1*e9953237Shenning /* $OpenBSD: pfctl_parser.c,v 1.242 2009/04/06 12:05:55 henning Exp $ */ 214a9b182Skjell 314a9b182Skjell /* 4fd3c3a0cSderaadt * Copyright (c) 2001 Daniel Hartmeier 5f2553c84Shenning * Copyright (c) 2002,2003 Henning Brauer 614a9b182Skjell * All rights reserved. 714a9b182Skjell * 814a9b182Skjell * Redistribution and use in source and binary forms, with or without 914a9b182Skjell * modification, are permitted provided that the following conditions 1014a9b182Skjell * are met: 1114a9b182Skjell * 1214a9b182Skjell * - Redistributions of source code must retain the above copyright 1314a9b182Skjell * notice, this list of conditions and the following disclaimer. 1414a9b182Skjell * - Redistributions in binary form must reproduce the above 1514a9b182Skjell * copyright notice, this list of conditions and the following 1614a9b182Skjell * disclaimer in the documentation and/or other materials provided 1714a9b182Skjell * with the distribution. 1814a9b182Skjell * 1914a9b182Skjell * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2014a9b182Skjell * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2114a9b182Skjell * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 2214a9b182Skjell * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 235974bd37Sdhartmei * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 2414a9b182Skjell * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 2514a9b182Skjell * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 2614a9b182Skjell * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 2714a9b182Skjell * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2814a9b182Skjell * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 2914a9b182Skjell * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 3014a9b182Skjell * POSSIBILITY OF SUCH DAMAGE. 3114a9b182Skjell * 3214a9b182Skjell */ 3314a9b182Skjell 34252d784aSderaadt #include <sys/types.h> 3579cc0068Scedric #include <sys/ioctl.h> 36252d784aSderaadt #include <sys/socket.h> 376b640f62Smcbride #include <sys/param.h> 386b640f62Smcbride #include <sys/proc.h> 39252d784aSderaadt #include <net/if.h> 40252d784aSderaadt #include <netinet/in.h> 416329fa59Sderaadt #include <netinet/in_systm.h> 426329fa59Sderaadt #include <netinet/ip.h> 436329fa59Sderaadt #include <netinet/ip_icmp.h> 4430620b12Sfrantzen #include <netinet/icmp6.h> 45252d784aSderaadt #include <net/pfvar.h> 469f13c6caSmillert #include <arpa/inet.h> 47252d784aSderaadt 4814a9b182Skjell #include <stdio.h> 4914a9b182Skjell #include <stdlib.h> 5014a9b182Skjell #include <string.h> 5114a9b182Skjell #include <ctype.h> 5214a9b182Skjell #include <netdb.h> 536329fa59Sderaadt #include <stdarg.h> 546329fa59Sderaadt #include <errno.h> 55ff352a37Smarkus #include <err.h> 5694e9410bShenning #include <ifaddrs.h> 572ff5b035Shenning #include <unistd.h> 5814a9b182Skjell 5914a9b182Skjell #include "pfctl_parser.h" 60eb824e11Sderaadt #include "pfctl.h" 6114a9b182Skjell 625d9ac2dcSdhartmei void print_op (u_int8_t, const char *, const char *); 63132c30ccShenning void print_port (u_int8_t, u_int16_t, u_int16_t, const char *); 641173271aScedric void print_ugid (u_int8_t, unsigned, unsigned, const char *, unsigned); 6581a15e5dSderaadt void print_flags (u_int8_t); 6664b4b616Sfrantzen void print_fromto(struct pf_rule_addr *, pf_osfp_t, 6764b4b616Sfrantzen struct pf_rule_addr *, u_int8_t, u_int8_t, int); 687ad220f2Scedric int ifa_skip_if(const char *filter, struct node_host *p); 6914a9b182Skjell 702ff5b035Shenning struct node_host *ifa_grouplookup(const char *, int); 71f2370d27Shenning struct node_host *host_if(const char *, int); 72383ebbbfShenning struct node_host *host_v4(const char *, int); 73f2370d27Shenning struct node_host *host_v6(const char *, int); 74f2370d27Shenning struct node_host *host_dns(const char *, int, int); 752a6c1abaShenning 76361e311cShenning const char *tcpflags = "FSRPAUEW"; 7714a9b182Skjell 787d27d81aSdhartmei static const struct icmptypeent icmp_type[] = { 79082ebc44Swilfried { "echoreq", ICMP_ECHO }, 80082ebc44Swilfried { "echorep", ICMP_ECHOREPLY }, 81082ebc44Swilfried { "unreach", ICMP_UNREACH }, 82082ebc44Swilfried { "squench", ICMP_SOURCEQUENCH }, 83082ebc44Swilfried { "redir", ICMP_REDIRECT }, 84082ebc44Swilfried { "althost", ICMP_ALTHOSTADDR }, 85082ebc44Swilfried { "routeradv", ICMP_ROUTERADVERT }, 86082ebc44Swilfried { "routersol", ICMP_ROUTERSOLICIT }, 87082ebc44Swilfried { "timex", ICMP_TIMXCEED }, 88082ebc44Swilfried { "paramprob", ICMP_PARAMPROB }, 89082ebc44Swilfried { "timereq", ICMP_TSTAMP }, 90082ebc44Swilfried { "timerep", ICMP_TSTAMPREPLY }, 91082ebc44Swilfried { "inforeq", ICMP_IREQ }, 92082ebc44Swilfried { "inforep", ICMP_IREQREPLY }, 93082ebc44Swilfried { "maskreq", ICMP_MASKREQ }, 9402cbcc9eSwilfried { "maskrep", ICMP_MASKREPLY }, 9502cbcc9eSwilfried { "trace", ICMP_TRACEROUTE }, 9602cbcc9eSwilfried { "dataconv", ICMP_DATACONVERR }, 9702cbcc9eSwilfried { "mobredir", ICMP_MOBILE_REDIRECT }, 9802cbcc9eSwilfried { "ipv6-where", ICMP_IPV6_WHEREAREYOU }, 9902cbcc9eSwilfried { "ipv6-here", ICMP_IPV6_IAMHERE }, 10002cbcc9eSwilfried { "mobregreq", ICMP_MOBILE_REGREQUEST }, 10102cbcc9eSwilfried { "mobregrep", ICMP_MOBILE_REGREPLY }, 10202cbcc9eSwilfried { "skip", ICMP_SKIP }, 10302cbcc9eSwilfried { "photuris", ICMP_PHOTURIS } 104082ebc44Swilfried }; 105082ebc44Swilfried 1067d27d81aSdhartmei static const struct icmptypeent icmp6_type[] = { 10730620b12Sfrantzen { "unreach", ICMP6_DST_UNREACH }, 10830620b12Sfrantzen { "toobig", ICMP6_PACKET_TOO_BIG }, 10930620b12Sfrantzen { "timex", ICMP6_TIME_EXCEEDED }, 11030620b12Sfrantzen { "paramprob", ICMP6_PARAM_PROB }, 11130620b12Sfrantzen { "echoreq", ICMP6_ECHO_REQUEST }, 11230620b12Sfrantzen { "echorep", ICMP6_ECHO_REPLY }, 11330620b12Sfrantzen { "groupqry", ICMP6_MEMBERSHIP_QUERY }, 11422a58e88Sitojun { "listqry", MLD_LISTENER_QUERY }, 11530620b12Sfrantzen { "grouprep", ICMP6_MEMBERSHIP_REPORT }, 11622a58e88Sitojun { "listenrep", MLD_LISTENER_REPORT }, 11730620b12Sfrantzen { "groupterm", ICMP6_MEMBERSHIP_REDUCTION }, 11822a58e88Sitojun { "listendone", MLD_LISTENER_DONE }, 11930620b12Sfrantzen { "routersol", ND_ROUTER_SOLICIT }, 12030620b12Sfrantzen { "routeradv", ND_ROUTER_ADVERT }, 12130620b12Sfrantzen { "neighbrsol", ND_NEIGHBOR_SOLICIT }, 12230620b12Sfrantzen { "neighbradv", ND_NEIGHBOR_ADVERT }, 12330620b12Sfrantzen { "redir", ND_REDIRECT }, 12430620b12Sfrantzen { "routrrenum", ICMP6_ROUTER_RENUMBERING }, 12530620b12Sfrantzen { "wrureq", ICMP6_WRUREQUEST }, 12630620b12Sfrantzen { "wrurep", ICMP6_WRUREPLY }, 12730620b12Sfrantzen { "fqdnreq", ICMP6_FQDN_QUERY }, 12830620b12Sfrantzen { "fqdnrep", ICMP6_FQDN_REPLY }, 12930620b12Sfrantzen { "niqry", ICMP6_NI_QUERY }, 13030620b12Sfrantzen { "nirep", ICMP6_NI_REPLY }, 13122a58e88Sitojun { "mtraceresp", MLD_MTRACE_RESP }, 13222a58e88Sitojun { "mtrace", MLD_MTRACE } 13330620b12Sfrantzen }; 13430620b12Sfrantzen 1357d27d81aSdhartmei static const struct icmpcodeent icmp_code[] = { 136082ebc44Swilfried { "net-unr", ICMP_UNREACH, ICMP_UNREACH_NET }, 137082ebc44Swilfried { "host-unr", ICMP_UNREACH, ICMP_UNREACH_HOST }, 138082ebc44Swilfried { "proto-unr", ICMP_UNREACH, ICMP_UNREACH_PROTOCOL }, 139082ebc44Swilfried { "port-unr", ICMP_UNREACH, ICMP_UNREACH_PORT }, 140082ebc44Swilfried { "needfrag", ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG }, 141082ebc44Swilfried { "srcfail", ICMP_UNREACH, ICMP_UNREACH_SRCFAIL }, 142082ebc44Swilfried { "net-unk", ICMP_UNREACH, ICMP_UNREACH_NET_UNKNOWN }, 143082ebc44Swilfried { "host-unk", ICMP_UNREACH, ICMP_UNREACH_HOST_UNKNOWN }, 144082ebc44Swilfried { "isolate", ICMP_UNREACH, ICMP_UNREACH_ISOLATED }, 145082ebc44Swilfried { "net-prohib", ICMP_UNREACH, ICMP_UNREACH_NET_PROHIB }, 146082ebc44Swilfried { "host-prohib", ICMP_UNREACH, ICMP_UNREACH_HOST_PROHIB }, 147082ebc44Swilfried { "net-tos", ICMP_UNREACH, ICMP_UNREACH_TOSNET }, 148082ebc44Swilfried { "host-tos", ICMP_UNREACH, ICMP_UNREACH_TOSHOST }, 149082ebc44Swilfried { "filter-prohib", ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB }, 150082ebc44Swilfried { "host-preced", ICMP_UNREACH, ICMP_UNREACH_HOST_PRECEDENCE }, 151082ebc44Swilfried { "cutoff-preced", ICMP_UNREACH, ICMP_UNREACH_PRECEDENCE_CUTOFF }, 152082ebc44Swilfried { "redir-net", ICMP_REDIRECT, ICMP_REDIRECT_NET }, 153082ebc44Swilfried { "redir-host", ICMP_REDIRECT, ICMP_REDIRECT_HOST }, 154082ebc44Swilfried { "redir-tos-net", ICMP_REDIRECT, ICMP_REDIRECT_TOSNET }, 155082ebc44Swilfried { "redir-tos-host", ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST }, 15602cbcc9eSwilfried { "normal-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NORMAL }, 15702cbcc9eSwilfried { "common-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NOROUTE_COMMON }, 158082ebc44Swilfried { "transit", ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS }, 159082ebc44Swilfried { "reassemb", ICMP_TIMXCEED, ICMP_TIMXCEED_REASS }, 160082ebc44Swilfried { "badhead", ICMP_PARAMPROB, ICMP_PARAMPROB_ERRATPTR }, 161082ebc44Swilfried { "optmiss", ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT }, 16202cbcc9eSwilfried { "badlen", ICMP_PARAMPROB, ICMP_PARAMPROB_LENGTH }, 16302cbcc9eSwilfried { "unknown-ind", ICMP_PHOTURIS, ICMP_PHOTURIS_UNKNOWN_INDEX }, 16402cbcc9eSwilfried { "auth-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_AUTH_FAILED }, 16502cbcc9eSwilfried { "decrypt-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_DECRYPT_FAILED } 166082ebc44Swilfried }; 167082ebc44Swilfried 1687d27d81aSdhartmei