1f1220db8SAlexander V. Chernikov /* 2f1220db8SAlexander V. Chernikov * Copyright (c) 2002-2003 Luigi Rizzo 3f1220db8SAlexander V. Chernikov * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp 4f1220db8SAlexander V. Chernikov * Copyright (c) 1994 Ugen J.S.Antsilevich 5f1220db8SAlexander V. Chernikov * 6f1220db8SAlexander V. Chernikov * Idea and grammar partially left from: 7f1220db8SAlexander V. Chernikov * Copyright (c) 1993 Daniel Boulet 8f1220db8SAlexander V. Chernikov * 9f1220db8SAlexander V. Chernikov * Redistribution and use in source forms, with and without modification, 10f1220db8SAlexander V. Chernikov * are permitted provided that this entire comment appears intact. 11f1220db8SAlexander V. Chernikov * 12f1220db8SAlexander V. Chernikov * Redistribution in binary form may occur without any restrictions. 13f1220db8SAlexander V. Chernikov * Obviously, it would be nice if you gave credit where credit is due 14f1220db8SAlexander V. Chernikov * but requiring it would be too onerous. 15f1220db8SAlexander V. Chernikov * 16f1220db8SAlexander V. Chernikov * This software is provided ``AS IS'' without any warranties of any kind. 17f1220db8SAlexander V. Chernikov * 18f1220db8SAlexander V. Chernikov * in-kernel tables support 19f1220db8SAlexander V. Chernikov * 20f1220db8SAlexander V. Chernikov * $FreeBSD: projects/ipfw/sbin/ipfw/ipfw2.c 267467 2014-06-14 10:58:39Z melifaro $ 21f1220db8SAlexander V. Chernikov */ 22f1220db8SAlexander V. Chernikov 23f1220db8SAlexander V. Chernikov 24f1220db8SAlexander V. Chernikov #include <sys/types.h> 25f1220db8SAlexander V. Chernikov #include <sys/param.h> 26f1220db8SAlexander V. Chernikov #include <sys/socket.h> 27f1220db8SAlexander V. Chernikov #include <sys/sysctl.h> 28f1220db8SAlexander V. Chernikov 29f1220db8SAlexander V. Chernikov #include <ctype.h> 30f1220db8SAlexander V. Chernikov #include <err.h> 31f1220db8SAlexander V. Chernikov #include <errno.h> 32f1220db8SAlexander V. Chernikov #include <netdb.h> 33f1220db8SAlexander V. Chernikov #include <stdio.h> 34f1220db8SAlexander V. Chernikov #include <stdlib.h> 35f1220db8SAlexander V. Chernikov #include <string.h> 36f1220db8SAlexander V. Chernikov #include <sysexits.h> 37f1220db8SAlexander V. Chernikov 38f1220db8SAlexander V. Chernikov #include <net/if.h> 39f1220db8SAlexander V. Chernikov #include <netinet/in.h> 40f1220db8SAlexander V. Chernikov #include <netinet/ip_fw.h> 41f1220db8SAlexander V. Chernikov #include <arpa/inet.h> 42f1220db8SAlexander V. Chernikov 43f1220db8SAlexander V. Chernikov #include "ipfw2.h" 44f1220db8SAlexander V. Chernikov 45f1220db8SAlexander V. Chernikov static void table_list(ipfw_xtable_info *i, int need_header); 46ac35ff17SAlexander V. Chernikov static void table_modify_record(ipfw_obj_header *oh, int ac, char *av[], 473a845e10SAlexander V. Chernikov int add, int quiet, int update, int atomic); 48ac35ff17SAlexander V. Chernikov static int table_flush(ipfw_obj_header *oh); 49ac35ff17SAlexander V. Chernikov static int table_destroy(ipfw_obj_header *oh); 50ac35ff17SAlexander V. Chernikov static int table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i); 51adf3b2b9SAlexander V. Chernikov static int table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i); 5246d52008SAlexander V. Chernikov static int table_do_swap(ipfw_obj_header *oh, char *second); 53adf3b2b9SAlexander V. Chernikov static void table_create(ipfw_obj_header *oh, int ac, char *av[]); 54adf3b2b9SAlexander V. Chernikov static void table_modify(ipfw_obj_header *oh, int ac, char *av[]); 55adf3b2b9SAlexander V. Chernikov static void table_lookup(ipfw_obj_header *oh, int ac, char *av[]); 564f43138aSAlexander V. Chernikov static void table_lock(ipfw_obj_header *oh, int lock); 5746d52008SAlexander V. Chernikov static int table_swap(ipfw_obj_header *oh, char *second); 58ac35ff17SAlexander V. Chernikov static int table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i); 59f1220db8SAlexander V. Chernikov static int table_show_info(ipfw_xtable_info *i, void *arg); 60ac35ff17SAlexander V. Chernikov static void table_fill_ntlv(ipfw_obj_ntlv *ntlv, char *name, uint32_t set, 61ac35ff17SAlexander V. Chernikov uint16_t uidx); 62f1220db8SAlexander V. Chernikov 63f1220db8SAlexander V. Chernikov static int table_flush_one(ipfw_xtable_info *i, void *arg); 64f1220db8SAlexander V. Chernikov static int table_show_one(ipfw_xtable_info *i, void *arg); 65720ee730SAlexander V. Chernikov static int table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh); 66f1220db8SAlexander V. Chernikov static void table_show_list(ipfw_obj_header *oh, int need_header); 6781d3153dSAlexander V. Chernikov static void table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent); 68f1220db8SAlexander V. Chernikov 69ac35ff17SAlexander V. Chernikov static void tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, 700cba2b28SAlexander V. Chernikov char *key, int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi); 71ac35ff17SAlexander V. Chernikov static void tentry_fill_value(ipfw_obj_header *oh, ipfw_obj_tentry *tent, 720cba2b28SAlexander V. Chernikov char *arg, uint8_t type, uint32_t vmask); 730cba2b28SAlexander V. Chernikov static void table_show_value(char *buf, size_t bufsize, ipfw_table_value *v, 740cba2b28SAlexander V. Chernikov uint32_t vmask, int print_ip); 75ac35ff17SAlexander V. Chernikov 76f1220db8SAlexander V. Chernikov typedef int (table_cb_t)(ipfw_xtable_info *i, void *arg); 77f1220db8SAlexander V. Chernikov static int tables_foreach(table_cb_t *f, void *arg, int sort); 78f1220db8SAlexander V. Chernikov 79f1220db8SAlexander V. Chernikov #ifndef s6_addr32 80f1220db8SAlexander V. Chernikov #define s6_addr32 __u6_addr.__u6_addr32 81f1220db8SAlexander V. Chernikov #endif 82f1220db8SAlexander V. Chernikov 83ac35ff17SAlexander V. Chernikov static struct _s_x tabletypes[] = { 84c21034b7SAlexander V. Chernikov { "addr", IPFW_TABLE_ADDR }, 85ac35ff17SAlexander V. Chernikov { "iface", IPFW_TABLE_INTERFACE }, 86b23d5de9SAlexander V. Chernikov { "number", IPFW_TABLE_NUMBER }, 87914bffb6SAlexander V. Chernikov { "flow", IPFW_TABLE_FLOW }, 88ac35ff17SAlexander V. Chernikov { NULL, 0 } 89ac35ff17SAlexander V. Chernikov }; 90ac35ff17SAlexander V. Chernikov 91ac35ff17SAlexander V. Chernikov static struct _s_x tablevaltypes[] = { 920cba2b28SAlexander V. Chernikov { "skipto", IPFW_VTYPE_SKIPTO }, 930cba2b28SAlexander V. Chernikov { "pipe", IPFW_VTYPE_PIPE }, 940cba2b28SAlexander V. Chernikov { "fib", IPFW_VTYPE_FIB }, 950cba2b28SAlexander V. Chernikov { "nat", IPFW_VTYPE_NAT }, 960cba2b28SAlexander V. Chernikov { "dscp", IPFW_VTYPE_DSCP }, 970cba2b28SAlexander V. Chernikov { "tag", IPFW_VTYPE_TAG }, 980cba2b28SAlexander V. Chernikov { "divert", IPFW_VTYPE_DIVERT }, 990cba2b28SAlexander V. Chernikov { "netgraph", IPFW_VTYPE_NETGRAPH }, 1000cba2b28SAlexander V. Chernikov { "limit", IPFW_VTYPE_LIMIT }, 1010cba2b28SAlexander V. Chernikov { "ipv4", IPFW_VTYPE_NH4 }, 1020cba2b28SAlexander V. Chernikov { "ipv6", IPFW_VTYPE_NH6 }, 103adf3b2b9SAlexander V. Chernikov { NULL, 0 } 104adf3b2b9SAlexander V. Chernikov }; 105adf3b2b9SAlexander V. Chernikov 106ac35ff17SAlexander V. Chernikov static struct _s_x tablecmds[] = { 107ac35ff17SAlexander V. Chernikov { "add", TOK_ADD }, 108ac35ff17SAlexander V. Chernikov { "delete", TOK_DEL }, 10946d52008SAlexander V. Chernikov { "create", TOK_CREATE }, 110ac35ff17SAlexander V. Chernikov { "destroy", TOK_DESTROY }, 111ac35ff17SAlexander V. Chernikov { "flush", TOK_FLUSH }, 112adf3b2b9SAlexander V. Chernikov { "modify", TOK_MODIFY }, 11346d52008SAlexander V. Chernikov { "swap", TOK_SWAP }, 114ac35ff17SAlexander V. Chernikov { "info", TOK_INFO }, 115358b9d09SAlexander V. Chernikov { "detail", TOK_DETAIL }, 116ac35ff17SAlexander V. Chernikov { "list", TOK_LIST }, 11781d3153dSAlexander V. Chernikov { "lookup", TOK_LOOKUP }, 1183a845e10SAlexander V. Chernikov { "atomic", TOK_ATOMIC }, 1194f43138aSAlexander V. Chernikov { "lock", TOK_LOCK }, 1204f43138aSAlexander V. Chernikov { "unlock", TOK_UNLOCK }, 121ac35ff17SAlexander V. Chernikov { NULL, 0 } 122ac35ff17SAlexander V. Chernikov }; 123ac35ff17SAlexander V. Chernikov 124f1220db8SAlexander V. Chernikov static int 125f1220db8SAlexander V. Chernikov lookup_host (char *host, struct in_addr *ipaddr) 126f1220db8SAlexander V. Chernikov { 127f1220db8SAlexander V. Chernikov struct hostent *he; 128f1220db8SAlexander V. Chernikov 129f1220db8SAlexander V. Chernikov if (!inet_aton(host, ipaddr)) { 130f1220db8SAlexander V. Chernikov if ((he = gethostbyname(host)) == NULL) 131f1220db8SAlexander V. Chernikov return(-1); 132f1220db8SAlexander V. Chernikov *ipaddr = *(struct in_addr *)he->h_addr_list[0]; 133f1220db8SAlexander V. Chernikov } 134f1220db8SAlexander V. Chernikov return(0); 135f1220db8SAlexander V. Chernikov } 136f1220db8SAlexander V. Chernikov 137be695df9SAlexander V. Chernikov static int 138be695df9SAlexander V. Chernikov get_token(struct _s_x *table, char *string, char *errbase) 139be695df9SAlexander V. Chernikov { 140be695df9SAlexander V. Chernikov int tcmd; 141be695df9SAlexander V. Chernikov 142be695df9SAlexander V. Chernikov if ((tcmd = match_token_relaxed(table, string)) < 0) 143be695df9SAlexander V. Chernikov errx(EX_USAGE, "%s %s %s", 144be695df9SAlexander V. Chernikov (tcmd == 0) ? "invalid" : "ambiguous", errbase, string); 145be695df9SAlexander V. Chernikov 146be695df9SAlexander V. Chernikov return (tcmd); 147be695df9SAlexander V. Chernikov } 148be695df9SAlexander V. Chernikov 149f1220db8SAlexander V. Chernikov /* 150f1220db8SAlexander V. Chernikov * This one handles all table-related commands 151ac35ff17SAlexander V. Chernikov * ipfw table NAME create ... 152be695df9SAlexander V. Chernikov * ipfw table NAME modify ... 153ac35ff17SAlexander V. Chernikov * ipfw table NAME destroy 154be695df9SAlexander V. Chernikov * ipfw table NAME swap NAME 155be695df9SAlexander V. Chernikov * ipfw table NAME lock 156be695df9SAlexander V. Chernikov * ipfw table NAME unlock 157ac35ff17SAlexander V. Chernikov * ipfw table NAME add addr[/masklen] [value] 158be695df9SAlexander V. Chernikov * ipfw table NAME add [addr[/masklen] value] [addr[/masklen] value] .. 159be695df9SAlexander V. Chernikov * ipfw table NAME delete addr[/masklen] [addr[/masklen]] .. 160be695df9SAlexander V. Chernikov * ipfw table NAME lookup addr 161ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} flush 162ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} list 163ac35ff17SAlexander V. Chernikov * ipfw table {NAME | all} info 164be695df9SAlexander V. Chernikov * ipfw table {NAME | all} detail 165f1220db8SAlexander V. Chernikov */ 166f1220db8SAlexander V. Chernikov void 167f1220db8SAlexander V. Chernikov ipfw_table_handler(int ac, char *av[]) 168f1220db8SAlexander V. Chernikov { 169ac35ff17SAlexander V. Chernikov int do_add, is_all; 1703a845e10SAlexander V. Chernikov int atomic, error, tcmd; 171ac35ff17SAlexander V. Chernikov ipfw_xtable_info i; 172ac35ff17SAlexander V. Chernikov ipfw_obj_header oh; 173f1220db8SAlexander V. Chernikov char *tablename; 174ac35ff17SAlexander V. Chernikov uint32_t set; 175358b9d09SAlexander V. Chernikov void *arg; 176f1220db8SAlexander V. Chernikov 177ac35ff17SAlexander V. Chernikov memset(&oh, 0, sizeof(oh)); 178ac35ff17SAlexander V. Chernikov is_all = 0; 179ac35ff17SAlexander V. Chernikov if (co.use_set != 0) 180ac35ff17SAlexander V. Chernikov set = co.use_set - 1; 181ac35ff17SAlexander V. Chernikov else 182ac35ff17SAlexander V. Chernikov set = 0; 183f1220db8SAlexander V. Chernikov 184f1220db8SAlexander V. Chernikov ac--; av++; 1859d099b4fSAlexander V. Chernikov NEED1("table needs name"); 186f1220db8SAlexander V. Chernikov tablename = *av; 187f1220db8SAlexander V. Chernikov 188ac35ff17SAlexander V. Chernikov if (table_check_name(tablename) == 0) { 189ac35ff17SAlexander V. Chernikov table_fill_ntlv(&oh.ntlv, *av, set, 1); 190ac35ff17SAlexander V. Chernikov oh.idx = 1; 191ac35ff17SAlexander V. Chernikov } else { 192ac35ff17SAlexander V. Chernikov if (strcmp(tablename, "all") == 0) 193ac35ff17SAlexander V. Chernikov is_all = 1; 194ac35ff17SAlexander V. Chernikov else 195ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "table name %s is invalid", tablename); 196ac35ff17SAlexander V. Chernikov } 197ac35ff17SAlexander V. Chernikov ac--; av++; 1989d099b4fSAlexander V. Chernikov NEED1("table needs command"); 199ac35ff17SAlexander V. Chernikov 200be695df9SAlexander V. Chernikov tcmd = get_token(tablecmds, *av, "table command"); 2013a845e10SAlexander V. Chernikov /* Check if atomic operation was requested */ 2023a845e10SAlexander V. Chernikov atomic = 0; 2033a845e10SAlexander V. Chernikov if (tcmd == TOK_ATOMIC) { 2043a845e10SAlexander V. Chernikov ac--; av++; 2053a845e10SAlexander V. Chernikov NEED1("atomic needs command"); 206be695df9SAlexander V. Chernikov tcmd = get_token(tablecmds, *av, "table command"); 2073a845e10SAlexander V. Chernikov switch (tcmd) { 2083a845e10SAlexander V. Chernikov case TOK_ADD: 2093a845e10SAlexander V. Chernikov break; 2103a845e10SAlexander V. Chernikov default: 2113a845e10SAlexander V. Chernikov errx(EX_USAGE, "atomic is not compatible with %s", *av); 2123a845e10SAlexander V. Chernikov } 2133a845e10SAlexander V. Chernikov atomic = 1; 2143a845e10SAlexander V. Chernikov } 215ac35ff17SAlexander V. Chernikov 216ac35ff17SAlexander V. Chernikov switch (tcmd) { 217ac35ff17SAlexander V. Chernikov case TOK_LIST: 218ac35ff17SAlexander V. Chernikov case TOK_INFO: 219358b9d09SAlexander V. Chernikov case TOK_DETAIL: 220ac35ff17SAlexander V. Chernikov case TOK_FLUSH: 221ac35ff17SAlexander V. Chernikov break; 222ac35ff17SAlexander V. Chernikov default: 223ac35ff17SAlexander V. Chernikov if (is_all != 0) 224ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "table name required"); 225ac35ff17SAlexander V. Chernikov } 226ac35ff17SAlexander V. Chernikov 227ac35ff17SAlexander V. Chernikov switch (tcmd) { 228ac35ff17SAlexander V. Chernikov case TOK_ADD: 229ac35ff17SAlexander V. Chernikov case TOK_DEL: 230f1220db8SAlexander