1*e77e5dc4Sjaredy /* $OpenBSD: pfctl_parser.c,v 1.205 2004/09/27 12:51:12 jaredy Exp $ */ 214a9b182Skjell 314a9b182Skjell /* 4fd3c3a0cSderaadt * Copyright (c) 2001 Daniel Hartmeier 5f2553c84Shenning * Copyright (c) 2002,2003 Henning Brauer 614a9b182Skjell * All rights reserved. 714a9b182Skjell * 814a9b182Skjell * Redistribution and use in source and binary forms, with or without 914a9b182Skjell * modification, are permitted provided that the following conditions 1014a9b182Skjell * are met: 1114a9b182Skjell * 1214a9b182Skjell * - Redistributions of source code must retain the above copyright 1314a9b182Skjell * notice, this list of conditions and the following disclaimer. 1414a9b182Skjell * - Redistributions in binary form must reproduce the above 1514a9b182Skjell * copyright notice, this list of conditions and the following 1614a9b182Skjell * disclaimer in the documentation and/or other materials provided 1714a9b182Skjell * with the distribution. 1814a9b182Skjell * 1914a9b182Skjell * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2014a9b182Skjell * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2114a9b182Skjell * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 2214a9b182Skjell * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 235974bd37Sdhartmei * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 2414a9b182Skjell * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 2514a9b182Skjell * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 2614a9b182Skjell * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 2714a9b182Skjell * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2814a9b182Skjell * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 2914a9b182Skjell * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 3014a9b182Skjell * POSSIBILITY OF SUCH DAMAGE. 3114a9b182Skjell * 3214a9b182Skjell */ 3314a9b182Skjell 34252d784aSderaadt #include <sys/types.h> 3579cc0068Scedric #include <sys/ioctl.h> 36252d784aSderaadt #include <sys/socket.h> 37252d784aSderaadt #include <net/if.h> 38252d784aSderaadt #include <netinet/in.h> 396329fa59Sderaadt #include <netinet/in_systm.h> 406329fa59Sderaadt #include <netinet/ip.h> 416329fa59Sderaadt #include <netinet/ip_icmp.h> 4230620b12Sfrantzen #include <netinet/icmp6.h> 43252d784aSderaadt #include <net/pfvar.h> 449f13c6caSmillert #include <arpa/inet.h> 45252d784aSderaadt 4614a9b182Skjell #include <stdio.h> 4714a9b182Skjell #include <stdlib.h> 4814a9b182Skjell #include <string.h> 4914a9b182Skjell #include <ctype.h> 5014a9b182Skjell #include <netdb.h> 516329fa59Sderaadt #include <stdarg.h> 526329fa59Sderaadt #include <errno.h> 53ff352a37Smarkus #include <err.h> 5494e9410bShenning #include <ifaddrs.h> 5514a9b182Skjell 5614a9b182Skjell #include "pfctl_parser.h" 57eb824e11Sderaadt #include "pfctl.h" 5814a9b182Skjell 595d9ac2dcSdhartmei void print_op (u_int8_t, const char *, const char *); 60132c30ccShenning void print_port (u_int8_t, u_int16_t, u_int16_t, const char *); 611173271aScedric void print_ugid (u_int8_t, unsigned, unsigned, const char *, unsigned); 6281a15e5dSderaadt void print_flags (u_int8_t); 6364b4b616Sfrantzen void print_fromto(struct pf_rule_addr *, pf_osfp_t, 6464b4b616Sfrantzen struct pf_rule_addr *, u_int8_t, u_int8_t, int); 657ad220f2Scedric int ifa_skip_if(const char *filter, struct node_host *p); 6614a9b182Skjell 67f2370d27Shenning struct node_host *host_if(const char *, int); 68383ebbbfShenning struct node_host *host_v4(const char *, int); 69f2370d27Shenning struct node_host *host_v6(const char *, int); 70f2370d27Shenning struct node_host *host_dns(const char *, int, int); 712a6c1abaShenning 72361e311cShenning const char *tcpflags = "FSRPAUEW"; 7314a9b182Skjell 747d27d81aSdhartmei static const struct icmptypeent icmp_type[] = { 75082ebc44Swilfried { "echoreq", ICMP_ECHO }, 76082ebc44Swilfried { "echorep", ICMP_ECHOREPLY }, 77082ebc44Swilfried { "unreach", ICMP_UNREACH }, 78082ebc44Swilfried { "squench", ICMP_SOURCEQUENCH }, 79082ebc44Swilfried { "redir", ICMP_REDIRECT }, 80082ebc44Swilfried { "althost", ICMP_ALTHOSTADDR }, 81082ebc44Swilfried { "routeradv", ICMP_ROUTERADVERT }, 82082ebc44Swilfried { "routersol", ICMP_ROUTERSOLICIT }, 83082ebc44Swilfried { "timex", ICMP_TIMXCEED }, 84082ebc44Swilfried { "paramprob", ICMP_PARAMPROB }, 85082ebc44Swilfried { "timereq", ICMP_TSTAMP }, 86082ebc44Swilfried { "timerep", ICMP_TSTAMPREPLY }, 87082ebc44Swilfried { "inforeq", ICMP_IREQ }, 88082ebc44Swilfried { "inforep", ICMP_IREQREPLY }, 89082ebc44Swilfried { "maskreq", ICMP_MASKREQ }, 9002cbcc9eSwilfried { "maskrep", ICMP_MASKREPLY }, 9102cbcc9eSwilfried { "trace", ICMP_TRACEROUTE }, 9202cbcc9eSwilfried { "dataconv", ICMP_DATACONVERR }, 9302cbcc9eSwilfried { "mobredir", ICMP_MOBILE_REDIRECT }, 9402cbcc9eSwilfried { "ipv6-where", ICMP_IPV6_WHEREAREYOU }, 9502cbcc9eSwilfried { "ipv6-here", ICMP_IPV6_IAMHERE }, 9602cbcc9eSwilfried { "mobregreq", ICMP_MOBILE_REGREQUEST }, 9702cbcc9eSwilfried { "mobregrep", ICMP_MOBILE_REGREPLY }, 9802cbcc9eSwilfried { "skip", ICMP_SKIP }, 9902cbcc9eSwilfried { "photuris", ICMP_PHOTURIS } 100082ebc44Swilfried }; 101082ebc44Swilfried 1027d27d81aSdhartmei static const struct icmptypeent icmp6_type[] = { 10330620b12Sfrantzen { "unreach", ICMP6_DST_UNREACH }, 10430620b12Sfrantzen { "toobig", ICMP6_PACKET_TOO_BIG }, 10530620b12Sfrantzen { "timex", ICMP6_TIME_EXCEEDED }, 10630620b12Sfrantzen { "paramprob", ICMP6_PARAM_PROB }, 10730620b12Sfrantzen { "echoreq", ICMP6_ECHO_REQUEST }, 10830620b12Sfrantzen { "echorep", ICMP6_ECHO_REPLY }, 10930620b12Sfrantzen { "groupqry", ICMP6_MEMBERSHIP_QUERY }, 11022a58e88Sitojun { "listqry", MLD_LISTENER_QUERY }, 11130620b12Sfrantzen { "grouprep", ICMP6_MEMBERSHIP_REPORT }, 11222a58e88Sitojun { "listenrep", MLD_LISTENER_REPORT }, 11330620b12Sfrantzen { "groupterm", ICMP6_MEMBERSHIP_REDUCTION }, 11422a58e88Sitojun { "listendone", MLD_LISTENER_DONE }, 11530620b12Sfrantzen { "routersol", ND_ROUTER_SOLICIT }, 11630620b12Sfrantzen { "routeradv", ND_ROUTER_ADVERT }, 11730620b12Sfrantzen { "neighbrsol", ND_NEIGHBOR_SOLICIT }, 11830620b12Sfrantzen { "neighbradv", ND_NEIGHBOR_ADVERT }, 11930620b12Sfrantzen { "redir", ND_REDIRECT }, 12030620b12Sfrantzen { "routrrenum", ICMP6_ROUTER_RENUMBERING }, 12130620b12Sfrantzen { "wrureq", ICMP6_WRUREQUEST }, 12230620b12Sfrantzen { "wrurep", ICMP6_WRUREPLY }, 12330620b12Sfrantzen { "fqdnreq", ICMP6_FQDN_QUERY }, 12430620b12Sfrantzen { "fqdnrep", ICMP6_FQDN_REPLY }, 12530620b12Sfrantzen { "niqry", ICMP6_NI_QUERY }, 12630620b12Sfrantzen { "nirep", ICMP6_NI_REPLY }, 12722a58e88Sitojun { "mtraceresp", MLD_MTRACE_RESP }, 12822a58e88Sitojun { "mtrace", MLD_MTRACE } 12930620b12Sfrantzen }; 13030620b12Sfrantzen 1317d27d81aSdhartmei static const struct icmpcodeent icmp_code[] = { 132082ebc44Swilfried { "net-unr", ICMP_UNREACH, ICMP_UNREACH_NET }, 133082ebc44Swilfried { "host-unr", ICMP_UNREACH, ICMP_UNREACH_HOST }, 134082ebc44Swilfried { "proto-unr", ICMP_UNREACH, ICMP_UNREACH_PROTOCOL }, 135082ebc44Swilfried { "port-unr", ICMP_UNREACH, ICMP_UNREACH_PORT }, 136082ebc44Swilfried { "needfrag", ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG }, 137082ebc44Swilfried { "srcfail", ICMP_UNREACH, ICMP_UNREACH_SRCFAIL }, 138082ebc44Swilfried { "net-unk", ICMP_UNREACH, ICMP_UNREACH_NET_UNKNOWN }, 139082ebc44Swilfried { "host-unk", ICMP_UNREACH, ICMP_UNREACH_HOST_UNKNOWN }, 140082ebc44Swilfried { "isolate", ICMP_UNREACH, ICMP_UNREACH_ISOLATED }, 141082ebc44Swilfried { "net-prohib", ICMP_UNREACH, ICMP_UNREACH_NET_PROHIB }, 142082ebc44Swilfried { "host-prohib", ICMP_UNREACH, ICMP_UNREACH_HOST_PROHIB }, 143082ebc44Swilfried { "net-tos", ICMP_UNREACH, ICMP_UNREACH_TOSNET }, 144082ebc44Swilfried { "host-tos", ICMP_UNREACH, ICMP_UNREACH_TOSHOST }, 145082ebc44Swilfried { "filter-prohib", ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB }, 146082ebc44Swilfried { "host-preced", ICMP_UNREACH, ICMP_UNREACH_HOST_PRECEDENCE }, 147082ebc44Swilfried { "cutoff-preced", ICMP_UNREACH, ICMP_UNREACH_PRECEDENCE_CUTOFF }, 148082ebc44Swilfried { "redir-net", ICMP_REDIRECT, ICMP_REDIRECT_NET }, 149082ebc44Swilfried { "redir-host", ICMP_REDIRECT, ICMP_REDIRECT_HOST }, 150082ebc44Swilfried { "redir-tos-net", ICMP_REDIRECT, ICMP_REDIRECT_TOSNET }, 151082ebc44Swilfried { "redir-tos-host", ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST }, 15202cbcc9eSwilfried { "normal-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NORMAL }, 15302cbcc9eSwilfried { "common-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NOROUTE_COMMON }, 154082ebc44Swilfried { "transit", ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS }, 155082ebc44Swilfried { "reassemb", ICMP_TIMXCEED, ICMP_TIMXCEED_REASS }, 156082ebc44Swilfried { "badhead", ICMP_PARAMPROB, ICMP_PARAMPROB_ERRATPTR }, 157082ebc44Swilfried { "optmiss", ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT }, 15802cbcc9eSwilfried { "badlen", ICMP_PARAMPROB, ICMP_PARAMPROB_LENGTH }, 15902cbcc9eSwilfried { "unknown-ind", ICMP_PHOTURIS, ICMP_PHOTURIS_UNKNOWN_INDEX }, 16002cbcc9eSwilfried { "auth-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_AUTH_FAILED }, 16102cbcc9eSwilfried { "decrypt-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_DECRYPT_FAILED } 162082ebc44Swilfried }; 163082ebc44Swilfried 1647d27d81aSdhartmei static const struct icmpcodeent icmp6_code[] = { 1651d32ee3bSdhartmei { "admin-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN }, 1661d32ee3bSdhartmei { "noroute-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE }, 16730620b12Sfrantzen { "notnbr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOTNEIGHBOR }, 16830620b12Sfrantzen { "beyond-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_BEYONDSCOPE }, 16930620b12Sfrantzen { "addr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR }, 17030620b12Sfrantzen { "port-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT }, 17130620b12Sfrantzen { "transit", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT }, 17230620b12Sfrantzen { "reassemb", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY }, 17330620b12Sfrantzen { "badhead", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER }, 17430620b12Sfrantzen { "nxthdr", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER }, 17530620b12Sfrantzen { "redironlink", ND_REDIRECT, ND_REDIRECT_ONLINK }, 17630620b12Sfrantzen { "redirrouter", ND_REDIRECT, ND_REDIRECT_ROUTER } 17730620b12Sfrantzen }; 17830620b12Sfrantzen 179d593fb91Sdrahn const struct pf_timeout pf_timeouts[] = { 180d593fb91Sdrahn { "tcp.first", PFTM_TCP_FIRST_PACKET }, 181d593fb91Sdrahn { "tcp.opening", PFTM_TCP_OPENING }, 182d593fb91Sdrahn { "tcp.established", PFTM_TCP_ESTABLISHED }, 183d593fb91Sdrahn { "tcp.closing", PFTM_TCP_CLOSING }, 184d593fb91Sdrahn { "tcp.finwait", PFTM_TCP_FIN_WAIT }, 185d593fb91Sdrahn { "tcp.closed", PFTM_TCP_CLOSED }, 18698d12bd8Sfrantzen { "tcp.tsdiff", PFTM_TS_DIFF }, 187d593fb91Sdrahn { "udp.first", PFTM_UDP_FIRST_PACKET }, 188d593fb91Sdrahn { "udp.single", PFTM_UDP_SINGLE }, 189d593fb91Sdrahn { "udp.multiple", PFTM_UDP_MULTIPLE }, 190d593fb91Sdrahn { "icmp.first", PFTM_ICMP_FIRST_PACKET }, 191d593fb91Sdrahn { "icmp.error", PFTM_ICMP_ERROR_REPLY }, 192d593fb91Sdrahn { "other.first", PFTM_OTHER_FIRST_PACKET }, 193d593fb91Sdrahn { "other.single", PFTM_OTHER_SINGLE }, 194d593fb91Sdrahn { "other.multiple", PFTM_OTHER_MULTIPLE }, 195d593fb91Sdrahn { "frag", PFTM_FRAG }, 196d593fb91Sdrahn { "interval", PFTM_INTERVAL }, 197a85e74a5Sdhartmei { "adaptive.start", PFTM_ADAPTIVE_START }, 198a85e74a5Sdhartmei { "adaptive.end", PFTM_ADAPTIVE_END }, 199fd777407Smcbride { "src.track", PFTM_SRC_NODE }, 200d593fb91Sdrahn { NULL, 0 } 201d593fb91Sdrahn }; 202d593fb91Sdrahn 2037d27d81aSdhartmei const struct icmptypeent * 204bb9f691eSmcbride geticmptypebynumber(u_int8_t type, sa_family_t af) 205082ebc44Swilfried { 206ed99c291Sderaadt unsigned int i; 207082ebc44Swilfried 208d14c53d7Swilfried if (af != AF_INET6) { 209e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 210e4ebe044Shenning i++) { 211082ebc44Swilfried if (type == icmp_type[i].type) 212082ebc44Swilfried return (&icmp_type[i]); 213082ebc44Swilfried } 21430620b12Sfrantzen } else { 21530620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 21630620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 21730620b12Sfrantzen if (type == icmp6_type[i].type) 21830620b12Sfrantzen return (&icmp6_type[i]); 21930620b12Sfrantzen } 22030620b12Sfrantzen } 22130620b12Sfrantzen return (NULL); 222082ebc44Swilfried } 223082ebc44Swilfried 2247d27d81aSdhartmei const struct icmptypeent * 225bb9f691eSmcbride geticmptypebyname(char *w, sa_family_t af) 226082ebc44Swilfried { 227ed99c291Sderaadt unsigned int i; 228082ebc44Swilfried 229d14c53d7Swilfried if (af != AF_INET6) { 230e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 231e4ebe044Shenning i++) { 232082ebc44Swilfried if (!strcmp(w, icmp_type[i].name)) 233082ebc44Swilfried return (&icmp_type[i]); 234082ebc44Swilfried } 23530620b12Sfrantzen } else { 23630620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 23730620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 23830620b12Sfrantzen if (!strcmp(w, icmp6_type[i].name)) 23930620b12Sfrantzen return (&icmp6_type[i]); 24030620b12Sfrantzen } 24130620b12Sfrantzen } 24230620b12Sfrantzen return (NULL); 243082ebc44Swilfried } 244082ebc44Swilfried 2457d27d81aSdhartmei const struct icmpcodeent * 246bb9f691eSmcbride geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) 247082ebc44Swilfried { 248ed99c291Sderaadt unsigned int i; 249082ebc44Swilfried 250d14c53d7Swilfried if (af != AF_INET6) { 251e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 252e4ebe044Shenning i++) { 25330620b12Sfrantzen if (type == icmp_code[i].type && 25430620b12Sfrantzen code == icmp_code[i].code) 255082ebc44Swilfried return (&icmp_code[i]); 256082ebc44Swilfried } 25730620b12Sfrantzen } else { 25830620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 25930620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 26030620b12Sfrantzen if (type == icmp6_code[i].type && 26130620b12Sfrantzen code == icmp6_code[i].code) 26230620b12Sfrantzen return (&icmp6_code[i]); 26330620b12Sfrantzen } 26430620b12Sfrantzen } 26530620b12Sfrantzen return (NULL); 266082ebc44Swilfried } 267082ebc44Swilfried 2687d27d81aSdhartmei const struct icmpcodeent * 269bb9f691eSmcbride geticmpcodebyname(u_long type, char *w, sa_family_t af) 270082ebc44Swilfried { 271ed99c291Sderaadt unsigned int i; 272082ebc44Swilfried 273d14c53d7Swilfried if (af != AF_INET6) { 274e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 275e4ebe044Shenning i++) { 27630620b12Sfrantzen if (type == icmp_code[i].type && 27730620b12Sfrantzen !strcmp(w, icmp_code[i].name)) 278082ebc44Swilfried return (&icmp_code[i]); 279082ebc44Swilfried } 28030620b12Sfrantzen } else { 28130620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 28230620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 28330620b12Sfrantzen if (type == icmp6_code[i].type && 28430620b12Sfrantzen !strcmp(w, icmp6_code[i].name)) 28530620b12Sfrantzen return (&icmp6_code[i]); 28630620b12Sfrantzen } 28730620b12Sfrantzen } 28830620b12Sfrantzen return (NULL); 28930620b12Sfrantzen } 29030620b12Sfrantzen 29181a15e5dSderaadt void 2925d9ac2dcSdhartmei print_op(u_int8_t op, const char *a1, const char *a2) 2935d9ac2dcSdhartmei { 2945d9ac2dcSdhartmei if (op == PF_OP_IRG) 2955d9ac2dcSdhartmei printf(" %s >< %s", a1, a2); 2965d9ac2dcSdhartmei else if (op == PF_OP_XRG) 2975d9ac2dcSdhartmei printf(" %s <> %s", a1, a2); 2981308506cShenning else if (op == PF_OP_EQ) 2995d9ac2dcSdhartmei printf(" = %s", a1); 3001308506cShenning else if (op == PF_OP_NE) 3015d9ac2dcSdhartmei printf(" != %s", a1); 3021308506cShenning else if (op == PF_OP_LT) 3035d9ac2dcSdhartmei printf(" < %s", a1); 3045d9ac2dcSdhartmei else if (op == PF_OP_LE) 3055d9ac2dcSdhartmei printf(" <= %s", a1); 3065d9ac2dcSdhartmei else if (op == PF_OP_GT) 3075d9ac2dcSdhartmei printf(" > %s", a1); 3085d9ac2dcSdhartmei else if (op == PF_OP_GE) 3095d9ac2dcSdhartmei printf(" >= %s", a1); 3108da4e377Smcbride else if (op == PF_OP_RRG) 3118da4e377Smcbride printf(" %s:%s", a1, a2); 3125d9ac2dcSdhartmei } 3135d9ac2dcSdhartmei 3145d9ac2dcSdhartmei void 315132c30ccShenning print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto) 31614a9b182Skjell { 317e31d21c9Sdhartmei char a1[6], a2[6]; 318e4ebe044Shenning struct servent *s; 31981a15e5dSderaadt 320e4ebe044Shenning s = getservbyport(p1, proto); 32114a9b182Skjell p1 = ntohs(p1); 32214a9b182Skjell p2 = ntohs(p2); 3235d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", p1); 3245d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", p2); 32514a9b182Skjell printf(" port"); 3265d9ac2dcSdhartmei if (s != NULL && (op == PF_OP_EQ || op == PF_OP_NE)) 3275d9ac2dcSdhartmei print_op(op, s->s_name, a2); 32814a9b182Skjell else 3295d9ac2dcSdhartmei print_op(op, a1, a2); 3305d9ac2dcSdhartmei } 3315d9ac2dcSdhartmei 3325d9ac2dcSdhartmei void 3331173271aScedric print_ugid(u_int8_t op, unsigned u1, unsigned u2, const char *t, unsigned umax) 3345d9ac2dcSdhartmei { 335d8fcd2dfSdhartmei char a1[11], a2[11]; 3365d9ac2dcSdhartmei 3375d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", u1); 3385d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", u2); 3395d9ac2dcSdhartmei printf(" %s", t); 3401173271aScedric if (u1 == umax && (op == PF_OP_EQ || op == PF_OP_NE)) 341c16ab608Sdhartmei print_op(op, "unknown", a2); 342c16ab608Sdhartmei else 343c16ab608Sdhartmei print_op(op, a1, a2); 344c16ab608Sdhartmei } 345c16ab608Sdhartmei 346c16ab608Sdhartmei void 34714a9b182Skjell print_flags(u_int8_t f) 34814a9b182Skjell { 34914a9b182Skjell int i; 35081a15e5dSderaadt 351bc795af0Shugh for (i = 0; tcpflags[i]; ++i) 35214a9b182Skjell if (f & (1 << i)) 35314a9b182Skjell printf("%c", tcpflags[i]); 35414a9b182Skjell } 35514a9b182Skjell 35614a9b182Skjell void 35764b4b616Sfrantzen print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, 35844f5ed0aScedric sa_family_t af, u_int8_t proto, int verbose) 35915e76891Sdhartmei { 36064b4b616Sfrantzen char buf[PF_OSFP_LEN*3]; 3611173271aScedric if (src->addr.type == PF_ADDR_ADDRMASK && 3621173271aScedric dst->addr.type == PF_ADDR_ADDRMASK && 363bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.addr, AF_INET6) && 364bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.mask, AF_INET6) && 3651173271aScedric PF_AZERO(&dst->addr.v.a.addr, AF_INET6) && 3661173271aScedric PF_AZERO(&dst->addr.v.a.mask, AF_INET6) && 367d4008a34Sdhartmei !src->neg && !dst->neg && 36864b4b616Sfrantzen !src->port_op && !dst->port_op && 36964b4b616Sfrantzen osfp == PF_OSFP_ANY) 37015e76891Sdhartmei printf(" all"); 37115e76891Sdhartmei else { 37215e76891Sdhartmei printf(" from "); 373d4008a34Sdhartmei if (src->neg) 37415e76891Sdhartmei printf("! "); 37544f5ed0aScedric print_addr(&src->addr, af, verbose); 37615e76891Sdhartmei if (src->port_op) 37715e76891Sdhartmei print_port(src->port_op, src->port[0], 37815e76891Sdhartmei src->port[1], 37915e76891Sdhartmei proto == IPPROTO_TCP ? "tcp" : "udp"); 38064b4b616Sfrantzen if (osfp != PF_OSFP_ANY) 38164b4b616Sfrantzen printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, 38264b4b616Sfrantzen sizeof(buf))); 38315e76891Sdhartmei 38415e76891Sdhartmei printf(" to "); 385d4008a34Sdhartmei if (dst->neg) 38615e76891Sdhartmei printf("! "); 38744f5ed0aScedric print_addr(&dst->addr, af, verbose); 38815e76891Sdhartmei if (dst->port_op) 38915e76891Sdhartmei print_port(dst->port_op, dst->port[0], 39015e76891Sdhartmei dst->port[1], 39115e76891Sdhartmei proto == IPPROTO_TCP ? "tcp" : "udp"); 39215e76891Sdhartmei } 39315e76891Sdhartmei } 39415e76891Sdhartmei 39515e76891Sdhartmei void 396e0c302d0Smcbride print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, 397e0c302d0Smcbride sa_family_t af, int id) 3983a44df3cSmcbride { 3993a44df3cSmcbride struct pf_pooladdr *pooladdr; 4003a44df3cSmcbride 4016c917913Smcbride if ((TAILQ_FIRST(&pool->list) != NULL) && 4026c917913Smcbride TAILQ_NEXT(TAILQ_FIRST(&pool->list), entries) != NULL) 4033a44df3cSmcbride printf("{ "); 4043a44df3cSmcbride TAILQ_FOREACH(pooladdr, &pool->list, entries){ 4053a44df3cSmcbride switch (id) { 406e8793aa9Smcbride case PF_NAT: 407e8793aa9Smcbride case PF_RDR: 408e8793aa9Smcbride case PF_BINAT: 40920b4324fScedric print_addr(&pooladdr->addr, af, 0); 4103a44df3cSmcbride break; 411e8793aa9Smcbride case PF_PASS: 41220b4324fScedric if (PF_AZERO(&pooladdr->addr.v.a.addr, af)) 4133b9b234fSmcbride printf("%s", pooladdr->ifname); 414790504a6Sdhartmei else { 4153a44df3cSmcbride printf("(%s ", pooladdr->ifname); 41620b4324fScedric print_addr(&pooladdr->addr, af, 0); 4173a44df3cSmcbride printf(")"); 4183b9b234fSmcbride } 4193a44df3cSmcbride break; 420e8793aa9Smcbride default: 421e8793aa9Smcbride break; 4223a44df3cSmcbride } 4233a44df3cSmcbride if (TAILQ_NEXT(pooladdr, entries) != NULL) 4243a44df3cSmcbride printf(", "); 4253a44df3cSmcbride else if (TAILQ_NEXT(TAILQ_FIRST(&pool->list), entries) != NULL) 4263a44df3cSmcbride printf(" }"); 4273a44df3cSmcbride } 428e0c302d0Smcbride switch (id) { 429e8793aa9Smcbride case PF_NAT: 4309782f7a2Smcbride if ((p1 != PF_NAT_PROXY_PORT_LOW || 4319782f7a2Smcbride p2 != PF_NAT_PROXY_PORT_HIGH) && (p1 != 0 || p2 != 0)) { 432e0c302d0Smcbride if (p1 == p2) 433e0c302d0Smcbride printf(" port %u", p1); 434e0c302d0Smcbride else 435e0c302d0Smcbride printf(" port %u:%u", p1, p2); 436e0c302d0Smcbride } 437e0c302d0Smcbride break; 438e8793aa9Smcbride case PF_RDR: 439e0c302d0Smcbride if (p1) { 4408da4e377Smcbride printf(" port %u", p1); 4418da4e377Smcbride if (p2 && (p2 != p1)) 4428da4e377Smcbride printf(":%u", p2); 443e0c302d0Smcbride } 444e0c302d0Smcbride break; 445e0c302d0Smcbride default: 446e0c302d0Smcbride break; 447e0c302d0Smcbride } 448e0c302d0Smcbride switch (pool->opts & PF_POOL_TYPEMASK) { 449e0c302d0Smcbride case PF_POOL_NONE: 450e0c302d0Smcbride break; 451e0c302d0Smcbride case PF_POOL_BITMASK: 452e0c302d0Smcbride printf(" bitmask"); 453e0c302d0Smcbride break; 454e0c302d0Smcbride case PF_POOL_RANDOM: 455e0c302d0Smcbride printf(" random"); 456e0c302d0Smcbride break; 457e0c302d0Smcbride case PF_POOL_SRCHASH: 4580436fa02Smcbride printf(" source-hash 0x%08x%08x%08x%08x", 459e0c302d0Smcbride pool->key.key32[0], pool->key.key32[1], 460e0c302d0Smcbride pool->key.key32[2], pool->key.key32[3]); 461e0c302d0Smcbride break; 462e0c302d0Smcbride case PF_POOL_ROUNDROBIN: 463e0c302d0Smcbride printf(" round-robin"); 464e0c302d0Smcbride break; 465e0c302d0Smcbride } 466fd777407Smcbride if (pool->opts & PF_POOL_STICKYADDR) 467fd777407Smcbride printf(" sticky-address"); 4689782f7a2Smcbride if (id == PF_NAT && p1 == 0 && p2 == 0) 469e0c302d0Smcbride printf(" static-port"); 4703a44df3cSmcbride } 4713a44df3cSmcbride 472132c30ccShenning const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 473132c30ccShenning const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; 474fd777407Smcbride const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES; 47599a73934Sderaadt 47614a9b182Skjell void 477fd777407Smcbride print_status(struct pf_status *s, int opts) 47814a9b182Skjell { 4795191b30fScedric char statline[80], *running; 480c474e331Shenning time_t runtime; 48199a73934Sderaadt int i; 48299a73934Sderaadt 483c474e331Shenning runtime = time(NULL) - s->since; 4845191b30fScedric running = s->running ? "Enabled" : "Disabled"; 485c474e331Shenning 4865191b30fScedric if (s->since) { 487d85e4ad6Sdhartmei unsigned sec, min, hrs, day = runtime; 488d85e4ad6Sdhartmei 489d85e4ad6Sdhartmei sec = day % 60; 490d85e4ad6Sdhartmei day /= 60; 491d85e4ad6Sdhartmei min = day % 60; 492d85e4ad6Sdhartmei day /= 60; 493d85e4ad6Sdhartmei hrs = day % 24; 494d85e4ad6Sdhartmei day /= 24; 495c474e331Shenning snprintf(statline, sizeof(statline), 4965191b30fScedric "Status: %s for %u days %.2u:%.2u:%.2u", 4975191b30fScedric running, day, hrs, min, sec); 498d85e4ad6Sdhartmei } else 4995191b30fScedric snprintf(statline, sizeof(statline), "Status: %s", running); 500c97b4ee1Shenning printf("%-44s", statline); 501ae58c8acSdhartmei switch (s->debug) { 502a1d6f6e2Shenning case PF_DEBUG_NONE: 503c97b4ee1Shenning printf("%15s\n\n", "Debug: None"); 504ae58c8acSdhartmei break; 505a1d6f6e2Shenning case PF_DEBUG_URGENT: 506c97b4ee1Shenning printf("%15s\n\n", "Debug: Urgent"); 507ae58c8acSdhartmei break; 508a1d6f6e2Shenning case PF_DEBUG_MISC: 509c97b4ee1Shenning printf("%15s\n\n", "Debug: Misc"); 510ae58c8acSdhartmei break; 511a1d6f6e2Shenning case PF_DEBUG_NOISY: 512a1d6f6e2Shenning printf("%15s\n\n", "Debug: Loud"); 513a1d6f6e2Shenning break; 514ae58c8acSdhartmei } 5150c9bb4a7Sdhartmei printf("Hostid: 0x%08x\n\n", ntohl(s->hostid)); 516c474e331Shenning if (s->ifname[0] != 0) { 517c474e331Shenning printf("Interface Stats for %-16s %5s %16s\n", 518c474e331Shenning s->ifname, "IPv4", "IPv6"); 519c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes In", 520ef22e615Sdhartmei (unsigned long long)s->bcounters[0][0], 521ef22e615Sdhartmei (unsigned long long)s->bcounters[1][0]); 522c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes Out", 523ef22e615Sdhartmei (unsigned long long)s->bcounters[0][1], 524ef22e615Sdhartmei (unsigned long long)s->bcounters[1][1]); 525c474e331Shenning printf(" Packets In\n"); 526c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 527ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_PASS], 528ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_PASS]); 529c474e331Shenning printf(" %-23s %14llu %16llu\n", "Blocked", 530ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_DROP], 531ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_DROP]); 