static const struct icmpcodeent icmp6_code[] = { 1691d32ee3bSdhartmei { "admin-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN }, 1701d32ee3bSdhartmei { "noroute-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE }, 17130620b12Sfrantzen { "notnbr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOTNEIGHBOR }, 17230620b12Sfrantzen { "beyond-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_BEYONDSCOPE }, 17330620b12Sfrantzen { "addr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR }, 17430620b12Sfrantzen { "port-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT }, 17530620b12Sfrantzen { "transit", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT }, 17630620b12Sfrantzen { "reassemb", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY }, 17730620b12Sfrantzen { "badhead", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER }, 17830620b12Sfrantzen { "nxthdr", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER }, 17930620b12Sfrantzen { "redironlink", ND_REDIRECT, ND_REDIRECT_ONLINK }, 18030620b12Sfrantzen { "redirrouter", ND_REDIRECT, ND_REDIRECT_ROUTER } 18130620b12Sfrantzen }; 18230620b12Sfrantzen 183d593fb91Sdrahn const struct pf_timeout pf_timeouts[] = { 184d593fb91Sdrahn { "tcp.first", PFTM_TCP_FIRST_PACKET }, 185d593fb91Sdrahn { "tcp.opening", PFTM_TCP_OPENING }, 186d593fb91Sdrahn { "tcp.established", PFTM_TCP_ESTABLISHED }, 187d593fb91Sdrahn { "tcp.closing", PFTM_TCP_CLOSING }, 188d593fb91Sdrahn { "tcp.finwait", PFTM_TCP_FIN_WAIT }, 189d593fb91Sdrahn { "tcp.closed", PFTM_TCP_CLOSED }, 19098d12bd8Sfrantzen { "tcp.tsdiff", PFTM_TS_DIFF }, 191d593fb91Sdrahn { "udp.first", PFTM_UDP_FIRST_PACKET }, 192d593fb91Sdrahn { "udp.single", PFTM_UDP_SINGLE }, 193d593fb91Sdrahn { "udp.multiple", PFTM_UDP_MULTIPLE }, 194d593fb91Sdrahn { "icmp.first", PFTM_ICMP_FIRST_PACKET }, 195d593fb91Sdrahn { "icmp.error", PFTM_ICMP_ERROR_REPLY }, 196d593fb91Sdrahn { "other.first", PFTM_OTHER_FIRST_PACKET }, 197d593fb91Sdrahn { "other.single", PFTM_OTHER_SINGLE }, 198d593fb91Sdrahn { "other.multiple", PFTM_OTHER_MULTIPLE }, 199d593fb91Sdrahn { "frag", PFTM_FRAG }, 200d593fb91Sdrahn { "interval", PFTM_INTERVAL }, 201a85e74a5Sdhartmei { "adaptive.start", PFTM_ADAPTIVE_START }, 202a85e74a5Sdhartmei { "adaptive.end", PFTM_ADAPTIVE_END }, 203fd777407Smcbride { "src.track", PFTM_SRC_NODE }, 204d593fb91Sdrahn { NULL, 0 } 205d593fb91Sdrahn }; 206d593fb91Sdrahn 2077d27d81aSdhartmei const struct icmptypeent * 208bb9f691eSmcbride geticmptypebynumber(u_int8_t type, sa_family_t af) 209082ebc44Swilfried { 210ed99c291Sderaadt unsigned int i; 211082ebc44Swilfried 212d14c53d7Swilfried if (af != AF_INET6) { 213e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 214e4ebe044Shenning i++) { 215082ebc44Swilfried if (type == icmp_type[i].type) 216082ebc44Swilfried return (&icmp_type[i]); 217082ebc44Swilfried } 21830620b12Sfrantzen } else { 21930620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 22030620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 22130620b12Sfrantzen if (type == icmp6_type[i].type) 22230620b12Sfrantzen return (&icmp6_type[i]); 22330620b12Sfrantzen } 22430620b12Sfrantzen } 22530620b12Sfrantzen return (NULL); 226082ebc44Swilfried } 227082ebc44Swilfried 2287d27d81aSdhartmei const struct icmptypeent * 229bb9f691eSmcbride geticmptypebyname(char *w, sa_family_t af) 230082ebc44Swilfried { 231ed99c291Sderaadt unsigned int i; 232082ebc44Swilfried 233d14c53d7Swilfried if (af != AF_INET6) { 234e4ebe044Shenning for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); 235e4ebe044Shenning i++) { 236082ebc44Swilfried if (!strcmp(w, icmp_type[i].name)) 237082ebc44Swilfried return (&icmp_type[i]); 238082ebc44Swilfried } 23930620b12Sfrantzen } else { 24030620b12Sfrantzen for (i=0; i < (sizeof (icmp6_type) / 24130620b12Sfrantzen sizeof(icmp6_type[0])); i++) { 24230620b12Sfrantzen if (!strcmp(w, icmp6_type[i].name)) 24330620b12Sfrantzen return (&icmp6_type[i]); 24430620b12Sfrantzen } 24530620b12Sfrantzen } 24630620b12Sfrantzen return (NULL); 247082ebc44Swilfried } 248082ebc44Swilfried 2497d27d81aSdhartmei const struct icmpcodeent * 250bb9f691eSmcbride geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) 251082ebc44Swilfried { 252ed99c291Sderaadt unsigned int i; 253082ebc44Swilfried 254d14c53d7Swilfried if (af != AF_INET6) { 255e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 256e4ebe044Shenning i++) { 25730620b12Sfrantzen if (type == icmp_code[i].type && 25830620b12Sfrantzen code == icmp_code[i].code) 259082ebc44Swilfried return (&icmp_code[i]); 260082ebc44Swilfried } 26130620b12Sfrantzen } else { 26230620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 26330620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 26430620b12Sfrantzen if (type == icmp6_code[i].type && 26530620b12Sfrantzen code == icmp6_code[i].code) 26630620b12Sfrantzen return (&icmp6_code[i]); 26730620b12Sfrantzen } 26830620b12Sfrantzen } 26930620b12Sfrantzen return (NULL); 270082ebc44Swilfried } 271082ebc44Swilfried 2727d27d81aSdhartmei const struct icmpcodeent * 273bb9f691eSmcbride geticmpcodebyname(u_long type, char *w, sa_family_t af) 274082ebc44Swilfried { 275ed99c291Sderaadt unsigned int i; 276082ebc44Swilfried 277d14c53d7Swilfried if (af != AF_INET6) { 278e4ebe044Shenning for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); 279e4ebe044Shenning i++) { 28030620b12Sfrantzen if (type == icmp_code[i].type && 28130620b12Sfrantzen !strcmp(w, icmp_code[i].name)) 282082ebc44Swilfried return (&icmp_code[i]); 283082ebc44Swilfried } 28430620b12Sfrantzen } else { 28530620b12Sfrantzen for (i=0; i < (sizeof (icmp6_code) / 28630620b12Sfrantzen sizeof(icmp6_code[0])); i++) { 28730620b12Sfrantzen if (type == icmp6_code[i].type && 28830620b12Sfrantzen !strcmp(w, icmp6_code[i].name)) 28930620b12Sfrantzen return (&icmp6_code[i]); 29030620b12Sfrantzen } 29130620b12Sfrantzen } 29230620b12Sfrantzen return (NULL); 29330620b12Sfrantzen } 29430620b12Sfrantzen 29581a15e5dSderaadt void 2965d9ac2dcSdhartmei print_op(u_int8_t op, const char *a1, const char *a2) 2975d9ac2dcSdhartmei { 2985d9ac2dcSdhartmei if (op == PF_OP_IRG) 2995d9ac2dcSdhartmei printf(" %s >< %s", a1, a2); 3005d9ac2dcSdhartmei else if (op == PF_OP_XRG) 3015d9ac2dcSdhartmei printf(" %s <> %s", a1, a2); 3021308506cShenning else if (op == PF_OP_EQ) 3035d9ac2dcSdhartmei printf(" = %s", a1); 3041308506cShenning else if (op == PF_OP_NE) 3055d9ac2dcSdhartmei printf(" != %s", a1); 3061308506cShenning else if (op == PF_OP_LT) 3075d9ac2dcSdhartmei printf(" < %s", a1); 3085d9ac2dcSdhartmei else if (op == PF_OP_LE) 3095d9ac2dcSdhartmei printf(" <= %s", a1); 3105d9ac2dcSdhartmei else if (op == PF_OP_GT) 3115d9ac2dcSdhartmei printf(" > %s", a1); 3125d9ac2dcSdhartmei else if (op == PF_OP_GE) 3135d9ac2dcSdhartmei printf(" >= %s", a1); 3148da4e377Smcbride else if (op == PF_OP_RRG) 3158da4e377Smcbride printf(" %s:%s", a1, a2); 3165d9ac2dcSdhartmei } 3175d9ac2dcSdhartmei 3185d9ac2dcSdhartmei void 319132c30ccShenning print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto) 32014a9b182Skjell { 321e31d21c9Sdhartmei char a1[6], a2[6]; 322e4ebe044Shenning struct servent *s; 32381a15e5dSderaadt 324e4ebe044Shenning s = getservbyport(p1, proto); 32514a9b182Skjell p1 = ntohs(p1); 32614a9b182Skjell p2 = ntohs(p2); 3275d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", p1); 3285d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", p2); 32914a9b182Skjell printf(" port"); 3305d9ac2dcSdhartmei if (s != NULL && (op == PF_OP_EQ || op == PF_OP_NE)) 3315d9ac2dcSdhartmei print_op(op, s->s_name, a2); 33214a9b182Skjell else 3335d9ac2dcSdhartmei print_op(op, a1, a2); 3345d9ac2dcSdhartmei } 3355d9ac2dcSdhartmei 3365d9ac2dcSdhartmei void 3371173271aScedric print_ugid(u_int8_t op, unsigned u1, unsigned u2, const char *t, unsigned umax) 3385d9ac2dcSdhartmei { 339d8fcd2dfSdhartmei char a1[11], a2[11]; 3405d9ac2dcSdhartmei 3415d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", u1); 3425d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", u2); 3435d9ac2dcSdhartmei printf(" %s", t); 3441173271aScedric if (u1 == umax && (op == PF_OP_EQ || op == PF_OP_NE)) 345c16ab608Sdhartmei print_op(op, "unknown", a2); 346c16ab608Sdhartmei else 347c16ab608Sdhartmei print_op(op, a1, a2); 348c16ab608Sdhartmei } 349c16ab608Sdhartmei 350c16ab608Sdhartmei void 35114a9b182Skjell print_flags(u_int8_t f) 35214a9b182Skjell { 35314a9b182Skjell int i; 35481a15e5dSderaadt 355bc795af0Shugh for (i = 0; tcpflags[i]; ++i) 35614a9b182Skjell if (f & (1 << i)) 35714a9b182Skjell printf("%c", tcpflags[i]); 35814a9b182Skjell } 35914a9b182Skjell 36014a9b182Skjell void 36164b4b616Sfrantzen print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, 36244f5ed0aScedric sa_family_t af, u_int8_t proto, int verbose) 36315e76891Sdhartmei { 36464b4b616Sfrantzen char buf[PF_OSFP_LEN*3]; 3651173271aScedric if (src->addr.type == PF_ADDR_ADDRMASK && 3661173271aScedric dst->addr.type == PF_ADDR_ADDRMASK && 367bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.addr, AF_INET6) && 368bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.mask, AF_INET6) && 3691173271aScedric PF_AZERO(&dst->addr.v.a.addr, AF_INET6) && 3701173271aScedric PF_AZERO(&dst->addr.v.a.mask, AF_INET6) && 371d4008a34Sdhartmei !src->neg && !dst->neg && 37264b4b616Sfrantzen !src->port_op && !dst->port_op && 37364b4b616Sfrantzen osfp == PF_OSFP_ANY) 37415e76891Sdhartmei printf(" all"); 37515e76891Sdhartmei else { 37615e76891Sdhartmei printf(" from "); 377d4008a34Sdhartmei