28SAlexander V. Chernikov break; 17570cba2b28SAlexander V. Chernikov case IPFW_VTYPE_FIB: 17580cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->fib); 17590cba2b28SAlexander V. Chernikov break; 17600cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NAT: 17610cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->nat); 17620cba2b28SAlexander V. Chernikov break; 17630cba2b28SAlexander V. Chernikov case IPFW_VTYPE_LIMIT: 17640cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->limit); 17650cba2b28SAlexander V. Chernikov break; 17660cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH4: 17670cba2b28SAlexander V. Chernikov a4.s_addr = htonl(v->nh4); 17680cba2b28SAlexander V. Chernikov inet_ntop(AF_INET, &a4, abuf, sizeof(abuf)); 17690cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%s,", abuf); 17700cba2b28SAlexander V. Chernikov break; 17710cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DSCP: 17720cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->dscp); 17730cba2b28SAlexander V. Chernikov break; 17740cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH6: 17752530ed9eSAndrey V. Elsukov sa6.sin6_family = AF_INET6; 17762530ed9eSAndrey V. Elsukov sa6.sin6_len = sizeof(sa6); 17772530ed9eSAndrey V. Elsukov sa6.sin6_addr = v->nh6; 17782530ed9eSAndrey V. Elsukov sa6.sin6_port = 0; 17792530ed9eSAndrey V. Elsukov sa6.sin6_scope_id = v->zoneid; 17802530ed9eSAndrey V. Elsukov if (getnameinfo((const struct sockaddr *)&sa6, 17812530ed9eSAndrey V. Elsukov sa6.sin6_len, abuf, sizeof(abuf), NULL, 0, 17822530ed9eSAndrey V. Elsukov NI_NUMERICHOST) == 0) 17830cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%s,", abuf); 17840cba2b28SAlexander V. Chernikov break; 17850cba2b28SAlexander V. Chernikov } 17860cba2b28SAlexander V. Chernikov 17870cba2b28SAlexander V. Chernikov buf += l; 17880cba2b28SAlexander V. Chernikov sz -= l; 17890cba2b28SAlexander V. Chernikov } 17900cba2b28SAlexander V. Chernikov 17910cba2b28SAlexander V. Chernikov if (sz != bufsize) 17920cba2b28SAlexander V. Chernikov *(buf - 1) = '\0'; 17930cba2b28SAlexander V. Chernikov } 17940cba2b28SAlexander V. Chernikov 17950cba2b28SAlexander V. Chernikov static void 179681d3153dSAlexander V. Chernikov table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent) 179781d3153dSAlexander V. Chernikov { 17980cba2b28SAlexander V. Chernikov char *comma, tbuf[128], pval[128]; 1799914bffb6SAlexander V. Chernikov void *paddr; 1800914bffb6SAlexander V. Chernikov struct tflow_entry *tfe; 180181d3153dSAlexander V. Chernikov 18020cba2b28SAlexander V. Chernikov table_show_value(pval, sizeof(pval), &tent->v.value, i->vmask, 18030cba2b28SAlexander V. Chernikov co.do_value_as_ip); 1804914bffb6SAlexander V. Chernikov 1805f1220db8SAlexander V. Chernikov switch (i->type) { 1806c21034b7SAlexander V. Chernikov case IPFW_TABLE_ADDR: 1807f1220db8SAlexander V. Chernikov /* IPv4 or IPv6 prefixes */ 180881d3153dSAlexander V. Chernikov inet_ntop(tent->subtype, &tent->k, tbuf, sizeof(tbuf)); 1809914bffb6SAlexander V. Chernikov printf("%s/%u %s\n", tbuf, tent->masklen, pval); 1810f1220db8SAlexander V. Chernikov break; 1811f1220db8SAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 1812f1220db8SAlexander V. Chernikov /* Interface names */ 1813914bffb6SAlexander V. Chernikov printf("%s %s\n", tent->k.iface, pval); 1814b23d5de9SAlexander V. Chernikov break; 1815b23d5de9SAlexander V. Chernikov case IPFW_TABLE_NUMBER: 1816b23d5de9SAlexander V. Chernikov /* numbers */ 1817914bffb6SAlexander V. Chernikov