File: | src/sbin/pfctl/pfctl_parser.c |
Warning: | line 1682, column 7 Potential memory leak |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: pfctl_parser.c,v 1.349 2023/10/26 16:26:01 deraadt Exp $ */ | |||
2 | ||||
3 | /* | |||
4 | * Copyright (c) 2001 Daniel Hartmeier | |||
5 | * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> | |||
6 | * All rights reserved. | |||
7 | * | |||
8 | * Redistribution and use in source and binary forms, with or without | |||
9 | * modification, are permitted provided that the following conditions | |||
10 | * are met: | |||
11 | * | |||
12 | * - Redistributions of source code must retain the above copyright | |||
13 | * notice, this list of conditions and the following disclaimer. | |||
14 | * - Redistributions in binary form must reproduce the above | |||
15 | * copyright notice, this list of conditions and the following | |||
16 | * disclaimer in the documentation and/or other materials provided | |||
17 | * with the distribution. | |||
18 | * | |||
19 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |||
20 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |||
21 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS | |||
22 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | |||
23 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, | |||
24 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, | |||
25 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |||
26 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER | |||
27 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | |||
28 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN | |||
29 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | |||
30 | * POSSIBILITY OF SUCH DAMAGE. | |||
31 | * | |||
32 | */ | |||
33 | ||||
34 | #include <sys/types.h> | |||
35 | #include <sys/ioctl.h> | |||
36 | #include <sys/socket.h> | |||
37 | #include <net/if_dl.h> | |||
38 | #include <net/if.h> | |||
39 | #include <netinet/in.h> | |||
40 | #include <netinet/ip.h> | |||
41 | #include <netinet/ip_icmp.h> | |||
42 | #include <netinet/icmp6.h> | |||
43 | #include <net/pfvar.h> | |||
44 | #include <arpa/inet.h> | |||
45 | ||||
46 | #include <ctype.h> | |||
47 | #include <err.h> | |||
48 | #include <errno(*__errno()).h> | |||
49 | #include <ifaddrs.h> | |||
50 | #include <limits.h> | |||
51 | #include <netdb.h> | |||
52 | #include <stdarg.h> | |||
53 | #include <stdio.h> | |||
54 | #include <stdlib.h> | |||
55 | #include <string.h> | |||
56 | #include <time.h> | |||
57 | #include <unistd.h> | |||
58 | ||||
59 | #define SYSLOG_NAMES | |||
60 | #include <syslog.h> | |||
61 | ||||
62 | #include "pfctl_parser.h" | |||
63 | #include "pfctl.h" | |||
64 | ||||
65 | #ifndef nitems | |||
66 | #define nitems(_a)(sizeof((_a)) / sizeof((_a)[0])) (sizeof((_a)) / sizeof((_a)[0])) | |||
67 | #endif | |||
68 | ||||
69 | void print_op (u_int8_t, const char *, const char *); | |||
70 | void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); | |||
71 | void print_ugid (u_int8_t, id_t, id_t, const char *); | |||
72 | void print_flags (u_int8_t); | |||
73 | void print_fromto(struct pf_rule_addr *, pf_osfp_t, | |||
74 | struct pf_rule_addr *, u_int8_t, u_int8_t, int); | |||
75 | void print_bwspec(const char *index, struct pf_queue_bwspec *); | |||
76 | void print_scspec(const char *, struct pf_queue_scspec *); | |||
77 | int ifa_skip_if(const char *filter, struct node_host *p); | |||
78 | ||||
79 | struct node_host *ifa_grouplookup(const char *, int); | |||
80 | struct node_host *host_if(const char *, int); | |||
81 | struct node_host *host_ip(const char *, int); | |||
82 | struct node_host *host_dns(const char *, int, int); | |||
83 | ||||
84 | const char *tcpflags = "FSRPAUEW"; | |||
85 | ||||
86 | static const struct icmptypeent icmp_type[] = { | |||
87 | { "echoreq", ICMP_ECHO8 }, | |||
88 | { "echorep", ICMP_ECHOREPLY0 }, | |||
89 | { "unreach", ICMP_UNREACH3 }, | |||
90 | { "squench", ICMP_SOURCEQUENCH4 }, | |||
91 | { "redir", ICMP_REDIRECT5 }, | |||
92 | { "althost", ICMP_ALTHOSTADDR6 }, | |||
93 | { "routeradv", ICMP_ROUTERADVERT9 }, | |||
94 | { "routersol", ICMP_ROUTERSOLICIT10 }, | |||
95 | { "timex", ICMP_TIMXCEED11 }, | |||
96 | { "paramprob", ICMP_PARAMPROB12 }, | |||
97 | { "timereq", ICMP_TSTAMP13 }, | |||
98 | { "timerep", ICMP_TSTAMPREPLY14 }, | |||
99 | { "inforeq", ICMP_IREQ15 }, | |||
100 | { "inforep", ICMP_IREQREPLY16 }, | |||
101 | { "maskreq", ICMP_MASKREQ17 }, | |||
102 | { "maskrep", ICMP_MASKREPLY18 }, | |||
103 | { "trace", ICMP_TRACEROUTE30 }, | |||
104 | { "dataconv", ICMP_DATACONVERR31 }, | |||
105 | { "mobredir", ICMP_MOBILE_REDIRECT32 }, | |||
106 | { "ipv6-where", ICMP_IPV6_WHEREAREYOU33 }, | |||
107 | { "ipv6-here", ICMP_IPV6_IAMHERE34 }, | |||
108 | { "mobregreq", ICMP_MOBILE_REGREQUEST35 }, | |||
109 | { "mobregrep", ICMP_MOBILE_REGREPLY36 }, | |||
110 | { "skip", ICMP_SKIP39 }, | |||
111 | { "photuris", ICMP_PHOTURIS40 } | |||
112 | }; | |||
113 | ||||
114 | static const struct icmptypeent icmp6_type[] = { | |||
115 | { "unreach", ICMP6_DST_UNREACH1 }, | |||
116 | { "toobig", ICMP6_PACKET_TOO_BIG2 }, | |||
117 | { "timex", ICMP6_TIME_EXCEEDED3 }, | |||
118 | { "paramprob", ICMP6_PARAM_PROB4 }, | |||
119 | { "echoreq", ICMP6_ECHO_REQUEST128 }, | |||
120 | { "echorep", ICMP6_ECHO_REPLY129 }, | |||
121 | { "groupqry", ICMP6_MEMBERSHIP_QUERY130 }, | |||
122 | { "listqry", MLD_LISTENER_QUERY130 }, | |||
123 | { "grouprep", ICMP6_MEMBERSHIP_REPORT131 }, | |||
124 | { "listenrep", MLD_LISTENER_REPORT131 }, | |||
125 | { "groupterm", ICMP6_MEMBERSHIP_REDUCTION132 }, | |||
126 | { "listendone", MLD_LISTENER_DONE132 }, | |||
127 | { "routersol", ND_ROUTER_SOLICIT133 }, | |||
128 | { "routeradv", ND_ROUTER_ADVERT134 }, | |||
129 | { "neighbrsol", ND_NEIGHBOR_SOLICIT135 }, | |||
130 | { "neighbradv", ND_NEIGHBOR_ADVERT136 }, | |||
131 | { "redir", ND_REDIRECT137 }, | |||
132 | { "routrrenum", ICMP6_ROUTER_RENUMBERING138 }, | |||
133 | { "wrureq", ICMP6_WRUREQUEST139 }, | |||
134 | { "wrurep", ICMP6_WRUREPLY140 }, | |||
135 | { "fqdnreq", ICMP6_FQDN_QUERY139 }, | |||
136 | { "fqdnrep", ICMP6_FQDN_REPLY140 }, | |||
137 | { "niqry", ICMP6_NI_QUERY139 }, | |||
138 | { "nirep", ICMP6_NI_REPLY140 }, | |||
139 | { "mtraceresp", MLD_MTRACE_RESP200 }, | |||
140 | { "mtrace", MLD_MTRACE201 }, | |||
141 | { "listenrepv2", MLDV2_LISTENER_REPORT143 }, | |||
142 | }; | |||
143 | ||||
144 | static const struct icmpcodeent icmp_code[] = { | |||
145 | { "net-unr", ICMP_UNREACH3, ICMP_UNREACH_NET0 }, | |||
146 | { "host-unr", ICMP_UNREACH3, ICMP_UNREACH_HOST1 }, | |||
147 | { "proto-unr", ICMP_UNREACH3, ICMP_UNREACH_PROTOCOL2 }, | |||
148 | { "port-unr", ICMP_UNREACH3, ICMP_UNREACH_PORT3 }, | |||
149 | { "needfrag", ICMP_UNREACH3, ICMP_UNREACH_NEEDFRAG4 }, | |||
150 | { "srcfail", ICMP_UNREACH3, ICMP_UNREACH_SRCFAIL5 }, | |||
151 | { "net-unk", ICMP_UNREACH3, ICMP_UNREACH_NET_UNKNOWN6 }, | |||
152 | { "host-unk", ICMP_UNREACH3, ICMP_UNREACH_HOST_UNKNOWN7 }, | |||
153 | { "isolate", ICMP_UNREACH3, ICMP_UNREACH_ISOLATED8 }, | |||
154 | { "net-prohib", ICMP_UNREACH3, ICMP_UNREACH_NET_PROHIB9 }, | |||
155 | { "host-prohib", ICMP_UNREACH3, ICMP_UNREACH_HOST_PROHIB10 }, | |||
156 | { "net-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSNET11 }, | |||
157 | { "host-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSHOST12 }, | |||
158 | { "filter-prohib", ICMP_UNREACH3, ICMP_UNREACH_FILTER_PROHIB13 }, | |||
159 | { "host-preced", ICMP_UNREACH3, ICMP_UNREACH_HOST_PRECEDENCE14 }, | |||
160 | { "cutoff-preced", ICMP_UNREACH3, ICMP_UNREACH_PRECEDENCE_CUTOFF15 }, | |||
161 | { "redir-net", ICMP_REDIRECT5, ICMP_REDIRECT_NET0 }, | |||
162 | { "redir-host", ICMP_REDIRECT5, ICMP_REDIRECT_HOST1 }, | |||
163 | { "redir-tos-net", ICMP_REDIRECT5, ICMP_REDIRECT_TOSNET2 }, | |||
164 | { "redir-tos-host", ICMP_REDIRECT5, ICMP_REDIRECT_TOSHOST3 }, | |||
165 | { "normal-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NORMAL0 }, | |||
166 | { "common-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NOROUTE_COMMON16 }, | |||
167 | { "transit", ICMP_TIMXCEED11, ICMP_TIMXCEED_INTRANS0 }, | |||
168 | { "reassemb", ICMP_TIMXCEED11, ICMP_TIMXCEED_REASS1 }, | |||
169 | { "badhead", ICMP_PARAMPROB12, ICMP_PARAMPROB_ERRATPTR0 }, | |||
170 | { "optmiss", ICMP_PARAMPROB12, ICMP_PARAMPROB_OPTABSENT1 }, | |||
171 | { "badlen", ICMP_PARAMPROB12, ICMP_PARAMPROB_LENGTH2 }, | |||
172 | { "unknown-ind", ICMP_PHOTURIS40, ICMP_PHOTURIS_UNKNOWN_INDEX1 }, | |||
173 | { "auth-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_AUTH_FAILED2 }, | |||
174 | { "decrypt-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_DECRYPT_FAILED3 } | |||
175 | }; | |||
176 | ||||
177 | static const struct icmpcodeent icmp6_code[] = { | |||
178 | { "admin-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADMIN1 }, | |||
179 | { "noroute-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOROUTE0 }, | |||
180 | { "beyond-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_BEYONDSCOPE2 }, | |||
181 | { "addr-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADDR3 }, | |||
182 | { "port-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOPORT4 }, | |||
183 | { "transit", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_TRANSIT0 }, | |||
184 | { "reassemb", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_REASSEMBLY1 }, | |||
185 | { "badhead", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_HEADER0 }, | |||
