File: | src/sbin/pfctl/pfctl_parser.c |
Warning: | line 1075, column 4 Value stored to 'ropts' is never read |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: pfctl_parser.c,v 1.349 2023/10/26 16:26:01 deraadt Exp $ */ |
2 | |
3 | /* |
4 | * Copyright (c) 2001 Daniel Hartmeier |
5 | * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> |
6 | * All rights reserved. |
7 | * |
8 | * Redistribution and use in source and binary forms, with or without |
9 | * modification, are permitted provided that the following conditions |
10 | * are met: |
11 | * |
12 | * - Redistributions of source code must retain the above copyright |
13 | * notice, this list of conditions and the following disclaimer. |
14 | * - Redistributions in binary form must reproduce the above |
15 | * copyright notice, this list of conditions and the following |
16 | * disclaimer in the documentation and/or other materials provided |
17 | * with the distribution. |
18 | * |
19 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
20 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
21 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
22 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
23 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
24 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
25 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
26 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
27 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
28 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
29 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
30 | * POSSIBILITY OF SUCH DAMAGE. |
31 | * |
32 | */ |
33 | |
34 | #include <sys/types.h> |
35 | #include <sys/ioctl.h> |
36 | #include <sys/socket.h> |
37 | #include <net/if_dl.h> |
38 | #include <net/if.h> |
39 | #include <netinet/in.h> |
40 | #include <netinet/ip.h> |
41 | #include <netinet/ip_icmp.h> |
42 | #include <netinet/icmp6.h> |
43 | #include <net/pfvar.h> |
44 | #include <arpa/inet.h> |
45 | |
46 | #include <ctype.h> |
47 | #include <err.h> |
48 | #include <errno(*__errno()).h> |
49 | #include <ifaddrs.h> |
50 | #include <limits.h> |
51 | #include <netdb.h> |
52 | #include <stdarg.h> |
53 | #include <stdio.h> |
54 | #include <stdlib.h> |
55 | #include <string.h> |
56 | #include <time.h> |
57 | #include <unistd.h> |
58 | |
59 | #define SYSLOG_NAMES |
60 | #include <syslog.h> |
61 | |
62 | #include "pfctl_parser.h" |
63 | #include "pfctl.h" |
64 | |
65 | #ifndef nitems |
66 | #define nitems(_a)(sizeof((_a)) / sizeof((_a)[0])) (sizeof((_a)) / sizeof((_a)[0])) |
67 | #endif |
68 | |
69 | void print_op (u_int8_t, const char *, const char *); |
70 | void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); |
71 | void print_ugid (u_int8_t, id_t, id_t, const char *); |
72 | void print_flags (u_int8_t); |
73 | void print_fromto(struct pf_rule_addr *, pf_osfp_t, |
74 | struct pf_rule_addr *, u_int8_t, u_int8_t, int); |
75 | void print_bwspec(const char *index, struct pf_queue_bwspec *); |
76 | void print_scspec(const char *, struct pf_queue_scspec *); |
77 | int ifa_skip_if(const char *filter, struct node_host *p); |
78 | |
79 | struct node_host *ifa_grouplookup(const char *, int); |
80 | struct node_host *host_if(const char *, int); |
81 | struct node_host *host_ip(const char *, int); |
82 | struct node_host *host_dns(const char *, int, int); |
83 | |
84 | const char *tcpflags = "FSRPAUEW"; |
85 | |
86 | static const struct icmptypeent icmp_type[] = { |
87 | { "echoreq", ICMP_ECHO8 }, |
88 | { "echorep", ICMP_ECHOREPLY0 }, |
89 | { "unreach", ICMP_UNREACH3 }, |
90 | { "squench", ICMP_SOURCEQUENCH4 }, |
91 | { "redir", ICMP_REDIRECT5 }, |
92 | { "althost", ICMP_ALTHOSTADDR6 }, |
93 | { "routeradv", ICMP_ROUTERADVERT9 }, |
94 | { "routersol", ICMP_ROUTERSOLICIT10 }, |
95 | { "timex", ICMP_TIMXCEED11 }, |
96 | { "paramprob", ICMP_PARAMPROB12 }, |
97 | { "timereq", ICMP_TSTAMP13 }, |
98 | { "timerep", ICMP_TSTAMPREPLY14 }, |
99 | { "inforeq", ICMP_IREQ15 }, |
100 | { "inforep", ICMP_IREQREPLY16 }, |
101 | { "maskreq", ICMP_MASKREQ17 }, |
102 | { "maskrep", ICMP_MASKREPLY18 }, |
103 | { "trace", ICMP_TRACEROUTE30 }, |
104 | { "dataconv", ICMP_DATACONVERR31 }, |
105 | { "mobredir", ICMP_MOBILE_REDIRECT32 }, |
106 | { "ipv6-where", ICMP_IPV6_WHEREAREYOU33 }, |
107 | { "ipv6-here", ICMP_IPV6_IAMHERE34 }, |
108 | { "mobregreq", ICMP_MOBILE_REGREQUEST35 }, |
109 | { "mobregrep", ICMP_MOBILE_REGREPLY36 }, |
110 | { "skip", ICMP_SKIP39 }, |
111 | { "photuris", ICMP_PHOTURIS40 } |
112 | }; |
113 | |
114 | static const struct icmptypeent icmp6_type[] = { |
115 | { "unreach", ICMP6_DST_UNREACH1 }, |
116 | { "toobig", ICMP6_PACKET_TOO_BIG2 }, |
117 | { "timex", ICMP6_TIME_EXCEEDED3 }, |
118 | { "paramprob", ICMP6_PARAM_PROB4 }, |
119 | { "echoreq", ICMP6_ECHO_REQUEST128 }, |
120 | { "echorep", ICMP6_ECHO_REPLY129 }, |
121 | { "groupqry", ICMP6_MEMBERSHIP_QUERY130 }, |
122 | { "listqry", MLD_LISTENER_QUERY130 }, |
123 | { "grouprep", ICMP6_MEMBERSHIP_REPORT131 }, |
124 | { "listenrep", MLD_LISTENER_REPORT131 }, |
125 | { "groupterm", ICMP6_MEMBERSHIP_REDUCTION132 }, |
126 | { "listendone", MLD_LISTENER_DONE132 }, |
127 | { "routersol", ND_ROUTER_SOLICIT133 }, |
128 | { "routeradv", ND_ROUTER_ADVERT134 }, |
129 | { "neighbrsol", ND_NEIGHBOR_SOLICIT135 }, |
130 | { "neighbradv", ND_NEIGHBOR_ADVERT136 }, |
131 | { "redir", ND_REDIRECT137 }, |
132 | { "routrrenum", ICMP6_ROUTER_RENUMBERING138 }, |
133 | { "wrureq", ICMP6_WRUREQUEST139 }, |
134 | { "wrurep", ICMP6_WRUREPLY140 }, |
135 | { "fqdnreq", ICMP6_FQDN_QUERY139 }, |
136 | { "fqdnrep", ICMP6_FQDN_REPLY140 }, |
137 | { "niqry", ICMP6_NI_QUERY139 }, |
138 | { "nirep", ICMP6_NI_REPLY140 }, |
139 | { "mtraceresp", MLD_MTRACE_RESP200 }, |
140 | { "mtrace", MLD_MTRACE201 }, |
141 | { "listenrepv2", MLDV2_LISTENER_REPORT143 }, |
142 | }; |
143 | |
144 | static const struct icmpcodeent icmp_code[] = { |
145 | { "net-unr", ICMP_UNREACH3, ICMP_UNREACH_NET0 }, |
146 | { "host-unr", ICMP_UNREACH3, ICMP_UNREACH_HOST1 }, |
147 | { "proto-unr", ICMP_UNREACH3, ICMP_UNREACH_PROTOCOL2 }, |
148 | { "port-unr", ICMP_UNREACH3, ICMP_UNREACH_PORT3 }, |
149 | { "needfrag", ICMP_UNREACH3, ICMP_UNREACH_NEEDFRAG4 }, |
150 | { "srcfail", ICMP_UNREACH3, ICMP_UNREACH_SRCFAIL5 }, |
151 | { "net-unk", ICMP_UNREACH3, ICMP_UNREACH_NET_UNKNOWN6 }, |
152 | { "host-unk", ICMP_UNREACH3, ICMP_UNREACH_HOST_UNKNOWN7 }, |
153 | { "isolate", ICMP_UNREACH3, ICMP_UNREACH_ISOLATED8 }, |
154 | { "net-prohib", ICMP_UNREACH3, ICMP_UNREACH_NET_PROHIB9 }, |
155 | { "host-prohib", ICMP_UNREACH3, ICMP_UNREACH_HOST_PROHIB10 }, |
156 | { "net-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSNET11 }, |
157 | { "host-tos", ICMP_UNREACH3, ICMP_UNREACH_TOSHOST12 }, |
158 | { "filter-prohib", ICMP_UNREACH3, ICMP_UNREACH_FILTER_PROHIB13 }, |
159 | { "host-preced", ICMP_UNREACH3, ICMP_UNREACH_HOST_PRECEDENCE14 }, |
160 | { "cutoff-preced", ICMP_UNREACH3, ICMP_UNREACH_PRECEDENCE_CUTOFF15 }, |
161 | { "redir-net", ICMP_REDIRECT5, ICMP_REDIRECT_NET0 }, |
162 | { "redir-host", ICMP_REDIRECT5, ICMP_REDIRECT_HOST1 }, |
163 | { "redir-tos-net", ICMP_REDIRECT5, ICMP_REDIRECT_TOSNET2 }, |
164 | { "redir-tos-host", ICMP_REDIRECT5, ICMP_REDIRECT_TOSHOST3 }, |
165 | { "normal-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NORMAL0 }, |
166 | { "common-adv", ICMP_ROUTERADVERT9, ICMP_ROUTERADVERT_NOROUTE_COMMON16 }, |
167 | { "transit", ICMP_TIMXCEED11, ICMP_TIMXCEED_INTRANS0 }, |
168 | { "reassemb", ICMP_TIMXCEED11, ICMP_TIMXCEED_REASS1 }, |
169 | { "badhead", ICMP_PARAMPROB12, ICMP_PARAMPROB_ERRATPTR0 }, |
170 | { "optmiss", ICMP_PARAMPROB12, ICMP_PARAMPROB_OPTABSENT1 }, |
171 | { "badlen", ICMP_PARAMPROB12, ICMP_PARAMPROB_LENGTH2 }, |
172 | { "unknown-ind", ICMP_PHOTURIS40, ICMP_PHOTURIS_UNKNOWN_INDEX1 }, |
173 | { "auth-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_AUTH_FAILED2 }, |
174 | { "decrypt-fail", ICMP_PHOTURIS40, ICMP_PHOTURIS_DECRYPT_FAILED3 } |
175 | }; |
176 | |
177 | static const struct icmpcodeent icmp6_code[] = { |
178 | { "admin-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADMIN1 }, |
179 | { "noroute-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOROUTE0 }, |
180 | { "beyond-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_BEYONDSCOPE2 }, |
181 | { "addr-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_ADDR3 }, |
182 | { "port-unr", ICMP6_DST_UNREACH1, ICMP6_DST_UNREACH_NOPORT4 }, |
183 | { "transit", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_TRANSIT0 }, |
184 | { "reassemb", ICMP6_TIME_EXCEEDED3, ICMP6_TIME_EXCEED_REASSEMBLY1 }, |