V. Chernikov do_add = **av == 'a'; 231f1220db8SAlexander V. Chernikov ac--; av++; 2323a845e10SAlexander V. Chernikov table_modify_record(&oh, ac, av, do_add, co.do_quiet, 2333a845e10SAlexander V. Chernikov co.do_quiet, atomic); 234ac35ff17SAlexander V. Chernikov break; 235ac35ff17SAlexander V. Chernikov case TOK_CREATE: 236f1220db8SAlexander V. Chernikov ac--; av++; 237ac35ff17SAlexander V. Chernikov table_create(&oh, ac, av); 238ac35ff17SAlexander V. Chernikov break; 239adf3b2b9SAlexander V. Chernikov case TOK_MODIFY: 240adf3b2b9SAlexander V. Chernikov ac--; av++; 241adf3b2b9SAlexander V. Chernikov table_modify(&oh, ac, av); 242adf3b2b9SAlexander V. Chernikov break; 243ac35ff17SAlexander V. Chernikov case TOK_DESTROY: 244ac35ff17SAlexander V. Chernikov if (table_destroy(&oh) != 0) 245ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to destroy table %s", tablename); 246ac35ff17SAlexander V. Chernikov break; 247ac35ff17SAlexander V. Chernikov case TOK_FLUSH: 248f1220db8SAlexander V. Chernikov if (is_all == 0) { 249ac35ff17SAlexander V. Chernikov if ((error = table_flush(&oh)) != 0) 250f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to flush table %s info", 251f1220db8SAlexander V. Chernikov tablename); 252f1220db8SAlexander V. Chernikov } else { 253ac35ff17SAlexander V. Chernikov error = tables_foreach(table_flush_one, &oh, 1); 254f1220db8SAlexander V. Chernikov if (error != 0) 255f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to flush tables list"); 256f1220db8SAlexander V. Chernikov } 257ac35ff17SAlexander V. Chernikov break; 25846d52008SAlexander V. Chernikov case TOK_SWAP: 25946d52008SAlexander V. Chernikov ac--; av++; 26046d52008SAlexander V. Chernikov NEED1("second table name required"); 26146d52008SAlexander V. Chernikov table_swap(&oh, *av); 26246d52008SAlexander V. Chernikov break; 2634f43138aSAlexander V. Chernikov case TOK_LOCK: 2644f43138aSAlexander V. Chernikov case TOK_UNLOCK: 2654f43138aSAlexander V. Chernikov table_lock(&oh, (tcmd == TOK_LOCK)); 2664f43138aSAlexander V. Chernikov break; 267358b9d09SAlexander V. Chernikov case TOK_DETAIL: 268ac35ff17SAlexander V. Chernikov case TOK_INFO: 269358b9d09SAlexander V. Chernikov arg = (tcmd == TOK_DETAIL) ? (void *)1 : NULL; 270f1220db8SAlexander V. Chernikov if (is_all == 0) { 271ac35ff17SAlexander V. Chernikov if ((error = table_get_info(&oh, &i)) != 0) 272f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to request table info"); 273358b9d09SAlexander V. Chernikov table_show_info(&i, arg); 274f1220db8SAlexander V. Chernikov } else { 275358b9d09SAlexander V. Chernikov error = tables_foreach(table_show_info, arg, 1); 276f1220db8SAlexander V. Chernikov if (error != 0) 277f1220db8SAlexander V. Chernikov err(EX_OSERR, "failed to request tables list"); 278f1220db8SAlexander V. Chernikov } 279ac35ff17SAlexander V. Chernikov break; 280ac35ff17SAlexander V. Chernikov case TOK_LIST: 281ac35ff17SAlexander V. Chernikov if (is_all == 0) { 282ac35ff17SAlexander V. Chernikov ipfw_xtable_info i; 283ac35ff17SAlexander V. Chernikov if ((error = table_get_info(&oh, &i)) != 0) 284ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to request table info"); 285ac35ff17SAlexander V. Chernikov table_show_one(&i, NULL); 286f1220db8SAlexander V. Chernikov } else { 287ac35ff17SAlexander V. Chernikov error = tables_foreach(table_show_one, NULL, 1); 288ac35ff17SAlexander V. Chernikov if (error != 0) 289ac35ff17SAlexander V. Chernikov err(EX_OSERR, "failed to request tables list"); 290f1220db8SAlexander V. Chernikov } 291ac35ff17SAlexander V. Chernikov break; 29281d3153dSAlexander V. Chernikov case TOK_LOOKUP: 29381d3153dSAlexander V. Chernikov ac--; av++; 29481d3153dSAlexander V. Chernikov table_lookup(&oh, ac, av); 29581d3153dSAlexander V. Chernikov break; 296f1220db8SAlexander V. Chernikov } 297f1220db8SAlexander V. Chernikov } 298f1220db8SAlexander V. Chernikov 299f1220db8SAlexander V. Chernikov static void 300ac35ff17SAlexander V. Chernikov table_fill_ntlv(ipfw_obj_ntlv *ntlv, char *name, uint32_t set, uint16_t uidx) 301f1220db8SAlexander V. Chernikov { 302f1220db8SAlexander V. Chernikov 303563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 304f1220db8SAlexander V. Chernikov ntlv->head.length = sizeof(ipfw_obj_ntlv); 305f1220db8SAlexander V. Chernikov ntlv->idx = uidx; 306ac35ff17SAlexander V. Chernikov ntlv->set = set; 307f1220db8SAlexander V. Chernikov strlcpy(ntlv->name, name, sizeof(ntlv->name)); 308f1220db8SAlexander V. Chernikov } 309f1220db8SAlexander V. Chernikov 310f1220db8SAlexander V. Chernikov static void 311f1220db8SAlexander V. Chernikov table_fill_objheader(ipfw_obj_header *oh, ipfw_xtable_info *i) 312f1220db8SAlexander V. Chernikov { 313f1220db8SAlexander V. Chernikov 314f1220db8SAlexander V. Chernikov oh->idx = 1; 31581d3153dSAlexander V. Chernikov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 316ac35ff17SAlexander V. Chernikov } 317ac35ff17SAlexander V. Chernikov 318ac35ff17SAlexander V. Chernikov static struct _s_x tablenewcmds[] = { 319ac35ff17SAlexander V. Chernikov { "type", TOK_TYPE }, 320ac35ff17SAlexander V. Chernikov { "valtype", TOK_VALTYPE }, 321ac35ff17SAlexander V. Chernikov { "algo", TOK_ALGO }, 3224c0c07a5SAlexander V. Chernikov { "limit", TOK_LIMIT }, 3234f43138aSAlexander V. Chernikov { "locked", TOK_LOCK }, 324ac35ff17SAlexander V. Chernikov { NULL, 0 } 325ac35ff17SAlexander V. Chernikov }; 326ac35ff17SAlexander V. Chernikov 327914bffb6SAlexander V. Chernikov static struct _s_x flowtypecmds[] = { 328914bffb6SAlexander V. Chernikov { "src-ip", IPFW_TFFLAG_SRCIP }, 329914bffb6SAlexander V. Chernikov { "proto", IPFW_TFFLAG_PROTO }, 330914bffb6SAlexander V. Chernikov { "src-port", IPFW_TFFLAG_SRCPORT }, 331914bffb6SAlexander V. Chernikov { "dst-ip", IPFW_TFFLAG_DSTIP }, 332914bffb6SAlexander V. Chernikov { "dst-port", IPFW_TFFLAG_DSTPORT }, 333914bffb6SAlexander V. Chernikov { NULL, 0 } 334914bffb6SAlexander V. Chernikov }; 335914bffb6SAlexander V. Chernikov 336914bffb6SAlexander V. Chernikov int 337914bffb6SAlexander V. Chernikov table_parse_type(uint8_t ttype, char *p, uint8_t *tflags) 338914bffb6SAlexander V. Chernikov { 3390cba2b28SAlexander V. Chernikov uint32_t fset, fclear; 3400cba2b28SAlexander V. Chernikov char *e; 341914bffb6SAlexander V. Chernikov 342914bffb6SAlexander V. Chernikov /* Parse type options */ 343914bffb6SAlexander V. Chernikov switch(ttype) { 344914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 345914bffb6SAlexander V. Chernikov fset = fclear = 0; 3460cba2b28SAlexander V. Chernikov if (fill_flags(flowtypecmds, p, &e, &fset, &fclear) != 0) 3470cba2b28SAlexander V. Chernikov errx(EX_USAGE, 3480cba2b28SAlexander V. Chernikov "unable to parse flow option %s", e); 349914bffb6SAlexander V. Chernikov *tflags = fset; 350914bffb6SAlexander V. Chernikov break; 351914bffb6SAlexander V. Chernikov default: 352914bffb6SAlexander V. Chernikov return (EX_USAGE); 353914bffb6SAlexander V. Chernikov } 354914bffb6SAlexander V. Chernikov 355914bffb6SAlexander V. Chernikov return (0); 356914bffb6SAlexander V. Chernikov } 357914bffb6SAlexander V. Chernikov 358914bffb6SAlexander V. Chernikov void 359914bffb6SAlexander V. Chernikov table_print_type(char *tbuf, size_t size, uint8_t type, uint8_t tflags) 360914bffb6SAlexander V. Chernikov { 361914bffb6SAlexander V. Chernikov const char *tname; 362914bffb6SAlexander V. Chernikov int l; 363914bffb6SAlexander V. Chernikov 364914bffb6SAlexander V. Chernikov if ((tname = match_value(tabletypes, type)) == NULL) 365914bffb6SAlexander V. Chernikov tname = "unknown"; 366914bffb6SAlexander V. Chernikov 367914bffb6SAlexander V. Chernikov l = snprintf(tbuf, size, "%s", tname); 368914bffb6SAlexander V. Chernikov tbuf += l; 369914bffb6SAlexander V. Chernikov size -= l; 370914bffb6SAlexander V. Chernikov 371914bffb6SAlexander V. Chernikov switch(type) { 372914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 373914bffb6SAlexander V. Chernikov if (tflags != 0) { 374914bffb6SAlexander V. Chernikov *tbuf++ = ':'; 375914bffb6SAlexander V. Chernikov l--; 376914bffb6SAlexander V. Chernikov print_flags_buffer(tbuf, size, flowtypecmds, tflags); 377914bffb6SAlexander V. Chernikov } 378914bffb6SAlexander V. Chernikov break; 379914bffb6SAlexander V. Chernikov } 380914bffb6SAlexander V. Chernikov } 381914bffb6SAlexander V. Chernikov 382ac35ff17SAlexander V. Chernikov /* 383ac35ff17SAlexander V. Chernikov * Creates new table 384ac35ff17SAlexander V. Chernikov * 385c21034b7SAlexander V. Chernikov * ipfw table NAME create [ type { addr | iface | number | flow } ] 386ac35ff17SAlexander V. Chernikov * [ algo algoname ] 387ac35ff17SAlexander V. Chernikov */ 388ac35ff17SAlexander V. Chernikov static void 389ac35ff17SAlexander V. Chernikov table_create(ipfw_obj_header *oh, int ac, char *av[]) 390ac35ff17SAlexander V. Chernikov { 391ac35ff17SAlexander V. Chernikov ipfw_xtable_info xi; 392ac35ff17SAlexander V. Chernikov int error, tcmd, val; 3930cba2b28SAlexander V. Chernikov uint32_t fset, fclear; 394ac35ff17SAlexander V. Chernikov size_t sz; 3950cba2b28SAlexander V. Chernikov char *e, *p; 396ac35ff17SAlexander V. Chernikov char tbuf[128]; 397ac35ff17SAlexander V. Chernikov 398ac35ff17SAlexander V. Chernikov sz = sizeof(tbuf); 399ac35ff17SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 400ac35ff17SAlexander V. Chernikov 401ac35ff17SAlexander V. Chernikov while (ac > 0) { 402be695df9SAlexander V. Chernikov tcmd = get_token(tablenewcmds, *av, "option"); 403ac35ff17SAlexander V. Chernikov ac--; av++; 404ac35ff17SAlexander V. Chernikov 405ac35ff17SAlexander V. Chernikov switch (tcmd) { 4064c0c07a5SAlexander V. Chernikov case TOK_LIMIT: 4074c0c07a5SAlexander V. Chernikov NEED1("limit value required"); 4084c0c07a5SAlexander V. Chernikov xi.limit = strtol(*av, NULL, 10); 4094c0c07a5SAlexander V. Chernikov ac--; av++; 4104c0c07a5SAlexander V. Chernikov break; 411ac35ff17SAlexander V. Chernikov case TOK_TYPE: 412ac35ff17SAlexander V. Chernikov NEED1("table type required"); 413914bffb6SAlexander V. Chernikov /* Type may have suboptions after ':' */ 414914bffb6SAlexander V. Chernikov if ((p = strchr(*av, ':')) != NULL) 415914bffb6SAlexander V. Chernikov *p++ = '\0'; 416ac35ff17SAlexander V. Chernikov val = match_token(tabletypes, *av); 417914bffb6SAlexander V. Chernikov if (val == -1) { 418914bffb6SAlexander V. Chernikov concat_tokens(tbuf, sizeof(tbuf), tabletypes, 419914bffb6SAlexander V. Chernikov ", "); 420914bffb6SAlexander V. Chernikov errx(EX_USAGE, 421914bffb6SAlexander V. Chernikov "Unknown tabletype: %s. Supported: %s", 422ac35ff17SAlexander V. Chernikov *av, tbuf); 423914bffb6SAlexander V. Chernikov } 424914bffb6SAlexander V. Chernikov xi.type = val; 425914bffb6SAlexander V. Chernikov if (p != NULL) { 426914bffb6SAlexander V. Chernikov error = table_parse_type(val, p, &xi.tflags); 427914bffb6SAlexander V. Chernikov if (error != 0) 428914bffb6SAlexander V. Chernikov errx(EX_USAGE, 429914bffb6SAlexander V. Chernikov "Unsupported suboptions: %s", p); 430914bffb6SAlexander V. Chernikov } 431914bffb6SAlexander V. Chernikov ac--; av++; 432ac35ff17SAlexander V. Chernikov break; 433ac35ff17SAlexander V. Chernikov case TOK_VALTYPE: 434ac35ff17SAlexander V. Chernikov NEED1("table value type required"); 4350cba2b28SAlexander V. Chernikov fset = fclear = 0; 4360cba2b28SAlexander V. Chernikov val = fill_flags(tablevaltypes, *av, &e, &fset, &fclear); 437ac35ff17SAlexander V. Chernikov if (val != -1) { 4380cba2b28SAlexander V. Chernikov xi.vmask = fset; 439ac35ff17SAlexander V. Chernikov ac--; av++; 440ac35ff17SAlexander V. Chernikov break; 441ac35ff17SAlexander V. Chernikov } 442ac35ff17SAlexander V. Chernikov concat_tokens(tbuf, sizeof(tbuf), tablevaltypes, ", "); 443ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "Unknown value type: %s. Supported: %s", 4440cba2b28SAlexander V. Chernikov e, tbuf); 445adf3b2b9SAlexander V. Chernikov break; 446ac35ff17SAlexander V. Chernikov case TOK_ALGO: 447ac35ff17SAlexander V. Chernikov NEED1("table algorithm name required"); 448ac35ff17SAlexander V. Chernikov if (strlen(*av) > sizeof(xi.algoname)) 449ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "algorithm name too long"); 450ac35ff17SAlexander V. Chernikov strlcpy(xi.algoname, *av, sizeof(xi.algoname)); 451ac35ff17SAlexander V. Chernikov ac--; av++; 452ac35ff17SAlexander V. Chernikov break; 4534f43138aSAlexander V. Chernikov case TOK_LOCK: 4544f43138aSAlexander V. Chernikov xi.flags |= IPFW_TGFLAGS_LOCKED; 4554f43138aSAlexander V. Chernikov break; 456ac35ff17SAlexander V. Chernikov } 457ac35ff17SAlexander V. Chernikov } 458ac35ff17SAlexander V. Chernikov 459fd0869d5SAlexander V. Chernikov /* Set some defaults to preserve compability */ 460fd0869d5SAlexander V. Chernikov if (xi.algoname[0] == '\0' && xi.type == 0) 461c21034b7SAlexander V. Chernikov xi.type = IPFW_TABLE_ADDR; 4620cba2b28SAlexander V. Chernikov if (xi.vmask == 0) 4630cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 464fd0869d5SAlexander V. Chernikov 465ac35ff17SAlexander V. Chernikov if ((error = table_do_create(oh, &xi)) != 0) 466ac35ff17SAlexander V. Chernikov err(EX_OSERR, "Table creation failed"); 467f1220db8SAlexander V. Chernikov } 468f1220db8SAlexander V. Chernikov 469f1220db8SAlexander V. Chernikov /* 470ac35ff17SAlexander V. Chernikov * Creates new table 471ac35ff17SAlexander V. Chernikov * 472ac35ff17SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 473ac35ff17SAlexander V. Chernikov * 474f1220db8SAlexander V. Chernikov * Returns 0 on success. 