186 | { "nxthdr", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_NEXTHEADER1 }, | |||
187 | { "redironlink", ND_REDIRECT137, ND_REDIRECT_ONLINK0 }, | |||
188 | { "redirrouter", ND_REDIRECT137, ND_REDIRECT_ROUTER1 } | |||
189 | }; | |||
190 | ||||
191 | const struct pf_timeout pf_timeouts[] = { | |||
192 | { "tcp.first", PFTM_TCP_FIRST_PACKET }, | |||
193 | { "tcp.opening", PFTM_TCP_OPENING }, | |||
194 | { "tcp.established", PFTM_TCP_ESTABLISHED }, | |||
195 | { "tcp.closing", PFTM_TCP_CLOSING }, | |||
196 | { "tcp.finwait", PFTM_TCP_FIN_WAIT }, | |||
197 | { "tcp.closed", PFTM_TCP_CLOSED }, | |||
198 | { "tcp.tsdiff", PFTM_TS_DIFF }, | |||
199 | { "udp.first", PFTM_UDP_FIRST_PACKET }, | |||
200 | { "udp.single", PFTM_UDP_SINGLE }, | |||
201 | { "udp.multiple", PFTM_UDP_MULTIPLE }, | |||
202 | { "icmp.first", PFTM_ICMP_FIRST_PACKET }, | |||
203 | { "icmp.error", PFTM_ICMP_ERROR_REPLY }, | |||
204 | { "other.first", PFTM_OTHER_FIRST_PACKET }, | |||
205 | { "other.single", PFTM_OTHER_SINGLE }, | |||
206 | { "other.multiple", PFTM_OTHER_MULTIPLE }, | |||
207 | { "frag", PFTM_FRAG }, | |||
208 | { "interval", PFTM_INTERVAL }, | |||
209 | { "adaptive.start", PFTM_ADAPTIVE_START }, | |||
210 | { "adaptive.end", PFTM_ADAPTIVE_END }, | |||
211 | { "src.track", PFTM_SRC_NODE }, | |||
212 | { NULL((void *)0), 0 } | |||
213 | }; | |||
214 | ||||
215 | enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; | |||
216 | ||||
217 | void | |||
218 | copy_satopfaddr(struct pf_addr *pfa, struct sockaddr *sa) | |||
219 | { | |||
220 | if (sa->sa_family == AF_INET624) | |||
221 | pfa->v6pfa.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr; | |||
222 | else if (sa->sa_family == AF_INET2) | |||
223 | pfa->v4pfa.v4 = ((struct sockaddr_in *)sa)->sin_addr; | |||
224 | else | |||
225 | warnx("unhandled af %d", sa->sa_family); | |||
226 | } | |||
227 | ||||
228 | const struct icmptypeent * | |||
229 | geticmptypebynumber(u_int8_t type, sa_family_t af) | |||
230 | { | |||
231 | size_t i; | |||
232 | ||||
233 | if (af != AF_INET624) { | |||
234 | for (i = 0; i < nitems(icmp_type)(sizeof((icmp_type)) / sizeof((icmp_type)[0])); i++) { | |||
235 | if (type == icmp_type[i].type) | |||
236 | return (&icmp_type[i]); | |||
237 | } | |||
238 | } else { | |||
239 | for (i = 0; i < nitems(icmp6_type)(sizeof((icmp6_type)) / sizeof((icmp6_type)[0])); i++) { | |||
240 | if (type == icmp6_type[i].type) | |||
241 | return (&icmp6_type[i]); | |||
242 | } | |||
243 | } | |||
244 | return (NULL((void *)0)); | |||
245 | } | |||
246 | ||||
247 | const struct icmptypeent * | |||
248 | geticmptypebyname(char *w, sa_family_t af) | |||
249 | { | |||
250 | size_t i; | |||
251 | ||||
252 | if (af != AF_INET624) { | |||
253 | for (i = 0; i < nitems(icmp_type)(sizeof((icmp_type)) / sizeof((icmp_type)[0])); i++) { | |||
254 | if (!strcmp(w, icmp_type[i].name)) | |||
255 | return (&icmp_type[i]); | |||
256 | } | |||
257 | } else { | |||
258 | for (i = 0; i < nitems(icmp6_type)(sizeof((icmp6_type)) / sizeof((icmp6_type)[0])); i++) { | |||
259 | if (!strcmp(w, icmp6_type[i].name)) | |||
260 | return (&icmp6_type[i]); | |||
261 | } | |||
262 | } | |||
263 | return (NULL((void *)0)); | |||
264 | } | |||
265 | ||||
266 | const struct icmpcodeent * | |||
267 | geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) | |||
268 | { | |||
269 | size_t i; | |||
270 | ||||
271 | if (af != AF_INET624) { | |||
272 | for (i = 0; i < nitems(icmp_code)(sizeof((icmp_code)) / sizeof((icmp_code)[0])); i++) { | |||
273 | if (type == icmp_code[i].type && | |||
274 | code == icmp_code[i].code) | |||
275 | return (&icmp_code[i]); | |||
276 | } | |||
277 | } else { | |||
278 | for (i = 0; i < nitems(icmp6_code)(sizeof((icmp6_code)) / sizeof((icmp6_code)[0])); i++) { | |||
279 | if (type == icmp6_code[i].type && | |||
280 | code == icmp6_code[i].code) | |||
281 | return (&icmp6_code[i]); | |||
282 | } | |||
283 | } | |||
284 | return (NULL((void *)0)); | |||
285 | } | |||
286 | ||||
287 | const struct icmpcodeent * | |||
288 | geticmpcodebyname(u_long type, char *w, sa_family_t af) | |||
289 | { | |||
290 | size_t i; | |||
291 | ||||
292 | if (af != AF_INET624) { | |||
293 | for (i = 0; i < nitems(icmp_code)(sizeof((icmp_code)) / sizeof((icmp_code)[0])); i++) { | |||
294 | if (type == icmp_code[i].type && | |||
295 | !strcmp(w, icmp_code[i].name)) | |||
296 | return (&icmp_code[i]); | |||
297 | } | |||
298 | } else { | |||
299 | for (i = 0; i < nitems(icmp6_code)(sizeof((icmp6_code)) / sizeof((icmp6_code)[0])); i++) { | |||
300 | if (type == icmp6_code[i].type && | |||
301 | !strcmp(w, icmp6_code[i].name)) | |||
302 | return (&icmp6_code[i]); | |||
303 | } | |||
304 | } | |||
305 | return (NULL((void *)0)); | |||
306 | } | |||
307 | ||||
308 | /* | |||
309 | * Decode a symbolic name to a numeric value. | |||
310 | * From syslogd. | |||
311 | */ | |||
312 | int | |||
313 | string_to_loglevel(const char *name) | |||
314 | { | |||
315 | CODE *c; | |||
316 | char *p, buf[40]; | |||
317 | ||||
318 | if (isdigit((unsigned char)*name)) { | |||
319 | const char *errstr; | |||
320 | int val; | |||
321 | ||||
322 | val = strtonum(name, 0, LOG_DEBUG7, &errstr); | |||
323 | if (errstr) | |||
324 | return -1; | |||
325 | return val; | |||
326 | } | |||
327 | ||||
328 | for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { | |||
329 | if (isupper((unsigned char)*name)) | |||
330 | *p = tolower((unsigned char)*name); | |||
331 | else | |||
332 | *p = *name; | |||
333 | } | |||
334 | *p = '\0'; | |||
335 | for (c = prioritynames; c->c_name; c++) | |||
336 | if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI0x10) | |||
337 | return (c->c_val); | |||
338 | ||||
339 | return (-1); | |||
340 | } | |||
341 | ||||
342 | const char * | |||
343 | loglevel_to_string(int level) | |||
344 | { | |||
345 | CODE *c; | |||
346 | ||||
347 | for (c = prioritynames; c->c_name; c++) | |||
348 | if (c->c_val == level) | |||
349 | return (c->c_name); | |||
350 | ||||
351 | return ("unknown"); | |||
352 | } | |||
353 | ||||
354 | void | |||
355 | print_op(u_int8_t op, const char *a1, const char *a2) | |||
356 | { | |||
357 | if (op == PF_OP_IRG) | |||
358 | printf(" %s >< %s", a1, a2); | |||
359 | else if (op == PF_OP_XRG) | |||
360 | printf(" %s <> %s", a1, a2); | |||
361 | else if (op == PF_OP_EQ) | |||
362 | printf(" = %s", a1); | |||
363 | else if (op == PF_OP_NE) | |||
364 | printf(" != %s", a1); | |||
365 | else if (op == PF_OP_LT) | |||
366 | printf(" < %s", a1); | |||
367 | else if (op == PF_OP_LE) | |||
368 | printf(" <= %s", a1); | |||
369 | else if (op == PF_OP_GT) | |||
370 | printf(" > %s", a1); | |||
371 | else if (op == PF_OP_GE) | |||
372 | printf(" >= %s", a1); | |||
373 | else if (op == PF_OP_RRG) | |||
374 | printf(" %s:%s", a1, a2); | |||
375 | } | |||
376 | ||||
377 | void | |||
378 | print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) | |||
379 | { | |||
380 | char a1[6], a2[6]; | |||
381 | struct servent *s = NULL((void *)0); | |||
382 | ||||
383 | if (opts & PF_OPT_PORTNAMES0x08000) | |||
384 | s = getservbyport(p1, proto); | |||
385 | p1 = ntohs(p1)(__uint16_t)(__builtin_constant_p(p1) ? (__uint16_t)(((__uint16_t )(p1) & 0xffU) << 8 | ((__uint16_t)(p1) & 0xff00U ) >> 8) : __swap16md(p1)); | |||
386 | p2 = ntohs(p2)(__uint16_t)(__builtin_constant_p(p2) ? (__uint16_t)(((__uint16_t )(p2) & 0xffU) << 8 | ((__uint16_t)(p2) & 0xff00U ) >> 8) : __swap16md(p2)); | |||
387 | snprintf(a1, sizeof(a1), "%u", p1); | |||
388 | snprintf(a2, sizeof(a2), "%u", p2); | |||
389 | printf(" port"); | |||
390 | if (s != NULL((void *)0) && (op == PF_OP_EQ || op == PF_OP_NE)) | |||
391 | print_op(op, s->s_name, a2); | |||
392 | else | |||
393 | print_op(op, a1, a2); | |||
394 | } | |||
395 | ||||
396 | void | |||
397 | print_ugid(u_int8_t op, id_t i1, id_t i2, const char *t) | |||
398 | { | |||
399 | char a1[11], a2[11]; | |||
400 | ||||
401 | snprintf(a1, sizeof(a1), "%u", i1); | |||
402 | snprintf(a2, sizeof(a2), "%u", i2); | |||
403 | printf(" %s", t); | |||
404 | if (i1 == -1 && (op == PF_OP_EQ || op == PF_OP_NE)) | |||
405 | print_op(op, "unknown", a2); | |||
406 | else | |||
407 | print_op(op, a1, a2); | |||
408 | } | |||
409 | ||||
410 | void | |||
411 | print_flags(u_int8_t f) | |||
412 | { | |||
413 | int i; | |||
414 | ||||
415 | for (i = 0; tcpflags[i]; ++i) | |||
416 | if (f & (1 << i)) | |||
417 | printf("%c", tcpflags[i]); | |||
418 | } | |||
419 | ||||
420 | void | |||
421 | print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, | |||
422 | sa_family_t af, u_int8_t proto, int opts) | |||
423 | { | |||
424 | char buf[PF_OSFP_LEN32*3]; | |||
425 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); | |||
426 | if (src->addr.type == PF_ADDR_ADDRMASK && | |||
427 | dst->addr.type == PF_ADDR_ADDRMASK && | |||
428 | PF_AZERO(&src->addr.v.a.addr, AF_INET6)((24 == 2 && !(&src->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.addr)-> pfa.addr32[0] && !(&src->addr.v.a.addr)->pfa .addr32[1] && !(&src->addr.v.a.addr)->pfa.addr32 [2] && !(&src->addr.v.a.addr)->pfa.addr32[3 ] )) && | |||
429 | PF_AZERO(&src->addr.v.a.mask, AF_INET6)((24 == 2 && !(&src->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.mask)-> pfa.addr32[0] && !(&src->addr.v.a.mask)->pfa .addr32[1] && !(&src->addr.v.a.mask)->pfa.addr32 [2] && !(&src->addr.v.a.mask)->pfa.addr32[3 ] )) && | |||
