File: | src/sbin/pfctl/pfctl_parser.c |
Warning: | line 1683, column 7 Potential memory leak |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: pfctl_parser.c,v 1.346 2021/02/01 00:31:04 dlg Exp $ */ | |||
2 | ||||
3 | /* | |||
4 | * Copyright (c) 2001 Daniel Hartmeier | |||
5 | * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> | |||
6 | * All rights reserved. | |||
7 | * | |||
8 | * Redistribution and use in source and binary forms, with or without | |||
9 | * modification, are permitted provided that the following conditions | |||
10 | * are met: | |||
11 | * | |||
12 | * - Redistributions of source code must retain the above copyright | |||
13 | * notice, this list of conditions and the following disclaimer. | |||
14 | * - Redistributions in binary form must reproduce the above | |||
15 | * copyright notice, this list of conditions and the following | |||
16 | * disclaimer in the documentation and/or other materials provided | |||
17 | * with the distribution. | |||
18 | * | |||
19 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |||
20 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |||
21 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS | |||
22 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | |||
23 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, | |||
24 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, | |||
25 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |||
26 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER | |||
27 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | |||
28 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN | |||
29 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | |||
30 | * POSSIBILITY OF SUCH DAMAGE. | |||
31 | * | |||
32 | */ | |||
33 | ||||
34 | #include <sys/types.h> | |||
35 | #include <sys/ioctl.h> | |||
36 | #include <sys/socket.h> | |||
37 | #include <net/if_dl.h> | |||
38 | #include <net/if.h> | |||
39 | #include <netinet/in.h> | |||
40 | #include <netinet/ip.h> | |||
41 | #include <netinet/ip_icmp.h> | |||
42 | #include <netinet/icmp6.h> | |||
43 | #include <net/pfvar.h> | |||
44 | #include <arpa/inet.h> | |||
45 | ||||
46 | #include <ctype.h> | |||
47 | #include <err.h> | |||
48 | #include <errno(*__errno()).h> | |||
49 | #include <ifaddrs.h> | |||
50 | #include <limits.h> | |||
51 | #include <netdb.h> | |||
52 | #include <stdarg.h> | |||
53 | #include <stdio.h> | |||
54 | #include <stdlib.h> | |||
55 | #include <string.h> | |||
56 | #include <time.h> | |||
57 | #include <unistd.h> | |||
58 | ||||
59 | #define SYSLOG_NAMES | |||
60 | #include <syslog.h> | |||
61 | ||||
62 | #include "pfctl_parser.h" | |||
63 | #include "pfctl.h" | |||
64 | ||||
65 | void print_op (u_int8_t, const char *, const char *); | |||
66 | void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); | |||
67 | void print_ugid (u_int8_t, id_t, id_t, const char *); | |||
68 | void print_flags (u_int8_t); | |||
69 | void print_fromto(struct pf_rule_addr *, pf_osfp_t, | |||
70 | struct pf_rule_addr *, u_int8_t, u_int8_t, int); | |||
71 | void print_bwspec(const char *index, struct pf_queue_bwspec *); | |||
72 | void print_scspec(const char *, struct pf_queue_scspec *); | |||
73 | int ifa_skip_if(const char *filter, struct node_host *p); | |||
74 | ||||
75 | struct node_host *ifa_grouplookup(const char *, int); | |||
76 | struct node_host *host_if(const char *, int); | |||
77 | struct node_host *host_ip(const char *, int); | |||
78 | struct node_host *host_dns(const char *, int, int); | |||
79 | ||||
80 | const char *tcpflags = "FSRPAUEW"; | |||
81 | ||||
82 | static const struct icmptypeent icmp_type[] = { | |||
83 | { "echoreq", ICMP_ECHO8 }, | |||
84 | { "echorep", ICMP_ECHOREPLY0 }, | |||
85 | { "unreach", ICMP_UNREACH3 }, | |||
86 | { "squench", ICMP_SOURCEQUENCH4 }, | |||
87 | { "redir", ICMP_REDIRECT5 }, | |||
88 | { "althost", ICMP_ALTHOSTADDR6 }, | |||
89 | { "routeradv", ICMP_ROUTERADVERT9 }, | |||
90 | { "routersol", ICMP_ROUTERSOLICIT10 }, | |||
91 | { "timex", ICMP_TIMXCEED11 }, | |||
92 | { "paramprob", ICMP_PARAMPROB12 }, | |||
93 | { "timereq", ICMP_TSTAMP13 }, | |||
94 | { "timerep", ICMP_TSTAMPREPLY14 }, | |||
95 | { "inforeq", ICMP_IREQ15 }, | |||
96 | { "inforep", ICMP_IREQREPLY16 }, | |||
97 | { "maskreq", ICMP_MASKREQ17 }, | |||
98 | { "maskrep", ICMP_MASKREPLY18 }, | |||
99 | { "trace", ICMP_TRACEROUTE30 }, | |||
100 | { "dataconv", ICMP_DATACONVERR31 }, | |||
101 | { "mobredir", ICMP_MOBILE_REDIRECT32 }, | |||
102 | { "ipv6-where", ICMP_IPV6_WHEREAREYOU33 }, | |||
103 | { "ipv6-here", ICMP_IPV6_IAMHERE34 }, | |||
104 | { "mobregreq", ICMP_MOBILE_REGREQUEST35 }, | |||
105 | { "mobregrep", ICMP_MOBILE_REGREPLY36 }, | |||
106 | { "skip", ICMP_SKIP39 }, | |||
107 | { "photuris", ICMP_PHOTURIS40 } | |||
108 | }; | |||
109 | ||||
110 | static const struct icmptypeent icmp6_type[] = { | |||
111 | { "unreach", ICMP6_DST_UNREACH1 }, | |||
112 | { "toobig", ICMP6_PACKET_TOO_BIG2 }, | |||
113 | { "timex", ICMP6_TIME_EXCEEDED3 }, | |||
114 | { "paramprob", ICMP6_PARAM_PROB4 }, | |||
115 | { "echoreq", ICMP6_ECHO_REQUEST128 }, | |||
116 | { "echorep", ICMP6_ECHO_REPLY129 }, | |||
117 | { "groupqry", ICMP6_MEMBERSHIP_QUERY130 }, | |||
118 | { "listqry", MLD_LISTENER_QUERY130 }, | |||
119 | { "grouprep", ICMP6_MEMBERSHIP_REPORT131 }, | |||
120 | { "listenrep", MLD_LISTENER_REPORT131 }, | |||
121 | { "groupterm", ICMP6_MEMBERSHIP_REDUCTION132 }, | |||
122 | { "listendone", MLD_LISTENER_DONE132 }, | |||
123 | { "routersol", ND_ROUTER_SOLICIT133 }, | |||
124 | { "routeradv", ND_ROUTER_ADVERT134 }, | |||
125 | { "neighbrsol", ND_NEIGHBOR_SOLICIT135 }, | |||
126 | { "neighbradv", ND_NEIGHBOR_ADVERT136 }, | |||
127 | { "redir", ND_REDIRECT137 }, | |||
128 | { "routrrenum", ICMP6_ROUTER_RENUMBERING138 }, | |||
129 | { "wrureq", ICMP6_WRUREQUEST139 }, | |||
130 | { "wrurep", ICMP6_WRUREPLY140 }, | |||
131 | { "fqdnreq", ICMP6_FQDN_QUERY139 }, | |||
132 | { "fqdnrep", ICMP6_FQDN_REPLY140 }, | |||
133 | { "niqry", ICMP6_NI_QUERY139 }, | |||
134 | { "nirep", ICMP6_NI_REPLY140 }, | |||
135 | { "mtraceresp", MLD_MTRACE_RESP200 }, | |||
136 | { "mtrace", MLD_MTRACE201 }, | |||
137 | { "listenrepv2", MLDV2_LISTENER_REPORT143 }, | |||
138 | }; | |||
139 | ||||
140 | static const struct icmpcodeent icmp_code[] = { | |||
141 | { "net-unr", ICMP_UNREACH3, ICMP_UNREACH_NET0 }, | |||
142 | { "host-unr", ICMP_UNREACH3, ICMP_UNREACH_HOST1 }, | |||
143 | { "proto-unr", ICMP_UNREACH3, ICMP_UNREACH_PROTOCOL2 }, | |||
144 | { "port-unr", ICMP_UNREACH3, ICMP_UNREACH_PORT3 }, | |||
145 | { "needfrag", ICMP_UNREACH3, ICMP_UNREACH_NEEDFRAG4 }, | |||
146 | { "srcfail", ICMP_UNREACH3, ICMP_UNREACH_SRCFAIL5 }, | |||
147 | { "net-unk", ICMP_UNREACH3, ICMP_UNREACH_NET_UNKNOWN6 }, | |||
148 | { "host-unk", ICMP_UNREACH3, ICMP_UNREACH_HOST_UNKNOWN7 }, | |||
149 | { "isolate", ICMP_UNREACH3, ICMP_UNREACH_ISOLATED8 }, | |||
150 | { "net-prohib", ICMP_UNREACH3, ICMP_UNREACH_NET_PROHIB9 }, | |||
151 | { "host-prohib", ICMP_UNREACH3, ICMP_UNREACH_HOST_PROHIB10 }, | |||
152 | { "net-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSNET11 }, | |||
153 | { "host-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSHOST12 }, | |||
154 | { "filter-prohib", ICMP_UNREACH3, ICMP_UNREACH_FILTER_PROHIB13 }, | |||
155 | { "host-preced", ICMP_UNREACH3, ICMP_UNREACH_HOST_PRECEDENCE14 }, | |||
156 | { "cutoff-preced", ICMP_UNREACH3, ICMP_UNREACH_PRECEDENCE_CUTOFF15 }, | |||
157 | { "redir-net", ICMP_REDIRECT5, ICMP_REDIRECT_NET0 }, | |||
158 | { "redir-host", ICMP_REDIRECT5, ICMP_REDIRECT_HOST1 }, | |||
159 | { "redir-tos-net", ICMP_REDIRECT5, ICMP_REDIRECT_TOSNET2 }, | |||
160 | { "redir-tos-host", ICMP_REDIRECT5, ICMP_REDIRECT_TOSHOST3 }, | |||
161 | { "normal-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NORMAL0 }, | |||
162 | { "common-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NOROUTE_COMMON16 }, | |||
163 | { "transit", ICMP_TIMXCEED11, ICMP_TIMXCEED_INTRANS0 }, | |||
164 | { "reassemb", ICMP_TIMXCEED11, ICMP_TIMXCEED_REASS1 }, | |||
165 | { "badhead", ICMP_PARAMPROB12, ICMP_PARAMPROB_ERRATPTR0 }, | |||
166 | { "optmiss", ICMP_PARAMPROB12, ICMP_PARAMPROB_OPTABSENT1 }, | |||
167 | { "badlen", ICMP_PARAMPROB12, ICMP_PARAMPROB_LENGTH2 }, | |||
168 | { "unknown-ind", ICMP_PHOTURIS40, ICMP_PHOTURIS_UNKNOWN_INDEX1 }, | |||
169 | { "auth-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_AUTH_FAILED2 }, | |||
170 | { "decrypt-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_DECRYPT_FAILED3 } | |||
171 | }; | |||
172 | ||||
173 | static const struct icmpcodeent icmp6_code[] = { | |||
174 | { "admin-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADMIN1 }, | |||
175 | { "noroute-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOROUTE0 }, | |||
176 | { "beyond-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_BEYONDSCOPE2 }, | |||
177 | { "addr-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADDR3 }, | |||
178 | { "port-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOPORT4 }, | |||
179 | { "transit", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_TRANSIT0 }, | |||
180 | { "reassemb", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_REASSEMBLY1 }, | |||
181 | { "badhead", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_HEADER0 }, | |||
182 | { "nxthdr", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_NEXTHEADER1 }, | |||
183 | { "redironlink", ND_REDIRECT137, ND_REDIRECT_ONLINK0 }, | |||
