1*42a2f8b7Sdlg /* $OpenBSD: pfctl_parser.c,v 1.352 2024/11/12 04:14:51 dlg Exp $ */ 214a9b182Skjell 314a9b182Skjell /* 4fd3c3a0cSderaadt * Copyright (c) 2001 Daniel Hartmeier 5f8d11d7cShenning * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> 614a9b182Skjell * All rights reserved. 714a9b182Skjell * 814a9b182Skjell * Redistribution and use in source and binary forms, with or without 914a9b182Skjell * modification, are permitted provided that the following conditions 1014a9b182Skjell * are met: 1114a9b182Skjell * 1214a9b182Skjell * - Redistributions of source code must retain the above copyright 1314a9b182Skjell * notice, this list of conditions and the following disclaimer. 1414a9b182Skjell * - Redistributions in binary form must reproduce the above 1514a9b182Skjell * copyright notice, this list of conditions and the following 1614a9b182Skjell * disclaimer in the documentation and/or other materials provided 1714a9b182Skjell * with the distribution. 1814a9b182Skjell * 1914a9b182Skjell * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2014a9b182Skjell * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2114a9b182Skjell * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 2214a9b182Skjell * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 235974bd37Sdhartmei * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 2414a9b182Skjell * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 2514a9b182Skjell * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 2614a9b182Skjell * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 2714a9b182Skjell * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2814a9b182Skjell * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 2914a9b182Skjell * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 3014a9b182Skjell * POSSIBILITY OF SUCH DAMAGE. 3114a9b182Skjell * 3214a9b182Skjell */ 3314a9b182Skjell 34252d784aSderaadt #include <sys/types.h> 3579cc0068Scedric #include <sys/ioctl.h> 36252d784aSderaadt #include <sys/socket.h> 37918dda86Smikeb #include <net/if_dl.h> 38252d784aSderaadt #include <net/if.h> 39252d784aSderaadt #include <netinet/in.h> 406329fa59Sderaadt #include <netinet/ip.h> 416329fa59Sderaadt #include <netinet/ip_icmp.h> 4230620b12Sfrantzen #include <netinet/icmp6.h> 43252d784aSderaadt #include <net/pfvar.h> 449f13c6caSmillert #include <arpa/inet.h> 45252d784aSderaadt 469c957736Sguenther #include <ctype.h> 479c957736Sguenther #include <err.h> 489c957736Sguenther #include <errno.h> 499c957736Sguenther #include <ifaddrs.h> 509c957736Sguenther #include <limits.h> 519c957736Sguenther #include <netdb.h> 529c957736Sguenther #include <stdarg.h> 5314a9b182Skjell #include <stdio.h> 5414a9b182Skjell #include <stdlib.h> 5514a9b182Skjell #include <string.h> 569c957736Sguenther #include <time.h> 572ff5b035Shenning #include <unistd.h> 5814a9b182Skjell 59a2fdc13dSmcbride #define SYSLOG_NAMES 60a2fdc13dSmcbride #include <syslog.h> 61a2fdc13dSmcbride 6214a9b182Skjell #include "pfctl_parser.h" 63eb824e11Sderaadt #include "pfctl.h" 