1*8cf23eedSsashan /* $OpenBSD: pfctl_parser.c,v 1.308 2016/09/03 17:11:40 sashan Exp $ */ 214a9b182Skjell 314a9b182Skjell /* 4fd3c3a0cSderaadt * Copyright (c) 2001 Daniel Hartmeier 5f8d11d7cShenning * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> 614a9b182Skjell * All rights reserved. 714a9b182Skjell * 814a9b182Skjell * Redistribution and use in source and binary forms, with or without 914a9b182Skjell * modification, are permitted provided that the following conditions 1014a9b182Skjell * are met: 1114a9b182Skjell * 1214a9b182Skjell * - Redistributions of source code must retain the above copyright 1314a9b182Skjell * notice, this list of conditions and the following disclaimer. 1414a9b182Skjell * - Redistributions in binary form must reproduce the above 1514a9b182Skjell * copyright notice, this list of conditions and the following 1614a9b182Skjell * disclaimer in the documentation and/or other materials provided 1714a9b182Skjell * with the distribution. 1814a9b182Skjell * 1914a9b182Skjell * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2014a9b182Skjell * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2114a9b182Skjell * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 2214a9b182Skjell * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 235974bd37Sdhartmei * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 2414a9b182Skjell * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 2514a9b182Skjell * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 2614a9b182Skjell * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 2714a9b182Skjell * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2814a9b182Skjell * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 2914a9b182Skjell * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 3014a9b182Skjell * POSSIBILITY OF SUCH DAMAGE. 3114a9b182Skjell * 3214a9b182Skjell */ 3314a9b182Skjell 34252d784aSderaadt #include <sys/types.h> 3579cc0068Scedric #include <sys/ioctl.h> 36252d784aSderaadt #include <sys/socket.h> 37918dda86Smikeb #include <net/if_dl.h> 38252d784aSderaadt #include <net/if.h> 39252d784aSderaadt #include <netinet/in.h> 406329fa59Sderaadt #include <netinet/ip.h> 416329fa59Sderaadt #include <netinet/ip_icmp.h> 4230620b12Sfrantzen #include <netinet/icmp6.h> 43252d784aSderaadt #include <net/pfvar.h> 44f8d11d7cShenning #include <net/hfsc.h> 459f13c6caSmillert #include <arpa/inet.h> 46252d784aSderaadt 479c957736Sguenther #include <ctype.h> 489c957736Sguenther #include <err.h> 499c957736Sguenther #include <errno.h> 509c957736Sguenther #include <ifaddrs.h> 519c957736Sguenther #include <limits.h> 529c957736Sguenther #include <netdb.h> 539c957736Sguenther #include <stdarg.h> 5414a9b182Skjell #include <stdio.h> 5514a9b182Skjell #include <stdlib.h> 5614a9b182Skjell #include <string.h> 579c957736Sguenther #include <time.h> 582ff5b035Shenning #include <unistd.h> 5914a9b182Skjell 60a2fdc13dSmcbride #define SYSLOG_NAMES 61a2fdc13dSmcbride #include <syslog.h> 62a2fdc13dSmcbride 6314a9b182Skjell #include "pfctl_parser.h" 64eb824e11Sderaadt #include "pfctl.h" 6514a9b182Skjell 665d9ac2dcSdhartmei void print_op (u_int8_t, const char *, const char *); 67ad85696eShenning void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); 681173271aScedric void print_ugid (u_int8_t, unsigned, unsigned, const char *, unsigned); 6981a15e5dSderaadt void print_flags (u_int8_t); 7064b4b616Sfrantzen void print_fromto(struct pf_rule_addr *, pf_osfp_t, 7164b4b616Sfrantzen struct pf_rule_addr *, u_int8_t, u_int8_t, int); 72f8d11d7cShenning void print_bwspec(const char *index, struct pf_queue_bwspec *); 73f8d11d7cShenning void print_scspec(const char *, struct pf_queue_scspec *); 747ad220f2Scedric int ifa_skip_if(const char *filter, struct node_host *p); 7514a9b182Skjell 762ff5b035Shenning struct node_host *ifa_grouplookup(const char *, int); 77f2370d27Shenning struct node_host *host_if(const char *, int); 78383ebbbfShenning struct node_host *host_v4(const char *, int); 79f2370d27Shenning struct node_host *host_v6(const char *, int); 80f2370d27Shenning struct node_host *host_dns(const char *, int, int); 812a6c1abaShenning 82361e311cShenning const char *tcpflags = "FSRPAUEW"; 8314a9b182Skjell 847d27d81aSdhartmei static const struct icmptypeent icmp_type[] = { 85082ebc44Swilfried { "echoreq", ICMP_ECHO }, 86082ebc44Swilfried { "echorep", ICMP_ECHOREPLY }, 87082ebc44Swilfried { "unreach", ICMP_UNREACH }, 88082ebc44Swilfried { "squench", ICMP_SOURCEQUENCH }, 89082ebc44Swilfried { "redir", ICMP_REDIRECT }, 90082ebc44Swilfried { "althost", ICMP_ALTHOSTADDR }, 91082ebc44Swilfried { "routeradv", ICMP_ROUTERADVERT }, 92082ebc44Swilfried { "routersol", ICMP_ROUTERSOLICIT }, 93082ebc44Swilfried { "timex", ICMP_TIMXCEED }, 94082ebc44Swilfried { "paramprob", ICMP_PARAMPROB }, 95082ebc44Swilfried { "timereq", ICMP_TSTAMP }, 96082ebc44Swilfried { "timerep", ICMP_TSTAMPREPLY }, 97082ebc44Swilfried { "inforeq", ICMP_IREQ }, 98082ebc44Swilfried { "inforep", ICMP_IREQREPLY }, 99082ebc44Swilfried { "maskreq", ICMP_MASKREQ }, 10002cbcc9eSwilfried { "maskrep", ICMP_MASKREPLY }, 10102cbcc9eSwilfried { "trace", ICMP_TRACEROUTE }, 10202cbcc9eSwilfried { "dataconv", ICMP_DATACONVERR }, 10302cbcc9eSwilfried { "mobredir", ICMP_MOBILE_REDIRECT }, 10402cbcc9eSwilfried { "ipv6-where", ICMP_IPV6_WHEREAREYOU }, 10502cbcc9eSwilfried { "ipv6-here", ICMP_IPV6_IAMHERE }, 10602cbcc9eSwilfried { "mobregreq", ICMP_MOBILE_REGREQUEST }, 10702cbcc9eSwilfried { "mobregrep", ICMP_MOBILE_REGREPLY }, 10802cbcc9eSwilfried { "skip", ICMP_SKIP }, 10902cbcc9eSwilfried { "photuris", ICMP_PHOTURIS } 110082ebc44Swilfried }; 111082ebc44Swilfried 1127d27d81aSdhartmei static const struct icmptypeent icmp6_type[] = { 11330620b12Sfrantzen { "unreach", ICMP6_DST_UNREACH }, 11430620b12Sfrantzen { "toobig", ICMP6_PACKET_TOO_BIG }, 11530620b12Sfrantzen { "timex", ICMP6_TIME_EXCEEDED }, 11630620b12Sfrantzen { "paramprob", ICMP6_PARAM_PROB }, 11730620b12Sfrantzen { "echoreq", ICMP6_ECHO_REQUEST }, 11830620b12Sfrantzen { "echorep", ICMP6_ECHO_REPLY }, 11930620b12Sfrantzen { "groupqry", ICMP6_MEMBERSHIP_QUERY }, 12022a58e88Sitojun { "listqry", MLD_LISTENER_QUERY }, 12130620b12Sfrantzen { "grouprep", ICMP6_MEMBERSHIP_REPORT }, 12222a58e88Sitojun { "listenrep", MLD_LISTENER_REPORT }, 12330620b12Sfrantzen { "groupterm", ICMP6_MEMBERSHIP_REDUCTION }, 12422a58e88Sitojun { "listendone", MLD_LISTENER_DONE }, 12530620b12Sfrantzen { "routersol", ND_ROUTER_SOLICIT }, 12630620b12Sfrantzen { "routeradv", ND_ROUTER_ADVERT }, 12730620b12Sfrantzen { "neighbrsol", ND_NEIGHBOR_SOLICIT }, 12830620b12Sfrantzen { "neighbradv", ND_NEIGHBOR_ADVERT }, 12930620b12Sfrantzen { "redir", ND_REDIRECT }, 13030620b12Sfrantzen { "routrrenum", ICMP6_ROUTER_RENUMBERING }, 13130620b12Sfrantzen { "wrureq", ICMP6_WRUREQUEST }, 13230620b12Sfrantzen { "wrurep", ICMP6_WRUREPLY }, 13330620b12Sfrantzen { "fqdnreq", ICMP6_FQDN_QUERY }, 13430620b12Sfrantzen { "fqdnrep", ICMP6_FQDN_REPLY }, 13530620b12Sfrantzen { "niqry", ICMP6_NI_QUERY }, 13630620b12Sfrantzen { "nirep", ICMP6_NI_REPLY }, 13722a58e88Sitojun { "mtraceresp", MLD_MTRACE_RESP }, 13822a58e88Sitojun { "mtrace", MLD_MTRACE } 13930620b12Sfrantzen }; 14030620b12Sfrantzen 1417d27d81aSdhartmei static const struct icmpcodeent icmp_code[] = { 142082ebc44Swilfried { "net-unr", ICMP_UNREACH, ICMP_UNREACH_NET }, 143082ebc44Swilfried { "host-unr", ICMP_UNREACH, ICMP_UNREACH_HOST }, 144082ebc44Swilfried { "proto-unr", ICMP_UNREACH, ICMP_UNREACH_PROTOCOL }, 145082ebc44Swilfried { "port-unr", ICMP_UNREACH, ICMP_UNREACH_PORT }, 146082ebc44Swilfried { "needfrag", ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG }, 147082ebc44Swilfried { "srcfail", ICMP_UNREACH, ICMP_UNREACH_SRCFAIL }, 148082ebc44Swilfried { "net-unk", ICMP_UNREACH, ICMP_UNREACH_NET_UNKNOWN }, 149082ebc44Swilfried { "host-unk", ICMP_UNREACH, ICMP_UNREACH_HOST_UNKNOWN }, 150082ebc44Swilfried { "isolate", ICMP_UNREACH, ICMP_UNREACH_ISOLATED }, 151082ebc44Swilfried { "net-prohib", ICMP_UNREACH, ICMP_UNREACH_NET_PROHIB }, 152082ebc44Swilfried { "host-prohib", ICMP_UNREACH, ICMP_UNREACH_HOST_PROHIB }, 153082ebc44Swilfried { "net-tos", ICMP_UNREACH, ICMP_UNREACH_TOSNET }, 154082ebc44Swilfried { "host-tos", ICMP_UNREACH, ICMP_UNREACH_TOSHOST }, 155082ebc44Swilfried { "filter-prohib", ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB }, 156082ebc44Swilfried { "host-preced", ICMP_UNREACH, ICMP_UNREACH_HOST_PRECEDENCE }, 157082ebc44Swilfried { "cutoff-preced", ICMP_UNREACH, ICMP_UNREACH_PRECEDENCE_CUTOFF }, 158082ebc44Swilfried { "redir-net", ICMP_REDIRECT, ICMP_REDIRECT_NET }, 159082ebc44Swilfried { "redir-host", ICMP_REDIRECT, ICMP_REDIRECT_HOST }, 160082ebc44Swilfried { "redir-tos-net", ICMP_REDIRECT, ICMP_REDIRECT_TOSNET }, 161082ebc44Swilfried { "redir-tos-host", ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST }, 16202cbcc9eSwilfried { "normal-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NORMAL }, 16302cbcc9eSwilfried { "common-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NOROUTE_COMMON }, 164082ebc44Swilfried { "transit", ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS }, 165082ebc44Swilfried { "reassemb", ICMP_TIMXCEED, ICMP_TIMXCEED_REASS }, 166082ebc44Swilfried { "badhead", ICMP_PARAMPROB, ICMP_PARAMPROB_ERRATPTR }, 167082ebc44Swilfried { "optmiss", ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT }, 16802cbcc9eSwilfried { "badlen", ICMP_PARAMPROB, ICMP_PARAMPROB_LENGTH }, 16902cbcc9eSwilfried { "unknown-ind", ICMP_PHOTURIS, ICMP_PHOTURIS_UNKNOWN_INDEX }, 17002cbcc9eSwilfried { "auth-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_AUTH_FAILED }, 17102cbcc9eSwilfried { "decrypt-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_DECRYPT_FAILED } 172082ebc44Swilfried }; 173082ebc44Swilfried 1747d27d81aSdhartmei static const struct icmpcodeent icmp6_code[] = { 1751d32ee3bSdhartmei { "admin-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN }, 1761d32ee3bSdhartmei { "noroute-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE }, 17730620b12Sfrantzen { "notnbr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOTNEIGHBOR }, 17830620b12Sfrantzen { "beyond-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_BEYONDSCOPE }, 17930620b12Sfrantzen { "addr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR }, 18030620b12Sfrantzen { "port-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT }, 18130620b12Sfrantzen { "transit", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT }, 18230620b12Sfrantzen { "reassemb", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY }, 18330620b12Sfrantzen { "badhead", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER }, 18430620b12Sfrantzen { "nxthdr", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER }, 18530620b12Sfrantzen { "redironlink", ND_REDIRECT, ND_REDIRECT_ONLINK }, 