1*19e99d06Sbluhm /* $OpenBSD: pfctl_parser.c,v 1.351 2024/04/22 13:30:22 bluhm Exp $ */
214a9b182Skjell
314a9b182Skjell /*
4fd3c3a0cSderaadt * Copyright (c) 2001 Daniel Hartmeier
5f8d11d7cShenning * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org>
614a9b182Skjell * All rights reserved.
714a9b182Skjell *
814a9b182Skjell * Redistribution and use in source and binary forms, with or without
914a9b182Skjell * modification, are permitted provided that the following conditions
1014a9b182Skjell * are met:
1114a9b182Skjell *
1214a9b182Skjell * - Redistributions of source code must retain the above copyright
1314a9b182Skjell * notice, this list of conditions and the following disclaimer.
1414a9b182Skjell * - Redistributions in binary form must reproduce the above
1514a9b182Skjell * copyright notice, this list of conditions and the following
1614a9b182Skjell * disclaimer in the documentation and/or other materials provided
1714a9b182Skjell * with the distribution.
1814a9b182Skjell *
1914a9b182Skjell * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
2014a9b182Skjell * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
2114a9b182Skjell * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
2214a9b182Skjell * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
235974bd37Sdhartmei * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
2414a9b182Skjell * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
2514a9b182Skjell * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
2614a9b182Skjell * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
2714a9b182Skjell * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2814a9b182Skjell * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
2914a9b182Skjell * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
3014a9b182Skjell * POSSIBILITY OF SUCH DAMAGE.
3114a9b182Skjell *
3214a9b182Skjell */
3314a9b182Skjell
34252d784aSderaadt #include <sys/types.h>
3579cc0068Scedric #include <sys/ioctl.h>
36252d784aSderaadt #include <sys/socket.h>
37918dda86Smikeb #include <net/if_dl.h>
38252d784aSderaadt #include <net/if.h>
39252d784aSderaadt #include <netinet/in.h>
406329fa59Sderaadt #include <netinet/ip.h>
416329fa59Sderaadt #include <netinet/ip_icmp.h>
4230620b12Sfrantzen #include <netinet/icmp6.h>
43252d784aSderaadt #include <net/pfvar.h>
449f13c6caSmillert #include <arpa/inet.h>
45252d784aSderaadt
469c957736Sguenther #include <ctype.h>
479c957736Sguenther #include <err.h>
489c957736Sguenther #include <errno.h>
499c957736Sguenther #include <ifaddrs.h>
509c957736Sguenther #include <limits.h>
519c957736Sguenther #include <netdb.h>
529c957736Sguenther #include <stdarg.h>
5314a9b182Skjell #include <stdio.h>
5414a9b182Skjell #include <stdlib.h>
5514a9b182Skjell #include <string.h>
569c957736Sguenther #include <time.h>
572ff5b035Shenning #include <unistd.h>
5814a9b182Skjell
59a2fdc13dSmcbride #define SYSLOG_NAMES
60a2fdc13dSmcbride #include <syslog.h>
61a2fdc13dSmcbride
6214a9b182Skjell #include "pfctl_parser.h"
63eb824e11Sderaadt #include "pfctl.h"
6414a9b182Skjell
653d49904cStb #ifndef nitems
663d49904cStb #define nitems(_a) (sizeof((_a)) / sizeof((_a)[0]))
673d49904cStb #endif
683d49904cStb
695d9ac2dcSdhartmei void print_op (u_int8_t, const char *, const char *);
70ad85696eShenning void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int);
71b4de0548Smillert void print_ugid (u_int8_t, id_t, id_t, const char *);
7281a15e5dSderaadt void print_flags (u_int8_t);
7364b4b616Sfrantzen void print_fromto(struct pf_rule_addr *, pf_osfp_t,
7464b4b616Sfrantzen struct pf_rule_addr *, u_int8_t, u_int8_t, int);
75f8d11d7cShenning void print_bwspec(const char *index, struct pf_queue_bwspec *);
76f8d11d7cShenning void print_scspec(const char *, struct pf_queue_scspec *);
777ad220f2Scedric int ifa_skip_if(const char *filter, struct node_host *p);
7814a9b182Skjell
792ff5b035Shenning struct node_host *ifa_grouplookup(const char *, int);
80f2370d27Shenning struct node_host *host_if(const char *, int);
811b6fdc2fSkn struct node_host *host_ip(const char *, int);
8217e25e94Skn struct node_host *host_dns(const char *, int, int);
832a6c1abaShenning
84361e311cShenning const char *tcpflags = "FSRPAUEW";
8514a9b182Skjell
867d27d81aSdhartmei static const struct icmptypeent icmp_type[] = {
87082ebc44Swilfried { "echoreq", ICMP_ECHO },
88082ebc44Swilfried { "echorep", ICMP_ECHOREPLY },
89082ebc44Swilfried { "unreach", ICMP_UNREACH },
90082ebc44Swilfried { "squench", ICMP_SOURCEQUENCH },
91082ebc44Swilfried { "redir", ICMP_REDIRECT },
92082ebc44Swilfried { "althost", ICMP_ALTHOSTADDR },
93082ebc44Swilfried { "routeradv", ICMP_ROUTERADVERT },
94082ebc44Swilfried { "routersol", ICMP_ROUTERSOLICIT },
95082ebc44Swilfried { "timex", ICMP_TIMXCEED },
96082ebc44Swilfried { "paramprob", ICMP_PARAMPROB },
97082ebc44Swilfried { "timereq", ICMP_TSTAMP },
98082ebc44Swilfried { "timerep", ICMP_TSTAMPREPLY },
99082ebc44Swilfried { "inforeq", ICMP_IREQ },
100082ebc44Swilfried { "inforep", ICMP_IREQREPLY },
101082ebc44Swilfried { "maskreq", ICMP_MASKREQ },
10202cbcc9eSwilfried { "maskrep", ICMP_MASKREPLY },
10302cbcc9eSwilfried { "trace", ICMP_TRACEROUTE },
10402cbcc9eSwilfried { "dataconv", ICMP_DATACONVERR },
10502cbcc9eSwilfried { "mobredir", ICMP_MOBILE_REDIRECT },
10602cbcc9eSwilfried { "ipv6-where", ICMP_IPV6_WHEREAREYOU },
10702cbcc9eSwilfried { "ipv6-here", ICMP_IPV6_IAMHERE },
10802cbcc9eSwilfried { "mobregreq", ICMP_MOBILE_REGREQUEST },
10902cbcc9eSwilfried { "mobregrep", ICMP_MOBILE_REGREPLY },
11002cbcc9eSwilfried { "skip", ICMP_SKIP },
11102cbcc9eSwilfried { "photuris", ICMP_PHOTURIS }
112082ebc44Swilfried };
113082ebc44Swilfried
1147d27d81aSdhartmei static const struct icmptypeent icmp6_type[] = {
11530620b12Sfrantzen { "unreach", ICMP6_DST_UNREACH },
11630620b12Sfrantzen { "toobig", ICMP6_PACKET_TOO_BIG },
11730620b12Sfrantzen { "timex", ICMP6_TIME_EXCEEDED },
11830620b12Sfrantzen { "paramprob", ICMP6_PARAM_PROB },
11930620b12Sfrantzen { "echoreq", ICMP6_ECHO_REQUEST },
12030620b12Sfrantzen { "echorep", ICMP6_ECHO_REPLY },
12130620b12Sfrantzen { "groupqry", ICMP6_MEMBERSHIP_QUERY },
12222a58e88Sitojun { "listqry", MLD_LISTENER_QUERY },
12330620b12Sfrantzen { "grouprep", ICMP6_MEMBERSHIP_REPORT },
12422a58e88Sitojun { "listenrep", MLD_LISTENER_REPORT },
12530620b12Sfrantzen { "groupterm", ICMP6_MEMBERSHIP_REDUCTION },
12622a58e88Sitojun { "listendone", MLD_LISTENER_DONE },
12730620b12Sfrantzen { "routersol", ND_ROUTER_SOLICIT },
12830620b12Sfrantzen { "routeradv", ND_ROUTER_ADVERT },
12930620b12Sfrantzen { "neighbrsol", ND_NEIGHBOR_SOLICIT },
13030620b12Sfrantzen { "neighbradv", ND_NEIGHBOR_ADVERT },
13130620b12Sfrantzen { "redir", ND_REDIRECT },
13230620b12Sfrantzen { "routrrenum", ICMP6_ROUTER_RENUMBERING },
13330620b12Sfrantzen { "wrureq", ICMP6_WRUREQUEST },
13430620b12Sfrantzen { "wrurep", ICMP6_WRUREPLY },
13530620b12Sfrantzen { "fqdnreq", ICMP6_FQDN_QUERY },
13630620b12Sfrantzen { "fqdnrep", ICMP6_FQDN_REPLY },
13730620b12Sfrantzen { "niqry", ICMP6_NI_QUERY },
13830620b12Sfrantzen { "nirep", ICMP6_NI_REPLY },
13922a58e88Sitojun { "mtraceresp", MLD_MTRACE_RESP },
14042b7d0f0Sjca { "mtrace", MLD_MTRACE },
14142b7d0f0Sjca { "listenrepv2", MLDV2_LISTENER_REPORT },
14230620b12Sfrantzen };
14330620b12Sfrantzen
1447d27d81aSdhartmei static const struct icmpcodeent icmp_code[] = {
145082ebc44Swilfried { "net-unr", ICMP_UNREACH, ICMP_UNREACH_NET },
146082ebc44Swilfried { "host-unr", ICMP_UNREACH, ICMP_UNREACH_HOST },
147082ebc44Swilfried { "proto-unr", ICMP_UNREACH, ICMP_UNREACH_PROTOCOL },
148082ebc44Swilfried { "port-unr", ICMP_UNREACH, ICMP_UNREACH_PORT },
149082ebc44Swilfried { "needfrag", ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG },
150082ebc44Swilfried { "srcfail", ICMP_UNREACH, ICMP_UNREACH_SRCFAIL },
151082ebc44Swilfried { "net-unk", ICMP_UNREACH, ICMP_UNREACH_NET_UNKNOWN },
152082ebc44Swilfried { "host-unk", ICMP_UNREACH, ICMP_UNREACH_HOST_UNKNOWN },
153082ebc44Swilfried { "isolate", ICMP_UNREACH, ICMP_UNREACH_ISOLATED },
154082ebc44Swilfried { "net-prohib", ICMP_UNREACH, ICMP_UNREACH_NET_PROHIB },
155082ebc44Swilfried { "host-prohib", ICMP_UNREACH, ICMP_UNREACH_HOST_PROHIB },
156082ebc44Swilfried { "net-tos", ICMP_UNREACH, ICMP_UNREACH_TOSNET },
157082ebc44Swilfried { "host-tos", ICMP_UNREACH, ICMP_UNREACH_TOSHOST },
158082ebc44Swilfried { "filter-prohib", ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB },
159082ebc44Swilfried { "host-preced", ICMP_UNREACH, ICMP_UNREACH_HOST_PRECEDENCE },
160082ebc44Swilfried { "cutoff-preced", ICMP_UNREACH, ICMP_UNREACH_PRECEDENCE_CUTOFF },
161082ebc44Swilfried { "redir-net", ICMP_REDIRECT, ICMP_REDIRECT_NET },
162082ebc44Swilfried { "redir-host", ICMP_REDIRECT, ICMP_REDIRECT_HOST },
163082ebc44Swilfried { "redir-tos-net", ICMP_REDIRECT, ICMP_REDIRECT_TOSNET },
164082ebc44Swilfried { "redir-tos-host", ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST },
16502cbcc9eSwilfried { "normal-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NORMAL },
16602cbcc9eSwilfried { "common-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NOROUTE_COMMON },
167082ebc44Swilfried { "transit", ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS },
168082ebc44Swilfried { "reassemb", ICMP_TIMXCEED, ICMP_TIMXCEED_REASS },
169082ebc44Swilfried { "badhead", ICMP_PARAMPROB, ICMP_PARAMPROB_ERRATPTR },
170082ebc44Swilfried { "optmiss", ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT },
17102cbcc9eSwilfried { "badlen", ICMP_PARAMPROB, ICMP_PARAMPROB_LENGTH },
17202cbcc9eSwilfried { "unknown-ind", ICMP_PHOTURIS, ICMP_PHOTURIS_UNKNOWN_INDEX },
17302cbcc9eSwilfried { "auth-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_AUTH_FAILED },
17402cbcc9eSwilfried { "decrypt-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_DECRYPT_FAILED }
175082ebc44Swilfried };
176082ebc44Swilfried
1777d27d81aSdhartmei static const struct icmpcodeent icmp6_code[] = {
1781d32ee3bSdhartmei { "admin-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN },
1791d32ee3bSdhartmei { "noroute-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE },
18030620b12Sfrantzen { "beyond-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_BEYONDSCOPE },
18130620b12Sfrantzen { "addr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR },
18230620b12Sfrantzen { "port-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT },
18330620b12Sfrantzen { "transit", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT },
18430620b12Sfrantzen { "reassemb", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY },
18530620b12Sfrantzen { "badhead", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER },
18630620b12Sfrantzen { "nxthdr", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER },
18730620b12Sfrantzen { "redironlink", ND_REDIRECT, ND_REDIRECT_ONLINK },
18830620b12Sfrantzen { "redirrouter", ND_REDIRECT, ND_REDIRECT_ROUTER }
18930620b12Sfrantzen };
19030620b12Sfrantzen
191d593fb91Sdrahn const struct pf_timeout pf_timeouts[] = {
192d593fb91Sdrahn { "tcp.first", PFTM_TCP_FIRST_PACKET },
193d593fb91Sdrahn { "tcp.opening", PFTM_TCP_OPENING },
194d593fb91Sdrahn { "tcp.established", PFTM_TCP_ESTABLISHED },
195d593fb91Sdrahn { "tcp.closing", PFTM_TCP_CLOSING },
196d593fb91Sdrahn { "tcp.finwait", PFTM_TCP_FIN_WAIT },
197d593fb91Sdrahn { "tcp.closed", PFTM_TCP_CLOSED },