532c474e331Shenning printf(" Packets Out\n"); 533c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 534ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_PASS], 535ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_PASS]); 536c474e331Shenning printf(" %-23s %14llu %16llu\n\n", "Blocked", 537ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_DROP], 538ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_DROP]); 539c474e331Shenning } 540c474e331Shenning printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); 541c474e331Shenning printf(" %-25s %14u %14s\n", "current entries", s->states, ""); 542c474e331Shenning for (i = 0; i < FCNT_MAX; i++) { 543ea4ec064Sitojun printf(" %-25s %14llu ", pf_fcounters[i], 544ea4ec064Sitojun (unsigned long long)s->fcounters[i]); 545c474e331Shenning if (runtime > 0) 546c474e331Shenning printf("%14.1f/s\n", 547c474e331Shenning (double)s->fcounters[i] / (double)runtime); 548c474e331Shenning else 549c474e331Shenning printf("%14s\n", ""); 550c474e331Shenning } 551fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 552fd777407Smcbride printf("Source Tracking Table\n"); 553fd777407Smcbride printf(" %-25s %14u %14s\n", "current entries", 554fd777407Smcbride s->src_nodes, ""); 555fd777407Smcbride for (i = 0; i < SCNT_MAX; i++) { 556fd777407Smcbride printf(" %-25s %14lld ", pf_scounters[i], 557fd777407Smcbride s->scounters[i]); 558fd777407Smcbride if (runtime > 0) 559fd777407Smcbride printf("%14.1f/s\n", 560fd777407Smcbride (double)s->scounters[i] / (double)runtime); 561fd777407Smcbride else 562fd777407Smcbride printf("%14s\n", ""); 563fd777407Smcbride } 564fd777407Smcbride } 56599a73934Sderaadt printf("Counters\n"); 566c474e331Shenning for (i = 0; i < PFRES_MAX; i++) { 567ea4ec064Sitojun printf(" %-25s %14llu ", pf_reasons[i], 568ea4ec064Sitojun (unsigned long long)s->counters[i]); 569c474e331Shenning if (runtime > 0) 570c474e331Shenning printf("%14.1f/s\n", 571c474e331Shenning (double)s->counters[i] / (double)runtime); 572c474e331Shenning else 573c474e331Shenning printf("%14s\n", ""); 574c474e331Shenning } 57514a9b182Skjell } 57614a9b182Skjell 57714a9b182Skjell void 578fd777407Smcbride print_src_node(struct pf_src_node *sn, int opts) 579fd777407Smcbride { 580fd777407Smcbride struct pf_addr_wrap aw; 581fd777407Smcbride int min, sec; 582fd777407Smcbride 583fd777407Smcbride memset(&aw, 0, sizeof(aw)); 584fd777407Smcbride if (sn->af == AF_INET) 585fd777407Smcbride aw.v.a.mask.addr32[0] = 0xffffffff; 586fd777407Smcbride else 587fd777407Smcbride memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); 588fd777407Smcbride 589fd777407Smcbride aw.v.a.addr = sn->addr; 590fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 591fd777407Smcbride printf(" -> "); 592fd777407Smcbride aw.v.a.addr = sn->raddr; 593fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 594fd777407Smcbride printf(" (%d states)\n", sn->states); 595fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 596fd777407Smcbride sec = sn->creation % 60; 597fd777407Smcbride sn->creation /= 60; 598fd777407Smcbride min = sn->creation % 60; 599fd777407Smcbride sn->creation /= 60; 600fd777407Smcbride printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); 601fd777407Smcbride if (sn->states == 0) { 602fd777407Smcbride sec = sn->expire % 60; 603fd777407Smcbride sn->expire /= 60; 604fd777407Smcbride min = sn->expire % 60; 605fd777407Smcbride sn->expire /= 60; 606fd777407Smcbride printf(", expires in %.2u:%.2u:%.2u", 607fd777407Smcbride sn->expire, min, sec); 608fd777407Smcbride } 609fd777407Smcbride printf(", %u pkts, %u bytes", sn->packets, sn->bytes); 610fd777407Smcbride switch (sn->ruletype) { 611fd777407Smcbride case PF_NAT: 612fd777407Smcbride if (sn->rule.nr != -1) 613fd777407Smcbride printf(", nat rule %u", sn->rule.nr); 614fd777407Smcbride break; 615fd777407Smcbride case PF_RDR: 616fd777407Smcbride if (sn->rule.nr != -1) 617fd777407Smcbride printf(", rdr rule %u", sn->rule.nr); 618fd777407Smcbride break; 619fd777407Smcbride case PF_PASS: 620fd777407Smcbride if (sn->rule.nr != -1) 621fd777407Smcbride printf(", filter rule %u", sn->rule.nr); 622fd777407Smcbride break; 623fd777407Smcbride } 624fd777407Smcbride printf("\n"); 625fd777407Smcbride } 626fd777407Smcbride } 627fd777407Smcbride 628fd777407Smcbride void 629d9ad7941Sdhartmei print_rule(struct pf_rule *r, const char *anchor_call, int verbose) 63014a9b182Skjell { 6310e8bc214Saaron static const char *actiontypes[] = { "pass", "block", "scrub", 6320e8bc214Saaron "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr" }; 6331173271aScedric static const char *anchortypes[] = { "anchor", "anchor", "anchor", 6340e8bc214Saaron "anchor", "nat-anchor", "nat-anchor", "binat-anchor", 6350e8bc214Saaron "binat-anchor", "rdr-anchor", "rdr-anchor" }; 636cc5f0329Sdhartmei int i, opts; 637cc5f0329Sdhartmei 63874dc4fddShenning if (verbose) 63978baf774Sdhartmei printf("@%d ", r->nr); 6401173271aScedric if (r->action > PF_NORDR) 6411173271aScedric printf("action(%d)", r->action); 642d9ad7941Sdhartmei else if (anchor_call[0]) 643*e77e5dc4Sjaredy printf("%s \"%s\"", anchortypes[r->action], 644*e77e5dc4Sjaredy anchor_call); 645fde34e86Shenning else { 6461173271aScedric printf("%s", actiontypes[r->action]); 647fde34e86Shenning if (r->natpass) 648fde34e86Shenning printf(" pass"); 649fde34e86Shenning } 6501173271aScedric if (r->action == PF_DROP) { 6518a87542aShenning if (r->rule_flag & PFRULE_RETURN) 6528a87542aShenning printf(" return"); 6538a87542aShenning else if (r->rule_flag & PFRULE_RETURNRST) { 6541f77cc8aSpb if (!r->return_ttl) 65514a9b182Skjell printf(" return-rst"); 6561f77cc8aSpb else 6571f77cc8aSpb printf(" return-rst(ttl %d)", r->return_ttl); 658328b2decShenning } else if (r->rule_flag & PFRULE_RETURNICMP) { 659328b2decShenning const struct icmpcodeent *ic, *ic6; 660b996d042Sdhartmei 661b996d042Sdhartmei ic = geticmpcodebynumber(r->return_icmp >> 8, 662328b2decShenning r->return_icmp & 255, AF_INET); 663328b2decShenning ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, 664328b2decShenning r->return_icmp6 & 255, AF_INET6); 665d14c53d7Swilfried 666328b2decShenning switch (r->af) { 667328b2decShenning case AF_INET: 668328b2decShenning printf(" return-icmp"); 669d14c53d7Swilfried if (ic == NULL) 670d14c53d7Swilfried printf("(%u)", r->return_icmp & 255); 671b996d042Sdhartmei else 672328b2decShenning printf("(%s)", ic->name); 673328b2decShenning break; 674328b2decShenning case AF_INET6: 675328b2decShenning printf(" return-icmp6"); 676328b2decShenning if (ic6 == NULL) 677328b2decShenning printf("(%u)", r->return_icmp6 & 255); 678328b2decShenning else 679328b2decShenning printf("(%s)", ic6->name); 680328b2decShenning break; 681328b2decShenning default: 682328b2decShenning printf(" return-icmp"); 683328b2decShenning if (ic == NULL) 684328b2decShenning printf("(%u, ", r->return_icmp & 255); 685328b2decShenning else 686328b2decShenning printf("(%s, ", ic->name); 687328b2decShenning if (ic6 == NULL) 688328b2decShenning printf("%u)", r->return_icmp6 & 255); 689328b2decShenning else 690328b2decShenning printf("%s)", ic6->name); 691328b2decShenning break; 692328b2decShenning } 693acf2444cShenning } else 694acf2444cShenning printf(" drop"); 6951173271aScedric } 6967189e280Sdhartmei if (r->direction == PF_IN) 69714a9b182Skjell printf(" in"); 6987189e280Sdhartmei else if (r->direction == PF_OUT) 69914a9b182Skjell printf(" out"); 7007242ce7aSdhartmei if (r->log == 1) 70114a9b182Skjell printf(" log"); 7027242ce7aSdhartmei else if (r->log == 2) 7037242ce7aSdhartmei printf(" log-all"); 70414a9b182Skjell if (r->quick) 70514a9b182Skjell printf(" quick"); 7067d0c9138Shenning if (r->ifname[0]) { 7077d0c9138Shenning if (r->ifnot) 7087d0c9138Shenning printf(" on ! %s", r->ifname); 7097d0c9138Shenning else 71014a9b182Skjell printf(" on %s", r->ifname); 7117d0c9138Shenning } 712cb3a4e31Sjasoni if (r->rt) { 713cb3a4e31Sjasoni if (r->rt == PF_ROUTETO) 714cb3a4e31Sjasoni printf(" route-to"); 715fa1cdd09Sdhartmei else if (r->rt == PF_REPLYTO) 716fa1cdd09Sdhartmei printf(" reply-to"); 717cb3a4e31Sjasoni else if (r->rt == PF_DUPTO) 718cb3a4e31Sjasoni printf(" dup-to"); 719cb3a4e31Sjasoni else if (r->rt == PF_FASTROUTE) 720cb3a4e31Sjasoni printf(" fastroute"); 721790504a6Sdhartmei if (r->rt != PF_FASTROUTE) { 722790504a6Sdhartmei printf(" "); 7231df6a140Scedric print_pool(&r->rpool, 0, 0, r->af, PF_PASS); 724790504a6Sdhartmei } 725cb3a4e31Sjasoni } 72630620b12Sfrantzen if (r->af) { 72730620b12Sfrantzen if (r->af == AF_INET) 72830620b12Sfrantzen printf(" inet"); 