185 | { "badhead", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_HEADER0 }, |
186 | { "nxthdr", ICMP6_PARAM_PROB4, ICMP6_PARAMPROB_NEXTHEADER1 }, |
187 | { "redironlink", ND_REDIRECT137, ND_REDIRECT_ONLINK0 }, |
188 | { "redirrouter", ND_REDIRECT137, ND_REDIRECT_ROUTER1 } |
189 | }; |
190 | |
191 | const struct pf_timeout pf_timeouts[] = { |
192 | { "tcp.first", PFTM_TCP_FIRST_PACKET }, |
193 | { "tcp.opening", PFTM_TCP_OPENING }, |
194 | { "tcp.established", PFTM_TCP_ESTABLISHED }, |
195 | { "tcp.closing", PFTM_TCP_CLOSING }, |
196 | { "tcp.finwait", PFTM_TCP_FIN_WAIT }, |
197 | { "tcp.closed", PFTM_TCP_CLOSED }, |
198 | { "tcp.tsdiff", PFTM_TS_DIFF }, |
199 | { "udp.first", PFTM_UDP_FIRST_PACKET }, |
200 | { "udp.single", PFTM_UDP_SINGLE }, |
201 | { "udp.multiple", PFTM_UDP_MULTIPLE }, |
202 | { "icmp.first", PFTM_ICMP_FIRST_PACKET }, |
203 | { "icmp.error", PFTM_ICMP_ERROR_REPLY }, |
204 | { "other.first", PFTM_OTHER_FIRST_PACKET }, |
205 | { "other.single", PFTM_OTHER_SINGLE }, |
206 | { "other.multiple", PFTM_OTHER_MULTIPLE }, |
207 | { "frag", PFTM_FRAG }, |
208 | { "interval", PFTM_INTERVAL }, |
209 | { "adaptive.start", PFTM_ADAPTIVE_START }, |
210 | { "adaptive.end", PFTM_ADAPTIVE_END }, |
211 | { "src.track", PFTM_SRC_NODE }, |
212 | { NULL((void *)0), 0 } |
213 | }; |
214 | |
215 | enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; |
216 | |
217 | void |
218 | copy_satopfaddr(struct pf_addr *pfa, struct sockaddr *sa) |
219 | { |
220 | if (sa->sa_family == AF_INET624) |
221 | pfa->v6pfa.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr; |
222 | else if (sa->sa_family == AF_INET2) |
223 | pfa->v4pfa.v4 = ((struct sockaddr_in *)sa)->sin_addr; |
224 | else |
225 | warnx("unhandled af %d", sa->sa_family); |
226 | } |
227 | |
228 | const struct icmptypeent * |
229 | geticmptypebynumber(u_int8_t type, sa_family_t af) |
230 | { |
231 | size_t i; |
232 | |
233 | if (af != AF_INET624) { |
234 | for (i = 0; i < nitems(icmp_type)(sizeof((icmp_type)) / sizeof((icmp_type)[0])); i++) { |
235 | if (type == icmp_type[i].type) |
236 | return (&icmp_type[i]); |
237 | } |
238 | } else { |
239 | for (i = 0; i < nitems(icmp6_type)(sizeof((icmp6_type)) / sizeof((icmp6_type)[0])); i++) { |
240 | if (type == icmp6_type[i].type) |
241 | return (&icmp6_type[i]); |
242 | } |
243 | } |
244 | return (NULL((void *)0)); |
245 | } |
246 | |
247 | const struct icmptypeent * |
248 | geticmptypebyname(char *w, sa_family_t af) |
249 | { |
250 | size_t i; |
251 | |
252 | if (af != AF_INET624) { |
253 | for (i = 0; i < nitems(icmp_type)(sizeof((icmp_type)) / sizeof((icmp_type)[0])); i++) { |
254 | if (!strcmp(w, icmp_type[i].name)) |
255 | return (&icmp_type[i]); |
256 | } |
257 | } else { |
258 | for (i = 0; i < nitems(icmp6_type)(sizeof((icmp6_type)) / sizeof((icmp6_type)[0])); i++) { |
259 | if (!strcmp(w, icmp6_type[i].name)) |
260 | return (&icmp6_type[i]); |
261 | } |
262 | } |
263 | return (NULL((void *)0)); |
264 | } |
265 | |
266 | const struct icmpcodeent * |
267 | geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) |
268 | { |
269 | size_t i; |
270 | |
271 | if (af != AF_INET624) { |
272 | for (i = 0; i < nitems(icmp_code)(sizeof((icmp_code)) / sizeof((icmp_code)[0])); i++) { |
273 | if (type == icmp_code[i].type && |
274 | code == icmp_code[i].code) |
275 | return (&icmp_code[i]); |
276 | } |
277 | } else { |
278 | for (i = 0; i < nitems(icmp6_code)(sizeof((icmp6_code)) / sizeof((icmp6_code)[0])); i++) { |
279 | if (type == icmp6_code[i].type && |
280 | code == icmp6_code[i].code) |
281 | return (&icmp6_code[i]); |
282 | } |
283 | } |
284 | return (NULL((void *)0)); |
285 | } |
286 | |
287 | const struct icmpcodeent * |
288 | geticmpcodebyname(u_long type, char *w, sa_family_t af) |
289 | { |
290 | size_t i; |
291 | |
292 | if (af != AF_INET624) { |
293 | for (i = 0; i < nitems(icmp_code)(sizeof((icmp_code)) / sizeof((icmp_code)[0])); i++) { |
294 | if (type == icmp_code[i].type && |
295 | !strcmp(w, icmp_code[i].name)) |
296 | return (&icmp_code[i]); |
297 | } |
298 | } else { |
299 | for (i = 0; i < nitems(icmp6_code)(sizeof((icmp6_code)) / sizeof((icmp6_code)[0])); i++) { |
300 | if (type == icmp6_code[i].type && |
301 | !strcmp(w, icmp6_code[i].name)) |
302 | return (&icmp6_code[i]); |
303 | } |
304 | } |
305 | return (NULL((void *)0)); |
306 | } |
307 | |
308 | /* |
309 | * Decode a symbolic name to a numeric value. |
310 | * From syslogd. |
311 | */ |
312 | int |
313 | string_to_loglevel(const char *name) |
314 | { |
315 | CODE *c; |
316 | char *p, buf[40]; |
317 | |
318 | if (isdigit((unsigned char)*name)) { |
319 | const char *errstr; |
320 | int val; |
321 | |
322 | val = strtonum(name, 0, LOG_DEBUG7, &errstr); |
323 | if (errstr) |
324 | return -1; |
325 | return val; |
326 | } |
327 | |
328 | for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { |
329 | if (isupper((unsigned char)*name)) |
330 | *p = tolower((unsigned char)*name); |
331 | else |
332 | *p = *name; |
333 | } |
334 | *p = '\0'; |
335 | for (c = prioritynames; c->c_name; c++) |
336 | if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI0x10) |
337 | return (c->c_val); |
338 | |
339 | return (-1); |
340 | } |
341 | |
342 | const char * |
343 | loglevel_to_string(int level) |
344 | { |
345 | CODE *c; |
346 | |
347 | for (c = prioritynames; c->c_name; c++) |
348 | if (c->c_val == level) |
349 | return (c->c_name); |
350 | |
351 | return ("unknown"); |
352 | } |
353 | |
354 | void |
355 | print_op(u_int8_t op, const char *a1, const char *a2) |
356 | { |
357 | if (op == PF_OP_IRG) |
358 | printf(" %s >< %s", a1, a2); |
359 | else if (op == PF_OP_XRG) |
360 | printf(" %s <> %s", a1, a2); |
361 | else if (op == PF_OP_EQ) |
362 | printf(" = %s", a1); |
363 | else if (op == PF_OP_NE) |
364 | printf(" != %s", a1); |
365 | else if (op == PF_OP_LT) |
366 | printf(" < %s", a1); |
367 | else if (op == PF_OP_LE) |
368 | printf(" <= %s", a1); |
369 | else if (op == PF_OP_GT) |
370 | printf(" > %s", a1); |
371 | else if (op == PF_OP_GE) |
372 | printf(" >= %s", a1); |
373 | else if (op == PF_OP_RRG) |
374 | printf(" %s:%s", a1, a2); |
375 | } |
376 | |
377 | void |
378 | print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) |
379 | { |
380 | char a1[6], a2[6]; |
381 | struct servent *s = NULL((void *)0); |
382 | |
383 | if (opts & PF_OPT_PORTNAMES0x08000) |
384 | s = getservbyport(p1, proto); |
385 | p1 = ntohs(p1)(__uint16_t)(__builtin_constant_p(p1) ? (__uint16_t)(((__uint16_t )(p1) & 0xffU) << 8 | ((__uint16_t)(p1) & 0xff00U ) >> 8) : __swap16md(p1)); |
386 | p2 = ntohs(p2)(__uint16_t)(__builtin_constant_p(p2) ? (__uint16_t)(((__uint16_t )(p2) & 0xffU) << 8 | ((__uint16_t)(p2) & 0xff00U ) >> 8) : __swap16md(p2)); |
387 | snprintf(a1, sizeof(a1), "%u", p1); |
388 | snprintf(a2, sizeof(a2), "%u", p2); |
389 | printf(" port"); |
390 | if (s != NULL((void *)0) && (op == PF_OP_EQ || op == PF_OP_NE)) |
391 | print_op(op, s->s_name, a2); |
392 | else |
393 | print_op(op, a1, a2); |
394 | } |
395 | |
396 | void |
397 | print_ugid(u_int8_t op, id_t i1, id_t i2, const char *t) |
398 | { |
399 | char a1[11], a2[11]; |
400 | |
401 | snprintf(a1, sizeof(a1), "%u", i1); |
402 | snprintf(a2, sizeof(a2), "%u", i2); |
403 | printf(" %s", t); |
404 | if (i1 == -1 && (op == PF_OP_EQ || op == PF_OP_NE)) |
405 | print_op(op, "unknown", a2); |
406 | else |
407 | print_op(op, a1, a2); |
408 | } |
409 | |
410 | void |
411 | print_flags(u_int8_t f) |
412 | { |
413 | int i; |
414 | |
415 | for (i = 0; tcpflags[i]; ++i) |
416 | if (f & (1 << i)) |
417 | printf("%c", tcpflags[i]); |
418 | } |
419 | |
420 | void |
421 | print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, |
422 | sa_family_t af, u_int8_t proto, int opts) |
423 | { |
424 | char buf[PF_OSFP_LEN32*3]; |
425 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); |
426 | if (src->addr.type == PF_ADDR_ADDRMASK && |
427 | dst->addr.type == PF_ADDR_ADDRMASK && |
428 | PF_AZERO(&src->addr.v.a.addr, AF_INET6)((24 == 2 && !(&src->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.addr)-> pfa.addr32[0] && !(&src->addr.v.a.addr)->pfa .addr32[1] && !(&src->addr.v.a.addr)->pfa.addr32 [2] && !(&src->addr.v.a.addr)->pfa.addr32[3 ] )) && |
429 | PF_AZERO(&src->addr.v.a.mask, AF_INET6)((24 == 2 && !(&src->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&src->addr.v.a.mask)-> pfa.addr32[0] && !(&src->addr.v.a.mask)->pfa .addr32[1] && !(&src->addr.v.a.mask)->pfa.addr32 [2] && !(&src->addr.v.a.mask)->pfa.addr32[3 ] )) && |