19898d12bd8Sfrantzen { "tcp.tsdiff", PFTM_TS_DIFF },
199d593fb91Sdrahn { "udp.first", PFTM_UDP_FIRST_PACKET },
200d593fb91Sdrahn { "udp.single", PFTM_UDP_SINGLE },
201d593fb91Sdrahn { "udp.multiple", PFTM_UDP_MULTIPLE },
202d593fb91Sdrahn { "icmp.first", PFTM_ICMP_FIRST_PACKET },
203d593fb91Sdrahn { "icmp.error", PFTM_ICMP_ERROR_REPLY },
204d593fb91Sdrahn { "other.first", PFTM_OTHER_FIRST_PACKET },
205d593fb91Sdrahn { "other.single", PFTM_OTHER_SINGLE },
206d593fb91Sdrahn { "other.multiple", PFTM_OTHER_MULTIPLE },
207d593fb91Sdrahn { "frag", PFTM_FRAG },
208d593fb91Sdrahn { "interval", PFTM_INTERVAL },
209a85e74a5Sdhartmei { "adaptive.start", PFTM_ADAPTIVE_START },
210a85e74a5Sdhartmei { "adaptive.end", PFTM_ADAPTIVE_END },
211fd777407Smcbride { "src.track", PFTM_SRC_NODE },
212d593fb91Sdrahn { NULL, 0 }
213d593fb91Sdrahn };
214d593fb91Sdrahn
215a64374fdSmcbride enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR };
216a64374fdSmcbride
217675ff33bSkn void
copy_satopfaddr(struct pf_addr * pfa,struct sockaddr * sa)218675ff33bSkn copy_satopfaddr(struct pf_addr *pfa, struct sockaddr *sa)
219675ff33bSkn {
220675ff33bSkn if (sa->sa_family == AF_INET6)
221675ff33bSkn pfa->v6 = ((struct sockaddr_in6 *)sa)->sin6_addr;
2221fef2296Sbluhm else if (sa->sa_family == AF_INET)
223675ff33bSkn pfa->v4 = ((struct sockaddr_in *)sa)->sin_addr;
2241fef2296Sbluhm else
2251fef2296Sbluhm warnx("unhandled af %d", sa->sa_family);
226675ff33bSkn }
227675ff33bSkn
2287d27d81aSdhartmei const struct icmptypeent *
geticmptypebynumber(u_int8_t type,sa_family_t af)229bb9f691eSmcbride geticmptypebynumber(u_int8_t type, sa_family_t af)
230082ebc44Swilfried {
2313d49904cStb size_t i;
232082ebc44Swilfried
233d14c53d7Swilfried if (af != AF_INET6) {
2343d49904cStb for (i = 0; i < nitems(icmp_type); i++) {
235082ebc44Swilfried if (type == icmp_type[i].type)
236082ebc44Swilfried return (&icmp_type[i]);
237082ebc44Swilfried }
23830620b12Sfrantzen } else {
2393d49904cStb for (i = 0; i < nitems(icmp6_type); i++) {
24030620b12Sfrantzen if (type == icmp6_type[i].type)
24130620b12Sfrantzen return (&icmp6_type[i]);
24230620b12Sfrantzen }
24330620b12Sfrantzen }
24430620b12Sfrantzen return (NULL);
245082ebc44Swilfried }
246082ebc44Swilfried
2477d27d81aSdhartmei const struct icmptypeent *
geticmptypebyname(char * w,sa_family_t af)248bb9f691eSmcbride geticmptypebyname(char *w, sa_family_t af)
249082ebc44Swilfried {
2503d49904cStb size_t i;
251082ebc44Swilfried
252d14c53d7Swilfried if (af != AF_INET6) {
2533d49904cStb for (i = 0; i < nitems(icmp_type); i++) {
254082ebc44Swilfried if (!strcmp(w, icmp_type[i].name))
255082ebc44Swilfried return (&icmp_type[i]);
256082ebc44Swilfried }
25730620b12Sfrantzen } else {
2583d49904cStb for (i = 0; i < nitems(icmp6_type); i++) {
25930620b12Sfrantzen if (!strcmp(w, icmp6_type[i].name))
26030620b12Sfrantzen return (&icmp6_type[i]);
26130620b12Sfrantzen }
26230620b12Sfrantzen }
26330620b12Sfrantzen return (NULL);
264082ebc44Swilfried }
265082ebc44Swilfried
2667d27d81aSdhartmei const struct icmpcodeent *
geticmpcodebynumber(u_int8_t type,u_int8_t code,sa_family_t af)267bb9f691eSmcbride geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af)
268082ebc44Swilfried {
2693d49904cStb size_t i;
270082ebc44Swilfried
271d14c53d7Swilfried if (af != AF_INET6) {
2723d49904cStb for (i = 0; i < nitems(icmp_code); i++) {
27330620b12Sfrantzen if (type == icmp_code[i].type &&
27430620b12Sfrantzen code == icmp_code[i].code)
275082ebc44Swilfried return (&icmp_code[i]);
276082ebc44Swilfried }
27730620b12Sfrantzen } else {
2783d49904cStb for (i = 0; i < nitems(icmp6_code); i++) {
27930620b12Sfrantzen if (type == icmp6_code[i].type &&
28030620b12Sfrantzen code == icmp6_code[i].code)
28130620b12Sfrantzen return (&icmp6_code[i]);
28230620b12Sfrantzen }
28330620b12Sfrantzen }
28430620b12Sfrantzen return (NULL);
285082ebc44Swilfried }
286082ebc44Swilfried
2877d27d81aSdhartmei const struct icmpcodeent *
geticmpcodebyname(u_long type,char * w,sa_family_t af)288bb9f691eSmcbride geticmpcodebyname(u_long type, char *w, sa_family_t af)
289082ebc44Swilfried {
2903d49904cStb size_t i;
291082ebc44Swilfried
292d14c53d7Swilfried if (af != AF_INET6) {
2933d49904cStb for (i = 0; i < nitems(icmp_code); i++) {
29430620b12Sfrantzen if (type == icmp_code[i].type &&
29530620b12Sfrantzen !strcmp(w, icmp_code[i].name))
296082ebc44Swilfried return (&icmp_code[i]);
297082ebc44Swilfried }
29830620b12Sfrantzen } else {
2993d49904cStb for (i = 0; i < nitems(icmp6_code); i++) {
30030620b12Sfrantzen if (type == icmp6_code[i].type &&
30130620b12Sfrantzen !strcmp(w, icmp6_code[i].name))
30230620b12Sfrantzen return (&icmp6_code[i]);
30330620b12Sfrantzen }
30430620b12Sfrantzen }
30530620b12Sfrantzen return (NULL);
30630620b12Sfrantzen }
30730620b12Sfrantzen
308a2fdc13dSmcbride /*
309a2fdc13dSmcbride * Decode a symbolic name to a numeric value.
310a2fdc13dSmcbride * From syslogd.
311a2fdc13dSmcbride */
312a2fdc13dSmcbride int
string_to_loglevel(const char * name)313a2fdc13dSmcbride string_to_loglevel(const char *name)
314a2fdc13dSmcbride {
315a2fdc13dSmcbride CODE *c;
316a2fdc13dSmcbride char *p, buf[40];
317a2fdc13dSmcbride
318707c207dStedu if (isdigit((unsigned char)*name)) {
319707c207dStedu const char *errstr;
320707c207dStedu int val;
321707c207dStedu
322707c207dStedu val = strtonum(name, 0, LOG_DEBUG, &errstr);
323707c207dStedu if (errstr)
324707c207dStedu return -1;
325707c207dStedu return val;
326707c207dStedu }
327a2fdc13dSmcbride
328a2fdc13dSmcbride for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) {
329025f5691Sderaadt if (isupper((unsigned char)*name))
330025f5691Sderaadt *p = tolower((unsigned char)*name);
331a2fdc13dSmcbride else
332a2fdc13dSmcbride *p = *name;
333a2fdc13dSmcbride }
334a2fdc13dSmcbride *p = '\0';
335a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++)
336d07c4539Sbluhm if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI)
337a2fdc13dSmcbride return (c->c_val);
338a2fdc13dSmcbride
339a2fdc13dSmcbride return (-1);
340a2fdc13dSmcbride }
341a2fdc13dSmcbride
342a2fdc13dSmcbride const char *
loglevel_to_string(int level)343a2fdc13dSmcbride loglevel_to_string(int level)
344a2fdc13dSmcbride {
345a2fdc13dSmcbride CODE *c;
346a2fdc13dSmcbride
347a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++)
348a2fdc13dSmcbride if (c->c_val == level)
349a2fdc13dSmcbride return (c->c_name);
350a2fdc13dSmcbride
351a2fdc13dSmcbride return ("unknown");
352a2fdc13dSmcbride }
353a2fdc13dSmcbride
35481a15e5dSderaadt void
print_op(u_int8_t op,const char * a1,const char * a2)3555d9ac2dcSdhartmei print_op(u_int8_t op, const char *a1, const char *a2)
3565d9ac2dcSdhartmei {
3575d9ac2dcSdhartmei if (op == PF_OP_IRG)
3585d9ac2dcSdhartmei printf(" %s >< %s", a1, a2);
3595d9ac2dcSdhartmei else if (op == PF_OP_XRG)
3605d9ac2dcSdhartmei printf(" %s <> %s", a1, a2);
3611308506cShenning else if (op == PF_OP_EQ)
3625d9ac2dcSdhartmei printf(" = %s", a1);
3631308506cShenning else if (op == PF_OP_NE)
3645d9ac2dcSdhartmei printf(" != %s", a1);
3651308506cShenning else if (op == PF_OP_LT)
3665d9ac2dcSdhartmei printf(" < %s", a1);
3675d9ac2dcSdhartmei else if (op == PF_OP_LE)
3685d9ac2dcSdhartmei printf(" <= %s", a1);
3695d9ac2dcSdhartmei else if (op == PF_OP_GT)
3705d9ac2dcSdhartmei printf(" > %s", a1);
3715d9ac2dcSdhartmei else if (op == PF_OP_GE)
3725d9ac2dcSdhartmei printf(" >= %s", a1);
3738da4e377Smcbride else if (op == PF_OP_RRG)
3748da4e377Smcbride printf(" %s:%s", a1, a2);
3755d9ac2dcSdhartmei }
3765d9ac2dcSdhartmei
3775d9ac2dcSdhartmei void
print_port(u_int8_t op,u_int16_t p1,u_int16_t p2,const char * proto,int opts)378ad85696eShenning print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts)
37914a9b182Skjell {
380e31d21c9Sdhartmei char a1[6], a2[6];
381ad85696eShenning struct servent *s = NULL;
38281a15e5dSderaadt
383ad85696eShenning if (opts & PF_OPT_PORTNAMES)
384e4ebe044Shenning s = getservbyport(p1, proto);
38514a9b182Skjell p1 = ntohs(p1);
38614a9b182Skjell p2 = ntohs(p2);
3875d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", p1);
3885d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", p2);
38914a9b182Skjell printf(" port");
3905d9ac2dcSdhartmei if (s != NULL && (op == PF_OP_EQ || op == PF_OP_NE))
3915d9ac2dcSdhartmei print_op(op, s->s_name, a2);
39214a9b182Skjell else
3935d9ac2dcSdhartmei print_op(op, a1, a2);
3945d9ac2dcSdhartmei }
3955d9ac2dcSdhartmei
3965d9ac2dcSdhartmei void
print_ugid(u_int8_t op,id_t i1,id_t i2,const char * t)397b4de0548Smillert print_ugid(u_int8_t op, id_t i1, id_t i2, const char *t)
3985d9ac2dcSdhartmei {
399d8fcd2dfSdhartmei char a1[11], a2[11];
4005d9ac2dcSdhartmei
401b4de0548Smillert snprintf(a1, sizeof(a1), "%u", i1);
402b4de0548Smillert snprintf(a2, sizeof(a2), "%u", i2);
4035d9ac2dcSdhartmei printf(" %s", t);
404b4de0548Smillert if (i1 == -1 && (op == PF_OP_EQ || op == PF_OP_NE))
405c16ab608Sdhartmei print_op(op, "unknown", a2);
406c16ab608Sdhartmei else
407c16ab608Sdhartmei print_op(op, a1, a2);
408c16ab608Sdhartmei }
409c16ab608Sdhartmei
410c16ab608Sdhartmei void
print_flags(u_int8_t f)41114a9b182Skjell print_flags(u_int8_t f)
41214a9b182Skjell {
41314a9b182Skjell int i;
41481a15e5dSderaadt
415bc795af0Shugh for (i = 0; tcpflags[i]; ++i)
41614a9b182Skjell if (f & (1 << i))
41714a9b182Skjell printf("%c", tcpflags[i]);
41814a9b182Skjell }
41914a9b182Skjell
42014a9b182Skjell void
print_fromto(struct pf_rule_addr * src,pf_osfp_t osfp,struct pf_rule_addr * dst,sa_family_t af,u_int8_t proto,int opts)42164b4b616Sfrantzen print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst,
422ad85696eShenning sa_family_t af, u_int8_t proto, int opts)
42315e76891Sdhartmei {
42464b4b616Sfrantzen char buf[PF_OSFP_LEN*3];
425ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
4261173271aScedric if (src->addr.type == PF_ADDR_ADDRMASK &&
4271173271aScedric dst->addr.type == PF_ADDR_ADDRMASK &&
428bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.addr, AF_INET6) &&
429bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.mask, AF_INET6) &&
4301173271aScedric PF_AZERO(&dst->addr.v.a.addr, AF_INET6) &&
4311173271aScedric PF_AZERO(&dst->addr.v.a.mask, AF_INET6) &&
432d4008a34Sdhartmei !src->neg && !dst->neg &&
43364b4b616Sfrantzen !src->port_op && !dst->port_op &&
43464b4b616Sfrantzen osfp == PF_OSFP_ANY)
43515e76891Sdhartmei printf(" all");
43615e76891Sdhartmei else {
43715e76891Sdhartmei printf(" from ");
438d4008a34Sdhartmei if (src->neg)
43915e76891Sdhartmei printf("! ");
44044f5ed0aScedric print_addr(&src->addr, af, verbose);
44115e76891Sdhartmei if (src->port_op)
44215e76891Sdhartmei print_port(src->port_op, src->port[0],
44315e76891Sdhartmei src->port[1],
444ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts);
44564b4b616Sfrantzen if (osfp != PF_OSFP_ANY)
44664b4b616Sfrantzen printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf,
44764b4b616Sfrantzen sizeof(buf)));
44815e76891Sdhartmei
44915e76891Sdhartmei printf(" to ");
450d4008a34Sdhartmei if (dst->neg)
45115e76891Sdhartmei printf("! ");
45244f5ed0aScedric print_addr(&dst->addr, af, verbose);
45315e76891Sdhartmei if (dst->port_op)
45415e76891Sdhartmei print_port(dst->port_op, dst->port[0],
45515e76891Sdhartmei dst->port[1],
456ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts);
45715e76891Sdhartmei }