475f1220db8SAlexander V. Chernikov */ 476f1220db8SAlexander V. Chernikov static int 477ac35ff17SAlexander V. Chernikov table_do_create(ipfw_obj_header *oh, ipfw_xtable_info *i) 478f1220db8SAlexander V. Chernikov { 479ac35ff17SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 480ac35ff17SAlexander V. Chernikov int error; 481f1220db8SAlexander V. Chernikov 482ac35ff17SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 483ac35ff17SAlexander V. Chernikov memcpy(tbuf + sizeof(*oh), i, sizeof(*i)); 484ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 485ac35ff17SAlexander V. Chernikov 486ac35ff17SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XCREATE, &oh->opheader, sizeof(tbuf)); 487ac35ff17SAlexander V. Chernikov 488ac35ff17SAlexander V. Chernikov return (error); 489ac35ff17SAlexander V. Chernikov } 490ac35ff17SAlexander V. Chernikov 491ac35ff17SAlexander V. Chernikov /* 492adf3b2b9SAlexander V. Chernikov * Modifies existing table 493adf3b2b9SAlexander V. Chernikov * 4940cba2b28SAlexander V. Chernikov * ipfw table NAME modify [ limit number ] 495adf3b2b9SAlexander V. Chernikov */ 496adf3b2b9SAlexander V. Chernikov static void 497adf3b2b9SAlexander V. Chernikov table_modify(ipfw_obj_header *oh, int ac, char *av[]) 498adf3b2b9SAlexander V. Chernikov { 499adf3b2b9SAlexander V. Chernikov ipfw_xtable_info xi; 500b6462881SAlexander V. Chernikov int tcmd; 501adf3b2b9SAlexander V. Chernikov size_t sz; 502adf3b2b9SAlexander V. Chernikov char tbuf[128]; 503adf3b2b9SAlexander V. Chernikov 504adf3b2b9SAlexander V. Chernikov sz = sizeof(tbuf); 505adf3b2b9SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 506adf3b2b9SAlexander V. Chernikov 507adf3b2b9SAlexander V. Chernikov while (ac > 0) { 508be695df9SAlexander V. Chernikov tcmd = get_token(tablenewcmds, *av, "option"); 509adf3b2b9SAlexander V. Chernikov ac--; av++; 510adf3b2b9SAlexander V. Chernikov 511adf3b2b9SAlexander V. Chernikov switch (tcmd) { 512adf3b2b9SAlexander V. Chernikov case TOK_LIMIT: 513adf3b2b9SAlexander V. Chernikov NEED1("limit value required"); 514adf3b2b9SAlexander V. Chernikov xi.limit = strtol(*av, NULL, 10); 515adf3b2b9SAlexander V. Chernikov xi.mflags |= IPFW_TMFLAGS_LIMIT; 516adf3b2b9SAlexander V. Chernikov ac--; av++; 517adf3b2b9SAlexander V. Chernikov break; 5180cba2b28SAlexander V. Chernikov default: 5190cba2b28SAlexander V. Chernikov errx(EX_USAGE, "cmd is not supported for modificatiob"); 520adf3b2b9SAlexander V. Chernikov } 521adf3b2b9SAlexander V. Chernikov } 522adf3b2b9SAlexander V. Chernikov 523b6462881SAlexander V. Chernikov if (table_do_modify(oh, &xi) != 0) 524adf3b2b9SAlexander V. Chernikov err(EX_OSERR, "Table modification failed"); 525adf3b2b9SAlexander V. Chernikov } 526adf3b2b9SAlexander V. Chernikov 527adf3b2b9SAlexander V. Chernikov /* 528adf3b2b9SAlexander V. Chernikov * Modifies existing table. 529adf3b2b9SAlexander V. Chernikov * 530adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 531adf3b2b9SAlexander V. Chernikov * 532adf3b2b9SAlexander V. Chernikov * Returns 0 on success. 533adf3b2b9SAlexander V. Chernikov */ 534adf3b2b9SAlexander V. Chernikov static int 535adf3b2b9SAlexander V. Chernikov table_do_modify(ipfw_obj_header *oh, ipfw_xtable_info *i) 536adf3b2b9SAlexander V. Chernikov { 537adf3b2b9SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 538adf3b2b9SAlexander V. Chernikov int error; 539adf3b2b9SAlexander V. Chernikov 540adf3b2b9SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 541adf3b2b9SAlexander V. Chernikov memcpy(tbuf + sizeof(*oh), i, sizeof(*i)); 542adf3b2b9SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 543adf3b2b9SAlexander V. Chernikov 544adf3b2b9SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XMODIFY, &oh->opheader, sizeof(tbuf)); 545adf3b2b9SAlexander V. Chernikov 546adf3b2b9SAlexander V. Chernikov return (error); 547adf3b2b9SAlexander V. Chernikov } 5484f43138aSAlexander V. Chernikov 5494f43138aSAlexander V. Chernikov /* 5504f43138aSAlexander V. Chernikov * Locks or unlocks given table 5514f43138aSAlexander V. Chernikov */ 5524f43138aSAlexander V. Chernikov static void 5534f43138aSAlexander V. Chernikov table_lock(ipfw_obj_header *oh, int lock) 5544f43138aSAlexander V. Chernikov { 5554f43138aSAlexander V. Chernikov ipfw_xtable_info xi; 5564f43138aSAlexander V. Chernikov 5574f43138aSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 5584f43138aSAlexander V. Chernikov 5594f43138aSAlexander V. Chernikov xi.mflags |= IPFW_TMFLAGS_LOCK; 5604f43138aSAlexander V. Chernikov xi.flags |= (lock != 0) ? IPFW_TGFLAGS_LOCKED : 0; 5614f43138aSAlexander V. Chernikov 562b6462881SAlexander V. Chernikov if (table_do_modify(oh, &xi) != 0) 5634f43138aSAlexander V. Chernikov err(EX_OSERR, "Table %s failed", lock != 0 ? "lock" : "unlock"); 5644f43138aSAlexander V. Chernikov } 5654f43138aSAlexander V. Chernikov 566adf3b2b9SAlexander V. Chernikov /* 567ac35ff17SAlexander V. Chernikov * Destroys given table specified by @oh->ntlv. 568ac35ff17SAlexander V. Chernikov * Returns 0 on success. 569ac35ff17SAlexander V. Chernikov */ 570ac35ff17SAlexander V. Chernikov static int 571ac35ff17SAlexander V. Chernikov table_destroy(ipfw_obj_header *oh) 572ac35ff17SAlexander V. Chernikov { 573ac35ff17SAlexander V. Chernikov 574ac35ff17SAlexander V. Chernikov if (do_set3(IP_FW_TABLE_XDESTROY, &oh->opheader, sizeof(*oh)) != 0) 575f1220db8SAlexander V. Chernikov return (-1); 576f1220db8SAlexander V. Chernikov 577f1220db8SAlexander V. Chernikov return (0); 578f1220db8SAlexander V. Chernikov } 579f1220db8SAlexander V. Chernikov 580f1220db8SAlexander V. Chernikov /* 581ac35ff17SAlexander V. Chernikov * Flushes given table specified by @oh->ntlv. 582f1220db8SAlexander V. Chernikov * Returns 0 on success. 583f1220db8SAlexander V. Chernikov */ 584f1220db8SAlexander V. Chernikov static int 585ac35ff17SAlexander V. Chernikov table_flush(ipfw_obj_header *oh) 586f1220db8SAlexander V. Chernikov { 587f1220db8SAlexander V. Chernikov 588ac35ff17SAlexander V. Chernikov if (do_set3(IP_FW_TABLE_XFLUSH, &oh->opheader, sizeof(*oh)) != 0) 589f1220db8SAlexander V. Chernikov return (-1); 590f1220db8SAlexander V. Chernikov 591f1220db8SAlexander V. Chernikov return (0); 592f1220db8SAlexander V. Chernikov } 593f1220db8SAlexander V. Chernikov 59446d52008SAlexander V. Chernikov static int 59546d52008SAlexander V. Chernikov table_do_swap(ipfw_obj_header *oh, char *second) 59646d52008SAlexander V. Chernikov { 59746d52008SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ntlv)]; 59846d52008SAlexander V. Chernikov int error; 59946d52008SAlexander V. Chernikov 60046d52008SAlexander V. Chernikov memset(tbuf, 0, sizeof(tbuf)); 60146d52008SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 60246d52008SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 60346d52008SAlexander V. Chernikov table_fill_ntlv((ipfw_obj_ntlv *)(oh + 1), second, oh->ntlv.set, 1); 60446d52008SAlexander V. Chernikov 60546d52008SAlexander V. Chernikov error = do_set3(IP_FW_TABLE_XSWAP, &oh->opheader, sizeof(tbuf)); 60646d52008SAlexander V. Chernikov 60746d52008SAlexander V. Chernikov return (error); 60846d52008SAlexander V. Chernikov } 60946d52008SAlexander V. Chernikov 61046d52008SAlexander V. Chernikov /* 61146d52008SAlexander V. Chernikov * Swaps given table with @second one. 61246d52008SAlexander V. Chernikov */ 61346d52008SAlexander V. Chernikov static int 61446d52008SAlexander V. Chernikov table_swap(ipfw_obj_header *oh, char *second) 61546d52008SAlexander V. Chernikov { 61646d52008SAlexander V. Chernikov int error; 61746d52008SAlexander V. Chernikov 61846d52008SAlexander V. Chernikov if (table_check_name(second) != 0) 61946d52008SAlexander V. Chernikov errx(EX_USAGE, "table name %s is invalid", second); 62046d52008SAlexander V. Chernikov 62146d52008SAlexander V. Chernikov error = table_do_swap(oh, second); 62246d52008SAlexander V. Chernikov 62346d52008SAlexander V. Chernikov switch (error) { 62446d52008SAlexander V. Chernikov case EINVAL: 62546d52008SAlexander V. Chernikov errx(EX_USAGE, "Unable to swap table: check types"); 62646d52008SAlexander V. Chernikov case EFBIG: 62746d52008SAlexander V. Chernikov errx(EX_USAGE, "Unable to swap table: check limits"); 62846d52008SAlexander V. Chernikov } 62946d52008SAlexander V. Chernikov 63046d52008SAlexander V. Chernikov return (0); 63146d52008SAlexander V. Chernikov } 63246d52008SAlexander V. Chernikov 63346d52008SAlexander V. Chernikov 634f1220db8SAlexander V. Chernikov /* 635ac35ff17SAlexander V. Chernikov * Retrieves table in given table specified by @oh->ntlv. 636f1220db8SAlexander V. Chernikov * it inside @i. 637f1220db8SAlexander V. Chernikov * Returns 0 on success. 638f1220db8SAlexander V. Chernikov */ 639f1220db8SAlexander V. Chernikov static int 640ac35ff17SAlexander V. Chernikov table_get_info(ipfw_obj_header *oh, ipfw_xtable_info *i) 641f1220db8SAlexander V. Chernikov { 642f1220db8SAlexander V. Chernikov char tbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info)]; 643f1220db8SAlexander V. Chernikov size_t sz; 644f1220db8SAlexander V. Chernikov 645f1220db8SAlexander V. Chernikov sz = sizeof(tbuf); 646f1220db8SAlexander V. Chernikov memset(tbuf, 0, sizeof(tbuf)); 647ac35ff17SAlexander V. Chernikov memcpy(tbuf, oh, sizeof(*oh)); 648f1220db8SAlexander V. Chernikov oh = (ipfw_obj_header *)tbuf; 649f1220db8SAlexander V. Chernikov 650b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XINFO, &oh->opheader, &sz) != 0) 651b6462881SAlexander V. Chernikov return (errno); 652f1220db8SAlexander V. Chernikov 653f1220db8SAlexander V. Chernikov if (sz < sizeof(tbuf)) 654ac35ff17SAlexander V. Chernikov return (EINVAL); 655f1220db8SAlexander V. Chernikov 656f1220db8SAlexander V. Chernikov *i = *(ipfw_xtable_info *)(oh + 1); 657f1220db8SAlexander V. Chernikov 658f1220db8SAlexander V. Chernikov return (0); 659f1220db8SAlexander V. Chernikov } 660f1220db8SAlexander V. Chernikov 6615f379342SAlexander V. Chernikov static struct _s_x tablealgoclass[] = { 6625f379342SAlexander V. Chernikov { "hash", IPFW_TACLASS_HASH }, 6635f379342SAlexander V. Chernikov { "array", IPFW_TACLASS_ARRAY }, 6645f379342SAlexander V. Chernikov { "radix", IPFW_TACLASS_RADIX }, 6655f379342SAlexander V. Chernikov { NULL, 0 } 6665f379342SAlexander V. Chernikov }; 6675f379342SAlexander V. Chernikov 6685f379342SAlexander V. Chernikov struct ta_cldata { 6695f379342SAlexander V. Chernikov uint8_t taclass; 6705f379342SAlexander V. Chernikov uint8_t spare4; 6715f379342SAlexander V. Chernikov uint16_t itemsize; 6725f379342SAlexander V. Chernikov uint16_t itemsize6; 6735f379342SAlexander V. Chernikov uint32_t size; 6745f379342SAlexander V. Chernikov uint32_t count; 6755f379342SAlexander V. Chernikov }; 6765f379342SAlexander V. Chernikov 6775f379342SAlexander V. Chernikov /* 6785f379342SAlexander V. Chernikov * Print global/per-AF table @i algorithm info. 6795f379342SAlexander V. Chernikov */ 6805f379342SAlexander V. Chernikov static void 6815f379342SAlexander V. Chernikov table_show_tainfo(ipfw_xtable_info *i, struct ta_cldata *d, 6825f379342SAlexander V. Chernikov const char *af, const char *taclass) 6835f379342SAlexander V. Chernikov { 6845f379342SAlexander V. Chernikov 6855f379342SAlexander V. Chernikov switch (d->taclass) { 6865f379342SAlexander V. Chernikov case IPFW_TACLASS_HASH: 6875f379342SAlexander V. Chernikov case IPFW_TACLASS_ARRAY: 6885f379342SAlexander V. Chernikov printf(" %salgorithm %s info\n", af, taclass); 6895f379342SAlexander V. Chernikov if (d->itemsize == d->itemsize6) 6905f379342SAlexander V. Chernikov printf(" size: %u items: %u itemsize: %u\n", 6915f379342SAlexander V. Chernikov d->size, d->count, d->itemsize); 6925f379342SAlexander V. Chernikov else 6935f379342SAlexander V. Chernikov printf(" size: %u items: %u " 6945f379342SAlexander V. Chernikov "itemsize4: %u itemsize6: %u\n", 6955f379342SAlexander V. Chernikov d->size, d->count, 6965f379342SAlexander V. Chernikov d->itemsize, d->itemsize6); 6975f379342SAlexander V. Chernikov break; 6985f379342SAlexander V. Chernikov case IPFW_TACLASS_RADIX: 6995f379342SAlexander V. Chernikov printf(" %salgorithm %s info\n", af, taclass); 7005f379342SAlexander V. Chernikov if (d->itemsize == d->itemsize6) 7015f379342SAlexander V. Chernikov printf(" items: %u itemsize: %u\n", 7025f379342SAlexander V. Chernikov d->count, d->itemsize); 7035f379342SAlexander V. Chernikov else 7045f379342SAlexander V. Chernikov printf(" items: %u " 7055f379342SAlexander V. Chernikov "itemsize4: %u itemsize6: %u\n", 7065f379342SAlexander V. Chernikov d->count, d->itemsize, d->itemsize6); 7075f379342SAlexander V. Chernikov break; 7085f379342SAlexander V. Chernikov default: 7095f379342SAlexander V. Chernikov printf(" algo class: %s\n", taclass); 7105f379342SAlexander V. Chernikov } 7115f379342SAlexander V. Chernikov } 7125f379342SAlexander V. Chernikov 7130cba2b28SAlexander V. Chernikov static void 7140cba2b28SAlexander V. Chernikov table_print_valheader(char *buf, size_t bufsize, uint32_t vmask) 7150cba2b28SAlexander V. Chernikov { 7160cba2b28SAlexander V. Chernikov 7170cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 7180cba2b28SAlexander V. Chernikov snprintf(buf, bufsize, "legacy"); 7190cba2b28SAlexander V. Chernikov return; 7200cba2b28SAlexander V. Chernikov } 7210cba2b28SAlexander V. Chernikov 7220cba2b28SAlexander V. Chernikov print_flags_buffer(buf, bufsize, tablevaltypes, vmask); 7230cba2b28SAlexander V. Chernikov } 7240cba2b28SAlexander V. Chernikov 725f1220db8SAlexander V. Chernikov /* 726f1220db8SAlexander V. Chernikov * Prints table info struct @i in human-readable form. 727f1220db8SAlexander V. Chernikov */ 728f1220db8SAlexander V. Chernikov static int 729f1220db8SAlexander V. Chernikov table_show_info(ipfw_xtable_info *i, void *arg) 730f1220db8SAlexander V. Chernikov { 7310cba2b28SAlexander V. Chernikov const char *vtype; 7325f379342SAlexander V. Chernikov ipfw_ta_tinfo *tainfo; 7335f379342SAlexander V. Chernikov int afdata, afitem; 7345f379342SAlexander V. Chernikov struct ta_cldata d; 735adf3b2b9SAlexander V. Chernikov char ttype[64], tvtype[64]; 736f1220db8SAlexander V. Chernikov 737914bffb6SAlexander V. Chernikov table_print_type(ttype, sizeof(ttype), i->type, i->tflags); 7380cba2b28SAlexander V. Chernikov table_print_valheader(tvtype, sizeof(tvtype), i->vmask); 739ac35ff17SAlexander V. Chernikov 740914bffb6SAlexander V. Chernikov printf("--- table(%s), set(%u) ---\n", i->tablename, i->set); 7414f43138aSAlexander V. Chernikov if ((i->flags & IPFW_TGFLAGS_LOCKED) != 0) 7424f43138aSAlexander V. Chernikov printf(" kindex: %d, type: %s, locked\n", i->kidx, ttype); 7434f43138aSAlexander V. Chernikov else 744914bffb6SAlexander V. Chernikov printf(" kindex: %d, type: %s\n", i->kidx, ttype); 7450cba2b28SAlexander V. Chernikov printf(" references: %u, valtype: %s\n", i->refcnt, tvtype); 7469d099b4fSAlexander V. Chernikov printf(" algorithm: %s\n", i->algoname); 747f1220db8SAlexander V. Chernikov printf(" items: %u, size: %u\n", i->count, i->size); 7484c0c07a5SAlexander V. Chernikov if (i->limit > 0) 7494c0c07a5SAlexander V. Chernikov printf(" limit: %u\n", i->limit); 750f1220db8SAlexander V. Chernikov 751358b9d09SAlexander V. Chernikov /* Print algo-specific info if requested & set */ 752358b9d09SAlexander V. Chernikov if (arg == NULL) 753358b9d09SAlexander V. Chernikov return (0); 754358b9d09SAlexander V. Chernikov 7555f379342SAlexander V. Chernikov if ((i->ta_info.flags & IPFW_TATFLAGS_DATA) == 0) 7565f379342SAlexander V. Chernikov return (0); 7575f379342SAlexander V. Chernikov tainfo = &i->ta_info; 7585f379342SAlexander V. Chernikov 7595f379342SAlexander V. Chernikov afdata = 0; 7605f379342SAlexander V. Chernikov afitem = 0; 7615f379342SAlexander V. Chernikov if (tainfo->flags & IPFW_TATFLAGS_AFDATA) 7625f379342SAlexander V. Chernikov afdata = 1; 7635f379342SAlexander V. Chernikov if (tainfo->flags & IPFW_TATFLAGS_AFITEM) 7645f379342SAlexander V. Chernikov afitem = 1; 7655f379342SAlexander V. Chernikov 7665f379342SAlexander V. Chernikov memset(&d, 0, sizeof(d)); 7675f379342SAlexander V. Chernikov d.taclass = tainfo->taclass4; 7685f379342SAlexander V. Chernikov d.size = tainfo->size4; 7695f379342SAlexander V. Chernikov d.count = tainfo->count4; 7705f379342SAlexander V. Chernikov d.itemsize = tainfo->itemsize4; 7715f379342SAlexander V. Chernikov if (afdata == 0 && afitem != 0) 7725f379342SAlexander V. Chernikov d.itemsize6 = tainfo->itemsize6; 7735f379342SAlexander V. Chernikov else 7745f379342SAlexander V. Chernikov d.itemsize6 = d.itemsize; 7755f379342SAlexander V. Chernikov if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL) 7765f379342SAlexander V. Chernikov vtype = "unknown"; 7775f379342SAlexander V. Chernikov 7785f379342SAlexander V. Chernikov if (afdata == 0) { 7795f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "", vtype); 7805f379342SAlexander V. Chernikov } else { 7815f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "IPv4 ", vtype); 7825f379342SAlexander V. Chernikov memset(&d, 0, sizeof(d)); 7835f379342SAlexander V. Chernikov d.taclass = tainfo->taclass6; 7845f379342SAlexander V. Chernikov if ((vtype = match_value(tablealgoclass, d.taclass)) == NULL) 7855f379342SAlexander V. Chernikov vtype = "unknown"; 7865f379342SAlexander V. Chernikov d.size = tainfo->size6; 7875f379342SAlexander V. Chernikov d.count = tainfo->count6; 7885f379342SAlexander V. Chernikov d.itemsize = tainfo->itemsize6; 7895f379342SAlexander V. Chernikov d.itemsize6 = d.itemsize; 7905f379342SAlexander V. Chernikov table_show_tainfo(i, &d, "IPv6 ", vtype); 7915f379342SAlexander V. Chernikov } 7925f379342SAlexander V. Chernikov 793f1220db8SAlexander V. Chernikov return (0); 794f1220db8SAlexander V. Chernikov } 795f1220db8SAlexander V. Chernikov 796f1220db8SAlexander V. Chernikov 797f1220db8SAlexander V. Chernikov /* 798f1220db8SAlexander V. Chernikov * Function wrappers which can be used either 799f1220db8SAlexander V. Chernikov * as is or as foreach function parameter. 800f1220db8SAlexander V. Chernikov */ 801f1220db8SAlexander V. Chernikov 802f1220db8SAlexander V. Chernikov static int 803f1220db8SAlexander V. Chernikov table_show_one(ipfw_xtable_info *i, void *arg) 804f1220db8SAlexander V. Chernikov { 805f1220db8SAlexander V. Chernikov ipfw_obj_header *oh; 80681d3153dSAlexander V. Chernikov int error; 807f1220db8SAlexander V. Chernikov 808720ee730SAlexander V. Chernikov if ((error = table_do_get_list(i, &oh)) != 0) { 80981d3153dSAlexander V. Chernikov err(EX_OSERR, "Error requesting table %s list", i->tablename); 81081d3153dSAlexander V. Chernikov return (error); 81181d3153dSAlexander V. Chernikov } 81281d3153dSAlexander V. Chernikov 813f1220db8SAlexander V. Chernikov table_show_list(oh, 1); 814f1220db8SAlexander V. Chernikov 815f1220db8SAlexander V. Chernikov free(oh); 816f1220db8SAlexander V. Chernikov return (0); 817f1220db8SAlexander V. Chernikov } 818f1220db8SAlexander V. Chernikov 819f1220db8SAlexander V. Chernikov static int 820f1220db8SAlexander V. Chernikov table_flush_one(ipfw_xtable_info *i, void *arg) 821f1220db8SAlexander V. Chernikov { 822ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 823f1220db8SAlexander V. Chernikov 824ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)arg; 825ac35ff17SAlexander V. Chernikov 826ac35ff17SAlexander V. Chernikov table_fill_ntlv(&oh->ntlv, i->tablename, i->set, 1); 827ac35ff17SAlexander V. Chernikov 828ac35ff17SAlexander V. Chernikov return (table_flush(oh)); 829f1220db8SAlexander V. Chernikov } 830f1220db8SAlexander V. Chernikov 831ac35ff17SAlexander V. Chernikov static int 832ac35ff17SAlexander V. Chernikov table_do_modify_record(int cmd, ipfw_obj_header *oh, 8333a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, int count, int atomic) 834ac35ff17SAlexander V. Chernikov { 835db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 8363a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent_base; 8373a845e10SAlexander V. Chernikov caddr_t pbuf; 838db785d31SAlexander V. Chernikov char xbuf[sizeof(*oh) + sizeof(ipfw_obj_ctlv) + sizeof(*tent)]; 8393a845e10SAlexander V. Chernikov int error, i; 8403a845e10SAlexander V. Chernikov size_t sz; 841ac35ff17SAlexander V. Chernikov 8423a845e10SAlexander V. Chernikov sz = sizeof(*ctlv) + sizeof(*tent) * count; 8433a845e10SAlexander V. Chernikov if (count == 1) { 844ac35ff17SAlexander V. Chernikov memset(xbuf, 0, sizeof(xbuf)); 8453a845e10SAlexander V. Chernikov pbuf = xbuf; 8463a845e10SAlexander V. Chernikov } else { 8473a845e10SAlexander V. Chernikov if ((pbuf = calloc(1, sizeof(*oh) + sz)) == NULL) 8483a845e10SAlexander V. Chernikov return (ENOMEM); 8493a845e10SAlexander V. Chernikov } 8503a845e10SAlexander V. Chernikov 8513a845e10SAlexander V. Chernikov memcpy(pbuf, oh, sizeof(*oh)); 8523a845e10SAlexander V. Chernikov oh = (ipfw_obj_header *)pbuf; 853ac35ff17SAlexander V. Chernikov oh->opheader.version = 1; 854ac35ff17SAlexander V. Chernikov 855db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 8563a845e10SAlexander V. Chernikov ctlv->count = count; 8573a845e10SAlexander V. Chernikov ctlv->head.length = sz; 8583a845e10SAlexander V. Chernikov if (atomic != 0) 8593a845e10SAlexander V. Chernikov ctlv->flags |= IPFW_CTF_ATOMIC; 860db785d31SAlexander V. Chernikov 8613a845e10SAlexander V. Chernikov tent_base = tent; 8623a845e10SAlexander V. Chernikov memcpy(ctlv + 1, tent, sizeof(*tent) * count); 863db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 8643a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, tent++) { 865ac35ff17SAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 8663a845e10SAlexander V. Chernikov tent->idx = oh->idx; 8673a845e10SAlexander V. Chernikov } 868ac35ff17SAlexander V. Chernikov 8693a845e10SAlexander V. Chernikov sz += sizeof(*oh); 8703a845e10SAlexander V. Chernikov error = do_get3(cmd, &oh->opheader, &sz); 8713a845e10SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 8723a845e10SAlexander V. Chernikov /* Copy result back to provided buffer */ 8733a845e10SAlexander V. Chernikov memcpy(tent_base, ctlv + 1, sizeof(*tent) * count); 8743a845e10SAlexander V. Chernikov 8753a845e10SAlexander V. Chernikov if (pbuf != xbuf) 8763a845e10SAlexander V. Chernikov free(pbuf); 877ac35ff17SAlexander V. Chernikov 878ac35ff17SAlexander V. Chernikov return (error); 879ac35ff17SAlexander V. Chernikov } 880ac35ff17SAlexander V. Chernikov 881ac35ff17SAlexander V. Chernikov static void 8823a845e10SAlexander V. Chernikov table_modify_record(ipfw_obj_header *oh, int ac, char *av[], int add, 8833a845e10SAlexander V. Chernikov int quiet, int update, int atomic) 884ac35ff17SAlexander V. Chernikov { 8853a845e10SAlexander V. Chernikov ipfw_obj_tentry *ptent, tent, *tent_buf; 88681d3153dSAlexander V. Chernikov ipfw_xtable_info xi; 8870cba2b28SAlexander V. Chernikov uint8_t type; 8880cba2b28SAlexander V. Chernikov uint32_t vmask; 8893a845e10SAlexander V. Chernikov int cmd, count, error, i, ignored; 8903a845e10SAlexander V. Chernikov char *texterr, *etxt, *px; 891ac35ff17SAlexander V. Chernikov 892ac35ff17SAlexander V. Chernikov if (ac == 0) 893ac35ff17SAlexander V. Chernikov errx(EX_USAGE, "address required"); 894ac35ff17SAlexander V. Chernikov 895ac35ff17SAlexander V. Chernikov if (add != 0) { 896ac35ff17SAlexander V. Chernikov cmd = IP_FW_TABLE_XADD; 8974c0c07a5SAlexander V. Chernikov texterr = "Adding record failed"; 898ac35ff17SAlexander V. Chernikov } else { 899ac35ff17SAlexander V. Chernikov cmd = IP_FW_TABLE_XDEL; 9004c0c07a5SAlexander V. Chernikov texterr = "Deleting record failed"; 901ac35ff17SAlexander V. Chernikov } 902ac35ff17SAlexander V. Chernikov 9033a845e10SAlexander V. Chernikov /* 9043a845e10SAlexander V. Chernikov * Calculate number of entries: 9053a845e10SAlexander V. Chernikov * Assume [key val] x N for add 9063a845e10SAlexander V. Chernikov * and 9073a845e10SAlexander V. Chernikov * key x N for delete 9083a845e10SAlexander V. Chernikov */ 9093a845e10SAlexander V. Chernikov count = (add != 0) ? ac / 2 + 1 : ac; 9103a845e10SAlexander V. Chernikov 9113a845e10SAlexander V. Chernikov if (count <= 1) { 9123a845e10SAlexander V. Chernikov /* Adding single entry with/without value */ 9133a845e10SAlexander V. Chernikov memset(&tent, 0, sizeof(tent)); 9143a845e10SAlexander V. Chernikov tent_buf = &tent; 9153a845e10SAlexander V. Chernikov } else { 9163a845e10SAlexander V. Chernikov 9173a845e10SAlexander V. Chernikov if ((tent_buf = calloc(count, sizeof(tent))) == NULL) 9183a845e10SAlexander V. Chernikov errx(EX_OSERR, 9193a845e10SAlexander V. Chernikov "Unable to allocate memory for all entries"); 9203a845e10SAlexander V. Chernikov } 9213a845e10SAlexander V. Chernikov ptent = tent_buf; 9223a845e10SAlexander V. Chernikov 9233a845e10SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 9243a845e10SAlexander V. Chernikov count = 0; 9253a845e10SAlexander V. Chernikov while (ac > 0) { 9260cba2b28SAlexander V. Chernikov tentry_fill_key(oh, ptent, *av, add, &type, &vmask, &xi); 9273a845e10SAlexander V. Chernikov 9283a845e10SAlexander V. Chernikov /* 9293a845e10SAlexander V. Chernikov * compability layer: auto-create table if not exists 9303a845e10SAlexander V. Chernikov */ 9313a845e10SAlexander V. Chernikov if (xi.tablename[0] == '\0') { 9323a845e10SAlexander V. Chernikov xi.type = type; 9330cba2b28SAlexander V. Chernikov xi.vmask = vmask; 9343a845e10SAlexander V. Chernikov strlcpy(xi.tablename, oh->ntlv.name, 9353a845e10SAlexander V. Chernikov sizeof(xi.tablename)); 9363a845e10SAlexander V. Chernikov fprintf(stderr, "DEPRECATED: inserting data info " 9373a845e10SAlexander V. Chernikov "non-existent table %s. (auto-created)\n", 9383a845e10SAlexander V. Chernikov xi.tablename); 9393a845e10SAlexander V. Chernikov table_do_create(oh, &xi); 9403a845e10SAlexander V. Chernikov } 9413a845e10SAlexander V. Chernikov 9423a845e10SAlexander V. Chernikov oh->ntlv.type = type; 9433a845e10SAlexander V. Chernikov ac--; av++; 9443a845e10SAlexander V. Chernikov 9453a845e10SAlexander V. Chernikov if (add != 0 && ac > 0) { 9460cba2b28SAlexander V. Chernikov tentry_fill_value(oh, ptent, *av, type, vmask); 9473a845e10SAlexander V. Chernikov ac--; av++; 9483a845e10SAlexander V. Chernikov } 9493a845e10SAlexander V. Chernikov 9503a845e10SAlexander V. Chernikov if (update != 0) 9513a845e10SAlexander V. Chernikov ptent->head.flags |= IPFW_TF_UPDATE; 9523a845e10SAlexander V. Chernikov 9533a845e10SAlexander V. Chernikov count++; 9543a845e10SAlexander V. Chernikov ptent++; 9553a845e10SAlexander V. Chernikov } 9563a845e10SAlexander V. Chernikov 9573a845e10SAlexander V. Chernikov error = table_do_modify_record(cmd, oh, tent_buf, count, atomic); 9583a845e10SAlexander V. Chernikov 9590cba2b28SAlexander V. Chernikov quiet = 0; 9600cba2b28SAlexander V. Chernikov 9613a845e10SAlexander V. Chernikov /* 9623a845e10SAlexander V. Chernikov * Compatibility stuff: do not yell on duplicate keys or 9633a845e10SAlexander V. Chernikov * failed deletions. 