18630620b12Sfrantzen { "redirrouter", ND_REDIRECT, ND_REDIRECT_ROUTER } 18730620b12Sfrantzen }; 18830620b12Sfrantzen 189d593fb91Sdrahn const struct pf_timeout pf_timeouts[] = { 190d593fb91Sdrahn { "tcp.first", PFTM_TCP_FIRST_PACKET }, 191d593fb91Sdrahn { "tcp.opening", PFTM_TCP_OPENING }, 192d593fb91Sdrahn { "tcp.established", PFTM_TCP_ESTABLISHED }, 193d593fb91Sdrahn { "tcp.closing", PFTM_TCP_CLOSING }, 194d593fb91Sdrahn { "tcp.finwait", PFTM_TCP_FIN_WAIT }, 195d593fb91Sdrahn { "tcp.closed", PFTM_TCP_CLOSED }, 19698d12bd8Sfrantzen { "tcp.tsdiff", PFTM_TS_DIFF }, 197d593fb91Sdrahn { "udp.first", PFTM_UDP_FIRST_PACKET }, 198d593fb91Sdrahn { "udp.single", PFTM_UDP_SINGLE }, 199d593fb91Sdrahn { "udp.multiple", PFTM_UDP_MULTIPLE }, 200d593fb91Sdrahn { "icmp.first", PFTM_ICMP_FIRST_PACKET }, 201d593fb91Sdrahn { "icmp.error", PFTM_ICMP_ERROR_REPLY }, 202d593fb91Sdrahn { "other.first", PFTM_OTHER_FIRST_PACKET }, 203d593fb91Sdrahn { "other.single", PFTM_OTHER_SINGLE }, 204d593fb91Sdrahn { "other.multiple", PFTM_OTHER_MULTIPLE }, 205d593fb91Sdrahn { "frag", PFTM_FRAG }, 206d593fb91Sdrahn { "interval", PFTM_INTERVAL }, 207a85e74a5Sdhartmei { "adaptive.start", PFTM_ADAPTIVE_START }, 208a85e74a5Sdhartmei { "adaptive.end", PFTM_ADAPTIVE_END }, 209fd777407Smcbride { "src.track", PFTM_SRC_NODE }, 210d593fb91Sdrahn { NULL, 0 } 211d593fb91Sdrahn }; 212d593fb91Sdrahn 213a64374fdSmcbride enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; 214a64374fdSmcbride 2157d27d81aSdhartmei const struct icmptypeent * 216bb9f691eSmcbride geticmptypebynumber(u_int8_t type, sa_family_t af) 217082ebc44Swilfried { 218ed99c291Sderaadt unsigned int i; 219082ebc44Swilfried 220d14c53d7Swilfried if (af != AF_INET6) { 221e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 222e4ebe044Shenning i++) { 223082ebc44Swilfried if (type == icmp_type[i].type) 224082ebc44Swilfried return (&icmp_type[i]); 225082ebc44Swilfried } 22630620b12Sfrantzen } else { 22730620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 22830620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 22930620b12Sfrantzen if (type == icmp6_type[i].type) 23030620b12Sfrantzen return (&icmp6_type[i]); 23130620b12Sfrantzen } 23230620b12Sfrantzen } 23330620b12Sfrantzen return (NULL); 234082ebc44Swilfried } 235082ebc44Swilfried 2367d27d81aSdhartmei const struct icmptypeent * 237bb9f691eSmcbride geticmptypebyname(char *w, sa_family_t af) 238082ebc44Swilfried { 239ed99c291Sderaadt unsigned int i; 240082ebc44Swilfried 241d14c53d7Swilfried if (af != AF_INET6) { 242e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 243e4ebe044Shenning i++) { 244082ebc44Swilfried if (!strcmp(w, icmp_type[i].name)) 245082ebc44Swilfried return (&icmp_type[i]); 246082ebc44Swilfried } 24730620b12Sfrantzen } else { 24830620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 24930620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 25030620b12Sfrantzen if (!strcmp(w, icmp6_type[i].name)) 25130620b12Sfrantzen return (&icmp6_type[i]); 25230620b12Sfrantzen } 25330620b12Sfrantzen } 25430620b12Sfrantzen return (NULL); 255082ebc44Swilfried } 256082ebc44Swilfried 2577d27d81aSdhartmei const struct icmpcodeent * 258bb9f691eSmcbride geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) 259082ebc44Swilfried { 260ed99c291Sderaadt unsigned int i; 261082ebc44Swilfried 262d14c53d7Swilfried if (af != AF_INET6) { 263e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 264e4ebe044Shenning i++) { 26530620b12Sfrantzen if (type == icmp_code[i].type && 26630620b12Sfrantzen code == icmp_code[i].code) 267082ebc44Swilfried return (&icmp_code[i]); 268082ebc44Swilfried } 26930620b12Sfrantzen } else { 27030620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 27130620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 27230620b12Sfrantzen if (type == icmp6_code[i].type && 27330620b12Sfrantzen code == icmp6_code[i].code) 27430620b12Sfrantzen return (&icmp6_code[i]); 27530620b12Sfrantzen } 27630620b12Sfrantzen } 27730620b12Sfrantzen return (NULL); 278082ebc44Swilfried } 279082ebc44Swilfried 2807d27d81aSdhartmei const struct icmpcodeent * 281bb9f691eSmcbride geticmpcodebyname(u_long type, char *w, sa_family_t af) 282082ebc44Swilfried { 283ed99c291Sderaadt unsigned int i; 284082ebc44Swilfried 285d14c53d7Swilfried if (af != AF_INET6) { 286e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 287e4ebe044Shenning i++) { 28830620b12Sfrantzen if (type == icmp_code[i].type && 28930620b12Sfrantzen !strcmp(w, icmp_code[i].name)) 290082ebc44Swilfried return (&icmp_code[i]); 291082ebc44Swilfried } 29230620b12Sfrantzen } else { 29330620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 29430620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 29530620b12Sfrantzen if (type == icmp6_code[i].type && 29630620b12Sfrantzen !strcmp(w, icmp6_code[i].name)) 29730620b12Sfrantzen return (&icmp6_code[i]); 29830620b12Sfrantzen } 29930620b12Sfrantzen } 30030620b12Sfrantzen return (NULL); 30130620b12Sfrantzen } 30230620b12Sfrantzen 303a2fdc13dSmcbride /* 304a2fdc13dSmcbride * Decode a symbolic name to a numeric value. 305a2fdc13dSmcbride * From syslogd. 306a2fdc13dSmcbride */ 307a2fdc13dSmcbride int 308a2fdc13dSmcbride string_to_loglevel(const char *name) 309a2fdc13dSmcbride { 310a2fdc13dSmcbride CODE *c; 311a2fdc13dSmcbride char *p, buf[40]; 312a2fdc13dSmcbride 313707c207dStedu if (isdigit((unsigned char)*name)) { 314707c207dStedu const char *errstr; 315707c207dStedu int val; 316707c207dStedu 317707c207dStedu val = strtonum(name, 0, LOG_DEBUG, &errstr); 318707c207dStedu if (errstr) 319707c207dStedu return -1; 320707c207dStedu return val; 321707c207dStedu } 322a2fdc13dSmcbride 323a2fdc13dSmcbride for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { 324025f5691Sderaadt if (isupper((unsigned char)*name)) 325025f5691Sderaadt *p = tolower((unsigned char)*name); 326a2fdc13dSmcbride else 327a2fdc13dSmcbride *p = *name; 328a2fdc13dSmcbride } 329a2fdc13dSmcbride *p = '\0'; 330a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++) 331d07c4539Sbluhm if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI) 332a2fdc13dSmcbride return (c->c_val); 333a2fdc13dSmcbride 334a2fdc13dSmcbride return (-1); 335a2fdc13dSmcbride } 336a2fdc13dSmcbride 337a2fdc13dSmcbride const char * 338a2fdc13dSmcbride loglevel_to_string(int level) 339a2fdc13dSmcbride { 340a2fdc13dSmcbride CODE *c; 341a2fdc13dSmcbride 342a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++) 343a2fdc13dSmcbride if (c->c_val == level) 344a2fdc13dSmcbride return (c->c_name); 345a2fdc13dSmcbride 346a2fdc13dSmcbride return ("unknown"); 347a2fdc13dSmcbride } 348a2fdc13dSmcbride 34981a15e5dSderaadt void 3505d9ac2dcSdhartmei print_op(u_int8_t op, const char *a1, const char *a2) 3515d9ac2dcSdhartmei { 3525d9ac2dcSdhartmei if (op == PF_OP_IRG) 3535d9ac2dcSdhartmei printf(" %s >< %s", a1, a2); 3545d9ac2dcSdhartmei else if (op == PF_OP_XRG) 3555d9ac2dcSdhartmei printf(" %s <> %s", a1, a2); 3561308506cShenning else if (op == PF_OP_EQ) 3575d9ac2dcSdhartmei printf(" = %s", a1); 3581308506cShenning else if (op == PF_OP_NE) 3595d9ac2dcSdhartmei printf(" != %s", a1); 3601308506cShenning else if (op == PF_OP_LT) 3615d9ac2dcSdhartmei printf(" < %s", a1); 3625d9ac2dcSdhartmei else if (op == PF_OP_LE) 3635d9ac2dcSdhartmei printf(" <= %s", a1); 3645d9ac2dcSdhartmei else if (op == PF_OP_GT) 3655d9ac2dcSdhartmei printf(" > %s", a1); 3665d9ac2dcSdhartmei else if (op == PF_OP_GE) 3675d9ac2dcSdhartmei printf(" >= %s", a1); 3688da4e377Smcbride else if (op == PF_OP_RRG) 3698da4e377Smcbride printf(" %s:%s", a1, a2); 3705d9ac2dcSdhartmei } 3715d9ac2dcSdhartmei 3725d9ac2dcSdhartmei void 373ad85696eShenning print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) 37414a9b182Skjell { 375e31d21c9Sdhartmei char a1[6], a2[6]; 376ad85696eShenning struct servent *s = NULL; 37781a15e5dSderaadt 378ad85696eShenning if (opts & PF_OPT_PORTNAMES) 379e4ebe044Shenning s = getservbyport(p1, proto); 38014a9b182Skjell p1 = ntohs(p1); 38114a9b182Skjell p2 = ntohs(p2); 3825d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", p1); 3835d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", p2); 38414a9b182Skjell printf(" port"); 3855d9ac2dcSdhartmei if (s != NULL && (op == PF_OP_EQ || op == PF_OP_NE)) 3865d9ac2dcSdhartmei print_op(op, s->s_name, a2); 38714a9b182Skjell else 3885d9ac2dcSdhartmei print_op(op, a1, a2); 3895d9ac2dcSdhartmei } 3905d9ac2dcSdhartmei 3915d9ac2dcSdhartmei void 3921173271aScedric print_ugid(u_int8_t op, unsigned u1, unsigned u2, const char *t, unsigned umax) 3935d9ac2dcSdhartmei { 394d8fcd2dfSdhartmei char a1[11], a2[11]; 3955d9ac2dcSdhartmei 3965d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", u1); 3975d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", u2); 3985d9ac2dcSdhartmei printf(" %s", t); 3991173271aScedric if (u1 == umax && (op == PF_OP_EQ || op == PF_OP_NE)) 400c16ab608Sdhartmei print_op(op, "unknown", a2); 401c16ab608Sdhartmei else 402c16ab608Sdhartmei print_op(op, a1, a2); 403c16ab608Sdhartmei } 404c16ab608Sdhartmei 405c16ab608Sdhartmei void 40614a9b182Skjell print_flags(u_int8_t f) 40714a9b182Skjell { 40814a9b182Skjell int i; 40981a15e5dSderaadt 410bc795af0Shugh for (i = 0; tcpflags[i]; ++i) 41114a9b182Skjell if (f & (1 << i)) 41214a9b182Skjell printf("%c", tcpflags[i]); 41314a9b182Skjell } 41414a9b182Skjell 41514a9b182Skjell void 41664b4b616Sfrantzen print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, 417ad85696eShenning sa_family_t af, u_int8_t proto, int opts) 41815e76891Sdhartmei { 41964b4b616Sfrantzen char buf[PF_OSFP_LEN*3]; 420ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 4211173271aScedric if (src->addr.type == PF_ADDR_ADDRMASK && 4221173271aScedric dst->addr.type == PF_ADDR_ADDRMASK && 423bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.addr, AF_INET6) && 424bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.mask, AF_INET6) && 4251173271aScedric PF_AZERO(&dst->addr.v.a.addr, AF_INET6) && 4261173271aScedric PF_AZERO(&dst->addr.v.a.mask, AF_INET6) && 427d4008a34Sdhartmei !src->neg && !dst->neg && 42864b4b616Sfrantzen !src->port_op && !dst->port_op && 42964b4b616Sfrantzen osfp == PF_OSFP_ANY) 43015e76891Sdhartmei printf(" all"); 43115e76891Sdhartmei else { 43215e76891Sdhartmei printf(" from "); 433d4008a34Sdhartmei if (src->neg) 43415e76891Sdhartmei printf("! "); 43544f5ed0aScedric print_addr(&src->addr, af, verbose); 43615e76891Sdhartmei if (src->port_op) 43715e76891Sdhartmei print_port(src->port_op, src->port[0], 43815e76891Sdhartmei src->port[1], 439ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts); 44064b4b616Sfrantzen if (osfp != PF_OSFP_ANY) 44164b4b616Sfrantzen printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, 44264b4b616Sfrantzen sizeof(buf))); 44315e76891Sdhartmei 44415e76891Sdhartmei printf(" to "); 445d4008a34Sdhartmei if (dst->neg) 44615e76891Sdhartmei