1*08263cb1Shenning /* $OpenBSD: pfctl_parser.c,v 1.290 2012/09/18 10:11:53 henning Exp $ */ 214a9b182Skjell 314a9b182Skjell /* 4fd3c3a0cSderaadt * Copyright (c) 2001 Daniel Hartmeier 5f2553c84Shenning * Copyright (c) 2002,2003 Henning Brauer 614a9b182Skjell * All rights reserved. 714a9b182Skjell * 814a9b182Skjell * Redistribution and use in source and binary forms, with or without 914a9b182Skjell * modification, are permitted provided that the following conditions 1014a9b182Skjell * are met: 1114a9b182Skjell * 1214a9b182Skjell * - Redistributions of source code must retain the above copyright 1314a9b182Skjell * notice, this list of conditions and the following disclaimer. 1414a9b182Skjell * - Redistributions in binary form must reproduce the above 1514a9b182Skjell * copyright notice, this list of conditions and the following 1614a9b182Skjell * disclaimer in the documentation and/or other materials provided 1714a9b182Skjell * with the distribution. 1814a9b182Skjell * 1914a9b182Skjell * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2014a9b182Skjell * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2114a9b182Skjell * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 2214a9b182Skjell * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 235974bd37Sdhartmei * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 2414a9b182Skjell * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 2514a9b182Skjell * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 2614a9b182Skjell * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 2714a9b182Skjell * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2814a9b182Skjell * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 2914a9b182Skjell * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 3014a9b182Skjell * POSSIBILITY OF SUCH DAMAGE. 3114a9b182Skjell * 3214a9b182Skjell */ 3314a9b182Skjell 34252d784aSderaadt #include <sys/types.h> 3579cc0068Scedric #include <sys/ioctl.h> 36252d784aSderaadt #include <sys/socket.h> 376b640f62Smcbride #include <sys/param.h> 386b640f62Smcbride #include <sys/proc.h> 39252d784aSderaadt #include <net/if.h> 40252d784aSderaadt #include <netinet/in.h> 416329fa59Sderaadt #include <netinet/in_systm.h> 426329fa59Sderaadt #include <netinet/ip.h> 436329fa59Sderaadt #include <netinet/ip_icmp.h> 4430620b12Sfrantzen #include <netinet/icmp6.h> 45252d784aSderaadt #include <net/pfvar.h> 469f13c6caSmillert #include <arpa/inet.h> 47252d784aSderaadt 4814a9b182Skjell #include <stdio.h> 4914a9b182Skjell #include <stdlib.h> 5014a9b182Skjell #include <string.h> 5114a9b182Skjell #include <ctype.h> 5214a9b182Skjell #include <netdb.h> 536329fa59Sderaadt #include <stdarg.h> 546329fa59Sderaadt #include <errno.h> 55ff352a37Smarkus #include <err.h> 5694e9410bShenning #include <ifaddrs.h> 572ff5b035Shenning #include <unistd.h> 5814a9b182Skjell 59a2fdc13dSmcbride #define SYSLOG_NAMES 60a2fdc13dSmcbride #include <syslog.h> 61a2fdc13dSmcbride 6214a9b182Skjell #include "pfctl_parser.h" 63eb824e11Sderaadt #include "pfctl.h" 6414a9b182Skjell 655d9ac2dcSdhartmei void print_op (u_int8_t, const char *, const char *); 66ad85696eShenning void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); 671173271aScedric void print_ugid (u_int8_t, unsigned, unsigned, const char *, unsigned); 6881a15e5dSderaadt void print_flags (u_int8_t); 6964b4b616Sfrantzen void print_fromto(struct pf_rule_addr *, pf_osfp_t, 7064b4b616Sfrantzen struct pf_rule_addr *, u_int8_t, u_int8_t, int); 717ad220f2Scedric int ifa_skip_if(const char *filter, struct node_host *p); 7214a9b182Skjell 732ff5b035Shenning struct node_host *ifa_grouplookup(const char *, int); 74f2370d27Shenning struct node_host *host_if(const char *, int); 75383ebbbfShenning struct node_host *host_v4(const char *, int); 76f2370d27Shenning struct node_host *host_v6(const char *, int); 77f2370d27Shenning struct node_host *host_dns(const char *, int, int); 782a6c1abaShenning 79361e311cShenning const char *tcpflags = "FSRPAUEW"; 8014a9b182Skjell 817d27d81aSdhartmei static const struct icmptypeent icmp_type[] = { 82082ebc44Swilfried { "echoreq", ICMP_ECHO }, 83082ebc44Swilfried { "echorep", ICMP_ECHOREPLY }, 84082ebc44Swilfried { "unreach", ICMP_UNREACH }, 85082ebc44Swilfried { "squench", ICMP_SOURCEQUENCH }, 86082ebc44Swilfried { "redir", ICMP_REDIRECT }, 87082ebc44Swilfried { "althost", ICMP_ALTHOSTADDR }, 88082ebc44Swilfried { "routeradv", ICMP_ROUTERADVERT }, 89082ebc44Swilfried { "routersol", ICMP_ROUTERSOLICIT }, 90082ebc44Swilfried { "timex", ICMP_TIMXCEED }, 91082ebc44Swilfried { "paramprob", ICMP_PARAMPROB }, 92082ebc44Swilfried { "timereq", ICMP_TSTAMP }, 93082ebc44Swilfried { "timerep", ICMP_TSTAMPREPLY }, 94082ebc44Swilfried { "inforeq", ICMP_IREQ }, 95082ebc44Swilfried { "inforep", ICMP_IREQREPLY }, 96082ebc44Swilfried { "maskreq", ICMP_MASKREQ }, 9702cbcc9eSwilfried { "maskrep", ICMP_MASKREPLY }, 9802cbcc9eSwilfried { "trace", ICMP_TRACEROUTE }, 9902cbcc9eSwilfried { "dataconv", ICMP_DATACONVERR }, 10002cbcc9eSwilfried { "mobredir", ICMP_MOBILE_REDIRECT }, 10102cbcc9eSwilfried { "ipv6-where", ICMP_IPV6_WHEREAREYOU }, 10202cbcc9eSwilfried { "ipv6-here", ICMP_IPV6_IAMHERE }, 10302cbcc9eSwilfried { "mobregreq", ICMP_MOBILE_REGREQUEST }, 10402cbcc9eSwilfried { "mobregrep", ICMP_MOBILE_REGREPLY }, 10502cbcc9eSwilfried { "skip", ICMP_SKIP }, 10602cbcc9eSwilfried { "photuris", ICMP_PHOTURIS } 107082ebc44Swilfried }; 108082ebc44Swilfried 1097d27d81aSdhartmei static const struct icmptypeent icmp6_type[] = { 11030620b12Sfrantzen { "unreach", ICMP6_DST_UNREACH }, 11130620b12Sfrantzen { "toobig", ICMP6_PACKET_TOO_BIG }, 11230620b12Sfrantzen { "timex", ICMP6_TIME_EXCEEDED }, 11330620b12Sfrantzen { "paramprob", ICMP6_PARAM_PROB }, 11430620b12Sfrantzen { "echoreq", ICMP6_ECHO_REQUEST }, 11530620b12Sfrantzen { "echorep", ICMP6_ECHO_REPLY }, 11630620b12Sfrantzen { "groupqry", ICMP6_MEMBERSHIP_QUERY }, 11722a58e88Sitojun { "listqry", MLD_LISTENER_QUERY }, 11830620b12Sfrantzen { "grouprep", ICMP6_MEMBERSHIP_REPORT }, 11922a58e88Sitojun { "listenrep", MLD_LISTENER_REPORT }, 12030620b12Sfrantzen { "groupterm", ICMP6_MEMBERSHIP_REDUCTION }, 12122a58e88Sitojun { "listendone", MLD_LISTENER_DONE }, 12230620b12Sfrantzen { "routersol", ND_ROUTER_SOLICIT }, 12330620b12Sfrantzen { "routeradv", ND_ROUTER_ADVERT }, 12430620b12Sfrantzen { "neighbrsol", ND_NEIGHBOR_SOLICIT }, 12530620b12Sfrantzen { "neighbradv", ND_NEIGHBOR_ADVERT }, 12630620b12Sfrantzen { "redir", ND_REDIRECT }, 12730620b12Sfrantzen { "routrrenum", ICMP6_ROUTER_RENUMBERING }, 12830620b12Sfrantzen { "wrureq", ICMP6_WRUREQUEST }, 12930620b12Sfrantzen { "wrurep", ICMP6_WRUREPLY }, 13030620b12Sfrantzen { "fqdnreq", ICMP6_FQDN_QUERY }, 13130620b12Sfrantzen { "fqdnrep", ICMP6_FQDN_REPLY }, 13230620b12Sfrantzen { "niqry", ICMP6_NI_QUERY }, 13330620b12Sfrantzen { "nirep", ICMP6_NI_REPLY }, 13422a58e88Sitojun { "mtraceresp", MLD_MTRACE_RESP }, 13522a58e88Sitojun { "mtrace", MLD_MTRACE } 13630620b12Sfrantzen }; 13730620b12Sfrantzen 1387d27d81aSdhartmei static const struct icmpcodeent icmp_code[] = { 139082ebc44Swilfried { "net-unr", ICMP_UNREACH, ICMP_UNREACH_NET }, 140082ebc44Swilfried { "host-unr", ICMP_UNREACH, ICMP_UNREACH_HOST }, 141082ebc44Swilfried { "proto-unr", ICMP_UNREACH, ICMP_UNREACH_PROTOCOL }, 142082ebc44Swilfried { "port-unr", ICMP_UNREACH, ICMP_UNREACH_PORT }, 143082ebc44Swilfried { "needfrag", ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG }, 144082ebc44Swilfried { "srcfail", ICMP_UNREACH, ICMP_UNREACH_SRCFAIL }, 145082ebc44Swilfried { "net-unk", ICMP_UNREACH, ICMP_UNREACH_NET_UNKNOWN }, 146082ebc44Swilfried { "host-unk", ICMP_UNREACH, ICMP_UNREACH_HOST_UNKNOWN }, 147082ebc44Swilfried { "isolate", ICMP_UNREACH, ICMP_UNREACH_ISOLATED }, 148082ebc44Swilfried { "net-prohib", ICMP_UNREACH, ICMP_UNREACH_NET_PROHIB }, 149082ebc44Swilfried { "host-prohib", ICMP_UNREACH, ICMP_UNREACH_HOST_PROHIB }, 150082ebc44Swilfried { "net-tos", ICMP_UNREACH, ICMP_UNREACH_TOSNET }, 151082ebc44Swilfried { "host-tos", ICMP_UNREACH, ICMP_UNREACH_TOSHOST }, 152082ebc44Swilfried { "filter-prohib", ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB }, 153082ebc44Swilfried { "host-preced", ICMP_UNREACH, ICMP_UNREACH_HOST_PRECEDENCE }, 154082ebc44Swilfried { "cutoff-preced", ICMP_UNREACH, ICMP_UNREACH_PRECEDENCE_CUTOFF }, 155082ebc44Swilfried { "redir-net", ICMP_REDIRECT, ICMP_REDIRECT_NET }, 156082ebc44Swilfried { "redir-host", ICMP_REDIRECT, ICMP_REDIRECT_HOST }, 157082ebc44Swilfried { "redir-tos-net", ICMP_REDIRECT, ICMP_REDIRECT_TOSNET }, 158082ebc44Swilfried { "redir-tos-host", ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST }, 15902cbcc9eSwilfried { "normal-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NORMAL }, 16002cbcc9eSwilfried { "common-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NOROUTE_COMMON }, 161082ebc44Swilfried { "transit", ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS }, 162082ebc44Swilfried { "reassemb", ICMP_TIMXCEED, ICMP_TIMXCEED_REASS }, 163082ebc44Swilfried { "badhead", ICMP_PARAMPROB, ICMP_PARAMPROB_ERRATPTR }, 164082ebc44Swilfried { "optmiss", ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT }, 16502cbcc9eSwilfried { "badlen", ICMP_PARAMPROB, ICMP_PARAMPROB_LENGTH }, 16602cbcc9eSwilfried { "unknown-ind", ICMP_PHOTURIS, ICMP_PHOTURIS_UNKNOWN_INDEX }, 16702cbcc9eSwilfried { "auth-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_AUTH_FAILED }, 16802cbcc9eSwilfried { "decrypt-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_DECRYPT_FAILED } 169082ebc44Swilfried }; 170082ebc44Swilfried 1717d27d81aSdhartmei static const struct icmpcodeent icmp6_code[] = { 1721d32ee3bSdhartmei { "admin-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN }, 1731d32ee3bSdhartmei { "noroute-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE }, 17430620b12Sfrantzen { "notnbr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOTNEIGHBOR }, 17530620b12Sfrantzen { "beyond-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_BEYONDSCOPE }, 17630620b12Sfrantzen { "addr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR }, 17730620b12Sfrantzen { "port-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT }, 17830620b12Sfrantzen { "transit", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT }, 17930620b12Sfrantzen { "reassemb", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY }, 18030620b12Sfrantzen { "badhead", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER }, 18130620b12Sfrantzen { "nxthdr", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER }, 18230620b12Sfrantzen { "redironlink", ND_REDIRECT, ND_REDIRECT_ONLINK }, 18330620b12Sfrantzen { "redirrouter", ND_REDIRECT, ND_REDIRECT_ROUTER } 18430620b12Sfrantzen }; 18530620b12Sfrantzen 186d593fb91Sdrahn const struct pf_timeout pf_timeouts[] = { 187d593fb91Sdrahn { "tcp.first", PFTM_TCP_FIRST_PACKET }, 188d593fb91Sdrahn { "tcp.opening", PFTM_TCP_OPENING }, 189d593fb91Sdrahn { "tcp.established", PFTM_TCP_ESTABLISHED }, 190d593fb91Sdrahn { "tcp.closing", PFTM_TCP_CLOSING }, 191d593fb91Sdrahn { "tcp.finwait", PFTM_TCP_FIN_WAIT }, 192d593fb91Sdrahn { "tcp.closed", PFTM_TCP_CLOSED }, 19398d12bd8Sfrantzen { "tcp.tsdiff", PFTM_TS_DIFF }, 194d593fb91Sdrahn { "udp.first", PFTM_UDP_FIRST_PACKET }, 195d593fb91Sdrahn { "udp.single", PFTM_UDP_SINGLE }, 196d593fb91Sdrahn { "udp.multiple", PFTM_UDP_MULTIPLE }, 197d593fb91Sdrahn { "icmp.first", PFTM_ICMP_FIRST_PACKET }, 198d593fb91Sdrahn { "icmp.error", PFTM_ICMP_ERROR_REPLY }, 199d593fb91Sdrahn { "other.first", PFTM_OTHER_FIRST_PACKET }, 200d593fb91Sdrahn { "other.single", PFTM_OTHER_SINGLE }, 201d593fb91Sdrahn { "other.multiple", PFTM_OTHER_MULTIPLE }, 202d593fb91Sdrahn { "frag", PFTM_FRAG }, 203d593fb91Sdrahn { "interval", PFTM_INTERVAL }, 204a85e74a5Sdhartmei { "adaptive.start", PFTM_ADAPTIVE_START }, 205a85e74a5Sdhartmei { "adaptive.end", PFTM_ADAPTIVE_END }, 206fd777407Smcbride { "src.track", PFTM_SRC_NODE }, 207d593fb91Sdrahn { NULL, 0 } 208d593fb91Sdrahn }; 209d593fb91Sdrahn 210a64374fdSmcbride enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; 211a64374fdSmcbride 2127d27d81aSdhartmei const struct icmptypeent * 213bb9f691eSmcbride geticmptypebynumber(u_int8_t type, sa_family_t af) 214082ebc44Swilfried { 215ed99c291Sderaadt unsigned int i; 216082ebc44Swilfried 217d14c53d7Swilfried if (af != AF_INET6) { 218e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 219e4ebe044Shenning i++) { 220082ebc44Swilfried if (type == icmp_type[i].type) 221082ebc44Swilfried return (&icmp_type[i]); 222082ebc44Swilfried } 22330620b12Sfrantzen } else { 22430620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 22530620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 22630620b12Sfrantzen if (type == icmp6_type[i].type) 22730620b12Sfrantzen return (&icmp6_type[i]); 22830620b12Sfrantzen } 22930620b12Sfrantzen } 23030620b12Sfrantzen return (NULL); 231082ebc44Swilfried } 232082ebc44Swilfried 2337d27d81aSdhartmei const struct icmptypeent * 234bb9f691eSmcbride geticmptypebyname(char *w, sa_family_t af) 235082ebc44Swilfried { 236ed99c291Sderaadt unsigned int i; 237082ebc44Swilfried 238d14c53d7Swilfried if (af != AF_INET6) { 239e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 240e4ebe044Shenning i++) { 241082ebc44Swilfried if (!strcmp(w, icmp_type[i].name)) 242082ebc44Swilfried return (&icmp_type[i]); 243082ebc44Swilfried } 24430620b12Sfrantzen } else { 24530620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 24630620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 24730620b12Sfrantzen if (!strcmp(w, icmp6_type[i].name)) 24830620b12Sfrantzen return (&icmp6_type[i]); 24930620b12Sfrantzen } 25030620b12Sfrantzen } 25130620b12Sfrantzen return (NULL); 252082ebc44Swilfried } 253082ebc44Swilfried 2547d27d81aSdhartmei const struct icmpcodeent * 255bb9f691eSmcbride geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) 256082ebc44Swilfried { 257ed99c291Sderaadt unsigned int i; 258082ebc44Swilfried 259d14c53d7Swilfried if (af != AF_INET6) { 260e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 261e4ebe044Shenning i++) { 26230620b12Sfrantzen if (type == icmp_code[i].type && 26330620b12Sfrantzen code == icmp_code[i].code) 264082ebc44Swilfried return (&icmp_code[i]); 265082ebc44Swilfried } 26630620b12Sfrantzen } else { 26730620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 26830620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 26930620b12Sfrantzen if (type == icmp6_code[i].type && 27030620b12Sfrantzen code == icmp6_code[i].code) 27130620b12Sfrantzen return (&icmp6_code[i]); 27230620b12Sfrantzen } 27330620b12Sfrantzen } 27430620b12Sfrantzen return (NULL); 275082ebc44Swilfried } 276082ebc44Swilfried 2777d27d81aSdhartmei const struct icmpcodeent * 278bb9f691eSmcbride geticmpcodebyname(u_long type, char *w, sa_family_t af) 279082ebc44Swilfried { 280ed99c291Sderaadt unsigned int i; 281082ebc44Swilfried 282d14c53d7Swilfried if (af != AF_INET6) { 283e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 284e4ebe044Shenning i++) { 28530620b12Sfrantzen if (type == icmp_code[i].type && 28630620b12Sfrantzen !strcmp(w, icmp_code[i].name)) 287082ebc44Swilfried return (&icmp_code[i]); 288082ebc44Swilfried } 28930620b12Sfrantzen } else { 29030620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 29130620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 29230620b12Sfrantzen if (type == icmp6_code[i].type && 29330620b12Sfrantzen !strcmp(w, icmp6_code[i].name)) 29430620b12Sfrantzen return (&icmp6_code[i]); 29530620b12Sfrantzen } 29630620b12Sfrantzen } 29730620b12Sfrantzen return (NULL); 29830620b12Sfrantzen } 29930620b12Sfrantzen 300a2fdc13dSmcbride /* 301a2fdc13dSmcbride * Decode a symbolic name to a numeric value. 302a2fdc13dSmcbride * From syslogd. 303a2fdc13dSmcbride */ 304a2fdc13dSmcbride int 305a2fdc13dSmcbride string_to_loglevel(const char *name) 306a2fdc13dSmcbride { 307a2fdc13dSmcbride CODE *c; 308a2fdc13dSmcbride char *p, buf[40]; 309a2fdc13dSmcbride 310a2fdc13dSmcbride if (isdigit(*name)) 311a2fdc13dSmcbride return (atoi(name)); 312a2fdc13dSmcbride 313a2fdc13dSmcbride for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { 314a2fdc13dSmcbride if (isupper(*name)) 315a2fdc13dSmcbride *p = tolower(*name); 316a2fdc13dSmcbride else 317a2fdc13dSmcbride *p = *name; 318a2fdc13dSmcbride } 319a2fdc13dSmcbride *p = '\0'; 320a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++) 321d07c4539Sbluhm if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI) 322a2fdc13dSmcbride return (c->c_val); 323a2fdc13dSmcbride 324a2fdc13dSmcbride return (-1); 325a2fdc13dSmcbride } 326a2fdc13dSmcbride 327a2fdc13dSmcbride const char * 328a2fdc13dSmcbride loglevel_to_string(int level) 329a2fdc13dSmcbride { 330a2fdc13dSmcbride CODE *c; 331a2fdc13dSmcbride 332a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++) 333a2fdc13dSmcbride if (c->c_val == level) 334a2fdc13dSmcbride return (c->c_name); 335a2fdc13dSmcbride 336a2fdc13dSmcbride return ("unknown"); 337a2fdc13dSmcbride } 338a2fdc13dSmcbride 33981a15e5dSderaadt void 3405d9ac2dcSdhartmei print_op(u_int8_t op, const char *a1, const char *a2) 3415d9ac2dcSdhartmei { 3425d9ac2dcSdhartmei if (op == PF_OP_IRG) 3435d9ac2dcSdhartmei printf(" %s >< %s", a1, a2); 3445d9ac2dcSdhartmei else if (op == PF_OP_XRG) 3455d9ac2dcSdhartmei printf(" %s <> %s", a1, a2); 3461308506cShenning else if (op == PF_OP_EQ) 3475d9ac2dcSdhartmei printf(" = %s", a1); 3481308506cShenning else if (op == PF_OP_NE) 3495d9ac2dcSdhartmei printf(" != %s", a1); 3501308506cShenning else if (op == PF_OP_LT) 3515d9ac2dcSdhartmei printf(" < %s", a1); 3525d9ac2dcSdhartmei else if (op == PF_OP_LE) 3535d9ac2dcSdhartmei printf(" <= %s", a1); 3545d9ac2dcSdhartmei else if (op == PF_OP_GT) 3555d9ac2dcSdhartmei printf(" > %s", a1); 3565d9ac2dcSdhartmei else if (op == PF_OP_GE) 3575d9ac2dcSdhartmei printf(" >= %s", a1); 3588da4e377Smcbride else if (op == PF_OP_RRG) 3598da4e377Smcbride printf(" %s:%s", a1, a2); 3605d9ac2dcSdhartmei } 3615d9ac2dcSdhartmei 3625d9ac2dcSdhartmei void 363ad85696eShenning print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) 36414a9b182Skjell { 365e31d21c9Sdhartmei char a1[6], a2[6]; 366ad85696eShenning struct servent *s = NULL; 36781a15e5dSderaadt 368ad85696eShenning if (opts & PF_OPT_PORTNAMES) 369e4ebe044Shenning s = getservbyport(p1, proto); 37014a9b182Skjell p1 = ntohs(p1); 37114a9b182Skjell p2 = ntohs(p2); 3725d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", p1); 3735d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", p2); 37414a9b182Skjell printf(" port"); 3755d9ac2dcSdhartmei if (s != NULL && (op == PF_OP_EQ || op == PF_OP_NE)) 3765d9ac2dcSdhartmei print_op(op, s->s_name, a2); 37714a9b182Skjell else 3785d9ac2dcSdhartmei print_op(op, a1, a2); 3795d9ac2dcSdhartmei } 3805d9ac2dcSdhartmei 3815d9ac2dcSdhartmei void 3821173271aScedric print_ugid(u_int8_t op, unsigned u1, unsigned u2, const char *t, unsigned umax) 3835d9ac2dcSdhartmei { 384d8fcd2dfSdhartmei char a1[11], a2[11]; 3855d9ac2dcSdhartmei 3865d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", u1); 3875d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", u2); 3885d9ac2dcSdhartmei printf(" %s", t); 3891173271aScedric if (u1 == umax && (op == PF_OP_EQ || op == PF_OP_NE)) 390c16ab608Sdhartmei print_op(op, "unknown", a2); 391c16ab608Sdhartmei else 392c16ab608Sdhartmei print_op(op, a1, a2); 393c16ab608Sdhartmei } 394c16ab608Sdhartmei 395c16ab608Sdhartmei void 39614a9b182Skjell print_flags(u_int8_t f) 39714a9b182Skjell { 39814a9b182Skjell int i; 39981a15e5dSderaadt 400bc795af0Shugh for (i = 0; tcpflags[i]; ++i) 40114a9b182Skjell if (f & (1 << i)) 40214a9b182Skjell printf("%c", tcpflags[i]); 40314a9b182Skjell } 40414a9b182Skjell 40514a9b182Skjell void 40664b4b616Sfrantzen print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, 407ad85696eShenning sa_family_t af, u_int8_t proto, int opts) 40815e76891Sdhartmei { 40964b4b616Sfrantzen char buf[PF_OSFP_LEN*3]; 410ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 4111173271aScedric if (src->addr.type == PF_ADDR_ADDRMASK && 4121173271aScedric dst->addr.type == PF_ADDR_ADDRMASK && 413bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.addr, AF_INET6) && 414bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.mask, AF_INET6) && 4151173271aScedric PF_AZERO(&dst->addr.v.a.addr, AF_INET6) && 4161173271aScedric PF_AZERO(&dst->addr.v.a.mask, AF_INET6) && 417d4008a34Sdhartmei !src->neg && !dst->neg && 41864b4b616Sfrantzen !src->port_op && !dst->port_op && 41964b4b616Sfrantzen osfp == PF_OSFP_ANY) 42015e76891Sdhartmei printf(" all"); 42115e76891Sdhartmei else { 42215e76891Sdhartmei printf(" from "); 423d4008a34Sdhartmei if (src->neg) 42415e76891Sdhartmei printf("! "); 42544f5ed0aScedric print_addr(&src->addr, af, verbose); 42615e76891Sdhartmei if (src->port_op) 42715e76891Sdhartmei print_port(src->port_op, src->port[0], 42815e76891Sdhartmei src->port[1], 429ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts); 43064b4b616Sfrantzen if (osfp != PF_OSFP_ANY) 43164b4b616Sfrantzen printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, 43264b4b616Sfrantzen sizeof(buf))); 43315e76891Sdhartmei 43415e76891Sdhartmei printf(" to "); 435d4008a34Sdhartmei if (dst->neg) 43615e76891Sdhartmei printf("! "); 43744f5ed0aScedric print_addr(&dst->addr, af, verbose); 43815e76891Sdhartmei if (dst->port_op) 43915e76891Sdhartmei print_port(dst->port_op, dst->port[0], 44015e76891Sdhartmei dst->port[1], 441ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts); 44215e76891Sdhartmei } 44315e76891Sdhartmei } 44415e76891Sdhartmei 44515e76891Sdhartmei void 446e0c302d0Smcbride print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, 44736754172Smcbride sa_family_t af, int id, int verbose) 4483a44df3cSmcbride { 44936754172Smcbride if (pool->ifname[0]) { 450a2f57b9fSmcbride if (!PF_AZERO(&pool->addr.v.a.addr, af)) { 45136754172Smcbride print_addr(&pool->addr, af, verbose); 452a2f57b9fSmcbride printf("@"); 453a2f57b9fSmcbride } 454a2f57b9fSmcbride printf("%s", pool->ifname); 45536754172Smcbride } else 45636754172Smcbride print_addr(&pool->addr, af, verbose); 457e0c302d0Smcbride switch (id) { 458a64374fdSmcbride case PF_POOL_NAT: 4599782f7a2Smcbride if ((p1 != PF_NAT_PROXY_PORT_LOW || 4609782f7a2Smcbride p2 != PF_NAT_PROXY_PORT_HIGH) && (p1 != 0 || p2 != 0)) { 461e0c302d0Smcbride if (p1 == p2) 462e0c302d0Smcbride printf(" port %u", p1); 463e0c302d0Smcbride else 464e0c302d0Smcbride printf(" port %u:%u", p1, p2); 465e0c302d0Smcbride } 466e0c302d0Smcbride break; 467a64374fdSmcbride case PF_POOL_RDR: 468e0c302d0Smcbride if (p1) { 4698da4e377Smcbride printf(" port %u", p1); 4708da4e377Smcbride if (p2 && (p2 != p1)) 4718da4e377Smcbride printf(":%u", p2); 472e0c302d0Smcbride } 473e0c302d0Smcbride break; 474e0c302d0Smcbride default: 475e0c302d0Smcbride break; 476e0c302d0Smcbride } 477e0c302d0Smcbride switch (pool->opts & PF_POOL_TYPEMASK) { 478e0c302d0Smcbride case PF_POOL_NONE: 479e0c302d0Smcbride break; 480e0c302d0Smcbride case PF_POOL_BITMASK: 481e0c302d0Smcbride printf(" bitmask"); 482e0c302d0Smcbride break; 483e0c302d0Smcbride case PF_POOL_RANDOM: 484e0c302d0Smcbride printf(" random"); 485e0c302d0Smcbride break; 486e0c302d0Smcbride case PF_POOL_SRCHASH: 4870436fa02Smcbride printf(" source-hash 0x%08x%08x%08x%08x", 488e0c302d0Smcbride pool->key.key32[0], pool->key.key32[1], 489e0c302d0Smcbride pool->key.key32[2], pool->key.key32[3]); 490e0c302d0Smcbride break; 491e0c302d0Smcbride case PF_POOL_ROUNDROBIN: 492e0c302d0Smcbride printf(" round-robin"); 493e0c302d0Smcbride break; 494bcb11948Szinke case PF_POOL_LEASTSTATES: 495bcb11948Szinke printf(" least-states"); 496bcb11948Szinke break; 497e0c302d0Smcbride } 498fd777407Smcbride if (pool->opts & PF_POOL_STICKYADDR) 499fd777407Smcbride printf(" sticky-address"); 500a64374fdSmcbride if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) 501e0c302d0Smcbride printf(" static-port"); 5023a44df3cSmcbride } 5033a44df3cSmcbride 504132c30ccShenning const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 5056b640f62Smcbride const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES; 506132c30ccShenning const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; 507fd777407Smcbride const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES; 50899a73934Sderaadt 50914a9b182Skjell void 510fd777407Smcbride print_status(struct pf_status *s, int opts) 51114a9b182Skjell { 512a2fdc13dSmcbride char statline[80], *running, *debug; 513c474e331Shenning time_t runtime; 51499a73934Sderaadt int i; 515a1973c63Ssturm char buf[PF_MD5_DIGEST_LENGTH * 2 + 1]; 516010eb8d3Smpf static const char hex[] = "0123456789abcdef"; 51799a73934Sderaadt 518c474e331Shenning runtime = time(NULL) - s->since; 5195191b30fScedric running = s->running ? "Enabled" : "Disabled"; 520c474e331Shenning 5215191b30fScedric if (s->since) { 522db93f2f1Sderaadt unsigned int sec, min, hrs, day = runtime; 523d85e4ad6Sdhartmei 524d85e4ad6Sdhartmei sec = day % 60; 525d85e4ad6Sdhartmei day /= 60; 526d85e4ad6Sdhartmei min = day % 60; 527d85e4ad6Sdhartmei day /= 60; 528d85e4ad6Sdhartmei hrs = day % 24; 529d85e4ad6Sdhartmei day /= 24; 530c474e331Shenning snprintf(statline, sizeof(statline), 5315191b30fScedric "Status: %s for %u days %.2u:%.2u:%.2u", 5325191b30fScedric running, day, hrs, min, sec); 533d85e4ad6Sdhartmei } else 5345191b30fScedric snprintf(statline, sizeof(statline), "Status: %s", running); 535c97b4ee1Shenning printf("%-44s", statline); 536a2fdc13dSmcbride asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)); 537a2fdc13dSmcbride printf("%15s\n\n", debug); 538e2714f7cSderaadt free(debug); 539f6e85b8dSmcbride 540f6e85b8dSmcbride if (opts & PF_OPT_VERBOSE) { 541010eb8d3Smpf printf("Hostid: 0x%08x\n", ntohl(s->hostid)); 542010eb8d3Smpf 543a1973c63Ssturm for (i = 0; i < PF_MD5_DIGEST_LENGTH; i++) { 544010eb8d3Smpf buf[i + i] = hex[s->pf_chksum[i] >> 4]; 545010eb8d3Smpf buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; 546010eb8d3Smpf } 547010eb8d3Smpf buf[i + i] = '\0'; 548010eb8d3Smpf printf("Checksum: 0x%s\n\n", buf); 549f6e85b8dSmcbride } 550010eb8d3Smpf 551c474e331Shenning if (s->ifname[0] != 0) { 552c474e331Shenning printf("Interface Stats for %-16s %5s %16s\n", 553c474e331Shenning s->ifname, "IPv4", "IPv6"); 554c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes In", 555ef22e615Sdhartmei (unsigned long long)s->bcounters[0][0], 556ef22e615Sdhartmei (unsigned long long)s->bcounters[1][0]); 557c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes Out", 558ef22e615Sdhartmei (unsigned long long)s->bcounters[0][1], 559ef22e615Sdhartmei (unsigned long long)s->bcounters[1][1]); 560c474e331Shenning printf(" Packets In\n"); 561c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 562ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_PASS], 563ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_PASS]); 564c474e331Shenning printf(" %-23s %14llu %16llu\n", "Blocked", 565ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_DROP], 566ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_DROP]); 567c474e331Shenning printf(" Packets Out\n"); 568c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 569ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_PASS], 570ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_PASS]); 571c474e331Shenning printf(" %-23s %14llu %16llu\n\n", "Blocked", 572ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_DROP], 573ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_DROP]); 574c474e331Shenning } 575c474e331Shenning printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); 576c474e331Shenning printf(" %-25s %14u %14s\n", "current entries", s->states, ""); 577c474e331Shenning for (i = 0; i < FCNT_MAX; i++) { 578ea4ec064Sitojun printf(" %-25s %14llu ", pf_fcounters[i], 579ea4ec064Sitojun (unsigned long long)s->fcounters[i]); 580c474e331Shenning if (runtime > 0) 581c474e331Shenning printf("%14.1f/s\n", 582c474e331Shenning (double)s->fcounters[i] / (double)runtime); 583c474e331Shenning else 584c474e331Shenning printf("%14s\n", ""); 585c474e331Shenning } 586fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 587fd777407Smcbride printf("Source Tracking Table\n"); 588fd777407Smcbride printf(" %-25s %14u %14s\n", "current entries", 589fd777407Smcbride s->src_nodes, ""); 590fd777407Smcbride for (i = 0; i < SCNT_MAX; i++) { 591fd777407Smcbride printf(" %-25s %14lld ", pf_scounters[i], 592fd777407Smcbride s->scounters[i]); 593fd777407Smcbride if (runtime > 0) 594fd777407Smcbride printf("%14.1f/s\n", 595fd777407Smcbride (double)s->scounters[i] / (double)runtime); 596fd777407Smcbride else 597fd777407Smcbride printf("%14s\n", ""); 598fd777407Smcbride } 599fd777407Smcbride } 60099a73934Sderaadt printf("Counters\n"); 601c474e331Shenning for (i = 0; i < PFRES_MAX; i++) { 602ea4ec064Sitojun printf(" %-25s %14llu ", pf_reasons[i], 603ea4ec064Sitojun (unsigned long long)s->counters[i]); 604c474e331Shenning if (runtime > 0) 605c474e331Shenning printf("%14.1f/s\n", 606c474e331Shenning (double)s->counters[i] / (double)runtime); 607c474e331Shenning else 608c474e331Shenning printf("%14s\n", ""); 609c474e331Shenning } 6106b640f62Smcbride if (opts & PF_OPT_VERBOSE) { 6116b640f62Smcbride printf("Limit Counters\n"); 6126b640f62Smcbride for (i = 0; i < LCNT_MAX; i++) { 6136b640f62Smcbride printf(" %-25s %14lld ", pf_lcounters[i], 6146b640f62Smcbride s->lcounters[i]); 6156b640f62Smcbride if (runtime > 0) 6166b640f62Smcbride printf("%14.1f/s\n", 6176b640f62Smcbride (double)s->lcounters[i] / (double)runtime); 6186b640f62Smcbride else 6196b640f62Smcbride printf("%14s\n", ""); 6206b640f62Smcbride } 6216b640f62Smcbride } 62214a9b182Skjell } 62314a9b182Skjell 62414a9b182Skjell void 625fd777407Smcbride print_src_node(struct pf_src_node *sn, int opts) 626fd777407Smcbride { 627fd777407Smcbride struct pf_addr_wrap aw; 628fd777407Smcbride int min, sec; 629fd777407Smcbride 630fd777407Smcbride memset(&aw, 0, sizeof(aw)); 631fd777407Smcbride if (sn->af == AF_INET) 632fd777407Smcbride aw.v.a.mask.addr32[0] = 0xffffffff; 633fd777407Smcbride else 634fd777407Smcbride memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); 635fd777407Smcbride 636fd777407Smcbride aw.v.a.addr = sn->addr; 637fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 638c3e2fff9Shenning 639c3e2fff9Shenning if (!PF_AZERO(&sn->raddr, sn->af)) { 640c3e2fff9Shenning if (sn->type == PF_SN_NAT) 641c3e2fff9Shenning printf(" nat-to "); 642c3e2fff9Shenning else if (sn->type == PF_SN_RDR) 643c3e2fff9Shenning printf(" rdr-to "); 644c3e2fff9Shenning else if (sn->type == PF_SN_ROUTE) 645c3e2fff9Shenning printf(" route-to "); 646c3e2fff9Shenning else 647c3e2fff9Shenning printf(" ??? (%u) ", sn->type); 648fd777407Smcbride aw.v.a.addr = sn->raddr; 6490cde32ceSclaudio print_addr(&aw, sn->naf ? sn->naf : sn->af, 6500cde32ceSclaudio opts & PF_OPT_VERBOSE2); 651c3e2fff9Shenning } 652c3e2fff9Shenning 6536b640f62Smcbride printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, 6546b640f62Smcbride sn->conn, sn->conn_rate.count / 1000, 6556b640f62Smcbride (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); 656fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 657fd777407Smcbride sec = sn->creation % 60; 658fd777407Smcbride sn->creation /= 60; 659fd777407Smcbride min = sn->creation % 60; 660fd777407Smcbride sn->creation /= 60; 661fd777407Smcbride printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); 662fd777407Smcbride if (sn->states == 0) { 663fd777407Smcbride sec = sn->expire % 60; 664fd777407Smcbride sn->expire /= 60; 665fd777407Smcbride min = sn->expire % 60; 666fd777407Smcbride sn->expire /= 60; 667fd777407Smcbride printf(", expires in %.2u:%.2u:%.2u", 668fd777407Smcbride sn->expire, min, sec); 669fd777407Smcbride } 670b19e9e6fSmcbride printf(", %llu pkts, %llu bytes", 671b19e9e6fSmcbride sn->packets[0] + sn->packets[1], 67259b61cdeShenning sn->bytes[0] + sn->bytes[1]); 673fd777407Smcbride if (sn->rule.nr != -1) 674c3e2fff9Shenning printf(", rule %u", sn->rule.nr); 675fd777407Smcbride printf("\n"); 676fd777407Smcbride } 677fd777407Smcbride } 678fd777407Smcbride 679fd777407Smcbride void 680ad85696eShenning print_rule(struct pf_rule *r, const char *anchor_call, int opts) 68114a9b182Skjell { 6820e8bc214Saaron static const char *actiontypes[] = { "pass", "block", "scrub", 683e9953237Shenning "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", 684e9953237Shenning "", "", "match"}; 6851173271aScedric static const char *anchortypes[] = { "anchor", "anchor", "anchor", 6860e8bc214Saaron "anchor", "nat-anchor", "nat-anchor", "binat-anchor", 6870e8bc214Saaron "binat-anchor", "rdr-anchor", "rdr-anchor" }; 6886992ade7Shenning int i, ropts; 689ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 690f9a568a2Smcbride char *p; 691cc5f0329Sdhartmei 69274dc4fddShenning if (verbose) 69378baf774Sdhartmei printf("@%d ", r->nr); 694e9953237Shenning if (r->action > PF_MATCH) 6951173271aScedric printf("action(%d)", r->action); 696305ca21dSmcbride else if (anchor_call[0]) { 697f9a568a2Smcbride p = strrchr(anchor_call, '/'); 698f9a568a2Smcbride if (p ? p[1] == '_' : anchor_call[0] == '_') 699305ca21dSmcbride printf("%s", anchortypes[r->action]); 700f9a568a2Smcbride else 701e77e5dc4Sjaredy printf("%s \"%s\"", anchortypes[r->action], 702e77e5dc4Sjaredy anchor_call); 703e151341fShenning } else 7041173271aScedric printf("%s", actiontypes[r->action]); 7051173271aScedric if (r->action == PF_DROP) { 7068a87542aShenning if (r->rule_flag & PFRULE_RETURN) 7078a87542aShenning printf(" return"); 7088a87542aShenning else if (r->rule_flag & PFRULE_RETURNRST) { 7091f77cc8aSpb if (!r->return_ttl) 71014a9b182Skjell printf(" return-rst"); 7111f77cc8aSpb else 7121f77cc8aSpb printf(" return-rst(ttl %d)", r->return_ttl); 713328b2decShenning } else if (r->rule_flag & PFRULE_RETURNICMP) { 714328b2decShenning const struct icmpcodeent *ic, *ic6; 715b996d042Sdhartmei 716b996d042Sdhartmei ic = geticmpcodebynumber(r->return_icmp >> 8, 717328b2decShenning r->return_icmp & 255, AF_INET); 718328b2decShenning ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, 719328b2decShenning r->return_icmp6 & 255, AF_INET6); 720d14c53d7Swilfried 721328b2decShenning switch (r->af) { 722328b2decShenning case AF_INET: 723328b2decShenning printf(" return-icmp"); 724d14c53d7Swilfried if (ic == NULL) 725d14c53d7Swilfried printf("(%u)", r->return_icmp & 255); 726b996d042Sdhartmei else 727328b2decShenning printf("(%s)", ic->name); 728328b2decShenning break; 729328b2decShenning case AF_INET6: 730328b2decShenning printf(" return-icmp6"); 731328b2decShenning if (ic6 == NULL) 732328b2decShenning printf("(%u)", r->return_icmp6 & 255); 733328b2decShenning else 734328b2decShenning printf("(%s)", ic6->name); 735328b2decShenning break; 736328b2decShenning default: 737328b2decShenning printf(" return-icmp"); 738328b2decShenning if (ic == NULL) 739328b2decShenning printf("(%u, ", r->return_icmp & 255); 740328b2decShenning else 741328b2decShenning printf("(%s, ", ic->name); 742328b2decShenning if (ic6 == NULL) 743328b2decShenning printf("%u)", r->return_icmp6 & 255); 744328b2decShenning else 745328b2decShenning printf("%s)", ic6->name); 746328b2decShenning break; 747328b2decShenning } 748acf2444cShenning } else 749acf2444cShenning printf(" drop"); 7501173271aScedric } 7517189e280Sdhartmei if (r->direction == PF_IN) 75214a9b182Skjell printf(" in"); 7537189e280Sdhartmei else if (r->direction == PF_OUT) 75414a9b182Skjell printf(" out"); 755a46dc179Sdhartmei if (r->log) { 756a46dc179Sdhartmei printf(" log"); 757f565c2a8Shenning if (r->log & ~PF_LOG || r->logif) { 7581cb19346Sdhartmei int count = 0; 7591cb19346Sdhartmei 760a46dc179Sdhartmei printf(" ("); 7611cb19346Sdhartmei if (r->log & PF_LOG_ALL) 7621cb19346Sdhartmei printf("%sall", count++ ? ", " : ""); 763f496e916Shenning if (r->log & PF_LOG_MATCHES) 764f496e916Shenning printf("%smatches", count++ ? ", " : ""); 765a46dc179Sdhartmei if (r->log & PF_LOG_SOCKET_LOOKUP) 7661cb19346Sdhartmei printf("%suser", count++ ? ", " : ""); 767f565c2a8Shenning if (r->logif) 768f565c2a8Shenning printf("%sto pflog%u", count++ ? ", " : "", 769f565c2a8Shenning r->logif); 770a46dc179Sdhartmei printf(")"); 771a46dc179Sdhartmei } 772a46dc179Sdhartmei } 77314a9b182Skjell if (r->quick) 77414a9b182Skjell printf(" quick"); 7757d0c9138Shenning if (r->ifname[0]) { 7767d0c9138Shenning if (r->ifnot) 7777d0c9138Shenning printf(" on ! %s", r->ifname); 7787d0c9138Shenning else 77914a9b182Skjell printf(" on %s", r->ifname); 7807d0c9138Shenning } 7819e70289eSclaudio if (r->onrdomain >= 0) { 7829e70289eSclaudio if (r->ifnot) 7839e70289eSclaudio printf(" on ! rdomain %i", r->onrdomain); 7849e70289eSclaudio else 7859e70289eSclaudio printf(" on rdomain %i", r->onrdomain); 7869e70289eSclaudio } 78730620b12Sfrantzen if (r->af) { 78830620b12Sfrantzen if (r->af == AF_INET) 78930620b12Sfrantzen printf(" inet"); 79030620b12Sfrantzen else 79130620b12Sfrantzen printf(" inet6"); 79230620b12Sfrantzen } 79314a9b182Skjell if (r->proto) { 794e4ebe044Shenning struct protoent *p; 795ed99c291Sderaadt 796e4ebe044Shenning if ((p = getprotobynumber(r->proto)) != NULL) 79714a9b182Skjell printf(" proto %s", p->p_name); 79814a9b182Skjell else 79914a9b182Skjell printf(" proto %u", r->proto); 80014a9b182Skjell } 80164b4b616Sfrantzen print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, 802ad85696eShenning opts); 80395b43208Sdlg if (r->rcv_ifname[0]) 80495b43208Sdlg printf(" received-on %s", r->rcv_ifname); 805c16ab608Sdhartmei if (r->uid.op) 8061173271aScedric print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user", 8071173271aScedric UID_MAX); 808c16ab608Sdhartmei if (r->gid.op) 8091173271aScedric print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group", 8101173271aScedric GID_MAX); 81114a9b182Skjell if (r->flags || r->flagset) { 81214a9b182Skjell printf(" flags "); 81314a9b182Skjell print_flags(r->flags); 81414a9b182Skjell printf("/"); 81514a9b182Skjell print_flags(r->flagset); 816e9953237Shenning } else if ((r->action == PF_PASS || r->action == PF_MATCH) && 817bd9b24faSmcbride (!r->proto || r->proto == IPPROTO_TCP) && 818bd9b24faSmcbride !(r->rule_flag & PFRULE_FRAGMENT) && 819be73131dSmcbride !anchor_call[0] && r->keep_state) 820bd9b24faSmcbride printf(" flags any"); 821082ebc44Swilfried if (r->type) { 822b49ca6bbShenning const struct icmptypeent *it; 823082ebc44Swilfried 824b49ca6bbShenning it = geticmptypebynumber(r->type-1, r->af); 825d14c53d7Swilfried if (r->af != AF_INET6) 826d14c53d7Swilfried printf(" icmp-type"); 827082ebc44Swilfried else 828d0cb3502Smcbride printf(" icmp6-type"); 829b49ca6bbShenning if (it != NULL) 830b49ca6bbShenning printf(" %s", it->name); 831d14c53d7Swilfried else 832d14c53d7Swilfried printf(" %u", r->type-1); 833082ebc44Swilfried if (r->code) { 834b49ca6bbShenning const struct icmpcodeent *ic; 835082ebc44Swilfried 836b49ca6bbShenning ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); 837b49ca6bbShenning if (ic != NULL) 838b49ca6bbShenning printf(" code %s", ic->name); 839082ebc44Swilfried else 84014a9b182Skjell printf(" code %u", r->code-1); 841082ebc44Swilfried } 842082ebc44Swilfried } 843e4cbe364Sdhartmei if (r->tos) 844e4cbe364Sdhartmei printf(" tos 0x%2.2x", r->tos); 8456ac157faSmcbride 846*08263cb1Shenning if (r->scrub_flags & PFSTATE_SETMASK) { 847f8b0ac7eShenning char *comma = ""; 8482aa5186dShenning printf(" set ("); 849*08263cb1Shenning if (r->scrub_flags & PFSTATE_SETPRIO) { 850f8b0ac7eShenning if (r->set_prio[0] == r->set_prio[1]) 851f8b0ac7eShenning printf("%s prio %u", comma, r->set_prio[0]); 852f8b0ac7eShenning else 853f8b0ac7eShenning printf("%s prio(%u, %u)", comma, r->set_prio[0], 854f8b0ac7eShenning r->set_prio[1]); 855f8b0ac7eShenning comma = ","; 856f8b0ac7eShenning } 857f8b0ac7eShenning if (r->scrub_flags & PFSTATE_SETTOS) { 858f8b0ac7eShenning printf("%s tos 0x%2.2x", comma, r->set_tos); 859f8b0ac7eShenning comma = ","; 860f8b0ac7eShenning } 8612aa5186dShenning printf(" )"); 862f8b0ac7eShenning } 863f8b0ac7eShenning 8646992ade7Shenning ropts = 0; 8656ac157faSmcbride if (r->max_states || r->max_src_nodes || r->max_src_states) 8666992ade7Shenning ropts = 1; 8676ac157faSmcbride if (r->rule_flag & PFRULE_NOSYNC) 8686992ade7Shenning ropts = 1; 8696ac157faSmcbride if (r->rule_flag & PFRULE_SRCTRACK) 8706992ade7Shenning ropts = 1; 8716ac157faSmcbride if (r->rule_flag & PFRULE_IFBOUND) 8726992ade7Shenning ropts = 1; 8736ac157faSmcbride if (r->rule_flag & PFRULE_STATESLOPPY) 8746992ade7Shenning ropts = 1; 8756ac157faSmcbride if (r->rule_flag & PFRULE_PFLOW) 8766992ade7Shenning ropts = 1; 8776992ade7Shenning for (i = 0; !ropts && i < PFTM_MAX; ++i) 8786ac157faSmcbride if (r->timeout[i]) 8796992ade7Shenning ropts = 1; 8806ac157faSmcbride 881bd9b24faSmcbride if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) 882f644f0ccSmcbride printf(" no state"); 8836992ade7Shenning else if (r->keep_state == PF_STATE_NORMAL && ropts) 88414a9b182Skjell printf(" keep state"); 885b96c47abSfrantzen else if (r->keep_state == PF_STATE_MODULATE) 886b96c47abSfrantzen printf(" modulate state"); 88752e0438eSdhartmei else if (r->keep_state == PF_STATE_SYNPROXY) 88852e0438eSdhartmei printf(" synproxy state"); 88938425613Scedric if (r->prob) { 89038425613Scedric char buf[20]; 89138425613Scedric 89238425613Scedric snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0)); 89338425613Scedric for (i = strlen(buf)-1; i > 0; i--) { 89438425613Scedric if (buf[i] == '0') 89538425613Scedric buf[i] = '\0'; 89638425613Scedric else { 89738425613Scedric if (buf[i] == '.') 