45815e76891Sdhartmei }
45915e76891Sdhartmei
46015e76891Sdhartmei void
print_pool(struct pf_pool * pool,u_int16_t p1,u_int16_t p2,sa_family_t af,int id,int verbose)461e0c302d0Smcbride print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2,
46236754172Smcbride sa_family_t af, int id, int verbose)
4633a44df3cSmcbride {
46436754172Smcbride if (pool->ifname[0]) {
465a2f57b9fSmcbride if (!PF_AZERO(&pool->addr.v.a.addr, af)) {
46636754172Smcbride print_addr(&pool->addr, af, verbose);
467a2f57b9fSmcbride printf("@");
468a2f57b9fSmcbride }
469a2f57b9fSmcbride printf("%s", pool->ifname);
47036754172Smcbride } else
47136754172Smcbride print_addr(&pool->addr, af, verbose);
472e0c302d0Smcbride switch (id) {
473a64374fdSmcbride case PF_POOL_NAT:
4749782f7a2Smcbride if ((p1 != PF_NAT_PROXY_PORT_LOW ||
4759782f7a2Smcbride p2 != PF_NAT_PROXY_PORT_HIGH) && (p1 != 0 || p2 != 0)) {
476e0c302d0Smcbride if (p1 == p2)
477e0c302d0Smcbride printf(" port %u", p1);
478e0c302d0Smcbride else
479e0c302d0Smcbride printf(" port %u:%u", p1, p2);
480e0c302d0Smcbride }
481e0c302d0Smcbride break;
482a64374fdSmcbride case PF_POOL_RDR:
483e0c302d0Smcbride if (p1) {
4848da4e377Smcbride printf(" port %u", p1);
4858da4e377Smcbride if (p2 && (p2 != p1))
4868da4e377Smcbride printf(":%u", p2);
487e0c302d0Smcbride }
488e0c302d0Smcbride break;
489e0c302d0Smcbride default:
490e0c302d0Smcbride break;
491e0c302d0Smcbride }
492e0c302d0Smcbride switch (pool->opts & PF_POOL_TYPEMASK) {
493e0c302d0Smcbride case PF_POOL_NONE:
494e0c302d0Smcbride break;
495e0c302d0Smcbride case PF_POOL_BITMASK:
496e0c302d0Smcbride printf(" bitmask");
497e0c302d0Smcbride break;
498e0c302d0Smcbride case PF_POOL_RANDOM:
499e0c302d0Smcbride printf(" random");
500e0c302d0Smcbride break;
501e0c302d0Smcbride case PF_POOL_SRCHASH:
5020436fa02Smcbride printf(" source-hash 0x%08x%08x%08x%08x",
503e0c302d0Smcbride pool->key.key32[0], pool->key.key32[1],
504e0c302d0Smcbride pool->key.key32[2], pool->key.key32[3]);
505e0c302d0Smcbride break;
506e0c302d0Smcbride case PF_POOL_ROUNDROBIN:
507e0c302d0Smcbride printf(" round-robin");
508e0c302d0Smcbride break;
509bcb11948Szinke case PF_POOL_LEASTSTATES:
510bcb11948Szinke printf(" least-states");
511bcb11948Szinke break;
512e0c302d0Smcbride }
513fd777407Smcbride if (pool->opts & PF_POOL_STICKYADDR)
514fd777407Smcbride printf(" sticky-address");
515a64374fdSmcbride if (id == PF_POOL_NAT && p1 == 0 && p2 == 0)
516e0c302d0Smcbride printf(" static-port");
5173a44df3cSmcbride }
5183a44df3cSmcbride
519132c30ccShenning const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
5206b640f62Smcbride const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES;
521132c30ccShenning const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES;
522*19e99d06Sbluhm const char *pf_scounters[SCNT_MAX+1] = FCNT_NAMES;
523*19e99d06Sbluhm const char *pf_ncounters[NCNT_MAX+1] = FCNT_NAMES;
52499a73934Sderaadt
52514a9b182Skjell void
print_status(struct pf_status * s,struct pfctl_watermarks * synflwats,int opts)5266af76811Shenning print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts)
52714a9b182Skjell {
528a2fdc13dSmcbride char statline[80], *running, *debug;
52963b24bdaSpatrick time_t runtime = 0;
53063b24bdaSpatrick struct timespec uptime;
53199a73934Sderaadt int i;
532a1973c63Ssturm char buf[PF_MD5_DIGEST_LENGTH * 2 + 1];
533010eb8d3Smpf static const char hex[] = "0123456789abcdef";
53499a73934Sderaadt
535e45b97acScheloha if (!clock_gettime(CLOCK_BOOTTIME, &uptime))
53663b24bdaSpatrick runtime = uptime.tv_sec - s->since;
5375191b30fScedric running = s->running ? "Enabled" : "Disabled";
538c474e331Shenning
53963b24bdaSpatrick if (runtime) {
540b14a9e08Sderaadt unsigned int sec, min, hrs;
541b14a9e08Sderaadt time_t day = runtime;
542d85e4ad6Sdhartmei
543d85e4ad6Sdhartmei sec = day % 60;
544d85e4ad6Sdhartmei day /= 60;
545d85e4ad6Sdhartmei min = day % 60;
546d85e4ad6Sdhartmei day /= 60;
547d85e4ad6Sdhartmei hrs = day % 24;
548d85e4ad6Sdhartmei day /= 24;
549c474e331Shenning snprintf(statline, sizeof(statline),
550b14a9e08Sderaadt "Status: %s for %lld days %.2u:%.2u:%.2u",
551b14a9e08Sderaadt running, (long long)day, hrs, min, sec);
552d85e4ad6Sdhartmei } else
5535191b30fScedric snprintf(statline, sizeof(statline), "Status: %s", running);
554c97b4ee1Shenning printf("%-44s", statline);
555aa48e8d1Smillert if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) {
556a2fdc13dSmcbride printf("%15s\n\n", debug);
557e2714f7cSderaadt free(debug);
558aa48e8d1Smillert }
559f6e85b8dSmcbride
560f6e85b8dSmcbride if (opts & PF_OPT_VERBOSE) {
561010eb8d3Smpf printf("Hostid: 0x%08x\n", ntohl(s->hostid));
562010eb8d3Smpf
563a1973c63Ssturm for (i = 0; i < PF_MD5_DIGEST_LENGTH; i++) {
564010eb8d3Smpf buf[i + i] = hex[s->pf_chksum[i] >> 4];
565010eb8d3Smpf buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f];
566010eb8d3Smpf }
567010eb8d3Smpf buf[i + i] = '\0';
568010eb8d3Smpf printf("Checksum: 0x%s\n\n", buf);
569f6e85b8dSmcbride }
570010eb8d3Smpf
571c474e331Shenning if (s->ifname[0] != 0) {
572c474e331Shenning printf("Interface Stats for %-16s %5s %16s\n",
573c474e331Shenning s->ifname, "IPv4", "IPv6");
574c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes In",
575ef22e615Sdhartmei (unsigned long long)s->bcounters[0][0],
576ef22e615Sdhartmei (unsigned long long)s->bcounters[1][0]);
577c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes Out",
578ef22e615Sdhartmei (unsigned long long)s->bcounters[0][1],
579ef22e615Sdhartmei (unsigned long long)s->bcounters[1][1]);
580c474e331Shenning printf(" Packets In\n");
581c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed",
582ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_PASS],
583ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_PASS]);
584c474e331Shenning printf(" %-23s %14llu %16llu\n", "Blocked",
585ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_DROP],
586ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_DROP]);
587c474e331Shenning printf(" Packets Out\n");
588c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed",
589ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_PASS],
590ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_PASS]);
591c474e331Shenning printf(" %-23s %14llu %16llu\n\n", "Blocked",
592ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_DROP],
593ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_DROP]);
594c474e331Shenning }
595c474e331Shenning printf("%-27s %14s %16s\n", "State Table", "Total", "Rate");
596c474e331Shenning printf(" %-25s %14u %14s\n", "current entries", s->states, "");
597b18f971fShenning printf(" %-25s %14u %14s\n", "half-open tcp", s->states_halfopen, "");
598c474e331Shenning for (i = 0; i < FCNT_MAX; i++) {
599ea4ec064Sitojun printf(" %-25s %14llu ", pf_fcounters[i],
600ea4ec064Sitojun (unsigned long long)s->fcounters[i]);
601c474e331Shenning if (runtime > 0)
602c474e331Shenning printf("%14.1f/s\n",
603c474e331Shenning (double)s->fcounters[i] / (double)runtime);
604c474e331Shenning else
605c474e331Shenning printf("%14s\n", "");
606c474e331Shenning }
607fd777407Smcbride if (opts & PF_OPT_VERBOSE) {
608fd777407Smcbride printf("Source Tracking Table\n");
609fd777407Smcbride printf(" %-25s %14u %14s\n", "current entries",
610fd777407Smcbride s->src_nodes, "");
611fd777407Smcbride for (i = 0; i < SCNT_MAX; i++) {
612fd777407Smcbride printf(" %-25s %14lld ", pf_scounters[i],
613fd777407Smcbride s->scounters[i]);
614fd777407Smcbride if (runtime > 0)
615fd777407Smcbride printf("%14.1f/s\n",
616fd777407Smcbride (double)s->scounters[i] / (double)runtime);
617fd777407Smcbride else
618fd777407Smcbride printf("%14s\n", "");
619fd777407Smcbride }
620fd777407Smcbride }
621*19e99d06Sbluhm if (opts & PF_OPT_VERBOSE) {
622*19e99d06Sbluhm printf("Fragments\n");
623*19e99d06Sbluhm printf(" %-25s %14u %14s\n", "current entries",
624*19e99d06Sbluhm s->fragments, "");
625*19e99d06Sbluhm for (i = 0; i < NCNT_MAX; i++) {
626*19e99d06Sbluhm printf(" %-25s %14lld ", pf_ncounters[i],
627*19e99d06Sbluhm s->ncounters[i]);
628*19e99d06Sbluhm if (runtime > 0)
629*19e99d06Sbluhm printf("%14.1f/s\n",
630*19e99d06Sbluhm (double)s->ncounters[i] / (double)runtime);
631*19e99d06Sbluhm else
632*19e99d06Sbluhm printf("%14s\n", "");
633*19e99d06Sbluhm }
634*19e99d06Sbluhm }
63599a73934Sderaadt printf("Counters\n");
636c474e331Shenning for (i = 0; i < PFRES_MAX; i++) {
637ea4ec064Sitojun printf(" %-25s %14llu ", pf_reasons[i],
638ea4ec064Sitojun (unsigned long long)s->counters[i]);
639c474e331Shenning if (runtime > 0)
640c474e331Shenning printf("%14.1f/s\n",
641c474e331Shenning (double)s->counters[i] / (double)runtime);
642c474e331Shenning else
643c474e331Shenning printf("%14s\n", "");
644c474e331Shenning }
6456b640f62Smcbride if (opts & PF_OPT_VERBOSE) {
6466b640f62Smcbride printf("Limit Counters\n");
6476b640f62Smcbride for (i = 0; i < LCNT_MAX; i++) {
6486b640f62Smcbride printf(" %-25s %14lld ", pf_lcounters[i],
6496b640f62Smcbride s->lcounters[i]);
6506b640f62Smcbride if (runtime > 0)
6516b640f62Smcbride printf("%14.1f/s\n",
6526b640f62Smcbride (double)s->lcounters[i] / (double)runtime);
6536b640f62Smcbride else
6546b640f62Smcbride printf("%14s\n", "");
6556b640f62Smcbride }
6566b640f62Smcbride }
6576af76811Shenning if (opts & PF_OPT_VERBOSE) {
6586af76811Shenning printf("Adaptive Syncookies Watermarks\n");
6596af76811Shenning printf(" %-25s %14d states\n", "start", synflwats->hi);
6606af76811Shenning printf(" %-25s %14d states\n", "end", synflwats->lo);
6616af76811Shenning }
66214a9b182Skjell }
66314a9b182Skjell
66414a9b182Skjell void
print_src_node(struct pf_src_node * sn,int opts)665fd777407Smcbride print_src_node(struct pf_src_node *sn, int opts)
666fd777407Smcbride {
667fd777407Smcbride struct pf_addr_wrap aw;
668fd777407Smcbride int min, sec;
669fd777407Smcbride
670fd777407Smcbride memset(&aw, 0, sizeof(aw));
671fd777407Smcbride if (sn->af == AF_INET)
672fd777407Smcbride aw.v.a.mask.addr32[0] = 0xffffffff;
673fd777407Smcbride else
674fd777407Smcbride memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
675fd777407Smcbride
676fd777407Smcbride aw.v.a.addr = sn->addr;
677fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2);
678c3e2fff9Shenning
679c3e2fff9Shenning if (!PF_AZERO(&sn->raddr, sn->af)) {
680c3e2fff9Shenning if (sn->type == PF_SN_NAT)
681c3e2fff9Shenning printf(" nat-to ");
682c3e2fff9Shenning else if (sn->type == PF_SN_RDR)
683c3e2fff9Shenning printf(" rdr-to ");
684c3e2fff9Shenning else if (sn->type == PF_SN_ROUTE)
685c3e2fff9Shenning printf(" route-to ");
686c3e2fff9Shenning else
687c3e2fff9Shenning printf(" ??? (%u) ", sn->type);
688fd777407Smcbride aw.v.a.addr = sn->raddr;
6890cde32ceSclaudio print_addr(&aw, sn->naf ? sn->naf : sn->af,
6900cde32ceSclaudio opts & PF_OPT_VERBOSE2);
691c3e2fff9Shenning }
692c3e2fff9Shenning
6936b640f62Smcbride printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states,
6946b640f62Smcbride sn->conn, sn->conn_rate.count / 1000,
6956b640f62Smcbride (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds);
696fd777407Smcbride if (opts & PF_OPT_VERBOSE) {
697fd777407Smcbride sec = sn->creation % 60;
698fd777407Smcbride sn->creation /= 60;
699fd777407Smcbride min = sn->creation % 60;
700fd777407Smcbride sn->creation /= 60;
701fd777407Smcbride printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec);