9643a845e10SAlexander V. Chernikov */ 9653a845e10SAlexander V. Chernikov if (error == 0 || (error == EEXIST && add != 0) || 9663a845e10SAlexander V. Chernikov (error == ENOENT && add == 0)) { 9673a845e10SAlexander V. Chernikov if (quiet != 0) { 9683a845e10SAlexander V. Chernikov if (tent_buf != &tent) 9693a845e10SAlexander V. Chernikov free(tent_buf); 9703a845e10SAlexander V. Chernikov return; 9713a845e10SAlexander V. Chernikov } 9723a845e10SAlexander V. Chernikov } 9733a845e10SAlexander V. Chernikov 9743a845e10SAlexander V. Chernikov /* Report results back */ 9753a845e10SAlexander V. Chernikov ptent = tent_buf; 9763a845e10SAlexander V. Chernikov for (i = 0; i < count; ptent++, i++) { 9773a845e10SAlexander V. Chernikov ignored = 0; 9783a845e10SAlexander V. Chernikov switch (ptent->result) { 9793a845e10SAlexander V. Chernikov case IPFW_TR_ADDED: 9803a845e10SAlexander V. Chernikov px = "added"; 9813a845e10SAlexander V. Chernikov break; 9823a845e10SAlexander V. Chernikov case IPFW_TR_DELETED: 9833a845e10SAlexander V. Chernikov px = "deleted"; 9843a845e10SAlexander V. Chernikov break; 9853a845e10SAlexander V. Chernikov case IPFW_TR_UPDATED: 9863a845e10SAlexander V. Chernikov px = "updated"; 9873a845e10SAlexander V. Chernikov break; 9883a845e10SAlexander V. Chernikov case IPFW_TR_LIMIT: 9893a845e10SAlexander V. Chernikov px = "limit"; 9903a845e10SAlexander V. Chernikov ignored = 1; 9913a845e10SAlexander V. Chernikov break; 9923a845e10SAlexander V. Chernikov case IPFW_TR_ERROR: 9933a845e10SAlexander V. Chernikov px = "error"; 9943a845e10SAlexander V. Chernikov ignored = 1; 9953a845e10SAlexander V. Chernikov break; 9963a845e10SAlexander V. Chernikov case IPFW_TR_NOTFOUND: 9973a845e10SAlexander V. Chernikov px = "notfound"; 9983a845e10SAlexander V. Chernikov ignored = 1; 9993a845e10SAlexander V. Chernikov break; 10003a845e10SAlexander V. Chernikov case IPFW_TR_EXISTS: 10013a845e10SAlexander V. Chernikov px = "exists"; 10023a845e10SAlexander V. Chernikov ignored = 1; 10033a845e10SAlexander V. Chernikov break; 10043a845e10SAlexander V. Chernikov case IPFW_TR_IGNORED: 10053a845e10SAlexander V. Chernikov px = "ignored"; 10063a845e10SAlexander V. Chernikov ignored = 1; 10073a845e10SAlexander V. Chernikov break; 10083a845e10SAlexander V. Chernikov default: 10093a845e10SAlexander V. Chernikov px = "unknown"; 10103a845e10SAlexander V. Chernikov ignored = 1; 10113a845e10SAlexander V. Chernikov } 10123a845e10SAlexander V. Chernikov 10133a845e10SAlexander V. Chernikov if (error != 0 && atomic != 0 && ignored == 0) 10143a845e10SAlexander V. Chernikov printf("%s(reverted): ", px); 10153a845e10SAlexander V. Chernikov else 10163a845e10SAlexander V. Chernikov printf("%s: ", px); 10173a845e10SAlexander V. Chernikov 10183a845e10SAlexander V. Chernikov table_show_entry(&xi, ptent); 10193a845e10SAlexander V. Chernikov } 10203a845e10SAlexander V. Chernikov 10213a845e10SAlexander V. Chernikov if (tent_buf != &tent) 10223a845e10SAlexander V. Chernikov free(tent_buf); 10233a845e10SAlexander V. Chernikov 10243a845e10SAlexander V. Chernikov if (error == 0) 10254c0c07a5SAlexander V. Chernikov return; 10264c0c07a5SAlexander V. Chernikov 10274c0c07a5SAlexander V. Chernikov /* Try to provide more human-readable error */ 10284c0c07a5SAlexander V. Chernikov switch (error) { 10294c0c07a5SAlexander V. Chernikov case EEXIST: 10304c0c07a5SAlexander V. Chernikov etxt = "record already exists"; 10314c0c07a5SAlexander V. Chernikov break; 10324c0c07a5SAlexander V. Chernikov case EFBIG: 10334c0c07a5SAlexander V. Chernikov etxt = "limit hit"; 10344c0c07a5SAlexander V. Chernikov break; 10354c0c07a5SAlexander V. Chernikov case ESRCH: 10364c0c07a5SAlexander V. Chernikov etxt = "table not found"; 10374c0c07a5SAlexander V. Chernikov break; 10384c0c07a5SAlexander V. Chernikov case ENOENT: 10394c0c07a5SAlexander V. Chernikov etxt = "record not found"; 10404c0c07a5SAlexander V. Chernikov break; 10414f43138aSAlexander V. Chernikov case EACCES: 10424f43138aSAlexander V. Chernikov etxt = "table is locked"; 10434f43138aSAlexander V. Chernikov break; 10444c0c07a5SAlexander V. Chernikov default: 10454c0c07a5SAlexander V. Chernikov etxt = strerror(error); 10464c0c07a5SAlexander V. Chernikov } 10474c0c07a5SAlexander V. Chernikov 10484c0c07a5SAlexander V. Chernikov errx(EX_OSERR, "%s: %s", texterr, etxt); 1049ac35ff17SAlexander V. Chernikov } 1050ac35ff17SAlexander V. Chernikov 105181d3153dSAlexander V. Chernikov static int 105281d3153dSAlexander V. Chernikov table_do_lookup(ipfw_obj_header *oh, char *key, ipfw_xtable_info *xi, 105381d3153dSAlexander V. Chernikov ipfw_obj_tentry *xtent) 105481d3153dSAlexander V. Chernikov { 105581d3153dSAlexander V. Chernikov char xbuf[sizeof(ipfw_obj_header) + sizeof(ipfw_obj_tentry)]; 105681d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 10570cba2b28SAlexander V. Chernikov uint8_t type; 10580cba2b28SAlexander V. Chernikov uint32_t vmask; 105981d3153dSAlexander V. Chernikov size_t sz; 106081d3153dSAlexander V. Chernikov 106181d3153dSAlexander V. Chernikov memcpy(xbuf, oh, sizeof(*oh)); 106281d3153dSAlexander V. Chernikov oh = (ipfw_obj_header *)xbuf; 106381d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 106481d3153dSAlexander V. Chernikov 106581d3153dSAlexander V. Chernikov memset(tent, 0, sizeof(*tent)); 106681d3153dSAlexander V. Chernikov tent->head.length = sizeof(*tent); 106781d3153dSAlexander V. Chernikov tent->idx = 1; 106881d3153dSAlexander V. Chernikov 10690cba2b28SAlexander V. Chernikov tentry_fill_key(oh, tent, key, 0, &type, &vmask, xi); 107081d3153dSAlexander V. Chernikov oh->ntlv.type = type; 107181d3153dSAlexander V. Chernikov 107281d3153dSAlexander V. Chernikov sz = sizeof(xbuf); 1073b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XFIND, &oh->opheader, &sz) != 0) 1074b6462881SAlexander V. Chernikov return (errno); 107581d3153dSAlexander V. Chernikov 107681d3153dSAlexander V. Chernikov if (sz < sizeof(xbuf)) 107781d3153dSAlexander V. Chernikov return (EINVAL); 107881d3153dSAlexander V. Chernikov 107981d3153dSAlexander V. Chernikov *xtent = *tent; 108081d3153dSAlexander V. Chernikov 108181d3153dSAlexander V. Chernikov return (0); 108281d3153dSAlexander V. Chernikov } 108381d3153dSAlexander V. Chernikov 108481d3153dSAlexander V. Chernikov static void 108581d3153dSAlexander V. Chernikov table_lookup(ipfw_obj_header *oh, int ac, char *av[]) 108681d3153dSAlexander V. Chernikov { 108781d3153dSAlexander V. Chernikov ipfw_obj_tentry xtent; 108881d3153dSAlexander V. Chernikov ipfw_xtable_info xi; 1089914bffb6SAlexander V. Chernikov char key[64]; 109081d3153dSAlexander V. Chernikov int error; 109181d3153dSAlexander V. Chernikov 109281d3153dSAlexander V. Chernikov if (ac == 0) 109381d3153dSAlexander V. Chernikov errx(EX_USAGE, "address required"); 109481d3153dSAlexander V. Chernikov 1095914bffb6SAlexander V. Chernikov strlcpy(key, *av, sizeof(key)); 1096914bffb6SAlexander V. Chernikov 10973a845e10SAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 1098914bffb6SAlexander V. Chernikov error = table_do_lookup(oh, key, &xi, &xtent); 109981d3153dSAlexander V. Chernikov 110081d3153dSAlexander V. Chernikov switch (error) { 110181d3153dSAlexander V. Chernikov case 0: 110281d3153dSAlexander V. Chernikov break; 110381d3153dSAlexander V. Chernikov case ESRCH: 110481d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Table %s not found", oh->ntlv.name); 110581d3153dSAlexander V. Chernikov case ENOENT: 110681d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Entry %s not found", *av); 110781d3153dSAlexander V. Chernikov case ENOTSUP: 110881d3153dSAlexander V. Chernikov errx(EX_UNAVAILABLE, "Table %s algo does not support " 110981d3153dSAlexander V. Chernikov "\"lookup\" method", oh->ntlv.name); 111081d3153dSAlexander V. Chernikov default: 111181d3153dSAlexander V. Chernikov err(EX_OSERR, "getsockopt(IP_FW_TABLE_XFIND)"); 111281d3153dSAlexander V. Chernikov } 111381d3153dSAlexander V. Chernikov 111481d3153dSAlexander V. Chernikov table_show_entry(&xi, &xtent); 111581d3153dSAlexander V. Chernikov } 1116ac35ff17SAlexander V. Chernikov 1117ac35ff17SAlexander V. Chernikov static void 1118914bffb6SAlexander V. Chernikov tentry_fill_key_type(char *arg, ipfw_obj_tentry *tentry, uint8_t type, 1119914bffb6SAlexander V. Chernikov uint8_t tflags) 1120ac35ff17SAlexander V. Chernikov { 1121914bffb6SAlexander V. Chernikov char *p, *pp; 1122ac35ff17SAlexander V. Chernikov int mask, af; 1123914bffb6SAlexander V. Chernikov struct in6_addr *paddr, tmp; 1124914bffb6SAlexander V. Chernikov struct tflow_entry *tfe; 1125ac35ff17SAlexander V. Chernikov uint32_t key, *pkey; 1126914bffb6SAlexander V. Chernikov uint16_t port; 1127914bffb6SAlexander V. Chernikov struct protoent *pent; 1128914bffb6SAlexander V. Chernikov struct servent *sent; 1129ac35ff17SAlexander V. Chernikov int masklen; 1130ac35ff17SAlexander V. Chernikov 1131ac35ff17SAlexander V. Chernikov masklen = 0; 1132ac35ff17SAlexander V. Chernikov af = 0; 1133ac35ff17SAlexander V. Chernikov paddr = (struct in6_addr *)&tentry->k; 1134ac35ff17SAlexander V. Chernikov 1135ac35ff17SAlexander V. Chernikov switch (type) { 1136c21034b7SAlexander V. Chernikov case IPFW_TABLE_ADDR: 1137ac35ff17SAlexander V. Chernikov /* Remove / if exists */ 1138ac35ff17SAlexander V. Chernikov if ((p = strchr(arg, '/')) != NULL) { 1139ac35ff17SAlexander V. Chernikov *p = '\0'; 1140ac35ff17SAlexander V. Chernikov mask = atoi(p + 1); 1141ac35ff17SAlexander V. Chernikov } 1142ac35ff17SAlexander V. Chernikov 1143ac35ff17SAlexander V. Chernikov if (inet_pton(AF_INET, arg, paddr) == 1) { 1144ac35ff17SAlexander V. Chernikov if (p != NULL && mask > 32) 1145ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "bad IPv4 mask width: %s", 1146ac35ff17SAlexander V. Chernikov p + 1); 1147ac35ff17SAlexander V. Chernikov 1148ac35ff17SAlexander V. Chernikov masklen = p ? mask : 32; 1149ac35ff17SAlexander V. Chernikov af = AF_INET; 1150ac35ff17SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, paddr) == 1) { 1151ac35ff17SAlexander V. Chernikov if (IN6_IS_ADDR_V4COMPAT(paddr)) 1152ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, 1153ac35ff17SAlexander V. Chernikov "Use IPv4 instead of v4-compatible"); 1154ac35ff17SAlexander V. Chernikov if (p != NULL && mask > 128) 1155ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "bad IPv6 mask width: %s", 1156ac35ff17SAlexander V. Chernikov p + 1); 1157ac35ff17SAlexander V. Chernikov 1158ac35ff17SAlexander V. Chernikov masklen = p ? mask : 128; 1159ac35ff17SAlexander V. Chernikov af = AF_INET6; 1160ac35ff17SAlexander V. Chernikov } else { 1161ac35ff17SAlexander V. Chernikov /* Assume FQDN */ 1162ac35ff17SAlexander V. Chernikov if (lookup_host(arg, (struct in_addr *)paddr) != 0) 1163ac35ff17SAlexander V. Chernikov errx(EX_NOHOST, "hostname ``%s'' unknown", arg); 1164ac35ff17SAlexander V. Chernikov 1165ac35ff17SAlexander V. Chernikov masklen = 32; 1166c21034b7SAlexander V. Chernikov type = IPFW_TABLE_ADDR; 1167ac35ff17SAlexander V. Chernikov af = AF_INET; 1168ac35ff17SAlexander V. Chernikov } 1169ac35ff17SAlexander V. Chernikov break; 1170ac35ff17SAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 1171ac35ff17SAlexander V. Chernikov /* Assume interface name. Copy significant data only */ 1172ac35ff17SAlexander V. Chernikov mask = MIN(strlen(arg), IF_NAMESIZE - 1); 1173ac35ff17SAlexander V. Chernikov memcpy(paddr, arg, mask); 1174ac35ff17SAlexander V. Chernikov /* Set mask to exact match */ 1175ac35ff17SAlexander V. Chernikov masklen = 8 * IF_NAMESIZE; 1176ac35ff17SAlexander V. Chernikov break; 1177b23d5de9SAlexander V. Chernikov case IPFW_TABLE_NUMBER: 1178ac35ff17SAlexander V. Chernikov /* Port or any other key */ 1179ac35ff17SAlexander V. Chernikov key = strtol(arg, &p, 10); 1180ac35ff17SAlexander V. Chernikov if (*p != '\0') 1181ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "Invalid number: %s", arg); 1182ac35ff17SAlexander V. Chernikov 1183ac35ff17SAlexander V. Chernikov pkey = (uint32_t *)paddr; 1184ac35ff17SAlexander V. Chernikov *pkey = key; 1185ac35ff17SAlexander V. Chernikov masklen = 32; 1186ac35ff17SAlexander V. Chernikov break; 1187914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 1188914bffb6SAlexander V. Chernikov /* Assume [src-ip][,proto][,src-port][,dst-ip][,dst-port] */ 1189914bffb6SAlexander V. Chernikov tfe = &tentry->k.flow; 1190914bffb6SAlexander V. Chernikov af = 0; 1191914bffb6SAlexander V. Chernikov 1192914bffb6SAlexander V. Chernikov /* Handle <ipv4|ipv6> */ 1193914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_SRCIP) != 0) { 1194914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1195914bffb6SAlexander V. Chernikov *p++ = '\0'; 1196914bffb6SAlexander V. Chernikov /* Determine family using temporary storage */ 1197914bffb6SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &tmp) == 1) { 1198914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET) 1199914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1200914bffb6SAlexander V. Chernikov "Inconsistent address family\n"); 1201914bffb6SAlexander V. Chernikov af = AF_INET; 1202914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a4.sip, &tmp, 4); 1203914bffb6SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, &tmp) == 1) { 1204914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET6) 1205914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1206914bffb6SAlexander V. Chernikov "Inconsistent address family\n"); 1207914bffb6SAlexander V. Chernikov af = AF_INET6; 1208914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a6.sip6, &tmp, 16); 1209914bffb6SAlexander V. Chernikov } 1210914bffb6SAlexander V. Chernikov 1211914bffb6SAlexander V. Chernikov arg = p; 1212914bffb6SAlexander V. Chernikov } 1213914bffb6SAlexander V. Chernikov 1214914bffb6SAlexander V. Chernikov /* Handle <proto-num|proto-name> */ 1215914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_PROTO) != 0) { 121635df97d0SAlexander V. Chernikov if (arg == NULL) 121735df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: proto missing"); 1218914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1219914bffb6SAlexander V. Chernikov *p++ = '\0'; 1220914bffb6SAlexander V. Chernikov 1221914bffb6SAlexander V. Chernikov key = strtol(arg, &pp, 10); 1222914bffb6SAlexander V. Chernikov if (*pp != '\0') { 1223914bffb6SAlexander V. Chernikov if ((pent = getprotobyname(arg)) == NULL) 1224914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown proto: %s", 1225914bffb6SAlexander V. Chernikov arg); 1226914bffb6SAlexander V. Chernikov else 1227914bffb6SAlexander V. Chernikov key = pent->p_proto; 1228914bffb6SAlexander V. Chernikov } 1229914bffb6SAlexander V. Chernikov 1230914bffb6SAlexander V. Chernikov if (key > 255) 1231914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Bad protocol number: %u",key); 1232914bffb6SAlexander V. Chernikov 1233914bffb6SAlexander V. Chernikov tfe->proto = key; 1234914bffb6SAlexander V. Chernikov 1235914bffb6SAlexander V. Chernikov arg = p; 1236914bffb6SAlexander V. Chernikov } 1237914bffb6SAlexander V. Chernikov 1238914bffb6SAlexander V. Chernikov /* Handle <port-num|service-name> */ 1239914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_SRCPORT) != 0) { 124035df97d0SAlexander V. Chernikov if (arg == NULL) 124135df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: src port missing"); 1242914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1243914bffb6SAlexander V. Chernikov *p++ = '\0'; 1244914bffb6SAlexander V. Chernikov 1245914bffb6SAlexander V. Chernikov if ((port = htons(strtol(arg, NULL, 10))) == 0) { 1246914bffb6SAlexander V. Chernikov if ((sent = getservbyname(arg, NULL)) == NULL) 1247914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown service: %s", 1248914bffb6SAlexander V. Chernikov arg); 1249914bffb6SAlexander V. Chernikov else 1250914bffb6SAlexander V. Chernikov key = sent->s_port; 1251914bffb6SAlexander V. Chernikov } 1252914bffb6SAlexander V. Chernikov 1253914bffb6SAlexander V. Chernikov tfe->sport = port; 1254914bffb6SAlexander V. Chernikov 1255914bffb6SAlexander V. Chernikov arg = p; 1256914bffb6SAlexander V. Chernikov } 1257914bffb6SAlexander V. Chernikov 1258914bffb6SAlexander V. Chernikov /* Handle <ipv4|ipv6>*/ 1259914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_DSTIP) != 0) { 126035df97d0SAlexander V. Chernikov if (arg == NULL) 126135df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: dst ip missing"); 1262914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1263914bffb6SAlexander V. Chernikov *p++ = '\0'; 1264914bffb6SAlexander V. Chernikov /* Determine family using temporary storage */ 1265914bffb6SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &tmp) == 1) { 1266914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET) 1267914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1268914bffb6SAlexander V. Chernikov "Inconsistent address family"); 1269914bffb6SAlexander V. Chernikov af = AF_INET; 1270914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a4.dip, &tmp, 4); 1271914bffb6SAlexander V. Chernikov } else if (inet_pton(AF_INET6, arg, &tmp) == 1) { 1272914bffb6SAlexander V. Chernikov if (af != 0 && af != AF_INET6) 1273914bffb6SAlexander V. Chernikov errx(EX_DATAERR, 1274914bffb6SAlexander V. Chernikov "Inconsistent address family"); 1275914bffb6SAlexander V. Chernikov af = AF_INET6; 1276914bffb6SAlexander V. Chernikov memcpy(&tfe->a.a6.dip6, &tmp, 16); 1277914bffb6SAlexander V. Chernikov } 1278914bffb6SAlexander V. Chernikov 1279914bffb6SAlexander V. Chernikov arg = p; 1280914bffb6SAlexander V. Chernikov } 1281914bffb6SAlexander V. Chernikov 1282914bffb6SAlexander V. Chernikov /* Handle <port-num|service-name> */ 1283914bffb6SAlexander V. Chernikov if ((tflags & IPFW_TFFLAG_DSTPORT) != 0) { 128435df97d0SAlexander V. Chernikov if (arg == NULL) 128535df97d0SAlexander V. Chernikov errx(EX_DATAERR, "invalid key: dst port missing"); 1286914bffb6SAlexander V. Chernikov if ((p = strchr(arg, ',')) != NULL) 1287914bffb6SAlexander V. Chernikov *p++ = '\0'; 1288914bffb6SAlexander V. Chernikov 1289914bffb6SAlexander V. Chernikov if ((port = htons(strtol(arg, NULL, 10))) == 0) { 1290914bffb6SAlexander V. Chernikov if ((sent = getservbyname(arg, NULL)) == NULL) 1291914bffb6SAlexander V. Chernikov errx(EX_DATAERR, "Unknown service: %s", 1292914bffb6SAlexander V. Chernikov arg); 1293914bffb6SAlexander V. Chernikov else 1294914bffb6SAlexander V. Chernikov key = sent->s_port; 1295914bffb6SAlexander V. Chernikov } 1296914bffb6SAlexander V. Chernikov 1297914bffb6SAlexander V. Chernikov tfe->dport = port; 1298914bffb6SAlexander V. Chernikov 1299914bffb6SAlexander V. Chernikov arg = p; 1300914bffb6SAlexander V. Chernikov } 1301914bffb6SAlexander V. Chernikov 1302914bffb6SAlexander V. Chernikov tfe->af = af; 1303914bffb6SAlexander V. Chernikov 1304914bffb6SAlexander V. Chernikov break; 1305914bffb6SAlexander V. Chernikov 1306ac35ff17SAlexander V. Chernikov default: 1307ac35ff17SAlexander V. Chernikov errx(EX_DATAERR, "Unsupported table type: %d", type); 1308ac35ff17SAlexander V. Chernikov } 1309ac35ff17SAlexander V. Chernikov 1310ac35ff17SAlexander V. Chernikov tentry->subtype = af; 1311ac35ff17SAlexander V. Chernikov tentry->masklen = masklen; 1312ac35ff17SAlexander V. Chernikov } 1313ac35ff17SAlexander V. Chernikov 1314ac35ff17SAlexander V. Chernikov static void 1315ac35ff17SAlexander V. Chernikov tentry_fill_key(ipfw_obj_header *oh, ipfw_obj_tentry *tent, char *key, 13160cba2b28SAlexander V. Chernikov int add, uint8_t *ptype, uint32_t *pvmask, ipfw_xtable_info *xi) 1317ac35ff17SAlexander V. Chernikov { 13180cba2b28SAlexander V. Chernikov uint8_t type, tflags; 13190cba2b28SAlexander V. Chernikov uint32_t vmask; 1320ac35ff17SAlexander V. Chernikov int error; 1321db785d31SAlexander V. Chernikov char *del; 1322ac35ff17SAlexander V. Chernikov 1323ac35ff17SAlexander V. Chernikov type = 0; 1324914bffb6SAlexander V. Chernikov tflags = 0; 13250cba2b28SAlexander V. Chernikov vmask = 0; 1326ac35ff17SAlexander V. Chernikov 13273a845e10SAlexander V. Chernikov if (xi->tablename[0] == '\0') 132881d3153dSAlexander V. Chernikov error = table_get_info(oh, xi); 13293a845e10SAlexander V. Chernikov else 13303a845e10SAlexander V. Chernikov error = 0; 133181d3153dSAlexander V. Chernikov 133281d3153dSAlexander V. Chernikov if (error == 0) { 133381d3153dSAlexander V. Chernikov /* Table found. */ 133481d3153dSAlexander V. Chernikov type = xi->type; 1335914bffb6SAlexander V. Chernikov tflags = xi->tflags; 13360cba2b28SAlexander V. Chernikov vmask = xi->vmask; 133781d3153dSAlexander V. Chernikov } else { 133881d3153dSAlexander V. Chernikov if (error != ESRCH) 133981d3153dSAlexander V. Chernikov errx(EX_OSERR, "Error requesting table %s info", 134081d3153dSAlexander V. Chernikov oh->ntlv.name); 134135df97d0SAlexander V. Chernikov if (add == 0) 134235df97d0SAlexander V. Chernikov errx(EX_DATAERR, "Table %s does not exist", 134335df97d0SAlexander V. Chernikov oh->ntlv.name); 1344ac35ff17SAlexander V. Chernikov /* 134581d3153dSAlexander V. Chernikov * Table does not exist. 1346c21034b7SAlexander V. Chernikov * Compability layer: try to interpret data as ADDR 134781d3153dSAlexander V. Chernikov * before failing. 1348ac35ff17SAlexander V. Chernikov */ 1349db785d31SAlexander V. Chernikov if ((del = strchr(key, '/')) != NULL) 1350db785d31SAlexander V. Chernikov *del = '\0'; 1351ac35ff17SAlexander V. Chernikov if (inet_pton(AF_INET, key, &tent->k.addr6) == 1 || 1352ac35ff17SAlexander V. Chernikov inet_pton(AF_INET6, key, &tent->k.addr6) == 1) { 1353ac35ff17SAlexander V. Chernikov /* OK Prepare and send */ 1354c21034b7SAlexander V. Chernikov type = IPFW_TABLE_ADDR; 13550cba2b28SAlexander V. Chernikov vmask = IPFW_VTYPE_LEGACY; 135681d3153dSAlexander V. Chernikov } else { 135781d3153dSAlexander V. Chernikov /* Inknown key */ 135881d3153dSAlexander V. Chernikov errx(EX_USAGE, "Table %s does not exist, cannot guess " 1359db785d31SAlexander V. Chernikov "key '%s' type", oh->ntlv.name, key); 136081d3153dSAlexander V. Chernikov } 1361db785d31SAlexander V. Chernikov if (del != NULL) 1362db785d31SAlexander V. Chernikov *del = '/'; 1363ac35ff17SAlexander V. Chernikov } 1364ac35ff17SAlexander V. Chernikov 1365914bffb6SAlexander V. Chernikov tentry_fill_key_type(key, tent, type, tflags); 1366ac35ff17SAlexander V. Chernikov 1367ac35ff17SAlexander V. Chernikov *ptype = type; 13680cba2b28SAlexander V. Chernikov *pvmask = vmask; 13690cba2b28SAlexander V. Chernikov } 13700cba2b28SAlexander V. Chernikov 13710cba2b28SAlexander V. Chernikov static void 13720cba2b28SAlexander V. Chernikov set_legacy_value(uint32_t val, ipfw_table_value *v) 13730cba2b28SAlexander V. Chernikov { 13740cba2b28SAlexander V. Chernikov v->tag = val; 13750cba2b28SAlexander V. Chernikov v->pipe = val; 13760cba2b28SAlexander V. Chernikov v->divert = val; 13770cba2b28SAlexander V. Chernikov v->skipto = val; 13780cba2b28SAlexander V. Chernikov v->netgraph = val; 13790cba2b28SAlexander V. Chernikov v->fib = val; 13800cba2b28SAlexander V. Chernikov v->nat = val; 13810cba2b28SAlexander V. Chernikov v->nh4 = val; 13820cba2b28SAlexander V. Chernikov v->dscp = (uint8_t)val; 13830cba2b28SAlexander V. Chernikov v->limit = val; 1384ac35ff17SAlexander V. Chernikov } 1385ac35ff17SAlexander V. Chernikov 1386ac35ff17SAlexander V. Chernikov static void 1387ac35ff17SAlexander V. Chernikov tentry_fill_value(ipfw_obj_header *oh, ipfw_obj_tentry *tent, char *arg, 13880cba2b28SAlexander V. Chernikov uint8_t type, uint32_t vmask) 1389ac35ff17SAlexander V. Chernikov { 13900cba2b28SAlexander V. Chernikov uint32_t a4, flag, val, vm; 13910cba2b28SAlexander V. Chernikov ipfw_table_value *v; 13920cba2b28SAlexander V. Chernikov uint32_t i; 13930cba2b28SAlexander V. Chernikov char *comma, *e, *etype, *n, *p; 1394ac35ff17SAlexander V. Chernikov 13950cba2b28SAlexander V. Chernikov v = &tent->v.value; 13960cba2b28SAlexander V. Chernikov vm = vmask; 13970cba2b28SAlexander V. Chernikov 13980cba2b28SAlexander V. Chernikov /* Compat layer: keep old behavior for legacy value types */ 13990cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 1400adf3b2b9SAlexander V. Chernikov /* Try to interpret as number first */ 14010cba2b28SAlexander V. Chernikov val = strtoul(arg, &p, 0); 14020cba2b28SAlexander V. Chernikov if (*p == '\0') { 14030cba2b28SAlexander V. Chernikov set_legacy_value(val, v); 1404adf3b2b9SAlexander V. Chernikov return; 14050cba2b28SAlexander V. Chernikov } 1406adf3b2b9SAlexander V. Chernikov if (inet_pton(AF_INET, arg, &val) == 1) { 14070cba2b28SAlexander V. Chernikov set_legacy_value(ntohl(val), v); 1408adf3b2b9SAlexander V. Chernikov return; 1409adf3b2b9SAlexander V. Chernikov } 1410adf3b2b9SAlexander V. Chernikov /* Try hostname */ 14110cba2b28SAlexander V. Chernikov if (lookup_host(arg, (struct in_addr *)&val) == 0) { 14120cba2b28SAlexander V. Chernikov set_legacy_value(val, v); 1413adf3b2b9SAlexander V. Chernikov return; 14140cba2b28SAlexander V. Chernikov } 1415adf3b2b9SAlexander V. Chernikov errx(EX_OSERR, "Unable to parse value %s", arg); 14160cba2b28SAlexander V. Chernikov } 14170cba2b28SAlexander V. Chernikov 14180cba2b28SAlexander V. Chernikov /* 14190cba2b28SAlexander V. Chernikov * Shorthands: handle single value if vmask consists 14200cba2b28SAlexander V. Chernikov * of numbers only. e.g.: 14210cba2b28SAlexander V. Chernikov * vmask = "fib,skipto" -> treat input "1" as "1,1" 14220cba2b28SAlexander V. Chernikov */ 14230cba2b28SAlexander V. Chernikov 14240cba2b28SAlexander V. Chernikov n = arg; 14250cba2b28SAlexander V. Chernikov etype = NULL; 14260cba2b28SAlexander V. Chernikov for (i = 1; i < (1 << 31); i *= 2) { 14270cba2b28SAlexander V. Chernikov if ((flag = (vmask & i)) == 0) 14280cba2b28SAlexander V. Chernikov continue; 14290cba2b28SAlexander V. Chernikov vmask &= ~flag; 14300cba2b28SAlexander V. Chernikov 14310cba2b28SAlexander V. Chernikov if ((comma = strchr(n, ',')) != NULL) 14320cba2b28SAlexander V. Chernikov *comma = '\0'; 14330cba2b28SAlexander V. Chernikov 14340cba2b28SAlexander V. Chernikov switch (flag) { 14350cba2b28SAlexander V. Chernikov case IPFW_VTYPE_TAG: 14360cba2b28SAlexander V. Chernikov v->tag = strtol(n, &e, 10); 14370cba2b28SAlexander V. Chernikov if (*e != '\0') 14380cba2b28SAlexander V. Chernikov etype = "tag"; 1439ac35ff17SAlexander V. Chernikov break; 14400cba2b28SAlexander V. Chernikov case IPFW_VTYPE_PIPE: 14410cba2b28SAlexander V. Chernikov v->pipe = strtol(n, &e, 10); 14420cba2b28SAlexander V. Chernikov if (*e != '\0') 14430cba2b28SAlexander V. Chernikov etype = "pipe"; 1444ac35ff17SAlexander V. Chernikov break; 14450cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DIVERT: 14460cba2b28SAlexander V. Chernikov v->divert = strtol(n, &e, 10); 14470cba2b28SAlexander V. Chernikov if (*e != '\0') 14480cba2b28SAlexander V. Chernikov etype = "divert"; 14490cba2b28SAlexander V. Chernikov break; 14500cba2b28SAlexander V. Chernikov case IPFW_VTYPE_SKIPTO: 14510cba2b28SAlexander V. Chernikov v->skipto = strtol(n, &e, 10); 14520cba2b28SAlexander V. Chernikov if (*e != '\0') 14530cba2b28SAlexander V. Chernikov etype = "skipto"; 14540cba2b28SAlexander V. Chernikov break; 14550cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NETGRAPH: 14560cba2b28SAlexander V. Chernikov v->netgraph = strtol(n, &e, 10); 14570cba2b28SAlexander V. Chernikov if (*e != '\0') 14580cba2b28SAlexander V. Chernikov etype = "netgraph"; 14590cba2b28SAlexander V. Chernikov break; 14600cba2b28SAlexander V. Chernikov case IPFW_VTYPE_FIB: 14610cba2b28SAlexander V. Chernikov v->fib = strtol(n, &e, 10); 14620cba2b28SAlexander V. Chernikov if (*e != '\0') 14630cba2b28SAlexander V. Chernikov etype = "fib"; 14640cba2b28SAlexander V. Chernikov break; 14650cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NAT: 14660cba2b28SAlexander V. Chernikov v->nat = strtol(n, &e, 10); 14670cba2b28SAlexander V. Chernikov if (*e != '\0') 14680cba2b28SAlexander V. Chernikov etype = "nat"; 14690cba2b28SAlexander V. Chernikov break; 14700cba2b28SAlexander V. Chernikov case IPFW_VTYPE_LIMIT: 14710cba2b28SAlexander V. Chernikov v->limit = strtol(n, &e, 10); 14720cba2b28SAlexander V. Chernikov if (*e != '\0') 14730cba2b28SAlexander V. Chernikov etype = "limit"; 14740cba2b28SAlexander V. Chernikov break; 14750cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH4: 14760cba2b28SAlexander V. Chernikov if (strchr(n, '.') != NULL && 14770cba2b28SAlexander V. Chernikov inet_pton(AF_INET, n, &a4) == 1) { 14780cba2b28SAlexander V. Chernikov v->nh4 = ntohl(a4); 14790cba2b28SAlexander V. Chernikov break; 14800cba2b28SAlexander V. Chernikov } 14810cba2b28SAlexander V. Chernikov if (lookup_host(n, (struct in_addr *)&v->nh4) == 0) 14820cba2b28SAlexander V. Chernikov break; 14830cba2b28SAlexander V. Chernikov etype = "ipv4"; 1484ac35ff17SAlexander V. Chernikov break; 1485ac35ff17SAlexander V. Chernikov case IPFW_VTYPE_DSCP: 14860cba2b28SAlexander V. Chernikov if (isalpha(*n)) { 14870cba2b28SAlexander V. Chernikov if ((v->dscp = match_token(f_ipdscp, n)) != -1) 1488ac35ff17SAlexander V. Chernikov break; 14890cba2b28SAlexander V. Chernikov else 14900cba2b28SAlexander V. Chernikov etype = "DSCP code"; 14910cba2b28SAlexander V. Chernikov } else { 14920cba2b28SAlexander V. Chernikov v->dscp = strtol(n, &e, 10); 14930cba2b28SAlexander V. Chernikov if (v->dscp > 63 || *e != '\0') 14940cba2b28SAlexander V. Chernikov etype = "DSCP value"; 1495ac35ff17SAlexander V. Chernikov } 14960cba2b28SAlexander V. Chernikov break; 14970cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH6: 14980cba2b28SAlexander V. Chernikov if (strchr(n, ':') != NULL && 14990cba2b28SAlexander V. Chernikov inet_pton(AF_INET6, n, &v->nh6) == 1) 15000cba2b28SAlexander V. Chernikov break; 15010cba2b28SAlexander V. Chernikov etype = "ipv6"; 15020cba2b28SAlexander V. Chernikov break; 15030cba2b28SAlexander V. Chernikov } 15040cba2b28SAlexander V. Chernikov 15050cba2b28SAlexander V. Chernikov if (etype != NULL) 15060cba2b28SAlexander V. Chernikov errx(EX_USAGE, "Unable to parse %s as %s", n, etype); 15070cba2b28SAlexander V. Chernikov 15080cba2b28SAlexander V. Chernikov if (comma != NULL) 15090cba2b28SAlexander V. Chernikov *comma++ = ','; 15100cba2b28SAlexander V. Chernikov 15110cba2b28SAlexander V. Chernikov if ((n = comma) != NULL) 15120cba2b28SAlexander V. Chernikov continue; 15130cba2b28SAlexander V. Chernikov 15140cba2b28SAlexander V. Chernikov /* End of input. */ 15150cba2b28SAlexander V. Chernikov if (vmask != 0) 15160cba2b28SAlexander V. Chernikov errx(EX_USAGE, "Not enough fields inside value"); 15170cba2b28SAlexander V. Chernikov } 1518ac35ff17SAlexander V. Chernikov } 1519f1220db8SAlexander V. Chernikov 1520f1220db8SAlexander V. Chernikov /* 1521f1220db8SAlexander V. Chernikov * Compare table names. 