printf("! "); 44744f5ed0aScedric print_addr(&dst->addr, af, verbose); 44815e76891Sdhartmei if (dst->port_op) 44915e76891Sdhartmei print_port(dst->port_op, dst->port[0], 45015e76891Sdhartmei dst->port[1], 451ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts); 45215e76891Sdhartmei } 45315e76891Sdhartmei } 45415e76891Sdhartmei 45515e76891Sdhartmei void 456e0c302d0Smcbride print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, 45736754172Smcbride sa_family_t af, int id, int verbose) 4583a44df3cSmcbride { 45936754172Smcbride if (pool->ifname[0]) { 460a2f57b9fSmcbride if (!PF_AZERO(&pool->addr.v.a.addr, af)) { 46136754172Smcbride print_addr(&pool->addr, af, verbose); 462a2f57b9fSmcbride printf("@"); 463a2f57b9fSmcbride } 464a2f57b9fSmcbride printf("%s", pool->ifname); 46536754172Smcbride } else 46636754172Smcbride print_addr(&pool->addr, af, verbose); 467e0c302d0Smcbride switch (id) { 468a64374fdSmcbride case PF_POOL_NAT: 4699782f7a2Smcbride if ((p1 != PF_NAT_PROXY_PORT_LOW || 4709782f7a2Smcbride p2 != PF_NAT_PROXY_PORT_HIGH) && (p1 != 0 || p2 != 0)) { 471e0c302d0Smcbride if (p1 == p2) 472e0c302d0Smcbride printf(" port %u", p1); 473e0c302d0Smcbride else 474e0c302d0Smcbride printf(" port %u:%u", p1, p2); 475e0c302d0Smcbride } 476e0c302d0Smcbride break; 477a64374fdSmcbride case PF_POOL_RDR: 478e0c302d0Smcbride if (p1) { 4798da4e377Smcbride printf(" port %u", p1); 4808da4e377Smcbride if (p2 && (p2 != p1)) 4818da4e377Smcbride printf(":%u", p2); 482e0c302d0Smcbride } 483e0c302d0Smcbride break; 484e0c302d0Smcbride default: 485e0c302d0Smcbride break; 486e0c302d0Smcbride } 487e0c302d0Smcbride switch (pool->opts & PF_POOL_TYPEMASK) { 488e0c302d0Smcbride case PF_POOL_NONE: 489e0c302d0Smcbride break; 490e0c302d0Smcbride case PF_POOL_BITMASK: 491e0c302d0Smcbride printf(" bitmask"); 492e0c302d0Smcbride break; 493e0c302d0Smcbride case PF_POOL_RANDOM: 494e0c302d0Smcbride printf(" random"); 495e0c302d0Smcbride break; 496e0c302d0Smcbride case PF_POOL_SRCHASH: 4970436fa02Smcbride printf(" source-hash 0x%08x%08x%08x%08x", 498e0c302d0Smcbride pool->key.key32[0], pool->key.key32[1], 499e0c302d0Smcbride pool->key.key32[2], pool->key.key32[3]); 500e0c302d0Smcbride break; 501e0c302d0Smcbride case PF_POOL_ROUNDROBIN: 502e0c302d0Smcbride printf(" round-robin"); 503e0c302d0Smcbride break; 504bcb11948Szinke case PF_POOL_LEASTSTATES: 505bcb11948Szinke printf(" least-states"); 506bcb11948Szinke break; 507e0c302d0Smcbride } 508fd777407Smcbride if (pool->opts & PF_POOL_STICKYADDR) 509fd777407Smcbride printf(" sticky-address"); 510a64374fdSmcbride if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) 511e0c302d0Smcbride printf(" static-port"); 5123a44df3cSmcbride } 5133a44df3cSmcbride 514132c30ccShenning const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 5156b640f62Smcbride const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES; 516132c30ccShenning const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; 517fd777407Smcbride const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES; 51899a73934Sderaadt 51914a9b182Skjell void 520fd777407Smcbride print_status(struct pf_status *s, int opts) 52114a9b182Skjell { 522a2fdc13dSmcbride char statline[80], *running, *debug; 523c474e331Shenning time_t runtime; 52499a73934Sderaadt int i; 525a1973c63Ssturm char buf[PF_MD5_DIGEST_LENGTH * 2 + 1]; 526010eb8d3Smpf static const char hex[] = "0123456789abcdef"; 52799a73934Sderaadt 528c474e331Shenning runtime = time(NULL) - s->since; 5295191b30fScedric running = s->running ? "Enabled" : "Disabled"; 530c474e331Shenning 5315191b30fScedric if (s->since) { 532b14a9e08Sderaadt unsigned int sec, min, hrs; 533b14a9e08Sderaadt time_t day = runtime; 534d85e4ad6Sdhartmei 535d85e4ad6Sdhartmei sec = day % 60; 536d85e4ad6Sdhartmei day /= 60; 537d85e4ad6Sdhartmei min = day % 60; 538d85e4ad6Sdhartmei day /= 60; 539d85e4ad6Sdhartmei hrs = day % 24; 540d85e4ad6Sdhartmei day /= 24; 541c474e331Shenning snprintf(statline, sizeof(statline), 542b14a9e08Sderaadt "Status: %s for %lld days %.2u:%.2u:%.2u", 543b14a9e08Sderaadt running, (long long)day, hrs, min, sec); 544d85e4ad6Sdhartmei } else 5455191b30fScedric snprintf(statline, sizeof(statline), "Status: %s", running); 546c97b4ee1Shenning printf("%-44s", statline); 547aa48e8d1Smillert if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) { 548a2fdc13dSmcbride printf("%15s\n\n", debug); 549e2714f7cSderaadt free(debug); 550aa48e8d1Smillert } 551f6e85b8dSmcbride 552f6e85b8dSmcbride if (opts & PF_OPT_VERBOSE) { 553010eb8d3Smpf printf("Hostid: 0x%08x\n", ntohl(s->hostid)); 554010eb8d3Smpf 555a1973c63Ssturm for (i = 0; i < PF_MD5_DIGEST_LENGTH; i++) { 556010eb8d3Smpf buf[i + i] = hex[s->pf_chksum[i] >> 4]; 557010eb8d3Smpf buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; 558010eb8d3Smpf } 559010eb8d3Smpf buf[i + i] = '\0'; 560010eb8d3Smpf printf("Checksum: 0x%s\n\n", buf); 561f6e85b8dSmcbride } 562010eb8d3Smpf 563c474e331Shenning if (s->ifname[0] != 0) { 564c474e331Shenning printf("Interface Stats for %-16s %5s %16s\n", 565c474e331Shenning s->ifname, "IPv4", "IPv6"); 566c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes In", 567ef22e615Sdhartmei (unsigned long long)s->bcounters[0][0], 568ef22e615Sdhartmei (unsigned long long)s->bcounters[1][0]); 569c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes Out", 570ef22e615Sdhartmei (unsigned long long)s->bcounters[0][1], 571ef22e615Sdhartmei (unsigned long long)s->bcounters[1][1]); 572c474e331Shenning printf(" Packets In\n"); 573c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 574ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_PASS], 575ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_PASS]); 576c474e331Shenning printf(" %-23s %14llu %16llu\n", "Blocked", 577ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_DROP], 578ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_DROP]); 579c474e331Shenning printf(" Packets Out\n"); 580c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 581ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_PASS], 582ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_PASS]); 583c474e331Shenning printf(" %-23s %14llu %16llu\n\n", "Blocked", 584ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_DROP], 585ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_DROP]); 586c474e331Shenning } 587c474e331Shenning printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); 588c474e331Shenning printf(" %-25s %14u %14s\n", "current entries", s->states, ""); 589c474e331Shenning for (i = 0; i < FCNT_MAX; i++) { 590ea4ec064Sitojun printf(" %-25s %14llu ", pf_fcounters[i], 591ea4ec064Sitojun (unsigned long long)s->fcounters[i]); 592c474e331Shenning if (runtime > 0) 593c474e331Shenning printf("%14.1f/s\n", 594c474e331Shenning (double)s->fcounters[i] / (double)runtime); 595c474e331Shenning else 596c474e331Shenning printf("%14s\n", ""); 597c474e331Shenning } 598fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 599fd777407Smcbride printf("Source Tracking Table\n"); 600fd777407Smcbride printf(" %-25s %14u %14s\n", "current entries", 601fd777407Smcbride s->src_nodes, ""); 602fd777407Smcbride for (i = 0; i < SCNT_MAX; i++) { 603fd777407Smcbride printf(" %-25s %14lld ", pf_scounters[i], 604fd777407Smcbride s->scounters[i]); 605fd777407Smcbride if (runtime > 0) 606fd777407Smcbride printf("%14.1f/s\n", 607fd777407Smcbride (double)s->scounters[i] / (double)runtime); 608fd777407Smcbride else 609fd777407Smcbride printf("%14s\n", ""); 610fd777407Smcbride } 611fd777407Smcbride } 61299a73934Sderaadt printf("Counters\n"); 613c474e331Shenning for (i = 0; i < PFRES_MAX; i++) { 614ea4ec064Sitojun printf(" %-25s %14llu ", pf_reasons[i], 615ea4ec064Sitojun (unsigned long long)s->counters[i]); 616c474e331Shenning if (runtime > 0) 617c474e331Shenning printf("%14.1f/s\n", 618c474e331Shenning (double)s->counters[i] / (double)runtime); 619c474e331Shenning else 620c474e331Shenning printf("%14s\n", ""); 621c474e331Shenning } 6226b640f62Smcbride if (opts & PF_OPT_VERBOSE) { 6236b640f62Smcbride printf("Limit Counters\n"); 6246b640f62Smcbride for (i = 0; i < LCNT_MAX; i++) { 6256b640f62Smcbride printf(" %-25s %14lld ", pf_lcounters[i], 6266b640f62Smcbride s->lcounters[i]); 6276b640f62Smcbride if (runtime > 0) 6286b640f62Smcbride printf("%14.1f/s\n", 6296b640f62Smcbride (double)s->lcounters[i] / (double)runtime); 6306b640f62Smcbride else 6316b640f62Smcbride printf("%14s\n", ""); 6326b640f62Smcbride } 6336b640f62Smcbride } 63414a9b182Skjell } 63514a9b182Skjell 63614a9b182Skjell void 637fd777407Smcbride print_src_node(struct pf_src_node *sn, int opts) 638fd777407Smcbride { 639fd777407Smcbride struct pf_addr_wrap aw; 640fd777407Smcbride int min, sec; 641fd777407Smcbride 642fd777407Smcbride memset(&aw, 0, sizeof(aw)); 643fd777407Smcbride if (sn->af == AF_INET) 644fd777407Smcbride aw.v.a.mask.addr32[0] = 0xffffffff; 645fd777407Smcbride else 646fd777407Smcbride memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); 647fd777407Smcbride 648fd777407Smcbride aw.v.a.addr = sn->addr; 649fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 650c3e2fff9Shenning 651c3e2fff9Shenning if (!PF_AZERO(&sn->raddr, sn->af)) { 652c3e2fff9Shenning if (sn->type == PF_SN_NAT) 653c3e2fff9Shenning printf(" nat-to "); 654c3e2fff9Shenning else if (sn->type == PF_SN_RDR) 655c3e2fff9Shenning printf(" rdr-to "); 656c3e2fff9Shenning else if (sn->type == PF_SN_ROUTE) 657c3e2fff9Shenning printf(" route-to "); 658c3e2fff9Shenning else 659c3e2fff9Shenning printf(" ??? (%u) ", sn->type); 660fd777407Smcbride aw.v.a.addr = sn->raddr; 6610cde32ceSclaudio print_addr(&aw, sn->naf ? sn->naf : sn->af, 6620cde32ceSclaudio opts & PF_OPT_VERBOSE2); 663c3e2fff9Shenning } 664c3e2fff9Shenning 6656b640f62Smcbride printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, 6666b640f62Smcbride sn->conn, sn->conn_rate.count / 1000, 6676b640f62Smcbride (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); 668fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 669fd777407Smcbride sec = sn->creation % 60; 670fd777407Smcbride sn->creation /= 60; 671fd777407Smcbride min = sn->creation % 60; 672fd777407Smcbride sn->creation /= 60; 673fd777407Smcbride printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); 674fd777407Smcbride if (sn->states == 0) { 675fd777407Smcbride sec = sn->expire % 60; 676fd777407Smcbride sn->expire /= 60; 677fd777407Smcbride min = sn->expire % 60; 678fd777407Smcbride sn->expire /= 60; 679fd777407Smcbride printf(", expires in %.2u:%.2u:%.2u", 680fd777407Smcbride sn->expire, min, sec); 681fd777407Smcbride } 682b19e9e6fSmcbride printf(", %llu pkts, %llu bytes", 683b19e9e6fSmcbride sn->packets[0] + sn->packets[1], 68459b61cdeShenning sn->bytes[0] + sn->bytes[1]); 685fd777407Smcbride if (sn->rule.nr != -1) 686c3e2fff9Shenning printf(", rule %u", sn->rule.nr); 687fd777407Smcbride