File: | src/sbin/pfctl/pfctl_parser.c |
Warning: | line 1079, column 4 Value stored to 'ropts' is never read |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: pfctl_parser.c,v 1.346 2021/02/01 00:31:04 dlg Exp $ */ |
2 | |
3 | /* |
4 | * Copyright (c) 2001 Daniel Hartmeier |
5 | * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> |
6 | * All rights reserved. |
7 | * |
8 | * Redistribution and use in source and binary forms, with or without |
9 | * modification, are permitted provided that the following conditions |
10 | * are met: |
11 | * |
12 | * - Redistributions of source code must retain the above copyright |
13 | * notice, this list of conditions and the following disclaimer. |
14 | * - Redistributions in binary form must reproduce the above |
15 | * copyright notice, this list of conditions and the following |
16 | * disclaimer in the documentation and/or other materials provided |
17 | * with the distribution. |
18 | * |
19 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
20 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
21 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
22 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
23 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
24 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
25 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
26 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
27 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
28 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
29 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
30 | * POSSIBILITY OF SUCH DAMAGE. |
31 | * |
32 | */ |
33 | |
34 | #include <sys/types.h> |
35 | #include <sys/ioctl.h> |
36 | #include <sys/socket.h> |
37 | #include <net/if_dl.h> |
38 | #include <net/if.h> |
39 | #include <netinet/in.h> |
40 | #include <netinet/ip.h> |
41 | #include <netinet/ip_icmp.h> |
42 | #include <netinet/icmp6.h> |
43 | #include <net/pfvar.h> |
44 | #include <arpa/inet.h> |
45 | |
46 | #include <ctype.h> |
47 | #include <err.h> |
48 | #include <errno(*__errno()).h> |
49 | #include <ifaddrs.h> |
50 | #include <limits.h> |
51 | #include <netdb.h> |
52 | #include <stdarg.h> |
53 | #include <stdio.h> |
54 | #include <stdlib.h> |
55 | #include <string.h> |
56 | #include <time.h> |
57 | #include <unistd.h> |
58 | |
59 | #define SYSLOG_NAMES |
60 | #include <syslog.h> |
61 | |
62 | #include "pfctl_parser.h" |
63 | #include "pfctl.h" |
64 | |
65 | void print_op (u_int8_t, const char *, const char *); |
66 | void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); |
67 | void print_ugid (u_int8_t, id_t, id_t, const char *); |
68 | void print_flags (u_int8_t); |
69 | void print_fromto(struct pf_rule_addr *, pf_osfp_t, |
70 | struct pf_rule_addr *, u_int8_t, u_int8_t, int); |
71 | void print_bwspec(const char *index, struct pf_queue_bwspec *); |
72 | void print_scspec(const char *, struct pf_queue_scspec *); |
73 | int ifa_skip_if(const char *filter, struct node_host *p); |
74 | |
75 | struct node_host *ifa_grouplookup(const char *, int); |
76 | struct node_host *host_if(const char *, int); |
77 | struct node_host *host_ip(const char *, int); |
78 | struct node_host *host_dns(const char *, int, int); |
79 | |
80 | const char *tcpflags = "FSRPAUEW"; |
81 | |
82 | static const struct icmptypeent icmp_type[] = { |
83 | { "echoreq", ICMP_ECHO8 }, |
84 | { "echorep", ICMP_ECHOREPLY0 }, |
85 | { "unreach", ICMP_UNREACH3 }, |
86 | { "squench", ICMP_SOURCEQUENCH4 }, |
87 | { "redir", ICMP_REDIRECT5 }, |
88 | { "althost", ICMP_ALTHOSTADDR6 }, |
89 | { "routeradv", ICMP_ROUTERADVERT9 }, |
90 | { "routersol", ICMP_ROUTERSOLICIT10 }, |
91 | { "timex", ICMP_TIMXCEED11 }, |
92 | { "paramprob", ICMP_PARAMPROB12 }, |
93 | { "timereq", ICMP_TSTAMP13 }, |
94 | { "timerep", ICMP_TSTAMPREPLY14 }, |
95 | { "inforeq", ICMP_IREQ15 }, |
96 | { "inforep", ICMP_IREQREPLY16 }, |
97 | { "maskreq", ICMP_MASKREQ17 }, |
98 | { "maskrep", ICMP_MASKREPLY18 }, |
99 | { "trace", ICMP_TRACEROUTE30 }, |
100 | { "dataconv", ICMP_DATACONVERR31 }, |
101 | { "mobredir", ICMP_MOBILE_REDIRECT32 }, |
102 | { "ipv6-where", ICMP_IPV6_WHEREAREYOU33 }, |
103 | { "ipv6-here", ICMP_IPV6_IAMHERE34 }, |
104 | { "mobregreq", ICMP_MOBILE_REGREQUEST35 }, |
105 | { "mobregrep", ICMP_MOBILE_REGREPLY36 }, |
106 | { "skip", ICMP_SKIP39 }, |
107 | { "photuris", ICMP_PHOTURIS40 } |
108 | }; |
109 | |
110 | static const struct icmptypeent icmp6_type[] = { |
111 | { "unreach", ICMP6_DST_UNREACH1 }, |
112 | { "toobig", ICMP6_PACKET_TOO_BIG2 }, |
113 | { "timex", ICMP6_TIME_EXCEEDED3 }, |
114 | { "paramprob", ICMP6_PARAM_PROB4 }, |
115 | { "echoreq", ICMP6_ECHO_REQUEST128 }, |
116 | { "echorep", ICMP6_ECHO_REPLY129 }, |
117 | { "groupqry", ICMP6_MEMBERSHIP_QUERY130 }, |
118 | { "listqry", MLD_LISTENER_QUERY130 }, |
119 | { "grouprep", ICMP6_MEMBERSHIP_REPORT131 }, |
120 | { "listenrep", MLD_LISTENER_REPORT131 }, |
121 | { "groupterm", ICMP6_MEMBERSHIP_REDUCTION132 }, |
122 | { "listendone", MLD_LISTENER_DONE132 }, |
123 | { "routersol", ND_ROUTER_SOLICIT133 }, |
124 | { "routeradv", ND_ROUTER_ADVERT134 }, |
125 | { "neighbrsol", ND_NEIGHBOR_SOLICIT135 }, |
126 | { "neighbradv", ND_NEIGHBOR_ADVERT136 }, |
127 | { "redir", ND_REDIRECT137 }, |
128 | { "routrrenum", ICMP6_ROUTER_RENUMBERING138 }, |
129 | { "wrureq", ICMP6_WRUREQUEST139 }, |
130 | { "wrurep", ICMP6_WRUREPLY140 }, |
131 | { "fqdnreq", ICMP6_FQDN_QUERY139 }, |
132 | { "fqdnrep", ICMP6_FQDN_REPLY140 }, |
133 | { "niqry", ICMP6_NI_QUERY139 }, |
134 | { "nirep", ICMP6_NI_REPLY140 }, |
135 | { "mtraceresp", MLD_MTRACE_RESP200 }, |
136 | { "mtrace", MLD_MTRACE201 }, |
137 | { "listenrepv2", MLDV2_LISTENER_REPORT143 }, |
138 | }; |
139 | |
140 | static const struct icmpcodeent icmp_code[] = { |
141 | { "net-unr", ICMP_UNREACH3, ICMP_UNREACH_NET0 }, |
142 | { "host-unr", ICMP_UNREACH3, ICMP_UNREACH_HOST1 }, |
143 | { "proto-unr", ICMP_UNREACH3, ICMP_UNREACH_PROTOCOL2 }, |
144 | { "port-unr", ICMP_UNREACH3, ICMP_UNREACH_PORT3 }, |
145 | { "needfrag", ICMP_UNREACH3, ICMP_UNREACH_NEEDFRAG4 }, |
146 | { "srcfail", ICMP_UNREACH3, ICMP_UNREACH_SRCFAIL5 }, |
147 | { "net-unk", ICMP_UNREACH3, ICMP_UNREACH_NET_UNKNOWN6 }, |
148 | { "host-unk", ICMP_UNREACH3, ICMP_UNREACH_HOST_UNKNOWN7 }, |
149 | { "isolate", ICMP_UNREACH3, ICMP_UNREACH_ISOLATED8 }, |
150 | { "net-prohib", ICMP_UNREACH3, ICMP_UNREACH_NET_PROHIB9 }, |
151 | { "host-prohib", ICMP_UNREACH3, ICMP_UNREACH_HOST_PROHIB10 }, |
152 | { "net-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSNET11 }, |
153 | { "host-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSHOST12 }, |
154 | { "filter-prohib", ICMP_UNREACH3, ICMP_UNREACH_FILTER_PROHIB13 }, |
155 | { "host-preced", ICMP_UNREACH3, ICMP_UNREACH_HOST_PRECEDENCE14 }, |
156 | { "cutoff-preced", ICMP_UNREACH3, ICMP_UNREACH_PRECEDENCE_CUTOFF15 }, |
157 | { "redir-net", ICMP_REDIRECT5, ICMP_REDIRECT_NET0 }, |
158 | { "redir-host", ICMP_REDIRECT5, ICMP_REDIRECT_HOST1 }, |
159 | { "redir-tos-net", ICMP_REDIRECT5, ICMP_REDIRECT_TOSNET2 }, |
160 | { "redir-tos-host", ICMP_REDIRECT5, ICMP_REDIRECT_TOSHOST3 }, |
161 | { "normal-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NORMAL0 }, |
162 | { "common-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NOROUTE_COMMON16 }, |
163 | { "transit", ICMP_TIMXCEED11, ICMP_TIMXCEED_INTRANS0 }, |
164 | { "reassemb", ICMP_TIMXCEED11, ICMP_TIMXCEED_REASS1 }, |
165 | { "badhead", ICMP_PARAMPROB12, ICMP_PARAMPROB_ERRATPTR0 }, |
166 | { "optmiss", ICMP_PARAMPROB12, ICMP_PARAMPROB_OPTABSENT1 }, |
167 | { "badlen", ICMP_PARAMPROB12, ICMP_PARAMPROB_LENGTH2 }, |
168 | { "unknown-ind", ICMP_PHOTURIS40, ICMP_PHOTURIS_UNKNOWN_INDEX1 }, |
169 | { "auth-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_AUTH_FAILED2 }, |
170 | { "decrypt-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_DECRYPT_FAILED3 } |
171 | }; |
172 | |
173 | static const struct icmpcodeent icmp6_code[] = { |
174 | { "admin-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADMIN1 }, |
175 | { "noroute-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOROUTE0 }, |
176 | { "beyond-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_BEYONDSCOPE2 }, |
177 | { "addr-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADDR3 }, |
178 | { "port-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOPORT4 }, |
179 | { "transit", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_TRANSIT0 }, |
180 | { "reassemb", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_REASSEMBLY1 }, |