430 | PF_AZERO(&dst->addr.v.a.addr, AF_INET6)((24 == 2 && !(&dst->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.addr)-> pfa.addr32[0] && !(&dst->addr.v.a.addr)->pfa .addr32[1] && !(&dst->addr.v.a.addr)->pfa.addr32 [2] && !(&dst->addr.v.a.addr)->pfa.addr32[3 ] )) && | |||
431 | PF_AZERO(&dst->addr.v.a.mask, AF_INET6)((24 == 2 && !(&dst->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.mask)-> pfa.addr32[0] && !(&dst->addr.v.a.mask)->pfa .addr32[1] && !(&dst->addr.v.a.mask)->pfa.addr32 [2] && !(&dst->addr.v.a.mask)->pfa.addr32[3 ] )) && | |||
432 | !src->neg && !dst->neg && | |||
433 | !src->port_op && !dst->port_op && | |||
434 | osfp == PF_OSFP_ANY((pf_osfp_t)0)) | |||
435 | printf(" all"); | |||
436 | else { | |||
437 | printf(" from "); | |||
438 | if (src->neg) | |||
439 | printf("! "); | |||
440 | print_addr(&src->addr, af, verbose); | |||
441 | if (src->port_op) | |||
442 | print_port(src->port_op, src->port[0], | |||
443 | src->port[1], | |||
444 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); | |||
445 | if (osfp != PF_OSFP_ANY((pf_osfp_t)0)) | |||
446 | printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, | |||
447 | sizeof(buf))); | |||
448 | ||||
449 | printf(" to "); | |||
450 | if (dst->neg) | |||
451 | printf("! "); | |||
452 | print_addr(&dst->addr, af, verbose); | |||
453 | if (dst->port_op) | |||
454 | print_port(dst->port_op, dst->port[0], | |||
455 | dst->port[1], | |||
456 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); | |||
457 | } | |||
458 | } | |||
459 | ||||
460 | void | |||
461 | print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, | |||
462 | sa_family_t af, int id, int verbose) | |||
463 | { | |||
464 | if (pool->ifname[0]) { | |||
465 | if (!PF_AZERO(&pool->addr.v.a.addr, af)((af == 2 && !(&pool->addr.v.a.addr)->pfa.addr32 [0]) || (af == 24 && !(&pool->addr.v.a.addr)-> pfa.addr32[0] && !(&pool->addr.v.a.addr)->pfa .addr32[1] && !(&pool->addr.v.a.addr)->pfa. addr32[2] && !(&pool->addr.v.a.addr)->pfa.addr32 [3] ))) { | |||
466 | print_addr(&pool->addr, af, verbose); | |||
467 | printf("@"); | |||
468 | } | |||
469 | printf("%s", pool->ifname); | |||
470 | } else | |||
471 | print_addr(&pool->addr, af, verbose); | |||
472 | switch (id) { | |||
473 | case PF_POOL_NAT: | |||
474 | if ((p1 != PF_NAT_PROXY_PORT_LOW50001 || | |||
475 | p2 != PF_NAT_PROXY_PORT_HIGH65535) && (p1 != 0 || p2 != 0)) { | |||
476 | if (p1 == p2) | |||
477 | printf(" port %u", p1); | |||
478 | else | |||
479 | printf(" port %u:%u", p1, p2); | |||
480 | } | |||
481 | break; | |||
482 | case PF_POOL_RDR: | |||
483 | if (p1) { | |||
484 | printf(" port %u", p1); | |||
485 | if (p2 && (p2 != p1)) | |||
486 | printf(":%u", p2); | |||
487 | } | |||
488 | break; | |||
489 | default: | |||
490 | break; | |||
491 | } | |||
492 | switch (pool->opts & PF_POOL_TYPEMASK0x0f) { | |||
493 | case PF_POOL_NONE: | |||
494 | break; | |||
495 | case PF_POOL_BITMASK: | |||
496 | printf(" bitmask"); | |||
497 | break; | |||
498 | case PF_POOL_RANDOM: | |||
499 | printf(" random"); | |||
500 | break; | |||
501 | case PF_POOL_SRCHASH: | |||
502 | printf(" source-hash 0x%08x%08x%08x%08x", | |||
503 | pool->key.key32pfk.key32[0], pool->key.key32pfk.key32[1], | |||
504 | pool->key.key32pfk.key32[2], pool->key.key32pfk.key32[3]); | |||
505 | break; | |||
506 | case PF_POOL_ROUNDROBIN: | |||
507 | printf(" round-robin"); | |||
508 | break; | |||
509 | case PF_POOL_LEASTSTATES: | |||
510 | printf(" least-states"); | |||
511 | break; | |||
512 | } | |||
513 | if (pool->opts & PF_POOL_STICKYADDR0x20) | |||
514 | printf(" sticky-address"); | |||
515 | if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) | |||
516 | printf(" static-port"); | |||
517 | } | |||
518 | ||||
519 | const char *pf_reasons[PFRES_MAX17+1] = PFRES_NAMES{ "match", "bad-offset", "fragment", "short", "normalize", "memory" , "bad-timestamp", "congestion", "ip-option", "proto-cksum", "state-mismatch" , "state-insert", "state-limit", "src-limit", "synproxy", "translate" , "no-route", ((void *)0) }; | |||
520 | const char *pf_lcounters[LCNT_MAX10+1] = LCNT_NAMES{ "max states per rule", "max-src-states", "max-src-nodes", "max-src-conn" , "max-src-conn-rate", "overload table insertion", "overload flush states" , "synfloods detected", "syncookies sent", "syncookies validated" , ((void *)0) }; | |||
521 | const char *pf_fcounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; | |||
522 | const char *pf_scounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; | |||
523 | ||||
524 | void | |||
525 | print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts) | |||
526 | { | |||
527 | char statline[80], *running, *debug; | |||
528 | time_t runtime = 0; | |||
529 | struct timespec uptime; | |||
530 | int i; | |||
531 | char buf[PF_MD5_DIGEST_LENGTH16 * 2 + 1]; | |||
532 | static const char hex[] = "0123456789abcdef"; | |||
533 | ||||
534 | if (!clock_gettime(CLOCK_BOOTTIME6, &uptime)) | |||
535 | runtime = uptime.tv_sec - s->since; | |||
536 | running = s->running ? "Enabled" : "Disabled"; | |||
537 | ||||
538 | if (runtime) { | |||
539 | unsigned int sec, min, hrs; | |||
540 | time_t day = runtime; | |||
541 | ||||
542 | sec = day % 60; | |||
543 | day /= 60; | |||
544 | min = day % 60; | |||
545 | day /= 60; | |||
546 | hrs = day % 24; | |||
547 | day /= 24; | |||
548 | snprintf(statline, sizeof(statline), | |||
549 | "Status: %s for %lld days %.2u:%.2u:%.2u", | |||
550 | running, (long long)day, hrs, min, sec); | |||
551 | } else | |||
552 | snprintf(statline, sizeof(statline), "Status: %s", running); | |||
553 | printf("%-44s", statline); | |||
554 | if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) { | |||
555 | printf("%15s\n\n", debug); | |||
556 | free(debug); | |||
557 | } | |||
558 | ||||
559 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
560 | printf("Hostid: 0x%08x\n", ntohl(s->hostid)(__uint32_t)(__builtin_constant_p(s->hostid) ? (__uint32_t )(((__uint32_t)(s->hostid) & 0xff) << 24 | ((__uint32_t )(s->hostid) & 0xff00) << 8 | ((__uint32_t)(s-> hostid) & 0xff0000) >> 8 | ((__uint32_t)(s->hostid ) & 0xff000000) >> 24) : __swap32md(s->hostid))); | |||
561 | ||||
562 | for (i = 0; i < PF_MD5_DIGEST_LENGTH16; i++) { | |||
563 | buf[i + i] = hex[s->pf_chksum[i] >> 4]; | |||
564 | buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; | |||
565 | } | |||
566 | buf[i + i] = '\0'; | |||
567 | printf("Checksum: 0x%s\n\n", buf); | |||
568 | } | |||
569 | ||||
570 | if (s->ifname[0] != 0) { | |||
571 | printf("Interface Stats for %-16s %5s %16s\n", | |||
572 | s->ifname, "IPv4", "IPv6"); | |||
573 | printf(" %-25s %14llu %16llu\n", "Bytes In", | |||
574 | (unsigned long long)s->bcounters[0][0], | |||
575 | (unsigned long long)s->bcounters[1][0]); | |||
576 | printf(" %-25s %14llu %16llu\n", "Bytes Out", | |||
577 | (unsigned long long)s->bcounters[0][1], | |||
578 | (unsigned long long)s->bcounters[1][1]); | |||
579 | printf(" Packets In\n"); | |||
580 | printf(" %-23s %14llu %16llu\n", "Passed", | |||
581 | (unsigned long long)s->pcounters[0][0][PF_PASS], | |||
582 | (unsigned long long)s->pcounters[1][0][PF_PASS]); | |||
583 | printf(" %-23s %14llu %16llu\n", "Blocked", | |||
584 | (unsigned long long)s->pcounters[0][0][PF_DROP], | |||
585 | (unsigned long long)s->pcounters[1][0][PF_DROP]); | |||
586 | printf(" Packets Out\n"); | |||
587 | printf(" %-23s %14llu %16llu\n", "Passed", | |||
588 | (unsigned long long)s->pcounters[0][1][PF_PASS], | |||
589 | (unsigned long long)s->pcounters[1][1][PF_PASS]); | |||
590 | printf(" %-23s %14llu %16llu\n\n", "Blocked", | |||
591 | (unsigned long long)s->pcounters[0][1][PF_DROP], | |||
592 | (unsigned long long)s->pcounters[1][1][PF_DROP]); | |||
593 | } | |||
594 | printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); | |||
595 | printf(" %-25s %14u %14s\n", "current entries", s->states, ""); | |||
596 | printf(" %-25s %14u %14s\n", "half-open tcp", s->states_halfopen, ""); | |||
597 | for (i = 0; i < FCNT_MAX3; i++) { | |||
598 | printf(" %-25s %14llu ", pf_fcounters[i], | |||
599 | (unsigned long long)s->fcounters[i]); | |||
600 | if (runtime > 0) | |||
601 | printf("%14.1f/s\n", | |||
602 | (double)s->fcounters[i] / (double)runtime); | |||
603 | else | |||
604 | printf("%14s\n", ""); | |||
605 | } | |||
606 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
607 | printf("Source Tracking Table\n"); | |||
608 | printf(" %-25s %14u %14s\n", "current entries", | |||
609 | s->src_nodes, ""); | |||
610 | for (i = 0; i < SCNT_MAX3; i++) { | |||
611 | printf(" %-25s %14lld ", pf_scounters[i], | |||
612 | s->scounters[i]); | |||
613 | if (runtime > 0) | |||
614 | printf("%14.1f/s\n", | |||
615 | (double)s->scounters[i] / (double)runtime); | |||
616 | else | |||
617 | printf("%14s\n", ""); | |||
618 | } | |||
619 | } | |||
620 | printf("Counters\n"); | |||
621 | for (i = 0; i < PFRES_MAX17; i++) { | |||
622 | printf(" %-25s %14llu ", pf_reasons[i], | |||
623 | (unsigned long long)s->counters[i]); | |||
624 | if (runtime > 0) | |||
625 | printf("%14.1f/s\n", | |||
626 | (double)s->counters[i] / (double)runtime); | |||
627 | else | |||
628 | printf("%14s\n", ""); | |||
629 | } | |||
630 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
631 | printf("Limit Counters\n"); | |||
632 | for (i = 0; i < LCNT_MAX10; i++) { | |||
633 | printf(" %-25s %14lld ", pf_lcounters[i], | |||
634 | s->lcounters[i]); | |||
635 | if (runtime > 0) | |||
636 | printf("%14.1f/s\n", | |||
637 | (double)s->lcounters[i] / (double)runtime); | |||
638 | else | |||
639 | printf("%14s\n", ""); | |||
640 | } | |||
641 | } | |||