430 | PF_AZERO(&dst->addr.v.a.addr, AF_INET6)((24 == 2 && !(&dst->addr.v.a.addr)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.addr)-> pfa.addr32[0] && !(&dst->addr.v.a.addr)->pfa .addr32[1] && !(&dst->addr.v.a.addr)->pfa.addr32 [2] && !(&dst->addr.v.a.addr)->pfa.addr32[3 ] )) && |
431 | PF_AZERO(&dst->addr.v.a.mask, AF_INET6)((24 == 2 && !(&dst->addr.v.a.mask)->pfa.addr32 [0]) || (24 == 24 && !(&dst->addr.v.a.mask)-> pfa.addr32[0] && !(&dst->addr.v.a.mask)->pfa .addr32[1] && !(&dst->addr.v.a.mask)->pfa.addr32 [2] && !(&dst->addr.v.a.mask)->pfa.addr32[3 ] )) && |
432 | !src->neg && !dst->neg && |
433 | !src->port_op && !dst->port_op && |
434 | osfp == PF_OSFP_ANY((pf_osfp_t)0)) |
435 | printf(" all"); |
436 | else { |
437 | printf(" from "); |
438 | if (src->neg) |
439 | printf("! "); |
440 | print_addr(&src->addr, af, verbose); |
441 | if (src->port_op) |
442 | print_port(src->port_op, src->port[0], |
443 | src->port[1], |
444 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); |
445 | if (osfp != PF_OSFP_ANY((pf_osfp_t)0)) |
446 | printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, |
447 | sizeof(buf))); |
448 | |
449 | printf(" to "); |
450 | if (dst->neg) |
451 | printf("! "); |
452 | print_addr(&dst->addr, af, verbose); |
453 | if (dst->port_op) |
454 | print_port(dst->port_op, dst->port[0], |
455 | dst->port[1], |
456 | proto == IPPROTO_TCP6 ? "tcp" : "udp", opts); |
457 | } |
458 | } |
459 | |
460 | void |
461 | print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, |
462 | sa_family_t af, int id, int verbose) |
463 | { |
464 | if (pool->ifname[0]) { |
465 | if (!PF_AZERO(&pool->addr.v.a.addr, af)((af == 2 && !(&pool->addr.v.a.addr)->pfa.addr32 [0]) || (af == 24 && !(&pool->addr.v.a.addr)-> pfa.addr32[0] && !(&pool->addr.v.a.addr)->pfa .addr32[1] && !(&pool->addr.v.a.addr)->pfa. addr32[2] && !(&pool->addr.v.a.addr)->pfa.addr32 [3] ))) { |
466 | print_addr(&pool->addr, af, verbose); |
467 | printf("@"); |
468 | } |
469 | printf("%s", pool->ifname); |
470 | } else |
471 | print_addr(&pool->addr, af, verbose); |
472 | switch (id) { |
473 | case PF_POOL_NAT: |
474 | if ((p1 != PF_NAT_PROXY_PORT_LOW50001 || |
475 | p2 != PF_NAT_PROXY_PORT_HIGH65535) && (p1 != 0 || p2 != 0)) { |
476 | if (p1 == p2) |
477 | printf(" port %u", p1); |
478 | else |
479 | printf(" port %u:%u", p1, p2); |
480 | } |
481 | break; |
482 | case PF_POOL_RDR: |
483 | if (p1) { |
484 | printf(" port %u", p1); |
485 | if (p2 && (p2 != p1)) |
486 | printf(":%u", p2); |
487 | } |
488 | break; |
489 | default: |
490 | break; |
491 | } |
492 | switch (pool->opts & PF_POOL_TYPEMASK0x0f) { |
493 | case PF_POOL_NONE: |
494 | break; |
495 | case PF_POOL_BITMASK: |
496 | printf(" bitmask"); |
497 | break; |
498 | case PF_POOL_RANDOM: |
499 | printf(" random"); |
500 | break; |
501 | case PF_POOL_SRCHASH: |
502 | printf(" source-hash 0x%08x%08x%08x%08x", |
503 | pool->key.key32pfk.key32[0], pool->key.key32pfk.key32[1], |
504 | pool->key.key32pfk.key32[2], pool->key.key32pfk.key32[3]); |
505 | break; |
506 | case PF_POOL_ROUNDROBIN: |
507 | printf(" round-robin"); |
508 | break; |
509 | case PF_POOL_LEASTSTATES: |
510 | printf(" least-states"); |
511 | break; |
512 | } |
513 | if (pool->opts & PF_POOL_STICKYADDR0x20) |
514 | printf(" sticky-address"); |
515 | if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) |
516 | printf(" static-port"); |
517 | } |
518 | |
519 | const char *pf_reasons[PFRES_MAX17+1] = PFRES_NAMES{ "match", "bad-offset", "fragment", "short", "normalize", "memory" , "bad-timestamp", "congestion", "ip-option", "proto-cksum", "state-mismatch" , "state-insert", "state-limit", "src-limit", "synproxy", "translate" , "no-route", ((void *)0) }; |
520 | const char *pf_lcounters[LCNT_MAX10+1] = LCNT_NAMES{ "max states per rule", "max-src-states", "max-src-nodes", "max-src-conn" , "max-src-conn-rate", "overload table insertion", "overload flush states" , "synfloods detected", "syncookies sent", "syncookies validated" , ((void *)0) }; |
521 | const char *pf_fcounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; |
522 | const char *pf_scounters[FCNT_MAX3+1] = FCNT_NAMES{ "searches", "inserts", "removals", ((void *)0) }; |
523 | |
524 | void |
525 | print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts) |
526 | { |
527 | char statline[80], *running, *debug; |
528 | time_t runtime = 0; |
529 | struct timespec uptime; |
530 | int i; |
531 | char buf[PF_MD5_DIGEST_LENGTH16 * 2 + 1]; |
532 | static const char hex[] = "0123456789abcdef"; |
533 | |
534 | if (!clock_gettime(CLOCK_BOOTTIME6, &uptime)) |
535 | runtime = uptime.tv_sec - s->since; |
536 | running = s->running ? "Enabled" : "Disabled"; |
537 | |
538 | if (runtime) { |
539 | unsigned int sec, min, hrs; |
540 | time_t day = runtime; |
541 | |
542 | sec = day % 60; |
543 | day /= 60; |
544 | min = day % 60; |
545 | day /= 60; |
546 | hrs = day % 24; |
547 | day /= 24; |
548 | snprintf(statline, sizeof(statline), |
549 | "Status: %s for %lld days %.2u:%.2u:%.2u", |
550 | running, (long long)day, hrs, min, sec); |
551 | } else |
552 | snprintf(statline, sizeof(statline), "Status: %s", running); |
553 | printf("%-44s", statline); |
554 | if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) { |
555 | printf("%15s\n\n", debug); |
556 | free(debug); |
557 | } |
558 | |
559 | if (opts & PF_OPT_VERBOSE0x00004) { |
560 | printf("Hostid: 0x%08x\n", ntohl(s->hostid)(__uint32_t)(__builtin_constant_p(s->hostid) ? (__uint32_t )(((__uint32_t)(s->hostid) & 0xff) << 24 | ((__uint32_t )(s->hostid) & 0xff00) << 8 | ((__uint32_t)(s-> hostid) & 0xff0000) >> 8 | ((__uint32_t)(s->hostid ) & 0xff000000) >> 24) : __swap32md(s->hostid))); |
561 | |
562 | for (i = 0; i < PF_MD5_DIGEST_LENGTH16; i++) { |
563 | buf[i + i] = hex[s->pf_chksum[i] >> 4]; |
564 | buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; |
565 | } |
566 | buf[i + i] = '\0'; |
567 | printf("Checksum: 0x%s\n\n", buf); |
568 | } |
569 | |
570 | if (s->ifname[0] != 0) { |
571 | printf("Interface Stats for %-16s %5s %16s\n", |
572 | s->ifname, "IPv4", "IPv6"); |
573 | printf(" %-25s %14llu %16llu\n", "Bytes In", |
574 | (unsigned long long)s->bcounters[0][0], |
575 | (unsigned long long)s->bcounters[1][0]); |
576 | printf(" %-25s %14llu %16llu\n", "Bytes Out", |
577 | (unsigned long long)s->bcounters[0][1], |
578 | (unsigned long long)s->bcounters[1][1]); |
579 | printf(" Packets In\n"); |
580 | printf(" %-23s %14llu %16llu\n", "Passed", |
581 | (unsigned long long)s->pcounters[0][0][PF_PASS], |
582 | (unsigned long long)s->pcounters[1][0][PF_PASS]); |
583 | printf(" %-23s %14llu %16llu\n", "Blocked", |
584 | (unsigned long long)s->pcounters[0][0][PF_DROP], |
585 | (unsigned long long)s->pcounters[1][0][PF_DROP]); |
586 | printf(" Packets Out\n"); |
587 | printf(" %-23s %14llu %16llu\n", "Passed", |
588 | (unsigned long long)s->pcounters[0][1][PF_PASS], |
589 | (unsigned long long)s->pcounters[1][1][PF_PASS]); |
590 | printf(" %-23s %14llu %16llu\n\n", "Blocked", |
591 | (unsigned long long)s->pcounters[0][1][PF_DROP], |
592 | (unsigned long long)s->pcounters[1][1][PF_DROP]); |
593 | } |
594 | printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); |
595 | printf(" %-25s %14u %14s\n", "current entries", s->states, ""); |
596 | printf(" %-25s %14u %14s\n", "half-open tcp", s->states_halfopen, ""); |
597 | for (i = 0; i < FCNT_MAX3; i++) { |
598 | printf(" %-25s %14llu ", pf_fcounters[i], |
599 | (unsigned long long)s->fcounters[i]); |
600 | if (runtime > 0) |
601 | printf("%14.1f/s\n", |
602 | (double)s->fcounters[i] / (double)runtime); |
603 | else |
604 | printf("%14s\n", ""); |
605 | } |
606 | if (opts & PF_OPT_VERBOSE0x00004) { |
607 | printf("Source Tracking Table\n"); |
608 | printf(" %-25s %14u %14s\n", "current entries", |
609 | s->src_nodes, ""); |
610 | for (i = 0; i < SCNT_MAX3; i++) { |
611 | printf(" %-25s %14lld ", pf_scounters[i], |
612 | s->scounters[i]); |
613 | if (runtime > 0) |
614 | printf("%14.1f/s\n", |
615 | (double)s->scounters[i] / (double)runtime); |
616 | else |
617 | printf("%14s\n", ""); |
618 | } |
619 | } |
620 | printf("Counters\n"); |
621 | for (i = 0; i < PFRES_MAX17; i++) { |
622 | printf(" %-25s %14llu ", pf_reasons[i], |
623 | (unsigned long long)s->counters[i]); |
624 | if (runtime > 0) |
625 | printf("%14.1f/s\n", |
626 | (double)s->counters[i] / (double)runtime); |
627 | else |
628 | printf("%14s\n", ""); |
629 | } |
630 | if (opts & PF_OPT_VERBOSE0x00004) { |
631 | printf("Limit Counters\n"); |
632 | for (i = 0; i < LCNT_MAX10; i++) { |
633 | printf(" %-25s %14lld ", pf_lcounters[i], |
634 | s->lcounters[i]); |
635 | if (runtime > 0) |