6414a9b182Skjell 653d49904cStb #ifndef nitems 663d49904cStb #define nitems(_a) (sizeof((_a)) / sizeof((_a)[0])) 673d49904cStb #endif 683d49904cStb 695d9ac2dcSdhartmei void print_op (u_int8_t, const char *, const char *); 70ad85696eShenning void print_port (u_int8_t, u_int16_t, u_int16_t, const char *, int); 71b4de0548Smillert void print_ugid (u_int8_t, id_t, id_t, const char *); 7281a15e5dSderaadt void print_flags (u_int8_t); 7364b4b616Sfrantzen void print_fromto(struct pf_rule_addr *, pf_osfp_t, 7464b4b616Sfrantzen struct pf_rule_addr *, u_int8_t, u_int8_t, int); 75f8d11d7cShenning void print_bwspec(const char *index, struct pf_queue_bwspec *); 76f8d11d7cShenning void print_scspec(const char *, struct pf_queue_scspec *); 777ad220f2Scedric int ifa_skip_if(const char *filter, struct node_host *p); 7814a9b182Skjell 792ff5b035Shenning struct node_host *ifa_grouplookup(const char *, int); 80f2370d27Shenning struct node_host *host_if(const char *, int); 811b6fdc2fSkn struct node_host *host_ip(const char *, int); 8217e25e94Skn struct node_host *host_dns(const char *, int, int); 832a6c1abaShenning 84361e311cShenning const char *tcpflags = "FSRPAUEW"; 8514a9b182Skjell 867d27d81aSdhartmei static const struct icmptypeent icmp_type[] = { 87082ebc44Swilfried { "echoreq", ICMP_ECHO }, 88082ebc44Swilfried { "echorep", ICMP_ECHOREPLY }, 89082ebc44Swilfried { "unreach", ICMP_UNREACH }, 90082ebc44Swilfried { "squench", ICMP_SOURCEQUENCH }, 91082ebc44Swilfried { "redir", ICMP_REDIRECT }, 92082ebc44Swilfried { "althost", ICMP_ALTHOSTADDR }, 93082ebc44Swilfried { "routeradv", ICMP_ROUTERADVERT }, 94082ebc44Swilfried { "routersol", ICMP_ROUTERSOLICIT }, 95082ebc44Swilfried { "timex", ICMP_TIMXCEED }, 96082ebc44Swilfried { "paramprob", ICMP_PARAMPROB }, 97082ebc44Swilfried { "timereq", ICMP_TSTAMP }, 98082ebc44Swilfried { "timerep", ICMP_TSTAMPREPLY }, 99082ebc44Swilfried { "inforeq", ICMP_IREQ }, 100082ebc44Swilfried { "inforep", ICMP_IREQREPLY }, 101082ebc44Swilfried { "maskreq", ICMP_MASKREQ }, 10202cbcc9eSwilfried { "maskrep", ICMP_MASKREPLY }, 10302cbcc9eSwilfried { "trace", ICMP_TRACEROUTE }, 10402cbcc9eSwilfried { "dataconv", ICMP_DATACONVERR }, 10502cbcc9eSwilfried { "mobredir", ICMP_MOBILE_REDIRECT }, 10602cbcc9eSwilfried { "ipv6-where", ICMP_IPV6_WHEREAREYOU }, 10702cbcc9eSwilfried { "ipv6-here", ICMP_IPV6_IAMHERE }, 10802cbcc9eSwilfried { "mobregreq", ICMP_MOBILE_REGREQUEST }, 10902cbcc9eSwilfried { "mobregrep", ICMP_MOBILE_REGREPLY }, 11002cbcc9eSwilfried { "skip", ICMP_SKIP }, 11102cbcc9eSwilfried { "photuris", ICMP_PHOTURIS } 112082ebc44Swilfried }; 113082ebc44Swilfried 1147d27d81aSdhartmei static const struct icmptypeent icmp6_type[] = { 11530620b12Sfrantzen { "unreach", ICMP6_DST_UNREACH }, 11630620b12Sfrantzen { "toobig", ICMP6_PACKET_TOO_BIG }, 11730620b12Sfrantzen { "timex", ICMP6_TIME_EXCEEDED }, 11830620b12Sfrantzen { "paramprob", ICMP6_PARAM_PROB }, 11930620b12Sfrantzen { "echoreq", ICMP6_ECHO_REQUEST }, 12030620b12Sfrantzen { "echorep", ICMP6_ECHO_REPLY }, 12130620b12Sfrantzen { "groupqry", ICMP6_MEMBERSHIP_QUERY }, 12222a58e88Sitojun { "listqry", MLD_LISTENER_QUERY }, 12330620b12Sfrantzen { "grouprep", ICMP6_MEMBERSHIP_REPORT }, 12422a58e88Sitojun { "listenrep", MLD_LISTENER_REPORT }, 12530620b12Sfrantzen { "groupterm", ICMP6_MEMBERSHIP_REDUCTION }, 12622a58e88Sitojun { "listendone", MLD_LISTENER_DONE }, 12730620b12Sfrantzen { "routersol", ND_ROUTER_SOLICIT }, 12830620b12Sfrantzen { "routeradv", ND_ROUTER_ADVERT }, 12930620b12Sfrantzen { "neighbrsol", ND_NEIGHBOR_SOLICIT }, 13030620b12Sfrantzen { "neighbradv", ND_NEIGHBOR_ADVERT }, 13130620b12Sfrantzen { "redir", ND_REDIRECT }, 13230620b12Sfrantzen { "routrrenum", ICMP6_ROUTER_RENUMBERING }, 13330620b12Sfrantzen { "wrureq", ICMP6_WRUREQUEST }, 13430620b12Sfrantzen { "wrurep", ICMP6_WRUREPLY }, 13530620b12Sfrantzen { "fqdnreq", ICMP6_FQDN_QUERY }, 13630620b12Sfrantzen { "fqdnrep", ICMP6_FQDN_REPLY }, 13730620b12Sfrantzen { "niqry", ICMP6_NI_QUERY }, 13830620b12Sfrantzen { "nirep", ICMP6_NI_REPLY }, 13922a58e88Sitojun { "mtraceresp", MLD_MTRACE_RESP }, 14042b7d0f0Sjca { "mtrace", MLD_MTRACE }, 14142b7d0f0Sjca { "listenrepv2", MLDV2_LISTENER_REPORT }, 14230620b12Sfrantzen }; 14330620b12Sfrantzen 1447d27d81aSdhartmei static const struct icmpcodeent icmp_code[] = { 145082ebc44Swilfried { "net-unr", ICMP_UNREACH, ICMP_UNREACH_NET }, 146082ebc44Swilfried { "host-unr", ICMP_UNREACH, ICMP_UNREACH_HOST }, 147082ebc44Swilfried { "proto-unr", ICMP_UNREACH, ICMP_UNREACH_PROTOCOL }, 148082ebc44Swilfried { "port-unr", ICMP_UNREACH, ICMP_UNREACH_PORT }, 149082ebc44Swilfried { "needfrag", ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG }, 150082ebc44Swilfried { "srcfail", ICMP_UNREACH, ICMP_UNREACH_SRCFAIL }, 151082ebc44Swilfried { "net-unk", ICMP_UNREACH, ICMP_UNREACH_NET_UNKNOWN }, 152082ebc44Swilfried { "host-unk", ICMP_UNREACH, ICMP_UNREACH_HOST_UNKNOWN }, 153082ebc44Swilfried { "isolate", ICMP_UNREACH, ICMP_UNREACH_ISOLATED }, 154082ebc44Swilfried { "net-prohib", ICMP_UNREACH, ICMP_UNREACH_NET_PROHIB }, 155082ebc44Swilfried { "host-prohib", ICMP_UNREACH, ICMP_UNREACH_HOST_PROHIB }, 156082ebc44Swilfried { "net-tos", ICMP_UNREACH, ICMP_UNREACH_TOSNET }, 157082ebc44Swilfried { "host-tos", ICMP_UNREACH, ICMP_UNREACH_TOSHOST }, 158082ebc44Swilfried { "filter-prohib", ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB }, 159082ebc44Swilfried { "host-preced", ICMP_UNREACH, ICMP_UNREACH_HOST_PRECEDENCE }, 160082ebc44Swilfried { "cutoff-preced", ICMP_UNREACH, ICMP_UNREACH_PRECEDENCE_CUTOFF }, 161082ebc44Swilfried { "redir-net", ICMP_REDIRECT, ICMP_REDIRECT_NET }, 162082ebc44Swilfried { "redir-host", ICMP_REDIRECT, ICMP_REDIRECT_HOST }, 163082ebc44Swilfried { "redir-tos-net", ICMP_REDIRECT, ICMP_REDIRECT_TOSNET }, 164082ebc44Swilfried { "redir-tos-host", ICMP_REDIRECT, ICMP_REDIRECT_TOSHOST }, 16502cbcc9eSwilfried { "normal-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NORMAL }, 16602cbcc9eSwilfried { "common-adv", ICMP_ROUTERADVERT, ICMP_ROUTERADVERT_NOROUTE_COMMON }, 167082ebc44Swilfried { "transit", ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS }, 168082ebc44Swilfried { "reassemb", ICMP_TIMXCEED, ICMP_TIMXCEED_REASS }, 169082ebc44Swilfried { "badhead", ICMP_PARAMPROB, ICMP_PARAMPROB_ERRATPTR }, 170082ebc44Swilfried { "optmiss", ICMP_PARAMPROB, ICMP_PARAMPROB_OPTABSENT }, 17102cbcc9eSwilfried { "badlen", ICMP_PARAMPROB, ICMP_PARAMPROB_LENGTH }, 17202cbcc9eSwilfried { "unknown-ind", ICMP_PHOTURIS, ICMP_PHOTURIS_UNKNOWN_INDEX }, 17302cbcc9eSwilfried { "auth-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_AUTH_FAILED }, 17402cbcc9eSwilfried { "decrypt-fail", ICMP_PHOTURIS, ICMP_PHOTURIS_DECRYPT_FAILED } 175082ebc44Swilfried }; 176082ebc44Swilfried 1777d27d81aSdhartmei static const struct icmpcodeent icmp6_code[] = { 1781d32ee3bSdhartmei { "admin-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN }, 1791d32ee3bSdhartmei { "noroute-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE }, 18030620b12Sfrantzen { "beyond-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_BEYONDSCOPE }, 18130620b12Sfrantzen { "addr-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR }, 18230620b12Sfrantzen { "port-unr", ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT }, 18330620b12Sfrantzen { "transit", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT }, 18430620b12Sfrantzen { "reassemb", ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY }, 18530620b12Sfrantzen { "badhead", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER }, 18630620b12Sfrantzen { "nxthdr", ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER }, 18730620b12Sfrantzen { "redironlink", ND_REDIRECT, ND_REDIRECT_ONLINK }, 18830620b12Sfrantzen { "redirrouter", ND_REDIRECT, ND_REDIRECT_ROUTER } 18930620b12Sfrantzen }; 19030620b12Sfrantzen 191d593fb91Sdrahn const struct pf_timeout pf_timeouts[] = { 192d593fb91Sdrahn { "tcp.first", PFTM_TCP_FIRST_PACKET }, 193d593fb91Sdrahn { "tcp.opening", PFTM_TCP_OPENING }, 194d593fb91Sdrahn { "tcp.established", PFTM_TCP_ESTABLISHED }, 195d593fb91Sdrahn { "tcp.closing", PFTM_TCP_CLOSING }, 196d593fb91Sdrahn { "tcp.finwait", PFTM_TCP_FIN_WAIT }, 197d593fb91Sdrahn { "tcp.closed", PFTM_TCP_CLOSED }, 19898d12bd8Sfrantzen { "tcp.tsdiff", PFTM_TS_DIFF }, 199d593fb91Sdrahn { "udp.first", PFTM_UDP_FIRST_PACKET }, 200d593fb91Sdrahn { "udp.single", PFTM_UDP_SINGLE }, 201d593fb91Sdrahn { "udp.multiple", PFTM_UDP_MULTIPLE }, 202d593fb91Sdrahn { "icmp.first", PFTM_ICMP_FIRST_PACKET }, 203d593fb91Sdrahn { "icmp.error", PFTM_ICMP_ERROR_REPLY }, 204d593fb91Sdrahn { "other.first", PFTM_OTHER_FIRST_PACKET }, 205d593fb91Sdrahn { "other.single", PFTM_OTHER_SINGLE }, 206d593fb91Sdrahn { "other.multiple", PFTM_OTHER_MULTIPLE }, 207d593fb91Sdrahn { "frag", PFTM_FRAG }, 208d593fb91Sdrahn { "interval", PFTM_INTERVAL }, 209a85e74a5Sdhartmei { "adaptive.start", PFTM_ADAPTIVE_START }, 210a85e74a5Sdhartmei { "adaptive.end", PFTM_ADAPTIVE_END }, 211fd777407Smcbride { "src.track", PFTM_SRC_NODE }, 212d593fb91Sdrahn { NULL, 0 } 213d593fb91Sdrahn }; 214d593fb91Sdrahn 215a64374fdSmcbride