184 | { "redirrouter", ND_REDIRECT137, ND_REDIRECT_ROUTER1 } | |||
185 | }; | |||
186 | ||||
187 | const struct pf_timeout pf_timeouts[] = { | |||
188 | { "tcp.first", PFTM_TCP_FIRST_PACKET }, | |||
189 | { "tcp.opening", PFTM_TCP_OPENING }, | |||
190 | { "tcp.established", PFTM_TCP_ESTABLISHED }, | |||
191 | { "tcp.closing", PFTM_TCP_CLOSING }, | |||
192 | { "tcp.finwait", PFTM_TCP_FIN_WAIT }, | |||
193 | { "tcp.closed", PFTM_TCP_CLOSED }, | |||
194 | { "tcp.tsdiff", PFTM_TS_DIFF }, | |||
195 | { "udp.first", PFTM_UDP_FIRST_PACKET }, | |||
196 | { "udp.single", PFTM_UDP_SINGLE }, | |||
197 | { "udp.multiple", PFTM_UDP_MULTIPLE }, | |||
198 | { "icmp.first", PFTM_ICMP_FIRST_PACKET }, | |||
199 | { "icmp.error", PFTM_ICMP_ERROR_REPLY }, | |||
200 | { "other.first", PFTM_OTHER_FIRST_PACKET }, | |||
201 | { "other.single", PFTM_OTHER_SINGLE }, | |||
202 | { "other.multiple", PFTM_OTHER_MULTIPLE }, | |||
203 | { "frag", PFTM_FRAG }, | |||
204 | { "interval", PFTM_INTERVAL }, | |||
205 | { "adaptive.start", PFTM_ADAPTIVE_START }, | |||
206 | { "adaptive.end", PFTM_ADAPTIVE_END }, | |||
207 | { "src.track", PFTM_SRC_NODE }, | |||
208 | { NULL((void *)0), 0 } | |||
209 | }; | |||
210 | ||||
211 | enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; | |||
212 | ||||
213 | void | |||
214 | copy_satopfaddr(struct pf_addr *pfa, struct sockaddr *sa) | |||
215 | { | |||
216 | if (sa->sa_family == AF_INET624) | |||
217 | pfa->v6pfa.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr; | |||
218 | else if (sa->sa_family == AF_INET2) | |||
219 | pfa->v4pfa.v4 = ((struct sockaddr_in *)sa)->sin_addr; | |||
220 | else | |||
221 | warnx("unhandled af %d", sa->sa_family); | |||
222 | } | |||
223 | ||||
224 | const struct icmptypeent * | |||
225 | geticmptypebynumber(u_int8_t type, sa_family_t af) | |||
226 | { | |||
227 | unsigned int i; | |||
228 | ||||
229 | if (af != AF_INET624) { | |||
230 | for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); | |||
231 | i++) { | |||
232 | if (type == icmp_type[i].type) | |||
233 | return (&icmp_type[i]); | |||
234 | } | |||
235 | } else { | |||
236 | for (i=0; i < (sizeof (icmp6_type) / | |||
237 | sizeof(icmp6_type[0])); i++) { | |||
238 | if (type == icmp6_type[i].type) | |||
239 | return (&icmp6_type[i]); | |||
240 | } | |||
241 | } | |||
242 | return (NULL((void *)0)); | |||
243 | } | |||
244 | ||||
245 | const struct icmptypeent * | |||
246 | geticmptypebyname(char *w, sa_family_t af) | |||
247 | { | |||
248 | unsigned int i; | |||
249 | ||||
250 | if (af != AF_INET624) { | |||
251 | for (i=0; i < (sizeof (icmp_type) / sizeof(icmp_type[0])); | |||
252 | i++) { | |||
253 | if (!strcmp(w, icmp_type[i].name)) | |||
254 | return (&icmp_type[i]); | |||
255 | } | |||
256 | } else { | |||
257 | for (i=0; i < (sizeof (icmp6_type) / | |||
258 | sizeof(icmp6_type[0])); i++) { | |||
259 | if (!strcmp(w, icmp6_type[i].name)) | |||
260 | return (&icmp6_type[i]); | |||
261 | } | |||
262 | } | |||
263 | return (NULL((void *)0)); | |||
264 | } | |||
265 | ||||
266 | const struct icmpcodeent * | |||
267 | geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) | |||
268 | { | |||
269 | unsigned int i; | |||
270 | ||||
271 | if (af != AF_INET624) { | |||
272 | for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); | |||
273 | i++) { | |||
274 | if (type == icmp_code[i].type && | |||
275 | code == icmp_code[i].code) | |||
276 | return (&icmp_code[i]); | |||
277 | } | |||
278 | } else { | |||
279 | for (i=0; i < (sizeof (icmp6_code) / | |||
280 | sizeof(icmp6_code[0])); i++) { | |||
281 | if (type == icmp6_code[i].type && | |||
282 | code == icmp6_code[i].code) | |||
283 | return (&icmp6_code[i]); | |||
284 | } | |||
285 | } | |||
286 | return (NULL((void *)0)); | |||
287 | } | |||
288 | ||||
289 | const struct icmpcodeent * | |||
290 | geticmpcodebyname(u_long type, char *w, sa_family_t af) | |||
291 | { | |||
292 | unsigned int i; | |||
293 | ||||
294 | if (af != AF_INET624) { | |||
295 | for (i=0; i < (sizeof (icmp_code) / sizeof(icmp_code[0])); | |||
296 | i++) { | |||
297 | if (type == icmp_code[i].type && | |||
298 | !strcmp(w, icmp_code[i].name)) | |||
299 | return (&icmp_code[i]); | |||
300 | } | |||
301 | } else { | |||
302 | for (i=0; i < (sizeof (icmp6_code) / | |||
303 | sizeof(icmp6_code[0])); i++) { | |||
304 | if (type == icmp6_code[i].type && | |||
305 | !strcmp(w, icmp6_code[i].name)) | |||
306 | return (&icmp6_code[i]); | |||
307 | } | |||
308 | } | |||
309 | return (NULL((void *)0)); | |||
310 | } | |||
311 | ||||
312 | /* | |||
313 | * Decode a symbolic name to a numeric value. | |||
314 | * From syslogd. | |||
315 | */ | |||
316 | int | |||
317 | string_to_loglevel(const char *name) | |||
318 | { | |||
319 | CODE *c; | |||
320 | char *p, buf[40]; | |||
321 | ||||
322 | if (isdigit((unsigned char)*name)) { | |||
323 | const char *errstr; | |||
324 | int val; | |||
325 | ||||
326 | val = strtonum(name, 0, LOG_DEBUG7, &errstr); | |||
327 | if (errstr) | |||
328 | return -1; | |||
329 | return val; | |||
330 | } | |||
331 | ||||
332 | for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { | |||
333 | if (isupper((unsigned char)*name)) | |||
334 | *p = tolower((unsigned char)*name); | |||
335 | else | |||
336 | *p = *name; | |||
337 | } | |||
338 | *p = '\0'; | |||
339 | for (c = prioritynames; c->c_name; c++) | |||
340 | if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI0x10) | |||
341 | return (c->c_val); | |||
342 | ||||
343 | return (-1); | |||
344 | } | |||
345 | ||||
346 | const char * | |||
347 | loglevel_to_string(int level) | |||
348 | { | |||
349 | CODE *c; | |||
350 | ||||
351 | for (c = prioritynames; c->c_name; c++) | |||
352 | if (c->c_val == level) | |||
353 | return (c->c_name); | |||
354 | ||||
355 | return ("unknown"); | |||
356 | } | |||
357 | ||||
358 | void | |||
359 | print_op(u_int8_t op, const char *a1, const char *a2) | |||
360 | { | |||
361 | if (op == PF_OP_IRG) | |||
362 | printf(" %s >< %s", a1, a2); | |||
363 | else if (op == PF_OP_XRG) | |||
364 | printf(" %s <> %s", a1, a2); | |||
365 | else if (op == PF_OP_EQ) | |||
366 | printf(" = %s", a1); | |||
367 | else if (op == PF_OP_NE) | |||
368 | printf(" != %s", a1); | |||
369 | else if (op == PF_OP_LT) | |||
370 | printf(" < %s", a1); | |||
371 | else if (op == PF_OP_LE) | |||
372 | printf(" <= %s", a1); | |||
373 | else if (op == PF_OP_GT) | |||
374 | printf(" > %s", a1); | |||
375 | else if (op == PF_OP_GE) | |||
376 | printf(" >= %s", a1); | |||
377 | else if (op == PF_OP_RRG) | |||
378 | printf(" %s:%s", a1, a2); | |||
379 | } | |||
380 | ||||
381 | void | |||
382 | print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) | |||
383 | { | |||
384 | char a1[6], a2[6]; | |||
385 | struct servent *s = NULL((void *)0); | |||
386 | ||||
387 | if (opts & PF_OPT_PORTNAMES0x08000) | |||
388 | s = getservbyport(p1, proto); | |||
389 | p1 = ntohs(p1)(__uint16_t)(__builtin_constant_p(p1) ? (__uint16_t)(((__uint16_t )(p1) & 0xffU) << 8 | ((__uint16_t)(p1) & 0xff00U ) >> 8) : __swap16md(p1)); | |||
390 | p2 = ntohs(p2)(__uint16_t)(__builtin_constant_p(p2) ? (__uint16_t)(((__uint16_t )(p2) & 0xffU) << 8 | ((__uint16_t)(p2) & 0xff00U ) >> 8) : __swap16md(p2)); | |||
391 | snprintf(a1, sizeof(a1), "%u", p1); | |||
392 | snprintf(a2, sizeof(a2), "%u", p2); | |||
393 | printf(" port"); | |||
394 | if (s != NULL((void *)0) && (op == PF_OP_EQ || op == PF_OP_NE)) | |||
395 | print_op(op, s->s_name, a2); | |||
396 | else | |||
397 | print_op(op, a1, a2); | |||
398 | } | |||
399 | ||||
400 | void | |||
401 | print_ugid(u_int8_t op, id_t i1, id_t i2, const char *t) | |||
402 | { | |||
403 | char a1[11], a2[11]; | |||
404 | ||||
405 | snprintf(a1, sizeof(a1), "%u", i1); | |||
406 | snprintf(a2, sizeof(a2), "%u", i2); | |||
407 | printf(" %s", t); | |||
408 | if (i1 == -1 && (op == PF_OP_EQ || op == PF_OP_NE)) | |||
409 | print_op(op, "unknown", a2); | |||
410 | else | |||
411 | print_op(op, a1, a2); | |||
412 | } | |||
413 | ||||
414 | void | |||
415 | print_flags(u_int8_t f) | |||
416 | { | |||
417 | int i; | |||
418 | ||||
419 | for (i = 0; tcpflags[i]; ++i) | |||
420 | if (f & (1 << i)) | |||
421 | printf("%c", tcpflags[i]); | |||
422 | } | |||
423 | ||||
424 | void | |||
425 | print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, | |||
426 | sa_family_t af, u_int8_t proto, int opts) | |||
427 | { | |||
428 | char buf[PF_OSFP_LEN32*3]; | |||
429 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); | |||
430 | if (src->addr.type == PF_ADDR_ADDRMASK && | |||
431 | dst->addr.type == PF_ADDR_ADDRMASK && | |||
432 | PF_AZERO(&src->addr.v.a.addr, AF_INET6)((24 == 2 && !(&src->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.addr)-> pfa.addr32[0] && !(&src->addr.v.a.addr)->pfa .addr32[1] && !(&src->addr.v.a.addr)->pfa.addr32 [2] && !(&src->addr.v.a.addr)->pfa.addr32[3 ] )) && | |||
433 | PF_AZERO(&src->addr.v.a.mask, AF_INET6)((24 == 2 && !(&src->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.mask)-> pfa.addr32[0] && !(&src->addr.v.a.mask)->pfa .addr32[1] && !(&src->addr.v.a.mask)->pfa.addr32 [2] && !(&src->addr.v.a.mask)->pfa.addr32[3 ] )) && | |||
434 | PF_AZERO(&dst->addr.v.a.addr, AF_INET6)((24 == 2 && !(&dst->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.addr)-> pfa.addr32[0] && !(&dst->addr.v.a.addr)->pfa .addr32[1] && !(&dst->addr.v.a.addr)->pfa.addr32 [2] && !(&dst->addr.v.a.addr)->pfa.addr32[3 ] )) && | |||