181 | { "badhead", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_HEADER0 }, |
182 | { "nxthdr", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_NEXTHEADER1 }, |
183 | { "redironlink", ND_REDIRECT137, ND_REDIRECT_ONLINK0 }, |
184 | { "redirrouter", ND_REDIRECT137, ND_REDIRECT_ROUTER1 } |
185 | }; |
186 | |
187 | const struct pf_timeout pf_timeouts[] = { |
188 | { "tcp.first", PFTM_TCP_FIRST_PACKET }, |
189 | { "tcp.opening", PFTM_TCP_OPENING }, |
190 | { "tcp.established", PFTM_TCP_ESTABLISHED }, |
191 | { "tcp.closing", PFTM_TCP_CLOSING }, |
192 | { "tcp.finwait", PFTM_TCP_FIN_WAIT }, |
193 | { "tcp.closed", PFTM_TCP_CLOSED }, |
194 | { "tcp.tsdiff", PFTM_TS_DIFF }, |
195 | { "udp.first", PFTM_UDP_FIRST_PACKET }, |
196 | { "udp.single", PFTM_UDP_SINGLE }, |
197 | { "udp.multiple", PFTM_UDP_MULTIPLE }, |
198 | { "icmp.first", PFTM_ICMP_FIRST_PACKET }, |
199 | { "icmp.error", PFTM_ICMP_ERROR_REPLY }, |
200 | { "other.first", PFTM_OTHER_FIRST_PACKET }, |
201 | { "other.single", PFTM_OTHER_SINGLE }, |
202 | { "other.multiple", PFTM_OTHER_MULTIPLE }, |
203 | { "frag", PFTM_FRAG }, |
204 | { "interval", PFTM_INTERVAL }, |
205 | { "adaptive.start", PFTM_ADAPTIVE_START }, |
206 | { "adaptive.end", PFTM_ADAPTIVE_END }, |
207 | { "src.track", PFTM_SRC_NODE }, |
208 | { NULL((void *)0), 0 } |
209 | }; |
210 | |
211 | enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; |
212 | |
213 | void |
214 | copy_satopfaddr(struct pf_addr *pfa, struct sockaddr *sa) |
215 | { |
216 | if (sa->sa_family == AF_INET624) |
217 | pfa->v6pfa.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr; |
218 | else if (sa->sa_family == AF_INET2) |
219 | pfa->v4pfa.v4 = ((struct sockaddr_in *)sa)->sin_addr; |
220 | else |
221 | warnx("unhandled af %d", sa->sa_family); |
222 | } |
223 | |
224 | const struct icmptypeent * |
225 | geticmptypebynumber(u_int8_t type, sa_family_t af) |
226 | { |
227 | unsigned int i; |
228 | |
229 | if (af != AF_INET624) { |
230 | for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); |
231 | i++) { |
232 | if (type == icmp_type[i].type) |
233 | return (&icmp_type[i]); |
234 | } |
235 | } else { |
236 | for (i=0; i < (sizeof (icmp6_type) / |
237 | sizeof(icmp6_type[0])); i++) { |
238 | if (type == icmp6_type[i].type) |
239 | return (&icmp6_type[i]); |
240 | } |
241 | } |
242 | return (NULL((void *)0)); |
243 | } |
244 | |
245 | const struct icmptypeent * |
246 | geticmptypebyname(char *w, sa_family_t af) |
247 | { |
248 | unsigned int i; |
249 | |
250 | if (af != AF_INET624) { |
251 | for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); |
252 | i++) { |
253 | if (!strcmp(w, icmp_type[i].name)) |
254 | return (&icmp_type[i]); |
255 | } |
256 | } else { |
257 | for (i=0; i < (sizeof (icmp6_type) / |
258 | sizeof(icmp6_type[0])); i++) { |
259 | if (!strcmp(w, icmp6_type[i].name)) |
260 | return (&icmp6_type[i]); |
261 | } |
262 | } |
263 | return (NULL((void *)0)); |
264 | } |
265 | |
266 | const struct icmpcodeent * |
267 | geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) |
268 | { |
269 | unsigned int i; |
270 | |
271 | if (af != AF_INET624) { |
272 | for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); |
273 | i++) { |
274 | if (type == icmp_code[i].type && |
275 | code == icmp_code[i].code) |
276 | return (&icmp_code[i]); |
277 | } |
278 | } else { |
279 | for (i=0; i < (sizeof (icmp6_code) / |
280 | sizeof(icmp6_code[0])); i++) { |
281 | if (type == icmp6_code[i].type && |
282 | code == icmp6_code[i].code) |
283 | return (&icmp6_code[i]); |
284 | } |
285 | } |
286 | return (NULL((void *)0)); |
287 | } |
288 | |
289 | const struct icmpcodeent * |
290 | geticmpcodebyname(u_long type, char *w, sa_family_t af) |
291 | { |
292 | unsigned int i; |
293 | |
294 | if (af != AF_INET624) { |
295 | for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); |
296 | i++) { |
297 | if (type == icmp_code[i].type && |
298 | !strcmp(w, icmp_code[i].name)) |
299 | return (&icmp_code[i]); |
300 | } |
301 | } else { |
302 | for (i=0; i < (sizeof (icmp6_code) / |
303 | sizeof(icmp6_code[0])); i++) { |
304 | if (type == icmp6_code[i].type && |
305 | !strcmp(w, icmp6_code[i].name)) |
306 | return (&icmp6_code[i]); |
307 | } |
308 | } |
309 | return (NULL((void *)0)); |
310 | } |
311 | |
312 | /* |
313 | * Decode a symbolic name to a numeric value. |
314 | * From syslogd. |
315 | */ |
316 | int |
317 | string_to_loglevel(const char *name) |
318 | { |
319 | CODE *c; |
320 | char *p, buf[40]; |
321 | |
322 | if (isdigit((unsigned char)*name)) { |
323 | const char *errstr; |
324 | int val; |
325 | |
326 | val = strtonum(name, 0, LOG_DEBUG7, &errstr); |
327 | if (errstr) |
328 | return -1; |
329 | return val; |
330 | } |
331 | |
332 | for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { |
333 | if (isupper((unsigned char)*name)) |
334 | *p = tolower((unsigned char)*name); |
335 | else |
336 | *p = *name; |
337 | } |
338 | *p = '\0'; |
339 | for (c = prioritynames; c->c_name; c++) |
340 | if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI0x10) |
341 | return (c->c_val); |
342 | |
343 | return (-1); |
344 | } |
345 | |
346 | const char * |
347 | loglevel_to_string(int level) |
348 | { |
349 | CODE *c; |
350 | |
351 | for (c = prioritynames; c->c_name; c++) |
352 | if (c->c_val == level) |
353 | return (c->c_name); |
354 | |
355 | return ("unknown"); |
356 | } |
357 | |
358 | void |
359 | print_op(u_int8_t op, const char *a1, const char *a2) |
360 | { |
361 | if (op == PF_OP_IRG) |
362 | printf(" %s >< %s", a1, a2); |
363 | else if (op == PF_OP_XRG) |
364 | printf(" %s <> %s", a1, a2); |
365 | else if (op == PF_OP_EQ) |
366 | printf(" = %s", a1); |
367 | else if (op == PF_OP_NE) |
368 | printf(" != %s", a1); |
369 | else if (op == PF_OP_LT) |
370 | printf(" < %s", a1); |
371 | else if (op == PF_OP_LE) |
372 | printf(" <= %s", a1); |
373 | else if (op == PF_OP_GT) |
374 | printf(" > %s", a1); |
375 | else if (op == PF_OP_GE) |
376 | printf(" >= %s", a1); |
377 | else if (op == PF_OP_RRG) |
378 | printf(" %s:%s", a1, a2); |
379 | } |
380 | |
381 | void |
382 | print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) |
383 | { |
384 | char a1[6], a2[6]; |
385 | struct servent *s = NULL((void *)0); |
386 | |
387 | if (opts & PF_OPT_PORTNAMES0x08000) |
388 | s = getservbyport(p1, proto); |
389 | p1 = ntohs(p1)(__uint16_t)(__builtin_constant_p(p1) ? (__uint16_t)(((__uint16_t )(p1) & 0xffU) << 8 | ((__uint16_t)(p1) & 0xff00U ) >> 8) : __swap16md(p1)); |
390 | p2 = ntohs(p2)(__uint16_t)(__builtin_constant_p(p2) ? (__uint16_t)(((__uint16_t )(p2) & 0xffU) << 8 | ((__uint16_t)(p2) & 0xff00U ) >> 8) : __swap16md(p2)); |
391 | snprintf(a1, sizeof(a1), "%u", p1); |
392 | snprintf(a2, sizeof(a2), "%u", p2); |
393 | printf(" port"); |
394 | if (s != NULL((void *)0) && (op == PF_OP_EQ || op == PF_OP_NE)) |
395 | print_op(op, s->s_name, a2); |
396 | else |
397 | print_op(op, a1, a2); |
398 | } |
399 | |
400 | void |
401 | print_ugid(u_int8_t op, id_t i1, id_t i2, const char *t) |
402 | { |
403 | char a1[11], a2[11]; |
404 | |
405 | snprintf(a1, sizeof(a1), "%u", i1); |
406 | snprintf(a2, sizeof(a2), "%u", i2); |
407 | printf(" %s", t); |
408 | if (i1 == -1 && (op == PF_OP_EQ || op == PF_OP_NE)) |
409 | print_op(op, "unknown", a2); |
410 | else |
411 | print_op(op, a1, a2); |
412 | } |
413 | |
414 | void |
415 | print_flags(u_int8_t f) |
416 | { |
417 | int i; |
418 | |
419 | for (i = 0; tcpflags[i]; ++i) |
420 | if (f & (1 << i)) |
421 | printf("%c", tcpflags[i]); |
422 | } |
423 | |
424 | void |
425 | print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, |
426 | sa_family_t af, u_int8_t proto, int opts) |
427 | { |
428 | char buf[PF_OSFP_LEN32*3]; |
429 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); |
430 | if (src->addr.type == PF_ADDR_ADDRMASK && |
431 | dst->addr.type == PF_ADDR_ADDRMASK && |
432 | PF_AZERO(&src->addr.v.a.addr, AF_INET6)((24 == 2 && !(&src->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.addr)-> pfa.addr32[0] && !(&src->addr.v.a.addr)->pfa .addr32[1] && !(&src->addr.v.a.addr)->pfa.addr32 [2] && !(&src->addr.v.a.addr)->pfa.addr32[3 ] )) && |
433 | PF_AZERO(&src->addr.v.a.mask, AF_INET6)((24 == 2 && !(&src->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.mask)-> pfa.addr32[0] && !(&src->addr.v.a.mask)->pfa .addr32[1] && !(&src->addr.v.a.mask)->pfa.addr32 [2] && !(&src->addr.v.a.mask)->pfa.addr32[3 ] )) && |