enum { PF_POOL_ROUTE, PF_POOL_NAT, PF_POOL_RDR }; 216a64374fdSmcbride 217675ff33bSkn void 218675ff33bSkn copy_satopfaddr(struct pf_addr *pfa, struct sockaddr *sa) 219675ff33bSkn { 220675ff33bSkn if (sa->sa_family == AF_INET6) 221675ff33bSkn pfa->v6 = ((struct sockaddr_in6 *)sa)->sin6_addr; 2221fef2296Sbluhm else if (sa->sa_family == AF_INET) 223675ff33bSkn pfa->v4 = ((struct sockaddr_in *)sa)->sin_addr; 2241fef2296Sbluhm else 2251fef2296Sbluhm warnx("unhandled af %d", sa->sa_family); 226675ff33bSkn } 227675ff33bSkn 2287d27d81aSdhartmei const struct icmptypeent * 229bb9f691eSmcbride geticmptypebynumber(u_int8_t type, sa_family_t af) 230082ebc44Swilfried { 2313d49904cStb size_t i; 232082ebc44Swilfried 233d14c53d7Swilfried if (af != AF_INET6) { 2343d49904cStb for (i = 0; i < nitems(icmp_type); i++) { 235082ebc44Swilfried if (type == icmp_type[i].type) 236082ebc44Swilfried return (&icmp_type[i]); 237082ebc44Swilfried } 23830620b12Sfrantzen } else { 2393d49904cStb for (i = 0; i < nitems(icmp6_type); i++) { 24030620b12Sfrantzen if (type == icmp6_type[i].type) 24130620b12Sfrantzen return (&icmp6_type[i]); 24230620b12Sfrantzen } 24330620b12Sfrantzen } 24430620b12Sfrantzen return (NULL); 245082ebc44Swilfried } 246082ebc44Swilfried 2477d27d81aSdhartmei const struct icmptypeent * 248bb9f691eSmcbride geticmptypebyname(char *w, sa_family_t af) 249082ebc44Swilfried { 2503d49904cStb size_t i; 251082ebc44Swilfried 252d14c53d7Swilfried if (af != AF_INET6) { 2533d49904cStb for (i = 0; i < nitems(icmp_type); i++) { 254082ebc44Swilfried if (!strcmp(w, icmp_type[i].name)) 255082ebc44Swilfried return (&icmp_type[i]); 256082ebc44Swilfried } 25730620b12Sfrantzen } else { 2583d49904cStb for (i = 0; i < nitems(icmp6_type); i++) { 25930620b12Sfrantzen if (!strcmp(w, icmp6_type[i].name)) 26030620b12Sfrantzen return (&icmp6_type[i]); 26130620b12Sfrantzen } 26230620b12Sfrantzen } 26330620b12Sfrantzen return (NULL); 264082ebc44Swilfried } 265082ebc44Swilfried 2667d27d81aSdhartmei const struct icmpcodeent * 267bb9f691eSmcbride geticmpcodebynumber(u_int8_t type, u_int8_t code, sa_family_t af) 268082ebc44Swilfried { 2693d49904cStb size_t i; 270082ebc44Swilfried 271d14c53d7Swilfried if (af != AF_INET6) { 2723d49904cStb for (i = 0; i < nitems(icmp_code); i++) { 27330620b12Sfrantzen if (type == icmp_code[i].type && 27430620b12Sfrantzen code == icmp_code[i].code) 275082ebc44Swilfried return (&icmp_code[i]); 276082ebc44Swilfried } 27730620b12Sfrantzen } else { 2783d49904cStb for (i = 0; i < nitems(icmp6_code); i++) { 27930620b12Sfrantzen if (type == icmp6_code[i].type && 28030620b12Sfrantzen code == icmp6_code[i].code) 28130620b12Sfrantzen return (&icmp6_code[i]); 28230620b12Sfrantzen } 28330620b12Sfrantzen } 28430620b12Sfrantzen return (NULL); 285082ebc44Swilfried } 286082ebc44Swilfried 2877d27d81aSdhartmei const struct icmpcodeent * 288bb9f691eSmcbride geticmpcodebyname(u_long type, char *w, sa_family_t af) 289082ebc44Swilfried { 2903d49904cStb size_t i; 291082ebc44Swilfried 292d14c53d7Swilfried if (af != AF_INET6) { 