702fd777407Smcbride if (sn->states == 0) {
703fd777407Smcbride sec = sn->expire % 60;
704fd777407Smcbride sn->expire /= 60;
705fd777407Smcbride min = sn->expire % 60;
706fd777407Smcbride sn->expire /= 60;
707fd777407Smcbride printf(", expires in %.2u:%.2u:%.2u",
708fd777407Smcbride sn->expire, min, sec);
709fd777407Smcbride }
710b19e9e6fSmcbride printf(", %llu pkts, %llu bytes",
711b19e9e6fSmcbride sn->packets[0] + sn->packets[1],
71259b61cdeShenning sn->bytes[0] + sn->bytes[1]);
713fd777407Smcbride if (sn->rule.nr != -1)
714c3e2fff9Shenning printf(", rule %u", sn->rule.nr);
715fd777407Smcbride printf("\n");
716fd777407Smcbride }
717fd777407Smcbride }
718fd777407Smcbride
719fd777407Smcbride void
print_rule(struct pf_rule * r,const char * anchor_call,int opts)720ad85696eShenning print_rule(struct pf_rule *r, const char *anchor_call, int opts)
72114a9b182Skjell {
7220e8bc214Saaron static const char *actiontypes[] = { "pass", "block", "scrub",
723e9953237Shenning "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr",
724e9953237Shenning "", "", "match"};
7251173271aScedric static const char *anchortypes[] = { "anchor", "anchor", "anchor",
7260e8bc214Saaron "anchor", "nat-anchor", "nat-anchor", "binat-anchor",
7270e8bc214Saaron "binat-anchor", "rdr-anchor", "rdr-anchor" };
7286992ade7Shenning int i, ropts;
729ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
730f9a568a2Smcbride char *p;
731cc5f0329Sdhartmei
7328cf23eedSsashan if ((r->rule_flag & PFRULE_EXPIRED) && (!verbose))
7338cf23eedSsashan return;
7348cf23eedSsashan
73574dc4fddShenning if (verbose)
73678baf774Sdhartmei printf("@%d ", r->nr);
7378cf23eedSsashan
738730c5d01Sjsg if (anchor_call[0]) {
739730c5d01Sjsg if (r->action >= nitems(anchortypes)) {
740730c5d01Sjsg printf("anchor(%d)", r->action);
741730c5d01Sjsg } else {
742f9a568a2Smcbride p = strrchr(anchor_call, '/');
743f9a568a2Smcbride if (p ? p[1] == '_' : anchor_call[0] == '_')
744305ca21dSmcbride printf("%s", anchortypes[r->action]);
745f9a568a2Smcbride else
746e77e5dc4Sjaredy printf("%s \"%s\"", anchortypes[r->action],
747e77e5dc4Sjaredy anchor_call);
748730c5d01Sjsg }
749730c5d01Sjsg } else {
750730c5d01Sjsg if (r->action >= nitems(actiontypes))
751730c5d01Sjsg printf("action(%d)", r->action);
752730c5d01Sjsg else
7531173271aScedric printf("%s", actiontypes[r->action]);
754730c5d01Sjsg }
7551173271aScedric if (r->action == PF_DROP) {
7568a87542aShenning if (r->rule_flag & PFRULE_RETURN)
7578a87542aShenning printf(" return");
7588a87542aShenning else if (r->rule_flag & PFRULE_RETURNRST) {
7591f77cc8aSpb if (!r->return_ttl)
76014a9b182Skjell printf(" return-rst");
7611f77cc8aSpb else
7621f77cc8aSpb printf(" return-rst(ttl %d)", r->return_ttl);
763328b2decShenning } else if (r->rule_flag & PFRULE_RETURNICMP) {
764328b2decShenning const struct icmpcodeent *ic, *ic6;
765b996d042Sdhartmei
766b996d042Sdhartmei ic = geticmpcodebynumber(r->return_icmp >> 8,
767328b2decShenning r->return_icmp & 255, AF_INET);
768328b2decShenning ic6 = geticmpcodebynumber(r->return_icmp6 >> 8,
769328b2decShenning r->return_icmp6 & 255, AF_INET6);
770d14c53d7Swilfried
771328b2decShenning switch (r->af) {
772328b2decShenning case AF_INET:
773328b2decShenning printf(" return-icmp");
774d14c53d7Swilfried if (ic == NULL)
775d14c53d7Swilfried printf("(%u)", r->return_icmp & 255);
776b996d042Sdhartmei else
777328b2decShenning printf("(%s)", ic->name);
778328b2decShenning break;
779328b2decShenning case AF_INET6:
780328b2decShenning printf(" return-icmp6");
781328b2decShenning if (ic6 == NULL)
782328b2decShenning printf("(%u)", r->return_icmp6 & 255);
783328b2decShenning else
784328b2decShenning printf("(%s)", ic6->name);
785328b2decShenning break;
786328b2decShenning default:
787328b2decShenning printf(" return-icmp");
788328b2decShenning if (ic == NULL)
789328b2decShenning printf("(%u, ", r->return_icmp & 255);
790328b2decShenning else
791328b2decShenning printf("(%s, ", ic->name);
792328b2decShenning if (ic6 == NULL)
793328b2decShenning printf("%u)", r->return_icmp6 & 255);
794328b2decShenning else
795328b2decShenning printf("%s)", ic6->name);
796328b2decShenning break;
797328b2decShenning }
798acf2444cShenning } else
799acf2444cShenning printf(" drop");
8001173271aScedric }
8017189e280Sdhartmei if (r->direction == PF_IN)
80214a9b182Skjell printf(" in");
8037189e280Sdhartmei else if (r->direction == PF_OUT)
80414a9b182Skjell printf(" out");
805a46dc179Sdhartmei if (r->log) {
806a46dc179Sdhartmei printf(" log");
807f565c2a8Shenning if (r->log & ~PF_LOG || r->logif) {
8081cb19346Sdhartmei int count = 0;
8091cb19346Sdhartmei
810a46dc179Sdhartmei printf(" (");
8111cb19346Sdhartmei if (r->log & PF_LOG_ALL)
8121cb19346Sdhartmei printf("%sall", count++ ? ", " : "");
813f496e916Shenning if (r->log & PF_LOG_MATCHES)
814f496e916Shenning printf("%smatches", count++ ? ", " : "");
815f6d3bf21Sbluhm if (r->log & PF_LOG_USER)
8161cb19346Sdhartmei printf("%suser", count++ ? ", " : "");
817f565c2a8Shenning if (r->logif)
818f565c2a8Shenning printf("%sto pflog%u", count++ ? ", " : "",
819f565c2a8Shenning r->logif);
820a46dc179Sdhartmei printf(")");
821a46dc179Sdhartmei }
822a46dc179Sdhartmei }
82314a9b182Skjell if (r->quick)
82414a9b182Skjell printf(" quick");
8257d0c9138Shenning if (r->ifname[0]) {
8267d0c9138Shenning if (r->ifnot)
8277d0c9138Shenning printf(" on ! %s", r->ifname);
8287d0c9138Shenning else
82914a9b182Skjell printf(" on %s", r->ifname);
8307d0c9138Shenning }
8319e70289eSclaudio if (r->onrdomain >= 0) {
8329e70289eSclaudio if (r->ifnot)
83341d2b8c8Sderaadt printf(" on ! rdomain %d", r->onrdomain);
8349e70289eSclaudio else
83541d2b8c8Sderaadt printf(" on rdomain %d", r->onrdomain);
8369e70289eSclaudio }
83730620b12Sfrantzen if (r->af) {
83830620b12Sfrantzen if (r->af == AF_INET)
83930620b12Sfrantzen printf(" inet");
84030620b12Sfrantzen else
84130620b12Sfrantzen printf(" inet6");
84230620b12Sfrantzen }
84314a9b182Skjell if (r->proto) {
844e4ebe044Shenning struct protoent *p;
845ed99c291Sderaadt
846e4ebe044Shenning if ((p = getprotobynumber(r->proto)) != NULL)
84714a9b182Skjell printf(" proto %s", p->p_name);
84814a9b182Skjell else
84914a9b182Skjell printf(" proto %u", r->proto);
85014a9b182Skjell }
85164b4b616Sfrantzen print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto,
852ad85696eShenning opts);
85395b43208Sdlg if (r->rcv_ifname[0])
8547d0482a9Shenning printf(" %sreceived-on %s", r->rcvifnot ? "!" : "",
8557d0482a9Shenning r->rcv_ifname);
856c16ab608Sdhartmei if (r->uid.op)
857b4de0548Smillert print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user");
858c16ab608Sdhartmei if (r->gid.op)
859b4de0548Smillert print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group");
86014a9b182Skjell if (r->flags || r->flagset) {
86114a9b182Skjell printf(" flags ");
86214a9b182Skjell print_flags(r->flags);
86314a9b182Skjell printf("/");
86414a9b182Skjell print_flags(r->flagset);
865e9953237Shenning } else if ((r->action == PF_PASS || r->action == PF_MATCH) &&
866bd9b24faSmcbride (!r->proto || r->proto == IPPROTO_TCP) &&
867bd9b24faSmcbride !(r->rule_flag & PFRULE_FRAGMENT) &&
868be73131dSmcbride !anchor_call[0] && r->keep_state)
869bd9b24faSmcbride printf(" flags any");
870082ebc44Swilfried if (r->type) {
871b49ca6bbShenning const struct icmptypeent *it;
872082ebc44Swilfried
873b49ca6bbShenning it = geticmptypebynumber(r->type-1, r->af);
874d14c53d7Swilfried if (r->af != AF_INET6)
875d14c53d7Swilfried printf(" icmp-type");
876082ebc44Swilfried else
877d0cb3502Smcbride printf(" icmp6-type");
878b49ca6bbShenning if (it != NULL)
879b49ca6bbShenning printf(" %s", it->name);
880d14c53d7Swilfried else
881d14c53d7Swilfried printf(" %u", r->type-1);
882082ebc44Swilfried if (r->code) {
883b49ca6bbShenning const struct icmpcodeent *ic;
884082ebc44Swilfried
885b49ca6bbShenning ic = geticmpcodebynumber(r->type-1, r->code-1, r->af);
886b49ca6bbShenning if (ic != NULL)
887b49ca6bbShenning printf(" code %s", ic->name);
888082ebc44Swilfried else
88914a9b182Skjell printf(" code %u", r->code-1);
890082ebc44Swilfried }
891082ebc44Swilfried }
892e4cbe364Sdhartmei if (r->tos)
893e4cbe364Sdhartmei printf(" tos 0x%2.2x", r->tos);
8947407027eSsthen if (r->prio)
8957407027eSsthen printf(" prio %u", r->prio == PF_PRIO_ZERO ? 0 : r->prio);
8965a4ae9a9Shenning if (r->pktrate.limit)
8975a4ae9a9Shenning printf(" max-pkt-rate %u/%u", r->pktrate.limit,
8985a4ae9a9Shenning r->pktrate.seconds);
8996ac157faSmcbride
900ea700e0fShenning if (r->scrub_flags & PFSTATE_SETMASK || r->qname[0] ||
901ea700e0fShenning r->rule_flag & PFRULE_SETDELAY) {
902f8b0ac7eShenning char *comma = "";
9032aa5186dShenning printf(" set (");
90408263cb1Shenning if (r->scrub_flags & PFSTATE_SETPRIO) {
905f8b0ac7eShenning if (r->set_prio[0] == r->set_prio[1])
906f8b0ac7eShenning printf("%sprio %u", comma, r->set_prio[0]);
907f8b0ac7eShenning else
908f8b0ac7eShenning printf("%sprio(%u, %u)", comma, r->set_prio[0],
909f8b0ac7eShenning r->set_prio[1]);
910f8b0ac7eShenning comma = ", ";
911f8b0ac7eShenning }
9120feb7a02Shenning if (r->qname[0]) {
9130feb7a02Shenning if (r->pqname[0])
9140feb7a02Shenning printf("%squeue(%s, %s)", comma, r->qname,
9150feb7a02Shenning r->pqname);
9160feb7a02Shenning else
9170feb7a02Shenning printf("%squeue %s", comma, r->qname);
9180feb7a02Shenning comma = ", ";
9190feb7a02Shenning }
920f8b0ac7eShenning if (r->scrub_flags & PFSTATE_SETTOS) {
921f8b0ac7eShenning printf("%stos 0x%2.2x", comma, r->set_tos);
922f8b0ac7eShenning comma = ", ";
923f8b0ac7eShenning }
924ea700e0fShenning if (r->rule_flag & PFRULE_SETDELAY) {
925ea700e0fShenning printf("%sdelay %u", comma, r->delay);
926ea700e0fShenning comma = ", ";
927ea700e0fShenning }
9282aa5186dShenning printf(")");
929f8b0ac7eShenning }
930f8b0ac7eShenning
9316992ade7Shenning ropts = 0;
9326ac157faSmcbride if (r->max_states || r->max_src_nodes || r->max_src_states)
9336992ade7Shenning ropts = 1;
9346ac157faSmcbride if (r->rule_flag & PFRULE_NOSYNC)
9356992ade7Shenning ropts = 1;
9366ac157faSmcbride if (r->rule_flag & PFRULE_SRCTRACK)
9376992ade7Shenning ropts = 1;
9386ac157faSmcbride if (r->rule_flag & PFRULE_IFBOUND)
9396992ade7Shenning ropts = 1;
9406ac157faSmcbride if (r->rule_flag & PFRULE_STATESLOPPY)
9416992ade7Shenning ropts = 1;
9426ac157faSmcbride if (r->rule_flag & PFRULE_PFLOW)
9436992ade7Shenning ropts = 1;
9446992ade7Shenning for (i = 0; !ropts && i < PFTM_MAX; ++i)
9456ac157faSmcbride if (r->timeout[i])
9466992ade7Shenning ropts = 1;
9476ac157faSmcbride
948bd9b24faSmcbride if (!r->keep_state && r->action == PF_PASS && !anchor_call[0])
949f644f0ccSmcbride printf(" no state");
9506992ade7Shenning else if (r->keep_state == PF_STATE_NORMAL && ropts)
95114a9b182Skjell printf(" keep state");
952b96c47abSfrantzen else if (r->keep_state == PF_STATE_MODULATE)
953b96c47abSfrantzen printf(" modulate state");
95452e0438eSdhartmei else if (r->keep_state == PF_STATE_SYNPROXY)
95552e0438eSdhartmei printf(" synproxy state");
95638425613Scedric if (r->prob) {
95738425613Scedric char buf[20];
95838425613Scedric
95938425613Scedric snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0));
96038425613Scedric for (i = strlen(buf)-1; i > 0; i--) {
96138425613Scedric if (buf[i] == '0')
96238425613Scedric buf[i] = '\0';
96338425613Scedric else {
96438425613Scedric if (buf[i] == '.')