434 | PF_AZERO(&dst->addr.v.a.addr, AF_INET6)((24 == 2 && !(&dst->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.addr)-> pfa.addr32[0] && !(&dst->addr.v.a.addr)->pfa .addr32[1] && !(&dst->addr.v.a.addr)->pfa.addr32 [2] && !(&dst->addr.v.a.addr)->pfa.addr32[3 ] )) && |
435 | PF_AZERO(&dst->addr.v.a.mask, AF_INET6)((24 == 2 && !(&dst->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.mask)-> pfa.addr32[0] && !(&dst->addr.v.a.mask)->pfa .addr32[1] && !(&dst->addr.v.a.mask)->pfa.addr32 [2] && !(&dst->addr.v.a.mask)->pfa.addr32[3 ] )) && |
436 | !src->neg && !dst->neg && |
437 | !src->port_op && !dst->port_op && |
438 | osfp == PF_OSFP_ANY((pf_osfp_t)0)) |
439 | printf(" all"); |
440 | else { |
441 | printf(" from "); |
442 | if (src->neg) |
443 | printf("! "); |
444 | print_addr(&src->addr, af, verbose); |
445 | if (src->port_op) |
446 | print_port(src->port_op, src->port[0], |
447 | src->port[1], |
448 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); |
449 | if (osfp != PF_OSFP_ANY((pf_osfp_t)0)) |
450 | printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, |
451 | sizeof(buf))); |
452 | |
453 | printf(" to "); |
454 | if (dst->neg) |
455 | printf("! "); |
456 | print_addr(&dst->addr, af, verbose); |
457 | if (dst->port_op) |
458 | print_port(dst->port_op, dst->port[0], |
459 | dst->port[1], |
460 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); |
461 | } |
462 | } |
463 | |
464 | void |
465 | print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, |
466 | sa_family_t af, int id, int verbose) |
467 | { |
468 | if (pool->ifname[0]) { |
469 | if (!PF_AZERO(&pool->addr.v.a.addr, af)((af == 2 && !(&pool->addr.v.a.addr)->pfa.addr32 [0]) || (af == 24 && !(&pool->addr.v.a.addr)-> pfa.addr32[0] && !(&pool->addr.v.a.addr)->pfa .addr32[1] && !(&pool->addr.v.a.addr)->pfa. addr32[2] && !(&pool->addr.v.a.addr)->pfa.addr32 [3] ))) { |
470 | print_addr(&pool->addr, af, verbose); |
471 | printf("@"); |
472 | } |
473 | printf("%s", pool->ifname); |
474 | } else |
475 | print_addr(&pool->addr, af, verbose); |
476 | switch (id) { |
477 | case PF_POOL_NAT: |
478 | if ((p1 != PF_NAT_PROXY_PORT_LOW50001 || |
479 | p2 != PF_NAT_PROXY_PORT_HIGH65535) && (p1 != 0 || p2 != 0)) { |
480 | if (p1 == p2) |
481 | printf(" port %u", p1); |
482 | else |
483 | printf(" port %u:%u", p1, p2); |
484 | } |
485 | break; |
486 | case PF_POOL_RDR: |
487 | if (p1) { |
488 | printf(" port %u", p1); |
489 | if (p2 && (p2 != p1)) |
490 | printf(":%u", p2); |
491 | } |
492 | break; |
493 | default: |
494 | break; |
495 | } |
496 | switch (pool->opts & PF_POOL_TYPEMASK0x0f) { |
497 | case PF_POOL_NONE: |
498 | break; |
499 | case PF_POOL_BITMASK: |
500 | printf(" bitmask"); |
501 | break; |
502 | case PF_POOL_RANDOM: |
503 | printf(" random"); |
504 | break; |
505 | case PF_POOL_SRCHASH: |
506 | printf(" source-hash 0x%08x%08x%08x%08x", |
507 | pool->key.key32pfk.key32[0], pool->key.key32pfk.key32[1], |
508 | pool->key.key32pfk.key32[2], pool->key.key32pfk.key32[3]); |
509 | break; |
510 | case PF_POOL_ROUNDROBIN: |
511 | printf(" round-robin"); |
512 | break; |
513 | case PF_POOL_LEASTSTATES: |
514 | printf(" least-states"); |
515 | break; |
516 | } |
517 | if (pool->opts & PF_POOL_STICKYADDR0x20) |
518 | printf(" sticky-address"); |
519 | if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) |
520 | printf(" static-port"); |
521 | } |
522 | |
523 | const char *pf_reasons[PFRES_MAX17+1] = PFRES_NAMES{ "match", "bad-offset", "fragment", "short", "normalize", "memory" , "bad-timestamp", "congestion", "ip-option", "proto-cksum", "state-mismatch" , "state-insert", "state-limit", "src-limit", "synproxy", "translate" , "no-route", ((void *)0) }; |
524 | const char *pf_lcounters[LCNT_MAX10+1] = LCNT_NAMES{ "max states per rule", "max-src-states", "max-src-nodes", "max-src-conn" , "max-src-conn-rate", "overload table insertion", "overload flush states" , "synfloods detected", "syncookies sent", "syncookies validated" , ((void *)0) }; |
525 | const char *pf_fcounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; |
526 | const char *pf_scounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; |
527 | |
528 | void |
529 | print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts) |
530 | { |
531 | char statline[80], *running, *debug; |
532 | time_t runtime = 0; |
533 | struct timespec uptime; |
534 | int i; |
535 | char buf[PF_MD5_DIGEST_LENGTH16 * 2 + 1]; |
536 | static const char hex[] = "0123456789abcdef"; |
537 | |
538 | if (!clock_gettime(CLOCK_BOOTTIME6, &uptime)) |
539 | runtime = uptime.tv_sec - s->since; |
540 | running = s->running ? "Enabled" : "Disabled"; |
541 | |
542 | if (runtime) { |
543 | unsigned int sec, min, hrs; |
544 | time_t day = runtime; |
545 | |
546 | sec = day % 60; |
547 | day /= 60; |
548 | min = day % 60; |
549 | day /= 60; |
550 | hrs = day % 24; |
551 | day /= 24; |
552 | snprintf(statline, sizeof(statline), |
553 | "Status: %s for %lld days %.2u:%.2u:%.2u", |
554 | running, (long long)day, hrs, min, sec); |
555 | } else |
556 | snprintf(statline, sizeof(statline), "Status: %s", running); |
557 | printf("%-44s", statline); |
558 | if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) { |
559 | printf("%15s\n\n", debug); |
560 | free(debug); |
561 | } |
562 | |
563 | if (opts & PF_OPT_VERBOSE0x00004) { |
564 | printf("Hostid: 0x%08x\n", ntohl(s->hostid)(__uint32_t)(__builtin_constant_p(s->hostid) ? (__uint32_t )(((__uint32_t)(s->hostid) & 0xff) << 24 | ((__uint32_t )(s->hostid) & 0xff00) << 8 | ((__uint32_t)(s-> hostid) & 0xff0000) >> 8 | ((__uint32_t)(s->hostid ) & 0xff000000) >> 24) : __swap32md(s->hostid))); |
565 | |
566 | for (i = 0; i < PF_MD5_DIGEST_LENGTH16; i++) { |
567 | buf[i + i] = hex[s->pf_chksum[i] >> 4]; |
568 | buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; |
569 | } |
570 | buf[i + i] = '\0'; |
571 | printf("Checksum: 0x%s\n\n", buf); |
572 | } |
573 | |
574 | if (s->ifname[0] != 0) { |
575 | printf("Interface Stats for %-16s %5s %16s\n", |
576 | s->ifname, "IPv4", "IPv6"); |
577 | printf(" %-25s %14llu %16llu\n", "Bytes In", |
578 | (unsigned long long)s->bcounters[0][0], |
579 | (unsigned long long)s->bcounters[1][0]); |
580 | printf(" %-25s %14llu %16llu\n", "Bytes Out", |
581 | (unsigned long long)s->bcounters[0][1], |
582 | (unsigned long long)s->bcounters[1][1]); |
583 | printf(" Packets In\n"); |
584 | printf(" %-23s %14llu %16llu\n", "Passed", |
585 | (unsigned long long)s->pcounters[0][0][PF_PASS], |
586 | (unsigned long long)s->pcounters[1][0][PF_PASS]); |
587 | printf(" %-23s %14llu %16llu\n", "Blocked", |
588 | (unsigned long long)s->pcounters[0][0][PF_DROP], |
589 | (unsigned long long)s->pcounters[1][0][PF_DROP]); |
590 | printf(" Packets Out\n"); |
591 | printf(" %-23s %14llu %16llu\n", "Passed", |
592 | (unsigned long long)s->pcounters[0][1][PF_PASS], |
593 | (unsigned long long)s->pcounters[1][1][PF_PASS]); |
594 | printf(" %-23s %14llu %16llu\n\n", "Blocked", |
595 | (unsigned long long)s->pcounters[0][1][PF_DROP], |
596 | (unsigned long long)s->pcounters[1][1][PF_DROP]); |
597 | } |
598 | printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); |
599 | printf(" %-25s %14u %14s\n", "current entries", s->states, ""); |
600 | printf(" %-25s %14u %14s\n", "half-open tcp", s->states_halfopen, ""); |
601 | for (i = 0; i < FCNT_MAX3; i++) { |
602 | printf(" %-25s %14llu ", pf_fcounters[i], |
603 | (unsigned long long)s->fcounters[i]); |
604 | if (runtime > 0) |
605 | printf("%14.1f/s\n", |
606 | (double)s->fcounters[i] / (double)runtime); |
607 | else |
608 | printf("%14s\n", ""); |
609 | } |
610 | if (opts & PF_OPT_VERBOSE0x00004) { |
611 | printf("Source Tracking Table\n"); |
612 | printf(" %-25s %14u %14s\n", "current entries", |
613 | s->src_nodes, ""); |
614 | for (i = 0; i < SCNT_MAX3; i++) { |
615 | printf(" %-25s %14lld ", pf_scounters[i], |
616 | s->scounters[i]); |
617 | if (runtime > 0) |
618 | printf("%14.1f/s\n", |
619 | (double)s->scounters[i] / (double)runtime); |
620 | else |
621 | printf("%14s\n", ""); |
622 | } |
623 | } |
624 | printf("Counters\n"); |
625 | for (i = 0; i < PFRES_MAX17; i++) { |
626 | printf(" %-25s %14llu ", pf_reasons[i], |
627 | (unsigned long long)s->counters[i]); |
628 | if (runtime > 0) |
629 | printf("%14.1f/s\n", |
630 | (double)s->counters[i] / (double)runtime); |
631 | else |
632 | printf("%14s\n", ""); |
633 | } |
634 | if (opts & PF_OPT_VERBOSE0x00004) { |
635 | printf("Limit Counters\n"); |
636 | for (i = 0; i < LCNT_MAX10; i++) { |
637 | printf(" %-25s %14lld ", pf_lcounters[i], |