636 | printf("%14.1f/s\n", |
637 | (double)s->lcounters[i] / (double)runtime); |
638 | else |
639 | printf("%14s\n", ""); |
640 | } |
641 | } |
642 | if (opts & PF_OPT_VERBOSE0x00004) { |
643 | printf("Adaptive Syncookies Watermarks\n"); |
644 | printf(" %-25s %14d states\n", "start", synflwats->hi); |
645 | printf(" %-25s %14d states\n", "end", synflwats->lo); |
646 | } |
647 | } |
648 | |
649 | void |
650 | print_src_node(struct pf_src_node *sn, int opts) |
651 | { |
652 | struct pf_addr_wrap aw; |
653 | int min, sec; |
654 | |
655 | memset(&aw, 0, sizeof(aw)); |
656 | if (sn->af == AF_INET2) |
657 | aw.v.a.mask.addr32pfa.addr32[0] = 0xffffffff; |
658 | else |
659 | memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); |
660 | |
661 | aw.v.a.addr = sn->addr; |
662 | print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE20x00080); |
663 | |
664 | if (!PF_AZERO(&sn->raddr, sn->af)((sn->af == 2 && !(&sn->raddr)->pfa.addr32 [0]) || (sn->af == 24 && !(&sn->raddr)-> pfa.addr32[0] && !(&sn->raddr)->pfa.addr32[ 1] && !(&sn->raddr)->pfa.addr32[2] && !(&sn->raddr)->pfa.addr32[3] ))) { |
665 | if (sn->type == PF_SN_NAT) |
666 | printf(" nat-to "); |
667 | else if (sn->type == PF_SN_RDR) |
668 | printf(" rdr-to "); |
669 | else if (sn->type == PF_SN_ROUTE) |
670 | printf(" route-to "); |
671 | else |
672 | printf(" ??? (%u) ", sn->type); |
673 | aw.v.a.addr = sn->raddr; |
674 | print_addr(&aw, sn->naf ? sn->naf : sn->af, |
675 | opts & PF_OPT_VERBOSE20x00080); |
676 | } |
677 | |
678 | printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, |
679 | sn->conn, sn->conn_rate.count / 1000, |
680 | (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); |
681 | if (opts & PF_OPT_VERBOSE0x00004) { |
682 | sec = sn->creation % 60; |
683 | sn->creation /= 60; |
684 | min = sn->creation % 60; |
685 | sn->creation /= 60; |
686 | printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); |
687 | if (sn->states == 0) { |
688 | sec = sn->expire % 60; |
689 | sn->expire /= 60; |
690 | min = sn->expire % 60; |
691 | sn->expire /= 60; |
692 | printf(", expires in %.2u:%.2u:%.2u", |
693 | sn->expire, min, sec); |
694 | } |
695 | printf(", %llu pkts, %llu bytes", |
696 | sn->packets[0] + sn->packets[1], |
697 | sn->bytes[0] + sn->bytes[1]); |
698 | if (sn->rule.nr != -1) |
699 | printf(", rule %u", sn->rule.nr); |
700 | printf("\n"); |
701 | } |
702 | } |
703 | |
704 | void |
705 | print_rule(struct pf_rule *r, const char *anchor_call, int opts) |
706 | { |
707 | static const char *actiontypes[] = { "pass", "block", "scrub", |
708 | "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", |
709 | "", "", "match"}; |
710 | static const char *anchortypes[] = { "anchor", "anchor", "anchor", |
711 | "anchor", "nat-anchor", "nat-anchor", "binat-anchor", |
712 | "binat-anchor", "rdr-anchor", "rdr-anchor" }; |
713 | int i, ropts; |
714 | int verbose = opts & (PF_OPT_VERBOSE20x00080 | PF_OPT_DEBUG0x00200); |
715 | char *p; |
716 | |
717 | if ((r->rule_flag & PFRULE_EXPIRED0x00400000) && (!verbose)) |
718 | return; |
719 | |
720 | if (verbose) |
721 | printf("@%d ", r->nr); |
722 | |
723 | if (r->action > PF_MATCH) |
724 | printf("action(%d)", r->action); |
725 | else if (anchor_call[0]) { |
726 | p = strrchr(anchor_call, '/'); |
727 | if (p ? p[1] == '_' : anchor_call[0] == '_') |
728 | printf("%s", anchortypes[r->action]); |
729 | else |
730 | printf("%s \"%s\"", anchortypes[r->action], |
731 | anchor_call); |
732 | } else |
733 | printf("%s", actiontypes[r->action]); |
734 | if (r->action == PF_DROP) { |
735 | if (r->rule_flag & PFRULE_RETURN0x0008) |
736 | printf(" return"); |
737 | else if (r->rule_flag & PFRULE_RETURNRST0x0001) { |
738 | if (!r->return_ttl) |
739 | printf(" return-rst"); |
740 | else |
741 | printf(" return-rst(ttl %d)", r->return_ttl); |
742 | } else if (r->rule_flag & PFRULE_RETURNICMP0x0004) { |
743 | const struct icmpcodeent *ic, *ic6; |
744 | |
745 | ic = geticmpcodebynumber(r->return_icmp >> 8, |
746 | r->return_icmp & 255, AF_INET2); |
747 | ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, |
748 | r->return_icmp6 & 255, AF_INET624); |
749 | |
750 | switch (r->af) { |
751 | case AF_INET2: |
752 | printf(" return-icmp"); |
753 | if (ic == NULL((void *)0)) |
754 | printf("(%u)", r->return_icmp & 255); |
755 | else |
756 | printf("(%s)", ic->name); |
757 | break; |
758 | case AF_INET624: |
759 | printf(" return-icmp6"); |
760 | if (ic6 == NULL((void *)0)) |
761 | printf("(%u)", r->return_icmp6 & 255); |
762 | else |
763 | printf("(%s)", ic6->name); |
764 | break; |
765 | default: |
766 | printf(" return-icmp"); |
767 | if (ic == NULL((void *)0)) |
768 | printf("(%u, ", r->return_icmp & 255); |
769 | else |
770 | printf("(%s, ", ic->name); |
771 | if (ic6 == NULL((void *)0)) |
772 | printf("%u)", r->return_icmp6 & 255); |
773 | else |
774 | printf("%s)", ic6->name); |
775 | break; |
776 | } |
777 | } else |
778 | printf(" drop"); |
779 | } |
780 | if (r->direction == PF_IN) |
781 | printf(" in"); |
782 | else if (r->direction == PF_OUT) |
783 | printf(" out"); |
784 | if (r->log) { |
785 | printf(" log"); |
786 | if (r->log & ~PF_LOG0x01 || r->logif) { |
787 | int count = 0; |
788 | |
789 | printf(" ("); |
790 | if (r->log & PF_LOG_ALL0x02) |
791 | printf("%sall", count++ ? ", " : ""); |
792 | if (r->log & PF_LOG_MATCHES0x10) |
793 | printf("%smatches", count++ ? ", " : ""); |
794 | if (r->log & PF_LOG_USER0x04) |
795 | printf("%suser", count++ ? ", " : ""); |
796 | if (r->logif) |
797 | printf("%sto pflog%u", count++ ? ", " : "", |
798 | r->logif); |
799 | printf(")"); |
800 | } |
801 | } |
802 | if (r->quick) |
803 | printf(" quick"); |
804 | if (r->ifname[0]) { |
805 | if (r->ifnot) |
806 | printf(" on ! %s", r->ifname); |
807 | else |
808 | printf(" on %s", r->ifname); |
809 | } |
810 | if (r->onrdomain >= 0) { |
811 | if (r->ifnot) |
812 | printf(" on ! rdomain %d", r->onrdomain); |
813 | else |
814 | printf(" on rdomain %d", r->onrdomain); |
815 | } |
816 | if (r->af) { |
817 | if (r->af == AF_INET2) |
818 | printf(" inet"); |
819 | else |
820 | printf(" inet6"); |
821 | } |
822 | if (r->proto) { |
823 | struct protoent *p; |
824 | |
825 | if ((p = getprotobynumber(r->proto)) != NULL((void *)0)) |
826 | printf(" proto %s", p->p_name); |
827 | else |
828 | printf(" proto %u", r->proto); |
829 | } |
830 | print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, |
831 | opts); |
832 | if (r->rcv_ifname[0]) |
833 | printf(" %sreceived-on %s", r->rcvifnot ? "!" : "", |
834 | r->rcv_ifname); |
835 | if (r->uid.op) |
836 | print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user"); |
837 | if (r->gid.op) |
838 | print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group"); |
839 | if (r->flags || r->flagset) { |
840 | printf(" flags "); |
841 | print_flags(r->flags); |
842 | printf("/"); |
843 | print_flags(r->flagset); |
844 | } else if ((r->action == PF_PASS || r->action == PF_MATCH) && |
845 | (!r->proto || r->proto == IPPROTO_TCP6) && |
846 | !(r->rule_flag & PFRULE_FRAGMENT0x0002) && |
847 | !anchor_call[0] && r->keep_state) |
848 | printf(" flags any"); |
849 | if (r->type) { |
850 | const struct icmptypeent *it; |
851 | |
852 | it = geticmptypebynumber(r->type-1, r->af); |
853 | if (r->af != AF_INET624) |
854 | printf(" icmp-type"); |
855 | else |
856 | printf(" icmp6-type"); |
857 | if (it != NULL((void *)0)) |
858 | printf(" %s", it->name); |
859 | else |
860 | printf(" %u", r->type-1); |
861 | if (r->code) { |
862 | const struct icmpcodeent *ic; |
863 | |
864 | ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); |
865 | if (ic != NULL((void *)0)) |
866 | printf(" code %s", ic->name); |
867 | else |
868 | printf(" code %u", r->code-1); |
869 | } |
870 | } |
871 | if (r->tos) |
872 | printf(" tos 0x%2.2x", r->tos); |
873 | if (r->prio) |
874 | printf(" prio %u", r->prio == PF_PRIO_ZERO0xff ? 0 : r->prio); |
875 | if (r->pktrate.limit) |
876 | printf(" max-pkt-rate %u/%u", r->pktrate.limit, |
877 | r->pktrate.seconds); |
878 | |
879 | if (r->scrub_flags & PFSTATE_SETMASK(0x0040|0x0200) || r->qname[0] || |
880 | r->rule_flag & PFRULE_SETDELAY0x0080) { |
881 | char *comma = ""; |
882 | printf(" set ("); |
883 | if (r->scrub_flags & PFSTATE_SETPRIO0x0200) { |
884 | if (r->set_prio[0] == r->set_prio[1]) |
885 | printf("%sprio %u", comma, r->set_prio[0]); |
886 | else |
887 | printf("%sprio(%u, %u)", comma, r->set_prio[0], |
888 | r->set_prio[1]); |
889 | comma = ", "; |
890 | } |
891 | if (r->qname[0]) { |
892 | if (r->pqname[0]) |
893 | printf("%squeue(%s, %s)", comma, r->qname, |