if (src->neg) 37815e76891Sdhartmei printf("! "); 37944f5ed0aScedric print_addr(&src->addr, af, verbose); 38015e76891Sdhartmei if (src->port_op) 38115e76891Sdhartmei print_port(src->port_op, src->port[0], 38215e76891Sdhartmei src->port[1], 38315e76891Sdhartmei proto == IPPROTO_TCP ? "tcp" : "udp"); 38464b4b616Sfrantzen if (osfp != PF_OSFP_ANY) 38564b4b616Sfrantzen printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, 38664b4b616Sfrantzen sizeof(buf))); 38715e76891Sdhartmei 38815e76891Sdhartmei printf(" to "); 389d4008a34Sdhartmei if (dst->neg) 39015e76891Sdhartmei printf("! "); 39144f5ed0aScedric print_addr(&dst->addr, af, verbose); 39215e76891Sdhartmei if (dst->port_op) 39315e76891Sdhartmei print_port(dst->port_op, dst->port[0], 39415e76891Sdhartmei dst->port[1], 39515e76891Sdhartmei proto == IPPROTO_TCP ? "tcp" : "udp"); 39615e76891Sdhartmei } 39715e76891Sdhartmei } 39815e76891Sdhartmei 39915e76891Sdhartmei void 400e0c302d0Smcbride print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, 401e0c302d0Smcbride sa_family_t af, int id) 4023a44df3cSmcbride { 4033a44df3cSmcbride struct pf_pooladdr *pooladdr; 4043a44df3cSmcbride 4056c917913Smcbride if ((TAILQ_FIRST(&pool->list) != NULL) && 4066c917913Smcbride TAILQ_NEXT(TAILQ_FIRST(&pool->list), entries) != NULL) 4073a44df3cSmcbride printf("{ "); 4083a44df3cSmcbride TAILQ_FOREACH(pooladdr, &pool->list, entries){ 4093a44df3cSmcbride switch (id) { 410e8793aa9Smcbride case PF_NAT: 411e8793aa9Smcbride case PF_RDR: 412e8793aa9Smcbride case PF_BINAT: 41320b4324fScedric print_addr(&pooladdr->addr, af, 0); 4143a44df3cSmcbride break; 415e8793aa9Smcbride case PF_PASS: 416*e9953237Shenning case PF_MATCH: 41720b4324fScedric if (PF_AZERO(&pooladdr->addr.v.a.addr, af)) 4183b9b234fSmcbride printf("%s", pooladdr->ifname); 419790504a6Sdhartmei else { 4203a44df3cSmcbride printf("(%s ", pooladdr->ifname); 42120b4324fScedric print_addr(&pooladdr->addr, af, 0); 4223a44df3cSmcbride printf(")"); 4233b9b234fSmcbride } 4243a44df3cSmcbride break; 425e8793aa9Smcbride default: 426e8793aa9Smcbride break; 4273a44df3cSmcbride } 4283a44df3cSmcbride if (TAILQ_NEXT(pooladdr, entries) != NULL) 4293a44df3cSmcbride printf(", "); 4303a44df3cSmcbride else if (TAILQ_NEXT(TAILQ_FIRST(&pool->list), entries) != NULL) 4313a44df3cSmcbride printf(" }"); 4323a44df3cSmcbride } 433e0c302d0Smcbride switch (id) { 434e8793aa9Smcbride case PF_NAT: 4359782f7a2Smcbride if ((p1 != PF_NAT_PROXY_PORT_LOW || 4369782f7a2Smcbride p2 != PF_NAT_PROXY_PORT_HIGH) && (p1 != 0 || p2 != 0)) { 437e0c302d0Smcbride if (p1 == p2) 438e0c302d0Smcbride printf(" port %u", p1); 439e0c302d0Smcbride else 440e0c302d0Smcbride printf(" port %u:%u", p1, p2); 441e0c302d0Smcbride } 442e0c302d0Smcbride break; 443e8793aa9Smcbride case PF_RDR: 444e0c302d0Smcbride if (p1) { 4458da4e377Smcbride printf(" port %u", p1); 4468da4e377Smcbride if (p2 && (p2 != p1)) 4478da4e377Smcbride printf(":%u", p2); 448e0c302d0Smcbride } 449e0c302d0Smcbride break; 450e0c302d0Smcbride default: 451e0c302d0Smcbride break; 452e0c302d0Smcbride } 453e0c302d0Smcbride switch (pool->opts & PF_POOL_TYPEMASK) { 454e0c302d0Smcbride case PF_POOL_NONE: 455e0c302d0Smcbride break; 456e0c302d0Smcbride case PF_POOL_BITMASK: 457e0c302d0Smcbride printf(" bitmask"); 458e0c302d0Smcbride break; 459e0c302d0Smcbride case PF_POOL_RANDOM: 460e0c302d0Smcbride printf(" random"); 461e0c302d0Smcbride break; 462e0c302d0Smcbride case PF_POOL_SRCHASH: 4630436fa02Smcbride printf(" source-hash 0x%08x%08x%08x%08x", 464e0c302d0Smcbride pool->key.key32[0], pool->key.key32[1], 465e0c302d0Smcbride pool->key.key32[2], pool->key.key32[3]); 466e0c302d0Smcbride break; 467e0c302d0Smcbride case PF_POOL_ROUNDROBIN: 468e0c302d0Smcbride printf(" round-robin"); 469e0c302d0Smcbride break; 470e0c302d0Smcbride } 471fd777407Smcbride if (pool->opts & PF_POOL_STICKYADDR) 472fd777407Smcbride printf(" sticky-address"); 4739782f7a2Smcbride if (id == PF_NAT && p1 == 0 && p2 == 0) 474e0c302d0Smcbride printf(" static-port"); 4753a44df3cSmcbride } 4763a44df3cSmcbride 477132c30ccShenning const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 4786b640f62Smcbride const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES; 479132c30ccShenning const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; 480fd777407Smcbride const char *pf_scounters[FCNT_MAX+1] = FCNT_NAMES; 48199a73934Sderaadt 48214a9b182Skjell void 483fd777407Smcbride print_status(struct pf_status *s, int opts) 48414a9b182Skjell { 4855191b30fScedric char statline[80], *running; 486c474e331Shenning time_t runtime; 48799a73934Sderaadt int i; 488a1973c63Ssturm char buf[PF_MD5_DIGEST_LENGTH * 2 + 1]; 489010eb8d3Smpf static const char hex[] = "0123456789abcdef"; 49099a73934Sderaadt 491c474e331Shenning runtime = time(NULL) - s->since; 4925191b30fScedric running = s->running ? "Enabled" : "Disabled"; 493c474e331Shenning 4945191b30fScedric if (s->since) { 495db93f2f1Sderaadt unsigned int sec, min, hrs, day = runtime; 496d85e4ad6Sdhartmei 497d85e4ad6Sdhartmei sec = day % 60; 498d85e4ad6Sdhartmei day /= 60; 499d85e4ad6Sdhartmei min = day % 60; 500d85e4ad6Sdhartmei day /= 60; 501d85e4ad6Sdhartmei hrs = day % 24; 502d85e4ad6Sdhartmei day /= 24; 503c474e331Shenning snprintf(statline, sizeof(statline), 5045191b30fScedric "Status: %s for %u days %.2u:%.2u:%.2u", 5055191b30fScedric running, day, hrs, min, sec); 506d85e4ad6Sdhartmei } else 5075191b30fScedric snprintf(statline, sizeof(statline), "Status: %s", running); 508c97b4ee1Shenning printf("%-44s", statline); 509ae58c8acSdhartmei switch (s->debug) { 510a1d6f6e2Shenning case PF_DEBUG_NONE: 511c97b4ee1Shenning printf("%15s\n\n", "Debug: None"); 512ae58c8acSdhartmei break; 513a1d6f6e2Shenning case PF_DEBUG_URGENT: 514c97b4ee1Shenning printf("%15s\n\n", "Debug: Urgent"); 515ae58c8acSdhartmei break; 516a1d6f6e2Shenning case PF_DEBUG_MISC: 517c97b4ee1Shenning printf("%15s\n\n", "Debug: Misc"); 518ae58c8acSdhartmei break; 519a1d6f6e2Shenning case PF_DEBUG_NOISY: 520a1d6f6e2Shenning printf("%15s\n\n", "Debug: Loud"); 521a1d6f6e2Shenning break; 522ae58c8acSdhartmei } 523f6e85b8dSmcbride 524f6e85b8dSmcbride if (opts & PF_OPT_VERBOSE) { 525010eb8d3Smpf printf("Hostid: 0x%08x\n", ntohl(s->hostid)); 526010eb8d3Smpf 527a1973c63Ssturm for (i = 0; i < PF_MD5_DIGEST_LENGTH; i++) { 528010eb8d3Smpf buf[i + i] = hex[s->pf_chksum[i] >> 4]; 529010eb8d3Smpf buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; 530010eb8d3Smpf } 531010eb8d3Smpf buf[i + i] = '\0'; 532010eb8d3Smpf printf("Checksum: 0x%s\n\n", buf); 533f6e85b8dSmcbride } 534010eb8d3Smpf 535c474e331Shenning if (s->ifname[0] != 0) { 536c474e331Shenning printf("Interface Stats for %-16s %5s %16s\n", 537c474e331Shenning s->ifname, "IPv4", "IPv6"); 538c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes In", 539ef22e615Sdhartmei (unsigned long long)s->bcounters[0][0], 540ef22e615Sdhartmei (unsigned long long)s->bcounters[1][0]); 541c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes Out", 542ef22e615Sdhartmei (unsigned long long)s->bcounters[0][1], 543ef22e615Sdhartmei (unsigned long long)s->bcounters[1][1]); 544c474e331Shenning printf(" Packets In\n"); 545c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 546ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_PASS], 547ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_PASS]); 548c474e331Shenning printf(" %-23s %14llu %16llu\n", "Blocked", 549ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_DROP], 550ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_DROP]); 551c474e331Shenning printf(" Packets Out\n"); 552c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 553ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_PASS], 554ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_PASS]); 555c474e331Shenning printf(" %-23s %14llu %16llu\n\n", "Blocked", 556ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_DROP], 557ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_DROP]); 558c474e331Shenning } 559c474e331Shenning printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); 560c474e331Shenning printf(" %-25s %14u %14s\n", "current entries", s->states, ""); 561c474e331Shenning for (i = 0; i < FCNT_MAX; i++) { 562ea4ec064Sitojun printf(" %-25s %14llu ", pf_fcounters[i], 563ea4ec064Sitojun (unsigned long long)s->fcounters[i]); 564c474e331Shenning if (runtime > 0) 565c474e331Shenning printf("%14.1f/s\n", 566c474e331Shenning (double)s->fcounters[i] / (double)runtime); 567c474e331Shenning else 568c474e331Shenning printf("%14s\n", ""); 569c474e331Shenning } 570fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 571fd777407Smcbride printf("Source Tracking Table\n"); 572fd777407Smcbride printf(" %-25s %14u %14s\n", "current entries", 573fd777407Smcbride s->src_nodes, ""); 574fd777407Smcbride for (i = 0; i < SCNT_MAX; i++) { 575fd777407Smcbride printf(" %-25s %14lld ", pf_scounters[i], 576fd777407Smcbride s->scounters[i]); 577fd777407Smcbride if (runtime > 0) 578fd777407Smcbride printf("%14.1f/s\n", 579fd777407Smcbride (double)s->scounters[i] / (double)runtime); 580fd777407Smcbride else 581fd777407Smcbride printf("%14s\n", ""); 582fd777407Smcbride } 583fd777407Smcbride } 58499a73934Sderaadt printf("Counters\n"); 585c474e331Shenning for (i = 0; i < PFRES_MAX; i++) { 586ea4ec064Sitojun printf(" %-25s %14llu ", pf_reasons[i], 587ea4ec064Sitojun (unsigned long long)s->counters[i]); 588c474e331Shenning if (runtime > 0) 589c474e331Shenning printf("%14.1f/s\n", 590c474e331Shenning (double)s->counters[i] / (double)runtime); 591c474e331Shenning else 592c474e331Shenning printf("%14s\n", ""); 593c474e331Shenning } 5946b640f62Smcbride if (opts & PF_OPT_VERBOSE) { 5956b640f62Smcbride printf("Limit Counters\n"); 5966b640f62Smcbride for (i = 0; i < LCNT_MAX; i++) { 5976b640f62Smcbride printf(" %-25s %14lld ", pf_lcounters[i], 5986b640f62Smcbride s->lcounters[i]); 5996b640f62Smcbride if (runtime > 0) 6006b640f62Smcbride printf("%14.1f/s\n", 6016b640f62Smcbride (double)s->lcounters[i] / (double)runtime); 6026b640f62Smcbride else 6036b640f62Smcbride printf("%14s\n", ""); 6046b640f62Smcbride } 6056b640f62Smcbride } 60614a9b182Skjell } 60714a9b182Skjell 60814a9b182Skjell void 609fd777407Smcbride print_src_node(struct pf_src_node *sn, int opts) 610fd777407Smcbride { 611fd777407Smcbride struct pf_addr_wrap aw; 612fd777407Smcbride int min, sec; 613fd777407Smcbride 614fd777407Smcbride memset(&aw, 0, sizeof(aw)); 615fd777407Smcbride if (sn->af == AF_INET) 616fd777407Smcbride aw.v.a.mask.addr32[0] = 0xffffffff; 617fd777407Smcbride else 618fd777407Smcbride memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); 619fd777407Smcbride 620fd777407Smcbride aw.v.a.addr = sn->addr; 621fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 622fd777407Smcbride printf(" -> "); 623fd777407Smcbride aw.v.a.addr = sn->raddr; 624fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 6256b640f62Smcbride printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, 6266b640f62Smcbride sn->conn, sn->conn_rate.count / 1000, 6276b640f62Smcbride (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); 628fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 629fd777407Smcbride sec = sn->creation % 60; 630fd777407Smcbride sn->creation /= 60; 631fd777407Smcbride min = sn->creation % 60; 632fd777407Smcbride sn->creation /= 60; 633fd777407Smcbride printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); 634fd777407Smcbride if (sn->states == 0) { 635fd777407Smcbride sec = sn->expire % 60; 636fd777407Smcbride sn->expire /= 60; 637fd777407Smcbride min = sn->expire % 60; 638fd777407Smcbride sn->expire /= 60; 639fd777407Smcbride printf(", expires in %.2u:%.2u:%.2u", 640fd777407Smcbride sn->expire, min, sec); 641fd777407Smcbride } 642b19e9e6fSmcbride printf(", %llu pkts, %llu bytes", 643b19e9e6fSmcbride sn->packets[0] + sn->packets[1], 64459b61cdeShenning sn->bytes[0] + sn->bytes[1]); 645fd777407Smcbride switch (sn->ruletype) { 646fd777407Smcbride case PF_NAT: 647fd777407Smcbride if (sn->rule.nr != -1) 648fd777407Smcbride printf(", nat rule %u", sn->rule.nr); 649fd777407Smcbride break; 650fd777407Smcbride case PF_RDR: 651fd777407Smcbride if (sn->rule.nr != -1) 652fd777407Smcbride printf(", rdr rule %u", sn->rule.nr); 653fd777407Smcbride break; 654fd777407Smcbride case PF_PASS: 655*e9953237Shenning case PF_MATCH: 656fd777407Smcbride if (sn->rule.nr != -1) 657fd777407Smcbride printf(", filter rule %u", sn->rule.nr); 658fd777407Smcbride break; 659fd777407Smcbride } 660fd777407Smcbride printf("\n"); 661fd777407Smcbride } 662fd777407Smcbride } 663fd777407Smcbride 664fd777407Smcbride void 665d9ad7941Sdhartmei print_rule(struct pf_rule *r, const char *anchor_call, int verbose) 66614a9b182Skjell { 6670e8bc214Saaron static const char *actiontypes[] = { "pass", "block", "scrub", 668*e9953237Shenning "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", 669*e9953237Shenning "", "", "match"}; 6701173271aScedric static const char *anchortypes[] = { "anchor", "anchor", "anchor", 6710e8bc214Saaron "anchor", "nat-anchor", "nat-anchor", "binat-anchor", 6720e8bc214Saaron "binat-anchor", "rdr-anchor", "rdr-anchor" }; 673cc5f0329Sdhartmei int i, opts; 674cc5f0329Sdhartmei 67574dc4fddShenning if (verbose) 67678baf774Sdhartmei printf("@%d ", r->nr); 677*e9953237Shenning if (r->action > PF_MATCH) 6781173271aScedric printf("action(%d)", r->action); 679305ca21dSmcbride else if (anchor_call[0]) { 680305ca21dSmcbride if (anchor_call[0] == '_') { 681305ca21dSmcbride printf("%s", anchortypes[r->action]); 682305ca21dSmcbride } else 683e77e5dc4Sjaredy printf("%s \"%s\"", anchortypes[r->action], 684e77e5dc4Sjaredy anchor_call); 685305ca21dSmcbride } else { 6861173271aScedric printf("%s", actiontypes[r->action]); 687fde34e86Shenning if (r->natpass) 688fde34e86Shenning printf(" pass"); 689fde34e86Shenning } 6901173271aScedric if (r->action == PF_DROP) { 6918a87542aShenning if (r->rule_flag & PFRULE_RETURN) 6928a87542aShenning printf(" return"); 6938a87542aShenning else if (r->rule_flag & PFRULE_RETURNRST) { 6941f77cc8aSpb if (!r->return_ttl) 69514a9b182Skjell printf(" return-rst"); 6961f77cc8aSpb else 6971f77cc8aSpb printf(" return-rst(ttl %d)", r->return_ttl); 698328b2decShenning } else if (r->rule_flag & PFRULE_RETURNICMP) { 699328b2decShenning const struct icmpcodeent *ic, *ic6; 700b996d042Sdhartmei 701b996d042Sdhartmei ic = geticmpcodebynumber(r->return_icmp >> 8, 702328b2decShenning r->return_icmp & 255, AF_INET); 703328b2decShenning ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, 704328b2decShenning r->return_icmp6 & 255, AF_INET6); 705d14c53d7Swilfried 706328b2decShenning switch (r->af) { 707328b2decShenning case AF_INET: 708328b2decShenning printf(" return-icmp"); 709d14c53d7Swilfried if (ic == NULL) 710d14c53d7Swilfried printf("(%u)", r->return_icmp & 255); 711b996d042Sdhartmei else 712328b2decShenning printf("(%s)", ic->name); 713328b2decShenning break; 714328b2decShenning case AF_INET6: 715328b2decShenning printf(" return-icmp6"); 716328b2decShenning if (ic6 == NULL) 717328b2decShenning printf("(%u)", r->return_icmp6 & 255); 718328b2decShenning else 719328b2decShenning printf("(%s)", ic6->name); 720328b2decShenning break; 721328b2decShenning default: 722328b2decShenning printf(" return-icmp"); 723328b2decShenning if (ic == NULL) 724328b2decShenning printf("(%u, ", r->return_icmp & 255); 725328b2decShenning else 726328b2decShenning printf("(%s, ", ic->name); 727328b2decShenning if (ic6 == NULL) 728328b2decShenning printf("%u)", r->return_icmp6 & 255); 729328b2decShenning else 730328b2decShenning printf("%s)", ic6->name); 731328b2decShenning break; 732328b2decShenning } 733acf2444cShenning } else 734acf2444cShenning printf(" drop"); 7351173271aScedric } 7367189e280Sdhartmei if (r->direction == PF_IN) 73714a9b182Skjell printf(" in"); 7387189e280Sdhartmei else if (r->direction == PF_OUT) 73914a9b182Skjell printf(" out"); 740a46dc179Sdhartmei if (r->log) { 741a46dc179Sdhartmei printf(" log"); 742f565c2a8Shenning if (r->log & ~PF_LOG || r->logif) { 7431cb19346Sdhartmei int count = 0; 7441cb19346Sdhartmei 745a46dc179Sdhartmei printf(" ("); 7461cb19346Sdhartmei if (r->log & PF_LOG_ALL) 7471cb19346Sdhartmei printf("%sall", count++ ? ", " : ""); 748a46dc179Sdhartmei if (r->log & PF_LOG_SOCKET_LOOKUP) 7491cb19346Sdhartmei printf("%suser", count++ ? ", " : ""); 750f565c2a8Shenning if (r->logif) 751f565c2a8Shenning printf("%sto pflog%u", count++ ? ", " : "", 752f565c2a8Shenning r->logif); 753a46dc179Sdhartmei printf(")"); 754a46dc179Sdhartmei } 755a46dc179Sdhartmei } 75614a9b182Skjell if (r->quick) 75714a9b182Skjell printf(" quick"); 7587d0c9138Shenning if (r->ifname[0]) { 7597d0c9138Shenning if (r->ifnot) 7607d0c9138Shenning printf(" on ! %s", r->ifname); 7617d0c9138Shenning else 76214a9b182Skjell printf(" on %s", r->ifname); 7637d0c9138Shenning } 764cb3a4e31Sjasoni if (r->rt) { 765cb3a4e31Sjasoni if (r->rt == PF_ROUTETO) 766cb3a4e31Sjasoni printf(" route-to"); 767fa1cdd09Sdhartmei else if (r->rt == PF_REPLYTO) 768fa1cdd09Sdhartmei printf(" reply-to"); 769cb3a4e31Sjasoni else if (r->rt == PF_DUPTO) 770cb3a4e31Sjasoni printf(" dup-to"); 771cb3a4e31Sjasoni else if (r->rt == PF_FASTROUTE) 772cb3a4e31Sjasoni printf(" fastroute"); 773790504a6Sdhartmei if (r->rt != PF_FASTROUTE) { 774790504a6Sdhartmei printf(" "); 7751df6a140Scedric print_pool(&r->rpool, 0, 0, r->af, PF_PASS); 776790504a6Sdhartmei } 777cb3a4e31Sjasoni } 77830620b12Sfrantzen if (r->af) { 77930620b12Sfrantzen if (r->af == AF_INET) 78030620b12Sfrantzen printf(" inet"); 78130620b12Sfrantzen else 78230620b12Sfrantzen printf(" inet6"); 78330620b12Sfrantzen } 78414a9b182Skjell if (r->proto) { 785e4ebe044Shenning struct protoent *p; 786ed99c291Sderaadt 787e4ebe044Shenning if ((p = getprotobynumber(r->proto)) != NULL) 78814a9b182Skjell printf(" proto %s", p->p_name); 78914a9b182Skjell else 79014a9b182Skjell printf(" proto %u", r->proto); 79114a9b182Skjell } 79264b4b616Sfrantzen print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, 79364b4b616Sfrantzen verbose); 794c16ab608Sdhartmei if (r->uid.op) 7951173271aScedric print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user", 7961173271aScedric UID_MAX); 797c16ab608Sdhartmei if (r->gid.op) 7981173271aScedric print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group", 7991173271aScedric GID_MAX); 80014a9b182Skjell if (r->flags || r->flagset) { 80114a9b182Skjell printf(" flags "); 80214a9b182Skjell print_flags(r->flags); 80314a9b182Skjell printf("/"); 80414a9b182Skjell print_flags(r->flagset); 805*e9953237Shenning } else if ((r->action == PF_PASS || r->action == PF_MATCH) && 806bd9b24faSmcbride (!r->proto || r->proto == IPPROTO_TCP) && 807bd9b24faSmcbride !