638 | s->lcounters[i]); |
639 | if (runtime > 0) |
640 | printf("%14.1f/s\n", |
641 | (double)s->lcounters[i] / (double)runtime); |
642 | else |
643 | printf("%14s\n", ""); |
644 | } |
645 | } |
646 | if (opts & PF_OPT_VERBOSE0x00004) { |
647 | printf("Adaptive Syncookies Watermarks\n"); |
648 | printf(" %-25s %14d states\n", "start", synflwats->hi); |
649 | printf(" %-25s %14d states\n", "end", synflwats->lo); |
650 | } |
651 | } |
652 | |
653 | void |
654 | print_src_node(struct pf_src_node *sn, int opts) |
655 | { |
656 | struct pf_addr_wrap aw; |
657 | int min, sec; |
658 | |
659 | memset(&aw, 0, sizeof(aw)); |
660 | if (sn->af == AF_INET2) |
661 | aw.v.a.mask.addr32pfa.addr32[0] = 0xffffffff; |
662 | else |
663 | memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); |
664 | |
665 | aw.v.a.addr = sn->addr; |
666 | print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE20x00080); |
667 | |
668 | if (!PF_AZERO(&sn->raddr, sn->af)((sn->af == 2 && !(&sn->raddr)->pfa.addr32 [0]) || (sn->af == 24 && !(&sn->raddr)-> pfa.addr32[0] && !(&sn->raddr)->pfa.addr32[ 1] && !(&sn->raddr)->pfa.addr32[2] && !(&sn->raddr)->pfa.addr32[3] ))) { |
669 | if (sn->type == PF_SN_NAT) |
670 | printf(" nat-to "); |
671 | else if (sn->type == PF_SN_RDR) |
672 | printf(" rdr-to "); |
673 | else if (sn->type == PF_SN_ROUTE) |
674 | printf(" route-to "); |
675 | else |
676 | printf(" ??? (%u) ", sn->type); |
677 | aw.v.a.addr = sn->raddr; |
678 | print_addr(&aw, sn->naf ? sn->naf : sn->af, |
679 | opts & PF_OPT_VERBOSE20x00080); |
680 | } |
681 | |
682 | printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, |
683 | sn->conn, sn->conn_rate.count / 1000, |
684 | (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); |
685 | if (opts & PF_OPT_VERBOSE0x00004) { |
686 | sec = sn->creation % 60; |
687 | sn->creation /= 60; |
688 | min = sn->creation % 60; |
689 | sn->creation /= 60; |
690 | printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); |
691 | if (sn->states == 0) { |
692 | sec = sn->expire % 60; |
693 | sn->expire /= 60; |
694 | min = sn->expire % 60; |
695 | sn->expire /= 60; |
696 | printf(", expires in %.2u:%.2u:%.2u", |
697 | sn->expire, min, sec); |
698 | } |
699 | printf(", %llu pkts, %llu bytes", |
700 | sn->packets[0] + sn->packets[1], |
701 | sn->bytes[0] + sn->bytes[1]); |
702 | if (sn->rule.nr != -1) |
703 | printf(", rule %u", sn->rule.nr); |
704 | printf("\n"); |
705 | } |
706 | } |
707 | |
708 | void |
709 | print_rule(struct pf_rule *r, const char *anchor_call, int opts) |
710 | { |
711 | static const char *actiontypes[] = { "pass", "block", "scrub", |
712 | "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", |
713 | "", "", "match"}; |
714 | static const char *anchortypes[] = { "anchor", "anchor", "anchor", |
715 | "anchor", "nat-anchor", "nat-anchor", "binat-anchor", |
716 | "binat-anchor", "rdr-anchor", "rdr-anchor" }; |
717 | int i, ropts; |
718 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); |
719 | char *p; |
720 | |
721 | if ((r->rule_flag & PFRULE_EXPIRED0x00400000) && (!verbose)) |
722 | return; |
723 | |
724 | if (verbose) |
725 | printf("@%d ", r->nr); |
726 | |
727 | if (r->action > PF_MATCH) |
728 | printf("action(%d)", r->action); |
729 | else if (anchor_call[0]) { |
730 | p = strrchr(anchor_call, '/'); |
731 | if (p ? p[1] == '_' : anchor_call[0] == '_') |
732 | printf("%s", anchortypes[r->action]); |
733 | else |
734 | printf("%s \"%s\"", anchortypes[r->action], |
735 | anchor_call); |
736 | } else |
737 | printf("%s", actiontypes[r->action]); |
738 | if (r->action == PF_DROP) { |
739 | if (r->rule_flag & PFRULE_RETURN0x0008) |
740 | printf(" return"); |
741 | else if (r->rule_flag & PFRULE_RETURNRST0x0001) { |
742 | if (!r->return_ttl) |
743 | printf(" return-rst"); |
744 | else |
745 | printf(" return-rst(ttl %d)", r->return_ttl); |
746 | } else if (r->rule_flag & PFRULE_RETURNICMP0x0004) { |
747 | const struct icmpcodeent *ic, *ic6; |
748 | |
749 | ic = geticmpcodebynumber(r->return_icmp >> 8, |
750 | r->return_icmp & 255, AF_INET2); |
751 | ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, |
752 | r->return_icmp6 & 255, AF_INET624); |
753 | |
754 | switch (r->af) { |
755 | case AF_INET2: |
756 | printf(" return-icmp"); |
757 | if (ic == NULL((void *)0)) |
758 | printf("(%u)", r->return_icmp & 255); |
759 | else |
760 | printf("(%s)", ic->name); |
761 | break; |
762 | case AF_INET624: |
763 | printf(" return-icmp6"); |
764 | if (ic6 == NULL((void *)0)) |
765 | printf("(%u)", r->return_icmp6 & 255); |
766 | else |
767 | printf("(%s)", ic6->name); |
768 | break; |
769 | default: |
770 | printf(" return-icmp"); |
771 | if (ic == NULL((void *)0)) |
772 | printf("(%u, ", r->return_icmp & 255); |
773 | else |
774 | printf("(%s, ", ic->name); |
775 | if (ic6 == NULL((void *)0)) |
776 | printf("%u)", r->return_icmp6 & 255); |
777 | else |
778 | printf("%s)", ic6->name); |
779 | break; |
780 | } |
781 | } else |
782 | printf(" drop"); |
783 | } |
784 | if (r->direction == PF_IN) |
785 | printf(" in"); |
786 | else if (r->direction == PF_OUT) |
787 | printf(" out"); |
788 | if (r->log) { |
789 | printf(" log"); |
790 | if (r->log & ~PF_LOG0x01 || r->logif) { |
791 | int count = 0; |
792 | |
793 | printf(" ("); |
794 | if (r->log & PF_LOG_ALL0x02) |
795 | printf("%sall", count++ ? ", " : ""); |
796 | if (r->log & PF_LOG_MATCHES0x10) |
797 | printf("%smatches", count++ ? ", " : ""); |
798 | if (r->log & PF_LOG_USER0x04) |
799 | printf("%suser", count++ ? ", " : ""); |
800 | if (r->logif) |
801 | printf("%sto pflog%u", count++ ? ", " : "", |
802 | r->logif); |
803 | printf(")"); |
804 | } |
805 | } |
806 | if (r->quick) |
807 | printf(" quick"); |
808 | if (r->ifname[0]) { |
809 | if (r->ifnot) |
810 | printf(" on ! %s", r->ifname); |
811 | else |
812 | printf(" on %s", r->ifname); |
813 | } |
814 | if (r->onrdomain >= 0) { |
815 | if (r->ifnot) |
816 | printf(" on ! rdomain %d", r->onrdomain); |
817 | else |
818 | printf(" on rdomain %d", r->onrdomain); |
819 | } |
820 | if (r->af) { |
821 | if (r->af == AF_INET2) |
822 | printf(" inet"); |
823 | else |
824 | printf(" inet6"); |
825 | } |
826 | if (r->proto) { |
827 | struct protoent *p; |
828 | |
829 | if ((p = getprotobynumber(r->proto)) != NULL((void *)0)) |
830 | printf(" proto %s", p->p_name); |
831 | else |
832 | printf(" proto %u", r->proto); |
833 | } |
834 | print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, |
835 | opts); |
836 | if (r->rcv_ifname[0]) |
837 | printf(" %sreceived-on %s", r->rcvifnot ? "!" : "", |
838 | r->rcv_ifname); |
839 | if (r->uid.op) |
840 | print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user"); |
841 | if (r->gid.op) |
842 | print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group"); |
843 | if (r->flags || r->flagset) { |
844 | printf(" flags "); |
845 | print_flags(r->flags); |
846 | printf("/"); |
847 | print_flags(r->flagset); |
848 | } else if ((r->action == PF_PASS || r->action == PF_MATCH) && |
849 | (!r->proto || r->proto == IPPROTO_TCP6) && |
850 | !(r->rule_flag & PFRULE_FRAGMENT0x0002) && |
851 | !anchor_call[0] && r->keep_state) |
852 | printf(" flags any"); |
853 | if (r->type) { |
854 | const struct icmptypeent *it; |
855 | |
856 | it = geticmptypebynumber(r->type-1, r->af); |
857 | if (r->af != AF_INET624) |
858 | printf(" icmp-type"); |
859 | else |
860 | printf(" icmp6-type"); |
861 | if (it != NULL((void *)0)) |
862 | printf(" %s", it->name); |
863 | else |
864 | printf(" %u", r->type-1); |
865 | if (r->code) { |
866 | const struct icmpcodeent *ic; |
867 | |
868 | ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); |
869 | if (ic != NULL((void *)0)) |
870 | printf(" code %s", ic->name); |
871 | else |
872 | printf(" code %u", r->code-1); |
873 | } |
874 | } |
875 | if (r->tos) |
876 | printf(" tos 0x%2.2x", r->tos); |
877 | if (r->prio) |
878 | printf(" prio %u", r->prio == PF_PRIO_ZERO0xff ? 0 : r->prio); |
879 | if (r->pktrate.limit) |
880 | printf(" max-pkt-rate %u/%u", r->pktrate.limit, |
881 | r->pktrate.seconds); |
882 | |
883 | if (r->scrub_flags & PFSTATE_SETMASK(0x0040|0x0200) || r->qname[0] || |
884 | r->rule_flag & PFRULE_SETDELAY0x0080) { |
885 | char *comma = ""; |
886 | printf(" set ("); |
887 | if (r->scrub_flags & PFSTATE_SETPRIO0x0200) { |
888 | if (r->set_prio[0] == r->set_prio[1]) |
889 | printf("%sprio %u", comma, r->set_prio[0]); |
890 | else |
891 | printf("%sprio(%u, %u)", comma, r->set_prio[0], |
892 | r->set_prio[1]); |
893 | comma = ", "; |