894 | r->pqname); |
895 | else |
896 | printf("%squeue %s", comma, r->qname); |
897 | comma = ", "; |
898 | } |
899 | if (r->scrub_flags & PFSTATE_SETTOS0x0040) { |
900 | printf("%stos 0x%2.2x", comma, r->set_tos); |
901 | comma = ", "; |
902 | } |
903 | if (r->rule_flag & PFRULE_SETDELAY0x0080) { |
904 | printf("%sdelay %u", comma, r->delay); |
905 | comma = ", "; |
906 | } |
907 | printf(")"); |
908 | } |
909 | |
910 | ropts = 0; |
911 | if (r->max_states || r->max_src_nodes || r->max_src_states) |
912 | ropts = 1; |
913 | if (r->rule_flag & PFRULE_NOSYNC0x0010) |
914 | ropts = 1; |
915 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) |
916 | ropts = 1; |
917 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) |
918 | ropts = 1; |
919 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) |
920 | ropts = 1; |
921 | if (r->rule_flag & PFRULE_PFLOW0x00040000) |
922 | ropts = 1; |
923 | for (i = 0; !ropts && i < PFTM_MAX; ++i) |
924 | if (r->timeout[i]) |
925 | ropts = 1; |
926 | |
927 | if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) |
928 | printf(" no state"); |
929 | else if (r->keep_state == PF_STATE_NORMAL0x1 && ropts) |
930 | printf(" keep state"); |
931 | else if (r->keep_state == PF_STATE_MODULATE0x2) |
932 | printf(" modulate state"); |
933 | else if (r->keep_state == PF_STATE_SYNPROXY0x3) |
934 | printf(" synproxy state"); |
935 | if (r->prob) { |
936 | char buf[20]; |
937 | |
938 | snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX0xffffffffU+1.0)); |
939 | for (i = strlen(buf)-1; i > 0; i--) { |
940 | if (buf[i] == '0') |
941 | buf[i] = '\0'; |
942 | else { |
943 | if (buf[i] == '.') |
944 | buf[i] = '\0'; |
945 | break; |
946 | } |
947 | } |
948 | printf(" probability %s%%", buf); |
949 | } |
950 | if (ropts) { |
951 | printf(" ("); |
952 | if (r->max_states) { |
953 | printf("max %u", r->max_states); |
954 | ropts = 0; |
955 | } |
956 | if (r->rule_flag & PFRULE_NOSYNC0x0010) { |
957 | if (!ropts) |
958 | printf(", "); |
959 | printf("no-sync"); |
960 | ropts = 0; |
961 | } |
962 | if (r->rule_flag & PFRULE_SRCTRACK0x0020) { |
963 | if (!ropts) |
964 | printf(", "); |
965 | printf("source-track"); |
966 | if (r->rule_flag & PFRULE_RULESRCTRACK0x0040) |
967 | printf(" rule"); |
968 | else |
969 | printf(" global"); |
970 | ropts = 0; |
971 | } |
972 | if (r->max_src_states) { |
973 | if (!ropts) |
974 | printf(", "); |
975 | printf("max-src-states %u", r->max_src_states); |
976 | ropts = 0; |
977 | } |
978 | if (r->max_src_conn) { |
979 | if (!ropts) |
980 | printf(", "); |
981 | printf("max-src-conn %u", r->max_src_conn); |
982 | ropts = 0; |
983 | } |
984 | if (r->max_src_conn_rate.limit) { |
985 | if (!ropts) |
986 | printf(", "); |
987 | printf("max-src-conn-rate %u/%u", |
988 | r->max_src_conn_rate.limit, |
989 | r->max_src_conn_rate.seconds); |
990 | ropts = 0; |
991 | } |
992 | if (r->max_src_nodes) { |
993 | if (!ropts) |
994 | printf(", "); |
995 | printf("max-src-nodes %u", r->max_src_nodes); |
996 | ropts = 0; |
997 | } |
998 | if (r->overload_tblname[0]) { |
999 | if (!ropts) |
1000 | printf(", "); |
1001 | printf("overload <%s>", r->overload_tblname); |
1002 | if (r->flush) |
1003 | printf(" flush"); |
1004 | if (r->flush & PF_FLUSH_GLOBAL0x02) |
1005 | printf(" global"); |
1006 | } |
1007 | if (r->rule_flag & PFRULE_IFBOUND0x00010000) { |
1008 | if (!ropts) |
1009 | printf(", "); |
1010 | printf("if-bound"); |
1011 | ropts = 0; |
1012 | } |
1013 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000) { |
1014 | if (!ropts) |
1015 | printf(", "); |
1016 | printf("sloppy"); |
1017 | ropts = 0; |
1018 | } |
1019 | if (r->rule_flag & PFRULE_PFLOW0x00040000) { |
1020 | if (!ropts) |
1021 | printf(", "); |
1022 | printf("pflow"); |
1023 | ropts = 0; |
1024 | } |
1025 | for (i = 0; i < PFTM_MAX; ++i) |
1026 | if (r->timeout[i]) { |
1027 | int j; |
1028 | |
1029 | if (!ropts) |
1030 | printf(", "); |
1031 | ropts = 0; |
1032 | for (j = 0; pf_timeouts[j].name != NULL((void *)0); |
1033 | ++j) |
1034 | if (pf_timeouts[j].timeout == i) |
1035 | break; |
1036 | printf("%s %u", pf_timeouts[j].name == NULL((void *)0) ? |
1037 | "inv.timeout" : pf_timeouts[j].name, |
1038 | r->timeout[i]); |
1039 | } |
1040 | printf(")"); |
1041 | } |
1042 | |
1043 | if (r->rule_flag & PFRULE_FRAGMENT0x0002) |
1044 | printf(" fragment"); |
1045 | |
1046 | if (r->scrub_flags & PFSTATE_SCRUBMASK(0x0020|0x0080|0x0100) || r->min_ttl || r->max_mss) { |
1047 | printf(" scrub ("); |
1048 | ropts = 1; |
1049 | if (r->scrub_flags & PFSTATE_NODF0x0020) { |
1050 | printf("no-df"); |
1051 | ropts = 0; |
1052 | } |
1053 | if (r->scrub_flags & PFSTATE_RANDOMID0x0080) { |
1054 | if (!ropts) |
1055 | printf(" "); |
1056 | printf("random-id"); |
1057 | ropts = 0; |
1058 | } |
1059 | if (r->min_ttl) { |
1060 | if (!ropts) |
1061 | printf(" "); |
1062 | printf("min-ttl %d", r->min_ttl); |
1063 | ropts = 0; |
1064 | } |
1065 | if (r->scrub_flags & PFSTATE_SCRUB_TCP0x0100) { |
1066 | if (!ropts) |
1067 | printf(" "); |
1068 | printf("reassemble tcp"); |
1069 | ropts = 0; |
1070 | } |
1071 | if (r->max_mss) { |
1072 | if (!ropts) |
1073 | printf(" "); |
1074 | printf("max-mss %d", r->max_mss); |
1075 | ropts = 0; |
Value stored to 'ropts' is never read | |
1076 | } |
1077 | printf(")"); |
1078 | } |
1079 | |
1080 | if (r->allow_opts) |
1081 | printf(" allow-opts"); |
1082 | if (r->label[0]) |
1083 | printf(" label \"%s\"", r->label); |
1084 | if (r->rule_flag & PFRULE_ONCE0x00100000) |
1085 | printf(" once"); |
1086 | if (r->tagname[0]) |
1087 | printf(" tag %s", r->tagname); |
1088 | if (r->match_tagname[0]) { |
1089 | if (r->match_tag_not) |
1090 | printf(" !"); |
1091 | printf(" tagged %s", r->match_tagname); |
1092 | } |
1093 | if (r->rtableid != -1) |
1094 | printf(" rtable %u", r->rtableid); |
1095 | switch (r->divert.type) { |
1096 | case PF_DIVERT_NONE: |
1097 | break; |
1098 | case PF_DIVERT_TO: { |
1099 | printf(" divert-to "); |
1100 | print_addr_str(r->af, &r->divert.addr); |
1101 | printf(" port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); |
1102 | break; |
1103 | } |
1104 | case PF_DIVERT_REPLY: |
1105 | printf(" divert-reply"); |
1106 | break; |
1107 | case PF_DIVERT_PACKET: |
1108 | printf(" divert-packet port %u", ntohs(r->divert.port)(__uint16_t)(__builtin_constant_p(r->divert.port) ? (__uint16_t )(((__uint16_t)(r->divert.port) & 0xffU) << 8 | ( (__uint16_t)(r->divert.port) & 0xff00U) >> 8) : __swap16md (r->divert.port))); |
1109 | break; |
1110 | default: |
1111 | printf(" divert ???"); |
1112 | break; |
1113 | } |
1114 | |
1115 | if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && |
1116 | r->rule_flag & PFRULE_AFTO0x00200000) { |
1117 | printf(" af-to %s from ", r->naf == AF_INET2 ? "inet" : "inet6"); |
1118 | print_pool(&r->nat, r->nat.proxy_port[0], |
1119 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, |
1120 | PF_POOL_NAT, verbose); |
1121 | if (r->rdr.addr.type != PF_ADDR_NONE) { |
1122 | printf(" to "); |
1123 | print_pool(&r->rdr, r->rdr.proxy_port[0], |
1124 | r->rdr.proxy_port[1], r->naf ? r->naf : r->af, |
1125 | PF_POOL_RDR, verbose); |
1126 | } |
1127 | } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { |
1128 | printf (" nat-to "); |
1129 | print_pool(&r->nat, r->nat.proxy_port[0], |
1130 | r->nat.proxy_port[1], r->naf ? r->naf : r->af, |
1131 | PF_POOL_NAT, verbose); |
1132 | } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { |
1133 | printf (" rdr-to "); |
1134 | print_pool(&r->rdr, r->rdr.proxy_port[0], |
1135 | r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); |
1136 | } |
1137 | if (r->rt) { |
1138 | if (r->rt == PF_ROUTETO) |
1139 | printf(" route-to"); |
1140 | else if (r->rt == PF_REPLYTO) |
1141 | printf(" reply-to"); |
1142 | else if (r->rt == PF_DUPTO) |
1143 | printf(" dup-to"); |
1144 | printf(" "); |
1145 | print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); |
1146 | } |
1147 | |
1148 | if (r->rule_flag & PFRULE_EXPIRED0x00400000) |
1149 | printf(" # expired"); |
1150 | } |
1151 | |
1152 | void |
1153 | print_tabledef(const char *name, int flags, int addrs, |
1154 | struct node_tinithead *nodes) |
1155 | { |
1156 | struct node_tinit *ti, *nti; |
1157 | struct node_host *h; |
1158 | |
1159 | printf("table <%s>", name); |
1160 | if (flags & PFR_TFLAG_CONST0x00000002) |
1161 | printf(" const"); |
1162 | if (flags & PFR_TFLAG_PERSIST0x00000001) |
1163 | printf(" persist"); |
1164 | if (flags & PFR_TFLAG_COUNTERS0x00000040) |
1165 | printf(" counters"); |
1166 | SIMPLEQ_FOREACH(ti, nodes, entries)for((ti) = ((nodes)->sqh_first); (ti) != ((void *)0); (ti) = ((ti)->entries.sqe_next)) { |