printf("\n"); 688fd777407Smcbride } 689fd777407Smcbride } 690fd777407Smcbride 691fd777407Smcbride void 692ad85696eShenning print_rule(struct pf_rule *r, const char *anchor_call, int opts) 69314a9b182Skjell { 6940e8bc214Saaron static const char *actiontypes[] = { "pass", "block", "scrub", 695e9953237Shenning "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", 696e9953237Shenning "", "", "match"}; 6971173271aScedric static const char *anchortypes[] = { "anchor", "anchor", "anchor", 6980e8bc214Saaron "anchor", "nat-anchor", "nat-anchor", "binat-anchor", 6990e8bc214Saaron "binat-anchor", "rdr-anchor", "rdr-anchor" }; 7006992ade7Shenning int i, ropts; 701ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 702f9a568a2Smcbride char *p; 703cc5f0329Sdhartmei 704*8cf23eedSsashan if ((r->rule_flag & PFRULE_EXPIRED) && (!verbose)) 705*8cf23eedSsashan return; 706*8cf23eedSsashan 70774dc4fddShenning if (verbose) 70878baf774Sdhartmei printf("@%d ", r->nr); 709*8cf23eedSsashan 710e9953237Shenning if (r->action > PF_MATCH) 7111173271aScedric printf("action(%d)", r->action); 712305ca21dSmcbride else if (anchor_call[0]) { 713f9a568a2Smcbride p = strrchr(anchor_call, '/'); 714f9a568a2Smcbride if (p ? p[1] == '_' : anchor_call[0] == '_') 715305ca21dSmcbride printf("%s", anchortypes[r->action]); 716f9a568a2Smcbride else 717e77e5dc4Sjaredy printf("%s \"%s\"", anchortypes[r->action], 718e77e5dc4Sjaredy anchor_call); 719e151341fShenning } else 7201173271aScedric printf("%s", actiontypes[r->action]); 7211173271aScedric if (r->action == PF_DROP) { 7228a87542aShenning if (r->rule_flag & PFRULE_RETURN) 7238a87542aShenning printf(" return"); 7248a87542aShenning else if (r->rule_flag & PFRULE_RETURNRST) { 7251f77cc8aSpb if (!r->return_ttl) 72614a9b182Skjell printf(" return-rst"); 7271f77cc8aSpb else 7281f77cc8aSpb printf(" return-rst(ttl %d)", r->return_ttl); 729328b2decShenning } else if (r->rule_flag & PFRULE_RETURNICMP) { 730328b2decShenning const struct icmpcodeent *ic, *ic6; 731b996d042Sdhartmei 732b996d042Sdhartmei ic = geticmpcodebynumber(r->return_icmp >> 8, 733328b2decShenning r->return_icmp & 255, AF_INET); 734328b2decShenning ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, 735328b2decShenning r->return_icmp6 & 255, AF_INET6); 736d14c53d7Swilfried 737328b2decShenning switch (r->af) { 738328b2decShenning case AF_INET: 739328b2decShenning printf(" return-icmp"); 740d14c53d7Swilfried if (ic == NULL) 741d14c53d7Swilfried printf("(%u)", r->return_icmp & 255); 742b996d042Sdhartmei else 743328b2decShenning printf("(%s)", ic->name); 744328b2decShenning break; 745328b2decShenning case AF_INET6: 746328b2decShenning printf(" return-icmp6"); 747328b2decShenning if (ic6 == NULL) 748328b2decShenning printf("(%u)", r->return_icmp6 & 255); 749328b2decShenning else 750328b2decShenning printf("(%s)", ic6->name); 751328b2decShenning break; 752328b2decShenning default: 753328b2decShenning printf(" return-icmp"); 754328b2decShenning if (ic == NULL) 755328b2decShenning printf("(%u, ", r->return_icmp & 255); 756328b2decShenning else 757328b2decShenning printf("(%s, ", ic->name); 758328b2decShenning if (ic6 == NULL) 759328b2decShenning printf("%u)", r->return_icmp6 & 255); 760328b2decShenning else 761328b2decShenning printf("%s)", ic6->name); 762328b2decShenning break; 763328b2decShenning } 764acf2444cShenning } else 765acf2444cShenning printf(" drop"); 7661173271aScedric } 7677189e280Sdhartmei if (r->direction == PF_IN) 76814a9b182Skjell printf(" in"); 7697189e280Sdhartmei else if (r->direction == PF_OUT) 77014a9b182Skjell printf(" out"); 771a46dc179Sdhartmei if (r->log) { 772a46dc179Sdhartmei printf(" log"); 773f565c2a8Shenning if (r->log & ~PF_LOG || r->logif) { 7741cb19346Sdhartmei int count = 0; 7751cb19346Sdhartmei 776a46dc179Sdhartmei printf(" ("); 7771cb19346Sdhartmei if (r->log & PF_LOG_ALL) 7781cb19346Sdhartmei printf("%sall", count++ ? ", " : ""); 779f496e916Shenning if (r->log & PF_LOG_MATCHES) 780f496e916Shenning printf("%smatches", count++ ? ", " : ""); 781a46dc179Sdhartmei if (r->log & PF_LOG_SOCKET_LOOKUP) 7821cb19346Sdhartmei printf("%suser", count++ ? ", " : ""); 783f565c2a8Shenning if (r->logif) 784f565c2a8Shenning printf("%sto pflog%u", count++ ? ", " : "", 785f565c2a8Shenning r->logif); 786a46dc179Sdhartmei printf(")"); 787a46dc179Sdhartmei } 788a46dc179Sdhartmei } 78914a9b182Skjell if (r->quick) 79014a9b182Skjell printf(" quick"); 7917d0c9138Shenning if (r->ifname[0]) { 7927d0c9138Shenning if (r->ifnot) 7937d0c9138Shenning printf(" on ! %s", r->ifname); 7947d0c9138Shenning else 79514a9b182Skjell printf(" on %s", r->ifname); 7967d0c9138Shenning } 7979e70289eSclaudio if (r->onrdomain >= 0) { 7989e70289eSclaudio if (r->ifnot) 79941d2b8c8Sderaadt printf(" on ! rdomain %d", r->onrdomain); 8009e70289eSclaudio else 80141d2b8c8Sderaadt printf(" on rdomain %d", r->onrdomain); 8029e70289eSclaudio } 80330620b12Sfrantzen if (r->af) { 80430620b12Sfrantzen if (r->af == AF_INET) 80530620b12Sfrantzen printf(" inet"); 80630620b12Sfrantzen else 80730620b12Sfrantzen printf(" inet6"); 80830620b12Sfrantzen } 80914a9b182Skjell if (r->proto) { 810e4ebe044Shenning struct protoent *p; 811ed99c291Sderaadt 812e4ebe044Shenning if ((p = getprotobynumber(r->proto)) != NULL) 81314a9b182Skjell printf(" proto %s", p->p_name); 81414a9b182Skjell else 81514a9b182Skjell printf(" proto %u", r->proto); 81614a9b182Skjell } 81764b4b616Sfrantzen print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, 818ad85696eShenning opts); 81995b43208Sdlg if (r->rcv_ifname[0]) 8207d0482a9Shenning printf(" %sreceived-on %s", r->rcvifnot ? "!" : "", 8217d0482a9Shenning r->rcv_ifname); 822c16ab608Sdhartmei if (r->uid.op) 8231173271aScedric print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user", 8241173271aScedric UID_MAX); 825c16ab608Sdhartmei if (r->gid.op) 8261173271aScedric print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group", 8271173271aScedric GID_MAX); 82814a9b182Skjell if (r->flags || r->flagset) { 82914a9b182Skjell printf(" flags "); 83014a9b182Skjell print_flags(r->flags); 83114a9b182Skjell printf("/"); 83214a9b182Skjell print_flags(r->flagset); 833e9953237Shenning } else if ((r->action == PF_PASS || r->action == PF_MATCH) && 834bd9b24faSmcbride (!r->proto || r->proto == IPPROTO_TCP) && 835bd9b24faSmcbride !(r->rule_flag & PFRULE_FRAGMENT) && 836be73131dSmcbride !anchor_call[0] && r->keep_state) 837bd9b24faSmcbride printf(" flags any"); 838082ebc44Swilfried if (r->type) { 839b49ca6bbShenning const struct icmptypeent *it; 840082ebc44Swilfried 841b49ca6bbShenning it = geticmptypebynumber(r->type-1, r->af); 842d14c53d7Swilfried if (r->af != AF_INET6) 843d14c53d7Swilfried printf(" icmp-type"); 844082ebc44Swilfried else 845d0cb3502Smcbride printf(" icmp6-type"); 846b49ca6bbShenning if (it != NULL) 847b49ca6bbShenning printf(" %s", it->name); 848d14c53d7Swilfried else 849d14c53d7Swilfried printf(" %u", r->type-1); 850082ebc44Swilfried if (r->code) { 851b49ca6bbShenning const struct icmpcodeent *ic; 852082ebc44Swilfried 853b49ca6bbShenning ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); 854b49ca6bbShenning if (ic != NULL) 855b49ca6bbShenning printf(" code %s", ic->name); 856082ebc44Swilfried else 85714a9b182Skjell printf(" code %u", r->code-1); 858082ebc44Swilfried } 859082ebc44Swilfried } 860e4cbe364Sdhartmei if (r->tos) 861e4cbe364Sdhartmei printf(" tos 0x%2.2x", r->tos); 8627407027eSsthen if (r->prio) 8637407027eSsthen printf(" prio %u", r->prio == PF_PRIO_ZERO ? 0 : r->prio); 8646ac157faSmcbride 8650feb7a02Shenning if (r->scrub_flags & PFSTATE_SETMASK || r->qname[0]) { 866f8b0ac7eShenning char *comma = ""; 8672aa5186dShenning printf(" set ("); 86808263cb1Shenning if (r->scrub_flags & PFSTATE_SETPRIO) { 869f8b0ac7eShenning if (r->set_prio[0] == r->set_prio[1]) 870f8b0ac7eShenning printf("%s prio %u", comma, r->set_prio[0]); 871f8b0ac7eShenning else 872f8b0ac7eShenning printf("%s prio(%u, %u)", comma, r->set_prio[0], 873f8b0ac7eShenning r->set_prio[1]); 874f8b0ac7eShenning comma = ","; 875f8b0ac7eShenning } 8760feb7a02Shenning if (r->qname[0]) { 8770feb7a02Shenning if (r->pqname[0]) 8780feb7a02Shenning printf("%s queue(%s, %s)", comma, r->qname, 8790feb7a02Shenning r->pqname); 8800feb7a02Shenning else 8810feb7a02Shenning printf("%s queue %s", comma, r->qname); 8820feb7a02Shenning comma = ","; 8830feb7a02Shenning } 884f8b0ac7eShenning if (r->scrub_flags & PFSTATE_SETTOS) { 885f8b0ac7eShenning printf("%s tos 0x%2.2x", comma, r->set_tos); 886f8b0ac7eShenning comma = ","; 887f8b0ac7eShenning } 8882aa5186dShenning printf(" )"); 889f8b0ac7eShenning } 890f8b0ac7eShenning 8916992ade7Shenning ropts = 0; 8926ac157faSmcbride if (r->max_states || r->max_src_nodes || r->max_src_states) 8936992ade7Shenning ropts = 1; 8946ac157faSmcbride if (r->rule_flag & PFRULE_NOSYNC) 8956992ade7Shenning ropts = 1; 8966ac157faSmcbride if (r->rule_flag & PFRULE_SRCTRACK) 8976992ade7Shenning ropts = 1; 8986ac157faSmcbride if (r->rule_flag & PFRULE_IFBOUND) 8996992ade7Shenning ropts = 1; 9006ac157faSmcbride if (r->rule_flag & PFRULE_STATESLOPPY) 9016992ade7Shenning ropts = 1; 9026ac157faSmcbride if (r->rule_flag & PFRULE_PFLOW) 9036992ade7Shenning ropts = 1; 9046992ade7Shenning for (i = 0; !ropts && i < PFTM_MAX; ++i) 9056ac157faSmcbride if (r->timeout[i]) 9066992ade7Shenning ropts = 1; 9076ac157faSmcbride 908bd9b24faSmcbride if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) 909f644f0ccSmcbride printf(" no state"); 9106992ade7Shenning else if (r->keep_state == PF_STATE_NORMAL && ropts) 91114a9b182Skjell printf(" keep state"); 912b96c47abSfrantzen else if (r->keep_state == PF_STATE_MODULATE) 913b96c47abSfrantzen printf(" modulate state"); 91452e0438eSdhartmei else if (r->keep_state == PF_STATE_SYNPROXY) 91552e0438eSdhartmei printf(" synproxy state"); 91638425613Scedric if (r->prob) { 91738425613Scedric char buf[20]; 91838425613Scedric 91938425613Scedric snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0)); 92038425613Scedric for (i = strlen(buf)-1; i > 0; i--) { 92138425613Scedric if (buf[i] == '0') 92238425613Scedric buf[i] = '\0'; 92338425613Scedric else { 92438425613Scedric if (buf[i] == '.') 