89838425613Scedric buf[i] = '\0'; 89938425613Scedric break; 90038425613Scedric } 90138425613Scedric } 90238425613Scedric printf(" probability %s%%", buf); 90338425613Scedric } 9046992ade7Shenning if (ropts) { 905cc5f0329Sdhartmei printf(" ("); 906cc5f0329Sdhartmei if (r->max_states) { 907cc5f0329Sdhartmei printf("max %u", r->max_states); 9086992ade7Shenning ropts = 0; 909cc5f0329Sdhartmei } 910af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) { 9116992ade7Shenning if (!ropts) 912af80fa86Smcbride printf(", "); 913af80fa86Smcbride printf("no-sync"); 9146992ade7Shenning ropts = 0; 915af80fa86Smcbride } 916fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) { 9176992ade7Shenning if (!ropts) 918fd777407Smcbride printf(", "); 919fd777407Smcbride printf("source-track"); 920fd777407Smcbride if (r->rule_flag & PFRULE_RULESRCTRACK) 921fd777407Smcbride printf(" rule"); 922fd777407Smcbride else 923fd777407Smcbride printf(" global"); 9246992ade7Shenning ropts = 0; 925fd777407Smcbride } 926fd777407Smcbride if (r->max_src_states) { 9276992ade7Shenning if (!ropts) 928fd777407Smcbride printf(", "); 929fd777407Smcbride printf("max-src-states %u", r->max_src_states); 9306992ade7Shenning ropts = 0; 931fd777407Smcbride } 9326b640f62Smcbride if (r->max_src_conn) { 9336992ade7Shenning if (!ropts) 9346b640f62Smcbride printf(", "); 9356b640f62Smcbride printf("max-src-conn %u", r->max_src_conn); 9366992ade7Shenning ropts = 0; 9376b640f62Smcbride } 9386b640f62Smcbride if (r->max_src_conn_rate.limit) { 9396992ade7Shenning if (!ropts) 9406b640f62Smcbride printf(", "); 9416b640f62Smcbride printf("max-src-conn-rate %u/%u", 9426b640f62Smcbride r->max_src_conn_rate.limit, 9436b640f62Smcbride r->max_src_conn_rate.seconds); 9446992ade7Shenning ropts = 0; 9456b640f62Smcbride } 946fd777407Smcbride if (r->max_src_nodes) { 9476992ade7Shenning if (!ropts) 948fd777407Smcbride printf(", "); 949fd777407Smcbride printf("max-src-nodes %u", r->max_src_nodes); 9506992ade7Shenning ropts = 0; 951fd777407Smcbride } 9526b640f62Smcbride if (r->overload_tblname[0]) { 9536992ade7Shenning if (!ropts) 9546b640f62Smcbride printf(", "); 9556b640f62Smcbride printf("overload <%s>", r->overload_tblname); 9561e320a53Sdhartmei if (r->flush) 9576b640f62Smcbride printf(" flush"); 9581e320a53Sdhartmei if (r->flush & PF_FLUSH_GLOBAL) 9591e320a53Sdhartmei printf(" global"); 9606b640f62Smcbride } 961ec359bd5Scedric if (r->rule_flag & PFRULE_IFBOUND) { 9626992ade7Shenning if (!ropts) 963ec359bd5Scedric printf(", "); 964ec359bd5Scedric printf("if-bound"); 9656992ade7Shenning ropts = 0; 966ec359bd5Scedric } 9674dc07d4cShenning if (r->rule_flag & PFRULE_STATESLOPPY) { 9686992ade7Shenning if (!ropts) 9694dc07d4cShenning printf(", "); 9704dc07d4cShenning printf("sloppy"); 9716992ade7Shenning ropts = 0; 9724dc07d4cShenning } 97318ae10f7Shenning if (r->rule_flag & PFRULE_PFLOW) { 9746992ade7Shenning if (!ropts) 97518ae10f7Shenning printf(", "); 97618ae10f7Shenning printf("pflow"); 9776992ade7Shenning ropts = 0; 97818ae10f7Shenning } 979cc5f0329Sdhartmei for (i = 0; i < PFTM_MAX; ++i) 980cc5f0329Sdhartmei if (r->timeout[i]) { 981ae233f99Sdhartmei int j; 982ae233f99Sdhartmei 9836992ade7Shenning if (!ropts) 984cc5f0329Sdhartmei printf(", "); 9856992ade7Shenning ropts = 0; 9867e5eec99Sdhartmei for (j = 0; pf_timeouts[j].name != NULL; 9877e5eec99Sdhartmei ++j) 988ae233f99Sdhartmei if (pf_timeouts[j].timeout == i) 989ae233f99Sdhartmei break; 9907e5eec99Sdhartmei printf("%s %u", pf_timeouts[j].name == NULL ? 9917e5eec99Sdhartmei "inv.timeout" : pf_timeouts[j].name, 9927e5eec99Sdhartmei r->timeout[i]); 993cc5f0329Sdhartmei } 994cc5f0329Sdhartmei printf(")"); 995cc5f0329Sdhartmei } 996e9953237Shenning 997ddd010a2Sdavid if (r->rule_flag & PFRULE_FRAGMENT) 998ddd010a2Sdavid printf(" fragment"); 999ddd010a2Sdavid 1000c4051035Shenning if (r->scrub_flags & PFSTATE_SCRUBMASK || r->min_ttl || r->max_mss) { 1001e9953237Shenning printf(" scrub ("); 10026992ade7Shenning ropts = 1; 100322923725Shenning if (r->scrub_flags & PFSTATE_NODF) { 100467d2a440Sprovos printf("no-df"); 10056992ade7Shenning ropts = 0; 100622923725Shenning } 100722923725Shenning if (r->scrub_flags & PFSTATE_RANDOMID) { 10086992ade7Shenning if (!ropts) 100922923725Shenning printf(" "); 1010edbe3066Sdhartmei printf("random-id"); 10116992ade7Shenning ropts = 0; 101222923725Shenning } 101322923725Shenning if (r->min_ttl) { 10146992ade7Shenning if (!ropts) 101522923725Shenning printf(" "); 101634c76dcbSprovos printf("min-ttl %d", r->min_ttl); 10176992ade7Shenning ropts = 0; 101822923725Shenning } 101922923725Shenning if (r->scrub_flags & PFSTATE_SCRUB_TCP) { 10206992ade7Shenning if (!ropts) 102122923725Shenning printf(" "); 1022e9953237Shenning printf("reassemble tcp"); 10236992ade7Shenning ropts = 0; 102422923725Shenning } 102522923725Shenning if (r->max_mss) { 10266992ade7Shenning if (!ropts) 102722923725Shenning printf(" "); 1028cfa91859Sjasoni printf("max-mss %d", r->max_mss); 10296992ade7Shenning ropts = 0; 103022923725Shenning } 1031e9953237Shenning printf(")"); 1032e9953237Shenning } 1033e9953237Shenning 1034f48d62b3Sdhartmei if (r->allow_opts) 1035f48d62b3Sdhartmei printf(" allow-opts"); 1036455ef0c1Sdhartmei if (r->label[0]) 1037ff45dfa8Scamield printf(" label \"%s\"", r->label); 103844b1b5a8Smikeb if (r->rule_flag & PFRULE_ONCE) 103944b1b5a8Smikeb printf(" once"); 1040f98324c6Shenning if (r->qname[0] && r->pqname[0]) 1041f98324c6Shenning printf(" queue(%s, %s)", r->qname, r->pqname); 1042f98324c6Shenning else if (r->qname[0]) 104378e1d2a6Shenning printf(" queue %s", r->qname); 10448aecb81aShenning if (r->tagname[0]) 10458aecb81aShenning printf(" tag %s", r->tagname); 104636369899Shenning if (r->match_tagname[0]) { 104736369899Shenning if (r->match_tag_not) 104836369899Shenning printf(" !"); 10490a5f7f2fShenning printf(" tagged %s", r->match_tagname); 105036369899Shenning } 10515e931757Shenning if (r->rtableid != -1) 10525e931757Shenning printf(" rtable %u", r->rtableid); 1053eb900600Smarkus if (r->divert.port) { 1054fd27dbffSbluhm if (PF_AZERO(&r->divert.addr, AF_INET6)) { 1055eb900600Smarkus printf(" divert-reply"); 1056eb900600Smarkus } else { 1057eb900600Smarkus /* XXX cut&paste from print_addr */ 1058eb900600Smarkus char buf[48]; 1059eb900600Smarkus 1060eb900600Smarkus printf(" divert-to "); 1061eb900600Smarkus if (inet_ntop(r->af, &r->divert.addr, buf, 1062eb900600Smarkus sizeof(buf)) == NULL) 1063eb900600Smarkus printf("?"); 1064eb900600Smarkus else 1065eb900600Smarkus printf("%s", buf); 1066782435eaSmarkus printf(" port %u", ntohs(r->divert.port)); 1067eb900600Smarkus } 1068eb900600Smarkus } 1069d85f7bc1Smichele if (r->divert_packet.port) 1070d85f7bc1Smichele printf(" divert-packet port %u", ntohs(r->divert_packet.port)); 10710cde32ceSclaudio 10720cde32ceSclaudio if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && 1073fc302162Smikeb r->rule_flag & PFRULE_AFTO) { 10740cde32ceSclaudio printf(" af-to %s from ", r->naf == AF_INET ? "inet" : "inet6"); 10750cde32ceSclaudio print_pool(&r->nat, r->nat.proxy_port[0], 10760cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af, 10770cde32ceSclaudio PF_POOL_NAT, verbose); 10780cde32ceSclaudio if (r->rdr.addr.type != PF_ADDR_NONE) { 10790cde32ceSclaudio printf(" to "); 10800cde32ceSclaudio print_pool(&r->rdr, r->rdr.proxy_port[0], 10810cde32ceSclaudio r->rdr.proxy_port[1], r->naf ? r->naf : r->af, 10820cde32ceSclaudio PF_POOL_RDR, verbose); 10830cde32ceSclaudio } 10840cde32ceSclaudio } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { 10850ef3d4feShenning printf (" nat-to "); 10860ef3d4feShenning print_pool(&r->nat, r->nat.proxy_port[0], 10870cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af, 10880cde32ceSclaudio PF_POOL_NAT, verbose); 10890cde32ceSclaudio } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { 10900ef3d4feShenning printf (" rdr-to "); 10910ef3d4feShenning print_pool(&r->rdr, r->rdr.proxy_port[0], 1092a64374fdSmcbride r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); 1093d0aca2f2Shenning } 109469e22b15Sreyk if (r->rt) { 109569e22b15Sreyk if (r->rt == PF_ROUTETO) 109669e22b15Sreyk printf(" route-to"); 109769e22b15Sreyk else if (r->rt == PF_REPLYTO) 109869e22b15Sreyk printf(" reply-to"); 109969e22b15Sreyk else if (r->rt == PF_DUPTO) 110069e22b15Sreyk printf(" dup-to"); 110169e22b15Sreyk printf(" "); 1102a64374fdSmcbride print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); 110369e22b15Sreyk } 110469e22b15Sreyk } 110514a9b182Skjell 11065b6c447dScedric void 11075b6c447dScedric print_tabledef(const char *name, int flags, int addrs, 11085b6c447dScedric struct node_tinithead *nodes) 11095b6c447dScedric { 11105b6c447dScedric struct node_tinit *ti, *nti; 11115b6c447dScedric struct node_host *h; 11125b6c447dScedric 11135b6c447dScedric printf("table <%s>", name); 11145b6c447dScedric if (flags & PFR_TFLAG_CONST) 11155b6c447dScedric printf(" const"); 11165b6c447dScedric if (flags & PFR_TFLAG_PERSIST) 11175b6c447dScedric printf(" persist"); 11185f03a6e1Smcbride if (flags & PFR_TFLAG_COUNTERS) 11195f03a6e1Smcbride printf(" counters"); 11205b6c447dScedric SIMPLEQ_FOREACH(ti, nodes, entries) { 11215b6c447dScedric if (ti->file) { 11225b6c447dScedric printf(" file \"%s\"", ti->file); 11235b6c447dScedric continue; 11245b6c447dScedric } 11255b6c447dScedric printf(" {"); 11265b6c447dScedric for (;;) { 11275b6c447dScedric for (h = ti->host; h != NULL; h = h->next) { 11285b6c447dScedric printf(h->not ? " !" : " "); 11295b6c447dScedric print_addr(&h->addr, h->af, 0); 113036754172Smcbride if (h->ifname) 113136754172Smcbride printf("@%s", h->ifname); 11325b6c447dScedric } 11335b6c447dScedric nti = SIMPLEQ_NEXT(ti, entries); 