894 | } |
895 | if (r->qname[0]) { |
896 | if (r->pqname[0]) |
897 | printf("%squeue(%s, %s)", comma, r->qname, |
898 | r->pqname); |
899 | else |
900 | printf("%squeue %s", comma, r->qname); |
901 | comma = ", "; |
902 | } |
903 | if (r->scrub_flags & PFSTATE_SETTOS0x0040) { |
904 | printf("%stos 0x%2.2x", comma, r->set_tos); |
905 | comma = ", "; |
906 | } |
907 | if (r->rule_flag & PFRULE_SETDELAY0x0080) { |
908 | printf("%sdelay %u", comma, r->delay); |
909 | comma = ", "; |
910 | } |
911 | printf(")"); |
912 | } |
913 | |
914 | ropts = 0; |
915 | if (r->max_states || r->max_src_nodes || r->max_src_states) |
916 | ropts = 1; |
917 | if (r->rule_flag & PFRULE_NOSYNC0x0010) |
918 | ropts = 1; |
919 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) |
920 | ropts = 1; |
921 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) |
922 | ropts = 1; |
923 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) |
924 | ropts = 1; |
925 | if (r->rule_flag & PFRULE_PFLOW0x00040000) |
926 | ropts = 1; |
927 | for (i = 0; !ropts && i < PFTM_MAX; ++i) |
928 | if (r->timeout[i]) |
929 | ropts = 1; |
930 | |
931 | if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) |
932 | printf(" no state"); |
933 | else if (r->keep_state == PF_STATE_NORMAL0x1 && ropts) |
934 | printf(" keep state"); |
935 | else if (r->keep_state == PF_STATE_MODULATE0x2) |
936 | printf(" modulate state"); |
937 | else if (r->keep_state == PF_STATE_SYNPROXY0x3) |
938 | printf(" synproxy state"); |
939 | if (r->prob) { |
940 | char buf[20]; |
941 | |
942 | snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX(2147483647 *2U +1U)+1.0)); |
943 | for (i = strlen(buf)-1; i > 0; i--) { |
944 | if (buf[i] == '0') |
945 | buf[i] = '\0'; |
946 | else { |
947 | if (buf[i] == '.') |
948 | buf[i] = '\0'; |
949 | break; |
950 | } |
951 | } |
952 | printf(" probability %s%%", buf); |
953 | } |
954 | if (ropts) { |
955 | printf(" ("); |
956 | if (r->max_states) { |
957 | printf("max %u", r->max_states); |
958 | ropts = 0; |
959 | } |
960 | if (r->rule_flag & PFRULE_NOSYNC0x0010) { |
961 | if (!ropts) |
962 | printf(", "); |
963 | printf("no-sync"); |
964 | ropts = 0; |
965 | } |
966 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) { |
967 | if (!ropts) |
968 | printf(", "); |
969 | printf("source-track"); |
970 | if (r->rule_flag & PFRULE_RULESRCTRACK0x0040) |
971 | printf(" rule"); |
972 | else |
973 | printf(" global"); |
974 | ropts = 0; |
975 | } |
976 | if (r->max_src_states) { |
977 | if (!ropts) |
978 | printf(", "); |
979 | printf("max-src-states %u", r->max_src_states); |
980 | ropts = 0; |
981 | } |
982 | if (r->max_src_conn) { |
983 | if (!ropts) |
984 | printf(", "); |
985 | printf("max-src-conn %u", r->max_src_conn); |
986 | ropts = 0; |
987 | } |
988 | if (r->max_src_conn_rate.limit) { |
989 | if (!ropts) |
990 | printf(", "); |
991 | printf("max-src-conn-rate %u/%u", |
992 | r->max_src_conn_rate.limit, |
993 | r->max_src_conn_rate.seconds); |
994 | ropts = 0; |
995 | } |
996 | if (r->max_src_nodes) { |
997 | if (!ropts) |
998 | printf(", "); |
999 | printf("max-src-nodes %u", r->max_src_nodes); |
1000 | ropts = 0; |
1001 | } |
1002 | if (r->overload_tblname[0]) { |
1003 | if (!ropts) |
1004 | printf(", "); |
1005 | printf("overload <%s>", r->overload_tblname); |
1006 | if (r->flush) |
1007 | printf(" flush"); |
1008 | if (r->flush & PF_FLUSH_GLOBAL0x02) |
1009 | printf(" global"); |
1010 | } |
1011 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) { |
1012 | if (!ropts) |
1013 | printf(", "); |
1014 | printf("if-bound"); |
1015 | ropts = 0; |
1016 | } |
1017 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) { |
1018 | if (!ropts) |
1019 | printf(", "); |
1020 | printf("sloppy"); |
1021 | ropts = 0; |
1022 | } |
1023 | if (r->rule_flag & PFRULE_PFLOW0x00040000) { |
1024 | if (!ropts) |
1025 | printf(", "); |
1026 | printf("pflow"); |
1027 | ropts = 0; |
1028 | } |
1029 | for (i = 0; i < PFTM_MAX; ++i) |
1030 | if (r->timeout[i]) { |
1031 | int j; |
1032 | |
1033 | if (!ropts) |
1034 | printf(", "); |
1035 | ropts = 0; |
1036 | for (j = 0; pf_timeouts[j].name != NULL((void *)0); |
1037 | ++j) |
1038 | if (pf_timeouts[j].timeout == i) |
1039 | break; |
1040 | printf("%s %u", pf_timeouts[j].name == NULL((void *)0) ? |
1041 | "inv.timeout" : pf_timeouts[j].name, |
1042 | r->timeout[i]); |
1043 | } |
1044 | printf(")"); |
1045 | } |
1046 | |
1047 | if (r->rule_flag & PFRULE_FRAGMENT0x0002) |
1048 | printf(" fragment"); |
1049 | |
1050 | if (r->scrub_flags & PFSTATE_SCRUBMASK(0x0020|0x0080|0x0100) || r->min_ttl || r->max_mss) { |
1051 | printf(" scrub ("); |
1052 | ropts = 1; |
1053 | if (r->scrub_flags & PFSTATE_NODF0x0020) { |
1054 | printf("no-df"); |
1055 | ropts = 0; |
1056 | } |
1057 | if (r->scrub_flags & PFSTATE_RANDOMID0x0080) { |
1058 | if (!ropts) |
1059 | printf(" "); |
1060 | printf("random-id"); |
1061 | ropts = 0; |
1062 | } |
1063 | if (r->min_ttl) { |
1064 | if (!ropts) |
1065 | printf(" "); |
1066 | printf("min-ttl %d", r->min_ttl); |
1067 | ropts = 0; |
1068 | } |
1069 | if (r->scrub_flags & PFSTATE_SCRUB_TCP0x0100) { |
1070 | if (!ropts) |
1071 | printf(" "); |
1072 | printf("reassemble tcp"); |
1073 | ropts = 0; |
1074 | } |
1075 | if (r->max_mss) { |
1076 | if (!ropts) |
1077 | printf(" "); |
1078 | printf("max-mss %d", r->max_mss); |
1079 | ropts = 0; |
Value stored to 'ropts' is never read | |
1080 | } |
1081 | printf(")"); |
1082 | } |
1083 | |
1084 | if (r->allow_opts) |
1085 | printf(" allow-opts"); |
1086 | if (r->label[0]) |
1087 | printf(" label \"%s\"", r->label); |
1088 | if (r->rule_flag & PFRULE_ONCE0x00100000) |
1089 | printf(" once"); |
1090 | if (r->tagname[0]) |
1091 | printf(" tag %s", r->tagname); |
1092 | if (r->match_tagname[0]) { |
1093 | if (r->match_tag_not) |
1094 | printf(" !"); |
1095 | printf(" tagged %s", r->match_tagname); |
1096 | } |
1097 | if (r->rtableid != -1) |
1098 | printf(" rtable %u", r->rtableid); |
1099 | switch (r->divert.type) { |
1100 | case PF_DIVERT_NONE: |
1101 | break; |
1102 | case PF_DIVERT_TO: { |
1103 | printf(" divert-to "); |
1104 | print_addr_str(r->af, &r->divert.addr); |
1105 | printf(" port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); |
1106 | break; |
1107 | } |
1108 | case PF_DIVERT_REPLY: |
1109 | printf(" divert-reply"); |
1110 | break; |
1111 | case PF_DIVERT_PACKET: |
1112 | printf(" divert-packet port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); |
1113 | break; |
1114 | default: |
1115 | printf(" divert ???"); |
1116 | break; |
1117 | } |
1118 | |
1119 | if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && |
1120 | r->rule_flag & PFRULE_AFTO0x00200000) { |
1121 | printf(" af-to %s from ", r->naf == AF_INET2 ? "inet" : "inet6"); |
1122 | print_pool(&r->nat, r->nat.proxy_port[0], |
1123 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, |
1124 | PF_POOL_NAT, verbose); |
1125 | if (r->rdr.addr.type != PF_ADDR_NONE) { |
1126 | printf(" to "); |
1127 | print_pool(&r->rdr, r->rdr.proxy_port[0], |
1128 | r->rdr.proxy_port[1], r->naf ? r->naf : r->af, |
1129 | PF_POOL_RDR, verbose); |
1130 | } |
1131 | } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { |
1132 | printf (" nat-to "); |
1133 | print_pool(&r->nat, r->nat.proxy_port[0], |
1134 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, |
1135 | PF_POOL_NAT, verbose); |
1136 | } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { |
1137 | printf (" rdr-to "); |
1138 | print_pool(&r->rdr, r->rdr.proxy_port[0], |
1139 | r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); |
1140 | } |
1141 | if (r->rt) { |
1142 | if (r->rt == PF_ROUTETO) |
1143 | printf(" route-to"); |
1144 | else if (r->rt == PF_REPLYTO) |
1145 | printf(" reply-to"); |
1146 | else if (r->rt == PF_DUPTO) |
1147 | printf(" dup-to"); |
1148 | printf(" "); |
1149 | print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); |
1150 | } |
1151 | } |
1152 | |
1153 | void |
1154 | print_tabledef(const char *name, int flags, int addrs, |
1155 | struct node_tinithead *nodes) |
1156 | { |
1157 | struct node_tinit *ti, *nti; |
1158 | struct node_host *h; |
1159 | |
1160 | printf("table <%s>", name); |
1161 | if (flags & PFR_TFLAG_CONST0x00000002) |
1162 | printf(" const"); |
1163 | if (flags & PFR_TFLAG_PERSIST0x00000001) |
1164 | printf(" persist"); |
1165 | if (flags & PFR_TFLAG_COUNTERS0x00000040) |
1166 | printf(" counters"); |
1167 | SIMPLEQ_FOREACH(ti, nodes, entries)for((ti) = ((nodes)->sqh_first); (ti) != ((void *)0); (ti) = ((ti)->entries.sqe_next)) { |