72930620b12Sfrantzen else 73030620b12Sfrantzen printf(" inet6"); 73130620b12Sfrantzen } 73214a9b182Skjell if (r->proto) { 733e4ebe044Shenning struct protoent *p; 734ed99c291Sderaadt 735e4ebe044Shenning if ((p = getprotobynumber(r->proto)) != NULL) 73614a9b182Skjell printf(" proto %s", p->p_name); 73714a9b182Skjell else 73814a9b182Skjell printf(" proto %u", r->proto); 73914a9b182Skjell } 74064b4b616Sfrantzen print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, 74164b4b616Sfrantzen verbose); 742c16ab608Sdhartmei if (r->uid.op) 7431173271aScedric print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user", 7441173271aScedric UID_MAX); 745c16ab608Sdhartmei if (r->gid.op) 7461173271aScedric print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group", 7471173271aScedric GID_MAX); 74814a9b182Skjell if (r->flags || r->flagset) { 74914a9b182Skjell printf(" flags "); 75014a9b182Skjell print_flags(r->flags); 75114a9b182Skjell printf("/"); 75214a9b182Skjell print_flags(r->flagset); 75314a9b182Skjell } 754082ebc44Swilfried if (r->type) { 755b49ca6bbShenning const struct icmptypeent *it; 756082ebc44Swilfried 757b49ca6bbShenning it = geticmptypebynumber(r->type-1, r->af); 758d14c53d7Swilfried if (r->af != AF_INET6) 759d14c53d7Swilfried printf(" icmp-type"); 760082ebc44Swilfried else 761d0cb3502Smcbride printf(" icmp6-type"); 762b49ca6bbShenning if (it != NULL) 763b49ca6bbShenning printf(" %s", it->name); 764d14c53d7Swilfried else 765d14c53d7Swilfried printf(" %u", r->type-1); 766082ebc44Swilfried if (r->code) { 767b49ca6bbShenning const struct icmpcodeent *ic; 768082ebc44Swilfried 769b49ca6bbShenning ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); 770b49ca6bbShenning if (ic != NULL) 771b49ca6bbShenning printf(" code %s", ic->name); 772082ebc44Swilfried else 77314a9b182Skjell printf(" code %u", r->code-1); 774082ebc44Swilfried } 775082ebc44Swilfried } 776e4cbe364Sdhartmei if (r->tos) 777e4cbe364Sdhartmei printf(" tos 0x%2.2x", r->tos); 778b96c47abSfrantzen if (r->keep_state == PF_STATE_NORMAL) 77914a9b182Skjell printf(" keep state"); 780b96c47abSfrantzen else if (r->keep_state == PF_STATE_MODULATE) 781b96c47abSfrantzen printf(" modulate state"); 78252e0438eSdhartmei else if (r->keep_state == PF_STATE_SYNPROXY) 78352e0438eSdhartmei printf(" synproxy state"); 78438425613Scedric if (r->prob) { 78538425613Scedric char buf[20]; 78638425613Scedric 78738425613Scedric snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0)); 78838425613Scedric for (i = strlen(buf)-1; i > 0; i--) { 78938425613Scedric if (buf[i] == '0') 79038425613Scedric buf[i] = '\0'; 79138425613Scedric else { 79238425613Scedric if (buf[i] == '.') 79338425613Scedric buf[i] = '\0'; 79438425613Scedric break; 79538425613Scedric } 79638425613Scedric } 79738425613Scedric printf(" probability %s%%", buf); 79838425613Scedric } 799cc5f0329Sdhartmei opts = 0; 800fd777407Smcbride if (r->max_states || r->max_src_nodes || r->max_src_states) 801cc5f0329Sdhartmei opts = 1; 802af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) 803af80fa86Smcbride opts = 1; 804fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) 805fd777407Smcbride opts = 1; 806ec359bd5Scedric if (r->rule_flag & (PFRULE_IFBOUND | PFRULE_GRBOUND)) 807ec359bd5Scedric opts = 1; 808cc5f0329Sdhartmei for (i = 0; !opts && i < PFTM_MAX; ++i) 809cc5f0329Sdhartmei if (r->timeout[i]) 810cc5f0329Sdhartmei opts = 1; 811cc5f0329Sdhartmei if (opts) { 812cc5f0329Sdhartmei printf(" ("); 813cc5f0329Sdhartmei if (r->max_states) { 814cc5f0329Sdhartmei printf("max %u", r->max_states); 815cc5f0329Sdhartmei opts = 0; 816cc5f0329Sdhartmei } 817af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) { 818af80fa86Smcbride if (!opts) 819af80fa86Smcbride printf(", "); 820af80fa86Smcbride printf("no-sync"); 821af80fa86Smcbride opts = 0; 822af80fa86Smcbride } 823fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) { 824fd777407Smcbride if (!opts) 825fd777407Smcbride printf(", "); 826fd777407Smcbride printf("source-track"); 827fd777407Smcbride if (r->rule_flag & PFRULE_RULESRCTRACK) 828fd777407Smcbride printf(" rule"); 829fd777407Smcbride else 830fd777407Smcbride printf(" global"); 831fd777407Smcbride opts = 0; 832fd777407Smcbride } 833fd777407Smcbride if (r->max_src_states) { 834fd777407Smcbride if (!opts) 835fd777407Smcbride printf(", "); 836fd777407Smcbride printf("max-src-states %u", r->max_src_states); 837fd777407Smcbride opts = 0; 838fd777407Smcbride } 839fd777407Smcbride if (r->max_src_nodes) { 840fd777407Smcbride if (!opts) 841fd777407Smcbride printf(", "); 842fd777407Smcbride printf("max-src-nodes %u", r->max_src_nodes); 843fd777407Smcbride opts = 0; 844fd777407Smcbride } 845ec359bd5Scedric if (r->rule_flag & PFRULE_IFBOUND) { 846ec359bd5Scedric if (!opts) 847ec359bd5Scedric printf(", "); 848ec359bd5Scedric printf("if-bound"); 849ec359bd5Scedric opts = 0; 850ec359bd5Scedric } 851ec359bd5Scedric if (r->rule_flag & PFRULE_GRBOUND) { 852ec359bd5Scedric if (!opts) 853ec359bd5Scedric printf(", "); 854ec359bd5Scedric printf("group-bound"); 855ec359bd5Scedric opts = 0; 856ec359bd5Scedric } 857cc5f0329Sdhartmei for (i = 0; i < PFTM_MAX; ++i) 858cc5f0329Sdhartmei if (r->timeout[i]) { 859cc5f0329Sdhartmei if (!opts) 860cc5f0329Sdhartmei printf(", "); 861cc5f0329Sdhartmei opts = 0; 862cc5f0329Sdhartmei printf("%s %u", pf_timeouts[i].name, 863cc5f0329Sdhartmei r->timeout[i]); 864cc5f0329Sdhartmei } 865cc5f0329Sdhartmei printf(")"); 866cc5f0329Sdhartmei } 8676673dee2Sdhartmei if (r->rule_flag & PFRULE_FRAGMENT) 8686673dee2Sdhartmei printf(" fragment"); 86967d2a440Sprovos if (r->rule_flag & PFRULE_NODF) 87067d2a440Sprovos printf(" no-df"); 871edbe3066Sdhartmei if (r->rule_flag & PFRULE_RANDOMID) 872edbe3066Sdhartmei printf(" random-id"); 873e258bfd4Sprovos if (r->min_ttl) 87434c76dcbSprovos printf(" min-ttl %d", r->min_ttl); 875cfa91859Sjasoni if (r->max_mss) 876cfa91859Sjasoni printf(" max-mss %d", r->max_mss); 877f48d62b3Sdhartmei if (r->allow_opts) 878f48d62b3Sdhartmei printf(" allow-opts"); 879b02af636Sfrantzen if (r->action == PF_SCRUB) { 8802b95ca55Sfrantzen if (r->rule_flag & PFRULE_REASSEMBLE_TCP) 8812b95ca55Sfrantzen printf(" reassemble tcp"); 8822b95ca55Sfrantzen 883b02af636Sfrantzen if (r->rule_flag & PFRULE_FRAGDROP) 884b02af636Sfrantzen printf(" fragment drop-ovl"); 885b02af636Sfrantzen else if (r->rule_flag & PFRULE_FRAGCROP) 886b02af636Sfrantzen printf(" fragment crop"); 887b02af636Sfrantzen else 888b02af636Sfrantzen printf(" fragment reassemble"); 889b02af636Sfrantzen } 890455ef0c1Sdhartmei if (r->label[0]) 891ff45dfa8Scamield printf(" label \"%s\"", r->label); 892f98324c6Shenning if (r->qname[0] && r->pqname[0]) 893f98324c6Shenning printf(" queue(%s, %s)", r->qname, r->pqname); 894f98324c6Shenning else if (r->qname[0]) 89578e1d2a6Shenning printf(" queue %s", r->qname); 8968aecb81aShenning if (r->tagname[0]) 8978aecb81aShenning printf(" tag %s", r->tagname); 89836369899Shenning if (r->match_tagname[0]) { 89936369899Shenning if (r->match_tag_not) 90036369899Shenning printf(" !"); 9010a5f7f2fShenning printf(" tagged %s", r->match_tagname); 90236369899Shenning } 903d9ad7941Sdhartmei if (!anchor_call[0] && (r->action == PF_NAT || 904d0aca2f2Shenning r->action == PF_BINAT || r->action == PF_RDR)) { 905d0aca2f2Shenning printf(" -> "); 906d0aca2f2Shenning print_pool(&r->rpool, r->rpool.proxy_port[0], 907d0aca2f2Shenning r->rpool.proxy_port[1], r->af, r->action); 908d0aca2f2Shenning } 90914a9b182Skjell printf("\n"); 91014a9b182Skjell } 91114a9b182Skjell 9125b6c447dScedric void 9135b6c447dScedric print_tabledef(const char *name, int flags, int addrs, 9145b6c447dScedric struct node_tinithead *nodes) 9155b6c447dScedric { 9165b6c447dScedric struct node_tinit *ti, *nti; 9175b6c447dScedric struct node_host *h; 9185b6c447dScedric 9195b6c447dScedric printf("table <%s>", name); 9205b6c447dScedric if (flags & PFR_TFLAG_CONST) 9215b6c447dScedric printf(" const"); 9225b6c447dScedric if (flags & PFR_TFLAG_PERSIST) 9235b6c447dScedric printf(" persist"); 9245b6c447dScedric SIMPLEQ_FOREACH(ti, nodes, entries) { 9255b6c447dScedric if (ti->file) { 9265b6c447dScedric printf(" file \"%s\"", ti->file); 9275b6c447dScedric continue; 9285b6c447dScedric } 9295b6c447dScedric printf(" {"); 9305b6c447dScedric for (;;) { 9315b6c447dScedric for (h = ti->host; h != NULL; h = h->next) { 9325b6c447dScedric printf(h->not ? " !" : " "); 9335b6c447dScedric print_addr(&h->addr, h->af, 0); 9345b6c447dScedric } 9355b6c447dScedric nti = SIMPLEQ_NEXT(ti, entries); 9365b6c447dScedric if (nti != NULL && nti->file == NULL) 9375b6c447dScedric ti = nti; /* merge lists */ 9385b6c447dScedric else 9395b6c447dScedric break; 9405b6c447dScedric } 9415b6c447dScedric printf(" }"); 9425b6c447dScedric } 9435b6c447dScedric if (addrs && SIMPLEQ_EMPTY(nodes)) 9445b6c447dScedric printf(" { }"); 9455b6c447dScedric printf("\n"); 9465b6c447dScedric } 9475b6c447dScedric 9481f8f21bdSmillert int 949ff352a37Smarkus parse_flags(char *s) 95014a9b182Skjell { 951ff352a37Smarkus char *p, *q; 95214a9b182Skjell u_int8_t f = 0; 95381a15e5dSderaadt 954ff352a37Smarkus for (p = s; *p; p++) { 955ff352a37Smarkus if ((q = strchr(tcpflags, *p)) == NULL) 956ff352a37Smarkus return -1; 957ff352a37Smarkus else 958ff352a37Smarkus f |= 1 << (q - tcpflags); 95914a9b182Skjell } 960bc795af0Shugh return (f ? f : PF_TH_ALL); 96114a9b182Skjell } 96294e9410bShenning 96394e9410bShenning void 96494e9410bShenning set_ipmask(struct node_host *h, u_int8_t b) 96594e9410bShenning { 96694e9410bShenning struct pf_addr *m, *n; 96794e9410bShenning int i, j = 0; 96894e9410bShenning 96994e9410bShenning m = &h->addr.v.a.mask; 970ab648bf6Sfrantzen memset(m, 0, sizeof(*m)); 97194e9410bShenning 97294e9410bShenning while (b >= 32) { 97394e9410bShenning m->addr32[j++] = 0xffffffff; 97494e9410bShenning b -= 32; 97594e9410bShenning } 97694e9410bShenning for (i = 31; i > 31-b; --i) 97794e9410bShenning m->addr32[j] |= (1 << i); 97894e9410bShenning if (b) 97994e9410bShenning m->addr32[j] = htonl(m->addr32[j]); 98094e9410bShenning 98194e9410bShenning /* Mask off bits of the address that will never be used. */ 98294e9410bShenning n = &h->addr.v.a.addr; 983ff626af1Shenning if (h->addr.type == PF_ADDR_ADDRMASK) 98494e9410bShenning for (i = 0; i < 4; i++) 98594e9410bShenning n->addr32[i] = n->addr32[i] & m->addr32[i]; 98694e9410bShenning } 98794e9410bShenning 98852f4a4a4Shenning int 98952f4a4a4Shenning check_netmask(struct node_host *h, sa_family_t af) 99052f4a4a4Shenning { 99152f4a4a4Shenning struct node_host *n = NULL; 99252f4a4a4Shenning struct pf_addr *m; 99352f4a4a4Shenning 99452f4a4a4Shenning for (n = h; n != NULL; n = n->next) { 99575d911b5Scedric if (h->addr.type == PF_ADDR_TABLE) 99675d911b5Scedric continue; 99752f4a4a4Shenning m = &h->addr.v.a.mask; 99852f4a4a4Shenning /* fix up netmask for dynaddr */ 99952f4a4a4Shenning if (af == AF_INET && h->addr.type == PF_ADDR_DYNIFTL && 100052f4a4a4Shenning unmask(m, AF_INET6) > 32) 100152f4a4a4Shenning set_ipmask(n, 32); 100252f4a4a4Shenning /* netmasks > 32 bit are invalid on v4 */ 100352f4a4a4Shenning if (af == AF_INET && 100452f4a4a4Shenning (m->addr32[1] || m->addr32[2] || m->addr32[3])) { 100552f4a4a4Shenning fprintf(stderr, "netmask %u invalid for IPv4 address\n", 100652f4a4a4Shenning unmask(m, AF_INET6)); 100752f4a4a4Shenning return (1); 100852f4a4a4Shenning } 100952f4a4a4Shenning } 101052f4a4a4Shenning return (0); 101152f4a4a4Shenning } 101252f4a4a4Shenning 101394e9410bShenning /* interface lookup routines */ 101494e9410bShenning 101594e9410bShenning struct node_host *iftab; 101694e9410bShenning 101794e9410bShenning void 101894e9410bShenning ifa_load(void) 101994e9410bShenning { 102094e9410bShenning struct ifaddrs *ifap, *ifa; 102194e9410bShenning struct node_host *n = NULL, *h = NULL; 102294e9410bShenning 102394e9410bShenning if (getifaddrs(&ifap) < 0) 102494e9410bShenning err(1, "getifaddrs"); 102594e9410bShenning 102694e9410bShenning for (ifa = ifap; ifa; ifa = ifa->ifa_next) { 102794e9410bShenning if (!(ifa->ifa_addr->sa_family == AF_INET || 102894e9410bShenning ifa->ifa_addr->sa_family == AF_INET6 || 102994e9410bShenning ifa->ifa_addr->sa_family == AF_LINK)) 103094e9410bShenning continue; 103194e9410bShenning n = calloc(1, sizeof(struct node_host)); 103294e9410bShenning if (n == NULL) 103394e9410bShenning err(1, "address: calloc"); 103494e9410bShenning n->af = ifa->ifa_addr->sa_family; 103594e9410bShenning n->ifa_flags = ifa->ifa_flags; 103694e9410bShenning #ifdef __KAME__ 103794e9410bShenning if (n->af == AF_INET6 && 103894e9410bShenning IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 103994e9410bShenning ifa->ifa_addr)->sin6_addr) && 1040ab642153Shenning ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == 1041ab642153Shenning 0) { 104294e9410bShenning struct sockaddr_in6 *sin6; 104394e9410bShenning 104494e9410bShenning sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 104594e9410bShenning sin6->sin6_scope_id = sin6->sin6_addr.s6_addr[2] << 8 | 104694e9410bShenning sin6->sin6_addr.s6_addr[3]; 104794e9410bShenning sin6->sin6_addr.s6_addr[2] = 0; 104894e9410bShenning sin6->sin6_addr.s6_addr[3] = 0; 104994e9410bShenning } 105094e9410bShenning #endif 105194e9410bShenning n->ifindex = 0; 105294e9410bShenning if (n->af == AF_INET) { 105394e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in *) 105494e9410bShenning ifa->ifa_addr)->sin_addr.s_addr, 105594e9410bShenning sizeof(struct in_addr)); 105694e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in *) 105794e9410bShenning ifa->ifa_netmask)->sin_addr.s_addr, 105894e9410bShenning sizeof(struct in_addr)); 105994e9410bShenning if (ifa->ifa_broadaddr != NULL) 106094e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in *) 106194e9410bShenning ifa->ifa_broadaddr)->sin_addr.s_addr, 106294e9410bShenning sizeof(struct in_addr)); 1063ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1064ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in *) 1065ec359bd5Scedric ifa->ifa_dstaddr)->sin_addr.s_addr, 1066ec359bd5Scedric sizeof(struct in_addr)); 106794e9410bShenning } else if (n->af == AF_INET6) { 106894e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in6 *) 106994e9410bShenning ifa->ifa_addr)->sin6_addr.s6_addr, 107094e9410bShenning sizeof(struct in6_addr)); 107194e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in6 *) 107294e9410bShenning ifa->ifa_netmask)->sin6_addr.s6_addr, 107394e9410bShenning sizeof(struct in6_addr)); 107494e9410bShenning if (ifa->ifa_broadaddr != NULL) 107594e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in6 *) 107694e9410bShenning ifa->ifa_broadaddr)->sin6_addr.s6_addr, 107794e9410bShenning sizeof(struct in6_addr)); 1078ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1079ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in6 *) 1080ec359bd5Scedric ifa->ifa_dstaddr)->sin6_addr.s6_addr, 1081ec359bd5Scedric sizeof(struct in6_addr)); 108294e9410bShenning n->ifindex = ((struct sockaddr_in6 *) 108394e9410bShenning ifa->ifa_addr)->sin6_scope_id; 108494e9410bShenning } 108594e9410bShenning if ((n->ifname = strdup(ifa->ifa_name)) == NULL) 108694e9410bShenning err(1, "ifa_load: strdup"); 108794e9410bShenning n->next = NULL; 108894e9410bShenning n->tail = n; 108994e9410bShenning if (h == NULL) 109094e9410bShenning h = n; 109194e9410bShenning else { 109294e9410bShenning h->tail->next = n; 109394e9410bShenning h->tail = n; 109494e9410bShenning } 109594e9410bShenning } 1096ec359bd5Scedric 109794e9410bShenning iftab = h; 109894e9410bShenning freeifaddrs(ifap); 109994e9410bShenning } 110094e9410bShenning 110194e9410bShenning struct node_host * 1102ec359bd5Scedric ifa_exists(const char *ifa_name, int group_ok) 110394e9410bShenning { 110494e9410bShenning struct node_host *n; 110594e9410bShenning 110694e9410bShenning if (iftab == NULL) 110794e9410bShenning ifa_load(); 110894e9410bShenning 110994e9410bShenning for (n = iftab; n; n = n->next) { 111094e9410bShenning if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ)) 111194e9410bShenning return (n); 111294e9410bShenning } 1113655a9f8aShenning 111494e9410bShenning return (NULL); 111594e9410bShenning } 111694e9410bShenning 111794e9410bShenning struct node_host * 1118ec359bd5Scedric ifa_lookup(const char *ifa_name, int flags) 111994e9410bShenning { 112094e9410bShenning struct node_host *p = NULL, *h = NULL, *n = NULL; 11217ad220f2Scedric int got4 = 0, got6 = 0; 1122ec359bd5Scedric const char *last_if = NULL; 112394e9410bShenning 112494e9410bShenning if (!strncmp(ifa_name, "self", IFNAMSIZ)) 11257ad220f2Scedric ifa_name = NULL; 112694e9410bShenning 112794e9410bShenning if (iftab == NULL) 112894e9410bShenning ifa_load(); 112994e9410bShenning 113094e9410bShenning for (p = iftab; p; p = p->next) { 11317ad220f2Scedric if (ifa_skip_if(ifa_name, p)) 113294e9410bShenning continue; 1133ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET) 113494e9410bShenning continue; 1135ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && 1136ec359bd5Scedric !(p->ifa_flags & IFF_BROADCAST)) 113794e9410bShenning continue; 1138ec359bd5Scedric if ((flags & PFI_AFLAG_PEER) && 1139ec359bd5Scedric !