1167 | if (ti->file) { |
1168 | printf(" file \"%s\"", ti->file); |
1169 | continue; |
1170 | } |
1171 | printf(" {"); |
1172 | for (;;) { |
1173 | for (h = ti->host; h != NULL((void *)0); h = h->next) { |
1174 | printf(h->not ? " !" : " "); |
1175 | print_addr(&h->addr, h->af, 0); |
1176 | if (h->ifname) |
1177 | printf("@%s", h->ifname); |
1178 | } |
1179 | nti = SIMPLEQ_NEXT(ti, entries)((ti)->entries.sqe_next); |
1180 | if (nti != NULL((void *)0) && nti->file == NULL((void *)0)) |
1181 | ti = nti; /* merge lists */ |
1182 | else |
1183 | break; |
1184 | } |
1185 | printf(" }"); |
1186 | } |
1187 | if (addrs && SIMPLEQ_EMPTY(nodes)(((nodes)->sqh_first) == ((void *)0))) |
1188 | printf(" { }"); |
1189 | printf("\n"); |
1190 | } |
1191 | |
1192 | void |
1193 | print_bwspec(const char *prefix, struct pf_queue_bwspec *bw) |
1194 | { |
1195 | u_int rate; |
1196 | int i; |
1197 | static const char unit[] = " KMG"; |
1198 | |
1199 | if (bw->percent) |
1200 | printf("%s%u%%", prefix, bw->percent); |
1201 | else if (bw->absolute) { |
1202 | rate = bw->absolute; |
1203 | for (i = 0; rate >= 1000 && i <= 3 && (rate % 1000 == 0); i++) |
1204 | rate /= 1000; |
1205 | printf("%s%u%c", prefix, rate, unit[i]); |
1206 | } |
1207 | } |
1208 | |
1209 | void |
1210 | print_scspec(const char *prefix, struct pf_queue_scspec *sc) |
1211 | { |
1212 | print_bwspec(prefix, &sc->m2); |
1213 | if (sc->d) { |
1214 | printf(" burst "); |
1215 | print_bwspec("", &sc->m1); |
1216 | printf(" for %ums", sc->d); |
1217 | } |
1218 | } |
1219 | |
1220 | void |
1221 | print_queuespec(struct pf_queuespec *q) |
1222 | { |
1223 | printf("queue %s", q->qname); |
1224 | if (q->parent[0]) |
1225 | printf(" parent %s", q->parent); |
1226 | else if (q->ifname[0]) |
1227 | printf(" on %s", q->ifname); |
1228 | if (q->flags & PFQS_FLOWQUEUE0x0001) { |
1229 | printf(" flows %u", q->flowqueue.flows); |
1230 | if (q->flowqueue.quantum > 0) |
1231 | printf(" quantum %u", q->flowqueue.quantum); |
1232 | if (q->flowqueue.interval > 0) |
1233 | printf(" interval %ums", |
1234 | q->flowqueue.interval / 1000000); |
1235 | if (q->flowqueue.target > 0) |
1236 | printf(" target %ums", |
1237 | q->flowqueue.target / 1000000); |
1238 | } |
1239 | if (q->linkshare.m1.absolute || q->linkshare.m2.absolute) { |
1240 | print_scspec(" bandwidth ", &q->linkshare); |
1241 | print_scspec(", min ", &q->realtime); |
1242 | print_scspec(", max ", &q->upperlimit); |
1243 | } |
1244 | if (q->flags & PFQS_DEFAULT0x1000) |
1245 | printf(" default"); |
1246 | if (q->qlimit) |
1247 | printf(" qlimit %u", q->qlimit); |
1248 | printf("\n"); |
1249 | } |
1250 | |
1251 | int |
1252 | parse_flags(char *s) |
1253 | { |
1254 | char *p, *q; |
1255 | u_int8_t f = 0; |
1256 | |
1257 | for (p = s; *p; p++) { |
1258 | if ((q = strchr(tcpflags, *p)) == NULL((void *)0)) |
1259 | return -1; |
1260 | else |
1261 | f |= 1 << (q - tcpflags); |
1262 | } |
1263 | return (f ? f : PF_TH_ALL0xFF); |
1264 | } |
1265 | |
1266 | void |
1267 | set_ipmask(struct node_host *h, int bb) |
1268 | { |
1269 | struct pf_addr *m, *n; |
1270 | int i, j = 0; |
1271 | u_int8_t b; |
1272 | |
1273 | m = &h->addr.v.a.mask; |
1274 | memset(m, 0, sizeof(*m)); |
1275 | |
1276 | if (bb == -1) |
1277 | b = h->af == AF_INET2 ? 32 : 128; |
1278 | else |
1279 | b = bb; |
1280 | |
1281 | while (b >= 32) { |
1282 | m->addr32pfa.addr32[j++] = 0xffffffff; |
1283 | b -= 32; |
1284 | } |
1285 | for (i = 31; i > 31-b; --i) |
1286 | m->addr32pfa.addr32[j] |= (1 << i); |
1287 | if (b) |
1288 | m->addr32pfa.addr32[j] = htonl(m->addr32[j])(__uint32_t)(__builtin_constant_p(m->pfa.addr32[j]) ? (__uint32_t )(((__uint32_t)(m->pfa.addr32[j]) & 0xff) << 24 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff00) << 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff0000) >> 8 | ((__uint32_t)(m->pfa.addr32[j]) & 0xff000000) >> 24) : __swap32md(m->pfa.addr32[j])); |
1289 | |
1290 | /* Mask off bits of the address that will never be used. */ |
1291 | n = &h->addr.v.a.addr; |
1292 | if (h->addr.type == PF_ADDR_ADDRMASK) |
1293 | for (i = 0; i < 4; i++) |
1294 | n->addr32pfa.addr32[i] = n->addr32pfa.addr32[i] & m->addr32pfa.addr32[i]; |
1295 | } |
1296 | |
1297 | int |
1298 | check_netmask(struct node_host *h, sa_family_t af) |
1299 | { |
1300 | struct node_host *n = NULL((void *)0); |
1301 | struct pf_addr *m; |
1302 | |
1303 | for (n = h; n != NULL((void *)0); n = n->next) { |
1304 | if (h->addr.type == PF_ADDR_TABLE) |
1305 | continue; |
1306 | m = &h->addr.v.a.mask; |
1307 | /* netmasks > 32 bit are invalid on v4 */ |
1308 | if (af == AF_INET2 && |
1309 | (m->addr32pfa.addr32[1] || m->addr32pfa.addr32[2] || m->addr32pfa.addr32[3])) { |
1310 | fprintf(stderr(&__sF[2]), "netmask %u invalid for IPv4 address\n", |
1311 | unmask(m)); |
1312 | return (1); |
1313 | } |
1314 | } |
1315 | return (0); |
1316 | } |
1317 | |
1318 | struct node_host * |
1319 | gen_dynnode(struct node_host *h, sa_family_t af) |
1320 | { |
1321 | struct node_host *n; |
1322 | |
1323 | if (h->addr.type != PF_ADDR_DYNIFTL) |
1324 | return (NULL((void *)0)); |
1325 | |
1326 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) |
1327 | return (NULL((void *)0)); |
1328 | bcopy(h, n, sizeof(*n)); |
1329 | n->ifname = NULL((void *)0); |
1330 | n->next = NULL((void *)0); |
1331 | n->tail = NULL((void *)0); |
1332 | |
1333 | /* fix up netmask */ |
1334 | if (af == AF_INET2 && unmask(&n->addr.v.a.mask) > 32) |
1335 | set_ipmask(n, 32); |
1336 | |
1337 | return (n); |
1338 | } |
1339 | |
1340 | /* interface lookup routines */ |
1341 | |
1342 | struct node_host *iftab; |
1343 | |
1344 | void |
1345 | ifa_load(void) |
1346 | { |
1347 | struct ifaddrs *ifap, *ifa; |
1348 | struct node_host *n = NULL((void *)0), *h = NULL((void *)0); |
1349 | |
1350 | if (getifaddrs(&ifap) == -1) |
1351 | err(1, "getifaddrs"); |
1352 | |
1353 | for (ifa = ifap; ifa; ifa = ifa->ifa_next) { |
1354 | if (ifa->ifa_addr == NULL((void *)0) || |
1355 | !(ifa->ifa_addr->sa_family == AF_INET2 || |
1356 | ifa->ifa_addr->sa_family == AF_INET624 || |
1357 | ifa->ifa_addr->sa_family == AF_LINK18)) |
1358 | continue; |
1359 | n = calloc(1, sizeof(struct node_host)); |
1360 | if (n == NULL((void *)0)) |
1361 | err(1, "%s: calloc", __func__); |
1362 | n->af = ifa->ifa_addr->sa_family; |
1363 | n->ifa_flags = ifa->ifa_flags; |
1364 | #ifdef __KAME__ |
1365 | if (n->af == AF_INET624 && |
1366 | IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) |
1367 | ifa->ifa_addr)->sin6_addr)(((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr )->__u6_addr.__u6_addr8[0] == 0xfe) && (((&((struct sockaddr_in6 *) ifa->ifa_addr)->sin6_addr)->__u6_addr .__u6_addr8[1] & 0xc0) == 0x80)) && |
1368 | ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == |
1369 | 0) { |
1370 | struct sockaddr_in6 *sin6; |
1371 | |
1372 | sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; |
1373 | sin6->sin6_scope_id = sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] << 8 | |
1374 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3]; |
1375 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] = 0; |
1376 | sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3] = 0; |
1377 | } |
1378 | #endif |
1379 | n->ifindex = 0; |
1380 | if (n->af == AF_LINK18) |
1381 | n->ifindex = ((struct sockaddr_dl *) |
1382 | ifa->ifa_addr)->sdl_index; |
1383 | else { |
1384 | copy_satopfaddr(&n->addr.v.a.addr, ifa->ifa_addr); |
1385 | ifa->ifa_netmask->sa_family = ifa->ifa_addr->sa_family; |
1386 | copy_satopfaddr(&n->addr.v.a.mask, ifa->ifa_netmask); |
1387 | if (ifa->ifa_broadaddrifa_dstaddr != NULL((void *)0)) { |
1388 | ifa->ifa_broadaddrifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; |
1389 | copy_satopfaddr(&n->bcast, ifa->ifa_broadaddrifa_dstaddr); |
1390 | } |
1391 | if (ifa->ifa_dstaddr != NULL((void *)0)) { |
1392 | ifa->ifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; |
1393 | copy_satopfaddr(&n->peer, ifa->ifa_dstaddr); |
1394 | } |
1395 | if (n->af == AF_INET624) |
1396 | n->ifindex = ((struct sockaddr_in6 *) |
1397 | ifa->ifa_addr)->sin6_scope_id; |
1398 | } |
1399 | if ((n->ifname = strdup(ifa->ifa_name)) == NULL((void *)0)) |
1400 | err(1, "%s: strdup", __func__); |
1401 | n->next = NULL((void *)0); |
1402 | n->tail = n; |
1403 | if (h == NULL((void *)0)) |
1404 | h = n; |
1405 | else { |
1406 | h->tail->next = n; |
1407 | h->tail = n; |
1408 | } |
1409 | } |
1410 | |
1411 | iftab = h; |
1412 | freeifaddrs(ifap); |
1413 | } |
1414 | |
1415 | unsigned int |