642 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
643 | printf("Adaptive Syncookies Watermarks\n"); | |||
644 | printf(" %-25s %14d states\n", "start", synflwats->hi); | |||
645 | printf(" %-25s %14d states\n", "end", synflwats->lo); | |||
646 | } | |||
647 | } | |||
648 | ||||
649 | void | |||
650 | print_src_node(struct pf_src_node *sn, int opts) | |||
651 | { | |||
652 | struct pf_addr_wrap aw; | |||
653 | int min, sec; | |||
654 | ||||
655 | memset(&aw, 0, sizeof(aw)); | |||
656 | if (sn->af == AF_INET2) | |||
657 | aw.v.a.mask.addr32pfa.addr32[0] = 0xffffffff; | |||
658 | else | |||
659 | memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); | |||
660 | ||||
661 | aw.v.a.addr = sn->addr; | |||
662 | print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE20x00080); | |||
663 | ||||
664 | if (!PF_AZERO(&sn->raddr, sn->af)((sn->af == 2 && !(&sn->raddr)->pfa.addr32 [0]) || (sn->af == 24 && !(&sn->raddr)-> pfa.addr32[0] && !(&sn->raddr)->pfa.addr32[ 1] && !(&sn->raddr)->pfa.addr32[2] && !(&sn->raddr)->pfa.addr32[3] ))) { | |||
665 | if (sn->type == PF_SN_NAT) | |||
666 | printf(" nat-to "); | |||
667 | else if (sn->type == PF_SN_RDR) | |||
668 | printf(" rdr-to "); | |||
669 | else if (sn->type == PF_SN_ROUTE) | |||
670 | printf(" route-to "); | |||
671 | else | |||
672 | printf(" ??? (%u) ", sn->type); | |||
673 | aw.v.a.addr = sn->raddr; | |||
674 | print_addr(&aw, sn->naf ? sn->naf : sn->af, | |||
675 | opts & PF_OPT_VERBOSE20x00080); | |||
676 | } | |||
677 | ||||
678 | printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, | |||
679 | sn->conn, sn->conn_rate.count / 1000, | |||
680 | (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); | |||
681 | if (opts & PF_OPT_VERBOSE0x00004) { | |||
682 | sec = sn->creation % 60; | |||
683 | sn->creation /= 60; | |||
684 | min = sn->creation % 60; | |||
685 | sn->creation /= 60; | |||
686 | printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); | |||
687 | if (sn->states == 0) { | |||
688 | sec = sn->expire % 60; | |||
689 | sn->expire /= 60; | |||
690 | min = sn->expire % 60; | |||
691 | sn->expire /= 60; | |||
692 | printf(", expires in %.2u:%.2u:%.2u", | |||
693 | sn->expire, min, sec); | |||
694 | } | |||
695 | printf(", %llu pkts, %llu bytes", | |||
696 | sn->packets[0] + sn->packets[1], | |||
697 | sn->bytes[0] + sn->bytes[1]); | |||
698 | if (sn->rule.nr != -1) | |||
699 | printf(", rule %u", sn->rule.nr); | |||
700 | printf("\n"); | |||
701 | } | |||
702 | } | |||
703 | ||||
704 | void | |||
705 | print_rule(struct pf_rule *r, const char *anchor_call, int opts) | |||
706 | { | |||
707 | static const char *actiontypes[] = { "pass", "block", "scrub", | |||
708 | "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", | |||
709 | "", "", "match"}; | |||
710 | static const char *anchortypes[] = { "anchor", "anchor", "anchor", | |||
711 | "anchor", "nat-anchor", "nat-anchor", "binat-anchor", | |||
712 | "binat-anchor", "rdr-anchor", "rdr-anchor" }; | |||
713 | int i, ropts; | |||
714 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); | |||
715 | char *p; | |||
716 | ||||
717 | if ((r->rule_flag & PFRULE_EXPIRED0x00400000) && (!verbose)) | |||
718 | return; | |||
719 | ||||
720 | if (verbose) | |||
721 | printf("@%d ", r->nr); | |||
722 | ||||
723 | if (r->action > PF_MATCH) | |||
724 | printf("action(%d)", r->action); | |||
725 | else if (anchor_call[0]) { | |||
726 | p = strrchr(anchor_call, '/'); | |||
727 | if (p ? p[1] == '_' : anchor_call[0] == '_') | |||
728 | printf("%s", anchortypes[r->action]); | |||
729 | else | |||
730 | printf("%s \"%s\"", anchortypes[r->action], | |||
731 | anchor_call); | |||
732 | } else | |||
733 | printf("%s", actiontypes[r->action]); | |||
734 | if (r->action == PF_DROP) { | |||
735 | if (r->rule_flag & PFRULE_RETURN0x0008) | |||
736 | printf(" return"); | |||
737 | else if (r->rule_flag & PFRULE_RETURNRST0x0001) { | |||
738 | if (!r->return_ttl) | |||
739 | printf(" return-rst"); | |||
740 | else | |||
741 | printf(" return-rst(ttl %d)", r->return_ttl); | |||
742 | } else if (r->rule_flag & PFRULE_RETURNICMP0x0004) { | |||
743 | const struct icmpcodeent *ic, *ic6; | |||
744 | ||||
745 | ic = geticmpcodebynumber(r->return_icmp >> 8, | |||
746 | r->return_icmp & 255, AF_INET2); | |||
747 | ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, | |||
748 | r->return_icmp6 & 255, AF_INET624); | |||
749 | ||||
750 | switch (r->af) { | |||
751 | case AF_INET2: | |||
752 | printf(" return-icmp"); | |||
753 | if (ic == NULL((void *)0)) | |||
754 | printf("(%u)", r->return_icmp & 255); | |||
755 | else | |||
756 | printf("(%s)", ic->name); | |||
757 | break; | |||
758 | case AF_INET624: | |||
759 | printf(" return-icmp6"); | |||
760 | if (ic6 == NULL((void *)0)) | |||
761 | printf("(%u)", r->return_icmp6 & 255); | |||
762 | else | |||
763 | printf("(%s)", ic6->name); | |||
764 | break; | |||
765 | default: | |||
766 | printf(" return-icmp"); | |||
767 | if (ic == NULL((void *)0)) | |||
768 | printf("(%u, ", r->return_icmp & 255); | |||
769 | else | |||
770 | printf("(%s, ", ic->name); | |||
771 | if (ic6 == NULL((void *)0)) | |||
772 | printf("%u)", r->return_icmp6 & 255); | |||
773 | else | |||
774 | printf("%s)", ic6->name); | |||
775 | break; | |||
776 | } | |||
777 | } else | |||
778 | printf(" drop"); | |||
779 | } | |||
780 | if (r->direction == PF_IN) | |||
781 | printf(" in"); | |||
782 | else if (r->direction == PF_OUT) | |||
783 | printf(" out"); | |||
784 | if (r->log) { | |||
785 | printf(" log"); | |||
786 | if (r->log & ~PF_LOG0x01 || r->logif) { | |||
787 | int count = 0; | |||
788 | ||||
789 | printf(" ("); | |||
790 | if (r->log & PF_LOG_ALL0x02) | |||
791 | printf("%sall", count++ ? ", " : ""); | |||
792 | if (r->log & PF_LOG_MATCHES0x10) | |||
793 | printf("%smatches", count++ ? ", " : ""); | |||
794 | if (r->log & PF_LOG_USER0x04) | |||
795 | printf("%suser", count++ ? ", " : ""); | |||
796 | if (r->logif) | |||
797 | printf("%sto pflog%u", count++ ? ", " : "", | |||
798 | r->logif); | |||
799 | printf(")"); | |||
800 | } | |||
801 | } | |||
802 | if (r->quick) | |||
803 | printf(" quick"); | |||
804 | if (r->ifname[0]) { | |||
805 | if (r->ifnot) | |||
806 | printf(" on ! %s", r->ifname); | |||
807 | else | |||
808 | printf(" on %s", r->ifname); | |||
809 | } | |||
810 | if (r->onrdomain >= 0) { | |||
811 | if (r->ifnot) | |||
812 | printf(" on ! rdomain %d", r->onrdomain); | |||
813 | else | |||
814 | printf(" on rdomain %d", r->onrdomain); | |||
815 | } | |||
816 | if (r->af) { | |||
817 | if (r->af == AF_INET2) | |||
818 | printf(" inet"); | |||
819 | else | |||
820 | printf(" inet6"); | |||
821 | } | |||
822 | if (r->proto) { | |||
823 | struct protoent *p; | |||
824 | ||||
825 | if ((p = getprotobynumber(r->proto)) != NULL((void *)0)) | |||
826 | printf(" proto %s", p->p_name); | |||
827 | else | |||
828 | printf(" proto %u", r->proto); | |||
829 | } | |||
830 | print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, | |||
831 | opts); | |||
832 | if (r->rcv_ifname[0]) | |||
833 | printf(" %sreceived-on %s", r->rcvifnot ? "!" : "", | |||
834 | r->rcv_ifname); | |||
835 | if (r->uid.op) | |||
836 | print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user"); | |||
837 | if (r->gid.op) | |||
838 | print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group"); | |||
839 | if (r->flags || r->flagset) { | |||
840 | printf(" flags "); | |||
841 | print_flags(r->flags); | |||
842 | printf("/"); | |||
843 | print_flags(r->flagset); | |||
844 | } else if ((r->action == PF_PASS || r->action == PF_MATCH) && | |||
845 | (!r->proto || r->proto == IPPROTO_TCP6) && | |||
846 | !(r->rule_flag & PFRULE_FRAGMENT0x0002) && | |||
847 | !anchor_call[0] && r->keep_state) | |||
848 | printf(" flags any"); | |||
849 | if (r->type) { | |||
850 | const struct icmptypeent *it; | |||
851 | ||||
852 | it = geticmptypebynumber(r->type-1, r->af); | |||
853 | if (r->af != AF_INET624) | |||
854 | printf(" icmp-type"); | |||
855 | else | |||
856 | printf(" icmp6-type"); | |||
857 | if (it != NULL((void *)0)) | |||
858 | printf(" %s", it->name); | |||
859 | else | |||
860 | printf(" %u", r->type-1); | |||
861 | if (r->code) { | |||
862 | const struct icmpcodeent *ic; | |||
863 | ||||
864 | ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); | |||
865 | if (ic != NULL((void *)0)) | |||
866 | printf(" code %s", ic->name); | |||
867 | else | |||
868 | printf(" code %u", r->code-1); | |||
869 | } | |||
870 | } | |||
871 | if (r->tos) | |||
872 | printf(" tos 0x%2.2x", r->tos); | |||
873 | if (r->prio) | |||
874 | printf(" prio %u", r->prio == PF_PRIO_ZERO0xff ? 0 : r->prio); | |||
875 | if (r->pktrate.limit) | |||
876 | printf(" max-pkt-rate %u/%u", r->pktrate.limit, | |||
877 | r->pktrate.seconds); | |||
878 | ||||
879 | if (r->scrub_flags & PFSTATE_SETMASK(0x0040|0x0200) || r->qname[0] || | |||
880 | r->rule_flag & PFRULE_SETDELAY0x0080) { | |||
881 | char *comma = ""; | |||
882 | printf(" set ("); | |||
883 | if (r->scrub_flags & PFSTATE_SETPRIO0x0200) { | |||
884 | if (r->set_prio[0] == r->set_prio[1]) | |||
885 | printf("%sprio %u", comma, r->set_prio[0]); | |||
886 | else | |||
887 | printf("%sprio(%u, %u)", comma, r->set_prio[0], | |||
888 | r->set_prio[1]); | |||
889 | comma = ", "; | |||
890 | } | |||
891 | if (r->qname[0]) { | |||
892 | if (r->pqname[0]) | |||
893 | printf("%squeue(%s, %s)", comma, r->qname, | |||
894 | r->pqname); | |||
895 | else | |||