435 | PF_AZERO(&dst->addr.v.a.mask, AF_INET6)((24 == 2 && !(&dst->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.mask)-> pfa.addr32[0] && !(&dst->addr.v.a.mask)->pfa .addr32[1] && !(&dst->addr.v.a.mask)->pfa.addr32 [2] && !(&dst->addr.v.a.mask)->pfa.addr32[3 ] )) && | |||
436 | !src->neg && !dst->neg && | |||
437 | !src->port_op && !dst->port_op && | |||
438 | osfp == PF_OSFP_ANY((pf_osfp_t)0)) | |||
439 | printf(" all"); | |||
440 | else { | |||
441 | printf(" from "); | |||
442 | if (src->neg) | |||
443 | printf("! "); | |||
444 | print_addr(&src->addr, af, verbose); | |||
445 | if (src->port_op) | |||
446 | print_port(src->port_op, src->port[0], | |||
447 | src->port[1], | |||
448 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); | |||
449 | if (osfp != PF_OSFP_ANY((pf_osfp_t)0)) | |||
450 | printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, | |||
451 | sizeof(buf))); | |||
452 | ||||
453 | printf(" to "); | |||
454 | if (dst->neg) | |||
455 | printf("! "); | |||
456 | print_addr(&dst->addr, af, verbose); | |||
457 | if (dst->port_op) | |||
458 | print_port(dst->port_op, dst->port[0], | |||
459 | dst->port[1], | |||
460 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); | |||
461 | } | |||
462 | } | |||
463 | ||||
464 | void | |||
465 | print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, | |||
466 | sa_family_t af, int id, int verbose) | |||
467 | { | |||
468 | if (pool->ifname[0]) { | |||
469 | if (!PF_AZERO(&pool->addr.v.a.addr, af)((af == 2 && !(&pool->addr.v.a.addr)->pfa.addr32 [0]) || (af == 24 && !(&pool->addr.v.a.addr)-> pfa.addr32[0] && !(&pool->addr.v.a.addr)->pfa .addr32[1] && !(&pool->addr.v.a.addr)->pfa. addr32[2] && !(&pool->addr.v.a.addr)->pfa.addr32 [3] ))) { | |||
470 | print_addr(&pool->addr, af, verbose); | |||
471 | printf("@"); | |||
472 | } | |||
473 | printf("%s", pool->ifname); | |||
474 | } else | |||
475 | print_addr(&pool->addr, af, verbose); | |||
476 | switch (id) { | |||
477 | case PF_POOL_NAT: | |||
478 | if ((p1 != PF_NAT_PROXY_PORT_LOW50001 || | |||
479 | p2 != PF_NAT_PROXY_PORT_HIGH65535) && (p1 != 0 || p2 != 0)) { | |||
480 | if (p1 == p2) | |||
481 | printf(" port %u", p1); | |||
482 | else | |||
483 | printf(" port %u:%u", p1, p2); | |||
484 | } | |||
485 | break; | |||
486 | case PF_POOL_RDR: | |||
487 | if (p1) { | |||
488 | printf(" port %u", p1); | |||
489 | if (p2 && (p2 != p1)) | |||
490 | printf(":%u", p2); | |||
491 | } | |||
492 | break; | |||
493 | default: | |||
494 | break; | |||
495 | } | |||
496 | switch (pool->opts & PF_POOL_TYPEMASK0x0f) { | |||
497 | case PF_POOL_NONE: | |||
498 | break; | |||
499 | case PF_POOL_BITMASK: | |||
500 | printf(" bitmask"); | |||
501 | break; | |||
502 | case PF_POOL_RANDOM: | |||
503 | printf(" random"); | |||
504 | break; | |||
505 | case PF_POOL_SRCHASH: | |||
506 | printf(" source-hash 0x%08x%08x%08x%08x", | |||
507 | pool->key.key32pfk.key32[0], pool->key.key32pfk.key32[1], | |||
508 | pool->key.key32pfk.key32[2], pool->key.key32pfk.key32[3]); | |||
509 | break; | |||
510 | case PF_POOL_ROUNDROBIN: | |||
511 | printf(" round-robin"); | |||
512 | break; | |||
513 | case PF_POOL_LEASTSTATES: | |||
514 | printf(" least-states"); | |||
515 | break; | |||
516 | } | |||
517 | if (pool->opts & PF_POOL_STICKYADDR0x20) | |||
518 | printf(" sticky-address"); | |||
519 | if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) | |||
520 | printf(" static-port"); | |||
521 | } | |||
522 | ||||
523 | const char *pf_reasons[PFRES_MAX17+1] = PFRES_NAMES{ "match", "bad-offset", "fragment", "short", "normalize", "memory" , "bad-timestamp", "congestion", "ip-option", "proto-cksum", "state-mismatch" , "state-insert", "state-limit", "src-limit", "synproxy", "translate" , "no-route", ((void *)0) }; | |||
524 | const char *pf_lcounters[LCNT_MAX10+1] = LCNT_NAMES{ "max states per rule", "max-src-states", "max-src-nodes", "max-src-conn" , "max-src-conn-rate", "overload table insertion", "overload flush states" , "synfloods detected", "syncookies sent", "syncookies validated" , ((void *)0) }; | |||
525 | const char *pf_fcounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; | |||
526 | const char *pf_scounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; | |||
527 | ||||
528 | void | |||
529 | print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts) | |||
530 | { | |||
531 | char statline[80], *running, *debug; | |||
532 | time_t runtime = 0; | |||
533 | struct timespec uptime; | |||
534 | int i; | |||
535 | char buf[PF_MD5_DIGEST_LENGTH16 * 2 + 1]; | |||
536 | static const char hex[] = "0123456789abcdef"; | |||
537 | ||||
538 | if (!clock_gettime(CLOCK_BOOTTIME6, &uptime)) | |||
539 | runtime = uptime.tv_sec - s->since; | |||
540 | running = s->running ? "Enabled" : "Disabled"; | |||
541 | ||||
542 | if (runtime) { | |||
543 | unsigned int sec, min, hrs; | |||
544 | time_t day = runtime; | |||
545 | ||||
546 | sec = day % 60; | |||
547 | day /= 60; | |||
548 | min = day % 60; | |||
549 | day /= 60; | |||
550 | hrs = day % 24; | |||
551 | day /= 24; | |||
552 | snprintf(statline, sizeof(statline), | |||
553 | "Status: %s for %lld days %.2u:%.2u:%.2u", | |||
554 | running, (long long)day, hrs, min, sec); | |||
555 | } else | |||
556 | snprintf(statline, sizeof(statline), "Status: %s", running); | |||
557 | printf("%-44s", statline); | |||
558 | if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) { | |||
559 | printf("%15s\n\n", debug); | |||
560 | free(debug); | |||
561 | } | |||
562 | ||||
563 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
564 | printf("Hostid: 0x%08x\n", ntohl(s->hostid)(__uint32_t)(__builtin_constant_p(s->hostid) ? (__uint32_t )(((__uint32_t)(s->hostid) & 0xff) << 24 | ((__uint32_t )(s->hostid) & 0xff00) << 8 | ((__uint32_t)(s-> hostid) & 0xff0000) >> 8 | ((__uint32_t)(s->hostid ) & 0xff000000) >> 24) : __swap32md(s->hostid))); | |||
565 | ||||
566 | for (i = 0; i < PF_MD5_DIGEST_LENGTH16; i++) { | |||
567 | buf[i + i] = hex[s->pf_chksum[i] >> 4]; | |||
568 | buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; | |||
569 | } | |||
570 | buf[i + i] = '\0'; | |||
571 | printf("Checksum: 0x%s\n\n", buf); | |||
572 | } | |||
573 | ||||
574 | if (s->ifname[0] != 0) { | |||
575 | printf("Interface Stats for %-16s %5s %16s\n", | |||
576 | s->ifname, "IPv4", "IPv6"); | |||
577 | printf(" %-25s %14llu %16llu\n", "Bytes In", | |||
578 | (unsigned long long)s->bcounters[0][0], | |||
579 | (unsigned long long)s->bcounters[1][0]); | |||
580 | printf(" %-25s %14llu %16llu\n", "Bytes Out", | |||
581 | (unsigned long long)s->bcounters[0][1], | |||
582 | (unsigned long long)s->bcounters[1][1]); | |||
583 | printf(" Packets In\n"); | |||
584 | printf(" %-23s %14llu %16llu\n", "Passed", | |||
585 | (unsigned long long)s->pcounters[0][0][PF_PASS], | |||
586 | (unsigned long long)s->pcounters[1][0][PF_PASS]); | |||
587 | printf(" %-23s %14llu %16llu\n", "Blocked", | |||
588 | (unsigned long long)s->pcounters[0][0][PF_DROP], | |||
589 | (unsigned long long)s->pcounters[1][0][PF_DROP]); | |||
590 | printf(" Packets Out\n"); | |||
591 | printf(" %-23s %14llu %16llu\n", "Passed", | |||
592 | (unsigned long long)s->pcounters[0][1][PF_PASS], | |||
593 | (unsigned long long)s->pcounters[1][1][PF_PASS]); | |||
594 | printf(" %-23s %14llu %16llu\n\n", "Blocked", | |||
595 | (unsigned long long)s->pcounters[0][1][PF_DROP], | |||
596 | (unsigned long long)s->pcounters[1][1][PF_DROP]); | |||
597 | } | |||
598 | printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); | |||
599 | printf(" %-25s %14u %14s\n", "current entries", s->states, ""); | |||
600 | printf(" %-25s %14u %14s\n", "half-open tcp", s->states_halfopen, ""); | |||
601 | for (i = 0; i < FCNT_MAX3; i++) { | |||
602 | printf(" %-25s %14llu ", pf_fcounters[i], | |||
603 | (unsigned long long)s->fcounters[i]); | |||
604 | if (runtime > 0) | |||
605 | printf("%14.1f/s\n", | |||
606 | (double)s->fcounters[i] / (double)runtime); | |||
607 | else | |||
608 | printf("%14s\n", ""); | |||
609 | } | |||
610 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
611 | printf("Source Tracking Table\n"); | |||
612 | printf(" %-25s %14u %14s\n", "current entries", | |||
613 | s->src_nodes, ""); | |||
614 | for (i = 0; i < SCNT_MAX3; i++) { | |||
615 | printf(" %-25s %14lld ", pf_scounters[i], | |||
616 | s->scounters[i]); | |||
617 | if (runtime > 0) | |||
618 | printf("%14.1f/s\n", | |||
619 | (double)s->scounters[i] / (double)runtime); | |||
620 | else | |||
621 | printf("%14s\n", ""); | |||
622 | } | |||
623 | } | |||
624 | printf("Counters\n"); | |||
625 | for (i = 0; i < PFRES_MAX17; i++) { | |||
626 | printf(" %-25s %14llu ", pf_reasons[i], | |||
627 | (unsigned long long)s->counters[i]); | |||
628 | if (runtime > 0) | |||
629 | printf("%14.1f/s\n", | |||
630 | (double)s->counters[i] / (double)runtime); | |||
631 | else | |||
632 | printf("%14s\n", ""); | |||
633 | } | |||
634 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
635 | printf("Limit Counters\n"); | |||
636 | for (i = 0; i < LCNT_MAX10; i++) { | |||
637 | printf(" %-25s %14lld ", pf_lcounters[i], | |||
638 | s->lcounters[i]); | |||
639 | if (runtime > 0) | |||
640 | printf("%14.1f/s\n", | |||
641 | (double)s->lcounters[i] / (double)runtime); | |||
642 | else | |||
643 | printf("%14s\n", ""); | |||
644 | } | |||
645 | } | |||
646 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
647 | printf("Adaptive Syncookies Watermarks\n"); | |||