11345b6c447dScedric if (nti != NULL && nti->file == NULL) 11355b6c447dScedric ti = nti; /* merge lists */ 11365b6c447dScedric else 11375b6c447dScedric break; 11385b6c447dScedric } 11395b6c447dScedric printf(" }"); 11405b6c447dScedric } 11415b6c447dScedric if (addrs && SIMPLEQ_EMPTY(nodes)) 11425b6c447dScedric printf(" { }"); 11435b6c447dScedric printf("\n"); 11445b6c447dScedric } 11455b6c447dScedric 11461f8f21bdSmillert int 1147ff352a37Smarkus parse_flags(char *s) 114814a9b182Skjell { 1149ff352a37Smarkus char *p, *q; 115014a9b182Skjell u_int8_t f = 0; 115181a15e5dSderaadt 1152ff352a37Smarkus for (p = s; *p; p++) { 1153ff352a37Smarkus if ((q = strchr(tcpflags, *p)) == NULL) 1154ff352a37Smarkus return -1; 1155ff352a37Smarkus else 1156ff352a37Smarkus f |= 1 << (q - tcpflags); 115714a9b182Skjell } 1158bc795af0Shugh return (f ? f : PF_TH_ALL); 115914a9b182Skjell } 116094e9410bShenning 116194e9410bShenning void 116294e9410bShenning set_ipmask(struct node_host *h, u_int8_t b) 116394e9410bShenning { 116494e9410bShenning struct pf_addr *m, *n; 116594e9410bShenning int i, j = 0; 116694e9410bShenning 116794e9410bShenning m = &h->addr.v.a.mask; 1168ab648bf6Sfrantzen memset(m, 0, sizeof(*m)); 116994e9410bShenning 117094e9410bShenning while (b >= 32) { 117194e9410bShenning m->addr32[j++] = 0xffffffff; 117294e9410bShenning b -= 32; 117394e9410bShenning } 117494e9410bShenning for (i = 31; i > 31-b; --i) 117594e9410bShenning m->addr32[j] |= (1 << i); 117694e9410bShenning if (b) 117794e9410bShenning m->addr32[j] = htonl(m->addr32[j]); 117894e9410bShenning 117994e9410bShenning /* Mask off bits of the address that will never be used. */ 118094e9410bShenning n = &h->addr.v.a.addr; 1181ff626af1Shenning if (h->addr.type == PF_ADDR_ADDRMASK) 118294e9410bShenning for (i = 0; i < 4; i++) 118394e9410bShenning n->addr32[i] = n->addr32[i] & m->addr32[i]; 118494e9410bShenning } 118594e9410bShenning 118652f4a4a4Shenning int 118752f4a4a4Shenning check_netmask(struct node_host *h, sa_family_t af) 118852f4a4a4Shenning { 118952f4a4a4Shenning struct node_host *n = NULL; 119052f4a4a4Shenning struct pf_addr *m; 119152f4a4a4Shenning 119252f4a4a4Shenning for (n = h; n != NULL; n = n->next) { 119375d911b5Scedric if (h->addr.type == PF_ADDR_TABLE) 119475d911b5Scedric continue; 119552f4a4a4Shenning m = &h->addr.v.a.mask; 119652f4a4a4Shenning /* fix up netmask for dynaddr */ 119752f4a4a4Shenning if (af == AF_INET && h->addr.type == PF_ADDR_DYNIFTL && 119852f4a4a4Shenning unmask(m, AF_INET6) > 32) 119952f4a4a4Shenning set_ipmask(n, 32); 120052f4a4a4Shenning /* netmasks > 32 bit are invalid on v4 */ 120152f4a4a4Shenning if (af == AF_INET && 120252f4a4a4Shenning (m->addr32[1] || m->addr32[2] || m->addr32[3])) { 120352f4a4a4Shenning fprintf(stderr, "netmask %u invalid for IPv4 address\n", 120452f4a4a4Shenning unmask(m, AF_INET6)); 120552f4a4a4Shenning return (1); 120652f4a4a4Shenning } 120752f4a4a4Shenning } 120852f4a4a4Shenning return (0); 120952f4a4a4Shenning } 121052f4a4a4Shenning 121194e9410bShenning /* interface lookup routines */ 121294e9410bShenning 121394e9410bShenning struct node_host *iftab; 121494e9410bShenning 121594e9410bShenning void 121694e9410bShenning ifa_load(void) 121794e9410bShenning { 121894e9410bShenning struct ifaddrs *ifap, *ifa; 121994e9410bShenning struct node_host *n = NULL, *h = NULL; 122094e9410bShenning 122194e9410bShenning if (getifaddrs(&ifap) < 0) 122294e9410bShenning err(1, "getifaddrs"); 122394e9410bShenning 122494e9410bShenning for (ifa = ifap; ifa; ifa = ifa->ifa_next) { 122594e9410bShenning if (!(ifa->ifa_addr->sa_family == AF_INET || 122694e9410bShenning ifa->ifa_addr->sa_family == AF_INET6 || 122794e9410bShenning ifa->ifa_addr->sa_family == AF_LINK)) 122894e9410bShenning continue; 122994e9410bShenning n = calloc(1, sizeof(struct node_host)); 123094e9410bShenning if (n == NULL) 123194e9410bShenning err(1, "address: calloc"); 123294e9410bShenning n->af = ifa->ifa_addr->sa_family; 123394e9410bShenning n->ifa_flags = ifa->ifa_flags; 123494e9410bShenning #ifdef __KAME__ 123594e9410bShenning if (n->af == AF_INET6 && 123694e9410bShenning IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 123794e9410bShenning ifa->ifa_addr)->sin6_addr) && 1238ab642153Shenning ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == 1239ab642153Shenning 0) { 124094e9410bShenning struct sockaddr_in6 *sin6; 124194e9410bShenning 124294e9410bShenning sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 124394e9410bShenning sin6->sin6_scope_id = sin6->sin6_addr.s6_addr[2] << 8 | 124494e9410bShenning sin6->sin6_addr.s6_addr[3]; 124594e9410bShenning sin6->sin6_addr.s6_addr[2] = 0; 124694e9410bShenning sin6->sin6_addr.s6_addr[3] = 0; 124794e9410bShenning } 124894e9410bShenning #endif 124994e9410bShenning n->ifindex = 0; 125094e9410bShenning if (n->af == AF_INET) { 125194e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in *) 125294e9410bShenning ifa->ifa_addr)->sin_addr.s_addr, 125394e9410bShenning sizeof(struct in_addr)); 125494e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in *) 125594e9410bShenning ifa->ifa_netmask)->sin_addr.s_addr, 125694e9410bShenning sizeof(struct in_addr)); 125794e9410bShenning if (ifa->ifa_broadaddr != NULL) 125894e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in *) 125994e9410bShenning ifa->ifa_broadaddr)->sin_addr.s_addr, 126094e9410bShenning sizeof(struct in_addr)); 1261ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1262ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in *) 1263ec359bd5Scedric ifa->ifa_dstaddr)->sin_addr.s_addr, 1264ec359bd5Scedric sizeof(struct in_addr)); 126594e9410bShenning } else if (n->af == AF_INET6) { 126694e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in6 *) 126794e9410bShenning ifa->ifa_addr)->sin6_addr.s6_addr, 126894e9410bShenning sizeof(struct in6_addr)); 126994e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in6 *) 127094e9410bShenning ifa->ifa_netmask)->sin6_addr.s6_addr, 127194e9410bShenning sizeof(struct in6_addr)); 127294e9410bShenning if (ifa->ifa_broadaddr != NULL) 127394e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in6 *) 127494e9410bShenning ifa->ifa_broadaddr)->sin6_addr.s6_addr, 127594e9410bShenning sizeof(struct in6_addr)); 1276ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1277ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in6 *) 1278ec359bd5Scedric ifa->ifa_dstaddr)->sin6_addr.s6_addr, 1279ec359bd5Scedric sizeof(struct in6_addr)); 128094e9410bShenning n->ifindex = ((struct sockaddr_in6 *) 128194e9410bShenning ifa->ifa_addr)->sin6_scope_id; 128294e9410bShenning } 128394e9410bShenning if ((n->ifname = strdup(ifa->ifa_name)) == NULL) 128494e9410bShenning err(1, "ifa_load: strdup"); 128594e9410bShenning n->next = NULL; 128694e9410bShenning n->tail = n; 128794e9410bShenning if (h == NULL) 128894e9410bShenning h = n; 128994e9410bShenning else { 129094e9410bShenning h->tail->next = n; 129194e9410bShenning h->tail = n; 129294e9410bShenning } 129394e9410bShenning } 1294ec359bd5Scedric 129594e9410bShenning iftab = h; 129694e9410bShenning freeifaddrs(ifap); 129794e9410bShenning } 129894e9410bShenning 129994e9410bShenning struct node_host * 13006c3582faShenning ifa_exists(const char *ifa_name) 130194e9410bShenning { 130294e9410bShenning struct node_host *n; 13032ff5b035Shenning struct ifgroupreq ifgr; 13042ff5b035Shenning int s; 130594e9410bShenning 130694e9410bShenning if (iftab == NULL) 130794e9410bShenning ifa_load(); 130894e9410bShenning 1309855d4e83Ssobrado /* check whether this is a group */ 13102ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 13112ff5b035Shenning err(1, "socket"); 13122ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 13132ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 13142ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == 0) { 13152ff5b035Shenning /* fake a node_host */ 13162ff5b035Shenning if ((n = calloc(1, sizeof(*n))) == NULL) 13172ff5b035Shenning err(1, "calloc"); 13182ff5b035Shenning if ((n->ifname = strdup(ifa_name)) == NULL) 13192ff5b035Shenning err(1, "strdup"); 13202ff5b035Shenning close(s); 13212ff5b035Shenning return (n); 13222ff5b035Shenning } 13232ff5b035Shenning close(s); 13242ff5b035Shenning 132594e9410bShenning for (n = iftab; n; n = n->next) { 132694e9410bShenning if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ)) 132794e9410bShenning return (n); 132894e9410bShenning } 1329655a9f8aShenning 133094e9410bShenning return (NULL); 133194e9410bShenning } 133294e9410bShenning 133394e9410bShenning struct node_host * 13342ff5b035Shenning ifa_grouplookup(const char *ifa_name, int flags) 13352ff5b035Shenning { 13362ff5b035Shenning struct ifg_req *ifg; 13372ff5b035Shenning struct ifgroupreq ifgr; 13382ff5b035Shenning int s, len; 1339727cb2f7Sdhartmei struct node_host *n, *h = NULL; 13402ff5b035Shenning 13412ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 13422ff5b035Shenning err(1, "socket"); 13432ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 13442ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 13452ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) { 13462ff5b035Shenning close(s); 13472ff5b035Shenning return (NULL); 13482ff5b035Shenning } 13492ff5b035Shenning 13502ff5b035Shenning len = ifgr.ifgr_len; 13512ff5b035Shenning if ((ifgr.ifgr_groups = calloc(1, len)) == NULL) 13522ff5b035Shenning err(1, "calloc"); 13532ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) 13542ff5b035Shenning err(1, "SIOCGIFGMEMB"); 13552ff5b035Shenning 13562ff5b035Shenning for (ifg = ifgr.ifgr_groups; ifg && len >= sizeof(struct ifg_req); 13572ff5b035Shenning ifg++) { 13582ff5b035Shenning len -= sizeof(struct ifg_req); 135917b44c41Shenning if ((n = ifa_lookup(ifg->ifgrq_member, flags)) == NULL) 136017b44c41Shenning continue; 13612ff5b035Shenning if (h == NULL) 13622ff5b035Shenning h = n; 13632ff5b035Shenning else { 1364727cb2f7Sdhartmei h->tail->next = n; 1365727cb2f7Sdhartmei h->tail = n->tail; 13662ff5b035Shenning } 13672ff5b035Shenning } 13682ff5b035Shenning free(ifgr.ifgr_groups); 13692ff5b035Shenning close(s); 13702ff5b035Shenning 13712ff5b035Shenning return (h); 13722ff5b035Shenning } 13732ff5b035Shenning 13742ff5b035Shenning struct node_host * 1375ec359bd5Scedric ifa_lookup(const char *ifa_name, int flags) 137694e9410bShenning { 137794e9410bShenning struct node_host *p = NULL, *h = NULL, *n = NULL; 13787ad220f2Scedric int got4 = 0, got6 = 0; 1379ec359bd5Scedric const char *last_if = NULL; 138094e9410bShenning 13812ff5b035Shenning if ((h = ifa_grouplookup(ifa_name, flags)) != NULL) 13822ff5b035Shenning return (h); 13832ff5b035Shenning 138494e9410bShenning if (!strncmp(ifa_name, "self", IFNAMSIZ)) 13857ad220f2Scedric ifa_name = NULL; 138694e9410bShenning 138794e9410bShenning if (iftab == NULL) 138894e9410bShenning ifa_load(); 138994e9410bShenning 139094e9410bShenning for (p = iftab; p; p = p->next) { 13917ad220f2Scedric if (ifa_skip_if(ifa_name, p)) 139294e9410bShenning continue; 1393ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET) 139494e9410bShenning continue; 1395ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && 1396ec359bd5Scedric !