896 | printf("%squeue %s", comma, r->qname); | |||
897 | comma = ", "; | |||
898 | } | |||
899 | if (r->scrub_flags & PFSTATE_SETTOS0x0040) { | |||
900 | printf("%stos 0x%2.2x", comma, r->set_tos); | |||
901 | comma = ", "; | |||
902 | } | |||
903 | if (r->rule_flag & PFRULE_SETDELAY0x0080) { | |||
904 | printf("%sdelay %u", comma, r->delay); | |||
905 | comma = ", "; | |||
906 | } | |||
907 | printf(")"); | |||
908 | } | |||
909 | ||||
910 | ropts = 0; | |||
911 | if (r->max_states || r->max_src_nodes || r->max_src_states) | |||
912 | ropts = 1; | |||
913 | if (r->rule_flag & PFRULE_NOSYNC0x0010) | |||
914 | ropts = 1; | |||
915 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) | |||
916 | ropts = 1; | |||
917 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) | |||
918 | ropts = 1; | |||
919 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) | |||
920 | ropts = 1; | |||
921 | if (r->rule_flag & PFRULE_PFLOW0x00040000) | |||
922 | ropts = 1; | |||
923 | for (i = 0; !ropts && i < PFTM_MAX; ++i) | |||
924 | if (r->timeout[i]) | |||
925 | ropts = 1; | |||
926 | ||||
927 | if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) | |||
928 | printf(" no state"); | |||
929 | else if (r->keep_state == PF_STATE_NORMAL0x1 && ropts) | |||
930 | printf(" keep state"); | |||
931 | else if (r->keep_state == PF_STATE_MODULATE0x2) | |||
932 | printf(" modulate state"); | |||
933 | else if (r->keep_state == PF_STATE_SYNPROXY0x3) | |||
934 | printf(" synproxy state"); | |||
935 | if (r->prob) { | |||
936 | char buf[20]; | |||
937 | ||||
938 | snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX0xffffffffU+1.0)); | |||
939 | for (i = strlen(buf)-1; i > 0; i--) { | |||
940 | if (buf[i] == '0') | |||
941 | buf[i] = '\0'; | |||
942 | else { | |||
943 | if (buf[i] == '.') | |||
944 | buf[i] = '\0'; | |||
945 | break; | |||
946 | } | |||
947 | } | |||
948 | printf(" probability %s%%", buf); | |||
949 | } | |||
950 | if (ropts) { | |||
951 | printf(" ("); | |||
952 | if (r->max_states) { | |||
953 | printf("max %u", r->max_states); | |||
954 | ropts = 0; | |||
955 | } | |||
956 | if (r->rule_flag & PFRULE_NOSYNC0x0010) { | |||
957 | if (!ropts) | |||
958 | printf(", "); | |||
959 | printf("no-sync"); | |||
960 | ropts = 0; | |||
961 | } | |||
962 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) { | |||
963 | if (!ropts) | |||
964 | printf(", "); | |||
965 | printf("source-track"); | |||
966 | if (r->rule_flag & PFRULE_RULESRCTRACK0x0040) | |||
967 | printf(" rule"); | |||
968 | else | |||
969 | printf(" global"); | |||
970 | ropts = 0; | |||
971 | } | |||
972 | if (r->max_src_states) { | |||
973 | if (!ropts) | |||
974 | printf(", "); | |||
975 | printf("max-src-states %u", r->max_src_states); | |||
976 | ropts = 0; | |||
977 | } | |||
978 | if (r->max_src_conn) { | |||
979 | if (!ropts) | |||
980 | printf(", "); | |||
981 | printf("max-src-conn %u", r->max_src_conn); | |||
982 | ropts = 0; | |||
983 | } | |||
984 | if (r->max_src_conn_rate.limit) { | |||
985 | if (!ropts) | |||
986 | printf(", "); | |||
987 | printf("max-src-conn-rate %u/%u", | |||
988 | r->max_src_conn_rate.limit, | |||
989 | r->max_src_conn_rate.seconds); | |||
990 | ropts = 0; | |||
991 | } | |||
992 | if (r->max_src_nodes) { | |||
993 | if (!ropts) | |||
994 | printf(", "); | |||
995 | printf("max-src-nodes %u", r->max_src_nodes); | |||
996 | ropts = 0; | |||
997 | } | |||
998 | if (r->overload_tblname[0]) { | |||
999 | if (!ropts) | |||
1000 | printf(", "); | |||
1001 | printf("overload <%s>", r->overload_tblname); | |||
1002 | if (r->flush) | |||
1003 | printf(" flush"); | |||
1004 | if (r->flush & PF_FLUSH_GLOBAL0x02) | |||
1005 | printf(" global"); | |||
1006 | } | |||
1007 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) { | |||
1008 | if (!ropts) | |||
1009 | printf(", "); | |||
1010 | printf("if-bound"); | |||
1011 | ropts = 0; | |||
1012 | } | |||
1013 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) { | |||
1014 | if (!ropts) | |||
1015 | printf(", "); | |||
1016 | printf("sloppy"); | |||
1017 | ropts = 0; | |||
1018 | } | |||
1019 | if (r->rule_flag & PFRULE_PFLOW0x00040000) { | |||
1020 | if (!ropts) | |||
1021 | printf(", "); | |||
1022 | printf("pflow"); | |||
1023 | ropts = 0; | |||
1024 | } | |||
1025 | for (i = 0; i < PFTM_MAX; ++i) | |||
1026 | if (r->timeout[i]) { | |||
1027 | int j; | |||
1028 | ||||
1029 | if (!ropts) | |||
1030 | printf(", "); | |||
1031 | ropts = 0; | |||
1032 | for (j = 0; pf_timeouts[j].name != NULL((void *)0); | |||
1033 | ++j) | |||
1034 | if (pf_timeouts[j].timeout == i) | |||
1035 | break; | |||
1036 | printf("%s %u", pf_timeouts[j].name == NULL((void *)0) ? | |||
1037 | "inv.timeout" : pf_timeouts[j].name, | |||
1038 | r->timeout[i]); | |||
1039 | } | |||
1040 | printf(")"); | |||
1041 | } | |||
1042 | ||||
1043 | if (r->rule_flag & PFRULE_FRAGMENT0x0002) | |||
1044 | printf(" fragment"); | |||
1045 | ||||
1046 | if (r->scrub_flags & PFSTATE_SCRUBMASK(0x0020|0x0080|0x0100) || r->min_ttl || r->max_mss) { | |||
1047 | printf(" scrub ("); | |||
1048 | ropts = 1; | |||
1049 | if (r->scrub_flags & PFSTATE_NODF0x0020) { | |||
1050 | printf("no-df"); | |||
1051 | ropts = 0; | |||
1052 | } | |||
1053 | if (r->scrub_flags & PFSTATE_RANDOMID0x0080) { | |||
1054 | if (!ropts) | |||
1055 | printf(" "); | |||
1056 | printf("random-id"); | |||
1057 | ropts = 0; | |||
1058 | } | |||
1059 | if (r->min_ttl) { | |||
1060 | if (!ropts) | |||
1061 | printf(" "); | |||
1062 | printf("min-ttl %d", r->min_ttl); | |||
1063 | ropts = 0; | |||
1064 | } | |||
1065 | if (r->scrub_flags & PFSTATE_SCRUB_TCP0x0100) { | |||
1066 | if (!ropts) | |||
1067 | printf(" "); | |||
1068 | printf("reassemble tcp"); | |||
1069 | ropts = 0; | |||
1070 | } | |||
1071 | if (r->max_mss) { | |||
1072 | if (!ropts) | |||
1073 | printf(" "); | |||
1074 | printf("max-mss %d", r->max_mss); | |||
1075 | ropts = 0; | |||
1076 | } | |||
1077 | printf(")"); | |||
1078 | } | |||
1079 | ||||
1080 | if (r->allow_opts) | |||
1081 | printf(" allow-opts"); | |||
1082 | if (r->label[0]) | |||
1083 | printf(" label \"%s\"", r->label); | |||
1084 | if (r->rule_flag & PFRULE_ONCE0x00100000) | |||
1085 | printf(" once"); | |||
1086 | if (r->tagname[0]) | |||
1087 | printf(" tag %s", r->tagname); | |||
1088 | if (r->match_tagname[0]) { | |||
1089 | if (r->match_tag_not) | |||
1090 | printf(" !"); | |||
1091 | printf(" tagged %s", r->match_tagname); | |||
1092 | } | |||
1093 | if (r->rtableid != -1) | |||
1094 | printf(" rtable %u", r->rtableid); | |||
1095 | switch (r->divert.type) { | |||
1096 | case PF_DIVERT_NONE: | |||
1097 | break; | |||
1098 | case PF_DIVERT_TO: { | |||
1099 | printf(" divert-to "); | |||
1100 | print_addr_str(r->af, &r->divert.addr); | |||
1101 | printf(" port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); | |||
1102 | break; | |||
1103 | } | |||
1104 | case PF_DIVERT_REPLY: | |||
1105 | printf(" divert-reply"); | |||
1106 | break; | |||
1107 | case PF_DIVERT_PACKET: | |||
1108 | printf(" divert-packet port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); | |||
1109 | break; | |||
1110 | default: | |||
1111 | printf(" divert ???"); | |||
1112 | break; | |||
1113 | } | |||
1114 | ||||
1115 | if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && | |||
1116 | r->rule_flag & PFRULE_AFTO0x00200000) { | |||
1117 | printf(" af-to %s from ", r->naf == AF_INET2 ? "inet" : "inet6"); | |||
1118 | print_pool(&r->nat, r->nat.proxy_port[0], | |||
1119 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, | |||
1120 | PF_POOL_NAT, verbose); | |||
1121 | if (r->rdr.addr.type != PF_ADDR_NONE) { | |||
1122 | printf(" to "); | |||
1123 | print_pool(&r->rdr, r->rdr.proxy_port[0], | |||
1124 | r->rdr.proxy_port[1], r->naf ? r->naf : r->af, | |||
1125 | PF_POOL_RDR, verbose); | |||
1126 | } | |||
1127 | } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { | |||
1128 | printf (" nat-to "); | |||
1129 | print_pool(&r->nat, r->nat.proxy_port[0], | |||
1130 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, | |||
1131 | PF_POOL_NAT, verbose); | |||
1132 | } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { | |||
1133 | printf (" rdr-to "); | |||
1134 | print_pool(&r->rdr, r->rdr.proxy_port[0], | |||
1135 | r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); | |||
1136 | } | |||
1137 | if (r->rt) { | |||
1138 | if (r->rt == PF_ROUTETO) | |||
1139 | printf(" route-to"); | |||
1140 | else if (r->rt == PF_REPLYTO) | |||
1141 | printf(" reply-to"); | |||
1142 | else if (r->rt == PF_DUPTO) | |||
1143 | printf(" dup-to"); | |||
1144 | printf(" "); | |||
1145 | print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); | |||
1146 | } | |||
1147 | ||||
1148 | if (r->rule_flag & PFRULE_EXPIRED0x00400000) | |||
1149 | printf(" # expired"); | |||
1150 | } | |||
1151 | ||||
1152 | void | |||
1153 | print_tabledef(const char *name, int flags, int addrs, | |||
1154 | struct node_tinithead *nodes) | |||
1155 | { | |||
1156 | struct node_tinit *ti, *nti; | |||
1157 | struct node_host *h; | |||
1158 | ||||
1159 | printf("table <%s>", name); | |||
1160 | if (flags & PFR_TFLAG_CONST0x00000002) | |||
1161 | printf(" const"); | |||
1162 | if (flags & PFR_TFLAG_PERSIST0x00000001) | |||
1163 | printf(" persist"); | |||
1164 | if (flags & PFR_TFLAG_COUNTERS0x00000040) | |||
1165 | printf(" counters"); | |||
1166 | SIMPLEQ_FOREACH(ti, nodes, entries)for((ti) = ((nodes)->sqh_first); (ti) != ((void *)0); (ti) = ((ti)->entries.sqe_next)) { | |||