648 | printf(" %-25s %14d states\n", "start", synflwats->hi); | |||
649 | printf(" %-25s %14d states\n", "end", synflwats->lo); | |||
650 | } | |||
651 | } | |||
652 | ||||
653 | void | |||
654 | print_src_node(struct pf_src_node *sn, int opts) | |||
655 | { | |||
656 | struct pf_addr_wrap aw; | |||
657 | int min, sec; | |||
658 | ||||
659 | memset(&aw, 0, sizeof(aw)); | |||
660 | if (sn->af == AF_INET2) | |||
661 | aw.v.a.mask.addr32pfa.addr32[0] = 0xffffffff; | |||
662 | else | |||
663 | memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); | |||
664 | ||||
665 | aw.v.a.addr = sn->addr; | |||
666 | print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE20x00080); | |||
667 | ||||
668 | if (!PF_AZERO(&sn->raddr, sn->af)((sn->af == 2 && !(&sn->raddr)->pfa.addr32 [0]) || (sn->af == 24 && !(&sn->raddr)-> pfa.addr32[0] && !(&sn->raddr)->pfa.addr32[ 1] && !(&sn->raddr)->pfa.addr32[2] && !(&sn->raddr)->pfa.addr32[3] ))) { | |||
669 | if (sn->type == PF_SN_NAT) | |||
670 | printf(" nat-to "); | |||
671 | else if (sn->type == PF_SN_RDR) | |||
672 | printf(" rdr-to "); | |||
673 | else if (sn->type == PF_SN_ROUTE) | |||
674 | printf(" route-to "); | |||
675 | else | |||
676 | printf(" ??? (%u) ", sn->type); | |||
677 | aw.v.a.addr = sn->raddr; | |||
678 | print_addr(&aw, sn->naf ? sn->naf : sn->af, | |||
679 | opts & PF_OPT_VERBOSE20x00080); | |||
680 | } | |||
681 | ||||
682 | printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, | |||
683 | sn->conn, sn->conn_rate.count / 1000, | |||
684 | (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); | |||
685 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
686 | sec = sn->creation % 60; | |||
687 | sn->creation /= 60; | |||
688 | min = sn->creation % 60; | |||
689 | sn->creation /= 60; | |||
690 | printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); | |||
691 | if (sn->states == 0) { | |||
692 | sec = sn->expire % 60; | |||
693 | sn->expire /= 60; | |||
694 | min = sn->expire % 60; | |||
695 | sn->expire /= 60; | |||
696 | printf(", expires in %.2u:%.2u:%.2u", | |||
697 | sn->expire, min, sec); | |||
698 | } | |||
699 | printf(", %llu pkts, %llu bytes", | |||
700 | sn->packets[0] + sn->packets[1], | |||
701 | sn->bytes[0] + sn->bytes[1]); | |||
702 | if (sn->rule.nr != -1) | |||
703 | printf(", rule %u", sn->rule.nr); | |||
704 | printf("\n"); | |||
705 | } | |||
706 | } | |||
707 | ||||
708 | void | |||
709 | print_rule(struct pf_rule *r, const char *anchor_call, int opts) | |||
710 | { | |||
711 | static const char *actiontypes[] = { "pass", "block", "scrub", | |||
712 | "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", | |||
713 | "", "", "match"}; | |||
714 | static const char *anchortypes[] = { "anchor", "anchor", "anchor", | |||
715 | "anchor", "nat-anchor", "nat-anchor", "binat-anchor", | |||
716 | "binat-anchor", "rdr-anchor", "rdr-anchor" }; | |||
717 | int i, ropts; | |||
718 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); | |||
719 | char *p; | |||
720 | ||||
721 | if ((r->rule_flag & PFRULE_EXPIRED0x00400000) && (!verbose)) | |||
722 | return; | |||
723 | ||||
724 | if (verbose) | |||
725 | printf("@%d ", r->nr); | |||
726 | ||||
727 | if (r->action > PF_MATCH) | |||
728 | printf("action(%d)", r->action); | |||
729 | else if (anchor_call[0]) { | |||
730 | p = strrchr(anchor_call, '/'); | |||
731 | if (p ? p[1] == '_' : anchor_call[0] == '_') | |||
732 | printf("%s", anchortypes[r->action]); | |||
733 | else | |||
734 | printf("%s \"%s\"", anchortypes[r->action], | |||
735 | anchor_call); | |||
736 | } else | |||
737 | printf("%s", actiontypes[r->action]); | |||
738 | if (r->action == PF_DROP) { | |||
739 | if (r->rule_flag & PFRULE_RETURN0x0008) | |||
740 | printf(" return"); | |||
741 | else if (r->rule_flag & PFRULE_RETURNRST0x0001) { | |||
742 | if (!r->return_ttl) | |||
743 | printf(" return-rst"); | |||
744 | else | |||
745 | printf(" return-rst(ttl %d)", r->return_ttl); | |||
746 | } else if (r->rule_flag & PFRULE_RETURNICMP0x0004) { | |||
747 | const struct icmpcodeent *ic, *ic6; | |||
748 | ||||
749 | ic = geticmpcodebynumber(r->return_icmp >> 8, | |||
750 | r->return_icmp & 255, AF_INET2); | |||
751 | ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, | |||
752 | r->return_icmp6 & 255, AF_INET624); | |||
753 | ||||
754 | switch (r->af) { | |||
755 | case AF_INET2: | |||
756 | printf(" return-icmp"); | |||
757 | if (ic == NULL((void *)0)) | |||
758 | printf("(%u)", r->return_icmp & 255); | |||
759 | else | |||
760 | printf("(%s)", ic->name); | |||
761 | break; | |||
762 | case AF_INET624: | |||
763 | printf(" return-icmp6"); | |||
764 | if (ic6 == NULL((void *)0)) | |||
765 | printf("(%u)", r->return_icmp6 & 255); | |||
766 | else | |||
767 | printf("(%s)", ic6->name); | |||
768 | break; | |||
769 | default: | |||
770 | printf(" return-icmp"); | |||
771 | if (ic == NULL((void *)0)) | |||
772 | printf("(%u, ", r->return_icmp & 255); | |||
773 | else | |||
774 | printf("(%s, ", ic->name); | |||
775 | if (ic6 == NULL((void *)0)) | |||
776 | printf("%u)", r->return_icmp6 & 255); | |||
777 | else | |||
778 | printf("%s)", ic6->name); | |||
779 | break; | |||
780 | } | |||
781 | } else | |||
782 | printf(" drop"); | |||
783 | } | |||
784 | if (r->direction == PF_IN) | |||
785 | printf(" in"); | |||
786 | else if (r->direction == PF_OUT) | |||
787 | printf(" out"); | |||
788 | if (r->log) { | |||
789 | printf(" log"); | |||
790 | if (r->log & ~PF_LOG0x01 || r->logif) { | |||
791 | int count = 0; | |||
792 | ||||
793 | printf(" ("); | |||
794 | if (r->log & PF_LOG_ALL0x02) | |||
795 | printf("%sall", count++ ? ", " : ""); | |||
796 | if (r->log & PF_LOG_MATCHES0x10) | |||
797 | printf("%smatches", count++ ? ", " : ""); | |||
798 | if (r->log & PF_LOG_USER0x04) | |||
799 | printf("%suser", count++ ? ", " : ""); | |||
800 | if (r->logif) | |||
801 | printf("%sto pflog%u", count++ ? ", " : "", | |||
802 | r->logif); | |||
803 | printf(")"); | |||
804 | } | |||
805 | } | |||
806 | if (r->quick) | |||
807 | printf(" quick"); | |||
808 | if (r->ifname[0]) { | |||
809 | if (r->ifnot) | |||
810 | printf(" on ! %s", r->ifname); | |||
811 | else | |||
812 | printf(" on %s", r->ifname); | |||
813 | } | |||
814 | if (r->onrdomain >= 0) { | |||
815 | if (r->ifnot) | |||
816 | printf(" on ! rdomain %d", r->onrdomain); | |||
817 | else | |||
818 | printf(" on rdomain %d", r->onrdomain); | |||
819 | } | |||
820 | if (r->af) { | |||
821 | if (r->af == AF_INET2) | |||
822 | printf(" inet"); | |||
823 | else | |||
824 | printf(" inet6"); | |||
825 | } | |||
826 | if (r->proto) { | |||
827 | struct protoent *p; | |||
828 | ||||
829 | if ((p = getprotobynumber(r->proto)) != NULL((void *)0)) | |||
830 | printf(" proto %s", p->p_name); | |||
831 | else | |||
832 | printf(" proto %u", r->proto); | |||
833 | } | |||
834 | print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, | |||
835 | opts); | |||
836 | if (r->rcv_ifname[0]) | |||
837 | printf(" %sreceived-on %s", r->rcvifnot ? "!" : "", | |||
838 | r->rcv_ifname); | |||
839 | if (r->uid.op) | |||
840 | print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user"); | |||
841 | if (r->gid.op) | |||
842 | print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group"); | |||
843 | if (r->flags || r->flagset) { | |||
844 | printf(" flags "); | |||
845 | print_flags(r->flags); | |||
846 | printf("/"); | |||
847 | print_flags(r->flagset); | |||
848 | } else if ((r->action == PF_PASS || r->action == PF_MATCH) && | |||
849 | (!r->proto || r->proto == IPPROTO_TCP6) && | |||
850 | !(r->rule_flag & PFRULE_FRAGMENT0x0002) && | |||
851 | !anchor_call[0] && r->keep_state) | |||
852 | printf(" flags any"); | |||
853 | if (r->type) { | |||
854 | const struct icmptypeent *it; | |||
855 | ||||
856 | it = geticmptypebynumber(r->type-1, r->af); | |||
857 | if (r->af != AF_INET624) | |||
858 | printf(" icmp-type"); | |||
859 | else | |||
860 | printf(" icmp6-type"); | |||
861 | if (it != NULL((void *)0)) | |||
862 | printf(" %s", it->name); | |||
863 | else | |||
864 | printf(" %u", r->type-1); | |||
865 | if (r->code) { | |||
866 | const struct icmpcodeent *ic; | |||
867 | ||||
868 | ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); | |||
869 | if (ic != NULL((void *)0)) | |||
870 | printf(" code %s", ic->name); | |||
871 | else | |||
872 | printf(" code %u", r->code-1); | |||
873 | } | |||
874 | } | |||
875 | if (r->tos) | |||
876 | printf(" tos 0x%2.2x", r->tos); | |||
877 | if (r->prio) | |||
878 | printf(" prio %u", r->prio == PF_PRIO_ZERO0xff ? 0 : r->prio); | |||
879 | if (r->pktrate.limit) | |||
880 | printf(" max-pkt-rate %u/%u", r->pktrate.limit, | |||
881 | r->pktrate.seconds); | |||
882 | ||||
883 | if (r->scrub_flags & PFSTATE_SETMASK(0x0040|0x0200) || r->qname[0] || | |||
884 | r->rule_flag & PFRULE_SETDELAY0x0080) { | |||
885 | char *comma = ""; | |||
886 | printf(" set ("); | |||
887 | if (r->scrub_flags & PFSTATE_SETPRIO0x0200) { | |||
888 | if (r->set_prio[0] == r->set_prio[1]) | |||
889 | printf("%sprio %u", comma, r->set_prio[0]); | |||
890 | else | |||
891 | printf("%sprio(%u, %u)", comma, r->set_prio[0], | |||
892 | r->set_prio[1]); | |||
893 | comma = ", "; | |||
894 | } | |||
895 | if (r->qname[0]) { | |||
896 | if (r->pqname[0]) | |||
897 | printf("%squeue(%s, %s)", comma, r->qname, | |||
898 | r->pqname); | |||
899 | else | |||
900 | printf("%squeue %s", comma, r->qname); | |||
901 | comma = ", "; | |||
902 | } | |||