(p->ifa_flags & IFF_POINTOPOINT)) 1140ec359bd5Scedric continue; 1141ec359bd5Scedric if ((flags & PFI_AFLAG_NETWORK) && p->ifindex > 0) 1142ec359bd5Scedric continue; 1143ec359bd5Scedric if (last_if == NULL || strcmp(last_if, p->ifname)) 1144ec359bd5Scedric got4 = got6 = 0; 1145ec359bd5Scedric last_if = p->ifname; 1146ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) 1147ec359bd5Scedric continue; 1148ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) 1149ec359bd5Scedric continue; 1150ec359bd5Scedric if (p->af == AF_INET) 1151ec359bd5Scedric got4 = 1; 1152ec359bd5Scedric else 1153ec359bd5Scedric got6 = 1; 115494e9410bShenning n = calloc(1, sizeof(struct node_host)); 115594e9410bShenning if (n == NULL) 115694e9410bShenning err(1, "address: calloc"); 115794e9410bShenning n->af = p->af; 1158ec359bd5Scedric if (flags & PFI_AFLAG_BROADCAST) 115994e9410bShenning memcpy(&n->addr.v.a.addr, &p->bcast, 116094e9410bShenning sizeof(struct pf_addr)); 1161ec359bd5Scedric else if (flags & PFI_AFLAG_PEER) 1162ec359bd5Scedric memcpy(&n->addr.v.a.addr, &p->peer, 1163ec359bd5Scedric sizeof(struct pf_addr)); 116494e9410bShenning else 116594e9410bShenning memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, 116694e9410bShenning sizeof(struct pf_addr)); 1167ec359bd5Scedric if (flags & PFI_AFLAG_NETWORK) 116894e9410bShenning set_ipmask(n, unmask(&p->addr.v.a.mask, n->af)); 116994e9410bShenning else { 117094e9410bShenning if (n->af == AF_INET) { 117194e9410bShenning if (p->ifa_flags & IFF_LOOPBACK && 117294e9410bShenning p->ifa_flags & IFF_LINK1) 117394e9410bShenning memcpy(&n->addr.v.a.mask, 117494e9410bShenning &p->addr.v.a.mask, 117594e9410bShenning sizeof(struct pf_addr)); 117694e9410bShenning else 117794e9410bShenning set_ipmask(n, 32); 117894e9410bShenning } else 117994e9410bShenning set_ipmask(n, 128); 118094e9410bShenning } 118194e9410bShenning n->ifindex = p->ifindex; 118294e9410bShenning 118394e9410bShenning n->next = NULL; 118494e9410bShenning n->tail = n; 118594e9410bShenning if (h == NULL) 118694e9410bShenning h = n; 118794e9410bShenning else { 118894e9410bShenning h->tail->next = n; 118994e9410bShenning h->tail = n; 119094e9410bShenning } 119194e9410bShenning } 119294e9410bShenning return (h); 119394e9410bShenning } 119494e9410bShenning 11957ad220f2Scedric int 11967ad220f2Scedric ifa_skip_if(const char *filter, struct node_host *p) 11977ad220f2Scedric { 11987ad220f2Scedric int n; 11997ad220f2Scedric 12007ad220f2Scedric if (p->af != AF_INET && p->af != AF_INET6) 12017ad220f2Scedric return (1); 12027ad220f2Scedric if (filter == NULL || !*filter) 12037ad220f2Scedric return (0); 12047ad220f2Scedric if (!strcmp(p->ifname, filter)) 12057ad220f2Scedric return (0); /* exact match */ 12067ad220f2Scedric n = strlen(filter); 12077ad220f2Scedric if (n < 1 || n >= IFNAMSIZ) 12087ad220f2Scedric return (1); /* sanity check */ 12097ad220f2Scedric if (filter[n-1] >= '0' && filter[n-1] <= '9') 12107ad220f2Scedric return (1); /* only do exact match in that case */ 12117ad220f2Scedric if (strncmp(p->ifname, filter, n)) 12127ad220f2Scedric return (1); /* prefix doesn't match */ 12137ad220f2Scedric return (p->ifname[n] < '0' || p->ifname[n] > '9'); 12147ad220f2Scedric } 12157ad220f2Scedric 12167ad220f2Scedric 121794e9410bShenning struct node_host * 1218f23861c1Shenning host(const char *s) 121994e9410bShenning { 12202a6c1abaShenning struct node_host *h = NULL; 1221f23861c1Shenning int mask, v4mask, v6mask, cont = 1; 1222f23861c1Shenning char *p, *q, *ps; 122394e9410bShenning 122494e9410bShenning if ((p = strrchr(s, '/')) != NULL) { 122594e9410bShenning mask = strtol(p+1, &q, 0); 1226fecc9cd0Shenning if (!q || *q || mask > 128 || q == (p+1)) { 122794e9410bShenning fprintf(stderr, "invalid netmask\n"); 122894e9410bShenning return (NULL); 122994e9410bShenning } 1230a81c851cShenning if ((ps = malloc(strlen(s) - strlen(p) + 1)) == NULL) 123194e9410bShenning err(1, "host: malloc"); 123294e9410bShenning strlcpy(ps, s, strlen(s) - strlen(p) + 1); 123394e9410bShenning v4mask = v6mask = mask; 123494e9410bShenning } else { 1235f23861c1Shenning if ((ps = strdup(s)) == NULL) 1236f23861c1Shenning err(1, "host: strdup"); 123794e9410bShenning v4mask = 32; 123894e9410bShenning v6mask = 128; 1239f23861c1Shenning mask = -1; 124094e9410bShenning } 124194e9410bShenning 12422a6c1abaShenning /* interface with this name exists? */ 12434a36d485Shenning if (cont && (h = host_if(ps, mask)) != NULL) 12442a6c1abaShenning cont = 0; 12452a6c1abaShenning 12462a6c1abaShenning /* IPv4 address? */ 1247f23861c1Shenning if (cont && (h = host_v4(s, mask)) != NULL) 12482a6c1abaShenning cont = 0; 12492a6c1abaShenning 12502a6c1abaShenning /* IPv6 address? */ 12512a6c1abaShenning if (cont && (h = host_v6(ps, v6mask)) != NULL) 12522a6c1abaShenning cont = 0; 12532a6c1abaShenning 12542a6c1abaShenning /* dns lookup */ 12552a6c1abaShenning if (cont && (h = host_dns(ps, v4mask, v6mask)) != NULL) 12562a6c1abaShenning cont = 0; 12572a6c1abaShenning free(ps); 12582a6c1abaShenning 12592a6c1abaShenning if (h == NULL || cont == 1) { 12602a6c1abaShenning fprintf(stderr, "no IP address found for %s\n", s); 12612a6c1abaShenning return (NULL); 12622a6c1abaShenning } 12632a6c1abaShenning return (h); 12642a6c1abaShenning } 12652a6c1abaShenning 12662a6c1abaShenning struct node_host * 1267f2370d27Shenning host_if(const char *s, int mask) 12682a6c1abaShenning { 12692a6c1abaShenning struct node_host *n, *h = NULL; 12704a36d485Shenning char *p, *ps; 1271ec359bd5Scedric int flags = 0; 12722a6c1abaShenning 1273ec359bd5Scedric if ((ps = strdup(s)) == NULL) 1274ec359bd5Scedric err(1, "host_if: strdup"); 1275ec359bd5Scedric while ((p = strrchr(ps, ':')) != NULL) { 12764a36d485Shenning if (!strcmp(p+1, "network")) 1277ec359bd5Scedric flags |= PFI_AFLAG_NETWORK; 1278ec359bd5Scedric else if (!strcmp(p+1, "broadcast")) 1279ec359bd5Scedric flags |= PFI_AFLAG_BROADCAST; 1280ec359bd5Scedric else if (!strcmp(p+1, "peer")) 1281ec359bd5Scedric flags |= PFI_AFLAG_PEER; 1282ec359bd5Scedric else if (!strcmp(p+1, "0")) 1283ec359bd5Scedric flags |= PFI_AFLAG_NOALIAS; 1284f8bc5305Shenning else { 1285f8bc5305Shenning free(ps); 1286ec359bd5Scedric return (NULL); 1287f8bc5305Shenning } 1288ec359bd5Scedric *p = '\0'; 1289ec359bd5Scedric } 1290ec359bd5Scedric if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */ 1291ec359bd5Scedric fprintf(stderr, "illegal combination of interface modifiers\n"); 1292f8bc5305Shenning free(ps); 1293ec359bd5Scedric return (NULL); 1294ec359bd5Scedric } 1295ec359bd5Scedric if ((flags & (PFI_AFLAG_NETWORK|PFI_AFLAG_BROADCAST)) && mask > -1) { 12964a36d485Shenning fprintf(stderr, "network or broadcast lookup, but " 12974a36d485Shenning "extra netmask given\n"); 1298f8bc5305Shenning free(ps); 12994a36d485Shenning return (NULL); 13004a36d485Shenning } 1301ec359bd5Scedric if (ifa_exists(ps, 1) || !strncmp(ps, "self", IFNAMSIZ)) { 13022a6c1abaShenning /* interface with this name exists */ 1303ec359bd5Scedric h = ifa_lookup(ps, flags); 13042a6c1abaShenning for (n = h; n != NULL && mask > -1; n = n->next) 13052a6c1abaShenning set_ipmask(n, mask); 13062a6c1abaShenning } 13074a36d485Shenning 13084a36d485Shenning free(ps); 13092a6c1abaShenning return (h); 13102a6c1abaShenning } 13112a6c1abaShenning 13122a6c1abaShenning struct node_host * 1313383ebbbfShenning host_v4(const char *s, int mask) 13142a6c1abaShenning { 13152a6c1abaShenning struct node_host *h = NULL; 13162a6c1abaShenning struct in_addr ina; 131790fffbb7Shenning int bits = 32; 13182a6c1abaShenning 131994e9410bShenning memset(&ina, 0, sizeof(struct in_addr)); 132090fffbb7Shenning if (strrchr(s, '/') != NULL) { 132190fffbb7Shenning if ((bits = inet_net_pton(AF_INET, s, &ina, sizeof(ina))) == -1) 132290fffbb7Shenning return (NULL); 132390fffbb7Shenning } else { 132490fffbb7Shenning if (inet_pton(AF_INET, s, &ina) != 1) 132590fffbb7Shenning return (NULL); 132690fffbb7Shenning } 132790fffbb7Shenning 132894e9410bShenning h = calloc(1, sizeof(struct node_host)); 132994e9410bShenning if (h == NULL) 133094e9410bShenning err(1, "address: calloc"); 133194e9410bShenning h->ifname = NULL; 133294e9410bShenning h->af = AF_INET; 133394e9410bShenning h->addr.v.a.addr.addr32[0] = ina.s_addr; 133494e9410bShenning set_ipmask(h, bits); 133594e9410bShenning h->next = NULL; 133694e9410bShenning h->tail = h; 13372a6c1abaShenning 133894e9410bShenning return (h); 133994e9410bShenning } 13402a6c1abaShenning 13412a6c1abaShenning struct node_host * 1342f2370d27Shenning host_v6(const char *s, int mask) 13432a6c1abaShenning { 13442a6c1abaShenning struct addrinfo hints, *res; 13452a6c1abaShenning struct node_host *h = NULL; 134694e9410bShenning 134794e9410bShenning memset(&hints, 0, sizeof(hints)); 134894e9410bShenning hints.ai_family = AF_INET6; 134994e9410bShenning hints.ai_socktype = SOCK_DGRAM; /*dummy*/ 135094e9410bShenning hints.ai_flags = AI_NUMERICHOST; 13512a6c1abaShenning if (getaddrinfo(s, "0", &hints, &res) == 0) { 13522a6c1abaShenning h = calloc(1, sizeof(struct node_host)); 13532a6c1abaShenning if (h == NULL) 135494e9410bShenning err(1, "address: calloc"); 13552a6c1abaShenning h->ifname = NULL; 13562a6c1abaShenning h->af = AF_INET6; 13572a6c1abaShenning memcpy(&h->addr.v.a.addr, 135894e9410bShenning &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 13592a6c1abaShenning sizeof(h->addr.v.a.addr)); 13602a6c1abaShenning h->ifindex = 13612a6c1abaShenning ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; 13622a6c1abaShenning set_ipmask(h, mask); 136394e9410bShenning freeaddrinfo(res); 13642a6c1abaShenning h->next = NULL; 13652a6c1abaShenning h->tail = h; 136694e9410bShenning } 136794e9410bShenning 13682a6c1abaShenning return (h); 13692a6c1abaShenning } 13702a6c1abaShenning 13712a6c1abaShenning struct node_host * 1372f2370d27Shenning host_dns(const char *s, int v4mask, int v6mask) 13732a6c1abaShenning { 13742a6c1abaShenning struct addrinfo hints, *res0, *res; 13752a6c1abaShenning struct node_host *n, *h = NULL; 1376ec359bd5Scedric int error, noalias = 0; 1377ec359bd5Scedric int got4 = 0, got6 = 0; 1378ec359bd5Scedric char *p, *ps; 13792a6c1abaShenning 1380ec359bd5Scedric if ((ps = strdup(s)) == NULL) 138122dee42fShenning err(1, "host_dns: strdup"); 1382ec359bd5Scedric if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) { 1383ec359bd5Scedric noalias = 1; 1384ec359bd5Scedric *p = '\0'; 1385ec359bd5Scedric } 138694e9410bShenning memset(&hints, 0, sizeof(hints)); 138794e9410bShenning hints.ai_family = PF_UNSPEC; 138894e9410bShenning hints.ai_socktype = SOCK_STREAM; /* DUMMY */ 1389ec359bd5Scedric error = getaddrinfo(ps, NULL, &hints, &res0); 1390b4d8b6eeShenning if (error) { 1391b4d8b6eeShenning free(ps); 13922a6c1abaShenning return (h); 1393b4d8b6eeShenning } 13942a6c1abaShenning 139594e9410bShenning for (res = res0; res; res = res->ai_next) { 139694e9410bShenning if (res->ai_family != AF_INET && 139794e9410bShenning res->ai_family != AF_INET6) 139894e9410bShenning continue; 1399ec359bd5Scedric if (noalias) { 1400ec359bd5Scedric if (res->ai_family == AF_INET) { 1401ec359bd5Scedric if (got4) 1402ec359bd5Scedric continue; 1403ec359bd5Scedric got4 = 1; 1404ec359bd5Scedric } else { 1405ec359bd5Scedric if (got6) 1406ec359bd5Scedric continue; 1407ec359bd5Scedric got6 = 1; 1408ec359bd5Scedric } 1409ec359bd5Scedric } 141094e9410bShenning n = calloc(1, sizeof(struct node_host)); 141194e9410bShenning if (n == NULL) 14122a6c1abaShenning err(1, "host_dns: calloc"); 141394e9410bShenning n->ifname = NULL; 141494e9410bShenning n->af = res->ai_family; 141594e9410bShenning if (res->ai_family == AF_INET) { 141694e9410bShenning memcpy(&n->addr.v.a.addr, 14172a6c1abaShenning &((struct sockaddr_in *) 14182a6c1abaShenning res->ai_addr)->sin_addr.s_addr, 141994e9410bShenning sizeof(struct in_addr)); 142094e9410bShenning set_ipmask(n, v4mask); 142194e9410bShenning } else { 142294e9410bShenning memcpy(&n->addr.v.a.addr, 14232a6c1abaShenning &((struct sockaddr_in6 *) 14242a6c1abaShenning res->ai_addr)->sin6_addr.s6_addr, 142594e9410bShenning sizeof(struct in6_addr)); 142694e9410bShenning n->ifindex = 14272a6c1abaShenning ((struct sockaddr_in6 *) 14282a6c1abaShenning res->ai_addr)->sin6_scope_id; 142994e9410bShenning set_ipmask(n, v6mask); 143094e9410bShenning } 143194e9410bShenning n->next = NULL; 143294e9410bShenning n->tail = n; 143394e9410bShenning if (h == NULL) 143494e9410bShenning h = n; 143594e9410bShenning else { 143694e9410bShenning h->tail->next = n; 143794e9410bShenning h->tail = n; 143894e9410bShenning } 143994e9410bShenning } 144094e9410bShenning freeaddrinfo(res0); 1441ec359bd5Scedric free(ps); 144294e9410bShenning 144394e9410bShenning return (h); 144494e9410bShenning } 144542e05679Scedric 144642e05679Scedric /* 144742e05679Scedric * convert a hostname to a list of addresses and put them in the given buffer. 144842e05679Scedric * test: 144942e05679Scedric * if set to 1, only simple addresses are accepted (no netblock, no "!"). 145042e05679Scedric */ 145142e05679Scedric int 145242e05679Scedric append_addr(struct pfr_buffer *b, char *s, int test) 145342e05679Scedric { 14545b6c447dScedric char *r; 1455b88a8d5dScedric struct node_host *h, *n; 1456b88a8d5dScedric int rv, not = 0; 14575b6c447dScedric 14585b6c447dScedric for (r = s; *r == '!'; r++) 14595b6c447dScedric not = !not; 14605b6c447dScedric if ((n = host(r)) == NULL) { 14615b6c447dScedric errno = 0; 14625b6c447dScedric return (-1); 14635b6c447dScedric } 1464b88a8d5dScedric rv = append_addr_host(b, n, test, not); 1465b88a8d5dScedric do { 1466b88a8d5dScedric h = n; 1467b88a8d5dScedric n = n->next; 1468b88a8d5dScedric free(h); 1469b88a8d5dScedric } while (n != NULL); 1470b88a8d5dScedric return (rv); 147142e05679Scedric } 147242e05679Scedric 147342e05679Scedric /* 14745b6c447dScedric * same as previous function, but with a pre-parsed input and the ability 1475b88a8d5dScedric * to "negate" the result. Does not free the node_host list. 147642e05679Scedric * not: 147742e05679Scedric * setting it to 1 is equivalent to adding "!" in front of parameter s. 147842e05679Scedric */ 147942e05679Scedric int 14805b6c447dScedric append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) 148142e05679Scedric { 148242e05679Scedric int bits; 148342e05679Scedric struct pfr_addr addr; 148442e05679Scedric 148542e05679Scedric do { 148642e05679Scedric bzero(&addr, sizeof(addr)); 14875b6c447dScedric addr.pfra_not = n->not ^ not; 148842e05679Scedric addr.pfra_af = n->af; 148942e05679Scedric addr.pfra_net = unmask(&n->addr.v.a.mask, n->af); 149042e05679Scedric switch (n->af) { 149142e05679Scedric case AF_INET: 149242e05679Scedric addr.pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32[0]; 149342e05679Scedric bits = 32; 149442e05679Scedric break; 149542e05679Scedric case AF_INET6: 149642e05679Scedric memcpy(&addr.pfra_ip6addr, &n->addr.v.a.addr.v6, 149742e05679Scedric sizeof(struct in6_addr)); 149842e05679Scedric bits = 128; 149942e05679Scedric break; 150042e05679Scedric default: 150142e05679Scedric errno = EINVAL; 150242e05679Scedric return (-1); 150342e05679Scedric } 150442e05679Scedric if ((test && (not || addr.pfra_net != bits)) || 150542e05679Scedric addr.pfra_net > bits) { 150642e05679Scedric errno = EINVAL; 150742e05679Scedric return (-1); 150842e05679Scedric } 150942e05679Scedric if (pfr_buf_add(b, &addr)) 151042e05679Scedric return (-1); 1511b88a8d5dScedric } while ((n = n->next) != NULL); 151242e05679Scedric 151342e05679Scedric return (0); 151442e05679Scedric } 151579cc0068Scedric 151679cc0068Scedric int 1517d9ad7941Sdhartmei pfctl_add_trans(struct pfr_buffer *buf, int rs_num, const char *anchor) 151879cc0068Scedric { 151979cc0068Scedric struct pfioc_trans_e trans; 152079cc0068Scedric 152179cc0068Scedric bzero(&trans, sizeof(trans)); 152279cc0068Scedric trans.rs_num = rs_num; 152379cc0068Scedric if (strlcpy(trans.anchor, anchor, 1524d9ad7941Sdhartmei sizeof(trans.anchor)) >= sizeof(trans.anchor)) 152579cc0068Scedric errx(1, "pfctl_add_trans: strlcpy"); 152679cc0068Scedric 152779cc0068Scedric return pfr_buf_add(buf, &trans); 152879cc0068Scedric } 152979cc0068Scedric 153079cc0068Scedric u_int32_t 1531d9ad7941Sdhartmei pfctl_get_ticket(struct pfr_buffer *buf, int rs_num, const char *anchor) 153279cc0068Scedric { 153379cc0068Scedric struct pfioc_trans_e *p; 153479cc0068Scedric 153579cc0068Scedric PFRB_FOREACH(p, buf) 1536d9ad7941Sdhartmei if (rs_num == p->rs_num && !strcmp(anchor, p->anchor)) 153779cc0068Scedric return (p->ticket); 153822dee42fShenning errx(1, "pfctl_get_ticket: assertion failed"); 153979cc0068Scedric } 154079cc0068Scedric 154179cc0068Scedric int 15423060c195Shenning pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) 154379cc0068Scedric { 154479cc0068Scedric struct pfioc_trans trans; 154579cc0068Scedric 154679cc0068Scedric bzero(&trans, sizeof(trans)); 154779cc0068Scedric trans.size = buf->pfrb_size - from; 154879cc0068Scedric trans.esize = sizeof(struct pfioc_trans_e); 154979cc0068Scedric trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; 155079cc0068Scedric return ioctl(dev, cmd, &trans); 155179cc0068Scedric } 1552