(p->ifa_flags & IFF_BROADCAST)) 139794e9410bShenning continue; 1398ec359bd5Scedric if ((flags & PFI_AFLAG_PEER) && 1399ec359bd5Scedric !(p->ifa_flags & IFF_POINTOPOINT)) 1400ec359bd5Scedric continue; 1401ec359bd5Scedric if ((flags & PFI_AFLAG_NETWORK) && p->ifindex > 0) 1402ec359bd5Scedric continue; 1403ec359bd5Scedric if (last_if == NULL || strcmp(last_if, p->ifname)) 1404ec359bd5Scedric got4 = got6 = 0; 1405ec359bd5Scedric last_if = p->ifname; 1406ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) 1407ec359bd5Scedric continue; 1408ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) 1409ec359bd5Scedric continue; 1410ec359bd5Scedric if (p->af == AF_INET) 1411ec359bd5Scedric got4 = 1; 1412ec359bd5Scedric else 1413ec359bd5Scedric got6 = 1; 141494e9410bShenning n = calloc(1, sizeof(struct node_host)); 141594e9410bShenning if (n == NULL) 141694e9410bShenning err(1, "address: calloc"); 141794e9410bShenning n->af = p->af; 1418ec359bd5Scedric if (flags & PFI_AFLAG_BROADCAST) 141994e9410bShenning memcpy(&n->addr.v.a.addr, &p->bcast, 142094e9410bShenning sizeof(struct pf_addr)); 1421ec359bd5Scedric else if (flags & PFI_AFLAG_PEER) 1422ec359bd5Scedric memcpy(&n->addr.v.a.addr, &p->peer, 1423ec359bd5Scedric sizeof(struct pf_addr)); 142494e9410bShenning else 142594e9410bShenning memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, 142694e9410bShenning sizeof(struct pf_addr)); 1427ec359bd5Scedric if (flags & PFI_AFLAG_NETWORK) 142894e9410bShenning set_ipmask(n, unmask(&p->addr.v.a.mask, n->af)); 142994e9410bShenning else { 143094e9410bShenning if (n->af == AF_INET) { 143194e9410bShenning if (p->ifa_flags & IFF_LOOPBACK && 143294e9410bShenning p->ifa_flags & IFF_LINK1) 143394e9410bShenning memcpy(&n->addr.v.a.mask, 143494e9410bShenning &p->addr.v.a.mask, 143594e9410bShenning sizeof(struct pf_addr)); 143694e9410bShenning else 143794e9410bShenning set_ipmask(n, 32); 143894e9410bShenning } else 143994e9410bShenning set_ipmask(n, 128); 144094e9410bShenning } 144194e9410bShenning n->ifindex = p->ifindex; 144294e9410bShenning 144394e9410bShenning n->next = NULL; 144494e9410bShenning n->tail = n; 144594e9410bShenning if (h == NULL) 144694e9410bShenning h = n; 144794e9410bShenning else { 144894e9410bShenning h->tail->next = n; 144994e9410bShenning h->tail = n; 145094e9410bShenning } 145194e9410bShenning } 145294e9410bShenning return (h); 145394e9410bShenning } 145494e9410bShenning 14557ad220f2Scedric int 14567ad220f2Scedric ifa_skip_if(const char *filter, struct node_host *p) 14577ad220f2Scedric { 14587ad220f2Scedric int n; 14597ad220f2Scedric 14607ad220f2Scedric if (p->af != AF_INET && p->af != AF_INET6) 14617ad220f2Scedric return (1); 14627ad220f2Scedric if (filter == NULL || !*filter) 14637ad220f2Scedric return (0); 14647ad220f2Scedric if (!strcmp(p->ifname, filter)) 14657ad220f2Scedric return (0); /* exact match */ 14667ad220f2Scedric n = strlen(filter); 14677ad220f2Scedric if (n < 1 || n >= IFNAMSIZ) 14687ad220f2Scedric return (1); /* sanity check */ 14697ad220f2Scedric if (filter[n-1] >= '0' && filter[n-1] <= '9') 14707ad220f2Scedric return (1); /* only do exact match in that case */ 14717ad220f2Scedric if (strncmp(p->ifname, filter, n)) 14727ad220f2Scedric return (1); /* prefix doesn't match */ 14737ad220f2Scedric return (p->ifname[n] < '0' || p->ifname[n] > '9'); 14747ad220f2Scedric } 14757ad220f2Scedric 147694e9410bShenning struct node_host * 1477f23861c1Shenning host(const char *s) 147894e9410bShenning { 147936754172Smcbride struct node_host *h = NULL, *n; 148036754172Smcbride int mask = -1, v4mask = 32, v6mask = 128, cont = 1; 148125bdb5e4Smcbride char *p, *q, *r, *ps, *if_name; 148294e9410bShenning 148336754172Smcbride if ((ps = strdup(s)) == NULL) 148436754172Smcbride err(1, "host: strdup"); 148536754172Smcbride 148636754172Smcbride if ((if_name = strrchr(ps, '@')) != NULL) { 148736754172Smcbride if_name[0] = '\0'; 148836754172Smcbride if_name++; 1489d20cfe34Smcbride } 149025bdb5e4Smcbride 1491d20cfe34Smcbride if ((p = strrchr(ps, '/')) != NULL) { 149225bdb5e4Smcbride if ((r = strdup(ps)) == NULL) 149325bdb5e4Smcbride err(1, "host: strdup"); 149494e9410bShenning mask = strtol(p+1, &q, 0); 1495fecc9cd0Shenning if (!q || *q || mask > 128 || q == (p+1)) { 14961cf63431Schl fprintf(stderr, "invalid netmask '%s'\n", p); 1497f565df7eSjsg free(r); 149820289793Szinovik free(ps); 149994e9410bShenning return (NULL); 150094e9410bShenning } 150136754172Smcbride p[0] = '\0'; 150294e9410bShenning v4mask = v6mask = mask; 150325bdb5e4Smcbride } else 150425bdb5e4Smcbride r = ps; 150594e9410bShenning 15062a6c1abaShenning /* interface with this name exists? */ 15074a36d485Shenning if (cont && (h = host_if(ps, mask)) != NULL) 15082a6c1abaShenning cont = 0; 15092a6c1abaShenning 15102a6c1abaShenning /* IPv4 address? */ 151125bdb5e4Smcbride if (cont && (h = host_v4(r, mask)) != NULL) 15122a6c1abaShenning cont = 0; 151325bdb5e4Smcbride if (r != ps) 151425bdb5e4Smcbride free(r); 15152a6c1abaShenning 15162a6c1abaShenning /* IPv6 address? */ 15172a6c1abaShenning if (cont && (h = host_v6(ps, v6mask)) != NULL) 15182a6c1abaShenning cont = 0; 15192a6c1abaShenning 15202a6c1abaShenning /* dns lookup */ 15212a6c1abaShenning if (cont && (h = host_dns(ps, v4mask, v6mask)) != NULL) 15222a6c1abaShenning cont = 0; 15232a6c1abaShenning 1524d20cfe34Smcbride if (if_name && if_name[0]) 1525d20cfe34Smcbride for (n = h; n != NULL; n = n->next) 1526d20cfe34Smcbride if ((n->ifname = strdup(if_name)) == NULL) 1527d20cfe34Smcbride err(1, "host: strdup"); 1528d20cfe34Smcbride 1529d20cfe34Smcbride free(ps); /* after we copy the name out */ 15302a6c1abaShenning if (h == NULL || cont == 1) { 15312a6c1abaShenning fprintf(stderr, "no IP address found for %s\n", s); 15322a6c1abaShenning return (NULL); 15332a6c1abaShenning } 1534cbdc262eSmcbride for (n = h; n != NULL; n = n->next) { 1535d20cfe34Smcbride n->addr.type = PF_ADDR_ADDRMASK; 1536cbdc262eSmcbride n->weight = 0; 1537cbdc262eSmcbride } 15382a6c1abaShenning return (h); 15392a6c1abaShenning } 15402a6c1abaShenning 15412a6c1abaShenning struct node_host * 1542f2370d27Shenning host_if(const char *s, int mask) 15432a6c1abaShenning { 15442a6c1abaShenning struct node_host *n, *h = NULL; 15454a36d485Shenning char *p, *ps; 1546ec359bd5Scedric int flags = 0; 15472a6c1abaShenning 1548ec359bd5Scedric if ((ps = strdup(s)) == NULL) 1549ec359bd5Scedric err(1, "host_if: strdup"); 1550ec359bd5Scedric while ((p = strrchr(ps, ':')) != NULL) { 15514a36d485Shenning if (!strcmp(p+1, "network")) 1552ec359bd5Scedric flags |= PFI_AFLAG_NETWORK; 1553ec359bd5Scedric else if (!strcmp(p+1, "broadcast")) 1554ec359bd5Scedric flags |= PFI_AFLAG_BROADCAST; 1555ec359bd5Scedric else if (!strcmp(p+1, "peer")) 1556ec359bd5Scedric flags |= PFI_AFLAG_PEER; 1557ec359bd5Scedric else if (!strcmp(p+1, "0")) 1558ec359bd5Scedric flags |= PFI_AFLAG_NOALIAS; 1559f8bc5305Shenning else { 1560f8bc5305Shenning free(ps); 1561ec359bd5Scedric return (NULL); 1562f8bc5305Shenning } 1563ec359bd5Scedric *p = '\0'; 1564ec359bd5Scedric } 1565ec359bd5Scedric if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */ 1566ec359bd5Scedric fprintf(stderr, "illegal combination of interface modifiers\n"); 1567f8bc5305Shenning free(ps); 1568ec359bd5Scedric return (NULL); 1569ec359bd5Scedric } 1570ec359bd5Scedric if ((flags & (PFI_AFLAG_NETWORK|PFI_AFLAG_BROADCAST)) && mask > -1) { 15714a36d485Shenning fprintf(stderr, "network or broadcast lookup, but " 15724a36d485Shenning "extra netmask given\n"); 1573f8bc5305Shenning free(ps); 15744a36d485Shenning return (NULL); 15754a36d485Shenning } 15766c3582faShenning if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ)) { 15772a6c1abaShenning /* interface with this name exists */ 1578ec359bd5Scedric h = ifa_lookup(ps, flags); 15792a6c1abaShenning for (n = h; n != NULL && mask > -1; n = n->next) 15802a6c1abaShenning set_ipmask(n, mask); 15812a6c1abaShenning } 15824a36d485Shenning 15834a36d485Shenning free(ps); 15842a6c1abaShenning return (h); 15852a6c1abaShenning } 15862a6c1abaShenning 15872a6c1abaShenning struct node_host * 1588383ebbbfShenning host_v4(const char *s, int mask) 15892a6c1abaShenning { 15902a6c1abaShenning struct node_host *h = NULL; 15912a6c1abaShenning struct in_addr ina; 159290fffbb7Shenning int bits = 32; 15932a6c1abaShenning 159494e9410bShenning memset(&ina, 0, sizeof(struct in_addr)); 159590fffbb7Shenning if (strrchr(s, '/') != NULL) { 159690fffbb7Shenning if ((bits = inet_net_pton(AF_INET, s, &ina, sizeof(ina))) == -1) 159790fffbb7Shenning return (NULL); 159890fffbb7Shenning } else { 159990fffbb7Shenning if (inet_pton(AF_INET, s, &ina) != 1) 160090fffbb7Shenning return (NULL); 160190fffbb7Shenning } 160290fffbb7Shenning 160394e9410bShenning h = calloc(1, sizeof(struct node_host)); 160494e9410bShenning if (h == NULL) 160594e9410bShenning err(1, "address: calloc"); 160694e9410bShenning h->ifname = NULL; 160794e9410bShenning h->af = AF_INET; 160894e9410bShenning h->addr.v.a.addr.addr32[0] = ina.s_addr; 160994e9410bShenning set_ipmask(h, bits); 161094e9410bShenning h->next = NULL; 161194e9410bShenning h->tail = h; 16122a6c1abaShenning 161394e9410bShenning return (h); 161494e9410bShenning } 16152a6c1abaShenning 16162a6c1abaShenning struct node_host * 1617f2370d27Shenning host_v6(const char *s, int mask) 16182a6c1abaShenning { 16192a6c1abaShenning struct addrinfo hints, *res; 