1167 | if (ti->file) { | |||
1168 | printf(" file \"%s\"", ti->file); | |||
1169 | continue; | |||
1170 | } | |||
1171 | printf(" {"); | |||
1172 | for (;;) { | |||
1173 | for (h = ti->host; h != NULL((void *)0); h = h->next) { | |||
1174 | printf(h->not ? " !" : " "); | |||
1175 | print_addr(&h->addr, h->af, 0); | |||
1176 | if (h->ifname) | |||
1177 | printf("@%s", h->ifname); | |||
1178 | } | |||
1179 | nti = SIMPLEQ_NEXT(ti, entries)((ti)->entries.sqe_next); | |||
1180 | if (nti != NULL((void *)0) && nti->file == NULL((void *)0)) | |||
1181 | ti = nti; /* merge lists */ | |||
1182 | else | |||
1183 | break; | |||
1184 | } | |||
1185 | printf(" }"); | |||
1186 | } | |||
1187 | if (addrs && SIMPLEQ_EMPTY(nodes)(((nodes)->sqh_first) == ((void *)0))) | |||
1188 | printf(" { }"); | |||
1189 | printf("\n"); | |||
1190 | } | |||
1191 | ||||
1192 | void | |||
1193 | print_bwspec(const char *prefix, struct pf_queue_bwspec *bw) | |||
1194 | { | |||
1195 | u_int rate; | |||
1196 | int i; | |||
1197 | static const char unit[] = " KMG"; | |||
1198 | ||||
1199 | if (bw->percent) | |||
1200 | printf("%s%u%%", prefix, bw->percent); | |||
1201 | else if (bw->absolute) { | |||
1202 | rate = bw->absolute; | |||
1203 | for (i = 0; rate >= 1000 && i <= 3 && (rate % 1000 == 0); i++) | |||
1204 | rate /= 1000; | |||
1205 | printf("%s%u%c", prefix, rate, unit[i]); | |||
1206 | } | |||
1207 | } | |||
1208 | ||||
1209 | void | |||
1210 | print_scspec(const char *prefix, struct pf_queue_scspec *sc) | |||
1211 | { | |||
1212 | print_bwspec(prefix, &sc->m2); | |||
1213 | if (sc->d) { | |||
1214 | printf(" burst "); | |||
1215 | print_bwspec("", &sc->m1); | |||
1216 | printf(" for %ums", sc->d); | |||
1217 | } | |||
1218 | } | |||
1219 | ||||
1220 | void | |||
1221 | print_queuespec(struct pf_queuespec *q) | |||
1222 | { | |||
1223 | printf("queue %s", q->qname); | |||
1224 | if (q->parent[0]) | |||
1225 | printf(" parent %s", q->parent); | |||
1226 | else if (q->ifname[0]) | |||
1227 | printf(" on %s", q->ifname); | |||
1228 | if (q->flags & PFQS_FLOWQUEUE0x0001) { | |||
1229 | printf(" flows %u", q->flowqueue.flows); | |||
1230 | if (q->flowqueue.quantum > 0) | |||
1231 | printf(" quantum %u", q->flowqueue.quantum); | |||
1232 | if (q->flowqueue.interval > 0) | |||
1233 | printf(" interval %ums", | |||
1234 | q->flowqueue.interval / 1000000); | |||
1235 | if (q->flowqueue.target > 0) | |||
1236 | printf(" target %ums", | |||
1237 | q->flowqueue.target / 1000000); | |||
1238 | } | |||
1239 | if (q->linkshare.m1.absolute || q->linkshare.m2.absolute) { | |||
1240 | print_scspec(" bandwidth ", &q->linkshare); | |||
1241 | print_scspec(", min ", &q->realtime); | |||
1242 | print_scspec(", max ", &q->upperlimit); | |||
1243 | } | |||
1244 | if (q->flags & PFQS_DEFAULT0x1000) | |||
1245 | printf(" default"); | |||
1246 | if (q->qlimit) | |||
1247 | printf(" qlimit %u", q->qlimit); | |||
1248 | printf("\n"); | |||
1249 | } | |||
1250 | ||||
1251 | int | |||
1252 | parse_flags(char *s) | |||
1253 | { | |||
1254 | char *p, *q; | |||
1255 | u_int8_t f = 0; | |||
1256 | ||||
1257 | for (p = s; *p; p++) { | |||
1258 | if ((q = strchr(tcpflags, *p)) == NULL((void *)0)) | |||
1259 | return -1; | |||
1260 | else | |||
1261 | f |= 1 << (q - tcpflags); | |||
1262 | } | |||
1263 | return (f ? f : PF_TH_ALL0xFF); | |||
1264 | } | |||
1265 | ||||
1266 | void | |||
1267 | set_ipmask(struct node_host *h, int bb) | |||
1268 | { | |||
1269 | struct pf_addr *m, *n; | |||
1270 | int i, j = 0; | |||
1271 | u_int8_t b; | |||
1272 | ||||
1273 | m = &h->addr.v.a.mask; | |||
1274 | memset(m, 0, sizeof(*m)); | |||
1275 | ||||
1276 | if (bb == -1) | |||
1277 | b = h->af == AF_INET2 ? 32 : 128; | |||
1278 | else | |||
1279 | b = bb; | |||
1280 | ||||
1281 | while (b >= 32) { | |||
1282 | m->addr32pfa.addr32[j++] = 0xffffffff; | |||
1283 | b -= 32; | |||
1284 | } | |||
1285 | for (i = 31; i > 31-b; --i) | |||
1286 | m->addr32pfa.addr32[j] |= (1 << i); | |||
1287 | if (b) | |||
1288 | m->addr32pfa.addr32[j] = htonl(m->addr32[j])(__uint32_t)(__builtin_constant_p(m->pfa.addr32[j]) ? (__uint32_t )(((__uint32_t)(m->pfa.addr32[j]) & 0xff) << 24 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff00) << 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff0000) >> 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff000000) >> 24) : __swap32md(m->pfa.addr32[j])); | |||
1289 | ||||
1290 | /* Mask off bits of the address that will never be used. */ | |||
1291 | n = &h->addr.v.a.addr; | |||
1292 | if (h->addr.type == PF_ADDR_ADDRMASK) | |||
1293 | for (i = 0; i < 4; i++) | |||
1294 | n->addr32pfa.addr32[i] = n->addr32pfa.addr32[i] & m->addr32pfa.addr32[i]; | |||
1295 | } | |||
1296 | ||||
1297 | int | |||
1298 | check_netmask(struct node_host *h, sa_family_t af) | |||
1299 | { | |||
1300 | struct node_host *n = NULL((void *)0); | |||
1301 | struct pf_addr *m; | |||
1302 | ||||
1303 | for (n = h; n != NULL((void *)0); n = n->next) { | |||
1304 | if (h->addr.type == PF_ADDR_TABLE) | |||
1305 | continue; | |||
1306 | m = &h->addr.v.a.mask; | |||
1307 | /* netmasks > 32 bit are invalid on v4 */ | |||
1308 | if (af == AF_INET2 && | |||
1309 | (m->addr32pfa.addr32[1] || m->addr32pfa.addr32[2] || m->addr32pfa.addr32[3])) { | |||
1310 | fprintf(stderr(&__sF[2]), "netmask %u invalid for IPv4 address\n", | |||
1311 | unmask(m)); | |||
1312 | return (1); | |||
1313 | } | |||
1314 | } | |||
1315 | return (0); | |||
1316 | } | |||
1317 | ||||
1318 | struct node_host * | |||
1319 | gen_dynnode(struct node_host *h, sa_family_t af) | |||
1320 | { | |||
1321 | struct node_host *n; | |||
1322 | ||||
1323 | if (h->addr.type != PF_ADDR_DYNIFTL) | |||
1324 | return (NULL((void *)0)); | |||
1325 | ||||
1326 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) | |||
1327 | return (NULL((void *)0)); | |||
1328 | bcopy(h, n, sizeof(*n)); | |||
1329 | n->ifname = NULL((void *)0); | |||
1330 | n->next = NULL((void *)0); | |||
1331 | n->tail = NULL((void *)0); | |||
1332 | ||||
1333 | /* fix up netmask */ | |||
1334 | if (af == AF_INET2 && unmask(&n->addr.v.a.mask) > 32) | |||
1335 | set_ipmask(n, 32); | |||
1336 | ||||
1337 | return (n); | |||
1338 | } | |||
1339 | ||||
1340 | /* interface lookup routines */ | |||
1341 | ||||
1342 | struct node_host *iftab; | |||
1343 | ||||
1344 | void | |||
1345 | ifa_load(void) | |||
1346 | { | |||
1347 | struct ifaddrs *ifap, *ifa; | |||
1348 | struct node_host *n = NULL((void *)0), *h = NULL((void *)0); | |||
1349 | ||||
1350 | if (getifaddrs(&ifap) == -1) | |||
1351 | err(1, "getifaddrs"); | |||
1352 | ||||
1353 | for (ifa = ifap; ifa; ifa = ifa->ifa_next) { | |||
1354 | if (ifa->ifa_addr == NULL((void *)0) || | |||
1355 | !(ifa->ifa_addr->sa_family == AF_INET2 || | |||
1356 | ifa->ifa_addr->sa_family == AF_INET624 || | |||
1357 | ifa->ifa_addr->sa_family == AF_LINK18)) | |||
1358 | continue; | |||
1359 | n = calloc(1, sizeof(struct node_host)); | |||
1360 | if (n == NULL((void *)0)) | |||
1361 | err(1, "%s: calloc", __func__); | |||
1362 | n->af = ifa->ifa_addr->sa_family; | |||
1363 | n->ifa_flags = ifa->ifa_flags; | |||
1364 | #ifdef __KAME__ | |||
1365 | if (n->af == AF_INET624 && | |||
1366 | IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) | |||
1367 | ifa->ifa_addr)->sin6_addr)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) && | |||
1368 | ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == | |||
1369 | 0) { | |||
1370 | struct sockaddr_in6 *sin6; | |||
1371 | ||||
1372 | sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; | |||
1373 | sin6->sin6_scope_id = sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] << 8 | | |||
1374 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3]; | |||
1375 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] = 0; | |||
1376 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3] = 0; | |||
1377 | } | |||
1378 | #endif | |||
1379 | n->ifindex = 0; | |||
1380 | if (n->af == AF_LINK18) | |||
1381 | n->ifindex = ((struct sockaddr_dl *) | |||
1382 | ifa->ifa_addr)->sdl_index; | |||
1383 | else { | |||
1384 | copy_satopfaddr(&n->addr.v.a.addr, ifa->ifa_addr); | |||
1385 | ifa->ifa_netmask->sa_family = ifa->ifa_addr->sa_family; | |||
1386 | copy_satopfaddr(&n->addr.v.a.mask, ifa->ifa_netmask); | |||
1387 | if (ifa->ifa_broadaddrifa_dstaddr != NULL((void *)0)) { | |||
1388 | ifa->ifa_broadaddrifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; | |||
1389 | copy_satopfaddr(&n->bcast, ifa->ifa_broadaddrifa_dstaddr); | |||
1390 | } | |||
1391 | if (ifa->ifa_dstaddr != NULL((void *)0)) { | |||
1392 | ifa->ifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; | |||
1393 | copy_satopfaddr(&n->peer, ifa->ifa_dstaddr); | |||
1394 | } | |||
1395 | if (n->af == AF_INET624) | |||
1396 | n->ifindex = ((struct sockaddr_in6 *) | |||
1397 | ifa->ifa_addr)->sin6_scope_id; | |||
1398 | } | |||
1399 | if ((n->ifname = strdup(ifa->ifa_name)) == NULL((void *)0)) | |||
1400 | err(1, "%s: strdup", __func__); | |||
1401 | n->next = NULL((void *)0); | |||
1402 | n->tail = n; | |||
1403 | if (h == NULL((void *)0)) | |||
1404 | h = n; | |||
1405 | else { | |||
1406 | h->tail->next = n; | |||
1407 | h->tail = n; | |||
1408 | } | |||
1409 | } | |||
1410 | ||||
1411 | iftab = h; | |||
1412 | freeifaddrs(ifap); | |||
1413 | } | |||
1414 | ||||
1415 | unsigned int | |||
1416 | ifa_nametoindex(const char *ifa_name) | |||
1417 | { | |||
1418 | struct node_host *p; | |||
1419 | ||||
1420 | for (p = iftab; p; p = p->next) { | |||