903 | if (r->scrub_flags & PFSTATE_SETTOS0x0040) { | |||
904 | printf("%stos 0x%2.2x", comma, r->set_tos); | |||
905 | comma = ", "; | |||
906 | } | |||
907 | if (r->rule_flag & PFRULE_SETDELAY0x0080) { | |||
908 | printf("%sdelay %u", comma, r->delay); | |||
909 | comma = ", "; | |||
910 | } | |||
911 | printf(")"); | |||
912 | } | |||
913 | ||||
914 | ropts = 0; | |||
915 | if (r->max_states || r->max_src_nodes || r->max_src_states) | |||
916 | ropts = 1; | |||
917 | if (r->rule_flag & PFRULE_NOSYNC0x0010) | |||
918 | ropts = 1; | |||
919 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) | |||
920 | ropts = 1; | |||
921 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) | |||
922 | ropts = 1; | |||
923 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) | |||
924 | ropts = 1; | |||
925 | if (r->rule_flag & PFRULE_PFLOW0x00040000) | |||
926 | ropts = 1; | |||
927 | for (i = 0; !ropts && i < PFTM_MAX; ++i) | |||
928 | if (r->timeout[i]) | |||
929 | ropts = 1; | |||
930 | ||||
931 | if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) | |||
932 | printf(" no state"); | |||
933 | else if (r->keep_state == PF_STATE_NORMAL0x1 && ropts) | |||
934 | printf(" keep state"); | |||
935 | else if (r->keep_state == PF_STATE_MODULATE0x2) | |||
936 | printf(" modulate state"); | |||
937 | else if (r->keep_state == PF_STATE_SYNPROXY0x3) | |||
938 | printf(" synproxy state"); | |||
939 | if (r->prob) { | |||
940 | char buf[20]; | |||
941 | ||||
942 | snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX(2147483647 *2U +1U)+1.0)); | |||
943 | for (i = strlen(buf)-1; i > 0; i--) { | |||
944 | if (buf[i] == '0') | |||
945 | buf[i] = '\0'; | |||
946 | else { | |||
947 | if (buf[i] == '.') | |||
948 | buf[i] = '\0'; | |||
949 | break; | |||
950 | } | |||
951 | } | |||
952 | printf(" probability %s%%", buf); | |||
953 | } | |||
954 | if (ropts) { | |||
955 | printf(" ("); | |||
956 | if (r->max_states) { | |||
957 | printf("max %u", r->max_states); | |||
958 | ropts = 0; | |||
959 | } | |||
960 | if (r->rule_flag & PFRULE_NOSYNC0x0010) { | |||
961 | if (!ropts) | |||
962 | printf(", "); | |||
963 | printf("no-sync"); | |||
964 | ropts = 0; | |||
965 | } | |||
966 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) { | |||
967 | if (!ropts) | |||
968 | printf(", "); | |||
969 | printf("source-track"); | |||
970 | if (r->rule_flag & PFRULE_RULESRCTRACK0x0040) | |||
971 | printf(" rule"); | |||
972 | else | |||
973 | printf(" global"); | |||
974 | ropts = 0; | |||
975 | } | |||
976 | if (r->max_src_states) { | |||
977 | if (!ropts) | |||
978 | printf(", "); | |||
979 | printf("max-src-states %u", r->max_src_states); | |||
980 | ropts = 0; | |||
981 | } | |||
982 | if (r->max_src_conn) { | |||
983 | if (!ropts) | |||
984 | printf(", "); | |||
985 | printf("max-src-conn %u", r->max_src_conn); | |||
986 | ropts = 0; | |||
987 | } | |||
988 | if (r->max_src_conn_rate.limit) { | |||
989 | if (!ropts) | |||
990 | printf(", "); | |||
991 | printf("max-src-conn-rate %u/%u", | |||
992 | r->max_src_conn_rate.limit, | |||
993 | r->max_src_conn_rate.seconds); | |||
994 | ropts = 0; | |||
995 | } | |||
996 | if (r->max_src_nodes) { | |||
997 | if (!ropts) | |||
998 | printf(", "); | |||
999 | printf("max-src-nodes %u", r->max_src_nodes); | |||
1000 | ropts = 0; | |||
1001 | } | |||
1002 | if (r->overload_tblname[0]) { | |||
1003 | if (!ropts) | |||
1004 | printf(", "); | |||
1005 | printf("overload <%s>", r->overload_tblname); | |||
1006 | if (r->flush) | |||
1007 | printf(" flush"); | |||
1008 | if (r->flush & PF_FLUSH_GLOBAL0x02) | |||
1009 | printf(" global"); | |||
1010 | } | |||
1011 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) { | |||
1012 | if (!ropts) | |||
1013 | printf(", "); | |||
1014 | printf("if-bound"); | |||
1015 | ropts = 0; | |||
1016 | } | |||
1017 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) { | |||
1018 | if (!ropts) | |||
1019 | printf(", "); | |||
1020 | printf("sloppy"); | |||
1021 | ropts = 0; | |||
1022 | } | |||
1023 | if (r->rule_flag & PFRULE_PFLOW0x00040000) { | |||
1024 | if (!ropts) | |||
1025 | printf(", "); | |||
1026 | printf("pflow"); | |||
1027 | ropts = 0; | |||
1028 | } | |||
1029 | for (i = 0; i < PFTM_MAX; ++i) | |||
1030 | if (r->timeout[i]) { | |||
1031 | int j; | |||
1032 | ||||
1033 | if (!ropts) | |||
1034 | printf(", "); | |||
1035 | ropts = 0; | |||
1036 | for (j = 0; pf_timeouts[j].name != NULL((void *)0); | |||
1037 | ++j) | |||
1038 | if (pf_timeouts[j].timeout == i) | |||
1039 | break; | |||
1040 | printf("%s %u", pf_timeouts[j].name == NULL((void *)0) ? | |||
1041 | "inv.timeout" : pf_timeouts[j].name, | |||
1042 | r->timeout[i]); | |||
1043 | } | |||
1044 | printf(")"); | |||
1045 | } | |||
1046 | ||||
1047 | if (r->rule_flag & PFRULE_FRAGMENT0x0002) | |||
1048 | printf(" fragment"); | |||
1049 | ||||
1050 | if (r->scrub_flags & PFSTATE_SCRUBMASK(0x0020|0x0080|0x0100) || r->min_ttl || r->max_mss) { | |||
1051 | printf(" scrub ("); | |||
1052 | ropts = 1; | |||
1053 | if (r->scrub_flags & PFSTATE_NODF0x0020) { | |||
1054 | printf("no-df"); | |||
1055 | ropts = 0; | |||
1056 | } | |||
1057 | if (r->scrub_flags & PFSTATE_RANDOMID0x0080) { | |||
1058 | if (!ropts) | |||
1059 | printf(" "); | |||
1060 | printf("random-id"); | |||
1061 | ropts = 0; | |||
1062 | } | |||
1063 | if (r->min_ttl) { | |||
1064 | if (!ropts) | |||
1065 | printf(" "); | |||
1066 | printf("min-ttl %d", r->min_ttl); | |||
1067 | ropts = 0; | |||
1068 | } | |||
1069 | if (r->scrub_flags & PFSTATE_SCRUB_TCP0x0100) { | |||
1070 | if (!ropts) | |||
1071 | printf(" "); | |||
1072 | printf("reassemble tcp"); | |||
1073 | ropts = 0; | |||
1074 | } | |||
1075 | if (r->max_mss) { | |||
1076 | if (!ropts) | |||
1077 | printf(" "); | |||
1078 | printf("max-mss %d", r->max_mss); | |||
1079 | ropts = 0; | |||
1080 | } | |||
1081 | printf(")"); | |||
1082 | } | |||
1083 | ||||
1084 | if (r->allow_opts) | |||
1085 | printf(" allow-opts"); | |||
1086 | if (r->label[0]) | |||
1087 | printf(" label \"%s\"", r->label); | |||
1088 | if (r->rule_flag & PFRULE_ONCE0x00100000) | |||
1089 | printf(" once"); | |||
1090 | if (r->tagname[0]) | |||
1091 | printf(" tag %s", r->tagname); | |||
1092 | if (r->match_tagname[0]) { | |||
1093 | if (r->match_tag_not) | |||
1094 | printf(" !"); | |||
1095 | printf(" tagged %s", r->match_tagname); | |||
1096 | } | |||
1097 | if (r->rtableid != -1) | |||
1098 | printf(" rtable %u", r->rtableid); | |||
1099 | switch (r->divert.type) { | |||
1100 | case PF_DIVERT_NONE: | |||
1101 | break; | |||
1102 | case PF_DIVERT_TO: { | |||
1103 | printf(" divert-to "); | |||
1104 | print_addr_str(r->af, &r->divert.addr); | |||
1105 | printf(" port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); | |||
1106 | break; | |||
1107 | } | |||
1108 | case PF_DIVERT_REPLY: | |||
1109 | printf(" divert-reply"); | |||
1110 | break; | |||
1111 | case PF_DIVERT_PACKET: | |||
1112 | printf(" divert-packet port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); | |||
1113 | break; | |||
1114 | default: | |||
1115 | printf(" divert ???"); | |||
1116 | break; | |||
1117 | } | |||
1118 | ||||
1119 | if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && | |||
1120 | r->rule_flag & PFRULE_AFTO0x00200000) { | |||
1121 | printf(" af-to %s from ", r->naf == AF_INET2 ? "inet" : "inet6"); | |||
1122 | print_pool(&r->nat, r->nat.proxy_port[0], | |||
1123 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, | |||
1124 | PF_POOL_NAT, verbose); | |||
1125 | if (r->rdr.addr.type != PF_ADDR_NONE) { | |||
1126 | printf(" to "); | |||
1127 | print_pool(&r->rdr, r->rdr.proxy_port[0], | |||
1128 | r->rdr.proxy_port[1], r->naf ? r->naf : r->af, | |||
1129 | PF_POOL_RDR, verbose); | |||
1130 | } | |||
1131 | } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { | |||
1132 | printf (" nat-to "); | |||
1133 | print_pool(&r->nat, r->nat.proxy_port[0], | |||
1134 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, | |||
1135 | PF_POOL_NAT, verbose); | |||
1136 | } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { | |||
1137 | printf (" rdr-to "); | |||
1138 | print_pool(&r->rdr, r->rdr.proxy_port[0], | |||
1139 | r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); | |||
1140 | } | |||
1141 | if (r->rt) { | |||
1142 | if (r->rt == PF_ROUTETO) | |||
1143 | printf(" route-to"); | |||
1144 | else if (r->rt == PF_REPLYTO) | |||
1145 | printf(" reply-to"); | |||
1146 | else if (r->rt == PF_DUPTO) | |||
1147 | printf(" dup-to"); | |||
1148 | printf(" "); | |||
1149 | print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); | |||
1150 | } | |||
1151 | } | |||
1152 | ||||
1153 | void | |||
1154 | print_tabledef(const char *name, int flags, int addrs, | |||
1155 | struct node_tinithead *nodes) | |||
1156 | { | |||
1157 | struct node_tinit *ti, *nti; | |||
1158 | struct node_host *h; | |||
1159 | ||||
1160 | printf("table <%s>", name); | |||
1161 | if (flags & PFR_TFLAG_CONST0x00000002) | |||
1162 | printf(" const"); | |||
1163 | if (flags & PFR_TFLAG_PERSIST0x00000001) | |||
1164 | printf(" persist"); | |||
1165 | if (flags & PFR_TFLAG_COUNTERS0x00000040) | |||
1166 | printf(" counters"); | |||
1167 | SIMPLEQ_FOREACH(ti, nodes, entries)for((ti) = ((nodes)->sqh_first); (ti) != ((void *)0); (ti) = ((ti)->entries.sqe_next)) { | |||
1168 | if (ti->file) { | |||
1169 | printf(" file \"%s\"", ti->file); | |||
1170 | continue; | |||
1171 | } | |||
1172 | printf(" {"); | |||