92538425613Scedric buf[i] = '\0'; 92638425613Scedric break; 92738425613Scedric } 92838425613Scedric } 92938425613Scedric printf(" probability %s%%", buf); 93038425613Scedric } 9316992ade7Shenning if (ropts) { 932cc5f0329Sdhartmei printf(" ("); 933cc5f0329Sdhartmei if (r->max_states) { 934cc5f0329Sdhartmei printf("max %u", r->max_states); 9356992ade7Shenning ropts = 0; 936cc5f0329Sdhartmei } 937af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) { 9386992ade7Shenning if (!ropts) 939af80fa86Smcbride printf(", "); 940af80fa86Smcbride printf("no-sync"); 9416992ade7Shenning ropts = 0; 942af80fa86Smcbride } 943fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) { 9446992ade7Shenning if (!ropts) 945fd777407Smcbride printf(", "); 946fd777407Smcbride printf("source-track"); 947fd777407Smcbride if (r->rule_flag & PFRULE_RULESRCTRACK) 948fd777407Smcbride printf(" rule"); 949fd777407Smcbride else 950fd777407Smcbride printf(" global"); 9516992ade7Shenning ropts = 0; 952fd777407Smcbride } 953fd777407Smcbride if (r->max_src_states) { 9546992ade7Shenning if (!ropts) 955fd777407Smcbride printf(", "); 956fd777407Smcbride printf("max-src-states %u", r->max_src_states); 9576992ade7Shenning ropts = 0; 958fd777407Smcbride } 9596b640f62Smcbride if (r->max_src_conn) { 9606992ade7Shenning if (!ropts) 9616b640f62Smcbride printf(", "); 9626b640f62Smcbride printf("max-src-conn %u", r->max_src_conn); 9636992ade7Shenning ropts = 0; 9646b640f62Smcbride } 9656b640f62Smcbride if (r->max_src_conn_rate.limit) { 9666992ade7Shenning if (!ropts) 9676b640f62Smcbride printf(", "); 9686b640f62Smcbride printf("max-src-conn-rate %u/%u", 9696b640f62Smcbride r->max_src_conn_rate.limit, 9706b640f62Smcbride r->max_src_conn_rate.seconds); 9716992ade7Shenning ropts = 0; 9726b640f62Smcbride } 973fd777407Smcbride if (r->max_src_nodes) { 9746992ade7Shenning if (!ropts) 975fd777407Smcbride printf(", "); 976fd777407Smcbride printf("max-src-nodes %u", r->max_src_nodes); 9776992ade7Shenning ropts = 0; 978fd777407Smcbride } 9796b640f62Smcbride if (r->overload_tblname[0]) { 9806992ade7Shenning if (!ropts) 9816b640f62Smcbride printf(", "); 9826b640f62Smcbride printf("overload <%s>", r->overload_tblname); 9831e320a53Sdhartmei if (r->flush) 9846b640f62Smcbride printf(" flush"); 9851e320a53Sdhartmei if (r->flush & PF_FLUSH_GLOBAL) 9861e320a53Sdhartmei printf(" global"); 9876b640f62Smcbride } 988ec359bd5Scedric if (r->rule_flag & PFRULE_IFBOUND) { 9896992ade7Shenning if (!ropts) 990ec359bd5Scedric printf(", "); 991ec359bd5Scedric printf("if-bound"); 9926992ade7Shenning ropts = 0; 993ec359bd5Scedric } 9944dc07d4cShenning if (r->rule_flag & PFRULE_STATESLOPPY) { 9956992ade7Shenning if (!ropts) 9964dc07d4cShenning printf(", "); 9974dc07d4cShenning printf("sloppy"); 9986992ade7Shenning ropts = 0; 9994dc07d4cShenning } 100018ae10f7Shenning if (r->rule_flag & PFRULE_PFLOW) { 10016992ade7Shenning if (!ropts) 100218ae10f7Shenning printf(", "); 100318ae10f7Shenning printf("pflow"); 10046992ade7Shenning ropts = 0; 100518ae10f7Shenning } 1006cc5f0329Sdhartmei for (i = 0; i < PFTM_MAX; ++i) 1007cc5f0329Sdhartmei if (r->timeout[i]) { 1008ae233f99Sdhartmei int j; 1009ae233f99Sdhartmei 10106992ade7Shenning if (!ropts) 1011cc5f0329Sdhartmei printf(", "); 10126992ade7Shenning ropts = 0; 10137e5eec99Sdhartmei for (j = 0; pf_timeouts[j].name != NULL; 10147e5eec99Sdhartmei ++j) 1015ae233f99Sdhartmei if (pf_timeouts[j].timeout == i) 1016ae233f99Sdhartmei break; 10177e5eec99Sdhartmei printf("%s %u", pf_timeouts[j].name == NULL ? 10187e5eec99Sdhartmei "inv.timeout" : pf_timeouts[j].name, 10197e5eec99Sdhartmei r->timeout[i]); 1020cc5f0329Sdhartmei } 1021cc5f0329Sdhartmei printf(")"); 1022cc5f0329Sdhartmei } 1023e9953237Shenning 1024ddd010a2Sdavid if (r->rule_flag & PFRULE_FRAGMENT) 1025ddd010a2Sdavid printf(" fragment"); 1026ddd010a2Sdavid 1027c4051035Shenning if (r->scrub_flags & PFSTATE_SCRUBMASK || r->min_ttl || r->max_mss) { 1028e9953237Shenning printf(" scrub ("); 10296992ade7Shenning ropts = 1; 103022923725Shenning if (r->scrub_flags & PFSTATE_NODF) { 103167d2a440Sprovos printf("no-df"); 10326992ade7Shenning ropts = 0; 103322923725Shenning } 103422923725Shenning if (r->scrub_flags & PFSTATE_RANDOMID) { 10356992ade7Shenning if (!ropts) 103622923725Shenning printf(" "); 1037edbe3066Sdhartmei printf("random-id"); 10386992ade7Shenning ropts = 0; 103922923725Shenning } 104022923725Shenning if (r->min_ttl) { 10416992ade7Shenning if (!ropts) 104222923725Shenning printf(" "); 104334c76dcbSprovos printf("min-ttl %d", r->min_ttl); 10446992ade7Shenning ropts = 0; 104522923725Shenning } 104622923725Shenning if (r->scrub_flags & PFSTATE_SCRUB_TCP) { 10476992ade7Shenning if (!ropts) 104822923725Shenning printf(" "); 1049e9953237Shenning printf("reassemble tcp"); 10506992ade7Shenning ropts = 0; 105122923725Shenning } 105222923725Shenning if (r->max_mss) { 10536992ade7Shenning if (!ropts) 105422923725Shenning printf(" "); 1055cfa91859Sjasoni printf("max-mss %d", r->max_mss); 10566992ade7Shenning ropts = 0; 105722923725Shenning } 1058e9953237Shenning printf(")"); 1059e9953237Shenning } 1060e9953237Shenning 1061f48d62b3Sdhartmei if (r->allow_opts) 1062f48d62b3Sdhartmei printf(" allow-opts"); 1063455ef0c1Sdhartmei if (r->label[0]) 1064ff45dfa8Scamield printf(" label \"%s\"", r->label); 106544b1b5a8Smikeb if (r->rule_flag & PFRULE_ONCE) 106644b1b5a8Smikeb printf(" once"); 10678aecb81aShenning if (r->tagname[0]) 10688aecb81aShenning printf(" tag %s", r->tagname); 106936369899Shenning if (r->match_tagname[0]) { 107036369899Shenning if (r->match_tag_not) 107136369899Shenning printf(" !"); 10720a5f7f2fShenning printf(" tagged %s", r->match_tagname); 107336369899Shenning } 10745e931757Shenning if (r->rtableid != -1) 10755e931757Shenning printf(" rtable %u", r->rtableid); 1076eb900600Smarkus if (r->divert.port) { 1077fd27dbffSbluhm if (PF_AZERO(&r->divert.addr, AF_INET6)) { 1078eb900600Smarkus printf(" divert-reply"); 1079eb900600Smarkus } else { 1080eb900600Smarkus /* XXX cut&paste from print_addr */ 1081eb900600Smarkus char buf[48]; 1082eb900600Smarkus 1083eb900600Smarkus printf(" divert-to "); 1084eb900600Smarkus if (inet_ntop(r->af, &r->divert.addr, buf, 1085eb900600Smarkus sizeof(buf)) == NULL) 1086eb900600Smarkus printf("?"); 1087eb900600Smarkus else 1088eb900600Smarkus printf("%s", buf); 1089782435eaSmarkus printf(" port %u", ntohs(r->divert.port)); 1090eb900600Smarkus } 1091eb900600Smarkus } 1092d85f7bc1Smichele if (r->divert_packet.port) 1093d85f7bc1Smichele printf(" divert-packet port %u", ntohs(r->divert_packet.port)); 10940cde32ceSclaudio 10950cde32ceSclaudio if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && 1096fc302162Smikeb r->rule_flag & PFRULE_AFTO) { 10970cde32ceSclaudio printf(" af-to %s from ", r->naf == AF_INET ? "inet" : "inet6"); 10980cde32ceSclaudio print_pool(&r->nat, r->nat.proxy_port[0], 10990cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af, 11000cde32ceSclaudio PF_POOL_NAT, verbose); 11010cde32ceSclaudio if (r->rdr.addr.type != PF_ADDR_NONE) { 11020cde32ceSclaudio printf(" to "); 11030cde32ceSclaudio print_pool(&r->rdr, r->rdr.proxy_port[0], 11040cde32ceSclaudio r->rdr.proxy_port[1], r->naf ? r->naf : r->af, 11050cde32ceSclaudio PF_POOL_RDR, verbose); 11060cde32ceSclaudio } 11070cde32ceSclaudio } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { 11080ef3d4feShenning printf (" nat-to "); 11090ef3d4feShenning print_pool(&r->nat, r->nat.proxy_port[0], 11100cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af, 11110cde32ceSclaudio PF_POOL_NAT, verbose); 11120cde32ceSclaudio } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { 11130ef3d4feShenning printf (" rdr-to "); 11140ef3d4feShenning print_pool(&r->rdr, r->rdr.proxy_port[0], 1115a64374fdSmcbride r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); 1116d0aca2f2Shenning } 111769e22b15Sreyk if (r->rt) { 111869e22b15Sreyk if (r->rt == PF_ROUTETO) 111969e22b15Sreyk printf(" route-to"); 112069e22b15Sreyk else if (r->rt == PF_REPLYTO) 112169e22b15Sreyk printf(" reply-to"); 112269e22b15Sreyk else if (r->rt == PF_DUPTO) 112369e22b15Sreyk printf(" dup-to"); 112469e22b15Sreyk printf(" "); 1125a64374fdSmcbride print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); 112669e22b15Sreyk } 112769e22b15Sreyk } 112814a9b182Skjell 11295b6c447dScedric void 11305b6c447dScedric print_tabledef(const char *name, int flags, int addrs, 11315b6c447dScedric struct node_tinithead *nodes) 11325b6c447dScedric { 11335b6c447dScedric struct node_tinit *ti, *nti; 11345b6c447dScedric struct node_host *h; 11355b6c447dScedric 11365b6c447dScedric printf("table <%s>", name); 11375b6c447dScedric if (flags & PFR_TFLAG_CONST) 11385b6c447dScedric printf(" const"); 11395b6c447dScedric if (flags & PFR_TFLAG_PERSIST) 11405b6c447dScedric printf(" persist"); 11415f03a6e1Smcbride if (flags & PFR_TFLAG_COUNTERS) 11425f03a6e1Smcbride printf(" counters"); 11435b6c447dScedric SIMPLEQ_FOREACH(ti, nodes, entries) { 11445b6c447dScedric if (ti->file) { 11455b6c447dScedric printf(" file \"%s\"", ti->file); 11465b6c447dScedric continue; 11475b6c447dScedric } 11485b6c447dScedric printf(" {"); 11495b6c447dScedric for (;;) { 11505b6c447dScedric for (h = ti->host; h != NULL; h = h->next) { 11515b6c447dScedric printf(h->not ? " !" : " "); 11525b6c447dScedric print_addr(&h->addr, h->af, 0); 115336754172Smcbride if (h->ifname) 115436754172Smcbride printf("@%s", h->ifname); 11555b6c447dScedric } 11565b6c447dScedric nti = SIMPLEQ_NEXT(ti, entries); 11575b6c447dScedric if (nti != NULL && nti->file == NULL) 11585b6c447dScedric ti = nti; /* merge lists */ 11595b6c447dScedric else 11605b6c447dScedric break; 11615b6c447dScedric } 11625b6c447dScedric printf(" }"); 11635b6c447dScedric } 11645b6c447dScedric if (addrs && SIMPLEQ_EMPTY(nodes)) 11655b6c447dScedric printf(" { }"); 11665b6c447dScedric printf("\n"); 11675b6c447dScedric } 11685b6c447dScedric 1169f8d11d7cShenning void 1170f8d11d7cShenning print_bwspec(const char *prefix, struct pf_queue_bwspec *bw) 1171f8d11d7cShenning { 1172f8d11d7cShenning u_int rate; 1173f8d11d7cShenning int i; 1174f8d11d7cShenning static const char unit[] = " KMG"; 1175f8d11d7cShenning 1176f8d11d7cShenning if (bw->percent) 1177f8d11d7cShenning printf("%s%u%%", prefix, bw->percent); 1178f8d11d7cShenning else if (bw->absolute) { 1179f8d11d7cShenning rate = bw->absolute; 1180f8d11d7cShenning for (i = 0; rate >= 1000 && i <= 3; i++) 1181f8d11d7cShenning rate /= 1000; 1182f8d11d7cShenning printf("%s%u%c", prefix, rate, unit[i]); 1183f8d11d7cShenning } 1184f8d11d7cShenning } 1185f8d11d7cShenning 1186f8d11d7cShenning void 1187f8d11d7cShenning print_scspec(const char *prefix, struct pf_queue_scspec *sc) 1188f8d11d7cShenning { 1189f8d11d7cShenning print_bwspec(prefix, &sc->m2); 1190f8d11d7cShenning if (sc->d) { 1191f8d11d7cShenning printf(" burst "); 1192f8d11d7cShenning print_bwspec("", &sc->m1); 1193f8d11d7cShenning printf(" for %ums", sc->d); 1194f8d11d7cShenning } 1195f8d11d7cShenning } 1196f8d11d7cShenning 1197f8d11d7cShenning void 1198f8d11d7cShenning print_queuespec(struct pf_queuespec *q) 1199f8d11d7cShenning { 1200f8d11d7cShenning /* hide the _root_ifname queues */ 1201f8d11d7cShenning if (q->qname[0] == '_') 1202f8d11d7cShenning return; 1203f8d11d7cShenning printf("queue %s", q->qname); 1204f8d11d7cShenning if (q->parent[0] && q->parent[0] != '_') 1205f8d11d7cShenning printf(" parent %s", q->parent); 1206cd984deeSmikeb else if (q->ifname[0]) 1207f8d11d7cShenning printf(" on %s", q->ifname); 1208f8d11d7cShenning print_scspec(" bandwidth ", &q->linkshare); 1209f8d11d7cShenning print_scspec(", min ", &q->realtime); 1210f8d11d7cShenning print_scspec(", max ", &q->upperlimit); 1211f8d11d7cShenning if (q->flags & HFSC_DEFAULTCLASS) 1212f8d11d7cShenning printf(" default"); 1213f8d11d7cShenning if (q->qlimit) 1214f8d11d7cShenning printf(" qlimit %u", q->qlimit); 1215f8d11d7cShenning printf("\n"); 1216f8d11d7cShenning } 1217f8d11d7cShenning 12181f8f21bdSmillert int 1219ff352a37Smarkus parse_flags(char *s) 122014a9b182Skjell { 1221ff352a37Smarkus char *p, *q; 122214a9b182Skjell u_int8_t f = 0; 122381a15e5dSderaadt 1224ff352a37Smarkus for (p = s; *p; p++) { 1225ff352a37Smarkus if ((q = strchr(tcpflags, *p)) == NULL) 1226ff352a37Smarkus return -1; 1227ff352a37Smarkus else 1228ff352a37Smarkus f |= 1 << (q - tcpflags); 122914a9b182Skjell } 1230bc795af0Shugh return (f ? f : PF_TH_ALL); 123114a9b182Skjell } 123294e9410bShenning 123394e9410bShenning void 123494e9410bShenning set_ipmask(struct node_host *h, u_int8_t b) 123594e9410bShenning { 123694e9410bShenning struct pf_addr *m, *n; 123794e9410bShenning int i, j = 0; 123894e9410bShenning 123994e9410bShenning m = &h->addr.v.a.mask; 1240ab648bf6Sfrantzen memset(m, 0, sizeof(*m)); 124194e9410bShenning 124294e9410bShenning while (b >= 32) { 124394e9410bShenning m->addr32[j++] = 0xffffffff; 124494e9410bShenning b -= 32; 124594e9410bShenning } 124694e9410bShenning for (i = 31; i > 31-b; --i) 124794e9410bShenning m->addr32[j] |= (1 << i); 124894e9410bShenning if (b) 124994e9410bShenning m->addr32[j] = htonl(m->addr32[j]); 125094e9410bShenning 125194e9410bShenning /* Mask off bits of the address that will never be used. */ 125294e9410bShenning n = &h->addr.v.a.addr; 1253ff626af1Shenning if (h->addr.type == PF_ADDR_ADDRMASK) 125494e9410bShenning for (i = 0; i < 4; i++) 125594e9410bShenning n->addr32[i] = n->addr32[i] & m->addr32[i]; 125694e9410bShenning } 125794e9410bShenning 125852f4a4a4Shenning int 125952f4a4a4Shenning check_netmask(struct node_host *h, sa_family_t af) 126052f4a4a4Shenning { 126152f4a4a4Shenning struct node_host *n = NULL; 126252f4a4a4Shenning struct pf_addr *m; 126352f4a4a4Shenning 126452f4a4a4Shenning for (n = h; n != NULL; n = n->next) { 126575d911b5Scedric if (h->addr.type == PF_ADDR_TABLE) 126675d911b5Scedric continue; 126752f4a4a4Shenning m = &h->addr.v.a.mask; 126852f4a4a4Shenning /* netmasks > 32 bit are invalid on v4 */ 126952f4a4a4Shenning if (af == AF_INET && 127052f4a4a4Shenning (m->addr32[1] || m->addr32[2] || m->addr32[3])) { 127152f4a4a4Shenning fprintf(stderr, "netmask %u invalid for IPv4 address\n", 127252f4a4a4Shenning unmask(m, AF_INET6)); 127352f4a4a4Shenning return (1); 127452f4a4a4Shenning } 127552f4a4a4Shenning } 127652f4a4a4Shenning return (0); 127752f4a4a4Shenning } 127852f4a4a4Shenning 1279c64927a6Smikeb struct node_host * 1280c64927a6Smikeb gen_dynnode(struct node_host *h, sa_family_t af) 1281c64927a6Smikeb { 1282c64927a6Smikeb struct node_host *n; 1283c64927a6Smikeb struct pf_addr *m; 1284c64927a6Smikeb 1285c64927a6Smikeb if (h->addr.type != PF_ADDR_DYNIFTL) 1286c64927a6Smikeb return (NULL); 1287c64927a6Smikeb 1288c64927a6Smikeb if ((n = calloc(1, sizeof(*n))) == NULL) 1289c64927a6Smikeb return (NULL); 1290c64927a6Smikeb bcopy(h, n, sizeof(*n)); 1291c64927a6Smikeb n->ifname = NULL; 1292c64927a6Smikeb n->next = NULL; 1293c64927a6Smikeb n->tail = NULL; 1294c64927a6Smikeb 1295c64927a6Smikeb /* fix up netmask */ 1296c64927a6Smikeb m = &n->addr.v.a.mask; 1297c64927a6Smikeb if (af == AF_INET && unmask(m, AF_INET6) > 32) 1298c64927a6Smikeb set_ipmask(n, 32); 1299c64927a6Smikeb 1300c64927a6Smikeb return (n); 1301c64927a6Smikeb } 1302c64927a6Smikeb 130394e9410bShenning /* interface lookup routines */ 130494e9410bShenning 130594e9410bShenning struct node_host *iftab; 130694e9410bShenning 130794e9410bShenning void 130894e9410bShenning ifa_load(void) 130994e9410bShenning { 131094e9410bShenning struct ifaddrs *ifap, *ifa; 131194e9410bShenning struct node_host *n = NULL, *h = NULL; 131294e9410bShenning 131394e9410bShenning if (getifaddrs(&ifap) < 0) 131494e9410bShenning err(1, "getifaddrs"); 131594e9410bShenning 131694e9410bShenning for (ifa = ifap; ifa; ifa = ifa->ifa_next) { 131794e9410bShenning if (!(ifa->ifa_addr->sa_family == AF_INET || 131894e9410bShenning ifa->ifa_addr->sa_family == AF_INET6 || 131994e9410bShenning ifa->ifa_addr->sa_family == AF_LINK)) 132094e9410bShenning continue; 132194e9410bShenning n = calloc(1, sizeof(struct node_host)); 132294e9410bShenning if (n == NULL) 132394e9410bShenning err(1, "address: calloc"); 132494e9410bShenning n->af = ifa->ifa_addr->sa_family; 132594e9410bShenning n->ifa_flags = ifa->ifa_flags; 132694e9410bShenning #ifdef __KAME__ 132794e9410bShenning if (n->af == AF_INET6 && 132894e9410bShenning IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 132994e9410bShenning ifa->ifa_addr)->sin6_addr) && 1330ab642153Shenning ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == 1331ab642153Shenning 0) { 133294e9410bShenning struct sockaddr_in6 *sin6; 133394e9410bShenning 133494e9410bShenning sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 133594e9410bShenning sin6->sin6_scope_id = sin6->sin6_addr.s6_addr[2] << 8 | 133694e9410bShenning sin6->sin6_addr.s6_addr[3]; 133794e9410bShenning sin6->sin6_addr.s6_addr[2] = 0; 133894e9410bShenning sin6->sin6_addr.s6_addr[3] = 0; 133994e9410bShenning } 134094e9410bShenning #endif 134194e9410bShenning n->ifindex = 0; 134294e9410bShenning if (n->af == AF_INET) { 134394e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in *) 134494e9410bShenning ifa->ifa_addr)->sin_addr.s_addr, 134594e9410bShenning sizeof(struct in_addr)); 134694e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in *) 134794e9410bShenning ifa->ifa_netmask)->sin_addr.s_addr, 134894e9410bShenning sizeof(struct in_addr)); 134994e9410bShenning if (ifa->ifa_broadaddr != NULL) 135094e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in *) 135194e9410bShenning ifa->ifa_broadaddr)->sin_addr.s_addr, 135294e9410bShenning sizeof(struct in_addr)); 1353ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1354ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in *) 1355ec359bd5Scedric ifa->ifa_dstaddr)->sin_addr.s_addr, 1356ec359bd5Scedric sizeof(struct in_addr)); 135794e9410bShenning } else if (n->af == AF_INET6) { 135894e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in6 *) 135994e9410bShenning ifa->ifa_addr)->sin6_addr.s6_addr, 136094e9410bShenning sizeof(struct in6_addr)); 136194e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in6 *) 136294e9410bShenning ifa->ifa_netmask)->sin6_addr.s6_addr, 136394e9410bShenning sizeof(struct in6_addr)); 136494e9410bShenning if (ifa->ifa_broadaddr != NULL) 136594e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in6 *) 136694e9410bShenning ifa->ifa_broadaddr)->sin6_addr.s6_addr, 136794e9410bShenning sizeof(struct in6_addr)); 1368ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1369ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in6 *) 1370ec359bd5Scedric ifa->ifa_dstaddr)->sin6_addr.s6_addr, 1371ec359bd5Scedric sizeof(struct in6_addr)); 137294e9410bShenning n->ifindex = ((struct sockaddr_in6 *) 137394e9410bShenning ifa->ifa_addr)->sin6_scope_id; 1374918dda86Smikeb } else if (n->af == AF_LINK) { 1375918dda86Smikeb n->ifindex = ((struct sockaddr_dl *) 1376918dda86Smikeb ifa->ifa_addr)->sdl_index; 137794e9410bShenning } 137894e9410bShenning if ((n->ifname = strdup(ifa->ifa_name)) == NULL) 137994e9410bShenning err(1, "ifa_load: strdup"); 138094e9410bShenning n->next = NULL; 138194e9410bShenning n->tail = n; 138294e9410bShenning if (h == NULL) 138394e9410bShenning h = n; 138494e9410bShenning else { 138594e9410bShenning h->tail->next = n; 138694e9410bShenning h->tail = n; 138794e9410bShenning } 138894e9410bShenning } 1389ec359bd5Scedric 139094e9410bShenning iftab = h; 139194e9410bShenning freeifaddrs(ifap); 139294e9410bShenning } 139394e9410bShenning 1394918dda86Smikeb unsigned int 1395918dda86Smikeb ifa_nametoindex(const char *ifa_name) 1396918dda86Smikeb { 1397918dda86Smikeb struct node_host *p; 1398918dda86Smikeb 1399918dda86Smikeb for (p = iftab; p; p = p->next) { 1400918dda86Smikeb if (p->af == AF_LINK && strcmp(p->ifname, ifa_name) == 0) 1401918dda86Smikeb return (p->ifindex); 1402918dda86Smikeb } 1403918dda86Smikeb errno = ENXIO; 1404918dda86Smikeb return (0); 1405918dda86Smikeb } 1406918dda86Smikeb 1407918dda86Smikeb char * 1408918dda86Smikeb ifa_indextoname(unsigned int ifindex, char *ifa_name) 1409918dda86Smikeb { 1410918dda86Smikeb struct node_host *p; 1411918dda86Smikeb 1412918dda86Smikeb for (p = iftab; p; p = p->next) { 1413918dda86Smikeb if (p->af == AF_LINK && ifindex == p->ifindex) { 1414918dda86Smikeb strlcpy(ifa_name, p->ifname, IFNAMSIZ); 1415918dda86Smikeb return (ifa_name); 1416918dda86Smikeb } 1417918dda86Smikeb } 1418918dda86Smikeb errno = ENXIO; 1419918dda86Smikeb return (NULL); 1420918dda86Smikeb } 1421918dda86Smikeb 142294e9410bShenning struct node_host * 14236c3582faShenning ifa_exists(const char *ifa_name) 142494e9410bShenning { 142594e9410bShenning struct node_host *n; 14262ff5b035Shenning struct ifgroupreq ifgr; 14272ff5b035Shenning int s; 142894e9410bShenning 142994e9410bShenning if (iftab == NULL) 143094e9410bShenning ifa_load(); 143194e9410bShenning 1432855d4e83Ssobrado /* check whether this is a group */ 14332ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 14342ff5b035Shenning err(1, "socket"); 14352ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 14362ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 14372ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == 0) { 14382ff5b035Shenning /* fake a node_host */ 14392ff5b035Shenning if ((n = calloc(1, sizeof(*n))) == NULL) 14402ff5b035Shenning err(1, "calloc"); 14412ff5b035Shenning if ((n->ifname = strdup(ifa_name)) == NULL) 14422ff5b035Shenning err(1, "strdup"); 14432ff5b035Shenning close(s); 14442ff5b035Shenning return (n); 14452ff5b035Shenning } 14462ff5b035Shenning close(s); 14472ff5b035Shenning 144894e9410bShenning for (n = iftab; n; n = n->next) { 144994e9410bShenning if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ)) 145094e9410bShenning return (n); 145194e9410bShenning } 1452655a9f8aShenning 145394e9410bShenning return (NULL); 145494e9410bShenning } 145594e9410bShenning 145694e9410bShenning struct node_host * 14572ff5b035Shenning ifa_grouplookup(const char *ifa_name, int flags) 14582ff5b035Shenning { 14592ff5b035Shenning struct ifg_req *ifg; 14602ff5b035Shenning struct ifgroupreq ifgr; 14612ff5b035Shenning int s, len; 1462727cb2f7Sdhartmei struct node_host *n, *h = NULL; 14632ff5b035Shenning 14642ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 14652ff5b035Shenning err(1, "socket"); 14662ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 14672ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 