96538425613Scedric buf[i] = '\0';
96638425613Scedric break;
96738425613Scedric }
96838425613Scedric }
96938425613Scedric printf(" probability %s%%", buf);
97038425613Scedric }
9716992ade7Shenning if (ropts) {
972cc5f0329Sdhartmei printf(" (");
973cc5f0329Sdhartmei if (r->max_states) {
974cc5f0329Sdhartmei printf("max %u", r->max_states);
9756992ade7Shenning ropts = 0;
976cc5f0329Sdhartmei }
977af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) {
9786992ade7Shenning if (!ropts)
979af80fa86Smcbride printf(", ");
980af80fa86Smcbride printf("no-sync");
9816992ade7Shenning ropts = 0;
982af80fa86Smcbride }
983fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) {
9846992ade7Shenning if (!ropts)
985fd777407Smcbride printf(", ");
986fd777407Smcbride printf("source-track");
987fd777407Smcbride if (r->rule_flag & PFRULE_RULESRCTRACK)
988fd777407Smcbride printf(" rule");
989fd777407Smcbride else
990fd777407Smcbride printf(" global");
9916992ade7Shenning ropts = 0;
992fd777407Smcbride }
993fd777407Smcbride if (r->max_src_states) {
9946992ade7Shenning if (!ropts)
995fd777407Smcbride printf(", ");
996fd777407Smcbride printf("max-src-states %u", r->max_src_states);
9976992ade7Shenning ropts = 0;
998fd777407Smcbride }
9996b640f62Smcbride if (r->max_src_conn) {
10006992ade7Shenning if (!ropts)
10016b640f62Smcbride printf(", ");
10026b640f62Smcbride printf("max-src-conn %u", r->max_src_conn);
10036992ade7Shenning ropts = 0;
10046b640f62Smcbride }
10056b640f62Smcbride if (r->max_src_conn_rate.limit) {
10066992ade7Shenning if (!ropts)
10076b640f62Smcbride printf(", ");
10086b640f62Smcbride printf("max-src-conn-rate %u/%u",
10096b640f62Smcbride r->max_src_conn_rate.limit,
10106b640f62Smcbride r->max_src_conn_rate.seconds);
10116992ade7Shenning ropts = 0;
10126b640f62Smcbride }
1013fd777407Smcbride if (r->max_src_nodes) {
10146992ade7Shenning if (!ropts)
1015fd777407Smcbride printf(", ");
1016fd777407Smcbride printf("max-src-nodes %u", r->max_src_nodes);
10176992ade7Shenning ropts = 0;
1018fd777407Smcbride }
10196b640f62Smcbride if (r->overload_tblname[0]) {
10206992ade7Shenning if (!ropts)
10216b640f62Smcbride printf(", ");
10226b640f62Smcbride printf("overload <%s>", r->overload_tblname);
10231e320a53Sdhartmei if (r->flush)
10246b640f62Smcbride printf(" flush");
10251e320a53Sdhartmei if (r->flush & PF_FLUSH_GLOBAL)
10261e320a53Sdhartmei printf(" global");
10276b640f62Smcbride }
1028ec359bd5Scedric if (r->rule_flag & PFRULE_IFBOUND) {
10296992ade7Shenning if (!ropts)
1030ec359bd5Scedric printf(", ");
1031ec359bd5Scedric printf("if-bound");
10326992ade7Shenning ropts = 0;
1033ec359bd5Scedric }
10344dc07d4cShenning if (r->rule_flag & PFRULE_STATESLOPPY) {
10356992ade7Shenning if (!ropts)
10364dc07d4cShenning printf(", ");
10374dc07d4cShenning printf("sloppy");
10386992ade7Shenning ropts = 0;
10394dc07d4cShenning }
104018ae10f7Shenning if (r->rule_flag & PFRULE_PFLOW) {
10416992ade7Shenning if (!ropts)
104218ae10f7Shenning printf(", ");
104318ae10f7Shenning printf("pflow");
10446992ade7Shenning ropts = 0;
104518ae10f7Shenning }
1046cc5f0329Sdhartmei for (i = 0; i < PFTM_MAX; ++i)
1047cc5f0329Sdhartmei if (r->timeout[i]) {
1048ae233f99Sdhartmei int j;
1049ae233f99Sdhartmei
10506992ade7Shenning if (!ropts)
1051cc5f0329Sdhartmei printf(", ");
10526992ade7Shenning ropts = 0;
10537e5eec99Sdhartmei for (j = 0; pf_timeouts[j].name != NULL;
10547e5eec99Sdhartmei ++j)
1055ae233f99Sdhartmei if (pf_timeouts[j].timeout == i)
1056ae233f99Sdhartmei break;
10577e5eec99Sdhartmei printf("%s %u", pf_timeouts[j].name == NULL ?
10587e5eec99Sdhartmei "inv.timeout" : pf_timeouts[j].name,
10597e5eec99Sdhartmei r->timeout[i]);
1060cc5f0329Sdhartmei }
1061cc5f0329Sdhartmei printf(")");
1062cc5f0329Sdhartmei }
1063e9953237Shenning
1064ddd010a2Sdavid if (r->rule_flag & PFRULE_FRAGMENT)
1065ddd010a2Sdavid printf(" fragment");
1066ddd010a2Sdavid
1067c4051035Shenning if (r->scrub_flags & PFSTATE_SCRUBMASK || r->min_ttl || r->max_mss) {
1068e9953237Shenning printf(" scrub (");
10696992ade7Shenning ropts = 1;
107022923725Shenning if (r->scrub_flags & PFSTATE_NODF) {
107167d2a440Sprovos printf("no-df");
10726992ade7Shenning ropts = 0;
107322923725Shenning }
107422923725Shenning if (r->scrub_flags & PFSTATE_RANDOMID) {
10756992ade7Shenning if (!ropts)
107622923725Shenning printf(" ");
1077edbe3066Sdhartmei printf("random-id");
10786992ade7Shenning ropts = 0;
107922923725Shenning }
108022923725Shenning if (r->min_ttl) {
10816992ade7Shenning if (!ropts)
108222923725Shenning printf(" ");
108334c76dcbSprovos printf("min-ttl %d", r->min_ttl);
10846992ade7Shenning ropts = 0;
108522923725Shenning }
108622923725Shenning if (r->scrub_flags & PFSTATE_SCRUB_TCP) {
10876992ade7Shenning if (!ropts)
108822923725Shenning printf(" ");
1089e9953237Shenning printf("reassemble tcp");
10906992ade7Shenning ropts = 0;
109122923725Shenning }
109222923725Shenning if (r->max_mss) {
10936992ade7Shenning if (!ropts)
109422923725Shenning printf(" ");
1095cfa91859Sjasoni printf("max-mss %d", r->max_mss);
10966992ade7Shenning ropts = 0;
109722923725Shenning }
1098e9953237Shenning printf(")");
1099e9953237Shenning }
1100e9953237Shenning
1101f48d62b3Sdhartmei if (r->allow_opts)
1102f48d62b3Sdhartmei printf(" allow-opts");
1103455ef0c1Sdhartmei if (r->label[0])
1104ff45dfa8Scamield printf(" label \"%s\"", r->label);
110544b1b5a8Smikeb if (r->rule_flag & PFRULE_ONCE)
110644b1b5a8Smikeb printf(" once");
11078aecb81aShenning if (r->tagname[0])
11088aecb81aShenning printf(" tag %s", r->tagname);
110936369899Shenning if (r->match_tagname[0]) {
111036369899Shenning if (r->match_tag_not)
111136369899Shenning printf(" !");
11120a5f7f2fShenning printf(" tagged %s", r->match_tagname);
111336369899Shenning }
11145e931757Shenning if (r->rtableid != -1)
11155e931757Shenning printf(" rtable %u", r->rtableid);
111637fced87Sbluhm switch (r->divert.type) {
111737fced87Sbluhm case PF_DIVERT_NONE:
111837fced87Sbluhm break;
111937fced87Sbluhm case PF_DIVERT_TO: {
1120eb900600Smarkus printf(" divert-to ");
112188d4e2f3Skn print_addr_str(r->af, &r->divert.addr);
1122782435eaSmarkus printf(" port %u", ntohs(r->divert.port));
112337fced87Sbluhm break;
1124eb900600Smarkus }
112537fced87Sbluhm case PF_DIVERT_REPLY:
112637fced87Sbluhm printf(" divert-reply");
112737fced87Sbluhm break;
112837fced87Sbluhm case PF_DIVERT_PACKET:
112937fced87Sbluhm printf(" divert-packet port %u", ntohs(r->divert.port));
113037fced87Sbluhm break;
113137fced87Sbluhm default:
113237fced87Sbluhm printf(" divert ???");
113337fced87Sbluhm break;
1134eb900600Smarkus }
11350cde32ceSclaudio
11360cde32ceSclaudio if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE &&
1137fc302162Smikeb r->rule_flag & PFRULE_AFTO) {
11380cde32ceSclaudio printf(" af-to %s from ", r->naf == AF_INET ? "inet" : "inet6");
11390cde32ceSclaudio print_pool(&r->nat, r->nat.proxy_port[0],
11400cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af,
11410cde32ceSclaudio PF_POOL_NAT, verbose);
11420cde32ceSclaudio if (r->rdr.addr.type != PF_ADDR_NONE) {
11430cde32ceSclaudio printf(" to ");
11440cde32ceSclaudio print_pool(&r->rdr, r->rdr.proxy_port[0],
11450cde32ceSclaudio r->rdr.proxy_port[1], r->naf ? r->naf : r->af,
11460cde32ceSclaudio PF_POOL_RDR, verbose);
11470cde32ceSclaudio }
11480cde32ceSclaudio } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) {
11490ef3d4feShenning printf (" nat-to ");
11500ef3d4feShenning print_pool(&r->nat, r->nat.proxy_port[0],
11510cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af,
11520cde32ceSclaudio PF_POOL_NAT, verbose);
11530cde32ceSclaudio } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) {
11540ef3d4feShenning printf (" rdr-to ");
11550ef3d4feShenning print_pool(&r->rdr, r->rdr.proxy_port[0],
1156a64374fdSmcbride r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose);
1157d0aca2f2Shenning }
115869e22b15Sreyk if (r->rt) {
115969e22b15Sreyk if (r->rt == PF_ROUTETO)
116069e22b15Sreyk printf(" route-to");
116169e22b15Sreyk else if (r->rt == PF_REPLYTO)
116269e22b15Sreyk printf(" reply-to");
116369e22b15Sreyk else if (r->rt == PF_DUPTO)
116469e22b15Sreyk printf(" dup-to");
116569e22b15Sreyk printf(" ");
1166a64374fdSmcbride print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose);
116769e22b15Sreyk }
1168a21b78caSsashan
1169a21b78caSsashan if (r->rule_flag & PFRULE_EXPIRED)
1170a21b78caSsashan printf(" # expired");
117169e22b15Sreyk }
117214a9b182Skjell
11735b6c447dScedric void
print_tabledef(const char * name,int flags,int addrs,struct node_tinithead * nodes)11745b6c447dScedric print_tabledef(const char *name, int flags, int addrs,
11755b6c447dScedric struct node_tinithead *nodes)
11765b6c447dScedric {
11775b6c447dScedric struct node_tinit *ti, *nti;
11785b6c447dScedric struct node_host *h;
11795b6c447dScedric
11805b6c447dScedric printf("table <%s>", name);
11815b6c447dScedric if (flags & PFR_TFLAG_CONST)
11825b6c447dScedric printf(" const");
11835b6c447dScedric if (flags & PFR_TFLAG_PERSIST)
11845b6c447dScedric printf(" persist");
11855f03a6e1Smcbride if (flags & PFR_TFLAG_COUNTERS)
11865f03a6e1Smcbride printf(" counters");
11875b6c447dScedric SIMPLEQ_FOREACH(ti, nodes, entries) {
11885b6c447dScedric if (ti->file) {
11895b6c447dScedric printf(" file \"%s\"", ti->file);
11905b6c447dScedric continue;
11915b6c447dScedric }
11925b6c447dScedric printf(" {");
11935b6c447dScedric for (;;) {
11945b6c447dScedric for (h = ti->host; h != NULL; h = h->next) {
11955b6c447dScedric printf(h->not ? " !" : " ");
11965b6c447dScedric print_addr(&h->addr, h->af, 0);
119736754172Smcbride if (h->ifname)
119836754172Smcbride printf("@%s", h->ifname);
11995b6c447dScedric }
12005b6c447dScedric nti = SIMPLEQ_NEXT(ti, entries);
12015b6c447dScedric if (nti != NULL && nti->file == NULL)
12025b6c447dScedric ti = nti; /* merge lists */
12035b6c447dScedric else
12045b6c447dScedric break;
12055b6c447dScedric }
12065b6c447dScedric printf(" }");
12075b6c447dScedric }
12085b6c447dScedric if (addrs && SIMPLEQ_EMPTY(nodes))
12095b6c447dScedric printf(" { }");
12105b6c447dScedric printf("\n");
12115b6c447dScedric }
12125b6c447dScedric
1213f8d11d7cShenning void
print_bwspec(const char * prefix,struct pf_queue_bwspec * bw)1214f8d11d7cShenning print_bwspec(const char *prefix, struct pf_queue_bwspec *bw)
1215f8d11d7cShenning {
1216f8d11d7cShenning u_int rate;
1217f8d11d7cShenning int i;
1218f8d11d7cShenning static const char unit[] = " KMG";
1219f8d11d7cShenning
1220f8d11d7cShenning if (bw->percent)