(r->rule_flag & PFRULE_FRAGMENT) && 808be73131dSmcbride !anchor_call[0] && r->keep_state) 809bd9b24faSmcbride printf(" flags any"); 810082ebc44Swilfried if (r->type) { 811b49ca6bbShenning const struct icmptypeent *it; 812082ebc44Swilfried 813b49ca6bbShenning it = geticmptypebynumber(r->type-1, r->af); 814d14c53d7Swilfried if (r->af != AF_INET6) 815d14c53d7Swilfried printf(" icmp-type"); 816082ebc44Swilfried else 817d0cb3502Smcbride printf(" icmp6-type"); 818b49ca6bbShenning if (it != NULL) 819b49ca6bbShenning printf(" %s", it->name); 820d14c53d7Swilfried else 821d14c53d7Swilfried printf(" %u", r->type-1); 822082ebc44Swilfried if (r->code) { 823b49ca6bbShenning const struct icmpcodeent *ic; 824082ebc44Swilfried 825b49ca6bbShenning ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); 826b49ca6bbShenning if (ic != NULL) 827b49ca6bbShenning printf(" code %s", ic->name); 828082ebc44Swilfried else 82914a9b182Skjell printf(" code %u", r->code-1); 830082ebc44Swilfried } 831082ebc44Swilfried } 832e4cbe364Sdhartmei if (r->tos) 833e4cbe364Sdhartmei printf(" tos 0x%2.2x", r->tos); 834bd9b24faSmcbride if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) 835f644f0ccSmcbride printf(" no state"); 836f644f0ccSmcbride else if (r->keep_state == PF_STATE_NORMAL) 83714a9b182Skjell printf(" keep state"); 838b96c47abSfrantzen else if (r->keep_state == PF_STATE_MODULATE) 839b96c47abSfrantzen printf(" modulate state"); 84052e0438eSdhartmei else if (r->keep_state == PF_STATE_SYNPROXY) 84152e0438eSdhartmei printf(" synproxy state"); 84238425613Scedric if (r->prob) { 84338425613Scedric char buf[20]; 84438425613Scedric 84538425613Scedric snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0)); 84638425613Scedric for (i = strlen(buf)-1; i > 0; i--) { 84738425613Scedric if (buf[i] == '0') 84838425613Scedric buf[i] = '\0'; 84938425613Scedric else { 85038425613Scedric if (buf[i] == '.') 85138425613Scedric buf[i] = '\0'; 85238425613Scedric break; 85338425613Scedric } 85438425613Scedric } 85538425613Scedric printf(" probability %s%%", buf); 85638425613Scedric } 857cc5f0329Sdhartmei opts = 0; 858fd777407Smcbride if (r->max_states || r->max_src_nodes || r->max_src_states) 859cc5f0329Sdhartmei opts = 1; 860af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) 861af80fa86Smcbride opts = 1; 862fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) 863fd777407Smcbride opts = 1; 864c1f13696Shenning if (r->rule_flag & PFRULE_IFBOUND) 865ec359bd5Scedric opts = 1; 8664dc07d4cShenning if (r->rule_flag & PFRULE_STATESLOPPY) 8674dc07d4cShenning opts = 1; 868cc5f0329Sdhartmei for (i = 0; !opts && i < PFTM_MAX; ++i) 869cc5f0329Sdhartmei if (r->timeout[i]) 870cc5f0329Sdhartmei opts = 1; 871cc5f0329Sdhartmei if (opts) { 872cc5f0329Sdhartmei printf(" ("); 873cc5f0329Sdhartmei if (r->max_states) { 874cc5f0329Sdhartmei printf("max %u", r->max_states); 875cc5f0329Sdhartmei opts = 0; 876cc5f0329Sdhartmei } 877af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) { 878af80fa86Smcbride if (!opts) 879af80fa86Smcbride printf(", "); 880af80fa86Smcbride printf("no-sync"); 881af80fa86Smcbride opts = 0; 882af80fa86Smcbride } 883fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) { 884fd777407Smcbride if (!opts) 885fd777407Smcbride printf(", "); 886fd777407Smcbride printf("source-track"); 887fd777407Smcbride if (r->rule_flag & PFRULE_RULESRCTRACK) 888fd777407Smcbride printf(" rule"); 889fd777407Smcbride else 890fd777407Smcbride printf(" global"); 891fd777407Smcbride opts = 0; 892fd777407Smcbride } 893fd777407Smcbride if (r->max_src_states) { 894fd777407Smcbride if (!opts) 895fd777407Smcbride printf(", "); 896fd777407Smcbride printf("max-src-states %u", r->max_src_states); 897fd777407Smcbride opts = 0; 898fd777407Smcbride } 8996b640f62Smcbride if (r->max_src_conn) { 9006b640f62Smcbride if (!opts) 9016b640f62Smcbride printf(", "); 9026b640f62Smcbride printf("max-src-conn %u", r->max_src_conn); 9036b640f62Smcbride opts = 0; 9046b640f62Smcbride } 9056b640f62Smcbride if (r->max_src_conn_rate.limit) { 9066b640f62Smcbride if (!opts) 9076b640f62Smcbride printf(", "); 9086b640f62Smcbride printf("max-src-conn-rate %u/%u", 9096b640f62Smcbride r->max_src_conn_rate.limit, 9106b640f62Smcbride r->max_src_conn_rate.seconds); 9116b640f62Smcbride opts = 0; 9126b640f62Smcbride } 913fd777407Smcbride if (r->max_src_nodes) { 914fd777407Smcbride if (!opts) 915fd777407Smcbride printf(", "); 916fd777407Smcbride printf("max-src-nodes %u", r->max_src_nodes); 917fd777407Smcbride opts = 0; 918fd777407Smcbride } 9196b640f62Smcbride if (r->overload_tblname[0]) { 9206b640f62Smcbride if (!opts) 9216b640f62Smcbride printf(", "); 9226b640f62Smcbride printf("overload <%s>", r->overload_tblname); 9231e320a53Sdhartmei if (r->flush) 9246b640f62Smcbride printf(" flush"); 9251e320a53Sdhartmei if (r->flush & PF_FLUSH_GLOBAL) 9261e320a53Sdhartmei printf(" global"); 9276b640f62Smcbride } 928ec359bd5Scedric if (r->rule_flag & PFRULE_IFBOUND) { 929ec359bd5Scedric if (!opts) 930ec359bd5Scedric printf(", "); 931ec359bd5Scedric printf("if-bound"); 932ec359bd5Scedric opts = 0; 933ec359bd5Scedric } 9344dc07d4cShenning if (r->rule_flag & PFRULE_STATESLOPPY) { 9354dc07d4cShenning if (!opts) 9364dc07d4cShenning printf(", "); 9374dc07d4cShenning printf("sloppy"); 9384dc07d4cShenning opts = 0; 9394dc07d4cShenning } 94018ae10f7Shenning if (r->rule_flag & PFRULE_PFLOW) { 94118ae10f7Shenning if (!opts) 94218ae10f7Shenning printf(", "); 94318ae10f7Shenning printf("pflow"); 94418ae10f7Shenning opts = 0; 94518ae10f7Shenning } 946cc5f0329Sdhartmei for (i = 0; i < PFTM_MAX; ++i) 947cc5f0329Sdhartmei if (r->timeout[i]) { 948ae233f99Sdhartmei int j; 949ae233f99Sdhartmei 950cc5f0329Sdhartmei if (!opts) 951cc5f0329Sdhartmei printf(", "); 952cc5f0329Sdhartmei opts = 0; 9537e5eec99Sdhartmei for (j = 0; pf_timeouts[j].name != NULL; 9547e5eec99Sdhartmei ++j) 955ae233f99Sdhartmei if (pf_timeouts[j].timeout == i) 956ae233f99Sdhartmei break; 9577e5eec99Sdhartmei printf("%s %u", pf_timeouts[j].name == NULL ? 9587e5eec99Sdhartmei "inv.timeout" : pf_timeouts[j].name, 9597e5eec99Sdhartmei r->timeout[i]); 960cc5f0329Sdhartmei } 961cc5f0329Sdhartmei printf(")"); 962cc5f0329Sdhartmei } 963*e9953237Shenning 964*e9953237Shenning if (r->scrub_flags & PFSTATE_NODF || r->min_ttl || r->max_mss) { 965*e9953237Shenning printf(" scrub("); 966*e9953237Shenning if (r->scrub_flags & PFSTATE_NODF) 96767d2a440Sprovos printf(" no-df"); 968*e9953237Shenning if (r->scrub_flags & PFSTATE_RANDOMID) 969edbe3066Sdhartmei printf(" random-id"); 970e258bfd4Sprovos if (r->min_ttl) 97134c76dcbSprovos printf(" min-ttl %d", r->min_ttl); 972*e9953237Shenning if (r->scrub_flags & PFSTATE_SETTOS) 973*e9953237Shenning printf(" set-tos 0x%2.2x", r->set_tos); 974*e9953237Shenning if (r->scrub_flags & PFSTATE_SCRUB_TCP) 975*e9953237Shenning printf(" reassemble tcp"); 976cfa91859Sjasoni if (r->max_mss) 977cfa91859Sjasoni printf(" max-mss %d", r->max_mss); 978*e9953237Shenning printf(")"); 979*e9953237Shenning } 980*e9953237Shenning 981f48d62b3Sdhartmei if (r->allow_opts) 982f48d62b3Sdhartmei printf(" allow-opts"); 983455ef0c1Sdhartmei if (r->label[0]) 984ff45dfa8Scamield printf(" label \"%s\"", r->label); 985f98324c6Shenning if (r->qname[0] && r->pqname[0]) 986f98324c6Shenning printf(" queue(%s, %s)", r->qname, r->pqname); 987f98324c6Shenning else if (r->qname[0]) 98878e1d2a6Shenning printf(" queue %s", r->qname); 9898aecb81aShenning if (r->tagname[0]) 9908aecb81aShenning printf(" tag %s", r->tagname); 99136369899Shenning if (r->match_tagname[0]) { 99236369899Shenning if (r->match_tag_not) 99336369899Shenning printf(" !"); 9940a5f7f2fShenning printf(" tagged %s", r->match_tagname); 99536369899Shenning } 9965e931757Shenning if (r->rtableid != -1) 9975e931757Shenning printf(" rtable %u", r->rtableid); 998eb900600Smarkus if (r->divert.port) { 999eb900600Smarkus if (PF_AZERO(&r->divert.addr, r->af)) { 1000eb900600Smarkus printf(" divert-reply"); 1001eb900600Smarkus } else { 1002eb900600Smarkus /* XXX cut&paste from print_addr */ 1003eb900600Smarkus char buf[48]; 1004eb900600Smarkus 1005eb900600Smarkus printf(" divert-to "); 1006eb900600Smarkus if (inet_ntop(r->af, &r->divert.addr, buf, 1007eb900600Smarkus sizeof(buf)) == NULL) 1008eb900600Smarkus printf("?"); 1009eb900600Smarkus else 1010eb900600Smarkus printf("%s", buf); 1011782435eaSmarkus printf(" port %u", ntohs(r->divert.port)); 1012eb900600Smarkus } 1013eb900600Smarkus } 1014d9ad7941Sdhartmei if (!anchor_call[0] && (r->action == PF_NAT || 1015d0aca2f2Shenning r->action == PF_BINAT || r->action == PF_RDR)) { 1016d0aca2f2Shenning printf(" -> "); 1017d0aca2f2Shenning print_pool(&r->rpool, r->rpool.proxy_port[0], 1018d0aca2f2Shenning r->rpool.proxy_port[1], r->af, r->action); 1019d0aca2f2Shenning } 102014a9b182Skjell } 102114a9b182Skjell 10225b6c447dScedric void 10235b6c447dScedric print_tabledef(const char *name, int flags, int addrs, 10245b6c447dScedric struct node_tinithead *nodes) 10255b6c447dScedric { 10265b6c447dScedric struct node_tinit *ti, *nti; 10275b6c447dScedric struct node_host *h; 10285b6c447dScedric 10295b6c447dScedric printf("table <%s>", name); 10305b6c447dScedric if (flags & PFR_TFLAG_CONST) 10315b6c447dScedric printf(" const"); 10325b6c447dScedric if (flags & PFR_TFLAG_PERSIST) 10335b6c447dScedric printf(" persist"); 10345f03a6e1Smcbride if (flags & PFR_TFLAG_COUNTERS) 10355f03a6e1Smcbride printf(" counters"); 10365b6c447dScedric SIMPLEQ_FOREACH(ti, nodes, entries) { 10375b6c447dScedric if (ti->file) { 10385b6c447dScedric printf(" file \"%s\"", ti->file); 10395b6c447dScedric continue; 10405b6c447dScedric } 10415b6c447dScedric printf(" {"); 10425b6c447dScedric for (;;) { 10435b6c447dScedric for (h = ti->host; h != NULL; h = h->next) { 10445b6c447dScedric printf(h->not ? " !" : " "); 