printf("%u %s\n", tent->k.key, pval); 1818b23d5de9SAlexander V. Chernikov break; 1819914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 1820914bffb6SAlexander V. Chernikov /* flows */ 1821914bffb6SAlexander V. Chernikov tfe = &tent->k.flow; 1822914bffb6SAlexander V. Chernikov comma = ""; 1823914bffb6SAlexander V. Chernikov 1824914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_SRCIP) != 0) { 1825914bffb6SAlexander V. Chernikov if (tfe->af == AF_INET) 1826914bffb6SAlexander V. Chernikov paddr = &tfe->a.a4.sip; 1827914bffb6SAlexander V. Chernikov else 1828914bffb6SAlexander V. Chernikov paddr = &tfe->a.a6.sip6; 1829914bffb6SAlexander V. Chernikov 1830914bffb6SAlexander V. Chernikov inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf)); 1831914bffb6SAlexander V. Chernikov printf("%s%s", comma, tbuf); 1832914bffb6SAlexander V. Chernikov comma = ","; 1833914bffb6SAlexander V. Chernikov } 1834914bffb6SAlexander V. Chernikov 1835914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_PROTO) != 0) { 1836914bffb6SAlexander V. Chernikov printf("%s%d", comma, tfe->proto); 1837914bffb6SAlexander V. Chernikov comma = ","; 1838914bffb6SAlexander V. Chernikov } 1839914bffb6SAlexander V. Chernikov 1840914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_SRCPORT) != 0) { 1841914bffb6SAlexander V. Chernikov printf("%s%d", comma, ntohs(tfe->sport)); 1842914bffb6SAlexander V. Chernikov comma = ","; 1843914bffb6SAlexander V. Chernikov } 1844914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_DSTIP) != 0) { 1845914bffb6SAlexander V. Chernikov if (tfe->af == AF_INET) 1846914bffb6SAlexander V. Chernikov paddr = &tfe->a.a4.dip; 1847914bffb6SAlexander V. Chernikov else 1848914bffb6SAlexander V. Chernikov paddr = &tfe->a.a6.dip6; 1849914bffb6SAlexander V. Chernikov 1850914bffb6SAlexander V. Chernikov inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf)); 1851914bffb6SAlexander V. Chernikov printf("%s%s", comma, tbuf); 1852914bffb6SAlexander V. Chernikov comma = ","; 1853914bffb6SAlexander V. Chernikov } 1854914bffb6SAlexander V. Chernikov 1855914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_DSTPORT) != 0) { 1856914bffb6SAlexander V. Chernikov printf("%s%d", comma, ntohs(tfe->dport)); 1857914bffb6SAlexander V. Chernikov comma = ","; 1858914bffb6SAlexander V. Chernikov } 1859914bffb6SAlexander V. Chernikov 1860914bffb6SAlexander V. Chernikov printf(" %s\n", pval); 1861f1220db8SAlexander V. Chernikov } 1862f1220db8SAlexander V. Chernikov } 1863f1220db8SAlexander V. Chernikov 18649d099b4fSAlexander V. Chernikov static int 18650cba2b28SAlexander V. Chernikov table_do_get_stdlist(uint16_t opcode, ipfw_obj_lheader **polh) 18669d099b4fSAlexander V. Chernikov { 18679d099b4fSAlexander V. Chernikov ipfw_obj_lheader req, *olh; 18689d099b4fSAlexander V. Chernikov size_t sz; 18699d099b4fSAlexander V. Chernikov 18709d099b4fSAlexander V. Chernikov memset(&req, 0, sizeof(req)); 18719d099b4fSAlexander V. Chernikov sz = sizeof(req); 18729d099b4fSAlexander V. Chernikov 1873b6462881SAlexander V. Chernikov if (do_get3(opcode, &req.opheader, &sz) != 0) 1874b6462881SAlexander V. Chernikov if (errno != ENOMEM) 1875b6462881SAlexander V. Chernikov return (errno); 18769d099b4fSAlexander V. Chernikov 18779d099b4fSAlexander V. Chernikov sz = req.size; 18789d099b4fSAlexander V. Chernikov if ((olh = calloc(1, sz)) == NULL) 18799d099b4fSAlexander V. Chernikov return (ENOMEM); 18809d099b4fSAlexander V. Chernikov 18819d099b4fSAlexander V. Chernikov olh->size = sz; 1882b6462881SAlexander