1168 | if (ti->file) { |
1169 | printf(" file \"%s\"", ti->file); |
1170 | continue; |
1171 | } |
1172 | printf(" {"); |
1173 | for (;;) { |
1174 | for (h = ti->host; h != NULL((void *)0); h = h->next) { |
1175 | printf(h->not ? " !" : " "); |
1176 | print_addr(&h->addr, h->af, 0); |
1177 | if (h->ifname) |
1178 | printf("@%s", h->ifname); |
1179 | } |
1180 | nti = SIMPLEQ_NEXT(ti, entries)((ti)->entries.sqe_next); |
1181 | if (nti != NULL((void *)0) && nti->file == NULL((void *)0)) |
1182 | ti = nti; /* merge lists */ |
1183 | else |
1184 | break; |
1185 | } |
1186 | printf(" }"); |
1187 | } |
1188 | if (addrs && SIMPLEQ_EMPTY(nodes)(((nodes)->sqh_first) == ((void *)0))) |
1189 | printf(" { }"); |
1190 | printf("\n"); |
1191 | } |
1192 | |
1193 | void |
1194 | print_bwspec(const char *prefix, struct pf_queue_bwspec *bw) |
1195 | { |
1196 | u_int rate; |
1197 | int i; |
1198 | static const char unit[] = " KMG"; |
1199 | |
1200 | if (bw->percent) |
1201 | printf("%s%u%%", prefix, bw->percent); |
1202 | else if (bw->absolute) { |
1203 | rate = bw->absolute; |
1204 | for (i = 0; rate >= 1000 && i <= 3 && (rate % 1000 == 0); i++) |
1205 | rate /= 1000; |
1206 | printf("%s%u%c", prefix, rate, unit[i]); |
1207 | } |
1208 | } |
1209 | |
1210 | void |
1211 | print_scspec(const char *prefix, struct pf_queue_scspec *sc) |
1212 | { |
1213 | print_bwspec(prefix, &sc->m2); |
1214 | if (sc->d) { |
1215 | printf(" burst "); |
1216 | print_bwspec("", &sc->m1); |
1217 | printf(" for %ums", sc->d); |
1218 | } |
1219 | } |
1220 | |
1221 | void |
1222 | print_queuespec(struct pf_queuespec *q) |
1223 | { |
1224 | printf("queue %s", q->qname); |
1225 | if (q->parent[0]) |
1226 | printf(" parent %s", q->parent); |
1227 | else if (q->ifname[0]) |
1228 | printf(" on %s", q->ifname); |
1229 | if (q->flags & PFQS_FLOWQUEUE0x0001) { |
1230 | printf(" flows %u", q->flowqueue.flows); |
1231 | if (q->flowqueue.quantum > 0) |
1232 | printf(" quantum %u", q->flowqueue.quantum); |
1233 | if (q->flowqueue.interval > 0) |
1234 | printf(" interval %ums", |
1235 | q->flowqueue.interval / 1000000); |
1236 | if (q->flowqueue.target > 0) |
1237 | printf(" target %ums", |
1238 | q->flowqueue.target / 1000000); |
1239 | } |
1240 | if (q->linkshare.m1.absolute || q->linkshare.m2.absolute) { |
1241 | print_scspec(" bandwidth ", &q->linkshare); |
1242 | print_scspec(", min ", &q->realtime); |
1243 | print_scspec(", max ", &q->upperlimit); |
1244 | } |
1245 | if (q->flags & PFQS_DEFAULT0x1000) |
1246 | printf(" default"); |
1247 | if (q->qlimit) |
1248 | printf(" qlimit %u", q->qlimit); |
1249 | printf("\n"); |
1250 | } |
1251 | |
1252 | int |
1253 | parse_flags(char *s) |
1254 | { |
1255 | char *p, *q; |
1256 | u_int8_t f = 0; |
1257 | |
1258 | for (p = s; *p; p++) { |
1259 | if ((q = strchr(tcpflags, *p)) == NULL((void *)0)) |
1260 | return -1; |
1261 | else |
1262 | f |= 1 << (q - tcpflags); |
1263 | } |
1264 | return (f ? f : PF_TH_ALL0xFF); |
1265 | } |
1266 | |
1267 | void |
1268 | set_ipmask(struct node_host *h, int bb) |
1269 | { |
1270 | struct pf_addr *m, *n; |
1271 | int i, j = 0; |
1272 | u_int8_t b; |
1273 | |
1274 | m = &h->addr.v.a.mask; |
1275 | memset(m, 0, sizeof(*m)); |
1276 | |
1277 | if (bb == -1) |
1278 | b = h->af == AF_INET2 ? 32 : 128; |
1279 | else |
1280 | b = bb; |
1281 | |
1282 | while (b >= 32) { |
1283 | m->addr32pfa.addr32[j++] = 0xffffffff; |
1284 | b -= 32; |
1285 | } |
1286 | for (i = 31; i > 31-b; --i) |
1287 | m->addr32pfa.addr32[j] |= (1 << i); |
1288 | if (b) |
1289 | m->addr32pfa.addr32[j] = htonl(m->addr32[j])(__uint32_t)(__builtin_constant_p(m->pfa.addr32[j]) ? (__uint32_t )(((__uint32_t)(m->pfa.addr32[j]) & 0xff) << 24 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff00) << 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff0000) >> 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff000000) >> 24) : __swap32md(m->pfa.addr32[j])); |
1290 | |
1291 | /* Mask off bits of the address that will never be used. */ |
1292 | n = &h->addr.v.a.addr; |
1293 | if (h->addr.type == PF_ADDR_ADDRMASK) |
1294 | for (i = 0; i < 4; i++) |
1295 | n->addr32pfa.addr32[i] = n->addr32pfa.addr32[i] & m->addr32pfa.addr32[i]; |
1296 | } |
1297 | |
1298 | int |
1299 | check_netmask(struct node_host *h, sa_family_t af) |
1300 | { |
1301 | struct node_host *n = NULL((void *)0); |
1302 | struct pf_addr *m; |
1303 | |
1304 | for (n = h; n != NULL((void *)0); n = n->next) { |
1305 | if (h->addr.type == PF_ADDR_TABLE) |
1306 | continue; |
1307 | m = &h->addr.v.a.mask; |
1308 | /* netmasks > 32 bit are invalid on v4 */ |
1309 | if (af == AF_INET2 && |
1310 | (m->addr32pfa.addr32[1] || m->addr32pfa.addr32[2] || m->addr32pfa.addr32[3])) { |
1311 | fprintf(stderr(&__sF[2]), "netmask %u invalid for IPv4 address\n", |
1312 | unmask(m)); |
1313 | return (1); |
1314 | } |
1315 | } |
1316 | return (0); |
1317 | } |
1318 | |
1319 | struct node_host * |
1320 | gen_dynnode(struct node_host *h, sa_family_t af) |
1321 | { |
1322 | struct node_host *n; |
1323 | |
1324 | if (h->addr.type != PF_ADDR_DYNIFTL) |
1325 | return (NULL((void *)0)); |
1326 | |
1327 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) |
1328 | return (NULL((void *)0)); |
1329 | bcopy(h, n, sizeof(*n)); |
1330 | n->ifname = NULL((void *)0); |
1331 | n->next = NULL((void *)0); |
1332 | n->tail = NULL((void *)0); |
1333 | |
1334 | /* fix up netmask */ |
1335 | if (af == AF_INET2 && unmask(&n->addr.v.a.mask) > 32) |
1336 | set_ipmask(n, 32); |
1337 | |
1338 | return (n); |
1339 | } |
1340 | |
1341 | /* interface lookup routines */ |
1342 | |
1343 | struct node_host *iftab; |
1344 | |
1345 | void |
1346 | ifa_load(void) |
1347 | { |
1348 | struct ifaddrs *ifap, *ifa; |
1349 | struct node_host *n = NULL((void *)0), *h = NULL((void *)0); |
1350 | |
1351 | if (getifaddrs(&ifap) == -1) |
1352 | err(1, "getifaddrs"); |
1353 | |
1354 | for (ifa = ifap; ifa; ifa = ifa->ifa_next) { |
1355 | if (ifa->ifa_addr == NULL((void *)0) || |
1356 | !(ifa->ifa_addr->sa_family == AF_INET2 || |
1357 | ifa->ifa_addr->sa_family == AF_INET624 || |
1358 | ifa->ifa_addr->sa_family == AF_LINK18)) |
1359 | continue; |
1360 | n = calloc(1, sizeof(struct node_host)); |
1361 | if (n == NULL((void *)0)) |
1362 | err(1, "%s: calloc", __func__); |
1363 | n->af = ifa->ifa_addr->sa_family; |
1364 | n->ifa_flags = ifa->ifa_flags; |
1365 | #ifdef __KAME__ |
1366 | if (n->af == AF_INET624 && |
1367 | IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) |
1368 | ifa->ifa_addr)->sin6_addr)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) && |
1369 | ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == |
1370 | 0) { |
1371 | struct sockaddr_in6 *sin6; |
1372 | |
1373 | sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; |
1374 | sin6->sin6_scope_id = sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] << 8 | |
1375 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3]; |
1376 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] = 0; |
1377 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3] = 0; |
1378 | } |
1379 | #endif |
1380 | n->ifindex = 0; |
1381 | if (n->af == AF_LINK18) |
1382 | n->ifindex = ((struct sockaddr_dl *) |
1383 | ifa->ifa_addr)->sdl_index; |
1384 | else { |
1385 | copy_satopfaddr(&n->addr.v.a.addr, ifa->ifa_addr); |
1386 | ifa->ifa_netmask->sa_family = ifa->ifa_addr->sa_family; |
1387 | copy_satopfaddr(&n->addr.v.a.mask, ifa->ifa_netmask); |
1388 | if (ifa->ifa_broadaddrifa_dstaddr != NULL((void *)0)) { |
1389 | ifa->ifa_broadaddrifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; |
1390 | copy_satopfaddr(&n->bcast, ifa->ifa_broadaddrifa_dstaddr); |
1391 | } |
1392 | if (ifa->ifa_dstaddr != NULL((void *)0)) { |
1393 | ifa->ifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; |
1394 | copy_satopfaddr(&n->peer, ifa->ifa_dstaddr); |
1395 | } |
1396 | if (n->af == AF_INET624) |
1397 | n->ifindex = ((struct sockaddr_in6 *) |
1398 | ifa->ifa_addr)->sin6_scope_id; |
1399 | } |
1400 | if ((n->ifname = strdup(ifa->ifa_name)) == NULL((void *)0)) |
1401 | err(1, "%s: strdup", __func__); |
1402 | n->next = NULL((void *)0); |
1403 | n->tail = n; |
1404 | if (h == NULL((void *)0)) |
1405 | h = n; |
1406 | else { |
1407 | h->tail->next = n; |
1408 | h->tail = n; |
1409 | } |
1410 | } |
1411 | |
1412 | iftab = h; |
1413 | freeifaddrs(ifap); |
1414 | } |
1415 | |
1416 | unsigned int |
1417 | ifa_nametoindex(const char *ifa_name) |
1418 | { |
1419 | struct node_host *p; |