1173 | for (;;) { | |||
1174 | for (h = ti->host; h != NULL((void *)0); h = h->next) { | |||
1175 | printf(h->not ? " !" : " "); | |||
1176 | print_addr(&h->addr, h->af, 0); | |||
1177 | if (h->ifname) | |||
1178 | printf("@%s", h->ifname); | |||
1179 | } | |||
1180 | nti = SIMPLEQ_NEXT(ti, entries)((ti)->entries.sqe_next); | |||
1181 | if (nti != NULL((void *)0) && nti->file == NULL((void *)0)) | |||
1182 | ti = nti; /* merge lists */ | |||
1183 | else | |||
1184 | break; | |||
1185 | } | |||
1186 | printf(" }"); | |||
1187 | } | |||
1188 | if (addrs && SIMPLEQ_EMPTY(nodes)(((nodes)->sqh_first) == ((void *)0))) | |||
1189 | printf(" { }"); | |||
1190 | printf("\n"); | |||
1191 | } | |||
1192 | ||||
1193 | void | |||
1194 | print_bwspec(const char *prefix, struct pf_queue_bwspec *bw) | |||
1195 | { | |||
1196 | u_int rate; | |||
1197 | int i; | |||
1198 | static const char unit[] = " KMG"; | |||
1199 | ||||
1200 | if (bw->percent) | |||
1201 | printf("%s%u%%", prefix, bw->percent); | |||
1202 | else if (bw->absolute) { | |||
1203 | rate = bw->absolute; | |||
1204 | for (i = 0; rate >= 1000 && i <= 3 && (rate % 1000 == 0); i++) | |||
1205 | rate /= 1000; | |||
1206 | printf("%s%u%c", prefix, rate, unit[i]); | |||
1207 | } | |||
1208 | } | |||
1209 | ||||
1210 | void | |||
1211 | print_scspec(const char *prefix, struct pf_queue_scspec *sc) | |||
1212 | { | |||
1213 | print_bwspec(prefix, &sc->m2); | |||
1214 | if (sc->d) { | |||
1215 | printf(" burst "); | |||
1216 | print_bwspec("", &sc->m1); | |||
1217 | printf(" for %ums", sc->d); | |||
1218 | } | |||
1219 | } | |||
1220 | ||||
1221 | void | |||
1222 | print_queuespec(struct pf_queuespec *q) | |||
1223 | { | |||
1224 | printf("queue %s", q->qname); | |||
1225 | if (q->parent[0]) | |||
1226 | printf(" parent %s", q->parent); | |||
1227 | else if (q->ifname[0]) | |||
1228 | printf(" on %s", q->ifname); | |||
1229 | if (q->flags & PFQS_FLOWQUEUE0x0001) { | |||
1230 | printf(" flows %u", q->flowqueue.flows); | |||
1231 | if (q->flowqueue.quantum > 0) | |||
1232 | printf(" quantum %u", q->flowqueue.quantum); | |||
1233 | if (q->flowqueue.interval > 0) | |||
1234 | printf(" interval %ums", | |||
1235 | q->flowqueue.interval / 1000000); | |||
1236 | if (q->flowqueue.target > 0) | |||
1237 | printf(" target %ums", | |||
1238 | q->flowqueue.target / 1000000); | |||
1239 | } | |||
1240 | if (q->linkshare.m1.absolute || q->linkshare.m2.absolute) { | |||
1241 | print_scspec(" bandwidth ", &q->linkshare); | |||
1242 | print_scspec(", min ", &q->realtime); | |||
1243 | print_scspec(", max ", &q->upperlimit); | |||
1244 | } | |||
1245 | if (q->flags & PFQS_DEFAULT0x1000) | |||
1246 | printf(" default"); | |||
1247 | if (q->qlimit) | |||
1248 | printf(" qlimit %u", q->qlimit); | |||
1249 | printf("\n"); | |||
1250 | } | |||
1251 | ||||
1252 | int | |||
1253 | parse_flags(char *s) | |||
1254 | { | |||
1255 | char *p, *q; | |||
1256 | u_int8_t f = 0; | |||
1257 | ||||
1258 | for (p = s; *p; p++) { | |||
1259 | if ((q = strchr(tcpflags, *p)) == NULL((void *)0)) | |||
1260 | return -1; | |||
1261 | else | |||
1262 | f |= 1 << (q - tcpflags); | |||
1263 | } | |||
1264 | return (f ? f : PF_TH_ALL0xFF); | |||
1265 | } | |||
1266 | ||||
1267 | void | |||
1268 | set_ipmask(struct node_host *h, int bb) | |||
1269 | { | |||
1270 | struct pf_addr *m, *n; | |||
1271 | int i, j = 0; | |||
1272 | u_int8_t b; | |||
1273 | ||||
1274 | m = &h->addr.v.a.mask; | |||
1275 | memset(m, 0, sizeof(*m)); | |||
1276 | ||||
1277 | if (bb == -1) | |||
1278 | b = h->af == AF_INET2 ? 32 : 128; | |||
1279 | else | |||
1280 | b = bb; | |||
1281 | ||||
1282 | while (b >= 32) { | |||
1283 | m->addr32pfa.addr32[j++] = 0xffffffff; | |||
1284 | b -= 32; | |||
1285 | } | |||
1286 | for (i = 31; i > 31-b; --i) | |||
1287 | m->addr32pfa.addr32[j] |= (1 << i); | |||
1288 | if (b) | |||
1289 | m->addr32pfa.addr32[j] = htonl(m->addr32[j])(__uint32_t)(__builtin_constant_p(m->pfa.addr32[j]) ? (__uint32_t )(((__uint32_t)(m->pfa.addr32[j]) & 0xff) << 24 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff00) << 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff0000) >> 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff000000) >> 24) : __swap32md(m->pfa.addr32[j])); | |||
1290 | ||||
1291 | /* Mask off bits of the address that will never be used. */ | |||
1292 | n = &h->addr.v.a.addr; | |||
1293 | if (h->addr.type == PF_ADDR_ADDRMASK) | |||
1294 | for (i = 0; i < 4; i++) | |||
1295 | n->addr32pfa.addr32[i] = n->addr32pfa.addr32[i] & m->addr32pfa.addr32[i]; | |||
1296 | } | |||
1297 | ||||
1298 | int | |||
1299 | check_netmask(struct node_host *h, sa_family_t af) | |||
1300 | { | |||
1301 | struct node_host *n = NULL((void *)0); | |||
1302 | struct pf_addr *m; | |||
1303 | ||||
1304 | for (n = h; n != NULL((void *)0); n = n->next) { | |||
1305 | if (h->addr.type == PF_ADDR_TABLE) | |||
1306 | continue; | |||
1307 | m = &h->addr.v.a.mask; | |||
1308 | /* netmasks > 32 bit are invalid on v4 */ | |||
1309 | if (af == AF_INET2 && | |||
1310 | (m->addr32pfa.addr32[1] || m->addr32pfa.addr32[2] || m->addr32pfa.addr32[3])) { | |||
1311 | fprintf(stderr(&__sF[2]), "netmask %u invalid for IPv4 address\n", | |||
1312 | unmask(m)); | |||
1313 | return (1); | |||
1314 | } | |||
1315 | } | |||
1316 | return (0); | |||
1317 | } | |||
1318 | ||||
1319 | struct node_host * | |||
1320 | gen_dynnode(struct node_host *h, sa_family_t af) | |||
1321 | { | |||
1322 | struct node_host *n; | |||
1323 | ||||
1324 | if (h->addr.type != PF_ADDR_DYNIFTL) | |||
1325 | return (NULL((void *)0)); | |||
1326 | ||||
1327 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) | |||
1328 | return (NULL((void *)0)); | |||
1329 | bcopy(h, n, sizeof(*n)); | |||
1330 | n->ifname = NULL((void *)0); | |||
1331 | n->next = NULL((void *)0); | |||
1332 | n->tail = NULL((void *)0); | |||
1333 | ||||
1334 | /* fix up netmask */ | |||
1335 | if (af == AF_INET2 && unmask(&n->addr.v.a.mask) > 32) | |||
1336 | set_ipmask(n, 32); | |||
1337 | ||||
1338 | return (n); | |||
1339 | } | |||
1340 | ||||
1341 | /* interface lookup routines */ | |||
1342 | ||||
1343 | struct node_host *iftab; | |||
1344 | ||||
1345 | void | |||
1346 | ifa_load(void) | |||
1347 | { | |||
1348 | struct ifaddrs *ifap, *ifa; | |||
1349 | struct node_host *n = NULL((void *)0), *h = NULL((void *)0); | |||
1350 | ||||
1351 | if (getifaddrs(&ifap) == -1) | |||
1352 | err(1, "getifaddrs"); | |||
1353 | ||||
1354 | for (ifa = ifap; ifa; ifa = ifa->ifa_next) { | |||
1355 | if (ifa->ifa_addr == NULL((void *)0) || | |||
1356 | !(ifa->ifa_addr->sa_family == AF_INET2 || | |||
1357 | ifa->ifa_addr->sa_family == AF_INET624 || | |||
1358 | ifa->ifa_addr->sa_family == AF_LINK18)) | |||
1359 | continue; | |||
1360 | n = calloc(1, sizeof(struct node_host)); | |||
1361 | if (n == NULL((void *)0)) | |||
1362 | err(1, "%s: calloc", __func__); | |||
1363 | n->af = ifa->ifa_addr->sa_family; | |||
1364 | n->ifa_flags = ifa->ifa_flags; | |||
1365 | #ifdef __KAME__ | |||
1366 | if (n->af == AF_INET624 && | |||
1367 | IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) | |||
1368 | ifa->ifa_addr)->sin6_addr)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) && | |||
1369 | ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == | |||
1370 | 0) { | |||
1371 | struct sockaddr_in6 *sin6; | |||
1372 | ||||
1373 | sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; | |||
1374 | sin6->sin6_scope_id = sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] << 8 | | |||
1375 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3]; | |||
1376 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] = 0; | |||
1377 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3] = 0; | |||
1378 | } | |||
1379 | #endif | |||
1380 | n->ifindex = 0; | |||
1381 | if (n->af == AF_LINK18) | |||
1382 | n->ifindex = ((struct sockaddr_dl *) | |||
1383 | ifa->ifa_addr)->sdl_index; | |||
1384 | else { | |||
1385 | copy_satopfaddr(&n->addr.v.a.addr, ifa->ifa_addr); | |||
1386 | ifa->ifa_netmask->sa_family = ifa->ifa_addr->sa_family; | |||
1387 | copy_satopfaddr(&n->addr.v.a.mask, ifa->ifa_netmask); | |||
1388 | if (ifa->ifa_broadaddrifa_dstaddr != NULL((void *)0)) { | |||
1389 | ifa->ifa_broadaddrifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; | |||
1390 | copy_satopfaddr(&n->bcast, ifa->ifa_broadaddrifa_dstaddr); | |||
1391 | } | |||
1392 | if (ifa->ifa_dstaddr != NULL((void *)0)) { | |||
1393 | ifa->ifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; | |||
1394 | copy_satopfaddr(&n->peer, ifa->ifa_dstaddr); | |||
1395 | } | |||
1396 | if (n->af == AF_INET624) | |||
1397 | n->ifindex = ((struct sockaddr_in6 *) | |||
1398 | ifa->ifa_addr)->sin6_scope_id; | |||
1399 | } | |||
1400 | if ((n->ifname = strdup(ifa->ifa_name)) == NULL((void *)0)) | |||
1401 | err(1, "%s: strdup", __func__); | |||
1402 | n->next = NULL((void *)0); | |||
1403 | n->tail = n; | |||
1404 | if (h == NULL((void *)0)) | |||
1405 | h = n; | |||
1406 | else { | |||
1407 | h->tail->next = n; | |||
1408 | h->tail = n; | |||
1409 | } | |||
1410 | } | |||
1411 | ||||
1412 | iftab = h; | |||
1413 | freeifaddrs(ifap); | |||
1414 | } | |||
1415 | ||||
1416 | unsigned int | |||
1417 | ifa_nametoindex(const char *ifa_name) | |||
1418 | { | |||
1419 | struct node_host *p; | |||
1420 | ||||
1421 | for (p = iftab; p; p = p->next) { | |||
1422 | if (p->af == AF_LINK18 && strcmp(p->ifname, ifa_name) == 0) | |||