V. Chernikov if (do_get3(opcode, &olh->opheader, &sz) != 0) { 18839d099b4fSAlexander V. Chernikov free(olh); 1884b6462881SAlexander V. Chernikov return (errno); 18859d099b4fSAlexander V. Chernikov } 18869d099b4fSAlexander V. Chernikov 18879d099b4fSAlexander V. Chernikov *polh = olh; 18889d099b4fSAlexander V. Chernikov return (0); 18899d099b4fSAlexander V. Chernikov } 18909d099b4fSAlexander V. Chernikov 18910cba2b28SAlexander V. Chernikov static int 18920cba2b28SAlexander V. Chernikov table_do_get_algolist(ipfw_obj_lheader **polh) 18930cba2b28SAlexander V. Chernikov { 18940cba2b28SAlexander V. Chernikov 18950cba2b28SAlexander V. Chernikov return (table_do_get_stdlist(IP_FW_TABLES_ALIST, polh)); 18960cba2b28SAlexander V. Chernikov } 18970cba2b28SAlexander V. Chernikov 18980cba2b28SAlexander V. Chernikov static int 18990cba2b28SAlexander V. Chernikov table_do_get_vlist(ipfw_obj_lheader **polh) 19000cba2b28SAlexander V. Chernikov { 19010cba2b28SAlexander V. Chernikov 19020cba2b28SAlexander V. Chernikov return (table_do_get_stdlist(IP_FW_TABLE_VLIST, polh)); 19030cba2b28SAlexander V. Chernikov } 19040cba2b28SAlexander V. Chernikov 19059d099b4fSAlexander V. Chernikov void 19069d099b4fSAlexander V. Chernikov ipfw_list_ta(int ac, char *av[]) 19079d099b4fSAlexander V. Chernikov { 19089d099b4fSAlexander V. Chernikov ipfw_obj_lheader *olh; 19099d099b4fSAlexander V. Chernikov ipfw_ta_info *info; 19109d099b4fSAlexander V. Chernikov int error, i; 19119d099b4fSAlexander V. Chernikov const char *atype; 19129d099b4fSAlexander V. Chernikov 19139d099b4fSAlexander V. Chernikov error = table_do_get_algolist(&olh); 19149d099b4fSAlexander V. Chernikov if (error != 0) 19159d099b4fSAlexander V. Chernikov err(EX_OSERR, "Unable to request algorithm list"); 19169d099b4fSAlexander V. Chernikov 19179d099b4fSAlexander V. Chernikov info = (ipfw_ta_info *)(olh + 1); 19189d099b4fSAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 19199d099b4fSAlexander V. Chernikov if ((atype = match_value(tabletypes, info->type)) == NULL) 19209d099b4fSAlexander V. Chernikov atype = "unknown"; 19218ce7a2bcSAlexander V. Chernikov printf("--- %s ---\n", info->algoname); 19228ce7a2bcSAlexander V. Chernikov printf(" type: %s\n refcount: %u\n", atype, info->refcnt); 19239d099b4fSAlexander V. Chernikov 19249d099b4fSAlexander V. Chernikov info = (ipfw_ta_info *)((caddr_t)info + olh->objsize); 19259d099b4fSAlexander V. Chernikov } 19269d099b4fSAlexander V. Chernikov 19279d099b4fSAlexander V. Chernikov free(olh); 19289d099b4fSAlexander V. Chernikov } 19299d099b4fSAlexander V. Chernikov 19300cba2b28SAlexander V. Chernikov 19310cba2b28SAlexander V. Chernikov /* Copy of current kernel table_value structure */ 19320cba2b28SAlexander V. Chernikov struct _table_value { 19330cba2b28SAlexander V. Chernikov uint32_t tag; /* O_TAG/O_TAGGED */ 19340cba2b28SAlexander V. Chernikov uint32_t pipe; /* O_PIPE/O_QUEUE */ 19350cba2b28SAlexander V. Chernikov uint16_t divert; /* O_DIVERT/O_TEE */ 19360cba2b28SAlexander V. Chernikov uint16_t skipto; /* skipto, CALLRET */ 19370cba2b28SAlexander V. Chernikov uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */ 19380cba2b28SAlexander V. Chernikov uint32_t fib; /* O_SETFIB */ 19390cba2b28SAlexander V. Chernikov uint32_t nat; /* O_NAT */ 19400cba2b28SAlexander V. Chernikov uint32_t nh4; 19410cba2b28SAlexander V. Chernikov uint8_t dscp; 19422530ed9eSAndrey V. Elsukov uint8_t spare0; 19432530ed9eSAndrey V. Elsukov uint16_t spare1; 19440cba2b28SAlexander V. Chernikov /* -- 32 bytes -- */ 19450cba2b28SAlexander V. Chernikov struct in6_addr nh6; 19460cba2b28SAlexander V. Chernikov uint32_t limit; /* O_LIMIT */ 19472530ed9eSAndrey V. Elsukov uint32_t zoneid; 19480cba2b28SAlexander V. Chernikov uint64_t refcnt; /* Number of references */ 19490cba2b28SAlexander V. Chernikov }; 19500cba2b28SAlexander V. Chernikov 19510cba2b28SAlexander V. Chernikov int 19520cba2b28SAlexander V. Chernikov compare_values(const void *_a, const void *_b) 19530cba2b28SAlexander V. Chernikov { 19540cba2b28SAlexander V. Chernikov struct _table_value *a, *b; 19550cba2b28SAlexander V. Chernikov 19560cba2b28SAlexander V. Chernikov a = (struct _table_value *)_a; 19570cba2b28SAlexander V. Chernikov b = (struct _table_value *)_b; 19580cba2b28SAlexander V. Chernikov 19590cba2b28SAlexander V. Chernikov if (a->spare1 < b->spare1) 19600cba2b28SAlexander V. Chernikov return (-1); 19610cba2b28SAlexander V. Chernikov else if (a->spare1 > b->spare1) 19620cba2b28SAlexander V. Chernikov return (1); 19630cba2b28SAlexander V. Chernikov 19640cba2b28SAlexander V. Chernikov return (0); 19650cba2b28SAlexander V. Chernikov } 19660cba2b28SAlexander V. Chernikov 19670cba2b28SAlexander V. Chernikov void 19680cba2b28SAlexander V. Chernikov ipfw_list_values(int ac, char *av[]) 19690cba2b28SAlexander V. Chernikov { 19700cba2b28SAlexander V. Chernikov ipfw_obj_lheader *olh; 19710cba2b28SAlexander V. Chernikov struct _table_value *v; 19720cba2b28SAlexander V. Chernikov int error, i; 19730cba2b28SAlexander V. Chernikov uint32_t vmask; 19740cba2b28SAlexander V. Chernikov char buf[128]; 19750cba2b28SAlexander V. Chernikov 19760cba2b28SAlexander V. Chernikov error = table_do_get_vlist(&olh); 19770cba2b28SAlexander V. Chernikov if (error != 0) 19780cba2b28SAlexander V. Chernikov err(EX_OSERR, "Unable to request value list"); 19790cba2b28SAlexander V. Chernikov 19800cba2b28SAlexander V. Chernikov vmask = 0x7FFFFFFF; /* Similar to IPFW_VTYPE_LEGACY */ 19810cba2b28SAlexander V. Chernikov 19820cba2b28SAlexander V. Chernikov table_print_valheader(buf, sizeof(buf), vmask); 19830cba2b28SAlexander V. Chernikov printf("HEADER: %s\n", buf); 19840cba2b28SAlexander V. Chernikov v = (struct _table_value *)(olh + 1); 19850cba2b28SAlexander V. Chernikov qsort(v, olh->count, olh->objsize, compare_values); 19860cba2b28SAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 19870cba2b28SAlexander V. Chernikov table_show_value(buf, sizeof(buf), (ipfw_table_value *)v, 19880cba2b28SAlexander V. Chernikov vmask, 0); 1989d3de6c1dSAlexander V. Chernikov printf("[%u] refs=%lu %s\n", v->spare1, (u_long)v->refcnt, buf); 19900cba2b28SAlexander V. Chernikov v = (struct _table_value *)((caddr_t)v + olh->objsize); 19910cba2b28SAlexander V. Chernikov } 19920cba2b28SAlexander V. Chernikov 19930cba2b28SAlexander V. Chernikov free(olh); 19940cba2b28SAlexander V. Chernikov } 19950cba2b28SAlexander V. Chernikov 19966c2997ffSAlexander V. Chernikov int 19972acdf79fSAndrey V. Elsukov table_check_name(const char *tablename) 19986c2997ffSAlexander V. Chernikov { 19996c2997ffSAlexander V. Chernikov 20002acdf79fSAndrey V. Elsukov if (ipfw_check_object_name(tablename) != 0) 20016c2997ffSAlexander V. Chernikov return (EINVAL); 2002ac35ff17SAlexander V. Chernikov /* Restrict some 'special' names */ 2003ac35ff17SAlexander V. Chernikov if (strcmp(tablename, "all") == 0) 2004ac35ff17SAlexander V. Chernikov return (EINVAL); 20056c2997ffSAlexander V. Chernikov return (0); 20066c2997ffSAlexander V. Chernikov } 20076c2997ffSAlexander V. Chernikov 2008