10455b6c447dScedric print_addr(&h->addr, h->af, 0); 10465b6c447dScedric } 10475b6c447dScedric nti = SIMPLEQ_NEXT(ti, entries); 10485b6c447dScedric if (nti != NULL && nti->file == NULL) 10495b6c447dScedric ti = nti; /* merge lists */ 10505b6c447dScedric else 10515b6c447dScedric break; 10525b6c447dScedric } 10535b6c447dScedric printf(" }"); 10545b6c447dScedric } 10555b6c447dScedric if (addrs && SIMPLEQ_EMPTY(nodes)) 10565b6c447dScedric printf(" { }"); 10575b6c447dScedric printf("\n"); 10585b6c447dScedric } 10595b6c447dScedric 10601f8f21bdSmillert int 1061ff352a37Smarkus parse_flags(char *s) 106214a9b182Skjell { 1063ff352a37Smarkus char *p, *q; 106414a9b182Skjell u_int8_t f = 0; 106581a15e5dSderaadt 1066ff352a37Smarkus for (p = s; *p; p++) { 1067ff352a37Smarkus if ((q = strchr(tcpflags, *p)) == NULL) 1068ff352a37Smarkus return -1; 1069ff352a37Smarkus else 1070ff352a37Smarkus f |= 1 << (q - tcpflags); 107114a9b182Skjell } 1072bc795af0Shugh return (f ? f : PF_TH_ALL); 107314a9b182Skjell } 107494e9410bShenning 107594e9410bShenning void 107694e9410bShenning set_ipmask(struct node_host *h, u_int8_t b) 107794e9410bShenning { 107894e9410bShenning struct pf_addr *m, *n; 107994e9410bShenning int i, j = 0; 108094e9410bShenning 108194e9410bShenning m = &h->addr.v.a.mask; 1082ab648bf6Sfrantzen memset(m, 0, sizeof(*m)); 108394e9410bShenning 108494e9410bShenning while (b >= 32) { 108594e9410bShenning m->addr32[j++] = 0xffffffff; 108694e9410bShenning b -= 32; 108794e9410bShenning } 108894e9410bShenning for (i = 31; i > 31-b; --i) 108994e9410bShenning m->addr32[j] |= (1 << i); 109094e9410bShenning if (b) 109194e9410bShenning m->addr32[j] = htonl(m->addr32[j]); 109294e9410bShenning 109394e9410bShenning /* Mask off bits of the address that will never be used. */ 109494e9410bShenning n = &h->addr.v.a.addr; 1095ff626af1Shenning if (h->addr.type == PF_ADDR_ADDRMASK) 109694e9410bShenning for (i = 0; i < 4; i++) 109794e9410bShenning n->addr32[i] = n->addr32[i] & m->addr32[i]; 109894e9410bShenning } 109994e9410bShenning 110052f4a4a4Shenning int 110152f4a4a4Shenning check_netmask(struct node_host *h, sa_family_t af) 110252f4a4a4Shenning { 110352f4a4a4Shenning struct node_host *n = NULL; 110452f4a4a4Shenning struct pf_addr *m; 110552f4a4a4Shenning 110652f4a4a4Shenning for (n = h; n != NULL; n = n->next) { 110775d911b5Scedric if (h->addr.type == PF_ADDR_TABLE) 110875d911b5Scedric continue; 110952f4a4a4Shenning m = &h->addr.v.a.mask; 111052f4a4a4Shenning /* fix up netmask for dynaddr */ 111152f4a4a4Shenning if (af == AF_INET && h->addr.type == PF_ADDR_DYNIFTL && 111252f4a4a4Shenning unmask(m, AF_INET6) > 32) 111352f4a4a4Shenning set_ipmask(n, 32); 111452f4a4a4Shenning /* netmasks > 32 bit are invalid on v4 */ 111552f4a4a4Shenning if (af == AF_INET && 111652f4a4a4Shenning (m->addr32[1] || m->addr32[2] || m->addr32[3])) { 111752f4a4a4Shenning fprintf(stderr, "netmask %u invalid for IPv4 address\n", 111852f4a4a4Shenning unmask(m, AF_INET6)); 111952f4a4a4Shenning return (1); 112052f4a4a4Shenning } 112152f4a4a4Shenning } 112252f4a4a4Shenning return (0); 112352f4a4a4Shenning } 112452f4a4a4Shenning 112594e9410bShenning /* interface lookup routines */ 112694e9410bShenning 112794e9410bShenning struct node_host *iftab; 112894e9410bShenning 112994e9410bShenning void 113094e9410bShenning ifa_load(void) 113194e9410bShenning { 113294e9410bShenning struct ifaddrs *ifap, *ifa; 113394e9410bShenning struct node_host *n = NULL, *h = NULL; 113494e9410bShenning 113594e9410bShenning if (getifaddrs(&ifap) < 0) 113694e9410bShenning err(1, "getifaddrs"); 113794e9410bShenning 113894e9410bShenning for (ifa = ifap; ifa; ifa = ifa->ifa_next) { 113994e9410bShenning if (!(ifa->ifa_addr->sa_family == AF_INET || 114094e9410bShenning ifa->ifa_addr->sa_family == AF_INET6 || 114194e9410bShenning ifa->ifa_addr->sa_family == AF_LINK)) 114294e9410bShenning continue; 114394e9410bShenning n = calloc(1, sizeof(struct node_host)); 114494e9410bShenning if (n == NULL) 114594e9410bShenning err(1, "address: calloc"); 114694e9410bShenning n->af = ifa->ifa_addr->sa_family; 114794e9410bShenning n->ifa_flags = ifa->ifa_flags; 114894e9410bShenning #ifdef __KAME__ 114994e9410bShenning if (n->af == AF_INET6 && 115094e9410bShenning IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 115194e9410bShenning ifa->ifa_addr)->sin6_addr) && 1152ab642153Shenning ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == 1153ab642153Shenning 0) { 115494e9410bShenning struct sockaddr_in6 *sin6; 115594e9410bShenning 115694e9410bShenning sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 115794e9410bShenning sin6->sin6_scope_id = sin6->sin6_addr.s6_addr[2] << 8 | 115894e9410bShenning sin6->sin6_addr.s6_addr[3]; 115994e9410bShenning sin6->sin6_addr.s6_addr[2] = 0; 116094e9410bShenning sin6->sin6_addr.s6_addr[3] = 0; 116194e9410bShenning } 116294e9410bShenning #endif 116394e9410bShenning n->ifindex = 0; 116494e9410bShenning if (n->af == AF_INET) { 116594e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in *) 116694e9410bShenning ifa->ifa_addr)->sin_addr.s_addr, 116794e9410bShenning sizeof(struct in_addr)); 116894e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in *) 116994e9410bShenning ifa->ifa_netmask)->sin_addr.s_addr, 117094e9410bShenning sizeof(struct in_addr)); 117194e9410bShenning if (ifa->ifa_broadaddr != NULL) 117294e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in *) 117394e9410bShenning ifa->ifa_broadaddr)->sin_addr.s_addr, 117494e9410bShenning sizeof(struct in_addr)); 1175ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1176ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in *) 1177ec359bd5Scedric ifa->ifa_dstaddr)->sin_addr.s_addr, 1178ec359bd5Scedric sizeof(struct in_addr)); 117994e9410bShenning } else if (n->af == AF_INET6) { 118094e9410bShenning memcpy(&n->addr.v.a.addr, &((struct sockaddr_in6 *) 118194e9410bShenning ifa->ifa_addr)->sin6_addr.s6_addr, 118294e9410bShenning sizeof(struct in6_addr)); 118394e9410bShenning memcpy(&n->addr.v.a.mask, &((struct sockaddr_in6 *) 118494e9410bShenning ifa->ifa_netmask)->sin6_addr.s6_addr, 118594e9410bShenning sizeof(struct in6_addr)); 118694e9410bShenning if (ifa->ifa_broadaddr != NULL) 118794e9410bShenning memcpy(&n->bcast, &((struct sockaddr_in6 *) 118894e9410bShenning ifa->ifa_broadaddr)->sin6_addr.s6_addr, 118994e9410bShenning sizeof(struct in6_addr)); 1190ec359bd5Scedric if (ifa->ifa_dstaddr != NULL) 1191ec359bd5Scedric memcpy(&n->peer, &((struct sockaddr_in6 *) 1192ec359bd5Scedric ifa->ifa_dstaddr)->sin6_addr.s6_addr, 1193ec359bd5Scedric sizeof(struct in6_addr)); 119494e9410bShenning n->ifindex = ((struct sockaddr_in6 *) 119594e9410bShenning ifa->ifa_addr)->sin6_scope_id; 119694e9410bShenning } 119794e9410bShenning if ((n->ifname = strdup(ifa->ifa_name)) == NULL) 119894e9410bShenning err(1, "ifa_load: strdup"); 119994e9410bShenning n->next = NULL; 120094e9410bShenning n->tail = n; 120194e9410bShenning if (h == NULL) 120294e9410bShenning h = n; 120394e9410bShenning else { 120494e9410bShenning h->tail->next = n; 120594e9410bShenning h->tail = n; 120694e9410bShenning } 120794e9410bShenning } 1208ec359bd5Scedric 120994e9410bShenning iftab = h; 121094e9410bShenning freeifaddrs(ifap); 121194e9410bShenning } 121294e9410bShenning 121394e9410bShenning struct node_host * 12146c3582faShenning ifa_exists(const char *ifa_name) 121594e9410bShenning { 121694e9410bShenning struct node_host *n; 12172ff5b035Shenning struct ifgroupreq ifgr; 12182ff5b035Shenning int s; 121994e9410bShenning 122094e9410bShenning if (iftab == NULL) 122194e9410bShenning ifa_load(); 122294e9410bShenning 12232ff5b035Shenning /* check wether this is a group */ 12242ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 12252ff5b035Shenning err(1, "socket"); 12262ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 12272ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 12282ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == 0) { 12292ff5b035Shenning /* fake a node_host */ 12302ff5b035Shenning if ((n = calloc(1, sizeof(*n))) == NULL) 12312ff5b035Shenning err(1, "calloc"); 12322ff5b035Shenning if ((n->ifname = strdup(ifa_name)) == NULL) 12332ff5b035Shenning err(1, "strdup"); 12342ff5b035Shenning close(s); 12352ff5b035Shenning return (n); 12362ff5b035Shenning } 12372ff5b035Shenning close(s); 12382ff5b035Shenning 123994e9410bShenning for (n = iftab; n; n = n->next) { 124094e9410bShenning if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ)) 124194e9410bShenning return (n); 124294e9410bShenning } 1243655a9f8aShenning 124494e9410bShenning return (NULL); 124594e9410bShenning } 124694e9410bShenning 124794e9410bShenning struct node_host * 12482ff5b035Shenning ifa_grouplookup(const char *ifa_name, int flags) 12492ff5b035Shenning { 12502ff5b035Shenning struct ifg_req *ifg; 12512ff5b035Shenning struct ifgroupreq ifgr; 12522ff5b035Shenning int s, len; 1253727cb2f7Sdhartmei struct node_host *n, *h = NULL; 12542ff5b035Shenning 12552ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 12562ff5b035Shenning err(1, "socket"); 12572ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 12582ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 12592ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) { 12602ff5b035Shenning close(s); 12612ff5b035Shenning return (NULL); 12622ff5b035Shenning } 12632ff5b035Shenning 12642ff5b035Shenning len = ifgr.ifgr_len; 12652ff5b035Shenning if ((ifgr.ifgr_groups = calloc(1, len)) == NULL) 12662ff5b035Shenning err(1, "calloc"); 