14682ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) { 14692ff5b035Shenning close(s); 14702ff5b035Shenning return (NULL); 14712ff5b035Shenning } 14722ff5b035Shenning 14732ff5b035Shenning len = ifgr.ifgr_len; 14742ff5b035Shenning if ((ifgr.ifgr_groups = calloc(1, len)) == NULL) 14752ff5b035Shenning err(1, "calloc"); 14762ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) 14772ff5b035Shenning err(1, "SIOCGIFGMEMB"); 14782ff5b035Shenning 14792ff5b035Shenning for (ifg = ifgr.ifgr_groups; ifg && len >= sizeof(struct ifg_req); 14802ff5b035Shenning ifg++) { 14812ff5b035Shenning len -= sizeof(struct ifg_req); 148217b44c41Shenning if ((n = ifa_lookup(ifg->ifgrq_member, flags)) == NULL) 148317b44c41Shenning continue; 14842ff5b035Shenning if (h == NULL) 14852ff5b035Shenning h = n; 14862ff5b035Shenning else { 1487727cb2f7Sdhartmei h->tail->next = n; 1488727cb2f7Sdhartmei h->tail = n->tail; 14892ff5b035Shenning } 14902ff5b035Shenning } 14912ff5b035Shenning free(ifgr.ifgr_groups); 14922ff5b035Shenning close(s); 14932ff5b035Shenning 14942ff5b035Shenning return (h); 14952ff5b035Shenning } 14962ff5b035Shenning 14972ff5b035Shenning struct node_host * 1498ec359bd5Scedric ifa_lookup(const char *ifa_name, int flags) 149994e9410bShenning { 150094e9410bShenning struct node_host *p = NULL, *h = NULL, *n = NULL; 15017ad220f2Scedric int got4 = 0, got6 = 0; 1502ec359bd5Scedric const char *last_if = NULL; 150394e9410bShenning 15042ff5b035Shenning if ((h = ifa_grouplookup(ifa_name, flags)) != NULL) 15052ff5b035Shenning return (h); 15062ff5b035Shenning 150794e9410bShenning if (!strncmp(ifa_name, "self", IFNAMSIZ)) 15087ad220f2Scedric ifa_name = NULL; 150994e9410bShenning 151094e9410bShenning if (iftab == NULL) 151194e9410bShenning ifa_load(); 151294e9410bShenning 151394e9410bShenning for (p = iftab; p; p = p->next) { 15147ad220f2Scedric if (ifa_skip_if(ifa_name, p)) 151594e9410bShenning continue; 1516ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET) 151794e9410bShenning continue; 1518ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && 1519ec359bd5Scedric !(p->ifa_flags & IFF_BROADCAST)) 152094e9410bShenning continue; 1521ec359bd5Scedric if ((flags & PFI_AFLAG_PEER) && 1522ec359bd5Scedric !(p->ifa_flags & IFF_POINTOPOINT)) 1523ec359bd5Scedric continue; 1524ec359bd5Scedric if ((flags & PFI_AFLAG_NETWORK) && p->ifindex > 0) 1525ec359bd5Scedric continue; 1526ec359bd5Scedric if (last_if == NULL || strcmp(last_if, p->ifname)) 1527ec359bd5Scedric got4 = got6 = 0; 1528ec359bd5Scedric last_if = p->ifname; 1529ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) 1530ec359bd5Scedric continue; 1531ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) 1532ec359bd5Scedric continue; 1533ec359bd5Scedric if (p->af == AF_INET) 1534ec359bd5Scedric got4 = 1; 1535ec359bd5Scedric else 1536ec359bd5Scedric got6 = 1; 153794e9410bShenning n = calloc(1, sizeof(struct node_host)); 153894e9410bShenning if (n == NULL) 153994e9410bShenning err(1, "address: calloc"); 154094e9410bShenning n->af = p->af; 1541ec359bd5Scedric if (flags & PFI_AFLAG_BROADCAST) 154294e9410bShenning memcpy(&n->addr.v.a.addr, &p->bcast, 154394e9410bShenning sizeof(struct pf_addr)); 1544ec359bd5Scedric else if (flags & PFI_AFLAG_PEER) 1545ec359bd5Scedric memcpy(&n->addr.v.a.addr, &p->peer, 1546ec359bd5Scedric sizeof(struct pf_addr)); 154794e9410bShenning else 154894e9410bShenning memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, 154994e9410bShenning sizeof(struct pf_addr)); 1550ec359bd5Scedric if (flags & PFI_AFLAG_NETWORK) 155194e9410bShenning set_ipmask(n, unmask(&p->addr.v.a.mask, n->af)); 155294e9410bShenning else { 155394e9410bShenning if (n->af == AF_INET) { 155494e9410bShenning if (p->ifa_flags & IFF_LOOPBACK && 155594e9410bShenning p->ifa_flags & IFF_LINK1) 155694e9410bShenning memcpy(&n->addr.v.a.mask, 155794e9410bShenning &p->addr.v.a.mask, 155894e9410bShenning sizeof(struct pf_addr)); 155994e9410bShenning else 156094e9410bShenning set_ipmask(n, 32); 156194e9410bShenning } else 156294e9410bShenning set_ipmask(n, 128); 156394e9410bShenning } 156494e9410bShenning n->ifindex = p->ifindex; 156594e9410bShenning 156694e9410bShenning n->next = NULL; 156794e9410bShenning n->tail = n; 156894e9410bShenning if (h == NULL) 156994e9410bShenning h = n; 157094e9410bShenning else { 157194e9410bShenning h->tail->next = n; 157294e9410bShenning h->tail = n; 157394e9410bShenning } 157494e9410bShenning } 157594e9410bShenning return (h); 157694e9410bShenning } 157794e9410bShenning 15787ad220f2Scedric int 15797ad220f2Scedric ifa_skip_if(const char *filter, struct node_host *p) 15807ad220f2Scedric { 15817ad220f2Scedric int n; 15827ad220f2Scedric 15837ad220f2Scedric if (p->af != AF_INET && p->af != AF_INET6) 15847ad220f2Scedric return (1); 15857ad220f2Scedric if (filter == NULL || !*filter) 15867ad220f2Scedric return (0); 15877ad220f2Scedric if (!strcmp(p->ifname, filter)) 15887ad220f2Scedric return (0); /* exact match */ 15897ad220f2Scedric n = strlen(filter); 15907ad220f2Scedric if (n < 1 || n >= IFNAMSIZ) 15917ad220f2Scedric return (1); /* sanity check */ 15927ad220f2Scedric if (filter[n-1] >= '0' && filter[n-1] <= '9') 15937ad220f2Scedric return (1); /* only do exact match in that case */ 15947ad220f2Scedric if (strncmp(p->ifname, filter, n)) 15957ad220f2Scedric return (1); /* prefix doesn't match */ 15967ad220f2Scedric return (p->ifname[n] < '0' || p->ifname[n] > '9'); 15977ad220f2Scedric } 15987ad220f2Scedric 159994e9410bShenning struct node_host * 1600f23861c1Shenning host(const char *s) 160194e9410bShenning { 160236754172Smcbride struct node_host *h = NULL, *n; 160336754172Smcbride int mask = -1, v4mask = 32, v6mask = 128, cont = 1; 160425bdb5e4Smcbride char *p, *q, *r, *ps, *if_name; 160594e9410bShenning 160636754172Smcbride if ((ps = strdup(s)) == NULL) 160736754172Smcbride err(1, "host: strdup"); 160836754172Smcbride 160936754172Smcbride if ((if_name = strrchr(ps, '@')) != NULL) { 161036754172Smcbride if_name[0] = '\0'; 161136754172Smcbride if_name++; 1612d20cfe34Smcbride } 161325bdb5e4Smcbride 1614d20cfe34Smcbride if ((p = strrchr(ps, '/')) != NULL) { 161525bdb5e4Smcbride if ((r = strdup(ps)) == NULL) 161625bdb5e4Smcbride err(1, "host: strdup"); 161794e9410bShenning mask = strtol(p+1, &q, 0); 1618fecc9cd0Shenning if (!q || *q || mask > 128 || q == (p+1)) { 16191cf63431Schl fprintf(stderr, "invalid netmask '%s'\n", p); 1620f565df7eSjsg free(r); 162120289793Szinovik free(ps); 162294e9410bShenning return (NULL); 162394e9410bShenning } 162436754172Smcbride p[0] = '\0'; 162594e9410bShenning v4mask = v6mask = mask; 162625bdb5e4Smcbride } else 162725bdb5e4Smcbride r = ps; 162894e9410bShenning 16292a6c1abaShenning /* interface with this name exists? */ 16304a36d485Shenning if (cont && (h = host_if(ps, mask)) != NULL) 16312a6c1abaShenning cont = 0; 16322a6c1abaShenning 16332a6c1abaShenning /* IPv4 address? */ 163425bdb5e4Smcbride if (cont && (h = host_v4(r, mask)) != NULL) 16352a6c1abaShenning cont = 0; 163625bdb5e4Smcbride if (r != ps) 163725bdb5e4Smcbride free(r); 16382a6c1abaShenning 16392a6c1abaShenning /* IPv6 address? */ 16402a6c1abaShenning if (cont && (h = host_v6(ps, v6mask)) != NULL) 16412a6c1abaShenning cont = 0; 16422a6c1abaShenning 16432a6c1abaShenning /* dns lookup */ 16442a6c1abaShenning if (cont && (h = host_dns(ps, v4mask, v6mask)) != NULL) 16452a6c1abaShenning cont = 0; 16462a6c1abaShenning 1647d20cfe34Smcbride if (if_name && if_name[0]) 1648d20cfe34Smcbride for (n = h; n != NULL; n = n->next) 1649d20cfe34Smcbride if ((n->ifname = strdup(if_name)) == NULL) 1650d20cfe34Smcbride err(1, "host: strdup"); 1651d20cfe34Smcbride 1652d20cfe34Smcbride free(ps); /* after we copy the name out */ 16532a6c1abaShenning if (h == NULL || cont == 1) { 16542a6c1abaShenning fprintf(stderr, "no IP address found for %s\n", s); 16552a6c1abaShenning return (NULL); 16562a6c1abaShenning } 1657cbdc262eSmcbride for (n = h; n != NULL; n = n->next) { 1658d20cfe34Smcbride n->addr.type = PF_ADDR_ADDRMASK; 1659cbdc262eSmcbride n->weight = 0; 1660cbdc262eSmcbride } 16612a6c1abaShenning return (h); 16622a6c1abaShenning } 16632a6c1abaShenning 16642a6c1abaShenning struct node_host * 1665f2370d27Shenning host_if(const char *s, int mask) 16662a6c1abaShenning { 16672a6c1abaShenning struct node_host *n, *h = NULL; 16684a36d485Shenning char *p, *ps; 1669ec359bd5Scedric int flags = 0; 16702a6c1abaShenning 1671ec359bd5Scedric if ((ps = strdup(s)) == NULL) 1672ec359bd5Scedric err(1, "host_if: strdup"); 1673ec359bd5Scedric while ((p = strrchr(ps, ':')) != NULL) { 16744a36d485Shenning if (!strcmp(p+1, "network")) 1675ec359bd5Scedric flags |= PFI_AFLAG_NETWORK; 1676ec359bd5Scedric else if (!strcmp(p+1, "broadcast")) 1677ec359bd5Scedric flags |= PFI_AFLAG_BROADCAST; 1678ec359bd5Scedric else if (!strcmp(p+1, "peer")) 1679ec359bd5Scedric flags |= PFI_AFLAG_PEER; 1680ec359bd5Scedric else if (!strcmp(p+1, "0")) 1681ec359bd5Scedric flags |= PFI_AFLAG_NOALIAS; 1682f8bc5305Shenning else { 1683f8bc5305Shenning free(ps); 1684ec359bd5Scedric return (NULL); 1685f8bc5305Shenning } 1686ec359bd5Scedric *p = '\0'; 1687ec359bd5Scedric } 1688ec359bd5Scedric if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */ 1689ec359bd5Scedric fprintf(stderr, "illegal combination of interface modifiers\n"); 1690f8bc5305Shenning free(ps); 1691ec359bd5Scedric return (NULL); 1692ec359bd5Scedric } 1693ec359bd5Scedric if ((flags & (PFI_AFLAG_NETWORK|PFI_AFLAG_BROADCAST)) && mask > -1) { 16944a36d485Shenning fprintf(stderr, "network or broadcast lookup, but " 16954a36d485Shenning "extra netmask given\n"); 1696f8bc5305Shenning free(ps); 16974a36d485Shenning return (NULL); 16984a36d485Shenning } 16996c3582faShenning if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ)) { 17002a6c1abaShenning /* interface with this name exists */ 1701ec359bd5Scedric h = ifa_lookup(ps, flags); 17022a6c1abaShenning for (n = h; n != NULL && mask > -1; n = n->next) 17032a6c1abaShenning set_ipmask(n, mask); 17042a6c1abaShenning } 17054a36d485Shenning 17064a36d485Shenning free(ps); 17072a6c1abaShenning return (h); 17082a6c1abaShenning } 17092a6c1abaShenning 17102a6c1abaShenning struct node_host * 1711383ebbbfShenning host_v4(const char *s, int mask) 17122a6c1abaShenning { 17132a6c1abaShenning struct node_host *h = NULL; 17142a6c1abaShenning struct in_addr ina; 171590fffbb7Shenning int bits = 32; 17162a6c1abaShenning 171794e9410bShenning memset(&ina, 0, sizeof(struct in_addr)); 171890fffbb7Shenning if (strrchr(s, '/') != NULL) { 171990fffbb7Shenning if ((bits = inet_net_pton(AF_INET, s, &ina, sizeof(ina))) == -1) 172090fffbb7Shenning return (NULL); 172190fffbb7Shenning } else { 172290fffbb7Shenning if (inet_pton(AF_INET, s, &ina) != 1) 172390fffbb7Shenning return (NULL); 172490fffbb7Shenning } 172590fffbb7Shenning 172694e9410bShenning h = calloc(1, sizeof(struct