1221f8d11d7cShenning printf("%s%u%%", prefix, bw->percent);
1222f8d11d7cShenning else if (bw->absolute) {
1223f8d11d7cShenning rate = bw->absolute;
1224f4219643Smikeb for (i = 0; rate >= 1000 && i <= 3 && (rate % 1000 == 0); i++)
1225f8d11d7cShenning rate /= 1000;
1226f8d11d7cShenning printf("%s%u%c", prefix, rate, unit[i]);
1227f8d11d7cShenning }
1228f8d11d7cShenning }
1229f8d11d7cShenning
1230f8d11d7cShenning void
print_scspec(const char * prefix,struct pf_queue_scspec * sc)1231f8d11d7cShenning print_scspec(const char *prefix, struct pf_queue_scspec *sc)
1232f8d11d7cShenning {
1233f8d11d7cShenning print_bwspec(prefix, &sc->m2);
1234f8d11d7cShenning if (sc->d) {
1235f8d11d7cShenning printf(" burst ");
1236f8d11d7cShenning print_bwspec("", &sc->m1);
1237f8d11d7cShenning printf(" for %ums", sc->d);
1238f8d11d7cShenning }
1239f8d11d7cShenning }
1240f8d11d7cShenning
1241f8d11d7cShenning void
print_queuespec(struct pf_queuespec * q)1242f8d11d7cShenning print_queuespec(struct pf_queuespec *q)
1243f8d11d7cShenning {
1244f8d11d7cShenning printf("queue %s", q->qname);
124570b55ec8Smikeb if (q->parent[0])
1246f8d11d7cShenning printf(" parent %s", q->parent);
1247cd984deeSmikeb else if (q->ifname[0])
1248f8d11d7cShenning printf(" on %s", q->ifname);
124970b55ec8Smikeb if (q->flags & PFQS_FLOWQUEUE) {
125070b55ec8Smikeb printf(" flows %u", q->flowqueue.flows);
125170b55ec8Smikeb if (q->flowqueue.quantum > 0)
125270b55ec8Smikeb printf(" quantum %u", q->flowqueue.quantum);
125370b55ec8Smikeb if (q->flowqueue.interval > 0)
125470b55ec8Smikeb printf(" interval %ums",
125570b55ec8Smikeb q->flowqueue.interval / 1000000);
125670b55ec8Smikeb if (q->flowqueue.target > 0)
125770b55ec8Smikeb printf(" target %ums",
125870b55ec8Smikeb q->flowqueue.target / 1000000);
125990944f0fSmikeb }
126090944f0fSmikeb if (q->linkshare.m1.absolute || q->linkshare.m2.absolute) {
1261f8d11d7cShenning print_scspec(" bandwidth ", &q->linkshare);
1262f8d11d7cShenning print_scspec(", min ", &q->realtime);
1263f8d11d7cShenning print_scspec(", max ", &q->upperlimit);
126470b55ec8Smikeb }
126570b55ec8Smikeb if (q->flags & PFQS_DEFAULT)
1266f8d11d7cShenning printf(" default");
1267f8d11d7cShenning if (q->qlimit)
1268f8d11d7cShenning printf(" qlimit %u", q->qlimit);
1269f8d11d7cShenning printf("\n");
1270f8d11d7cShenning }
1271f8d11d7cShenning
12721f8f21bdSmillert int
parse_flags(char * s)1273ff352a37Smarkus parse_flags(char *s)
127414a9b182Skjell {
1275ff352a37Smarkus char *p, *q;
127614a9b182Skjell u_int8_t f = 0;
127781a15e5dSderaadt
1278ff352a37Smarkus for (p = s; *p; p++) {
1279ff352a37Smarkus if ((q = strchr(tcpflags, *p)) == NULL)
1280ff352a37Smarkus return -1;
1281ff352a37Smarkus else
1282ff352a37Smarkus f |= 1 << (q - tcpflags);
128314a9b182Skjell }
1284bc795af0Shugh return (f ? f : PF_TH_ALL);
128514a9b182Skjell }
128694e9410bShenning
128794e9410bShenning void
set_ipmask(struct node_host * h,int bb)1288c04427ddSkn set_ipmask(struct node_host *h, int bb)
128994e9410bShenning {
129094e9410bShenning struct pf_addr *m, *n;
129194e9410bShenning int i, j = 0;
1292c04427ddSkn u_int8_t b;
129394e9410bShenning
129494e9410bShenning m = &h->addr.v.a.mask;
1295ab648bf6Sfrantzen memset(m, 0, sizeof(*m));
129694e9410bShenning
1297c04427ddSkn if (bb == -1)
1298c04427ddSkn b = h->af == AF_INET ? 32 : 128;
1299c04427ddSkn else
1300c04427ddSkn b = bb;
1301c04427ddSkn
130294e9410bShenning while (b >= 32) {
130394e9410bShenning m->addr32[j++] = 0xffffffff;
130494e9410bShenning b -= 32;
130594e9410bShenning }
130694e9410bShenning for (i = 31; i > 31-b; --i)
130794e9410bShenning m->addr32[j] |= (1 << i);
130894e9410bShenning if (b)
130994e9410bShenning m->addr32[j] = htonl(m->addr32[j]);
131094e9410bShenning
131194e9410bShenning /* Mask off bits of the address that will never be used. */
131294e9410bShenning n = &h->addr.v.a.addr;
1313ff626af1Shenning if (h->addr.type == PF_ADDR_ADDRMASK)
131494e9410bShenning for (i = 0; i < 4; i++)
131594e9410bShenning n->addr32[i] = n->addr32[i] & m->addr32[i];
131694e9410bShenning }
131794e9410bShenning
131852f4a4a4Shenning int
check_netmask(struct node_host * h,sa_family_t af)131952f4a4a4Shenning check_netmask(struct node_host *h, sa_family_t af)
132052f4a4a4Shenning {
132152f4a4a4Shenning struct node_host *n = NULL;
132252f4a4a4Shenning struct pf_addr *m;
132352f4a4a4Shenning
132452f4a4a4Shenning for (n = h; n != NULL; n = n->next) {
132575d911b5Scedric if (h->addr.type == PF_ADDR_TABLE)
132675d911b5Scedric continue;
132752f4a4a4Shenning m = &h->addr.v.a.mask;
132852f4a4a4Shenning /* netmasks > 32 bit are invalid on v4 */
132952f4a4a4Shenning if (af == AF_INET &&
133052f4a4a4Shenning (m->addr32[1] || m->addr32[2] || m->addr32[3])) {
133152f4a4a4Shenning fprintf(stderr, "netmask %u invalid for IPv4 address\n",
1332f0bb6ca5Skn unmask(m));
133352f4a4a4Shenning return (1);
133452f4a4a4Shenning }
133552f4a4a4Shenning }
133652f4a4a4Shenning return (0);
133752f4a4a4Shenning }
133852f4a4a4Shenning
1339c64927a6Smikeb struct node_host *
gen_dynnode(struct node_host * h,sa_family_t af)1340c64927a6Smikeb gen_dynnode(struct node_host *h, sa_family_t af)
1341c64927a6Smikeb {
1342c64927a6Smikeb struct node_host *n;
1343c64927a6Smikeb
1344c64927a6Smikeb if (h->addr.type != PF_ADDR_DYNIFTL)
1345c64927a6Smikeb return (NULL);
1346c64927a6Smikeb
1347c64927a6Smikeb if ((n = calloc(1, sizeof(*n))) == NULL)
1348c64927a6Smikeb return (NULL);
1349c64927a6Smikeb bcopy(h, n, sizeof(*n));
1350c64927a6Smikeb n->ifname = NULL;
1351c64927a6Smikeb n->next = NULL;
1352c64927a6Smikeb n->tail = NULL;
1353c64927a6Smikeb
1354c64927a6Smikeb /* fix up netmask */
13559e1cf8acSkn if (af == AF_INET && unmask(&n->addr.v.a.mask) > 32)
1356c64927a6Smikeb set_ipmask(n, 32);
1357c64927a6Smikeb
1358c64927a6Smikeb return (n);
1359c64927a6Smikeb }
1360c64927a6Smikeb
136194e9410bShenning /* interface lookup routines */
136294e9410bShenning
136394e9410bShenning struct node_host *iftab;
136494e9410bShenning
136594e9410bShenning void
ifa_load(void)136694e9410bShenning ifa_load(void)
136794e9410bShenning {
136894e9410bShenning struct ifaddrs *ifap, *ifa;
136994e9410bShenning struct node_host *n = NULL, *h = NULL;
137094e9410bShenning
1371df69c215Sderaadt if (getifaddrs(&ifap) == -1)
137294e9410bShenning err(1, "getifaddrs");
137394e9410bShenning
137494e9410bShenning for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
1375ff7f4978Sbenno if (ifa->ifa_addr == NULL ||
1376ff7f4978Sbenno !(ifa->ifa_addr->sa_family == AF_INET ||
137794e9410bShenning ifa->ifa_addr->sa_family == AF_INET6 ||
137894e9410bShenning ifa->ifa_addr->sa_family == AF_LINK))
137994e9410bShenning continue;
138094e9410bShenning n = calloc(1, sizeof(struct node_host));
138194e9410bShenning if (n == NULL)
1382f79f34e1Skn err(1, "%s: calloc", __func__);
138394e9410bShenning n->af = ifa->ifa_addr->sa_family;
138494e9410bShenning n->ifa_flags = ifa->ifa_flags;
138594e9410bShenning #ifdef __KAME__
138694e9410bShenning if (n->af == AF_INET6 &&
138794e9410bShenning IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)
138894e9410bShenning ifa->ifa_addr)->sin6_addr) &&
1389ab642153Shenning ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id ==
1390ab642153Shenning 0) {
139194e9410bShenning struct sockaddr_in6 *sin6;
139294e9410bShenning
139394e9410bShenning sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
139494e9410bShenning sin6->sin6_scope_id = sin6->sin6_addr.s6_addr[2] << 8 |
139594e9410bShenning sin6->sin6_addr.s6_addr[3];
139694e9410bShenning sin6->sin6_addr.s6_addr[2] = 0;
139794e9410bShenning sin6->sin6_addr.s6_addr[3] = 0;
139894e9410bShenning }
139994e9410bShenning #endif
140094e9410bShenning n->ifindex = 0;
1401675ff33bSkn if (n->af == AF_LINK)
1402918dda86Smikeb n->ifindex = ((struct sockaddr_dl *)
1403918dda86Smikeb ifa->ifa_addr)->sdl_index;
1404675ff33bSkn else {
1405675ff33bSkn copy_satopfaddr(&n->addr.v.a.addr, ifa->ifa_addr);
14061fef2296Sbluhm ifa->ifa_netmask->sa_family = ifa->ifa_addr->sa_family;
1407675ff33bSkn copy_satopfaddr(&n->addr.v.a.mask, ifa->ifa_netmask);
14081fef2296Sbluhm if (ifa->ifa_broadaddr != NULL) {
14091fef2296Sbluhm ifa->ifa_broadaddr->sa_family = ifa->ifa_addr->sa_family;
1410675ff33bSkn copy_satopfaddr(&n->bcast, ifa->ifa_broadaddr);
14111fef2296Sbluhm }
14121fef2296Sbluhm if (ifa->ifa_dstaddr != NULL) {
14131fef2296Sbluhm ifa->ifa_dstaddr->sa_family = ifa->ifa_addr->sa_family;
1414675ff33bSkn copy_satopfaddr(&n->peer, ifa->ifa_dstaddr);
14151fef2296Sbluhm }
1416675ff33bSkn if (n->af == AF_INET6)
1417675ff33bSkn n->ifindex = ((struct sockaddr_in6 *)
1418675ff33bSkn ifa->ifa_addr)->sin6_scope_id;
141994e9410bShenning }
142094e9410bShenning if ((n->ifname = strdup(ifa->ifa_name)) == NULL)
1421f79f34e1Skn err(1, "%s: strdup", __func__);
142294e9410bShenning n->next = NULL;
142394e9410bShenning n->tail = n;
142494e9410bShenning if (h == NULL)
142594e9410bShenning h = n;
142694e9410bShenning else {
142794e9410bShenning h->tail->next = n;
142894e9410bShenning h->tail = n;
142994e9410bShenning }
143094e9410bShenning }
1431ec359bd5Scedric
143294e9410bShenning iftab = h;
143394e9410bShenning freeifaddrs(ifap);
143494e9410bShenning }
143594e9410bShenning
1436918dda86Smikeb unsigned int
ifa_nametoindex(const char * ifa_name)1437918dda86Smikeb ifa_nametoindex(const char *ifa_name)
1438918dda86Smikeb {
1439918dda86Smikeb struct node_host *p;
1440918dda86Smikeb
1441918dda86Smikeb for (p = iftab; p; p = p->next) {
1442918dda86Smikeb if (p->af == AF_LINK && strcmp(p->ifname, ifa_name) == 0)
1443918dda86Smikeb return (p->ifindex);
1444918dda86Smikeb }
1445918dda86Smikeb errno = ENXIO;
1446918dda86Smikeb return (0);
1447918dda86Smikeb }
1448918dda86Smikeb
1449918dda86Smikeb char *
ifa_indextoname(unsigned int ifindex,char * ifa_name)1450918dda86Smikeb ifa_indextoname(unsigned int ifindex, char *ifa_name)
1451918dda86Smikeb {
1452918dda86Smikeb struct node_host *p;
1453918dda86Smikeb
1454918dda86Smikeb for (p = iftab; p; p = p->next) {
1455918dda86Smikeb if (p->af == AF_LINK && ifindex == p->ifindex) {
1456918dda86Smikeb strlcpy(ifa_name, p->ifname, IFNAMSIZ);
1457918dda86Smikeb return (ifa_name);
1458918dda86Smikeb }
1459918dda86Smikeb }
1460918dda86Smikeb errno = ENXIO;
1461918dda86Smikeb return (NULL);
1462918dda86Smikeb }
1463918dda86Smikeb
146494e9410bShenning struct node_host *
ifa_exists(const char * ifa_name)14656c3582faShenning ifa_exists(const char *ifa_name)
146694e9410bShenning {
146794e9410bShenning struct node_host *n;
14682ff5b035Shenning struct ifgroupreq ifgr;