1421 | if (p->af == AF_LINK18 && strcmp(p->ifname, ifa_name) == 0) | |||
1422 | return (p->ifindex); | |||
1423 | } | |||
1424 | errno(*__errno()) = ENXIO6; | |||
1425 | return (0); | |||
1426 | } | |||
1427 | ||||
1428 | char * | |||
1429 | ifa_indextoname(unsigned int ifindex, char *ifa_name) | |||
1430 | { | |||
1431 | struct node_host *p; | |||
1432 | ||||
1433 | for (p = iftab; p; p = p->next) { | |||
1434 | if (p->af == AF_LINK18 && ifindex == p->ifindex) { | |||
1435 | strlcpy(ifa_name, p->ifname, IFNAMSIZ16); | |||
1436 | return (ifa_name); | |||
1437 | } | |||
1438 | } | |||
1439 | errno(*__errno()) = ENXIO6; | |||
1440 | return (NULL((void *)0)); | |||
1441 | } | |||
1442 | ||||
1443 | struct node_host * | |||
1444 | ifa_exists(const char *ifa_name) | |||
1445 | { | |||
1446 | struct node_host *n; | |||
1447 | struct ifgroupreq ifgr; | |||
1448 | int s; | |||
1449 | ||||
1450 | if (iftab == NULL((void *)0)) | |||
1451 | ifa_load(); | |||
1452 | ||||
1453 | /* check whether this is a group */ | |||
1454 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) | |||
1455 | err(1, "socket"); | |||
1456 | bzero(&ifgr, sizeof(ifgr)); | |||
1457 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); | |||
1458 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == 0) { | |||
1459 | /* fake a node_host */ | |||
1460 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) | |||
1461 | err(1, "calloc"); | |||
1462 | if ((n->ifname = strdup(ifa_name)) == NULL((void *)0)) | |||
1463 | err(1, "strdup"); | |||
1464 | close(s); | |||
1465 | return (n); | |||
1466 | } | |||
1467 | close(s); | |||
1468 | ||||
1469 | for (n = iftab; n; n = n->next) { | |||
1470 | if (n->af == AF_LINK18 && !strncmp(n->ifname, ifa_name, IFNAMSIZ16)) | |||
1471 | return (n); | |||
1472 | } | |||
1473 | ||||
1474 | return (NULL((void *)0)); | |||
1475 | } | |||
1476 | ||||
1477 | struct node_host * | |||
1478 | ifa_grouplookup(const char *ifa_name, int flags) | |||
1479 | { | |||
1480 | struct ifg_req *ifg; | |||
1481 | struct ifgroupreq ifgr; | |||
1482 | int s, len; | |||
1483 | struct node_host *n, *h = NULL((void *)0); | |||
1484 | ||||
1485 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) | |||
1486 | err(1, "socket"); | |||
1487 | bzero(&ifgr, sizeof(ifgr)); | |||
1488 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); | |||
1489 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) { | |||
1490 | close(s); | |||
1491 | return (NULL((void *)0)); | |||
1492 | } | |||
1493 | ||||
1494 | len = ifgr.ifgr_len; | |||
1495 | if ((ifgr.ifgr_groupsifgr_ifgru.ifgru_groups = calloc(1, len)) == NULL((void *)0)) | |||
1496 | err(1, "calloc"); | |||
1497 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) | |||
1498 | err(1, "SIOCGIFGMEMB"); | |||
1499 | ||||
1500 | for (ifg = ifgr.ifgr_groupsifgr_ifgru.ifgru_groups; ifg && len >= sizeof(struct ifg_req); | |||
1501 | ifg++) { | |||
1502 | len -= sizeof(struct ifg_req); | |||
1503 | if ((n = ifa_lookup(ifg->ifgrq_memberifgrq_ifgrqu.ifgrqu_member, flags)) == NULL((void *)0)) | |||
1504 | continue; | |||
1505 | if (h == NULL((void *)0)) | |||
1506 | h = n; | |||
1507 | else { | |||
1508 | h->tail->next = n; | |||
1509 | h->tail = n->tail; | |||
1510 | } | |||
1511 | } | |||
1512 | free(ifgr.ifgr_groupsifgr_ifgru.ifgru_groups); | |||
1513 | close(s); | |||
1514 | ||||
1515 | return (h); | |||
1516 | } | |||
1517 | ||||
1518 | struct node_host * | |||
1519 | ifa_lookup(const char *ifa_name, int flags) | |||
1520 | { | |||
1521 | struct node_host *p = NULL((void *)0), *h = NULL((void *)0), *n = NULL((void *)0); | |||
1522 | int got4 = 0, got6 = 0; | |||
1523 | const char *last_if = NULL((void *)0); | |||
1524 | ||||
1525 | if ((h = ifa_grouplookup(ifa_name, flags)) != NULL((void *)0)) | |||
1526 | return (h); | |||
1527 | ||||
1528 | if (!strncmp(ifa_name, "self", IFNAMSIZ16)) | |||
1529 | ifa_name = NULL((void *)0); | |||
1530 | ||||
1531 | if (iftab == NULL((void *)0)) | |||
1532 | ifa_load(); | |||
1533 | ||||
1534 | for (p = iftab; p; p = p->next) { | |||
1535 | if (ifa_skip_if(ifa_name, p)) | |||
1536 | continue; | |||
1537 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->af != AF_INET2) | |||
1538 | continue; | |||
1539 | if ((flags & PFI_AFLAG_BROADCAST0x02) && | |||
1540 | !(p->ifa_flags & IFF_BROADCAST0x2)) | |||
1541 | continue; | |||
1542 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->bcast.v4pfa.v4.s_addr == 0) | |||
1543 | continue; | |||
1544 | if ((flags & PFI_AFLAG_PEER0x04) && | |||
1545 | !(p->ifa_flags & IFF_POINTOPOINT0x10)) | |||
1546 | continue; | |||
1547 | if ((flags & PFI_AFLAG_NETWORK0x01) && p->ifindex > 0) | |||
1548 | continue; | |||
1549 | if (last_if == NULL((void *)0) || strcmp(last_if, p->ifname)) | |||
1550 | got4 = got6 = 0; | |||
1551 | last_if = p->ifname; | |||
1552 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET2 && got4) | |||
1553 | continue; | |||
1554 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET624 && got6) | |||
1555 | continue; | |||
1556 | if (p->af == AF_INET2) | |||
1557 | got4 = 1; | |||
1558 | else | |||
1559 | got6 = 1; | |||
1560 | n = calloc(1, sizeof(struct node_host)); | |||
1561 | if (n == NULL((void *)0)) | |||
1562 | err(1, "%s: calloc", __func__); | |||
1563 | n->af = p->af; | |||
1564 | if (flags & PFI_AFLAG_BROADCAST0x02) | |||
1565 | memcpy(&n->addr.v.a.addr, &p->bcast, | |||
1566 | sizeof(struct pf_addr)); | |||
1567 | else if (flags & PFI_AFLAG_PEER0x04) | |||
1568 | memcpy(&n->addr.v.a.addr, &p->peer, | |||
1569 | sizeof(struct pf_addr)); | |||
1570 | else | |||
1571 | memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, | |||
1572 | sizeof(struct pf_addr)); | |||
1573 | if (flags & PFI_AFLAG_NETWORK0x01) | |||
1574 | set_ipmask(n, unmask(&p->addr.v.a.mask)); | |||
1575 | else | |||
1576 | set_ipmask(n, -1); | |||
1577 | n->ifindex = p->ifindex; | |||
1578 | ||||
1579 | n->next = NULL((void *)0); | |||
1580 | n->tail = n; | |||
1581 | if (h == NULL((void *)0)) | |||
1582 | h = n; | |||
1583 | else { | |||
1584 | h->tail->next = n; | |||
1585 | h->tail = n; | |||
1586 | } | |||
1587 | } | |||
1588 | return (h); | |||
1589 | } | |||
1590 | ||||
1591 | int | |||
1592 | ifa_skip_if(const char *filter, struct node_host *p) | |||
1593 | { | |||
1594 | int n; | |||
1595 | ||||
1596 | if (p->af != AF_INET2 && p->af != AF_INET624) | |||
1597 | return (1); | |||
1598 | if (filter == NULL((void *)0) || !*filter) | |||
1599 | return (0); | |||
1600 | if (!strcmp(p->ifname, filter)) | |||
1601 | return (0); /* exact match */ | |||
1602 | n = strlen(filter); | |||
1603 | if (n < 1 || n >= IFNAMSIZ16) | |||
1604 | return (1); /* sanity check */ | |||
1605 | if (filter[n-1] >= '0' && filter[n-1] <= '9') | |||
1606 | return (1); /* only do exact match in that case */ | |||
1607 | if (strncmp(p->ifname, filter, n)) | |||
1608 | return (1); /* prefix doesn't match */ | |||
1609 | return (p->ifname[n] < '0' || p->ifname[n] > '9'); | |||
1610 | } | |||
1611 | ||||
1612 | struct node_host * | |||
1613 | host(const char *s, int opts) | |||
1614 | { | |||
1615 | struct node_host *h = NULL((void *)0), *n; | |||
1616 | int mask = -1; | |||
1617 | char *p, *ps; | |||
1618 | const char *errstr; | |||
1619 | ||||
1620 | if ((ps = strdup(s)) == NULL((void *)0)) | |||
1621 | err(1, "%s: strdup", __func__); | |||
1622 | ||||
1623 | if ((p = strchr(ps, '/')) != NULL((void *)0)) { | |||
1624 | mask = strtonum(p+1, 0, 128, &errstr); | |||
1625 | if (errstr) { | |||
1626 | fprintf(stderr(&__sF[2]), "netmask is %s: %s\n", errstr, p); | |||
1627 | goto error; | |||
1628 | } | |||
1629 | p[0] = '\0'; | |||
1630 | } | |||
1631 | ||||
1632 | if ((h = host_if(ps, mask)) == NULL((void *)0) && | |||
1633 | (h = host_ip(ps, mask)) == NULL((void *)0) && | |||
1634 | (h = host_dns(ps, mask, (opts & PF_OPT_NODNS0x01000))) == NULL((void *)0)) { | |||
1635 | fprintf(stderr(&__sF[2]), "no IP address found for %s\n", s); | |||
1636 | goto error; | |||
1637 | } | |||
1638 | ||||
1639 | for (n = h; n != NULL((void *)0); n = n->next) { | |||
1640 | n->addr.type = PF_ADDR_ADDRMASK; | |||
1641 | n->weight = 0; | |||
1642 | } | |||
1643 | ||||
1644 | error: | |||
1645 | free(ps); | |||
1646 | return (h); | |||
1647 | } | |||
1648 | ||||
1649 | struct node_host * | |||
1650 | host_if(const char *s, int mask) | |||
1651 | { | |||
1652 | struct node_host *n, *h = NULL((void *)0); | |||
1653 | char *p, *ps; | |||
1654 | int flags = 0; | |||
1655 | ||||
1656 | if ((ps = strdup(s)) == NULL((void *)0)) | |||
1657 | err(1, "host_if: strdup"); | |||
1658 | while ((p = strrchr(ps, ':')) != NULL((void *)0)) { | |||
1659 | if (!strcmp(p+1, "network")) | |||
1660 | flags |= PFI_AFLAG_NETWORK0x01; | |||
1661 | else if (!strcmp(p+1, "broadcast")) | |||
1662 | flags |= PFI_AFLAG_BROADCAST0x02; | |||
1663 | else if (!strcmp(p+1, "peer")) | |||
1664 | flags |= PFI_AFLAG_PEER0x04; | |||
1665 | else if (!strcmp(p+1, "0")) | |||
1666 | flags |= PFI_AFLAG_NOALIAS0x08; | |||
1667 | else | |||
1668 | goto error; | |||
1669 | *p = '\0'; | |||
1670 | } | |||
1671 | if (flags & (flags - 1) & PFI_AFLAG_MODEMASK0x07) { /* Yep! */ | |||
1672 | fprintf(stderr(&__sF[2]), "illegal combination of interface modifiers\n"); | |||
1673 | goto error; | |||
1674 | } | |||
1675 | if ((flags & (PFI_AFLAG_NETWORK0x01|PFI_AFLAG_BROADCAST0x02)) && mask > -1) { | |||
1676 | fprintf(stderr(&__sF[2]), "network or broadcast lookup, but " | |||
1677 | "extra netmask given\n"); | |||