16202a6c1abaShenning struct node_host *h = NULL; 162194e9410bShenning 162294e9410bShenning memset(&hints, 0, sizeof(hints)); 162394e9410bShenning hints.ai_family = AF_INET6; 162494e9410bShenning hints.ai_socktype = SOCK_DGRAM; /*dummy*/ 162594e9410bShenning hints.ai_flags = AI_NUMERICHOST; 16262a6c1abaShenning if (getaddrinfo(s, "0", &hints, &res) == 0) { 16272a6c1abaShenning h = calloc(1, sizeof(struct node_host)); 16282a6c1abaShenning if (h == NULL) 162994e9410bShenning err(1, "address: calloc"); 16302a6c1abaShenning h->ifname = NULL; 16312a6c1abaShenning h->af = AF_INET6; 16322a6c1abaShenning memcpy(&h->addr.v.a.addr, 163394e9410bShenning &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 16342a6c1abaShenning sizeof(h->addr.v.a.addr)); 16352a6c1abaShenning h->ifindex = 16362a6c1abaShenning ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; 16372a6c1abaShenning set_ipmask(h, mask); 163894e9410bShenning freeaddrinfo(res); 16392a6c1abaShenning h->next = NULL; 16402a6c1abaShenning h->tail = h; 164194e9410bShenning } 164294e9410bShenning 16432a6c1abaShenning return (h); 16442a6c1abaShenning } 16452a6c1abaShenning 16462a6c1abaShenning struct node_host * 1647f2370d27Shenning host_dns(const char *s, int v4mask, int v6mask) 16482a6c1abaShenning { 16492a6c1abaShenning struct addrinfo hints, *res0, *res; 16502a6c1abaShenning struct node_host *n, *h = NULL; 1651ec359bd5Scedric int error, noalias = 0; 1652ec359bd5Scedric int got4 = 0, got6 = 0; 1653ec359bd5Scedric char *p, *ps; 16542a6c1abaShenning 1655ec359bd5Scedric if ((ps = strdup(s)) == NULL) 165622dee42fShenning err(1, "host_dns: strdup"); 1657ec359bd5Scedric if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) { 1658ec359bd5Scedric noalias = 1; 1659ec359bd5Scedric *p = '\0'; 1660ec359bd5Scedric } 166194e9410bShenning memset(&hints, 0, sizeof(hints)); 166294e9410bShenning hints.ai_family = PF_UNSPEC; 166394e9410bShenning hints.ai_socktype = SOCK_STREAM; /* DUMMY */ 1664ec359bd5Scedric error = getaddrinfo(ps, NULL, &hints, &res0); 1665b4d8b6eeShenning if (error) { 1666b4d8b6eeShenning free(ps); 16672a6c1abaShenning return (h); 1668b4d8b6eeShenning } 16692a6c1abaShenning 167094e9410bShenning for (res = res0; res; res = res->ai_next) { 167194e9410bShenning if (res->ai_family != AF_INET && 167294e9410bShenning res->ai_family != AF_INET6) 167394e9410bShenning continue; 1674ec359bd5Scedric if (noalias) { 1675ec359bd5Scedric if (res->ai_family == AF_INET) { 1676ec359bd5Scedric if (got4) 1677ec359bd5Scedric continue; 1678ec359bd5Scedric got4 = 1; 1679ec359bd5Scedric } else { 1680ec359bd5Scedric if (got6) 1681ec359bd5Scedric continue; 1682ec359bd5Scedric got6 = 1; 1683ec359bd5Scedric } 1684ec359bd5Scedric } 168594e9410bShenning n = calloc(1, sizeof(struct node_host)); 168694e9410bShenning if (n == NULL) 16872a6c1abaShenning err(1, "host_dns: calloc"); 168894e9410bShenning n->ifname = NULL; 168994e9410bShenning n->af = res->ai_family; 169094e9410bShenning if (res->ai_family == AF_INET) { 169194e9410bShenning memcpy(&n->addr.v.a.addr, 16922a6c1abaShenning &((struct sockaddr_in *) 16932a6c1abaShenning res->ai_addr)->sin_addr.s_addr, 169494e9410bShenning sizeof(struct in_addr)); 169594e9410bShenning set_ipmask(n, v4mask); 169694e9410bShenning } else { 169794e9410bShenning memcpy(&n->addr.v.a.addr, 16982a6c1abaShenning &((struct sockaddr_in6 *) 16992a6c1abaShenning res->ai_addr)->sin6_addr.s6_addr, 170094e9410bShenning sizeof(struct in6_addr)); 170194e9410bShenning n->ifindex = 17022a6c1abaShenning ((struct sockaddr_in6 *) 17032a6c1abaShenning res->ai_addr)->sin6_scope_id; 170494e9410bShenning set_ipmask(n, v6mask); 170594e9410bShenning } 170694e9410bShenning n->next = NULL; 170794e9410bShenning n->tail = n; 170894e9410bShenning if (h == NULL) 170994e9410bShenning h = n; 171094e9410bShenning else { 171194e9410bShenning h->tail->next = n; 171294e9410bShenning h->tail = n; 171394e9410bShenning } 171494e9410bShenning } 171594e9410bShenning freeaddrinfo(res0); 1716ec359bd5Scedric free(ps); 171794e9410bShenning 171894e9410bShenning return (h); 171994e9410bShenning } 172042e05679Scedric 172142e05679Scedric /* 172242e05679Scedric * convert a hostname to a list of addresses and put them in the given buffer. 172342e05679Scedric * test: 172442e05679Scedric * if set to 1, only simple addresses are accepted (no netblock, no "!"). 172542e05679Scedric */ 172642e05679Scedric int 172742e05679Scedric append_addr(struct pfr_buffer *b, char *s, int test) 172842e05679Scedric { 1729cbdc262eSmcbride static int previous = 0; 1730cbdc262eSmcbride static int expect = 0; 1731cbdc262eSmcbride struct pfr_addr *a; 1732b88a8d5dScedric struct node_host *h, *n; 1733cbdc262eSmcbride char *r; 1734cbdc262eSmcbride const char *errstr; 1735cbdc262eSmcbride int rv, not = 0, i = 0; 1736cbdc262eSmcbride u_int16_t weight; 1737cbdc262eSmcbride 1738cbdc262eSmcbride /* skip weight if given */ 1739cbdc262eSmcbride if (strcmp(s, "weight") == 0) { 1740cbdc262eSmcbride expect = 1; 1741cbdc262eSmcbride return (1); /* expecting further call */ 1742cbdc262eSmcbride } 1743cbdc262eSmcbride 1744cbdc262eSmcbride /* check if previous host is set */ 1745cbdc262eSmcbride if (expect) { 1746cbdc262eSmcbride /* parse and append load balancing weight */ 1747cbdc262eSmcbride weight = strtonum(s, 1, USHRT_MAX, &errstr); 1748cbdc262eSmcbride if (errstr) { 1749cbdc262eSmcbride fprintf(stderr, "failed to convert weight %s\n", s); 1750cbdc262eSmcbride return (-1); 1751cbdc262eSmcbride } 1752cbdc262eSmcbride if (previous != -1) { 1753cbdc262eSmcbride PFRB_FOREACH(a, b) { 1754cbdc262eSmcbride if (++i >= previous) { 1755cbdc262eSmcbride a->pfra_weight = weight; 1756cbdc262eSmcbride a->pfra_type = PFRKE_COST; 1757cbdc262eSmcbride } 1758cbdc262eSmcbride } 1759cbdc262eSmcbride } 1760cbdc262eSmcbride 1761cbdc262eSmcbride expect = 0; 1762cbdc262eSmcbride return (0); 1763cbdc262eSmcbride } 17645b6c447dScedric 17655b6c447dScedric for (r = s; *r == '!'; r++) 17665b6c447dScedric not = !not; 17675b6c447dScedric if ((n = host(r)) == NULL) { 17685b6c447dScedric errno = 0; 17695b6c447dScedric return (-1); 17705b6c447dScedric } 1771b88a8d5dScedric rv = append_addr_host(b, n, test, not); 1772cbdc262eSmcbride previous = b->pfrb_size; 1773b88a8d5dScedric do { 1774b88a8d5dScedric h = n; 1775b88a8d5dScedric n = n->next; 1776b88a8d5dScedric free(h); 1777b88a8d5dScedric } while (n != NULL); 1778b88a8d5dScedric return (rv); 177942e05679Scedric } 178042e05679Scedric 178142e05679Scedric /* 17825b6c447dScedric * same as previous function, but with a pre-parsed input and the ability 1783b88a8d5dScedric * to "negate" the result. Does not free the node_host list. 178442e05679Scedric * not: 178542e05679Scedric * setting it to 1 is equivalent to adding "!" in front of parameter s. 178642e05679Scedric */ 178742e05679Scedric int 17885b6c447dScedric append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) 178942e05679Scedric { 179042e05679Scedric int bits; 179142e05679Scedric struct pfr_addr addr; 179242e05679Scedric 179342e05679Scedric do { 179442e05679Scedric bzero(&addr, sizeof(addr)); 17955b6c447dScedric addr.pfra_not = n->not ^ not; 179642e05679Scedric addr.pfra_af = n->af; 179742e05679Scedric addr.pfra_net = unmask(&n->addr.v.a.mask, n->af); 179836754172Smcbride if (n->ifname) { 179936754172Smcbride if (strlcpy(addr.pfra_ifname, n->ifname, 180036754172Smcbride sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) 180136754172Smcbride errx(1, "append_addr_host: strlcpy"); 180236754172Smcbride addr.pfra_type = PFRKE_ROUTE; 180336754172Smcbride } 1804cbdc262eSmcbride if (n->weight > 0) { 1805cbdc262eSmcbride addr.pfra_weight = n->weight; 1806cbdc262eSmcbride addr.pfra_type = PFRKE_COST; 1807cbdc262eSmcbride } 180842e05679Scedric switch (n->af) { 180942e05679Scedric case AF_INET: 181042e05679Scedric addr.pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32[0]; 181142e05679Scedric bits = 32; 181242e05679Scedric break; 181342e05679Scedric case AF_INET6: 181442e05679Scedric memcpy(&addr.pfra_ip6addr, &n->addr.v.a.addr.v6, 181542e05679Scedric sizeof(struct in6_addr)); 181642e05679Scedric bits = 128; 181742e05679Scedric break; 181842e05679Scedric default: 181942e05679Scedric errno = EINVAL; 182042e05679Scedric return (-1); 182142e05679Scedric } 182242e05679Scedric if ((test && (not || addr.pfra_net != bits)) || 182342e05679Scedric addr.pfra_net > bits) { 182442e05679Scedric errno = EINVAL; 182542e05679Scedric return (-1); 182642e05679Scedric } 182742e05679Scedric if (pfr_buf_add(b, &addr)) 182842e05679Scedric return (-1); 1829b88a8d5dScedric } while ((n = n->next) != NULL); 183042e05679Scedric 183142e05679Scedric return (0); 183242e05679Scedric } 183379cc0068Scedric 183479cc0068Scedric int 18359f66a89aShenning pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) 183679cc0068Scedric { 183779cc0068Scedric struct pfioc_trans_e trans; 183879cc0068Scedric 183979cc0068Scedric bzero(&trans, sizeof(trans)); 18409f66a89aShenning trans.type = type; 184179cc0068Scedric if (strlcpy(trans.anchor, anchor, 1842d9ad7941Sdhartmei sizeof(trans.anchor)) >= sizeof(trans.anchor)) 184379cc0068Scedric errx(1, "pfctl_add_trans: strlcpy"); 184479cc0068Scedric 184579cc0068Scedric return pfr_buf_add(buf, &trans); 184679cc0068Scedric } 184779cc0068Scedric 184879cc0068Scedric u_int32_t 18499f66a89aShenning pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) 185079cc0068Scedric { 185179cc0068Scedric struct pfioc_trans_e *p; 185279cc0068Scedric 185379cc0068Scedric PFRB_FOREACH(p, buf) 18549f66a89aShenning if (type == p->type && !strcmp(anchor, p->anchor)) 185579cc0068Scedric return (p->ticket); 185622dee42fShenning errx(1, "pfctl_get_ticket: assertion failed"); 185779cc0068Scedric } 185879cc0068Scedric 185979cc0068Scedric int 18603060c195Shenning pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) 186179cc0068Scedric { 186279cc0068Scedric struct pfioc_trans trans; 186379cc0068Scedric 186479cc0068Scedric bzero(&trans, sizeof(trans)); 186579cc0068Scedric trans.size = buf->pfrb_size - from; 186679cc0068Scedric trans.esize = sizeof(struct pfioc_trans_e); 186779cc0068Scedric trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; 186879cc0068Scedric return ioctl(dev, cmd, &trans); 186979cc0068Scedric } 1870