1416 | ifa_nametoindex(const char *ifa_name) |
1417 | { |
1418 | struct node_host *p; |
1419 | |
1420 | for (p = iftab; p; p = p->next) { |
1421 | if (p->af == AF_LINK18 && strcmp(p->ifname, ifa_name) == 0) |
1422 | return (p->ifindex); |
1423 | } |
1424 | errno(*__errno()) = ENXIO6; |
1425 | return (0); |
1426 | } |
1427 | |
1428 | char * |
1429 | ifa_indextoname(unsigned int ifindex, char *ifa_name) |
1430 | { |
1431 | struct node_host *p; |
1432 | |
1433 | for (p = iftab; p; p = p->next) { |
1434 | if (p->af == AF_LINK18 && ifindex == p->ifindex) { |
1435 | strlcpy(ifa_name, p->ifname, IFNAMSIZ16); |
1436 | return (ifa_name); |
1437 | } |
1438 | } |
1439 | errno(*__errno()) = ENXIO6; |
1440 | return (NULL((void *)0)); |
1441 | } |
1442 | |
1443 | struct node_host * |
1444 | ifa_exists(const char *ifa_name) |
1445 | { |
1446 | struct node_host *n; |
1447 | struct ifgroupreq ifgr; |
1448 | int s; |
1449 | |
1450 | if (iftab == NULL((void *)0)) |
1451 | ifa_load(); |
1452 | |
1453 | /* check whether this is a group */ |
1454 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) |
1455 | err(1, "socket"); |
1456 | bzero(&ifgr, sizeof(ifgr)); |
1457 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); |
1458 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == 0) { |
1459 | /* fake a node_host */ |
1460 | if ((n = calloc(1, sizeof(*n))) == NULL((void *)0)) |
1461 | err(1, "calloc"); |
1462 | if ((n->ifname = strdup(ifa_name)) == NULL((void *)0)) |
1463 | err(1, "strdup"); |
1464 | close(s); |
1465 | return (n); |
1466 | } |
1467 | close(s); |
1468 | |
1469 | for (n = iftab; n; n = n->next) { |
1470 | if (n->af == AF_LINK18 && !strncmp(n->ifname, ifa_name, IFNAMSIZ16)) |
1471 | return (n); |
1472 | } |
1473 | |
1474 | return (NULL((void *)0)); |
1475 | } |
1476 | |
1477 | struct node_host * |
1478 | ifa_grouplookup(const char *ifa_name, int flags) |
1479 | { |
1480 | struct ifg_req *ifg; |
1481 | struct ifgroupreq ifgr; |
1482 | int s, len; |
1483 | struct node_host *n, *h = NULL((void *)0); |
1484 | |
1485 | if ((s = socket(AF_INET2, SOCK_DGRAM2, 0)) == -1) |
1486 | err(1, "socket"); |
1487 | bzero(&ifgr, sizeof(ifgr)); |
1488 | strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); |
1489 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) { |
1490 | close(s); |
1491 | return (NULL((void *)0)); |
1492 | } |
1493 | |
1494 | len = ifgr.ifgr_len; |
1495 | if ((ifgr.ifgr_groupsifgr_ifgru.ifgru_groups = calloc(1, len)) == NULL((void *)0)) |
1496 | err(1, "calloc"); |
1497 | if (ioctl(s, SIOCGIFGMEMB(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof (struct ifgroupreq) & 0x1fff) << 16) | ((('i')) << 8) | ((138))), (caddr_t)&ifgr) == -1) |
1498 | err(1, "SIOCGIFGMEMB"); |
1499 | |
1500 | for (ifg = ifgr.ifgr_groupsifgr_ifgru.ifgru_groups; ifg && len >= sizeof(struct ifg_req); |
1501 | ifg++) { |
1502 | len -= sizeof(struct ifg_req); |
1503 | if ((n = ifa_lookup(ifg->ifgrq_memberifgrq_ifgrqu.ifgrqu_member, flags)) == NULL((void *)0)) |
1504 | continue; |
1505 | if (h == NULL((void *)0)) |
1506 | h = n; |
1507 | else { |
1508 | h->tail->next = n; |
1509 | h->tail = n->tail; |
1510 | } |
1511 | } |
1512 | free(ifgr.ifgr_groupsifgr_ifgru.ifgru_groups); |
1513 | close(s); |
1514 | |
1515 | return (h); |
1516 | } |
1517 | |
1518 | struct node_host * |
1519 | ifa_lookup(const char *ifa_name, int flags) |
1520 | { |
1521 | struct node_host *p = NULL((void *)0), *h = NULL((void *)0), *n = NULL((void *)0); |
1522 | int got4 = 0, got6 = 0; |
1523 | const char *last_if = NULL((void *)0); |
1524 | |
1525 | if ((h = ifa_grouplookup(ifa_name, flags)) != NULL((void *)0)) |
1526 | return (h); |
1527 | |
1528 | if (!strncmp(ifa_name, "self", IFNAMSIZ16)) |
1529 | ifa_name = NULL((void *)0); |
1530 | |
1531 | if (iftab == NULL((void *)0)) |
1532 | ifa_load(); |
1533 | |
1534 | for (p = iftab; p; p = p->next) { |
1535 | if (ifa_skip_if(ifa_name, p)) |
1536 | continue; |
1537 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->af != AF_INET2) |
1538 | continue; |
1539 | if ((flags & PFI_AFLAG_BROADCAST0x02) && |
1540 | !(p->ifa_flags & IFF_BROADCAST0x2)) |
1541 | continue; |
1542 | if ((flags & PFI_AFLAG_BROADCAST0x02) && p->bcast.v4pfa.v4.s_addr == 0) |
1543 | continue; |
1544 | if ((flags & PFI_AFLAG_PEER0x04) && |
1545 | !(p->ifa_flags & IFF_POINTOPOINT0x10)) |
1546 | continue; |
1547 | if ((flags & PFI_AFLAG_NETWORK0x01) && p->ifindex > 0) |
1548 | continue; |
1549 | if (last_if == NULL((void *)0) || strcmp(last_if, p->ifname)) |
1550 | got4 = got6 = 0; |
1551 | last_if = p->ifname; |
1552 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET2 && got4) |
1553 | continue; |
1554 | if ((flags & PFI_AFLAG_NOALIAS0x08) && p->af == AF_INET624 && got6) |
1555 | continue; |
1556 | if (p->af == AF_INET2) |
1557 | got4 = 1; |
1558 | else |
1559 | got6 = 1; |
1560 | n = calloc(1, sizeof(struct node_host)); |
1561 | if (n == NULL((void *)0)) |
1562 | err(1, "%s: calloc", __func__); |
1563 | n->af = p->af; |
1564 | if (flags & PFI_AFLAG_BROADCAST0x02) |
1565 | memcpy(&n->addr.v.a.addr, &p->bcast, |
1566 | sizeof(struct pf_addr)); |
1567 | else if (flags & PFI_AFLAG_PEER0x04) |
1568 | memcpy(&n->addr.v.a.addr, &p->peer, |
1569 | sizeof(struct pf_addr)); |
1570 | else |
1571 | memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, |
1572 | sizeof(struct pf_addr)); |
1573 | if (flags & PFI_AFLAG_NETWORK0x01) |
1574 | set_ipmask(n, unmask(&p->addr.v.a.mask)); |
1575 | else |
1576 | set_ipmask(n, -1); |
1577 | n->ifindex = p->ifindex; |
1578 | |
1579 | n->next = NULL((void *)0); |
1580 | n->tail = n; |
1581 | if (h == NULL((void *)0)) |
1582 | h = n; |
1583 | else { |
1584 | h->tail->next = n; |
1585 | h->tail = n; |
1586 | } |
1587 | } |
1588 | return (h); |
1589 | } |
1590 | |
1591 | int |
1592 | ifa_skip_if(const char *filter, struct node_host *p) |
1593 | { |
1594 | int n; |
1595 | |
1596 | if (p->af != AF_INET2 && p->af != AF_INET624) |
1597 | return (1); |
1598 | if (filter == NULL((void *)0) || !*filter) |
1599 | return (0); |
1600 | if (!strcmp(p->ifname, filter)) |
1601 | return (0); /* exact match */ |
1602 | n = strlen(filter); |
1603 | if (n < 1 || n >= IFNAMSIZ16) |
1604 | return (1); /* sanity check */ |
1605 | if (filter[n-1] >= '0' && filter[n-1] <= '9') |
1606 | return (1); /* only do exact match in that case */ |
1607 | if (strncmp(p->ifname, filter, n)) |
1608 | return (1); /* prefix doesn't match */ |
1609 | return (p->ifname[n] < '0' || p->ifname[n] > '9'); |
1610 | } |
1611 | |
1612 | struct node_host * |
1613 | host(const char *s, int opts) |
1614 | { |
1615 | struct node_host *h = NULL((void *)0), *n; |
1616 | int mask = -1; |
1617 | char *p, *ps; |
1618 | const char *errstr; |
1619 | |
1620 | if ((ps = strdup(s)) == NULL((void *)0)) |
1621 | err(1, "%s: strdup", __func__); |
1622 | |
1623 | if ((p = strchr(ps, '/')) != NULL((void *)0)) { |
1624 | mask = strtonum(p+1, 0, 128, &errstr); |
1625 | if (errstr) { |
1626 | fprintf(stderr(&__sF[2]), "netmask is %s: %s\n", errstr, p); |
1627 | goto error; |
1628 | } |
1629 | p[0] = '\0'; |
1630 | } |
1631 | |
1632 | if ((h = host_if(ps, mask)) == NULL((void *)0) && |
1633 | (h = host_ip(ps, mask)) == NULL((void *)0) && |
1634 | (h = host_dns(ps, mask, (opts & PF_OPT_NODNS0x01000))) == NULL((void *)0)) { |
1635 | fprintf(stderr(&__sF[2]), "no IP address found for %s\n", s); |
1636 | goto error; |
1637 | } |
1638 | |
1639 | for (n = h; n != NULL((void *)0); n = n->next) { |
1640 | n->addr.type = PF_ADDR_ADDRMASK; |
1641 | n->weight = 0; |
1642 | } |
1643 | |
1644 | error: |
1645 | free(ps); |
1646 | return (h); |
1647 | } |
1648 | |
1649 | struct node_host * |
1650 | host_if(const char *s, int mask) |
1651 | { |
1652 | struct node_host *n, *h = NULL((void *)0); |
1653 | char *p, *ps; |
1654 | int flags = 0; |
1655 | |
1656 | if ((ps = strdup(s)) == NULL((void *)0)) |
1657 | err(1, "host_if: strdup"); |
1658 | while ((p = strrchr(ps, ':')) != NULL((void *)0)) { |
1659 | if (!strcmp(p+1, "network")) |
1660 | flags |= PFI_AFLAG_NETWORK0x01; |
1661 | else if (!strcmp(p+1, "broadcast")) |
1662 | flags |= PFI_AFLAG_BROADCAST0x02; |
1663 | else if (!strcmp(p+1, "peer")) |
1664 | flags |= PFI_AFLAG_PEER0x04; |
1665 | else if (!strcmp(p+1, "0")) |
1666 | flags |= PFI_AFLAG_NOALIAS0x08; |
1667 | else |
1668 | goto error; |
1669 | *p = '\0'; |
1670 | } |
1671 | if (flags & (flags - 1) & PFI_AFLAG_MODEMASK0x07) { /* Yep! */ |
1672 | fprintf(stderr(&__sF[2]), "illegal combination of interface modifiers\n"); |
1673 | goto error; |
1674 | } |
1675 | if ((flags & (PFI_AFLAG_NETWORK0x01|PFI_AFLAG_BROADCAST0x02)) && mask > -1) { |