1522f1220db8SAlexander V. Chernikov * Honor number comparison. 1523f1220db8SAlexander V. Chernikov */ 1524f1220db8SAlexander V. Chernikov static int 1525f1220db8SAlexander V. Chernikov tablename_cmp(const void *a, const void *b) 1526f1220db8SAlexander V. Chernikov { 1527f1220db8SAlexander V. Chernikov ipfw_xtable_info *ia, *ib; 1528f1220db8SAlexander V. Chernikov 1529f1220db8SAlexander V. Chernikov ia = (ipfw_xtable_info *)a; 1530f1220db8SAlexander V. Chernikov ib = (ipfw_xtable_info *)b; 1531f1220db8SAlexander V. Chernikov 153268394ec8SAlexander V. Chernikov return (stringnum_cmp(ia->tablename, ib->tablename)); 1533f1220db8SAlexander V. Chernikov } 1534f1220db8SAlexander V. Chernikov 1535f1220db8SAlexander V. Chernikov /* 1536f1220db8SAlexander V. Chernikov * Retrieves table list from kernel, 1537f1220db8SAlexander V. Chernikov * optionally sorts it and calls requested function for each table. 1538f1220db8SAlexander V. Chernikov * Returns 0 on success. 1539f1220db8SAlexander V. Chernikov */ 1540f1220db8SAlexander V. Chernikov static int 1541f1220db8SAlexander V. Chernikov tables_foreach(table_cb_t *f, void *arg, int sort) 1542f1220db8SAlexander V. Chernikov { 154328ea4fa3SAlexander V. Chernikov ipfw_obj_lheader *olh; 1544f1220db8SAlexander V. Chernikov ipfw_xtable_info *info; 1545f1220db8SAlexander V. Chernikov size_t sz; 1546f1220db8SAlexander V. Chernikov int i, error; 1547f1220db8SAlexander V. Chernikov 154828ea4fa3SAlexander V. Chernikov /* Start with reasonable default */ 154928ea4fa3SAlexander V. Chernikov sz = sizeof(*olh) + 16 * sizeof(ipfw_xtable_info); 1550f1220db8SAlexander V. Chernikov 155128ea4fa3SAlexander V. Chernikov for (;;) { 1552f1220db8SAlexander V. Chernikov if ((olh = calloc(1, sz)) == NULL) 1553f1220db8SAlexander V. Chernikov return (ENOMEM); 1554f1220db8SAlexander V. Chernikov 1555f1220db8SAlexander V. Chernikov olh->size = sz; 1556b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLES_XLIST, &olh->opheader, &sz) != 0) { 1557b6462881SAlexander V. Chernikov free(olh); 1558b6462881SAlexander V. Chernikov if (errno == ENOMEM) { 155928ea4fa3SAlexander V. Chernikov sz = olh->size; 156028ea4fa3SAlexander V. Chernikov continue; 1561b6462881SAlexander V. Chernikov } 1562b6462881SAlexander V. Chernikov return (errno); 1563f1220db8SAlexander V. Chernikov } 1564f1220db8SAlexander V. Chernikov 1565f1220db8SAlexander V. Chernikov if (sort != 0) 1566f1220db8SAlexander V. Chernikov qsort(olh + 1, olh->count, olh->objsize, tablename_cmp); 1567f1220db8SAlexander V. Chernikov 1568f1220db8SAlexander V. Chernikov info = (ipfw_xtable_info *)(olh + 1); 1569f1220db8SAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 1570f1220db8SAlexander V. Chernikov error = f(info, arg); /* Ignore errors for now */ 1571f1220db8SAlexander V. Chernikov info = (ipfw_xtable_info *)((caddr_t)info + olh->objsize); 1572f1220db8SAlexander V. Chernikov } 1573f1220db8SAlexander V. Chernikov 1574f1220db8SAlexander V. Chernikov free(olh); 157528ea4fa3SAlexander V. Chernikov break; 157628ea4fa3SAlexander V. Chernikov } 1577f1220db8SAlexander V. Chernikov 1578f1220db8SAlexander V. Chernikov return (0); 1579f1220db8SAlexander V. Chernikov } 1580f1220db8SAlexander V. Chernikov 158128ea4fa3SAlexander V. Chernikov 1582f1220db8SAlexander V. Chernikov /* 1583f1220db8SAlexander V. Chernikov * Retrieves all entries for given table @i in 1584720ee730SAlexander V. Chernikov * eXtended format. Allocate buffer large enough 1585720ee730SAlexander V. Chernikov * to store result. Called needs to free it later. 1586f1220db8SAlexander V. Chernikov * 1587f1220db8SAlexander V. Chernikov * Returns 0 on success. 1588f1220db8SAlexander V. Chernikov */ 1589f1220db8SAlexander V. Chernikov static int 1590720ee730SAlexander V. Chernikov table_do_get_list(ipfw_xtable_info *i, ipfw_obj_header **poh) 1591f1220db8SAlexander V. Chernikov { 1592720ee730SAlexander V. Chernikov ipfw_obj_header *oh; 1593f1220db8SAlexander V. Chernikov size_t sz; 1594b6462881SAlexander V. Chernikov int c; 1595f1220db8SAlexander V. Chernikov 159681d3153dSAlexander V. Chernikov sz = 0; 1597720ee730SAlexander V. Chernikov oh = NULL; 1598720ee730SAlexander V. Chernikov for (c = 0; c < 8; c++) { 159981d3153dSAlexander V. Chernikov if (sz < i->size) 1600720ee730SAlexander V. Chernikov sz = i->size + 44; 1601720ee730SAlexander V. Chernikov if (oh != NULL) 1602720ee730SAlexander V. Chernikov free(oh); 1603720ee730SAlexander V. Chernikov if ((oh = calloc(1, sz)) == NULL) 1604720ee730SAlexander V. Chernikov continue; 1605720ee730SAlexander V. Chernikov table_fill_objheader(oh, i); 1606d3a4f924SAlexander V. Chernikov oh->opheader.version = 1; /* Current version */ 1607b6462881SAlexander V. Chernikov if (do_get3(IP_FW_TABLE_XLIST, &oh->opheader, &sz) == 0) { 1608720ee730SAlexander V. Chernikov *poh = oh; 1609720ee730SAlexander V. Chernikov return (0); 161081d3153dSAlexander V. Chernikov } 1611f1220db8SAlexander V. Chernikov 1612b6462881SAlexander V. Chernikov if (errno != ENOMEM) 1613720ee730SAlexander V. Chernikov break; 1614720ee730SAlexander V. Chernikov } 1615720ee730SAlexander V. Chernikov free(oh); 1616720ee730SAlexander V. Chernikov 1617b6462881SAlexander V. Chernikov return (errno); 1618f1220db8SAlexander V. Chernikov } 1619f1220db8SAlexander V. Chernikov 1620f1220db8SAlexander V. Chernikov /* 1621f1220db8SAlexander V. Chernikov * Shows all entries from @oh in human-readable format 1622f1220db8SAlexander V. Chernikov */ 1623f1220db8SAlexander V. Chernikov static void 1624f1220db8SAlexander V. Chernikov table_show_list(ipfw_obj_header *oh, int need_header) 1625f1220db8SAlexander V. Chernikov { 162681d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 162781d3153dSAlexander V. Chernikov uint32_t count; 1628f1220db8SAlexander V. Chernikov ipfw_xtable_info *i; 1629f1220db8SAlexander V. Chernikov 1630f1220db8SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 163181d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(i + 1); 1632f1220db8SAlexander V. Chernikov 1633f1220db8SAlexander V. Chernikov if (need_header) 1634f1220db8SAlexander V. Chernikov printf("--- table(%s), set(%u) ---\n", i->tablename, i->set); 1635f1220db8SAlexander V. Chernikov 1636f1220db8SAlexander V. Chernikov count = i->count; 1637f1220db8SAlexander V. Chernikov while (count > 0) { 163881d3153dSAlexander V. Chernikov table_show_entry(i, tent); 163981d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)((caddr_t)tent + tent->head.length); 164081d3153dSAlexander V. Chernikov count--; 164181d3153dSAlexander V. Chernikov } 164281d3153dSAlexander V. Chernikov } 164381d3153dSAlexander V. Chernikov 164481d3153dSAlexander V. Chernikov static void 16450cba2b28SAlexander V. Chernikov table_show_value(char *buf, size_t bufsize, ipfw_table_value *v, 16460cba2b28SAlexander V. Chernikov uint32_t vmask, int print_ip) 16470cba2b28SAlexander V. Chernikov { 16480cba2b28SAlexander V. Chernikov uint32_t flag, i, l; 16490cba2b28SAlexander V. Chernikov size_t sz; 16500cba2b28SAlexander V. Chernikov struct in_addr a4; 16510cba2b28SAlexander V. Chernikov char abuf[INET6_ADDRSTRLEN]; 16520cba2b28SAlexander V. Chernikov 16530cba2b28SAlexander V. Chernikov sz = bufsize; 16540cba2b28SAlexander V. Chernikov 16550cba2b28SAlexander V. Chernikov /* 16560cba2b28SAlexander V. Chernikov * Some shorthands for printing values: 16570cba2b28SAlexander V. Chernikov * legacy assumes all values are equal, so keep the first one. 16580cba2b28SAlexander V. Chernikov */ 16590cba2b28SAlexander V. Chernikov if (vmask == IPFW_VTYPE_LEGACY) { 16600cba2b28SAlexander V. Chernikov if (print_ip != 0) { 16610cba2b28SAlexander V. Chernikov flag = htonl(v->tag); 16620cba2b28SAlexander V. Chernikov inet_ntop(AF_INET, &flag, buf, sz); 16630cba2b28SAlexander V. Chernikov } else 16640cba2b28SAlexander V. Chernikov snprintf(buf, sz, "%u", v->tag); 16650cba2b28SAlexander V. Chernikov return; 16660cba2b28SAlexander V. Chernikov } 16670cba2b28SAlexander V. Chernikov 16680cba2b28SAlexander V. Chernikov for (i = 1; i < (1 << 31); i *= 2) { 16690cba2b28SAlexander V. Chernikov if ((flag = (vmask & i)) == 0) 16700cba2b28SAlexander V. Chernikov continue; 16710cba2b28SAlexander V. Chernikov l = 0; 16720cba2b28SAlexander V. Chernikov 16730cba2b28SAlexander V. Chernikov switch (flag) { 16740cba2b28SAlexander V. Chernikov case IPFW_VTYPE_TAG: 16750cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->tag); 16760cba2b28SAlexander V. Chernikov break; 16770cba2b28SAlexander V. Chernikov case IPFW_VTYPE_PIPE: 16780cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->pipe); 16790cba2b28SAlexander V. Chernikov break; 16800cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DIVERT: 16810cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->divert); 16820cba2b28SAlexander V. Chernikov break; 16830cba2b28SAlexander V. Chernikov case IPFW_VTYPE_SKIPTO: 16840cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->skipto); 16850cba2b28SAlexander V. Chernikov break; 16860cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NETGRAPH: 16870cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->netgraph); 16880cba2b28SAlexander V. Chernikov break; 16890cba2b28SAlexander V. Chernikov case IPFW_VTYPE_FIB: 16900cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->fib); 16910cba2b28SAlexander V. Chernikov break; 16920cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NAT: 16930cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->nat); 16940cba2b28SAlexander V. Chernikov break; 16950cba2b28SAlexander V. Chernikov case IPFW_VTYPE_LIMIT: 16960cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%u,", v->limit); 16970cba2b28SAlexander V. Chernikov break; 16980cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH4: 16990cba2b28SAlexander V. Chernikov a4.s_addr = htonl(v->nh4); 17000cba2b28SAlexander V. Chernikov inet_ntop(AF_INET, &a4, abuf, sizeof(abuf)); 17010cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%s,", abuf); 17020cba2b28SAlexander V. Chernikov break; 17030cba2b28SAlexander V. Chernikov case IPFW_VTYPE_DSCP: 17040cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%d,", v->dscp); 17050cba2b28SAlexander V. Chernikov break; 17060cba2b28SAlexander V. Chernikov case IPFW_VTYPE_NH6: 17070cba2b28SAlexander V. Chernikov inet_ntop(AF_INET6, &v->nh6, abuf, sizeof(abuf)); 17080cba2b28SAlexander V. Chernikov l = snprintf(buf, sz, "%s,", abuf); 17090cba2b28SAlexander V. Chernikov break; 17100cba2b28SAlexander V. Chernikov } 17110cba2b28SAlexander V. Chernikov 17120cba2b28SAlexander V. Chernikov buf += l; 17130cba2b28SAlexander V. Chernikov sz -= l; 17140cba2b28SAlexander V. Chernikov } 17150cba2b28SAlexander V. Chernikov 17160cba2b28SAlexander V. Chernikov if (sz != bufsize) 17170cba2b28SAlexander V. Chernikov *(buf - 1) = '\0'; 17180cba2b28SAlexander V. Chernikov } 17190cba2b28SAlexander V. Chernikov 17200cba2b28SAlexander V. Chernikov static void 172181d3153dSAlexander V. Chernikov table_show_entry(ipfw_xtable_info *i, ipfw_obj_tentry *tent) 172281d3153dSAlexander V. Chernikov { 17230cba2b28SAlexander V. Chernikov char *comma, tbuf[128], pval[128]; 1724914bffb6SAlexander V. Chernikov void *paddr; 1725914bffb6SAlexander V. Chernikov struct tflow_entry *tfe; 172681d3153dSAlexander V. Chernikov 17270cba2b28SAlexander V. Chernikov table_show_value(pval, sizeof(pval), &tent->v.value, i->vmask, 17280cba2b28SAlexander V. Chernikov co.do_value_as_ip); 1729914bffb6SAlexander V. Chernikov 1730f1220db8SAlexander V. Chernikov switch (i->type) { 1731c21034b7SAlexander V. Chernikov case IPFW_TABLE_ADDR: 1732f1220db8SAlexander V. Chernikov /* IPv4 or IPv6 prefixes */ 173381d3153dSAlexander V. Chernikov inet_ntop(tent->subtype, &tent->k, tbuf, sizeof(tbuf)); 1734914bffb6SAlexander V. Chernikov printf("%s/%u %s\n", tbuf, tent->masklen, pval); 1735f1220db8SAlexander V. Chernikov break; 1736f1220db8SAlexander V. Chernikov case IPFW_TABLE_INTERFACE: 1737f1220db8SAlexander V. Chernikov /* Interface names */ 1738914bffb6SAlexander V. Chernikov printf("%s %s\n", tent->k.iface, pval); 1739b23d5de9SAlexander V. Chernikov break; 1740b23d5de9SAlexander V. Chernikov case IPFW_TABLE_NUMBER: 1741b23d5de9SAlexander V. Chernikov /* numbers */ 1742914bffb6SAlexander V. Chernikov printf("%u %s\n", tent->k.key, pval); 1743b23d5de9SAlexander V. Chernikov break; 1744914bffb6SAlexander V. Chernikov case IPFW_TABLE_FLOW: 1745914bffb6SAlexander V. Chernikov /* flows */ 1746914bffb6SAlexander V. Chernikov tfe = &tent->k.flow; 1747914bffb6SAlexander V. Chernikov comma = ""; 1748914bffb6SAlexander V. Chernikov 1749914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_SRCIP) != 0) { 1750914bffb6SAlexander V. Chernikov if (tfe->af == AF_INET) 1751914bffb6SAlexander V. Chernikov paddr = &tfe->a.a4.sip; 1752914bffb6SAlexander V. Chernikov else 1753914bffb6SAlexander V. Chernikov paddr = &tfe->a.a6.sip6; 1754914bffb6SAlexander V. Chernikov 1755914bffb6SAlexander V. Chernikov inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf)); 1756914bffb6SAlexander V. Chernikov