1423 | return (p->ifindex); | |||
1424 | } | |||
1425 | errno(*__errno()) = ENXIO6; | |||
1426 | return (0); | |||
1427 | } | |||
1428 | ||||
1429 | char * | |||
1430 | ifa_indextoname(unsigned int ifindex, char *ifa_name) | |||
1431 | { | |||
1432 | struct node_host *p; | |||
1433 | ||||
1434 | for (p = iftab; p; p = p->next) { | |||
1435 | if (p->af == AF_LINK18 && ifindex == p->ifindex) { | |||
1436 | strlcpy(ifa_name, p->ifname, IFNAMSIZ16); | |||
1437 | return (ifa_name); | |||
1438 | } | |||
1439 | } | |||
1440 | errno(*__errno()) = ENXIO6; | |||
1441 | return (NULL((void *)0)); | |||
1442 | } | |||
1443 | ||||
1444 | struct node_host * | |||
1445 | ifa_exists(const char *ifa_name) | |||
1446 | { | |||
1447 | struct node_host *n; | |||
1448 | struct ifgroupreq ifgr; | |||
1449 | int s; | |||
1450 | ||||
1451 | if (iftab == NULL((void *)0)) | |||
1452 | ifa_load(); | |||
1453 | ||||
1454 | /* check whether this is a group */ | |||
1455 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) | |||
1456 | err(1, "socket"); | |||
1457 | bzero(&ifgr, sizeof(ifgr)); | |||
1458 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); | |||
1459 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == 0) { | |||
1460 | /* fake a node_host */ | |||
1461 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) | |||
1462 | err(1, "calloc"); | |||
1463 | if ((n->ifname = strdup(ifa_name)) == NULL((void *)0)) | |||
1464 | err(1, "strdup"); | |||
1465 | close(s); | |||
1466 | return (n); | |||
1467 | } | |||
1468 | close(s); | |||
1469 | ||||
1470 | for (n = iftab; n; n = n->next) { | |||
1471 | if (n->af == AF_LINK18 && !strncmp(n->ifname, ifa_name, IFNAMSIZ16)) | |||
1472 | return (n); | |||
1473 | } | |||
1474 | ||||
1475 | return (NULL((void *)0)); | |||
1476 | } | |||
1477 | ||||
1478 | struct node_host * | |||
1479 | ifa_grouplookup(const char *ifa_name, int flags) | |||
1480 | { | |||
1481 | struct ifg_req *ifg; | |||
1482 | struct ifgroupreq ifgr; | |||
1483 | int s, len; | |||
1484 | struct node_host *n, *h = NULL((void *)0); | |||
1485 | ||||
1486 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) | |||
1487 | err(1, "socket"); | |||
1488 | bzero(&ifgr, sizeof(ifgr)); | |||
1489 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); | |||
1490 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) { | |||
1491 | close(s); | |||
1492 | return (NULL((void *)0)); | |||
1493 | } | |||
1494 | ||||
1495 | len = ifgr.ifgr_len; | |||
1496 | if ((ifgr.ifgr_groupsifgr_ifgru.ifgru_groups = calloc(1, len)) == NULL((void *)0)) | |||
1497 | err(1, "calloc"); | |||
1498 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) | |||
1499 | err(1, "SIOCGIFGMEMB"); | |||
1500 | ||||
1501 | for (ifg = ifgr.ifgr_groupsifgr_ifgru.ifgru_groups; ifg && len >= sizeof(struct ifg_req); | |||
1502 | ifg++) { | |||
1503 | len -= sizeof(struct ifg_req); | |||
1504 | if ((n = ifa_lookup(ifg->ifgrq_memberifgrq_ifgrqu.ifgrqu_member, flags)) == NULL((void *)0)) | |||
1505 | continue; | |||
1506 | if (h == NULL((void *)0)) | |||
1507 | h = n; | |||
1508 | else { | |||
1509 | h->tail->next = n; | |||
1510 | h->tail = n->tail; | |||
1511 | } | |||
1512 | } | |||
1513 | free(ifgr.ifgr_groupsifgr_ifgru.ifgru_groups); | |||
1514 | close(s); | |||
1515 | ||||
1516 | return (h); | |||
1517 | } | |||
1518 | ||||
1519 | struct node_host * | |||
1520 | ifa_lookup(const char *ifa_name, int flags) | |||
1521 | { | |||
1522 | struct node_host *p = NULL((void *)0), *h = NULL((void *)0), *n = NULL((void *)0); | |||
1523 | int got4 = 0, got6 = 0; | |||
1524 | const char *last_if = NULL((void *)0); | |||
1525 | ||||
1526 | if ((h = ifa_grouplookup(ifa_name, flags)) != NULL((void *)0)) | |||
1527 | return (h); | |||
1528 | ||||
1529 | if (!strncmp(ifa_name, "self", IFNAMSIZ16)) | |||
1530 | ifa_name = NULL((void *)0); | |||
1531 | ||||
1532 | if (iftab == NULL((void *)0)) | |||
1533 | ifa_load(); | |||
1534 | ||||
1535 | for (p = iftab; p; p = p->next) { | |||
1536 | if (ifa_skip_if(ifa_name, p)) | |||
1537 | continue; | |||
1538 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->af != AF_INET2) | |||
1539 | continue; | |||
1540 | if ((flags & PFI_AFLAG_BROADCAST0x02) && | |||
1541 | !(p->ifa_flags & IFF_BROADCAST0x2)) | |||
1542 | continue; | |||
1543 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->bcast.v4pfa.v4.s_addr == 0) | |||
1544 | continue; | |||
1545 | if ((flags & PFI_AFLAG_PEER0x04) && | |||
1546 | !(p->ifa_flags & IFF_POINTOPOINT0x10)) | |||
1547 | continue; | |||
1548 | if ((flags & PFI_AFLAG_NETWORK0x01) && p->ifindex > 0) | |||
1549 | continue; | |||
1550 | if (last_if == NULL((void *)0) || strcmp(last_if, p->ifname)) | |||
1551 | got4 = got6 = 0; | |||
1552 | last_if = p->ifname; | |||
1553 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET2 && got4) | |||
1554 | continue; | |||
1555 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET624 && got6) | |||
1556 | continue; | |||
1557 | if (p->af == AF_INET2) | |||
1558 | got4 = 1; | |||
1559 | else | |||
1560 | got6 = 1; | |||
1561 | n = calloc(1, sizeof(struct node_host)); | |||
1562 | if (n == NULL((void *)0)) | |||
1563 | err(1, "%s: calloc", __func__); | |||
1564 | n->af = p->af; | |||
1565 | if (flags & PFI_AFLAG_BROADCAST0x02) | |||
1566 | memcpy(&n->addr.v.a.addr, &p->bcast, | |||
1567 | sizeof(struct pf_addr)); | |||
1568 | else if (flags & PFI_AFLAG_PEER0x04) | |||
1569 | memcpy(&n->addr.v.a.addr, &p->peer, | |||
1570 | sizeof(struct pf_addr)); | |||
1571 | else | |||
1572 | memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, | |||
1573 | sizeof(struct pf_addr)); | |||
1574 | if (flags & PFI_AFLAG_NETWORK0x01) | |||
1575 | set_ipmask(n, unmask(&p->addr.v.a.mask)); | |||
1576 | else | |||
1577 | set_ipmask(n, -1); | |||
1578 | n->ifindex = p->ifindex; | |||
1579 | ||||
1580 | n->next = NULL((void *)0); | |||
1581 | n->tail = n; | |||
1582 | if (h == NULL((void *)0)) | |||
1583 | h = n; | |||
1584 | else { | |||
1585 | h->tail->next = n; | |||
1586 | h->tail = n; | |||
1587 | } | |||
1588 | } | |||
1589 | return (h); | |||
1590 | } | |||
1591 | ||||
1592 | int | |||
1593 | ifa_skip_if(const char *filter, struct node_host *p) | |||
1594 | { | |||
1595 | int n; | |||
1596 | ||||
1597 | if (p->af != AF_INET2 && p->af != AF_INET624) | |||
1598 | return (1); | |||
1599 | if (filter == NULL((void *)0) || !*filter) | |||
1600 | return (0); | |||
1601 | if (!strcmp(p->ifname, filter)) | |||
1602 | return (0); /* exact match */ | |||
1603 | n = strlen(filter); | |||
1604 | if (n < 1 || n >= IFNAMSIZ16) | |||
1605 | return (1); /* sanity check */ | |||
1606 | if (filter[n-1] >= '0' && filter[n-1] <= '9') | |||
1607 | return (1); /* only do exact match in that case */ | |||
1608 | if (strncmp(p->ifname, filter, n)) | |||
1609 | return (1); /* prefix doesn't match */ | |||
1610 | return (p->ifname[n] < '0' || p->ifname[n] > '9'); | |||
1611 | } | |||
1612 | ||||
1613 | struct node_host * | |||
1614 | host(const char *s, int opts) | |||
1615 | { | |||
1616 | struct node_host *h = NULL((void *)0), *n; | |||
1617 | int mask = -1; | |||
1618 | char *p, *ps; | |||
1619 | const char *errstr; | |||
1620 | ||||
1621 | if ((ps = strdup(s)) == NULL((void *)0)) | |||
1622 | err(1, "%s: strdup", __func__); | |||
1623 | ||||
1624 | if ((p = strchr(ps, '/')) != NULL((void *)0)) { | |||
1625 | mask = strtonum(p+1, 0, 128, &errstr); | |||
1626 | if (errstr) { | |||
1627 | fprintf(stderr(&__sF[2]), "netmask is %s: %s\n", errstr, p); | |||
1628 | goto error; | |||
1629 | } | |||
1630 | p[0] = '\0'; | |||
1631 | } | |||
1632 | ||||
1633 | if ((h = host_if(ps, mask)) == NULL((void *)0) && | |||
1634 | (h = host_ip(ps, mask)) == NULL((void *)0) && | |||
1635 | (h = host_dns(ps, mask, (opts & PF_OPT_NODNS0x01000))) == NULL((void *)0)) { | |||
1636 | fprintf(stderr(&__sF[2]), "no IP address found for %s\n", s); | |||
1637 | goto error; | |||
1638 | } | |||
1639 | ||||
1640 | for (n = h; n != NULL((void *)0); n = n->next) { | |||
1641 | n->addr.type = PF_ADDR_ADDRMASK; | |||
1642 | n->weight = 0; | |||
1643 | } | |||
1644 | ||||
1645 | error: | |||
1646 | free(ps); | |||
1647 | return (h); | |||
1648 | } | |||
1649 | ||||
1650 | struct node_host * | |||
1651 | host_if(const char *s, int mask) | |||
1652 | { | |||
1653 | struct node_host *n, *h = NULL((void *)0); | |||
1654 | char *p, *ps; | |||
1655 | int flags = 0; | |||
1656 | ||||
1657 | if ((ps = strdup(s)) == NULL((void *)0)) | |||
1658 | err(1, "host_if: strdup"); | |||
1659 | while ((p = strrchr(ps, ':')) != NULL((void *)0)) { | |||
1660 | if (!strcmp(p+1, "network")) | |||
1661 | flags |= PFI_AFLAG_NETWORK0x01; | |||
1662 | else if (!strcmp(p+1, "broadcast")) | |||
1663 | flags |= PFI_AFLAG_BROADCAST0x02; | |||
1664 | else if (!strcmp(p+1, "peer")) | |||
1665 | flags |= PFI_AFLAG_PEER0x04; | |||
1666 | else if (!strcmp(p+1, "0")) | |||
1667 | flags |= PFI_AFLAG_NOALIAS0x08; | |||
1668 | else | |||
1669 | goto error; | |||
1670 | *p = '\0'; | |||
1671 | } | |||
1672 | if (flags & (flags - 1) & PFI_AFLAG_MODEMASK0x07) { /* Yep! */ | |||
1673 | fprintf(stderr(&__sF[2]), "illegal combination of interface modifiers\n"); | |||
1674 | goto error; | |||
1675 | } | |||
1676 | if ((flags & (PFI_AFLAG_NETWORK0x01|PFI_AFLAG_BROADCAST0x02)) && mask > -1) { | |||
1677 | fprintf(stderr(&__sF[2]), "network or broadcast lookup, but " | |||
1678 | "extra netmask given\n"); | |||
1679 | goto error; | |||
1680 | } | |||