2933d49904cStb for (i = 0; i < nitems(icmp_code); i++) { 29430620b12Sfrantzen if (type == icmp_code[i].type && 29530620b12Sfrantzen !strcmp(w, icmp_code[i].name)) 296082ebc44Swilfried return (&icmp_code[i]); 297082ebc44Swilfried } 29830620b12Sfrantzen } else { 2993d49904cStb for (i = 0; i < nitems(icmp6_code); i++) { 30030620b12Sfrantzen if (type == icmp6_code[i].type && 30130620b12Sfrantzen !strcmp(w, icmp6_code[i].name)) 30230620b12Sfrantzen return (&icmp6_code[i]); 30330620b12Sfrantzen } 30430620b12Sfrantzen } 30530620b12Sfrantzen return (NULL); 30630620b12Sfrantzen } 30730620b12Sfrantzen 308a2fdc13dSmcbride /* 309a2fdc13dSmcbride * Decode a symbolic name to a numeric value. 310a2fdc13dSmcbride * From syslogd. 311a2fdc13dSmcbride */ 312a2fdc13dSmcbride int 313a2fdc13dSmcbride string_to_loglevel(const char *name) 314a2fdc13dSmcbride { 315a2fdc13dSmcbride CODE *c; 316a2fdc13dSmcbride char *p, buf[40]; 317a2fdc13dSmcbride 318707c207dStedu if (isdigit((unsigned char)*name)) { 319707c207dStedu const char *errstr; 320707c207dStedu int val; 321707c207dStedu 322707c207dStedu val = strtonum(name, 0, LOG_DEBUG, &errstr); 323707c207dStedu if (errstr) 324707c207dStedu return -1; 325707c207dStedu return val; 326707c207dStedu } 327a2fdc13dSmcbride 328a2fdc13dSmcbride for (p = buf; *name && p < &buf[sizeof(buf) - 1]; p++, name++) { 329025f5691Sderaadt if (isupper((unsigned char)*name)) 330025f5691Sderaadt *p = tolower((unsigned char)*name); 331a2fdc13dSmcbride else 332a2fdc13dSmcbride *p = *name; 333a2fdc13dSmcbride } 334a2fdc13dSmcbride *p = '\0'; 335a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++) 336d07c4539Sbluhm if (!strcmp(buf, c->c_name) && c->c_val != INTERNAL_NOPRI) 337a2fdc13dSmcbride return (c->c_val); 338a2fdc13dSmcbride 339a2fdc13dSmcbride return (-1); 340a2fdc13dSmcbride } 341a2fdc13dSmcbride 342a2fdc13dSmcbride const char * 343a2fdc13dSmcbride loglevel_to_string(int level) 344a2fdc13dSmcbride { 345a2fdc13dSmcbride CODE *c; 346a2fdc13dSmcbride 347a2fdc13dSmcbride for (c = prioritynames; c->c_name; c++) 348a2fdc13dSmcbride if (c->c_val == level) 349a2fdc13dSmcbride return (c->c_name); 350a2fdc13dSmcbride 351a2fdc13dSmcbride return ("unknown"); 352a2fdc13dSmcbride } 353a2fdc13dSmcbride 35481a15e5dSderaadt void 3555d9ac2dcSdhartmei print_op(u_int8_t op, const char *a1, const char *a2) 3565d9ac2dcSdhartmei { 3575d9ac2dcSdhartmei if (op == PF_OP_IRG) 3585d9ac2dcSdhartmei printf(" %s >< %s", a1, a2); 3595d9ac2dcSdhartmei else if (op == PF_OP_XRG) 3605d9ac2dcSdhartmei printf(" %s <> %s", a1, a2); 3611308506cShenning else if (op == PF_OP_EQ) 3625d9ac2dcSdhartmei printf(" = %s", a1); 3631308506cShenning else if (op == PF_OP_NE) 3645d9ac2dcSdhartmei printf(" != %s", a1); 3651308506cShenning else if (op == PF_OP_LT) 3665d9ac2dcSdhartmei printf(" < %s", a1); 3675d9ac2dcSdhartmei else if (op == PF_OP_LE) 3685d9ac2dcSdhartmei printf(" <= %s", a1); 3695d9ac2dcSdhartmei else if (op == PF_OP_GT) 3705d9ac2dcSdhartmei printf(" > %s", a1); 3715d9ac2dcSdhartmei else if (op == PF_OP_GE) 