node_host)); 172794e9410bShenning if (h == NULL) 172894e9410bShenning err(1, "address: calloc"); 172994e9410bShenning h->ifname = NULL; 173094e9410bShenning h->af = AF_INET; 173194e9410bShenning h->addr.v.a.addr.addr32[0] = ina.s_addr; 173294e9410bShenning set_ipmask(h, bits); 173394e9410bShenning h->next = NULL; 173494e9410bShenning h->tail = h; 17352a6c1abaShenning 173694e9410bShenning return (h); 173794e9410bShenning } 17382a6c1abaShenning 17392a6c1abaShenning struct node_host * 1740f2370d27Shenning host_v6(const char *s, int mask) 17412a6c1abaShenning { 17422a6c1abaShenning struct addrinfo hints, *res; 17432a6c1abaShenning struct node_host *h = NULL; 174494e9410bShenning 174594e9410bShenning memset(&hints, 0, sizeof(hints)); 174694e9410bShenning hints.ai_family = AF_INET6; 174794e9410bShenning hints.ai_socktype = SOCK_DGRAM; /*dummy*/ 174894e9410bShenning hints.ai_flags = AI_NUMERICHOST; 17492a6c1abaShenning if (getaddrinfo(s, "0", &hints, &res) == 0) { 17502a6c1abaShenning h = calloc(1, sizeof(struct node_host)); 17512a6c1abaShenning if (h == NULL) 175294e9410bShenning err(1, "address: calloc"); 17532a6c1abaShenning h->ifname = NULL; 17542a6c1abaShenning h->af = AF_INET6; 17552a6c1abaShenning memcpy(&h->addr.v.a.addr, 175694e9410bShenning &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 17572a6c1abaShenning sizeof(h->addr.v.a.addr)); 17582a6c1abaShenning h->ifindex = 17592a6c1abaShenning ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; 17602a6c1abaShenning set_ipmask(h, mask); 176194e9410bShenning freeaddrinfo(res); 17622a6c1abaShenning h->next = NULL; 17632a6c1abaShenning h->tail = h; 176494e9410bShenning } 176594e9410bShenning 17662a6c1abaShenning return (h); 17672a6c1abaShenning } 17682a6c1abaShenning 17692a6c1abaShenning struct node_host * 1770f2370d27Shenning host_dns(const char *s, int v4mask, int v6mask) 17712a6c1abaShenning { 17722a6c1abaShenning struct addrinfo hints, *res0, *res; 17732a6c1abaShenning struct node_host *n, *h = NULL; 1774ec359bd5Scedric int error, noalias = 0; 1775ec359bd5Scedric int got4 = 0, got6 = 0; 1776ec359bd5Scedric char *p, *ps; 17772a6c1abaShenning 1778ec359bd5Scedric if ((ps = strdup(s)) == NULL) 177922dee42fShenning err(1, "host_dns: strdup"); 1780ec359bd5Scedric if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) { 1781ec359bd5Scedric noalias = 1; 1782ec359bd5Scedric *p = '\0'; 1783ec359bd5Scedric } 178494e9410bShenning memset(&hints, 0, sizeof(hints)); 178594e9410bShenning hints.ai_family = PF_UNSPEC; 178694e9410bShenning hints.ai_socktype = SOCK_STREAM; /* DUMMY */ 1787ec359bd5Scedric error = getaddrinfo(ps, NULL, &hints, &res0); 1788b4d8b6eeShenning if (error) { 1789b4d8b6eeShenning free(ps); 17902a6c1abaShenning return (h); 1791b4d8b6eeShenning } 17922a6c1abaShenning 179394e9410bShenning for (res = res0; res; res = res->ai_next) { 179494e9410bShenning if (res->ai_family != AF_INET && 179594e9410bShenning res->ai_family != AF_INET6) 179694e9410bShenning continue; 1797ec359bd5Scedric if (noalias) { 1798ec359bd5Scedric if (res->ai_family == AF_INET) { 1799ec359bd5Scedric if (got4) 1800ec359bd5Scedric continue; 1801ec359bd5Scedric got4 = 1; 1802ec359bd5Scedric } else { 1803ec359bd5Scedric if (got6) 1804ec359bd5Scedric continue; 1805ec359bd5Scedric got6 = 1; 1806ec359bd5Scedric } 1807ec359bd5Scedric } 180894e9410bShenning n = calloc(1, sizeof(struct node_host)); 180994e9410bShenning if (n == NULL) 18102a6c1abaShenning err(1, "host_dns: calloc"); 181194e9410bShenning n->ifname = NULL; 181294e9410bShenning n->af = res->ai_family; 181394e9410bShenning if (res->ai_family == AF_INET) { 181494e9410bShenning memcpy(&n->addr.v.a.addr, 18152a6c1abaShenning &((struct sockaddr_in *) 18162a6c1abaShenning res->ai_addr)->sin_addr.s_addr, 181794e9410bShenning sizeof(struct in_addr)); 181894e9410bShenning set_ipmask(n, v4mask); 181994e9410bShenning } else { 182094e9410bShenning memcpy(&n->addr.v.a.addr, 18212a6c1abaShenning &((struct sockaddr_in6 *) 18222a6c1abaShenning res->ai_addr)->sin6_addr.s6_addr, 182394e9410bShenning sizeof(struct in6_addr)); 182494e9410bShenning n->ifindex = 18252a6c1abaShenning ((struct sockaddr_in6 *) 18262a6c1abaShenning res->ai_addr)->sin6_scope_id; 182794e9410bShenning set_ipmask(n, v6mask); 182894e9410bShenning } 182994e9410bShenning n->next = NULL; 183094e9410bShenning n->tail = n; 183194e9410bShenning if (h == NULL) 183294e9410bShenning h = n; 183394e9410bShenning else { 183494e9410bShenning h->tail->next = n; 183594e9410bShenning h->tail = n; 183694e9410bShenning } 183794e9410bShenning } 183894e9410bShenning freeaddrinfo(res0); 1839ec359bd5Scedric free(ps); 184094e9410bShenning 184194e9410bShenning return (h); 184294e9410bShenning } 184342e05679Scedric 184442e05679Scedric /* 184542e05679Scedric * convert a hostname to a list of addresses and put them in the given buffer. 184642e05679Scedric * test: 184742e05679Scedric * if set to 1, only simple addresses are accepted (no netblock, no "!"). 184842e05679Scedric */ 184942e05679Scedric int 185042e05679Scedric append_addr(struct pfr_buffer *b, char *s, int test) 185142e05679Scedric { 1852cbdc262eSmcbride static int previous = 0; 1853cbdc262eSmcbride static int expect = 0; 1854cbdc262eSmcbride struct pfr_addr *a; 1855b88a8d5dScedric struct node_host *h, *n; 1856cbdc262eSmcbride char *r; 1857cbdc262eSmcbride const char *errstr; 1858cbdc262eSmcbride int rv, not = 0, i = 0; 1859cbdc262eSmcbride u_int16_t weight; 1860cbdc262eSmcbride 1861cbdc262eSmcbride /* skip weight if given */ 1862cbdc262eSmcbride if (strcmp(s, "weight") == 0) { 1863cbdc262eSmcbride expect = 1; 1864cbdc262eSmcbride return (1); /* expecting further call */ 1865cbdc262eSmcbride } 1866cbdc262eSmcbride 1867cbdc262eSmcbride /* check if previous host is set */ 1868cbdc262eSmcbride if (expect) { 1869cbdc262eSmcbride /* parse and append load balancing weight */ 1870cbdc262eSmcbride weight = strtonum(s, 1, USHRT_MAX, &errstr); 1871cbdc262eSmcbride if (errstr) { 1872cbdc262eSmcbride fprintf(stderr, "failed to convert weight %s\n", s); 1873cbdc262eSmcbride return (-1); 1874cbdc262eSmcbride } 1875cbdc262eSmcbride if (previous != -1) { 1876cbdc262eSmcbride PFRB_FOREACH(a, b) { 1877cbdc262eSmcbride if (++i >= previous) { 1878cbdc262eSmcbride a->pfra_weight = weight; 1879cbdc262eSmcbride a->pfra_type = PFRKE_COST; 1880cbdc262eSmcbride } 1881cbdc262eSmcbride } 1882cbdc262eSmcbride } 1883cbdc262eSmcbride 1884cbdc262eSmcbride expect = 0; 1885cbdc262eSmcbride return (0); 1886cbdc262eSmcbride } 18875b6c447dScedric 18885b6c447dScedric for (r = s; *r == '!'; r++) 18895b6c447dScedric not = !not; 18905b6c447dScedric if ((n = host(r)) == NULL) { 18915b6c447dScedric errno = 0; 18925b6c447dScedric return (-1); 18935b6c447dScedric } 1894b88a8d5dScedric rv = append_addr_host(b, n, test, not); 1895cbdc262eSmcbride previous = b->pfrb_size; 1896b88a8d5dScedric do { 1897b88a8d5dScedric h = n; 1898b88a8d5dScedric n = n->next; 1899b88a8d5dScedric free(h); 1900b88a8d5dScedric } while (n != NULL); 1901b88a8d5dScedric return (rv); 190242e05679Scedric } 190342e05679Scedric 190442e05679Scedric /* 19055b6c447dScedric * same as previous function, but with a pre-parsed input and the ability 1906b88a8d5dScedric * to "negate" the result. Does not free the node_host list. 190742e05679Scedric * not: 190842e05679Scedric * setting it to 1 is equivalent to adding "!" in front of parameter s. 190942e05679Scedric */ 191042e05679Scedric int 19115b6c447dScedric append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) 191242e05679Scedric { 191342e05679Scedric int bits; 191442e05679Scedric struct pfr_addr addr; 191542e05679Scedric 191642e05679Scedric do { 191742e05679Scedric bzero(&addr, sizeof(addr)); 19185b6c447dScedric addr.pfra_not = n->not ^ not; 191942e05679Scedric addr.pfra_af = n->af; 192042e05679Scedric addr.pfra_net = unmask(&n->addr.v.a.mask, n->af); 192136754172Smcbride if (n->ifname) { 192236754172Smcbride if (strlcpy(addr.pfra_ifname, n->ifname, 192336754172Smcbride sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) 192436754172Smcbride errx(1, "append_addr_host: strlcpy"); 192536754172Smcbride addr.pfra_type = PFRKE_ROUTE; 192636754172Smcbride } 1927cbdc262eSmcbride if (n->weight > 0) { 1928cbdc262eSmcbride addr.pfra_weight = n->weight; 1929cbdc262eSmcbride addr.pfra_type = PFRKE_COST; 1930cbdc262eSmcbride } 193142e05679Scedric switch (n->af) { 193242e05679Scedric case AF_INET: 193342e05679Scedric addr.pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32[0]; 193442e05679Scedric bits = 32; 193542e05679Scedric break; 193642e05679Scedric case AF_INET6: 193742e05679Scedric memcpy(&addr.pfra_ip6addr, &n->addr.v.a.addr.v6, 193842e05679Scedric sizeof(struct in6_addr)); 193942e05679Scedric bits = 128; 194042e05679Scedric break; 194142e05679Scedric default: 194242e05679Scedric errno = EINVAL; 194342e05679Scedric return (-1); 194442e05679Scedric } 194542e05679Scedric if ((test && (not || addr.pfra_net != bits)) || 194642e05679Scedric addr.pfra_net > bits) { 194742e05679Scedric errno = EINVAL; 194842e05679Scedric return (-1); 194942e05679Scedric } 195042e05679Scedric if (pfr_buf_add(b, &addr)) 195142e05679Scedric return (-1); 1952b88a8d5dScedric } while ((n = n->next) != NULL); 195342e05679Scedric 195442e05679Scedric return (0); 195542e05679Scedric } 195679cc0068Scedric 195779cc0068Scedric int 19589f66a89aShenning pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) 195979cc0068Scedric { 196079cc0068Scedric struct pfioc_trans_e trans; 196179cc0068Scedric 196279cc0068Scedric bzero(&trans, sizeof(trans)); 19639f66a89aShenning trans.type = type; 196479cc0068Scedric if (strlcpy(trans.anchor, anchor, 1965d9ad7941Sdhartmei sizeof(trans.anchor)) >= sizeof(trans.anchor)) 196679cc0068Scedric errx(1, "pfctl_add_trans: strlcpy"); 196779cc0068Scedric 196879cc0068Scedric return pfr_buf_add(buf, &trans); 196979cc0068Scedric } 197079cc0068Scedric 197179cc0068Scedric u_int32_t 19729f66a89aShenning pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) 197379cc0068Scedric { 197479cc0068Scedric struct pfioc_trans_e *p; 197579cc0068Scedric 197679cc0068Scedric PFRB_FOREACH(p, buf) 19779f66a89aShenning if (type == p->type && !strcmp(anchor, p->anchor)) 197879cc0068Scedric return (p->ticket); 197922dee42fShenning errx(1, "pfctl_get_ticket: assertion failed"); 198079cc0068Scedric } 198179cc0068Scedric 198279cc0068Scedric int 19833060c195Shenning pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) 198479cc0068Scedric { 198579cc0068Scedric struct pfioc_trans trans; 198679cc0068Scedric 198779cc0068Scedric bzero(&trans, sizeof(trans)); 198879cc0068Scedric trans.size = buf->pfrb_size - from; 198979cc0068Scedric trans.esize = sizeof(struct pfioc_trans_e); 199079cc0068Scedric trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; 199179cc0068Scedric return ioctl(dev, cmd, &trans); 199279cc0068Scedric } 1993