1420 | |
1421 | for (p = iftab; p; p = p->next) { |
1422 | if (p->af == AF_LINK18 && strcmp(p->ifname, ifa_name) == 0) |
1423 | return (p->ifindex); |
1424 | } |
1425 | errno(*__errno()) = ENXIO6; |
1426 | return (0); |
1427 | } |
1428 | |
1429 | char * |
1430 | ifa_indextoname(unsigned int ifindex, char *ifa_name) |
1431 | { |
1432 | struct node_host *p; |
1433 | |
1434 | for (p = iftab; p; p = p->next) { |
1435 | if (p->af == AF_LINK18 && ifindex == p->ifindex) { |
1436 | strlcpy(ifa_name, p->ifname, IFNAMSIZ16); |
1437 | return (ifa_name); |
1438 | } |
1439 | } |
1440 | errno(*__errno()) = ENXIO6; |
1441 | return (NULL((void *)0)); |
1442 | } |
1443 | |
1444 | struct node_host * |
1445 | ifa_exists(const char *ifa_name) |
1446 | { |
1447 | struct node_host *n; |
1448 | struct ifgroupreq ifgr; |
1449 | int s; |
1450 | |
1451 | if (iftab == NULL((void *)0)) |
1452 | ifa_load(); |
1453 | |
1454 | /* check whether this is a group */ |
1455 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) |
1456 | err(1, "socket"); |
1457 | bzero(&ifgr, sizeof(ifgr)); |
1458 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); |
1459 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == 0) { |
1460 | /* fake a node_host */ |
1461 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) |
1462 | err(1, "calloc"); |
1463 | if ((n->ifname = strdup(ifa_name)) == NULL((void *)0)) |
1464 | err(1, "strdup"); |
1465 | close(s); |
1466 | return (n); |
1467 | } |
1468 | close(s); |
1469 | |
1470 | for (n = iftab; n; n = n->next) { |
1471 | if (n->af == AF_LINK18 && !strncmp(n->ifname, ifa_name, IFNAMSIZ16)) |
1472 | return (n); |
1473 | } |
1474 | |
1475 | return (NULL((void *)0)); |
1476 | } |
1477 | |
1478 | struct node_host * |
1479 | ifa_grouplookup(const char *ifa_name, int flags) |
1480 | { |
1481 | struct ifg_req *ifg; |
1482 | struct ifgroupreq ifgr; |
1483 | int s, len; |
1484 | struct node_host *n, *h = NULL((void *)0); |
1485 | |
1486 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) |
1487 | err(1, "socket"); |
1488 | bzero(&ifgr, sizeof(ifgr)); |
1489 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); |
1490 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) { |
1491 | close(s); |
1492 | return (NULL((void *)0)); |
1493 | } |
1494 | |
1495 | len = ifgr.ifgr_len; |
1496 | if ((ifgr.ifgr_groupsifgr_ifgru.ifgru_groups = calloc(1, len)) == NULL((void *)0)) |
1497 | err(1, "calloc"); |
1498 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) |
1499 | err(1, "SIOCGIFGMEMB"); |
1500 | |
1501 | for (ifg = ifgr.ifgr_groupsifgr_ifgru.ifgru_groups; ifg && len >= sizeof(struct ifg_req); |
1502 | ifg++) { |
1503 | len -= sizeof(struct ifg_req); |
1504 | if ((n = ifa_lookup(ifg->ifgrq_memberifgrq_ifgrqu.ifgrqu_member, flags)) == NULL((void *)0)) |
1505 | continue; |
1506 | if (h == NULL((void *)0)) |
1507 | h = n; |
1508 | else { |
1509 | h->tail->next = n; |
1510 | h->tail = n->tail; |
1511 | } |
1512 | } |
1513 | free(ifgr.ifgr_groupsifgr_ifgru.ifgru_groups); |
1514 | close(s); |
1515 | |
1516 | return (h); |
1517 | } |
1518 | |
1519 | struct node_host * |
1520 | ifa_lookup(const char *ifa_name, int flags) |
1521 | { |
1522 | struct node_host *p = NULL((void *)0), *h = NULL((void *)0), *n = NULL((void *)0); |
1523 | int got4 = 0, got6 = 0; |
1524 | const char *last_if = NULL((void *)0); |
1525 | |
1526 | if ((h = ifa_grouplookup(ifa_name, flags)) != NULL((void *)0)) |
1527 | return (h); |
1528 | |
1529 | if (!strncmp(ifa_name, "self", IFNAMSIZ16)) |
1530 | ifa_name = NULL((void *)0); |
1531 | |
1532 | if (iftab == NULL((void *)0)) |
1533 | ifa_load(); |
1534 | |
1535 | for (p = iftab; p; p = p->next) { |
1536 | if (ifa_skip_if(ifa_name, p)) |
1537 | continue; |
1538 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->af != AF_INET2) |
1539 | continue; |
1540 | if ((flags & PFI_AFLAG_BROADCAST0x02) && |
1541 | !(p->ifa_flags & IFF_BROADCAST0x2)) |
1542 | continue; |
1543 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->bcast.v4pfa.v4.s_addr == 0) |
1544 | continue; |
1545 | if ((flags & PFI_AFLAG_PEER0x04) && |
1546 | !(p->ifa_flags & IFF_POINTOPOINT0x10)) |
1547 | continue; |
1548 | if ((flags & PFI_AFLAG_NETWORK0x01) && p->ifindex > 0) |
1549 | continue; |
1550 | if (last_if == NULL((void *)0) || strcmp(last_if, p->ifname)) |
1551 | got4 = got6 = 0; |
1552 | last_if = p->ifname; |
1553 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET2 && got4) |
1554 | continue; |
1555 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET624 && got6) |
1556 | continue; |
1557 | if (p->af == AF_INET2) |
1558 | got4 = 1; |
1559 | else |
1560 | got6 = 1; |
1561 | n = calloc(1, sizeof(struct node_host)); |
1562 | if (n == NULL((void *)0)) |
1563 | err(1, "%s: calloc", __func__); |
1564 | n->af = p->af; |
1565 | if (flags & PFI_AFLAG_BROADCAST0x02) |
1566 | memcpy(&n->addr.v.a.addr, &p->bcast, |
1567 | sizeof(struct pf_addr)); |
1568 | else if (flags & PFI_AFLAG_PEER0x04) |
1569 | memcpy(&n->addr.v.a.addr, &p->peer, |
1570 | sizeof(struct pf_addr)); |
1571 | else |
1572 | memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, |
1573 | sizeof(struct pf_addr)); |
1574 | if (flags & PFI_AFLAG_NETWORK0x01) |
1575 | set_ipmask(n, unmask(&p->addr.v.a.mask)); |
1576 | else |
1577 | set_ipmask(n, -1); |
1578 | n->ifindex = p->ifindex; |
1579 | |
1580 | n->next = NULL((void *)0); |
1581 | n->tail = n; |
1582 | if (h == NULL((void *)0)) |
1583 | h = n; |
1584 | else { |
1585 | h->tail->next = n; |
1586 | h->tail = n; |
1587 | } |
1588 | } |
1589 | return (h); |
1590 | } |
1591 | |
1592 | int |
1593 | ifa_skip_if(const char *filter, struct node_host *p) |
1594 | { |
1595 | int n; |
1596 | |
1597 | if (p->af != AF_INET2 && p->af != AF_INET624) |
1598 | return (1); |
1599 | if (filter == NULL((void *)0) || !*filter) |
1600 | return (0); |
1601 | if (!strcmp(p->ifname, filter)) |
1602 | return (0); /* exact match */ |
1603 | n = strlen(filter); |
1604 | if (n < 1 || n >= IFNAMSIZ16) |
1605 | return (1); /* sanity check */ |
1606 | if (filter[n-1] >= '0' && filter[n-1] <= '9') |
1607 | return (1); /* only do exact match in that case */ |
1608 | if (strncmp(p->ifname, filter, n)) |
1609 | return (1); /* prefix doesn't match */ |
1610 | return (p->ifname[n] < '0' || p->ifname[n] > '9'); |
1611 | } |
1612 | |
1613 | struct node_host * |
1614 | host(const char *s, int opts) |
1615 | { |
1616 | struct node_host *h = NULL((void *)0), *n; |
1617 | int mask = -1; |
1618 | char *p, *ps; |
1619 | const char *errstr; |
1620 | |
1621 | if ((ps = strdup(s)) == NULL((void *)0)) |
1622 | err(1, "%s: strdup", __func__); |
1623 | |
1624 | if ((p = strchr(ps, '/')) != NULL((void *)0)) { |
1625 | mask = strtonum(p+1, 0, 128, &errstr); |
1626 | if (errstr) { |
1627 | fprintf(stderr(&__sF[2]), "netmask is %s: %s\n", errstr, p); |
1628 | goto error; |
1629 | } |
1630 | p[0] = '\0'; |
1631 | } |
1632 | |
1633 | if ((h = host_if(ps, mask)) == NULL((void *)0) && |
1634 | (h = host_ip(ps, mask)) == NULL((void *)0) && |
1635 | (h = host_dns(ps, mask, (opts & PF_OPT_NODNS0x01000))) == NULL((void *)0)) { |
1636 | fprintf(stderr(&__sF[2]), "no IP address found for %s\n", s); |
1637 | goto error; |
1638 | } |
1639 | |
1640 | for (n = h; n != NULL((void *)0); n = n->next) { |
1641 | n->addr.type = PF_ADDR_ADDRMASK; |
1642 | n->weight = 0; |
1643 | } |
1644 | |
1645 | error: |
1646 | free(ps); |
1647 | return (h); |
1648 | } |
1649 | |
1650 | struct node_host * |
1651 | host_if(const char *s, int mask) |
1652 | { |
1653 | struct node_host *n, *h = NULL((void *)0); |
1654 | char *p, *ps; |
1655 | int flags = 0; |
1656 | |
1657 | if ((ps = strdup(s)) == NULL((void *)0)) |
1658 | err(1, "host_if: strdup"); |
1659 | while ((p = strrchr(ps, ':')) != NULL((void *)0)) { |
1660 | if (!strcmp(p+1, "network")) |
1661 | flags |= PFI_AFLAG_NETWORK0x01; |
1662 | else if (!strcmp(p+1, "broadcast")) |
1663 | flags |= PFI_AFLAG_BROADCAST0x02; |
1664 | else if (!strcmp(p+1, "peer")) |
1665 | flags |= PFI_AFLAG_PEER0x04; |
1666 | else if (!strcmp(p+1, "0")) |
1667 | flags |= PFI_AFLAG_NOALIAS0x08; |
1668 | else |
1669 | goto error; |
1670 | *p = '\0'; |
1671 | } |
1672 | if (flags & (flags - 1) & PFI_AFLAG_MODEMASK0x07) { /* Yep! */ |
1673 | fprintf(stderr(&__sF[2]), "illegal combination of interface modifiers\n"); |
1674 | goto error; |
1675 | } |
1676 | if ((flags & (PFI_AFLAG_NETWORK0x01|PFI_AFLAG_BROADCAST0x02)) && mask > -1) { |
1677 | fprintf(stderr(&__sF[2]), "network or broadcast lookup, but " |