12672ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) 12682ff5b035Shenning err(1, "SIOCGIFGMEMB"); 12692ff5b035Shenning 12702ff5b035Shenning for (ifg = ifgr.ifgr_groups; ifg && len >= sizeof(struct ifg_req); 12712ff5b035Shenning ifg++) { 12722ff5b035Shenning len -= sizeof(struct ifg_req); 127317b44c41Shenning if ((n = ifa_lookup(ifg->ifgrq_member, flags)) == NULL) 127417b44c41Shenning continue; 12752ff5b035Shenning if (h == NULL) 12762ff5b035Shenning h = n; 12772ff5b035Shenning else { 1278727cb2f7Sdhartmei h->tail->next = n; 1279727cb2f7Sdhartmei h->tail = n->tail; 12802ff5b035Shenning } 12812ff5b035Shenning } 12822ff5b035Shenning free(ifgr.ifgr_groups); 12832ff5b035Shenning close(s); 12842ff5b035Shenning 12852ff5b035Shenning return (h); 12862ff5b035Shenning } 12872ff5b035Shenning 12882ff5b035Shenning struct node_host * 1289ec359bd5Scedric ifa_lookup(const char *ifa_name, int flags) 129094e9410bShenning { 129194e9410bShenning struct node_host *p = NULL, *h = NULL, *n = NULL; 12927ad220f2Scedric int got4 = 0, got6 = 0; 1293ec359bd5Scedric const char *last_if = NULL; 129494e9410bShenning 12952ff5b035Shenning if ((h = ifa_grouplookup(ifa_name, flags)) != NULL) 12962ff5b035Shenning return (h); 12972ff5b035Shenning 129894e9410bShenning if (!strncmp(ifa_name, "self", IFNAMSIZ)) 12997ad220f2Scedric ifa_name = NULL; 130094e9410bShenning 130194e9410bShenning if (iftab == NULL) 130294e9410bShenning ifa_load(); 130394e9410bShenning 130494e9410bShenning for (p = iftab; p; p = p->next) { 13057ad220f2Scedric if (ifa_skip_if(ifa_name, p)) 130694e9410bShenning continue; 1307ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET) 130894e9410bShenning continue; 1309ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && 1310ec359bd5Scedric !(p->ifa_flags & IFF_BROADCAST)) 131194e9410bShenning continue; 1312ec359bd5Scedric if ((flags & PFI_AFLAG_PEER) && 1313ec359bd5Scedric !(p->ifa_flags & IFF_POINTOPOINT)) 1314ec359bd5Scedric continue; 1315ec359bd5Scedric if ((flags & PFI_AFLAG_NETWORK) && p->ifindex > 0) 1316ec359bd5Scedric continue; 1317ec359bd5Scedric if (last_if == NULL || strcmp(last_if, p->ifname)) 1318ec359bd5Scedric got4 = got6 = 0; 1319ec359bd5Scedric last_if = p->ifname; 1320ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) 1321ec359bd5Scedric continue; 1322ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) 1323ec359bd5Scedric continue; 1324ec359bd5Scedric if (p->af == AF_INET) 1325ec359bd5Scedric got4 = 1; 1326ec359bd5Scedric else 1327ec359bd5Scedric got6 = 1; 132894e9410bShenning n = calloc(1, sizeof(struct node_host)); 132994e9410bShenning if (n == NULL) 133094e9410bShenning err(1, "address: calloc"); 133194e9410bShenning n->af = p->af; 1332ec359bd5Scedric if (flags & PFI_AFLAG_BROADCAST) 133394e9410bShenning memcpy(&n->addr.v.a.addr, &p->bcast, 133494e9410bShenning sizeof(struct pf_addr)); 1335ec359bd5Scedric else if (flags & PFI_AFLAG_PEER) 1336ec359bd5Scedric memcpy(&n->addr.v.a.addr, &p->peer, 1337ec359bd5Scedric sizeof(struct pf_addr)); 133894e9410bShenning else 133994e9410bShenning memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, 134094e9410bShenning sizeof(struct pf_addr)); 1341ec359bd5Scedric if (flags & PFI_AFLAG_NETWORK) 134294e9410bShenning set_ipmask(n, unmask(&p->addr.v.a.mask, n->af)); 134394e9410bShenning else { 134494e9410bShenning if (n->af == AF_INET) { 134594e9410bShenning if (p->ifa_flags & IFF_LOOPBACK && 134694e9410bShenning p->ifa_flags & IFF_LINK1) 134794e9410bShenning memcpy(&n->addr.v.a.mask, 134894e9410bShenning &p->addr.v.a.mask, 134994e9410bShenning sizeof(struct pf_addr)); 135094e9410bShenning else 135194e9410bShenning set_ipmask(n, 32); 135294e9410bShenning } else 135394e9410bShenning set_ipmask(n, 128); 135494e9410bShenning } 135594e9410bShenning n->ifindex = p->ifindex; 135694e9410bShenning 135794e9410bShenning n->next = NULL; 135894e9410bShenning n->tail = n; 135994e9410bShenning if (h == NULL) 136094e9410bShenning h = n; 136194e9410bShenning else { 136294e9410bShenning h->tail->next = n; 136394e9410bShenning h->tail = n; 136494e9410bShenning } 136594e9410bShenning } 136694e9410bShenning return (h); 136794e9410bShenning } 136894e9410bShenning 13697ad220f2Scedric int 13707ad220f2Scedric ifa_skip_if(const char *filter, struct node_host *p) 13717ad220f2Scedric { 13727ad220f2Scedric int n; 13737ad220f2Scedric 13747ad220f2Scedric if (p->af != AF_INET && p->af != AF_INET6) 13757ad220f2Scedric return (1); 13767ad220f2Scedric if (filter == NULL || !*filter) 13777ad220f2Scedric return (0); 13787ad220f2Scedric if (!strcmp(p->ifname, filter)) 13797ad220f2Scedric return (0); /* exact match */ 13807ad220f2Scedric n = strlen(filter); 13817ad220f2Scedric if (n < 1 || n >= IFNAMSIZ) 13827ad220f2Scedric return (1); /* sanity check */ 13837ad220f2Scedric if (filter[n-1] >= '0' && filter[n-1] <= '9') 13847ad220f2Scedric return (1); /* only do exact match in that case */ 13857ad220f2Scedric if (strncmp(p->ifname, filter, n)) 13867ad220f2Scedric return (1); /* prefix doesn't match */ 13877ad220f2Scedric return (p->ifname[n] < '0' || p->ifname[n] > '9'); 13887ad220f2Scedric } 13897ad220f2Scedric 13907ad220f2Scedric 139194e9410bShenning struct node_host * 1392f23861c1Shenning host(const char *s) 139394e9410bShenning { 13942a6c1abaShenning struct node_host *h = NULL; 1395f23861c1Shenning int mask, v4mask, v6mask, cont = 1; 1396f23861c1Shenning char *p, *q, *ps; 139794e9410bShenning 139894e9410bShenning if ((p = strrchr(s, '/')) != NULL) { 139994e9410bShenning mask = strtol(p+1, &q, 0); 1400fecc9cd0Shenning if (!q || *q || mask > 128 || q == (p+1)) { 14013f76a180Sdhartmei fprintf(stderr, "invalid netmask '%s'\n", p); 140294e9410bShenning return (NULL); 140394e9410bShenning } 1404a81c851cShenning if ((ps = malloc(strlen(s) - strlen(p) + 1)) == NULL) 140594e9410bShenning err(1, "host: malloc"); 140694e9410bShenning strlcpy(ps, s, strlen(s) - strlen(p) + 1); 140794e9410bShenning v4mask = v6mask = mask; 140894e9410bShenning } else { 1409f23861c1Shenning if ((ps = strdup(s)) == NULL) 1410f23861c1Shenning err(1, "host: strdup"); 141194e9410bShenning v4mask = 32; 141294e9410bShenning v6mask = 128; 1413f23861c1Shenning mask = -1; 141494e9410bShenning } 141594e9410bShenning 14162a6c1abaShenning /* interface with this name exists? */ 14174a36d485Shenning if (cont && (h = host_if(ps, mask)) != NULL) 14182a6c1abaShenning cont = 0; 14192a6c1abaShenning 14202a6c1abaShenning /* IPv4 address? */ 1421f23861c1Shenning if (cont && (h = host_v4(s, mask)) != NULL) 14222a6c1abaShenning cont = 0; 14232a6c1abaShenning 14242a6c1abaShenning /* IPv6 address? */ 14252a6c1abaShenning if (cont && (h = host_v6(ps, v6mask)) != NULL) 14262a6c1abaShenning cont = 0; 14272a6c1abaShenning 14282a6c1abaShenning /* dns lookup */ 14292a6c1abaShenning if (cont && (h = host_dns(ps, v4mask, v6mask)) != NULL) 14302a6c1abaShenning cont = 0; 14312a6c1abaShenning free(ps); 14322a6c1abaShenning 14332a6c1abaShenning if (h == NULL || cont == 1) { 14342a6c1abaShenning fprintf(stderr, "no IP address found for %s\n", s); 14352a6c1abaShenning return (NULL); 14362a6c1abaShenning } 14372a6c1abaShenning return (h); 14382a6c1abaShenning } 14392a6c1abaShenning 14402a6c1abaShenning struct node_host * 1441f2370d27Shenning host_if(const char *s, int mask) 14422a6c1abaShenning { 14432a6c1abaShenning struct node_host *n, *h = NULL; 14444a36d485Shenning char *p, *ps; 1445ec359bd5Scedric int flags = 0; 14462a6c1abaShenning 1447ec359bd5Scedric if ((ps = strdup(s)) == NULL) 1448ec359bd5Scedric err(1, "host_if: strdup"); 1449ec359bd5Scedric while ((p = strrchr(ps, ':')) != NULL) { 14504a36d485Shenning if (!strcmp(p+1, "network")) 1451ec359bd5Scedric flags |= PFI_AFLAG_NETWORK; 1452ec359bd5Scedric else if (!strcmp(p+1, "broadcast")) 1453ec359bd5Scedric flags |= PFI_AFLAG_BROADCAST; 1454ec359bd5Scedric else if (!strcmp(p+1, "peer")) 1455ec359bd5Scedric flags |= PFI_AFLAG_PEER; 1456ec359bd5Scedric else if (!strcmp(p+1, "0")) 1457ec359bd5Scedric flags |= PFI_AFLAG_NOALIAS; 1458f8bc5305Shenning else { 1459f8bc5305Shenning free(ps); 1460ec359bd5Scedric return (NULL); 1461f8bc5305Shenning } 1462ec359bd5Scedric *p = '\0'; 1463ec359bd5Scedric } 1464ec359bd5Scedric if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */ 1465ec359bd5Scedric fprintf(stderr, "illegal combination of interface modifiers\n"); 1466f8bc5305Shenning free(ps); 1467ec359bd5Scedric return (NULL); 1468ec359bd5Scedric } 1469ec359bd5Scedric if ((flags & (PFI_AFLAG_NETWORK|PFI_AFLAG_BROADCAST)) && mask > -1) { 14704a36d485Shenning fprintf(stderr, "network or broadcast lookup, but " 14714a36d485Shenning "extra netmask given\n"); 1472f8bc5305Shenning free(ps); 14734a36d485Shenning return (NULL); 14744a36d485Shenning } 14756c3582faShenning if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ)) { 14762a6c1abaShenning /* interface with this name exists */ 1477ec359bd5Scedric h = ifa_lookup(ps, flags); 14782a6c1abaShenning for (n = h; n != NULL && mask > -1; n = n->next) 14792a6c1abaShenning set_ipmask(n, mask); 14802a6c1abaShenning } 14814a36d485Shenning 14824a36d485Shenning free(ps); 14832a6c1abaShenning return (h); 14842a6c1abaShenning } 14852a6c1abaShenning 14862a6c1abaShenning struct node_host * 1487383ebbbfShenning host_v4(const char *s, int mask) 14882a6c1abaShenning { 14892a6c1abaShenning struct node_host *h = NULL; 14902a6c1abaShenning struct in_addr ina; 149190fffbb7Shenning int bits = 32; 14922a6c1abaShenning 149394e9410bShenning memset(&ina, 0, sizeof(struct in_addr)); 