1681 | if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ16)) { | |||
1682 | /* interface with this name exists */ | |||
1683 | h = ifa_lookup(ps, flags); | |||
| ||||
1684 | if (mask > -1) | |||
1685 | for (n = h; n != NULL((void *)0); n = n->next) | |||
1686 | set_ipmask(n, mask); | |||
1687 | } | |||
1688 | ||||
1689 | error: | |||
1690 | free(ps); | |||
1691 | return (h); | |||
1692 | } | |||
1693 | ||||
1694 | struct node_host * | |||
1695 | host_ip(const char *s, int mask) | |||
1696 | { | |||
1697 | struct addrinfo hints, *res; | |||
1698 | struct node_host *h = NULL((void *)0); | |||
1699 | ||||
1700 | memset(&hints, 0, sizeof(hints)); | |||
1701 | hints.ai_family = AF_UNSPEC0; | |||
1702 | hints.ai_socktype = SOCK_DGRAM2; /*dummy*/ | |||
1703 | hints.ai_flags = AI_NUMERICHOST4; | |||
1704 | if (getaddrinfo(s, NULL((void *)0), &hints, &res) == 0) { | |||
1705 | h = calloc(1, sizeof(*h)); | |||
1706 | if (h == NULL((void *)0)) | |||
1707 | err(1, "%s: calloc", __func__); | |||
1708 | h->af = res->ai_family; | |||
1709 | copy_satopfaddr(&h->addr.v.a.addr, res->ai_addr); | |||
1710 | if (h->af == AF_INET624) | |||
1711 | h->ifindex = | |||
1712 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; | |||
1713 | freeaddrinfo(res); | |||
1714 | } else { /* ie. for 10/8 parsing */ | |||
1715 | if (mask == -1) | |||
1716 | return (NULL((void *)0)); | |||
1717 | h = calloc(1, sizeof(*h)); | |||
1718 | if (h == NULL((void *)0)) | |||
1719 | err(1, "%s: calloc", __func__); | |||
1720 | h->af = AF_INET2; | |||
1721 | if (inet_net_pton(AF_INET2, s, &h->addr.v.a.addr.v4pfa.v4, | |||
1722 | sizeof(h->addr.v.a.addr.v4pfa.v4)) == -1) { | |||
1723 | free(h); | |||
1724 | return (NULL((void *)0)); | |||
1725 | } | |||
1726 | } | |||
1727 | set_ipmask(h, mask); | |||
1728 | h->ifname = NULL((void *)0); | |||
1729 | h->next = NULL((void *)0); | |||
1730 | h->tail = h; | |||
1731 | ||||
1732 | return (h); | |||
1733 | } | |||
1734 | ||||
1735 | struct node_host * | |||
1736 | host_dns(const char *s, int mask, int numeric) | |||
1737 | { | |||
1738 | struct addrinfo hints, *res0, *res; | |||
1739 | struct node_host *n, *h = NULL((void *)0); | |||
1740 | int noalias = 0, got4 = 0, got6 = 0; | |||
1741 | char *p, *ps; | |||
1742 | ||||
1743 | if ((ps = strdup(s)) == NULL((void *)0)) | |||
1744 | err(1, "host_dns: strdup"); | |||
1745 | if ((p = strrchr(ps, ':')) != NULL((void *)0) && !strcmp(p, ":0")) { | |||
1746 | noalias = 1; | |||
1747 | *p = '\0'; | |||
1748 | } | |||
1749 | memset(&hints, 0, sizeof(hints)); | |||
1750 | hints.ai_family = PF_UNSPEC0; | |||
1751 | hints.ai_socktype = SOCK_STREAM1; /* DUMMY */ | |||
1752 | if (numeric) | |||
1753 | hints.ai_flags = AI_NUMERICHOST4; | |||
1754 | if (getaddrinfo(ps, NULL((void *)0), &hints, &res0) != 0) | |||
1755 | goto error; | |||
1756 | ||||
1757 | for (res = res0; res; res = res->ai_next) { | |||
1758 | if (res->ai_family != AF_INET2 && | |||
1759 | res->ai_family != AF_INET624) | |||
1760 | continue; | |||
1761 | if (noalias) { | |||
1762 | if (res->ai_family == AF_INET2) { | |||
1763 | if (got4) | |||
1764 | continue; | |||
1765 | got4 = 1; | |||
1766 | } else { | |||
1767 | if (got6) | |||
1768 | continue; | |||
1769 | got6 = 1; | |||
1770 | } | |||
1771 | } | |||
1772 | n = calloc(1, sizeof(struct node_host)); | |||
1773 | if (n == NULL((void *)0)) | |||
1774 | err(1, "host_dns: calloc"); | |||
1775 | n->ifname = NULL((void *)0); | |||
1776 | n->af = res->ai_family; | |||
1777 | copy_satopfaddr(&n->addr.v.a.addr, res->ai_addr); | |||
1778 | if (res->ai_family == AF_INET624) | |||
1779 | n->ifindex = | |||
1780 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; | |||
1781 | set_ipmask(n, mask); | |||
1782 | n->next = NULL((void *)0); | |||
1783 | n->tail = n; | |||
1784 | if (h == NULL((void *)0)) | |||
1785 | h = n; | |||
1786 | else { | |||
1787 | h->tail->next = n; | |||
1788 | h->tail = n; | |||
1789 | } | |||
1790 | } | |||
1791 | freeaddrinfo(res0); | |||
1792 | error: | |||
1793 | free(ps); | |||
1794 | ||||
1795 | return (h); | |||
1796 | } | |||
1797 | ||||
1798 | /* | |||
1799 | * convert a hostname to a list of addresses and put them in the given buffer. | |||
1800 | * test: | |||
1801 | * if set to 1, only simple addresses are accepted (no netblock, no "!"). | |||
1802 | */ | |||
1803 | int | |||
1804 | append_addr(struct pfr_buffer *b, char *s, int test, int opts) | |||
1805 | { | |||
1806 | static int previous = 0; | |||
1807 | static int expect = 0; | |||
1808 | struct pfr_addr *a; | |||
1809 | struct node_host *h, *n; | |||
1810 | char *r; | |||
1811 | const char *errstr; | |||
1812 | int rv, not = 0, i = 0; | |||
1813 | u_int16_t weight; | |||
1814 | ||||
1815 | /* skip weight if given */ | |||
1816 | if (strcmp(s, "weight") == 0) { | |||
| ||||
1817 | expect = 1; | |||
1818 | return (1); /* expecting further call */ | |||
1819 | } | |||
1820 | ||||
1821 | /* check if previous host is set */ | |||
1822 | if (expect
| |||
1823 | /* parse and append load balancing weight */ | |||
1824 | weight = strtonum(s, 1, USHRT_MAX(32767 *2 +1), &errstr); | |||
1825 | if (errstr) { | |||
1826 | fprintf(stderr(&__sF[2]), "failed to convert weight %s\n", s); | |||
1827 | return (-1); | |||
1828 | } | |||
1829 | if (previous != -1) { | |||
1830 | PFRB_FOREACH(a, b)for ((a) = pfr_buf_next((b), ((void *)0)); (a) != ((void *)0) ; (a) = pfr_buf_next((b), (a))) { | |||
1831 | if (++i >= previous) { | |||
1832 | a->pfra_weight = weight; | |||
1833 | a->pfra_type = PFRKE_COST; | |||
1834 | } | |||
1835 | } | |||
1836 | } | |||
1837 | ||||
1838 | expect = 0; | |||
1839 | return (0); | |||
1840 | } | |||
1841 | ||||
1842 | for (r = s; *r == '!'; r++) | |||
1843 | not = !not; | |||
1844 | if ((n = host(r, opts)) == NULL((void *)0)) { | |||
1845 | errno(*__errno()) = 0; | |||
1846 | return (-1); | |||
1847 | } | |||
1848 | rv = append_addr_host(b, n, test, not); | |||
1849 | previous = b->pfrb_size; | |||
1850 | do { | |||
1851 | h = n; | |||
1852 | n = n->next; | |||
1853 | free(h); | |||
1854 | } while (n != NULL((void *)0)); | |||
1855 | return (rv); | |||
1856 | } | |||
1857 | ||||
1858 | /* | |||
1859 | * same as previous function, but with a pre-parsed input and the ability | |||
1860 | * to "negate" the result. Does not free the node_host list. | |||
1861 | * not: | |||
1862 | * setting it to 1 is equivalent to adding "!" in front of parameter s. | |||
1863 | */ | |||
1864 | int | |||
1865 | append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) | |||
1866 | { | |||
1867 | int bits; | |||
1868 | struct pfr_addr addr; | |||
1869 | ||||
1870 | do { | |||
1871 | bzero(&addr, sizeof(addr)); | |||
1872 | addr.pfra_not = n->not ^ not; | |||
1873 | addr.pfra_af = n->af; | |||
1874 | addr.pfra_net = unmask(&n->addr.v.a.mask); | |||
1875 | if (n->ifname) { | |||
1876 | if (strlcpy(addr.pfra_ifname, n->ifname, | |||
1877 | sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) | |||
1878 | errx(1, "append_addr_host: strlcpy"); | |||
1879 | addr.pfra_type = PFRKE_ROUTE; | |||
1880 | } | |||
1881 | if (n->weight > 0) { | |||
1882 | addr.pfra_weight = n->weight; | |||
1883 | addr.pfra_type = PFRKE_COST; | |||
1884 | } | |||
1885 | switch (n->af) { | |||
1886 | case AF_INET2: | |||
1887 | addr.pfra_ip4addrpfra_u._pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32pfa.addr32[0]; | |||
1888 | bits = 32; | |||
1889 | break; | |||
1890 | case AF_INET624: | |||
1891 | memcpy(&addr.pfra_ip6addrpfra_u._pfra_ip6addr, &n->addr.v.a.addr.v6pfa.v6, | |||
1892 | sizeof(struct in6_addr)); | |||
1893 | bits = 128; | |||
1894 | break; | |||
1895 | default: | |||
1896 | errno(*__errno()) = EINVAL22; | |||
1897 | return (-1); | |||
1898 | } | |||
1899 | if ((test && (not || addr.pfra_net != bits)) || | |||
1900 | addr.pfra_net > bits) { | |||
1901 | errno(*__errno()) = EINVAL22; | |||
1902 | return (-1); | |||
1903 | } | |||
1904 | if (pfr_buf_add(b, &addr)) | |||
1905 | return (-1); | |||
1906 | } while ((n = n->next) != NULL((void *)0)); | |||
1907 | ||||
1908 | return (0); | |||
1909 | } | |||
1910 | ||||
1911 | int | |||
1912 | pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) | |||
1913 | { | |||
1914 | struct pfioc_trans_e trans; | |||
1915 | ||||
1916 | bzero(&trans, sizeof(trans)); | |||
1917 | trans.type = type; | |||
1918 | if (strlcpy(trans.anchor, anchor, | |||
1919 | sizeof(trans.anchor)) >= sizeof(trans.anchor)) | |||
1920 | errx(1, "pfctl_add_trans: strlcpy"); | |||
1921 | ||||
1922 | return pfr_buf_add(buf, &trans); | |||
1923 | } | |||
1924 | ||||
1925 | u_int32_t | |||
1926 | pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) | |||
1927 | { | |||
1928 | struct pfioc_trans_e *p; | |||
1929 | ||||
1930 | PFRB_FOREACH(p, buf)for ((p) = pfr_buf_next((buf), ((void *)0)); (p) != ((void *) 0); (p) = pfr_buf_next((buf), (p))) | |||
1931 | if (type == p->type && !strcmp(anchor, p->anchor)) | |||
1932 | return (p->ticket); | |||
1933 | errx(1, "pfctl_get_ticket: assertion failed"); | |||
1934 | } | |||
1935 | ||||
1936 | int | |||
1937 | pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) | |||
1938 | { | |||
1939 | struct pfioc_trans trans; | |||
1940 | ||||
1941 | bzero(&trans, sizeof(trans)); | |||
1942 | trans.size = buf->pfrb_size - from; | |||
1943 | trans.esize = sizeof(struct pfioc_trans_e); | |||
1944 | trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; | |||
1945 | return ioctl(dev, cmd, &trans); | |||
1946 | } |