1678 | "extra netmask given\n"); |
1679 | goto error; |
1680 | } |
1681 | if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ16)) { |
1682 | /* interface with this name exists */ |
1683 | h = ifa_lookup(ps, flags); |
1684 | if (mask > -1) |
1685 | for (n = h; n != NULL((void *)0); n = n->next) |
1686 | set_ipmask(n, mask); |
1687 | } |
1688 | |
1689 | error: |
1690 | free(ps); |
1691 | return (h); |
1692 | } |
1693 | |
1694 | struct node_host * |
1695 | host_ip(const char *s, int mask) |
1696 | { |
1697 | struct addrinfo hints, *res; |
1698 | struct node_host *h = NULL((void *)0); |
1699 | |
1700 | memset(&hints, 0, sizeof(hints)); |
1701 | hints.ai_family = AF_UNSPEC0; |
1702 | hints.ai_socktype = SOCK_DGRAM2; /*dummy*/ |
1703 | hints.ai_flags = AI_NUMERICHOST4; |
1704 | if (getaddrinfo(s, NULL((void *)0), &hints, &res) == 0) { |
1705 | h = calloc(1, sizeof(*h)); |
1706 | if (h == NULL((void *)0)) |
1707 | err(1, "%s: calloc", __func__); |
1708 | h->af = res->ai_family; |
1709 | copy_satopfaddr(&h->addr.v.a.addr, res->ai_addr); |
1710 | if (h->af == AF_INET624) |
1711 | h->ifindex = |
1712 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; |
1713 | freeaddrinfo(res); |
1714 | } else { /* ie. for 10/8 parsing */ |
1715 | if (mask == -1) |
1716 | return (NULL((void *)0)); |
1717 | h = calloc(1, sizeof(*h)); |
1718 | if (h == NULL((void *)0)) |
1719 | err(1, "%s: calloc", __func__); |
1720 | h->af = AF_INET2; |
1721 | if (inet_net_pton(AF_INET2, s, &h->addr.v.a.addr.v4pfa.v4, |
1722 | sizeof(h->addr.v.a.addr.v4pfa.v4)) == -1) { |
1723 | free(h); |
1724 | return (NULL((void *)0)); |
1725 | } |
1726 | } |
1727 | set_ipmask(h, mask); |
1728 | h->ifname = NULL((void *)0); |
1729 | h->next = NULL((void *)0); |
1730 | h->tail = h; |
1731 | |
1732 | return (h); |
1733 | } |
1734 | |
1735 | struct node_host * |
1736 | host_dns(const char *s, int mask, int numeric) |
1737 | { |
1738 | struct addrinfo hints, *res0, *res; |
1739 | struct node_host *n, *h = NULL((void *)0); |
1740 | int noalias = 0, got4 = 0, got6 = 0; |
1741 | char *p, *ps; |
1742 | |
1743 | if ((ps = strdup(s)) == NULL((void *)0)) |
1744 | err(1, "host_dns: strdup"); |
1745 | if ((p = strrchr(ps, ':')) != NULL((void *)0) && !strcmp(p, ":0")) { |
1746 | noalias = 1; |
1747 | *p = '\0'; |
1748 | } |
1749 | memset(&hints, 0, sizeof(hints)); |
1750 | hints.ai_family = PF_UNSPEC0; |
1751 | hints.ai_socktype = SOCK_STREAM1; /* DUMMY */ |
1752 | if (numeric) |
1753 | hints.ai_flags = AI_NUMERICHOST4; |
1754 | if (getaddrinfo(ps, NULL((void *)0), &hints, &res0) != 0) |
1755 | goto error; |
1756 | |
1757 | for (res = res0; res; res = res->ai_next) { |
1758 | if (res->ai_family != AF_INET2 && |
1759 | res->ai_family != AF_INET624) |
1760 | continue; |
1761 | if (noalias) { |
1762 | if (res->ai_family == AF_INET2) { |
1763 | if (got4) |
1764 | continue; |
1765 | got4 = 1; |
1766 | } else { |
1767 | if (got6) |
1768 | continue; |
1769 | got6 = 1; |
1770 | } |
1771 | } |
1772 | n = calloc(1, sizeof(struct node_host)); |
1773 | if (n == NULL((void *)0)) |
1774 | err(1, "host_dns: calloc"); |
1775 | n->ifname = NULL((void *)0); |
1776 | n->af = res->ai_family; |
1777 | copy_satopfaddr(&n->addr.v.a.addr, res->ai_addr); |
1778 | if (res->ai_family == AF_INET624) |
1779 | n->ifindex = |
1780 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; |
1781 | set_ipmask(n, mask); |
1782 | n->next = NULL((void *)0); |
1783 | n->tail = n; |
1784 | if (h == NULL((void *)0)) |
1785 | h = n; |
1786 | else { |
1787 | h->tail->next = n; |
1788 | h->tail = n; |
1789 | } |
1790 | } |
1791 | freeaddrinfo(res0); |
1792 | error: |
1793 | free(ps); |
1794 | |
1795 | return (h); |
1796 | } |
1797 | |
1798 | /* |
1799 | * convert a hostname to a list of addresses and put them in the given buffer. |
1800 | * test: |
1801 | * if set to 1, only simple addresses are accepted (no netblock, no "!"). |
1802 | */ |
1803 | int |
1804 | append_addr(struct pfr_buffer *b, char *s, int test, int opts) |
1805 | { |
1806 | static int previous = 0; |
1807 | static int expect = 0; |
1808 | struct pfr_addr *a; |
1809 | struct node_host *h, *n; |
1810 | char *r; |
1811 | const char *errstr; |
1812 | int rv, not = 0, i = 0; |
1813 | u_int16_t weight; |
1814 | |
1815 | /* skip weight if given */ |
1816 | if (strcmp(s, "weight") == 0) { |
1817 | expect = 1; |
1818 | return (1); /* expecting further call */ |
1819 | } |
1820 | |
1821 | /* check if previous host is set */ |
1822 | if (expect) { |
1823 | /* parse and append load balancing weight */ |
1824 | weight = strtonum(s, 1, USHRT_MAX(32767 *2 +1), &errstr); |
1825 | if (errstr) { |
1826 | fprintf(stderr(&__sF[2]), "failed to convert weight %s\n", s); |
1827 | return (-1); |
1828 | } |
1829 | if (previous != -1) { |
1830 | PFRB_FOREACH(a, b)for ((a) = pfr_buf_next((b), ((void *)0)); (a) != ((void *)0) ; (a) = pfr_buf_next((b), (a))) { |
1831 | if (++i >= previous) { |
1832 | a->pfra_weight = weight; |
1833 | a->pfra_type = PFRKE_COST; |
1834 | } |
1835 | } |
1836 | } |
1837 | |
1838 | expect = 0; |
1839 | return (0); |
1840 | } |
1841 | |
1842 | for (r = s; *r == '!'; r++) |
1843 | not = !not; |
1844 | if ((n = host(r, opts)) == NULL((void *)0)) { |
1845 | errno(*__errno()) = 0; |
1846 | return (-1); |
1847 | } |
1848 | rv = append_addr_host(b, n, test, not); |
1849 | previous = b->pfrb_size; |
1850 | do { |
1851 | h = n; |
1852 | n = n->next; |
1853 | free(h); |
1854 | } while (n != NULL((void *)0)); |
1855 | return (rv); |
1856 | } |
1857 | |
1858 | /* |
1859 | * same as previous function, but with a pre-parsed input and the ability |
1860 | * to "negate" the result. Does not free the node_host list. |
1861 | * not: |
1862 | * setting it to 1 is equivalent to adding "!" in front of parameter s. |
1863 | */ |
1864 | int |
1865 | append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) |
1866 | { |
1867 | int bits; |
1868 | struct pfr_addr addr; |
1869 | |
1870 | do { |
1871 | bzero(&addr, sizeof(addr)); |
1872 | addr.pfra_not = n->not ^ not; |
1873 | addr.pfra_af = n->af; |
1874 | addr.pfra_net = unmask(&n->addr.v.a.mask); |
1875 | if (n->ifname) { |
1876 | if (strlcpy(addr.pfra_ifname, n->ifname, |
1877 | sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) |
1878 | errx(1, "append_addr_host: strlcpy"); |
1879 | addr.pfra_type = PFRKE_ROUTE; |
1880 | } |
1881 | if (n->weight > 0) { |
1882 | addr.pfra_weight = n->weight; |
1883 | addr.pfra_type = PFRKE_COST; |
1884 | } |
1885 | switch (n->af) { |
1886 | case AF_INET2: |
1887 | addr.pfra_ip4addrpfra_u._pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32pfa.addr32[0]; |
1888 | bits = 32; |
1889 | break; |
1890 | case AF_INET624: |
1891 | memcpy(&addr.pfra_ip6addrpfra_u._pfra_ip6addr, &n->addr.v.a.addr.v6pfa.v6, |
1892 | sizeof(struct in6_addr)); |
1893 | bits = 128; |
1894 | break; |
1895 | default: |
1896 | errno(*__errno()) = EINVAL22; |
1897 | return (-1); |
1898 | } |
1899 | if ((test && (not || addr.pfra_net != bits)) || |
1900 | addr.pfra_net > bits) { |
1901 | errno(*__errno()) = EINVAL22; |
1902 | return (-1); |
1903 | } |
1904 | if (pfr_buf_add(b, &addr)) |
1905 | return (-1); |
1906 | } while ((n = n->next) != NULL((void *)0)); |
1907 | |
1908 | return (0); |
1909 | } |
1910 | |
1911 | int |
1912 | pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) |
1913 | { |
1914 | struct pfioc_trans_e trans; |
1915 | |
1916 | bzero(&trans, sizeof(trans)); |
1917 | trans.type = type; |
1918 | if (strlcpy(trans.anchor, anchor, |
1919 | sizeof(trans.anchor)) >= sizeof(trans.anchor)) |
1920 | errx(1, "pfctl_add_trans: strlcpy"); |
1921 | |
1922 | return pfr_buf_add(buf, &trans); |
1923 | } |
1924 | |
1925 | u_int32_t |
1926 | pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) |
1927 | { |
1928 | struct pfioc_trans_e *p; |
1929 | |
1930 | PFRB_FOREACH(p, buf)for ((p) = pfr_buf_next((buf), ((void *)0)); (p) != ((void *) 0); (p) = pfr_buf_next((buf), (p))) |
1931 | if (type == p->type && !strcmp(anchor, p->anchor)) |
1932 | return (p->ticket); |
1933 | errx(1, "pfctl_get_ticket: assertion failed"); |
1934 | } |
1935 | |
1936 | int |
1937 | pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) |
1938 | { |
1939 | struct pfioc_trans trans; |
1940 | |
1941 | bzero(&trans, sizeof(trans)); |
1942 | trans.size = buf->pfrb_size - from; |
1943 | trans.esize = sizeof(struct pfioc_trans_e); |
1944 | trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; |
1945 | return ioctl(dev, cmd, &trans); |
1946 | } |