14692ff5b035Shenning int s;
147094e9410bShenning
147194e9410bShenning if (iftab == NULL)
147294e9410bShenning ifa_load();
147394e9410bShenning
1474855d4e83Ssobrado /* check whether this is a group */
14752ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
14762ff5b035Shenning err(1, "socket");
14772ff5b035Shenning bzero(&ifgr, sizeof(ifgr));
14782ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name));
14792ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == 0) {
14802ff5b035Shenning /* fake a node_host */
14812ff5b035Shenning if ((n = calloc(1, sizeof(*n))) == NULL)
14822ff5b035Shenning err(1, "calloc");
14832ff5b035Shenning if ((n->ifname = strdup(ifa_name)) == NULL)
14842ff5b035Shenning err(1, "strdup");
14852ff5b035Shenning close(s);
14862ff5b035Shenning return (n);
14872ff5b035Shenning }
14882ff5b035Shenning close(s);
14892ff5b035Shenning
149094e9410bShenning for (n = iftab; n; n = n->next) {
149194e9410bShenning if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ))
149294e9410bShenning return (n);
149394e9410bShenning }
1494655a9f8aShenning
149594e9410bShenning return (NULL);
149694e9410bShenning }
149794e9410bShenning
149894e9410bShenning struct node_host *
ifa_grouplookup(const char * ifa_name,int flags)14992ff5b035Shenning ifa_grouplookup(const char *ifa_name, int flags)
15002ff5b035Shenning {
15012ff5b035Shenning struct ifg_req *ifg;
15022ff5b035Shenning struct ifgroupreq ifgr;
15032ff5b035Shenning int s, len;
1504727cb2f7Sdhartmei struct node_host *n, *h = NULL;
15052ff5b035Shenning
15062ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
15072ff5b035Shenning err(1, "socket");
15082ff5b035Shenning bzero(&ifgr, sizeof(ifgr));
15092ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name));
15102ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) {
15112ff5b035Shenning close(s);
15122ff5b035Shenning return (NULL);
15132ff5b035Shenning }
15142ff5b035Shenning
15152ff5b035Shenning len = ifgr.ifgr_len;
15162ff5b035Shenning if ((ifgr.ifgr_groups = calloc(1, len)) == NULL)
15172ff5b035Shenning err(1, "calloc");
15182ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1)
15192ff5b035Shenning err(1, "SIOCGIFGMEMB");
15202ff5b035Shenning
15212ff5b035Shenning for (ifg = ifgr.ifgr_groups; ifg && len >= sizeof(struct ifg_req);
15222ff5b035Shenning ifg++) {
15232ff5b035Shenning len -= sizeof(struct ifg_req);
152417b44c41Shenning if ((n = ifa_lookup(ifg->ifgrq_member, flags)) == NULL)
152517b44c41Shenning continue;
15262ff5b035Shenning if (h == NULL)
15272ff5b035Shenning h = n;
15282ff5b035Shenning else {
1529727cb2f7Sdhartmei h->tail->next = n;
1530727cb2f7Sdhartmei h->tail = n->tail;
15312ff5b035Shenning }
15322ff5b035Shenning }
15332ff5b035Shenning free(ifgr.ifgr_groups);
15342ff5b035Shenning close(s);
15352ff5b035Shenning
15362ff5b035Shenning return (h);
15372ff5b035Shenning }
15382ff5b035Shenning
15392ff5b035Shenning struct node_host *
ifa_lookup(const char * ifa_name,int flags)1540ec359bd5Scedric ifa_lookup(const char *ifa_name, int flags)
154194e9410bShenning {
154294e9410bShenning struct node_host *p = NULL, *h = NULL, *n = NULL;
15437ad220f2Scedric int got4 = 0, got6 = 0;
1544ec359bd5Scedric const char *last_if = NULL;
154594e9410bShenning
15462ff5b035Shenning if ((h = ifa_grouplookup(ifa_name, flags)) != NULL)
15472ff5b035Shenning return (h);
15482ff5b035Shenning
154994e9410bShenning if (!strncmp(ifa_name, "self", IFNAMSIZ))
15507ad220f2Scedric ifa_name = NULL;
155194e9410bShenning
155294e9410bShenning if (iftab == NULL)
155394e9410bShenning ifa_load();
155494e9410bShenning
155594e9410bShenning for (p = iftab; p; p = p->next) {
15567ad220f2Scedric if (ifa_skip_if(ifa_name, p))
155794e9410bShenning continue;
1558ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET)
155994e9410bShenning continue;
1560ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) &&
1561ec359bd5Scedric !(p->ifa_flags & IFF_BROADCAST))
156294e9410bShenning continue;
1563cf181e99Sbluhm if ((flags & PFI_AFLAG_BROADCAST) && p->bcast.v4.s_addr == 0)
1564cf181e99Sbluhm continue;
1565ec359bd5Scedric if ((flags & PFI_AFLAG_PEER) &&
1566ec359bd5Scedric !(p->ifa_flags & IFF_POINTOPOINT))
1567ec359bd5Scedric continue;
1568ec359bd5Scedric if ((flags & PFI_AFLAG_NETWORK) && p->ifindex > 0)
1569ec359bd5Scedric continue;
1570ec359bd5Scedric if (last_if == NULL || strcmp(last_if, p->ifname))
1571ec359bd5Scedric got4 = got6 = 0;
1572ec359bd5Scedric last_if = p->ifname;
1573ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4)
1574ec359bd5Scedric continue;
1575ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6)
1576ec359bd5Scedric continue;
1577ec359bd5Scedric if (p->af == AF_INET)
1578ec359bd5Scedric got4 = 1;
1579ec359bd5Scedric else
1580ec359bd5Scedric got6 = 1;
158194e9410bShenning n = calloc(1, sizeof(struct node_host));
158294e9410bShenning if (n == NULL)
1583f79f34e1Skn err(1, "%s: calloc", __func__);
158494e9410bShenning n->af = p->af;
1585ec359bd5Scedric if (flags & PFI_AFLAG_BROADCAST)
158694e9410bShenning memcpy(&n->addr.v.a.addr, &p->bcast,
158794e9410bShenning sizeof(struct pf_addr));
1588ec359bd5Scedric else if (flags & PFI_AFLAG_PEER)
1589ec359bd5Scedric memcpy(&n->addr.v.a.addr, &p->peer,
1590ec359bd5Scedric sizeof(struct pf_addr));
159194e9410bShenning else
159294e9410bShenning memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr,
159394e9410bShenning sizeof(struct pf_addr));
1594ec359bd5Scedric if (flags & PFI_AFLAG_NETWORK)
1595f0bb6ca5Skn set_ipmask(n, unmask(&p->addr.v.a.mask));
159694e9410bShenning else
1597c04427ddSkn set_ipmask(n, -1);
159894e9410bShenning n->ifindex = p->ifindex;
159994e9410bShenning
160094e9410bShenning n->next = NULL;
160194e9410bShenning n->tail = n;
160294e9410bShenning if (h == NULL)
160394e9410bShenning h = n;
160494e9410bShenning else {
160594e9410bShenning h->tail->next = n;
160694e9410bShenning h->tail = n;
160794e9410bShenning }
160894e9410bShenning }
160994e9410bShenning return (h);
161094e9410bShenning }
161194e9410bShenning
16127ad220f2Scedric int
ifa_skip_if(const char * filter,struct node_host * p)16137ad220f2Scedric ifa_skip_if(const char *filter, struct node_host *p)
16147ad220f2Scedric {
16157ad220f2Scedric int n;
16167ad220f2Scedric
16177ad220f2Scedric if (p->af != AF_INET && p->af != AF_INET6)
16187ad220f2Scedric return (1);
16197ad220f2Scedric if (filter == NULL || !*filter)
16207ad220f2Scedric return (0);
16217ad220f2Scedric if (!strcmp(p->ifname, filter))
16227ad220f2Scedric return (0); /* exact match */
16237ad220f2Scedric n = strlen(filter);
16247ad220f2Scedric if (n < 1 || n >= IFNAMSIZ)
16257ad220f2Scedric return (1); /* sanity check */
16267ad220f2Scedric if (filter[n-1] >= '0' && filter[n-1] <= '9')
16277ad220f2Scedric return (1); /* only do exact match in that case */
16287ad220f2Scedric if (strncmp(p->ifname, filter, n))
16297ad220f2Scedric return (1); /* prefix doesn't match */
16307ad220f2Scedric return (p->ifname[n] < '0' || p->ifname[n] > '9');
16317ad220f2Scedric }
16327ad220f2Scedric
163394e9410bShenning struct node_host *
host(const char * s,int opts)16347c8726d4Sbenno host(const char *s, int opts)
163594e9410bShenning {
163636754172Smcbride struct node_host *h = NULL, *n;
163717e25e94Skn int mask = -1;
16385812a4adSdlg char *p, *ps;
1639e351e6cbSkn const char *errstr;
164094e9410bShenning
164136754172Smcbride if ((ps = strdup(s)) == NULL)
1642e7f9714dSkn err(1, "%s: strdup", __func__);
164336754172Smcbride
1644dfaca142Skn if ((p = strchr(ps, '/')) != NULL) {
164517e25e94Skn mask = strtonum(p+1, 0, 128, &errstr);
1646e351e6cbSkn if (errstr) {
1647e351e6cbSkn fprintf(stderr, "netmask is %s: %s\n", errstr, p);
1648a98f6f5fSkn goto error;
164994e9410bShenning }
165036754172Smcbride p[0] = '\0';
1651e7f9714dSkn }
165294e9410bShenning
1653a98f6f5fSkn if ((h = host_if(ps, mask)) == NULL &&
16541b6fdc2fSkn (h = host_ip(ps, mask)) == NULL &&
165517e25e94Skn (h = host_dns(ps, mask, (opts & PF_OPT_NODNS))) == NULL) {
1656a98f6f5fSkn fprintf(stderr, "no IP address found for %s\n", s);
1657a98f6f5fSkn goto error;
1658a98f6f5fSkn }
16592a6c1abaShenning
1660cbdc262eSmcbride for (n = h; n != NULL; n = n->next) {
1661d20cfe34Smcbride n->addr.type = PF_ADDR_ADDRMASK;
1662cbdc262eSmcbride n->weight = 0;
1663cbdc262eSmcbride }
1664a98f6f5fSkn
1665a98f6f5fSkn error:
1666a98f6f5fSkn free(ps);
16672a6c1abaShenning return (h);
16682a6c1abaShenning }
16692a6c1abaShenning
16702a6c1abaShenning struct node_host *
host_if(const char * s,int mask)1671f2370d27Shenning host_if(const char *s, int mask)
16722a6c1abaShenning {
16732a6c1abaShenning struct node_host *n, *h = NULL;
16744a36d485Shenning char *p, *ps;
1675ec359bd5Scedric int flags = 0;
16762a6c1abaShenning
1677ec359bd5Scedric if ((ps = strdup(s)) == NULL)
1678ec359bd5Scedric err(1, "host_if: strdup");
1679ec359bd5Scedric while ((p = strrchr(ps, ':')) != NULL) {
16804a36d485Shenning if (!strcmp(p+1, "network"))
1681ec359bd5Scedric flags |= PFI_AFLAG_NETWORK;
1682ec359bd5Scedric else if (!strcmp(p+1, "broadcast"))
1683ec359bd5Scedric flags |= PFI_AFLAG_BROADCAST;
1684ec359bd5Scedric else if (!strcmp(p+1, "peer"))
1685ec359bd5Scedric flags |= PFI_AFLAG_PEER;
1686ec359bd5Scedric else if (!strcmp(p+1, "0"))
1687ec359bd5Scedric flags |= PFI_AFLAG_NOALIAS;
1688d1273114Skn else
1689d1273114Skn goto error;
1690ec359bd5Scedric *p = '\0';
1691ec359bd5Scedric }
1692ec359bd5Scedric if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */
1693ec359bd5Scedric fprintf(stderr, "illegal combination of interface modifiers\n");
1694d1273114Skn goto error;
1695ec359bd5Scedric }
1696ec359bd5Scedric if ((flags & (PFI_AFLAG_NETWORK|PFI_AFLAG_BROADCAST)) && mask > -1) {
16974a36d485Shenning fprintf(stderr, "network or broadcast lookup, but "
16984a36d485Shenning "extra netmask given\n");
1699d1273114Skn goto error;
17004a36d485Shenning }
17016c3582faShenning if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ)) {
17022a6c1abaShenning /* interface with this name exists */
1703ec359bd5Scedric h = ifa_lookup(ps, flags);
1704c04427ddSkn if (mask > -1)
1705c04427ddSkn for (n = h; n != NULL; n = n->next)
17062a6c1abaShenning set_ipmask(n, mask);
17072a6c1abaShenning }
17084a36d485Shenning
1709d1273114Skn error:
17104a36d485Shenning free(ps);
17112a6c1abaShenning return (h);
17122a6c1abaShenning }
17132a6c1abaShenning
17142a6c1abaShenning struct node_host *
host_ip(const char * s,int mask)17151b6fdc2fSkn host_ip(const char *s, int mask)
17162a6c1abaShenning {
17172a6c1abaShenning struct addrinfo hints, *res;