1676 | fprintf(stderr(&__sF[2]), "network or broadcast lookup, but " |
1677 | "extra netmask given\n"); |
1678 | goto error; |
1679 | } |
1680 | if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ16)) { |
1681 | /* interface with this name exists */ |
1682 | h = ifa_lookup(ps, flags); |
1683 | if (mask > -1) |
1684 | for (n = h; n != NULL((void *)0); n = n->next) |
1685 | set_ipmask(n, mask); |
1686 | } |
1687 | |
1688 | error: |
1689 | free(ps); |
1690 | return (h); |
1691 | } |
1692 | |
1693 | struct node_host * |
1694 | host_ip(const char *s, int mask) |
1695 | { |
1696 | struct addrinfo hints, *res; |
1697 | struct node_host *h = NULL((void *)0); |
1698 | |
1699 | memset(&hints, 0, sizeof(hints)); |
1700 | hints.ai_family = AF_UNSPEC0; |
1701 | hints.ai_socktype = SOCK_DGRAM2; /*dummy*/ |
1702 | hints.ai_flags = AI_NUMERICHOST4; |
1703 | if (getaddrinfo(s, NULL((void *)0), &hints, &res) == 0) { |
1704 | h = calloc(1, sizeof(*h)); |
1705 | if (h == NULL((void *)0)) |
1706 | err(1, "%s: calloc", __func__); |
1707 | h->af = res->ai_family; |
1708 | copy_satopfaddr(&h->addr.v.a.addr, res->ai_addr); |
1709 | if (h->af == AF_INET624) |
1710 | h->ifindex = |
1711 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; |
1712 | freeaddrinfo(res); |
1713 | } else { /* ie. for 10/8 parsing */ |
1714 | if (mask == -1) |
1715 | return (NULL((void *)0)); |
1716 | h = calloc(1, sizeof(*h)); |
1717 | if (h == NULL((void *)0)) |
1718 | err(1, "%s: calloc", __func__); |
1719 | h->af = AF_INET2; |
1720 | if (inet_net_pton(AF_INET2, s, &h->addr.v.a.addr.v4pfa.v4, |
1721 | sizeof(h->addr.v.a.addr.v4pfa.v4)) == -1) { |
1722 | free(h); |
1723 | return (NULL((void *)0)); |
1724 | } |
1725 | } |
1726 | set_ipmask(h, mask); |
1727 | h->ifname = NULL((void *)0); |
1728 | h->next = NULL((void *)0); |
1729 | h->tail = h; |
1730 | |
1731 | return (h); |
1732 | } |
1733 | |
1734 | struct node_host * |
1735 | host_dns(const char *s, int mask, int numeric) |
1736 | { |
1737 | struct addrinfo hints, *res0, *res; |
1738 | struct node_host *n, *h = NULL((void *)0); |
1739 | int noalias = 0, got4 = 0, got6 = 0; |
1740 | char *p, *ps; |
1741 | |
1742 | if ((ps = strdup(s)) == NULL((void *)0)) |
1743 | err(1, "host_dns: strdup"); |
1744 | if ((p = strrchr(ps, ':')) != NULL((void *)0) && !strcmp(p, ":0")) { |
1745 | noalias = 1; |
1746 | *p = '\0'; |
1747 | } |
1748 | memset(&hints, 0, sizeof(hints)); |
1749 | hints.ai_family = PF_UNSPEC0; |
1750 | hints.ai_socktype = SOCK_STREAM1; /* DUMMY */ |
1751 | if (numeric) |
1752 | hints.ai_flags = AI_NUMERICHOST4; |
1753 | if (getaddrinfo(ps, NULL((void *)0), &hints, &res0) != 0) |
1754 | goto error; |
1755 | |
1756 | for (res = res0; res; res = res->ai_next) { |
1757 | if (res->ai_family != AF_INET2 && |
1758 | res->ai_family != AF_INET624) |
1759 | continue; |
1760 | if (noalias) { |
1761 | if (res->ai_family == AF_INET2) { |
1762 | if (got4) |
1763 | continue; |
1764 | got4 = 1; |
1765 | } else { |
1766 | if (got6) |
1767 | continue; |
1768 | got6 = 1; |
1769 | } |
1770 | } |
1771 | n = calloc(1, sizeof(struct node_host)); |
1772 | if (n == NULL((void *)0)) |
1773 | err(1, "host_dns: calloc"); |
1774 | n->ifname = NULL((void *)0); |
1775 | n->af = res->ai_family; |
1776 | copy_satopfaddr(&n->addr.v.a.addr, res->ai_addr); |
1777 | if (res->ai_family == AF_INET624) |
1778 | n->ifindex = |
1779 | ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; |
1780 | set_ipmask(n, mask); |
1781 | n->next = NULL((void *)0); |
1782 | n->tail = n; |
1783 | if (h == NULL((void *)0)) |
1784 | h = n; |
1785 | else { |
1786 | h->tail->next = n; |
1787 | h->tail = n; |
1788 | } |
1789 | } |
1790 | freeaddrinfo(res0); |
1791 | error: |
1792 | free(ps); |
1793 | |
1794 | return (h); |
1795 | } |
1796 | |
1797 | /* |
1798 | * convert a hostname to a list of addresses and put them in the given buffer. |
1799 | * test: |
1800 | * if set to 1, only simple addresses are accepted (no netblock, no "!"). |
1801 | */ |
1802 | int |
1803 | append_addr(struct pfr_buffer *b, char *s, int test, int opts) |
1804 | { |
1805 | static int previous = 0; |
1806 | static int expect = 0; |
1807 | struct pfr_addr *a; |
1808 | struct node_host *h, *n; |
1809 | char *r; |
1810 | const char *errstr; |
1811 | int rv, not = 0, i = 0; |
1812 | u_int16_t weight; |
1813 | |
1814 | /* skip weight if given */ |
1815 | if (strcmp(s, "weight") == 0) { |
1816 | expect = 1; |
1817 | return (1); /* expecting further call */ |
1818 | } |
1819 | |
1820 | /* check if previous host is set */ |
1821 | if (expect) { |
1822 | /* parse and append load balancing weight */ |
1823 | weight = strtonum(s, 1, USHRT_MAX0xffff, &errstr); |
1824 | if (errstr) { |
1825 | fprintf(stderr(&__sF[2]), "failed to convert weight %s\n", s); |
1826 | return (-1); |
1827 | } |
1828 | if (previous != -1) { |
1829 | PFRB_FOREACH(a, b)for ((a) = pfr_buf_next((b), ((void *)0)); (a) != ((void *)0) ; (a) = pfr_buf_next((b), (a))) { |
1830 | if (++i >= previous) { |
1831 | a->pfra_weight = weight; |
1832 | a->pfra_type = PFRKE_COST; |
1833 | } |
1834 | } |
1835 | } |
1836 | expect = 0; |
1837 | return (0); |
1838 | } |
1839 | |
1840 | for (r = s; *r == '!'; r++) |
1841 | not = !not; |
1842 | if ((n = host(r, opts)) == NULL((void *)0)) { |
1843 | errno(*__errno()) = 0; |
1844 | return (-1); |
1845 | } |
1846 | rv = append_addr_host(b, n, test, not); |
1847 | previous = b->pfrb_size; |
1848 | do { |
1849 | h = n; |
1850 | n = n->next; |
1851 | free(h); |
1852 | } while (n != NULL((void *)0)); |
1853 | return (rv); |
1854 | } |
1855 | |
1856 | /* |
1857 | * same as previous function, but with a pre-parsed input and the ability |
1858 | * to "negate" the result. Does not free the node_host list. |
1859 | * not: |
1860 | * setting it to 1 is equivalent to adding "!" in front of parameter s. |
1861 | */ |
1862 | int |
1863 | append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) |
1864 | { |
1865 | int bits; |
1866 | struct pfr_addr addr; |
1867 | |
1868 | do { |
1869 | bzero(&addr, sizeof(addr)); |
1870 | addr.pfra_not = n->not ^ not; |
1871 | addr.pfra_af = n->af; |
1872 | addr.pfra_net = unmask(&n->addr.v.a.mask); |
1873 | if (n->ifname) { |
1874 | if (strlcpy(addr.pfra_ifname, n->ifname, |
1875 | sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) |
1876 | errx(1, "append_addr_host: strlcpy"); |
1877 | addr.pfra_type = PFRKE_ROUTE; |
1878 | } |
1879 | if (n->weight > 0) { |
1880 | addr.pfra_weight = n->weight; |
1881 | addr.pfra_type = PFRKE_COST; |
1882 | } |
1883 | switch (n->af) { |
1884 | case AF_INET2: |
1885 | addr.pfra_ip4addrpfra_u._pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32pfa.addr32[0]; |
1886 | bits = 32; |
1887 | break; |
1888 | case AF_INET624: |
1889 | memcpy(&addr.pfra_ip6addrpfra_u._pfra_ip6addr, &n->addr.v.a.addr.v6pfa.v6, |
1890 | sizeof(struct in6_addr)); |
1891 | bits = 128; |
1892 | break; |
1893 | default: |
1894 | errno(*__errno()) = EINVAL22; |
1895 | return (-1); |
1896 | } |
1897 | if ((test && (not || addr.pfra_net != bits)) || |
1898 | addr.pfra_net > bits) { |
1899 | errno(*__errno()) = EINVAL22; |
1900 | return (-1); |
1901 | } |
1902 | if (pfr_buf_add(b, &addr)) |
1903 | return (-1); |
1904 | } while ((n = n->next) != NULL((void *)0)); |
1905 | |
1906 | return (0); |
1907 | } |
1908 | |
1909 | int |
1910 | pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) |
1911 | { |
1912 | struct pfioc_trans_e trans; |
1913 | |
1914 | bzero(&trans, sizeof(trans)); |
1915 | trans.type = type; |
1916 | if (strlcpy(trans.anchor, anchor, |
1917 | sizeof(trans.anchor)) >= sizeof(trans.anchor)) |
1918 | errx(1, "pfctl_add_trans: strlcpy"); |
1919 | |
1920 | return pfr_buf_add(buf, &trans); |
1921 | } |
1922 | |
1923 | u_int32_t |
1924 | pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) |
1925 | { |
1926 | struct pfioc_trans_e *p; |
1927 | |
1928 | PFRB_FOREACH(p, buf)for ((p) = pfr_buf_next((buf), ((void *)0)); (p) != ((void *) 0); (p) = pfr_buf_next((buf), (p))) |
1929 | if (type == p->type && !strcmp(anchor, p->anchor)) |
1930 | return (p->ticket); |
1931 | errx(1, "pfctl_get_ticket: assertion failed"); |
1932 | } |
1933 | |
1934 | int |
1935 | pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) |
1936 | { |
1937 | struct pfioc_trans trans; |
1938 | |
1939 | bzero(&trans, sizeof(trans)); |
1940 | trans.size = buf->pfrb_size - from; |
1941 | trans.esize = sizeof(struct pfioc_trans_e); |
1942 | trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; |
1943 | return ioctl(dev, cmd, &trans); |
1944 | } |