1678 | goto error; | |||
1679 | } | |||
1680 | if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ16)) { | |||
1681 | /* interface with this name exists */ | |||
1682 | h = ifa_lookup(ps, flags); | |||
| ||||
1683 | if (mask > -1) | |||
1684 | for (n = h; n != NULL((void *)0); n = n->next) | |||
1685 | set_ipmask(n, mask); | |||
1686 | } | |||
1687 | ||||
1688 | error: | |||
1689 | free(ps); | |||
1690 | return (h); | |||
1691 | } | |||
1692 | ||||
1693 | struct node_host * | |||
1694 | host_ip(const char *s, int mask) | |||
1695 | { | |||
1696 | struct addrinfo hints, *res; | |||
1697 | struct node_host *h = NULL((void *)0); | |||
1698 | ||||
1699 | memset(&hints, 0, sizeof(hints)); | |||
1700 | hints.ai_family = AF_UNSPEC0; | |||
1701 | hints.ai_socktype = SOCK_DGRAM2; /*dummy*/ | |||
1702 | hints.ai_flags = AI_NUMERICHOST4; | |||
1703 | if (getaddrinfo(s, NULL((void *)0), &hints, &res) == 0) { | |||
1704 | h = calloc(1, sizeof(*h)); | |||
1705 | if (h == NULL((void *)0)) | |||
1706 | err(1, "%s: calloc", __func__); | |||
1707 | h->af = res->ai_family; | |||
1708 | copy_satopfaddr(&h->addr.v.a.addr, res->ai_addr); | |||
1709 | if (h->af == AF_INET624) | |||
1710 | h->ifindex = | |||
1711 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; | |||
1712 | freeaddrinfo(res); | |||
1713 | } else { /* ie. for 10/8 parsing */ | |||
1714 | if (mask == -1) | |||
1715 | return (NULL((void *)0)); | |||
1716 | h = calloc(1, sizeof(*h)); | |||
1717 | if (h == NULL((void *)0)) | |||
1718 | err(1, "%s: calloc", __func__); | |||
1719 | h->af = AF_INET2; | |||
1720 | if (inet_net_pton(AF_INET2, s, &h->addr.v.a.addr.v4pfa.v4, | |||
1721 | sizeof(h->addr.v.a.addr.v4pfa.v4)) == -1) { | |||
1722 | free(h); | |||
1723 | return (NULL((void *)0)); | |||
1724 | } | |||
1725 | } | |||
1726 | set_ipmask(h, mask); | |||
1727 | h->ifname = NULL((void *)0); | |||
1728 | h->next = NULL((void *)0); | |||
1729 | h->tail = h; | |||
1730 | ||||
1731 | return (h); | |||
1732 | } | |||
1733 | ||||
1734 | struct node_host * | |||
1735 | host_dns(const char *s, int mask, int numeric) | |||
1736 | { | |||
1737 | struct addrinfo hints, *res0, *res; | |||
1738 | struct node_host *n, *h = NULL((void *)0); | |||
1739 | int noalias = 0, got4 = 0, got6 = 0; | |||
1740 | char *p, *ps; | |||
1741 | ||||
1742 | if ((ps = strdup(s)) == NULL((void *)0)) | |||
1743 | err(1, "host_dns: strdup"); | |||
1744 | if ((p = strrchr(ps, ':')) != NULL((void *)0) && !strcmp(p, ":0")) { | |||
1745 | noalias = 1; | |||
1746 | *p = '\0'; | |||
1747 | } | |||
1748 | memset(&hints, 0, sizeof(hints)); | |||
1749 | hints.ai_family = PF_UNSPEC0; | |||
1750 | hints.ai_socktype = SOCK_STREAM1; /* DUMMY */ | |||
1751 | if (numeric) | |||
1752 | hints.ai_flags = AI_NUMERICHOST4; | |||
1753 | if (getaddrinfo(ps, NULL((void *)0), &hints, &res0) != 0) | |||
1754 | goto error; | |||
1755 | ||||
1756 | for (res = res0; res; res = res->ai_next) { | |||
1757 | if (res->ai_family != AF_INET2 && | |||
1758 | res->ai_family != AF_INET624) | |||
1759 | continue; | |||
1760 | if (noalias) { | |||
1761 | if (res->ai_family == AF_INET2) { | |||
1762 | if (got4) | |||
1763 | continue; | |||
1764 | got4 = 1; | |||
1765 | } else { | |||
1766 | if (got6) | |||
1767 | continue; | |||
1768 | got6 = 1; | |||
1769 | } | |||
1770 | } | |||
1771 | n = calloc(1, sizeof(struct node_host)); | |||
1772 | if (n == NULL((void *)0)) | |||
1773 | err(1, "host_dns: calloc"); | |||
1774 | n->ifname = NULL((void *)0); | |||
1775 | n->af = res->ai_family; | |||
1776 | copy_satopfaddr(&n->addr.v.a.addr, res->ai_addr); | |||
1777 | if (res->ai_family == AF_INET624) | |||
1778 | n->ifindex = | |||
1779 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; | |||
1780 | set_ipmask(n, mask); | |||
1781 | n->next = NULL((void *)0); | |||
1782 | n->tail = n; | |||
1783 | if (h == NULL((void *)0)) | |||
1784 | h = n; | |||
1785 | else { | |||
1786 | h->tail->next = n; | |||
1787 | h->tail = n; | |||
1788 | } | |||
1789 | } | |||
1790 | freeaddrinfo(res0); | |||
1791 | error: | |||
1792 | free(ps); | |||
1793 | ||||
1794 | return (h); | |||
1795 | } | |||
1796 | ||||
1797 | /* | |||
1798 | * convert a hostname to a list of addresses and put them in the given buffer. | |||
1799 | * test: | |||
1800 | * if set to 1, only simple addresses are accepted (no netblock, no "!"). | |||
1801 | */ | |||
1802 | int | |||
1803 | append_addr(struct pfr_buffer *b, char *s, int test, int opts) | |||
1804 | { | |||
1805 | static int previous = 0; | |||
1806 | static int expect = 0; | |||
1807 | struct pfr_addr *a; | |||
1808 | struct node_host *h, *n; | |||
1809 | char *r; | |||
1810 | const char *errstr; | |||
1811 | int rv, not = 0, i = 0; | |||
1812 | u_int16_t weight; | |||
1813 | ||||
1814 | /* skip weight if given */ | |||
1815 | if (strcmp(s, "weight") == 0) { | |||
| ||||
1816 | expect = 1; | |||
1817 | return (1); /* expecting further call */ | |||
1818 | } | |||
1819 | ||||
1820 | /* check if previous host is set */ | |||
1821 | if (expect
| |||
1822 | /* parse and append load balancing weight */ | |||
1823 | weight = strtonum(s, 1, USHRT_MAX0xffff, &errstr); | |||
1824 | if (errstr) { | |||
1825 | fprintf(stderr(&__sF[2]), "failed to convert weight %s\n", s); | |||
1826 | return (-1); | |||
1827 | } | |||
1828 | if (previous != -1) { | |||
1829 | PFRB_FOREACH(a, b)for ((a) = pfr_buf_next((b), ((void *)0)); (a) != ((void *)0) ; (a) = pfr_buf_next((b), (a))) { | |||
1830 | if (++i >= previous) { | |||
1831 | a->pfra_weight = weight; | |||
1832 | a->pfra_type = PFRKE_COST; | |||
1833 | } | |||
1834 | } | |||
1835 | } | |||
1836 | expect = 0; | |||
1837 | return (0); | |||
1838 | } | |||
1839 | ||||
1840 | for (r = s; *r == '!'; r++) | |||
1841 | not = !not; | |||
1842 | if ((n = host(r, opts)) == NULL((void *)0)) { | |||
1843 | errno(*__errno()) = 0; | |||
1844 | return (-1); | |||
1845 | } | |||
1846 | rv = append_addr_host(b, n, test, not); | |||
1847 | previous = b->pfrb_size; | |||
1848 | do { | |||
1849 | h = n; | |||
1850 | n = n->next; | |||
1851 | free(h); | |||
1852 | } while (n != NULL((void *)0)); | |||
1853 | return (rv); | |||
1854 | } | |||
1855 | ||||
1856 | /* | |||
1857 | * same as previous function, but with a pre-parsed input and the ability | |||
1858 | * to "negate" the result. Does not free the node_host list. | |||
1859 | * not: | |||
1860 | * setting it to 1 is equivalent to adding "!" in front of parameter s. | |||
1861 | */ | |||
1862 | int | |||
1863 | append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) | |||
1864 | { | |||
1865 | int bits; | |||
1866 | struct pfr_addr addr; | |||
1867 | ||||
1868 | do { | |||
1869 | bzero(&addr, sizeof(addr)); | |||
1870 | addr.pfra_not = n->not ^ not; | |||
1871 | addr.pfra_af = n->af; | |||
1872 | addr.pfra_net = unmask(&n->addr.v.a.mask); | |||
1873 | if (n->ifname) { | |||
1874 | if (strlcpy(addr.pfra_ifname, n->ifname, | |||
1875 | sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) | |||
1876 | errx(1, "append_addr_host: strlcpy"); | |||
1877 | addr.pfra_type = PFRKE_ROUTE; | |||
1878 | } | |||
1879 | if (n->weight > 0) { | |||
1880 | addr.pfra_weight = n->weight; | |||
1881 | addr.pfra_type = PFRKE_COST; | |||
1882 | } | |||
1883 | switch (n->af) { | |||
1884 | case AF_INET2: | |||
1885 | addr.pfra_ip4addrpfra_u._pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32pfa.addr32[0]; | |||
1886 | bits = 32; | |||
1887 | break; | |||
1888 | case AF_INET624: | |||
1889 | memcpy(&addr.pfra_ip6addrpfra_u._pfra_ip6addr, &n->addr.v.a.addr.v6pfa.v6, | |||
1890 | sizeof(struct in6_addr)); | |||
1891 | bits = 128; | |||
1892 | break; | |||
1893 | default: | |||
1894 | errno(*__errno()) = EINVAL22; | |||
1895 | return (-1); | |||
1896 | } | |||
1897 | if ((test && (not || addr.pfra_net != bits)) || | |||
1898 | addr.pfra_net > bits) { | |||
1899 | errno(*__errno()) = EINVAL22; | |||
1900 | return (-1); | |||
1901 | } | |||
1902 | if (pfr_buf_add(b, &addr)) | |||
1903 | return (-1); | |||
1904 | } while ((n = n->next) != NULL((void *)0)); | |||
1905 | ||||
1906 | return (0); | |||
1907 | } | |||
1908 | ||||
1909 | int | |||
1910 | pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) | |||
1911 | { | |||
1912 | struct pfioc_trans_e trans; | |||
1913 | ||||
1914 | bzero(&trans, sizeof(trans)); | |||
1915 | trans.type = type; | |||
1916 | if (strlcpy(trans.anchor, anchor, | |||
1917 | sizeof(trans.anchor)) >= sizeof(trans.anchor)) | |||
1918 | errx(1, "pfctl_add_trans: strlcpy"); | |||
1919 | ||||
1920 | return pfr_buf_add(buf, &trans); | |||
1921 | } | |||
1922 | ||||
1923 | u_int32_t | |||
1924 | pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) | |||
1925 | { | |||
1926 | struct pfioc_trans_e *p; | |||
1927 | ||||
1928 | PFRB_FOREACH(p, buf)for ((p) = pfr_buf_next((buf), ((void *)0)); (p) != ((void *) 0); (p) = pfr_buf_next((buf), (p))) | |||
1929 | if (type == p->type && !strcmp(anchor, p->anchor)) | |||
1930 | return (p->ticket); | |||
1931 | errx(1, "pfctl_get_ticket: assertion failed"); | |||
1932 | } | |||
1933 | ||||
1934 | int | |||
1935 | pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) | |||
1936 | { | |||
1937 | struct pfioc_trans trans; | |||
1938 | ||||
1939 | bzero(&trans, sizeof(trans)); | |||
1940 | trans.size = buf->pfrb_size - from; | |||
1941 | trans.esize = sizeof(struct pfioc_trans_e); | |||
1942 | trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; | |||
1943 | return ioctl(dev, cmd, &trans); | |||
1944 | } |