17182a6c1abaShenning struct node_host *h = NULL;
171994e9410bShenning
172094e9410bShenning memset(&hints, 0, sizeof(hints));
17211b6fdc2fSkn hints.ai_family = AF_UNSPEC;
172294e9410bShenning hints.ai_socktype = SOCK_DGRAM; /*dummy*/
172394e9410bShenning hints.ai_flags = AI_NUMERICHOST;
17241b6fdc2fSkn if (getaddrinfo(s, NULL, &hints, &res) == 0) {
17251b6fdc2fSkn h = calloc(1, sizeof(*h));
17262a6c1abaShenning if (h == NULL)
17271b6fdc2fSkn err(1, "%s: calloc", __func__);
17281b6fdc2fSkn h->af = res->ai_family;
1729675ff33bSkn copy_satopfaddr(&h->addr.v.a.addr, res->ai_addr);
17301b6fdc2fSkn if (h->af == AF_INET6)
17312a6c1abaShenning h->ifindex =
17322a6c1abaShenning ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id;
173394e9410bShenning freeaddrinfo(res);
17341b6fdc2fSkn } else { /* ie. for 10/8 parsing */
17351b6fdc2fSkn if (mask == -1)
17361b6fdc2fSkn return (NULL);
17371b6fdc2fSkn h = calloc(1, sizeof(*h));
17381b6fdc2fSkn if (h == NULL)
17391b6fdc2fSkn err(1, "%s: calloc", __func__);
17401b6fdc2fSkn h->af = AF_INET;
17411b6fdc2fSkn if (inet_net_pton(AF_INET, s, &h->addr.v.a.addr.v4,
17421b6fdc2fSkn sizeof(h->addr.v.a.addr.v4)) == -1) {
17431b6fdc2fSkn free(h);
17441b6fdc2fSkn return (NULL);
17451b6fdc2fSkn }
17461b6fdc2fSkn }
17471b6fdc2fSkn set_ipmask(h, mask);
17481b6fdc2fSkn h->ifname = NULL;
17492a6c1abaShenning h->next = NULL;
17502a6c1abaShenning h->tail = h;
175194e9410bShenning
17522a6c1abaShenning return (h);
17532a6c1abaShenning }
17542a6c1abaShenning
17552a6c1abaShenning struct node_host *
host_dns(const char * s,int mask,int numeric)175617e25e94Skn host_dns(const char *s, int mask, int numeric)
17572a6c1abaShenning {
17582a6c1abaShenning struct addrinfo hints, *res0, *res;
17592a6c1abaShenning struct node_host *n, *h = NULL;
1760da7f49d7Skn int noalias = 0, got4 = 0, got6 = 0;
1761ec359bd5Scedric char *p, *ps;
17622a6c1abaShenning
1763ec359bd5Scedric if ((ps = strdup(s)) == NULL)
176422dee42fShenning err(1, "host_dns: strdup");
1765ec359bd5Scedric if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) {
1766ec359bd5Scedric noalias = 1;
1767ec359bd5Scedric *p = '\0';
1768ec359bd5Scedric }
176994e9410bShenning memset(&hints, 0, sizeof(hints));
177094e9410bShenning hints.ai_family = PF_UNSPEC;
177194e9410bShenning hints.ai_socktype = SOCK_STREAM; /* DUMMY */
17727c8726d4Sbenno if (numeric)
17737c8726d4Sbenno hints.ai_flags = AI_NUMERICHOST;
1774da7f49d7Skn if (getaddrinfo(ps, NULL, &hints, &res0) != 0)
1775da7f49d7Skn goto error;
17762a6c1abaShenning
177794e9410bShenning for (res = res0; res; res = res->ai_next) {
177894e9410bShenning if (res->ai_family != AF_INET &&
177994e9410bShenning res->ai_family != AF_INET6)
178094e9410bShenning continue;
1781ec359bd5Scedric if (noalias) {
1782ec359bd5Scedric if (res->ai_family == AF_INET) {
1783ec359bd5Scedric if (got4)
1784ec359bd5Scedric continue;
1785ec359bd5Scedric got4 = 1;
1786ec359bd5Scedric } else {
1787ec359bd5Scedric if (got6)
1788ec359bd5Scedric continue;
1789ec359bd5Scedric got6 = 1;
1790ec359bd5Scedric }
1791ec359bd5Scedric }
179294e9410bShenning n = calloc(1, sizeof(struct node_host));
179394e9410bShenning if (n == NULL)
17942a6c1abaShenning err(1, "host_dns: calloc");
179594e9410bShenning n->ifname = NULL;
179694e9410bShenning n->af = res->ai_family;
1797675ff33bSkn copy_satopfaddr(&n->addr.v.a.addr, res->ai_addr);
1798675ff33bSkn if (res->ai_family == AF_INET6)
179994e9410bShenning n->ifindex =
1800675ff33bSkn ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id;
1801c04427ddSkn set_ipmask(n, mask);
180294e9410bShenning n->next = NULL;
180394e9410bShenning n->tail = n;
180494e9410bShenning if (h == NULL)
180594e9410bShenning h = n;
180694e9410bShenning else {
180794e9410bShenning h->tail->next = n;
180894e9410bShenning h->tail = n;
180994e9410bShenning }
181094e9410bShenning }
181194e9410bShenning freeaddrinfo(res0);
1812da7f49d7Skn error:
1813ec359bd5Scedric free(ps);
181494e9410bShenning
181594e9410bShenning return (h);
181694e9410bShenning }
181742e05679Scedric
181842e05679Scedric /*
181942e05679Scedric * convert a hostname to a list of addresses and put them in the given buffer.
182042e05679Scedric * test:
182142e05679Scedric * if set to 1, only simple addresses are accepted (no netblock, no "!").
182242e05679Scedric */
182342e05679Scedric int
append_addr(struct pfr_buffer * b,char * s,int test,int opts)18247c8726d4Sbenno append_addr(struct pfr_buffer *b, char *s, int test, int opts)
182542e05679Scedric {
1826cbdc262eSmcbride static int previous = 0;
1827cbdc262eSmcbride static int expect = 0;
1828cbdc262eSmcbride struct pfr_addr *a;
1829b88a8d5dScedric struct node_host *h, *n;
1830cbdc262eSmcbride char *r;
1831cbdc262eSmcbride const char *errstr;
1832cbdc262eSmcbride int rv, not = 0, i = 0;
1833cbdc262eSmcbride u_int16_t weight;
1834cbdc262eSmcbride
1835cbdc262eSmcbride /* skip weight if given */
1836cbdc262eSmcbride if (strcmp(s, "weight") == 0) {
1837cbdc262eSmcbride expect = 1;
1838cbdc262eSmcbride return (1); /* expecting further call */
1839cbdc262eSmcbride }
1840cbdc262eSmcbride
1841cbdc262eSmcbride /* check if previous host is set */
1842cbdc262eSmcbride if (expect) {
1843cbdc262eSmcbride /* parse and append load balancing weight */
1844cbdc262eSmcbride weight = strtonum(s, 1, USHRT_MAX, &errstr);
1845cbdc262eSmcbride if (errstr) {
1846cbdc262eSmcbride fprintf(stderr, "failed to convert weight %s\n", s);
1847cbdc262eSmcbride return (-1);
1848cbdc262eSmcbride }
1849cbdc262eSmcbride if (previous != -1) {
1850cbdc262eSmcbride PFRB_FOREACH(a, b) {
1851cbdc262eSmcbride if (++i >= previous) {
1852cbdc262eSmcbride a->pfra_weight = weight;
1853cbdc262eSmcbride a->pfra_type = PFRKE_COST;
1854cbdc262eSmcbride }
1855cbdc262eSmcbride }
1856cbdc262eSmcbride }
1857cbdc262eSmcbride expect = 0;
1858cbdc262eSmcbride return (0);
1859cbdc262eSmcbride }
18605b6c447dScedric
18615b6c447dScedric for (r = s; *r == '!'; r++)
18625b6c447dScedric not = !not;
18637c8726d4Sbenno if ((n = host(r, opts)) == NULL) {
18645b6c447dScedric errno = 0;
18655b6c447dScedric return (-1);
18665b6c447dScedric }
1867b88a8d5dScedric rv = append_addr_host(b, n, test, not);
1868cbdc262eSmcbride previous = b->pfrb_size;
1869b88a8d5dScedric do {
1870b88a8d5dScedric h = n;
1871b88a8d5dScedric n = n->next;
1872b88a8d5dScedric free(h);
1873b88a8d5dScedric } while (n != NULL);
1874b88a8d5dScedric return (rv);
187542e05679Scedric }
187642e05679Scedric
187742e05679Scedric /*
18785b6c447dScedric * same as previous function, but with a pre-parsed input and the ability
1879b88a8d5dScedric * to "negate" the result. Does not free the node_host list.
188042e05679Scedric * not:
188142e05679Scedric * setting it to 1 is equivalent to adding "!" in front of parameter s.
188242e05679Scedric */
188342e05679Scedric int
append_addr_host(struct pfr_buffer * b,struct node_host * n,int test,int not)18845b6c447dScedric append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not)
188542e05679Scedric {
188642e05679Scedric int bits;
188742e05679Scedric struct pfr_addr addr;
188842e05679Scedric
188942e05679Scedric do {
189042e05679Scedric bzero(&addr, sizeof(addr));
18915b6c447dScedric addr.pfra_not = n->not ^ not;
189242e05679Scedric addr.pfra_af = n->af;
1893f0bb6ca5Skn addr.pfra_net = unmask(&n->addr.v.a.mask);
189436754172Smcbride if (n->ifname) {
189536754172Smcbride if (strlcpy(addr.pfra_ifname, n->ifname,
189636754172Smcbride sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname))
189736754172Smcbride errx(1, "append_addr_host: strlcpy");
189836754172Smcbride addr.pfra_type = PFRKE_ROUTE;
189936754172Smcbride }
1900cbdc262eSmcbride if (n->weight > 0) {
1901cbdc262eSmcbride addr.pfra_weight = n->weight;
1902cbdc262eSmcbride addr.pfra_type = PFRKE_COST;
1903cbdc262eSmcbride }
190442e05679Scedric switch (n->af) {
190542e05679Scedric case AF_INET:
190642e05679Scedric addr.pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32[0];
190742e05679Scedric bits = 32;
190842e05679Scedric break;
190942e05679Scedric case AF_INET6:
191042e05679Scedric memcpy(&addr.pfra_ip6addr, &n->addr.v.a.addr.v6,
191142e05679Scedric sizeof(struct in6_addr));
191242e05679Scedric bits = 128;
191342e05679Scedric break;
191442e05679Scedric default:
191542e05679Scedric errno = EINVAL;
191642e05679Scedric return (-1);
191742e05679Scedric }
191842e05679Scedric if ((test && (not || addr.pfra_net != bits)) ||
191942e05679Scedric addr.pfra_net > bits) {
192042e05679Scedric errno = EINVAL;
192142e05679Scedric return (-1);
192242e05679Scedric }
192342e05679Scedric if (pfr_buf_add(b, &addr))
192442e05679Scedric return (-1);
1925b88a8d5dScedric } while ((n = n->next) != NULL);
192642e05679Scedric
192742e05679Scedric return (0);
192842e05679Scedric }
192979cc0068Scedric
193079cc0068Scedric int
pfctl_add_trans(struct pfr_buffer * buf,int type,const char * anchor)19319f66a89aShenning pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor)
193279cc0068Scedric {
193379cc0068Scedric struct pfioc_trans_e trans;
193479cc0068Scedric
193579cc0068Scedric bzero(&trans, sizeof(trans));
19369f66a89aShenning trans.type = type;
193779cc0068Scedric if (strlcpy(trans.anchor, anchor,
1938d9ad7941Sdhartmei sizeof(trans.anchor)) >= sizeof(trans.anchor))
193979cc0068Scedric errx(1, "pfctl_add_trans: strlcpy");
194079cc0068Scedric
194179cc0068Scedric return pfr_buf_add(buf, &trans);
194279cc0068Scedric }
194379cc0068Scedric
194479cc0068Scedric u_int32_t
pfctl_get_ticket(struct pfr_buffer * buf,int type,const char * anchor)19459f66a89aShenning pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor)
194679cc0068Scedric {
194779cc0068Scedric struct pfioc_trans_e *p;
194879cc0068Scedric
194979cc0068Scedric PFRB_FOREACH(p, buf)
19509f66a89aShenning if (type == p->type && !strcmp(anchor, p->anchor))
195179cc0068Scedric return (p->ticket);
195222dee42fShenning errx(1, "pfctl_get_ticket: assertion failed");
195379cc0068Scedric }
195479cc0068Scedric
195579cc0068Scedric int
pfctl_trans(int dev,struct pfr_buffer * buf,u_long cmd,int from)19563060c195Shenning pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from)
195779cc0068Scedric {
195879cc0068Scedric struct pfioc_trans trans;
195979cc0068Scedric
196079cc0068Scedric bzero(&trans, sizeof(trans));
196179cc0068Scedric trans.size = buf->pfrb_size - from;
196279cc0068Scedric trans.esize = sizeof(struct pfioc_trans_e);
196379cc0068Scedric trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from;
196479cc0068Scedric return ioctl(dev, cmd, &trans);
196579cc0068Scedric }
1966