149490fffbb7Shenning if (strrchr(s, '/') != NULL) { 149590fffbb7Shenning if ((bits = inet_net_pton(AF_INET, s, &ina, sizeof(ina))) == -1) 149690fffbb7Shenning return (NULL); 149790fffbb7Shenning } else { 149890fffbb7Shenning if (inet_pton(AF_INET, s, &ina) != 1) 149990fffbb7Shenning return (NULL); 150090fffbb7Shenning } 150190fffbb7Shenning 150294e9410bShenning h = calloc(1, sizeof(struct node_host)); 150394e9410bShenning if (h == NULL) 150494e9410bShenning err(1, "address: calloc"); 150594e9410bShenning h->ifname = NULL; 150694e9410bShenning h->af = AF_INET; 150794e9410bShenning h->addr.v.a.addr.addr32[0] = ina.s_addr; 150894e9410bShenning set_ipmask(h, bits); 150994e9410bShenning h->next = NULL; 151094e9410bShenning h->tail = h; 15112a6c1abaShenning 151294e9410bShenning return (h); 151394e9410bShenning } 15142a6c1abaShenning 15152a6c1abaShenning struct node_host * 1516f2370d27Shenning host_v6(const char *s, int mask) 15172a6c1abaShenning { 15182a6c1abaShenning struct addrinfo hints, *res; 15192a6c1abaShenning struct node_host *h = NULL; 152094e9410bShenning 152194e9410bShenning memset(&hints, 0, sizeof(hints)); 152294e9410bShenning hints.ai_family = AF_INET6; 152394e9410bShenning hints.ai_socktype = SOCK_DGRAM; /*dummy*/ 152494e9410bShenning hints.ai_flags = AI_NUMERICHOST; 15252a6c1abaShenning if (getaddrinfo(s, "0", &hints, &res) == 0) { 15262a6c1abaShenning h = calloc(1, sizeof(struct node_host)); 15272a6c1abaShenning if (h == NULL) 152894e9410bShenning err(1, "address: calloc"); 15292a6c1abaShenning h->ifname = NULL; 15302a6c1abaShenning h->af = AF_INET6; 15312a6c1abaShenning memcpy(&h->addr.v.a.addr, 153294e9410bShenning &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 15332a6c1abaShenning sizeof(h->addr.v.a.addr)); 15342a6c1abaShenning h->ifindex = 15352a6c1abaShenning ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; 15362a6c1abaShenning set_ipmask(h, mask); 153794e9410bShenning freeaddrinfo(res); 15382a6c1abaShenning h->next = NULL; 15392a6c1abaShenning h->tail = h; 154094e9410bShenning } 154194e9410bShenning 15422a6c1abaShenning return (h); 15432a6c1abaShenning } 15442a6c1abaShenning 15452a6c1abaShenning struct node_host * 1546f2370d27Shenning host_dns(const char *s, int v4mask, int v6mask) 15472a6c1abaShenning { 15482a6c1abaShenning struct addrinfo hints, *res0, *res; 15492a6c1abaShenning struct node_host *n, *h = NULL; 1550ec359bd5Scedric int error, noalias = 0; 1551ec359bd5Scedric int got4 = 0, got6 = 0; 1552ec359bd5Scedric char *p, *ps; 15532a6c1abaShenning 1554ec359bd5Scedric if ((ps = strdup(s)) == NULL) 155522dee42fShenning err(1, "host_dns: strdup"); 1556ec359bd5Scedric if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) { 1557ec359bd5Scedric noalias = 1; 1558ec359bd5Scedric *p = '\0'; 1559ec359bd5Scedric } 156094e9410bShenning memset(&hints, 0, sizeof(hints)); 156194e9410bShenning hints.ai_family = PF_UNSPEC; 156294e9410bShenning hints.ai_socktype = SOCK_STREAM; /* DUMMY */ 1563ec359bd5Scedric error = getaddrinfo(ps, NULL, &hints, &res0); 1564b4d8b6eeShenning if (error) { 1565b4d8b6eeShenning free(ps); 15662a6c1abaShenning return (h); 1567b4d8b6eeShenning } 15682a6c1abaShenning 156994e9410bShenning for (res = res0; res; res = res->ai_next) { 157094e9410bShenning if (res->ai_family != AF_INET && 157194e9410bShenning res->ai_family != AF_INET6) 157294e9410bShenning continue; 1573ec359bd5Scedric if (noalias) { 1574ec359bd5Scedric if (res->ai_family == AF_INET) { 1575ec359bd5Scedric if (got4) 1576ec359bd5Scedric continue; 1577ec359bd5Scedric got4 = 1; 1578ec359bd5Scedric } else { 1579ec359bd5Scedric if (got6) 1580ec359bd5Scedric continue; 1581ec359bd5Scedric got6 = 1; 1582ec359bd5Scedric } 1583ec359bd5Scedric } 158494e9410bShenning n = calloc(1, sizeof(struct node_host)); 158594e9410bShenning if (n == NULL) 15862a6c1abaShenning err(1, "host_dns: calloc"); 158794e9410bShenning n->ifname = NULL; 158894e9410bShenning n->af = res->ai_family; 158994e9410bShenning if (res->ai_family == AF_INET) { 159094e9410bShenning memcpy(&n->addr.v.a.addr, 15912a6c1abaShenning &((struct sockaddr_in *) 15922a6c1abaShenning res->ai_addr)->sin_addr.s_addr, 159394e9410bShenning sizeof(struct in_addr)); 159494e9410bShenning set_ipmask(n, v4mask); 159594e9410bShenning } else { 159694e9410bShenning memcpy(&n->addr.v.a.addr, 15972a6c1abaShenning &((struct sockaddr_in6 *) 15982a6c1abaShenning res->ai_addr)->sin6_addr.s6_addr, 159994e9410bShenning sizeof(struct in6_addr)); 160094e9410bShenning n->ifindex = 16012a6c1abaShenning ((struct sockaddr_in6 *) 16022a6c1abaShenning res->ai_addr)->sin6_scope_id; 160394e9410bShenning set_ipmask(n, v6mask); 160494e9410bShenning } 160594e9410bShenning n->next = NULL; 160694e9410bShenning n->tail = n; 160794e9410bShenning if (h == NULL) 160894e9410bShenning h = n; 160994e9410bShenning else { 161094e9410bShenning h->tail->next = n; 161194e9410bShenning h->tail = n; 161294e9410bShenning } 161394e9410bShenning } 161494e9410bShenning freeaddrinfo(res0); 1615ec359bd5Scedric free(ps); 161694e9410bShenning 161794e9410bShenning return (h); 161894e9410bShenning } 161942e05679Scedric 162042e05679Scedric /* 162142e05679Scedric * convert a hostname to a list of addresses and put them in the given buffer. 162242e05679Scedric * test: 162342e05679Scedric * if set to 1, only simple addresses are accepted (no netblock, no "!"). 162442e05679Scedric */ 162542e05679Scedric int 162642e05679Scedric append_addr(struct pfr_buffer *b, char *s, int test) 162742e05679Scedric { 16285b6c447dScedric char *r; 1629b88a8d5dScedric struct node_host *h, *n; 1630b88a8d5dScedric int rv, not = 0; 16315b6c447dScedric 16325b6c447dScedric for (r = s; *r == '!'; r++) 16335b6c447dScedric not = !not; 16345b6c447dScedric if ((n = host(r)) == NULL) { 16355b6c447dScedric errno = 0; 16365b6c447dScedric return (-1); 16375b6c447dScedric } 1638b88a8d5dScedric rv = append_addr_host(b, n, test, not); 1639b88a8d5dScedric do { 1640b88a8d5dScedric h = n; 1641b88a8d5dScedric n = n->next; 1642b88a8d5dScedric free(h); 1643b88a8d5dScedric } while (n != NULL); 1644b88a8d5dScedric return (rv); 164542e05679Scedric } 164642e05679Scedric 164742e05679Scedric /* 16485b6c447dScedric * same as previous function, but with a pre-parsed input and the ability 1649b88a8d5dScedric * to "negate" the result. Does not free the node_host list. 165042e05679Scedric * not: 165142e05679Scedric * setting it to 1 is equivalent to adding "!" in front of parameter s. 165242e05679Scedric */ 165342e05679Scedric int 16545b6c447dScedric append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) 165542e05679Scedric { 165642e05679Scedric int bits; 165742e05679Scedric struct pfr_addr addr; 165842e05679Scedric 165942e05679Scedric do { 166042e05679Scedric bzero(&addr, sizeof(addr)); 16615b6c447dScedric addr.pfra_not = n->not ^ not; 166242e05679Scedric addr.pfra_af = n->af; 166342e05679Scedric addr.pfra_net = unmask(&n->addr.v.a.mask, n->af); 166442e05679Scedric switch (n->af) { 166542e05679Scedric case AF_INET: 166642e05679Scedric addr.pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32[0]; 166742e05679Scedric bits = 32; 166842e05679Scedric break; 166942e05679Scedric case AF_INET6: 167042e05679Scedric memcpy(&addr.pfra_ip6addr, &n->addr.v.a.addr.v6, 167142e05679Scedric sizeof(struct in6_addr)); 167242e05679Scedric bits = 128; 167342e05679Scedric break; 167442e05679Scedric default: 167542e05679Scedric errno = EINVAL; 167642e05679Scedric return (-1); 167742e05679Scedric } 167842e05679Scedric if ((test && (not || addr.pfra_net != bits)) || 167942e05679Scedric addr.pfra_net > bits) { 168042e05679Scedric errno = EINVAL; 168142e05679Scedric return (-1); 168242e05679Scedric } 168342e05679Scedric if (pfr_buf_add(b, &addr)) 168442e05679Scedric return (-1); 1685b88a8d5dScedric } while ((n = n->next) != NULL); 168642e05679Scedric 168742e05679Scedric return (0); 168842e05679Scedric } 168979cc0068Scedric 169079cc0068Scedric int 1691d9ad7941Sdhartmei pfctl_add_trans(struct pfr_buffer *buf, int rs_num, const char *anchor) 169279cc0068Scedric { 169379cc0068Scedric struct pfioc_trans_e trans; 169479cc0068Scedric 169579cc0068Scedric bzero(&trans, sizeof(trans)); 169679cc0068Scedric trans.rs_num = rs_num; 169779cc0068Scedric if (strlcpy(trans.anchor, anchor, 1698d9ad7941Sdhartmei sizeof(trans.anchor)) >= sizeof(trans.anchor)) 169979cc0068Scedric errx(1, "pfctl_add_trans: strlcpy"); 170079cc0068Scedric 170179cc0068Scedric return pfr_buf_add(buf, &trans); 170279cc0068Scedric } 170379cc0068Scedric 170479cc0068Scedric u_int32_t 1705d9ad7941Sdhartmei pfctl_get_ticket(struct pfr_buffer *buf, int rs_num, const char *anchor) 170679cc0068Scedric { 170779cc0068Scedric struct pfioc_trans_e *p; 170879cc0068Scedric 170979cc0068Scedric PFRB_FOREACH(p, buf) 1710d9ad7941Sdhartmei if (rs_num == p->rs_num && !strcmp(anchor, p->anchor)) 171179cc0068Scedric return (p->ticket); 171222dee42fShenning errx(1, "pfctl_get_ticket: assertion failed"); 171379cc0068Scedric } 171479cc0068Scedric 171579cc0068Scedric int 17163060c195Shenning pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) 171779cc0068Scedric { 171879cc0068Scedric struct pfioc_trans trans; 171979cc0068Scedric 172079cc0068Scedric bzero(&trans, sizeof(trans)); 172179cc0068Scedric trans.size = buf->pfrb_size - from; 172279cc0068Scedric trans.esize = sizeof(struct pfioc_trans_e); 172379cc0068Scedric trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; 172479cc0068Scedric return ioctl(dev, cmd, &trans); 172579cc0068Scedric } 1726