printf("%s%s", comma, tbuf); 1757914bffb6SAlexander V. Chernikov comma = ","; 1758914bffb6SAlexander V. Chernikov } 1759914bffb6SAlexander V. Chernikov 1760914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_PROTO) != 0) { 1761914bffb6SAlexander V. Chernikov printf("%s%d", comma, tfe->proto); 1762914bffb6SAlexander V. Chernikov comma = ","; 1763914bffb6SAlexander V. Chernikov } 1764914bffb6SAlexander V. Chernikov 1765914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_SRCPORT) != 0) { 1766914bffb6SAlexander V. Chernikov printf("%s%d", comma, ntohs(tfe->sport)); 1767914bffb6SAlexander V. Chernikov comma = ","; 1768914bffb6SAlexander V. Chernikov } 1769914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_DSTIP) != 0) { 1770914bffb6SAlexander V. Chernikov if (tfe->af == AF_INET) 1771914bffb6SAlexander V. Chernikov paddr = &tfe->a.a4.dip; 1772914bffb6SAlexander V. Chernikov else 1773914bffb6SAlexander V. Chernikov paddr = &tfe->a.a6.dip6; 1774914bffb6SAlexander V. Chernikov 1775914bffb6SAlexander V. Chernikov inet_ntop(tfe->af, paddr, tbuf, sizeof(tbuf)); 1776914bffb6SAlexander V. Chernikov printf("%s%s", comma, tbuf); 1777914bffb6SAlexander V. Chernikov comma = ","; 1778914bffb6SAlexander V. Chernikov } 1779914bffb6SAlexander V. Chernikov 1780914bffb6SAlexander V. Chernikov if ((i->tflags & IPFW_TFFLAG_DSTPORT) != 0) { 1781914bffb6SAlexander V. Chernikov printf("%s%d", comma, ntohs(tfe->dport)); 1782914bffb6SAlexander V. Chernikov comma = ","; 1783914bffb6SAlexander V. Chernikov } 1784914bffb6SAlexander V. Chernikov 1785914bffb6SAlexander V. Chernikov printf(" %s\n", pval); 1786f1220db8SAlexander V. Chernikov } 1787f1220db8SAlexander V. Chernikov } 1788f1220db8SAlexander V. Chernikov 17899d099b4fSAlexander V. Chernikov static int 17900cba2b28SAlexander V. Chernikov table_do_get_stdlist(uint16_t opcode, ipfw_obj_lheader **polh) 17919d099b4fSAlexander V. Chernikov { 17929d099b4fSAlexander V. Chernikov ipfw_obj_lheader req, *olh; 17939d099b4fSAlexander V. Chernikov size_t sz; 17949d099b4fSAlexander V. Chernikov 17959d099b4fSAlexander V. Chernikov memset(&req, 0, sizeof(req)); 17969d099b4fSAlexander V. Chernikov sz = sizeof(req); 17979d099b4fSAlexander V. Chernikov 1798b6462881SAlexander V. Chernikov if (do_get3(opcode, &req.opheader, &sz) != 0) 1799b6462881SAlexander V. Chernikov if (errno != ENOMEM) 1800b6462881SAlexander V. Chernikov return (errno); 18019d099b4fSAlexander V. Chernikov 18029d099b4fSAlexander V. Chernikov sz = req.size; 18039d099b4fSAlexander V. Chernikov if ((olh = calloc(1, sz)) == NULL) 18049d099b4fSAlexander V. Chernikov return (ENOMEM); 18059d099b4fSAlexander V. Chernikov 18069d099b4fSAlexander V. Chernikov olh->size = sz; 1807b6462881SAlexander V. Chernikov if (do_get3(opcode, &olh->opheader, &sz) != 0) { 18089d099b4fSAlexander V. Chernikov free(olh); 1809b6462881SAlexander V. Chernikov return (errno); 18109d099b4fSAlexander V. Chernikov } 18119d099b4fSAlexander V. Chernikov 18129d099b4fSAlexander V. Chernikov *polh = olh; 18139d099b4fSAlexander V. Chernikov return (0); 18149d099b4fSAlexander V. Chernikov } 18159d099b4fSAlexander V. Chernikov 18160cba2b28SAlexander V. Chernikov static int 18170cba2b28SAlexander V. Chernikov table_do_get_algolist(ipfw_obj_lheader **polh) 18180cba2b28SAlexander V. Chernikov { 18190cba2b28SAlexander V. Chernikov 18200cba2b28SAlexander V. Chernikov return (table_do_get_stdlist(IP_FW_TABLES_ALIST, polh)); 18210cba2b28SAlexander V. Chernikov } 18220cba2b28SAlexander V. Chernikov 18230cba2b28SAlexander V. Chernikov static int 18240cba2b28SAlexander V. Chernikov table_do_get_vlist(ipfw_obj_lheader **polh) 18250cba2b28SAlexander V. Chernikov { 18260cba2b28SAlexander V. Chernikov 18270cba2b28SAlexander V. Chernikov return (table_do_get_stdlist(IP_FW_TABLE_VLIST, polh)); 18280cba2b28SAlexander V. Chernikov } 18290cba2b28SAlexander V. Chernikov 18309d099b4fSAlexander V. Chernikov void 18319d099b4fSAlexander V. Chernikov ipfw_list_ta(int ac, char *av[]) 18329d099b4fSAlexander V. Chernikov { 18339d099b4fSAlexander V. Chernikov ipfw_obj_lheader *olh; 18349d099b4fSAlexander V. Chernikov ipfw_ta_info *info; 18359d099b4fSAlexander V. Chernikov int error, i; 18369d099b4fSAlexander V. Chernikov const char *atype; 18379d099b4fSAlexander V. Chernikov 18389d099b4fSAlexander V. Chernikov error = table_do_get_algolist(&olh); 18399d099b4fSAlexander V. Chernikov if (error != 0) 18409d099b4fSAlexander V. Chernikov err(EX_OSERR, "Unable to request algorithm list"); 18419d099b4fSAlexander V. Chernikov 18429d099b4fSAlexander V. Chernikov info = (ipfw_ta_info *)(olh + 1); 18439d099b4fSAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 18449d099b4fSAlexander V. Chernikov if ((atype = match_value(tabletypes, info->type)) == NULL) 18459d099b4fSAlexander V. Chernikov atype = "unknown"; 18468ce7a2bcSAlexander V. Chernikov printf("--- %s ---\n", info->algoname); 18478ce7a2bcSAlexander V. Chernikov printf(" type: %s\n refcount: %u\n", atype, info->refcnt); 18489d099b4fSAlexander V. Chernikov 18499d099b4fSAlexander V. Chernikov info = (ipfw_ta_info *)((caddr_t)info + olh->objsize); 18509d099b4fSAlexander V. Chernikov } 18519d099b4fSAlexander V. Chernikov 18529d099b4fSAlexander V. Chernikov free(olh); 18539d099b4fSAlexander V. Chernikov } 18549d099b4fSAlexander V. Chernikov 18550cba2b28SAlexander V. Chernikov 18560cba2b28SAlexander V. Chernikov /* Copy of current kernel table_value structure */ 18570cba2b28SAlexander V. Chernikov struct _table_value { 18580cba2b28SAlexander V. Chernikov uint32_t tag; /* O_TAG/O_TAGGED */ 18590cba2b28SAlexander V. Chernikov uint32_t pipe; /* O_PIPE/O_QUEUE */ 18600cba2b28SAlexander V. Chernikov uint16_t divert; /* O_DIVERT/O_TEE */ 18610cba2b28SAlexander V. Chernikov uint16_t skipto; /* skipto, CALLRET */ 18620cba2b28SAlexander V. Chernikov uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */ 18630cba2b28SAlexander V. Chernikov uint32_t fib; /* O_SETFIB */ 18640cba2b28SAlexander V. Chernikov uint32_t nat; /* O_NAT */ 18650cba2b28SAlexander V. Chernikov uint32_t nh4; 18660cba2b28SAlexander V. Chernikov uint8_t dscp; 18670cba2b28SAlexander V. Chernikov uint8_t spare0[3]; 18680cba2b28SAlexander V. Chernikov /* -- 32 bytes -- */ 18690cba2b28SAlexander V. Chernikov struct in6_addr nh6; 18700cba2b28SAlexander V. Chernikov uint32_t limit; /* O_LIMIT */ 18710cba2b28SAlexander V. Chernikov uint32_t spare1; 18720cba2b28SAlexander V. Chernikov uint64_t refcnt; /* Number of references */ 18730cba2b28SAlexander V. Chernikov }; 18740cba2b28SAlexander V. Chernikov 18750cba2b28SAlexander V. Chernikov int 18760cba2b28SAlexander V. Chernikov compare_values(const void *_a, const void *_b) 18770cba2b28SAlexander V. Chernikov { 18780cba2b28SAlexander V. Chernikov struct _table_value *a, *b; 18790cba2b28SAlexander V. Chernikov 18800cba2b28SAlexander V. Chernikov a = (struct _table_value *)_a; 18810cba2b28SAlexander V. Chernikov b = (struct _table_value *)_b; 18820cba2b28SAlexander V. Chernikov 18830cba2b28SAlexander V. Chernikov if (a->spare1 < b->spare1) 18840cba2b28SAlexander V. Chernikov return (-1); 18850cba2b28SAlexander V. Chernikov else if (a->spare1 > b->spare1) 18860cba2b28SAlexander V. Chernikov return (1); 18870cba2b28SAlexander V. Chernikov 18880cba2b28SAlexander V. Chernikov return (0); 18890cba2b28SAlexander V. Chernikov } 18900cba2b28SAlexander V. Chernikov 18910cba2b28SAlexander V. Chernikov void 18920cba2b28SAlexander V. Chernikov ipfw_list_values(int ac, char *av[]) 18930cba2b28SAlexander V. Chernikov { 18940cba2b28SAlexander V. Chernikov ipfw_obj_lheader *olh; 18950cba2b28SAlexander V. Chernikov struct _table_value *v; 18960cba2b28SAlexander V. Chernikov int error, i; 18970cba2b28SAlexander V. Chernikov uint32_t vmask; 18980cba2b28SAlexander V. Chernikov char buf[128]; 18990cba2b28SAlexander V. Chernikov 19000cba2b28SAlexander V. Chernikov error = table_do_get_vlist(&olh); 19010cba2b28SAlexander V. Chernikov if (error != 0) 19020cba2b28SAlexander V. Chernikov err(EX_OSERR, "Unable to request value list"); 19030cba2b28SAlexander V. Chernikov 19040cba2b28SAlexander V. Chernikov vmask = 0x7FFFFFFF; /* Similar to IPFW_VTYPE_LEGACY */ 19050cba2b28SAlexander V. Chernikov 19060cba2b28SAlexander V. Chernikov table_print_valheader(buf, sizeof(buf), vmask); 19070cba2b28SAlexander V. Chernikov printf("HEADER: %s\n", buf); 19080cba2b28SAlexander V. Chernikov v = (struct _table_value *)(olh + 1); 19090cba2b28SAlexander V. Chernikov qsort(v, olh->count, olh->objsize, compare_values); 19100cba2b28SAlexander V. Chernikov for (i = 0; i < olh->count; i++) { 19110cba2b28SAlexander V. Chernikov table_show_value(buf, sizeof(buf), (ipfw_table_value *)v, 19120cba2b28SAlexander V. Chernikov vmask, 0); 19130cba2b28SAlexander V. Chernikov printf("[%u] refs=%lu %s\n", v->spare1, v->refcnt, buf); 19140cba2b28SAlexander V. Chernikov v = (struct _table_value *)((caddr_t)v + olh->objsize); 19150cba2b28SAlexander V. Chernikov } 19160cba2b28SAlexander V. Chernikov 19170cba2b28SAlexander V. Chernikov free(olh); 19180cba2b28SAlexander V. Chernikov } 19190cba2b28SAlexander V. Chernikov 19206c2997ffSAlexander V. Chernikov int 19216c2997ffSAlexander V. Chernikov compare_ntlv(const void *_a, const void *_b) 19226c2997ffSAlexander V. Chernikov { 19236c2997ffSAlexander V. Chernikov ipfw_obj_ntlv *a, *b; 19246c2997ffSAlexander V. Chernikov 19256c2997ffSAlexander V. Chernikov a = (ipfw_obj_ntlv *)_a; 19266c2997ffSAlexander V. Chernikov b = (ipfw_obj_ntlv *)_b; 19276c2997ffSAlexander V. Chernikov 19286c2997ffSAlexander V. Chernikov if (a->set < b->set) 19296c2997ffSAlexander V. Chernikov return (-1); 19306c2997ffSAlexander V. Chernikov else if (a->set > b->set) 19316c2997ffSAlexander V. Chernikov return (1); 19326c2997ffSAlexander V. Chernikov 19336c2997ffSAlexander V. Chernikov if (a->idx < b->idx) 19346c2997ffSAlexander V. Chernikov return (-1); 19356c2997ffSAlexander V. Chernikov else if (a->idx > b->idx) 19366c2997ffSAlexander V. Chernikov return (1); 19376c2997ffSAlexander V. Chernikov 19386c2997ffSAlexander V. Chernikov return (0); 19396c2997ffSAlexander V. Chernikov } 1940563b5ab1SAlexander V. Chernikov 1941563b5ab1SAlexander V. Chernikov int 19426c2997ffSAlexander V. Chernikov compare_kntlv(const void *k, const void *v) 1943563b5ab1SAlexander V. Chernikov { 1944563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 1945563b5ab1SAlexander V. Chernikov uint16_t key; 1946563b5ab1SAlexander V. Chernikov 1947563b5ab1SAlexander V. Chernikov key = *((uint16_t *)k); 1948563b5ab1SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)v; 1949563b5ab1SAlexander V. Chernikov 1950563b5ab1SAlexander V. Chernikov if (key < ntlv->idx) 1951563b5ab1SAlexander V. Chernikov return (-1); 1952563b5ab1SAlexander V. Chernikov else if (key > ntlv->idx) 1953563b5ab1SAlexander V. Chernikov return (1); 1954563b5ab1SAlexander V. Chernikov 1955563b5ab1SAlexander V. Chernikov return (0); 1956563b5ab1SAlexander V. Chernikov } 1957563b5ab1SAlexander V. Chernikov 1958563b5ab1SAlexander V. Chernikov /* 1959563b5ab1SAlexander V. Chernikov * Finds table name in @ctlv by @idx. 1960563b5ab1SAlexander V. Chernikov * Uses the following facts: 1961563b5ab1SAlexander V. Chernikov * 1) All TLVs are the same size 1962563b5ab1SAlexander V. Chernikov * 2) Kernel implementation provides already sorted list. 1963563b5ab1SAlexander V. Chernikov * 1964563b5ab1SAlexander V. Chernikov * Returns table name or NULL. 1965563b5ab1SAlexander V. Chernikov */ 1966563b5ab1SAlexander V. Chernikov char * 1967563b5ab1SAlexander V. Chernikov table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx) 1968563b5ab1SAlexander V. Chernikov { 1969563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 1970563b5ab1SAlexander V. Chernikov 1971563b5ab1SAlexander V. Chernikov ntlv = bsearch(&idx, (ctlv + 1), ctlv->count, ctlv->objsize, 19726c2997ffSAlexander V. Chernikov compare_kntlv); 1973563b5ab1SAlexander V. Chernikov 1974563b5ab1SAlexander V. Chernikov if (ntlv != 0) 1975563b5ab1SAlexander V. Chernikov return (ntlv->name); 1976563b5ab1SAlexander V. Chernikov 1977563b5ab1SAlexander V. Chernikov return (NULL); 1978563b5ab1SAlexander V. Chernikov } 1979563b5ab1SAlexander V. Chernikov 19806c2997ffSAlexander V. Chernikov void 19816c2997ffSAlexander V. Chernikov table_sort_ctlv(ipfw_obj_ctlv *ctlv) 19826c2997ffSAlexander V. Chernikov { 19836c2997ffSAlexander V. Chernikov 19846c2997ffSAlexander V. Chernikov qsort(ctlv + 1, ctlv->count, ctlv->objsize, compare_ntlv); 19856c2997ffSAlexander V. Chernikov } 19866c2997ffSAlexander V. Chernikov 19876c2997ffSAlexander V. Chernikov int 19886c2997ffSAlexander V. Chernikov table_check_name(char *tablename) 19896c2997ffSAlexander V. Chernikov { 19906c2997ffSAlexander V. Chernikov int c, i, l; 19916c2997ffSAlexander V. Chernikov 19926c2997ffSAlexander V. Chernikov /* 19936c2997ffSAlexander V. Chernikov * Check if tablename is null-terminated and contains 19946c2997ffSAlexander V. Chernikov * valid symbols only. Valid mask is: 1995ac35ff17SAlexander V. Chernikov * [a-zA-Z0-9\-_\.]{1,63} 19966c2997ffSAlexander V. Chernikov */ 19976c2997ffSAlexander V. Chernikov l = strlen(tablename); 19986c2997ffSAlexander V. Chernikov if (l == 0 || l >= 64) 19996c2997ffSAlexander V. Chernikov return (EINVAL); 20006c2997ffSAlexander V. Chernikov for (i = 0; i < l; i++) { 20016c2997ffSAlexander V. Chernikov c = tablename[i]; 20026c2997ffSAlexander V. Chernikov if (isalpha(c) || isdigit(c) || c == '_' || 20036c2997ffSAlexander V. Chernikov c == '-' || c == '.') 20046c2997ffSAlexander V. Chernikov continue; 20056c2997ffSAlexander V. Chernikov return (EINVAL); 20066c2997ffSAlexander V. Chernikov } 20076c2997ffSAlexander V. Chernikov 2008ac35ff17SAlexander V. Chernikov /* Restrict some 'special' names */ 2009ac35ff17SAlexander V. Chernikov if (strcmp(tablename, "all") == 0) 2010ac35ff17SAlexander V. Chernikov return (EINVAL); 2011ac35ff17SAlexander V. Chernikov 20126c2997ffSAlexander V. Chernikov return (0); 20136c2997ffSAlexander V. Chernikov } 20146c2997ffSAlexander V. Chernikov 2015