3725d9ac2dcSdhartmei printf(" >= %s", a1); 3738da4e377Smcbride else if (op == PF_OP_RRG) 3748da4e377Smcbride printf(" %s:%s", a1, a2); 3755d9ac2dcSdhartmei } 3765d9ac2dcSdhartmei 3775d9ac2dcSdhartmei void 378ad85696eShenning print_port(u_int8_t op, u_int16_t p1, u_int16_t p2, const char *proto, int opts) 37914a9b182Skjell { 380e31d21c9Sdhartmei char a1[6], a2[6]; 381ad85696eShenning struct servent *s = NULL; 38281a15e5dSderaadt 383ad85696eShenning if (opts & PF_OPT_PORTNAMES) 384e4ebe044Shenning s = getservbyport(p1, proto); 38514a9b182Skjell p1 = ntohs(p1); 38614a9b182Skjell p2 = ntohs(p2); 3875d9ac2dcSdhartmei snprintf(a1, sizeof(a1), "%u", p1); 3885d9ac2dcSdhartmei snprintf(a2, sizeof(a2), "%u", p2); 38914a9b182Skjell printf(" port"); 3905d9ac2dcSdhartmei if (s != NULL && (op == PF_OP_EQ || op == PF_OP_NE)) 3915d9ac2dcSdhartmei print_op(op, s->s_name, a2); 39214a9b182Skjell else 3935d9ac2dcSdhartmei print_op(op, a1, a2); 3945d9ac2dcSdhartmei } 3955d9ac2dcSdhartmei 3965d9ac2dcSdhartmei void 397b4de0548Smillert print_ugid(u_int8_t op, id_t i1, id_t i2, const char *t) 3985d9ac2dcSdhartmei { 399d8fcd2dfSdhartmei char a1[11], a2[11]; 4005d9ac2dcSdhartmei 401b4de0548Smillert snprintf(a1, sizeof(a1), "%u", i1); 402b4de0548Smillert snprintf(a2, sizeof(a2), "%u", i2); 4035d9ac2dcSdhartmei printf(" %s", t); 404b4de0548Smillert if (i1 == -1 && (op == PF_OP_EQ || op == PF_OP_NE)) 405c16ab608Sdhartmei print_op(op, "unknown", a2); 406c16ab608Sdhartmei else 407c16ab608Sdhartmei print_op(op, a1, a2); 408c16ab608Sdhartmei } 409c16ab608Sdhartmei 410c16ab608Sdhartmei void 41114a9b182Skjell print_flags(u_int8_t f) 41214a9b182Skjell { 41314a9b182Skjell int i; 41481a15e5dSderaadt 415bc795af0Shugh for (i = 0; tcpflags[i]; ++i) 41614a9b182Skjell if (f & (1 << i)) 41714a9b182Skjell printf("%c", tcpflags[i]); 41814a9b182Skjell } 41914a9b182Skjell 42014a9b182Skjell void 42164b4b616Sfrantzen print_fromto(struct pf_rule_addr *src, pf_osfp_t osfp, struct pf_rule_addr *dst, 422ad85696eShenning sa_family_t af, u_int8_t proto, int opts) 42315e76891Sdhartmei { 42464b4b616Sfrantzen char buf[PF_OSFP_LEN*3]; 425ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 4261173271aScedric if (src->addr.type == PF_ADDR_ADDRMASK && 4271173271aScedric dst->addr.type == PF_ADDR_ADDRMASK && 428bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.addr, AF_INET6) && 429bcf142a4Sdhartmei PF_AZERO(&src->addr.v.a.mask, AF_INET6) && 4301173271aScedric PF_AZERO(&dst->addr.v.a.addr, AF_INET6) && 4311173271aScedric PF_AZERO(&dst->addr.v.a.mask, AF_INET6) && 432d4008a34Sdhartmei !src->neg && !dst->neg && 43364b4b616Sfrantzen !src->port_op && !dst->port_op && 43464b4b616Sfrantzen osfp == PF_OSFP_ANY) 43515e76891Sdhartmei printf(" all"); 43615e76891Sdhartmei else { 43715e76891Sdhartmei printf(" from "); 438d4008a34Sdhartmei if (src->neg) 43915e76891Sdhartmei printf("! "); 44044f5ed0aScedric print_addr(&src->addr, af, verbose); 44115e76891Sdhartmei if (src->port_op) 44215e76891Sdhartmei print_port(src->port_op, src->port[0], 44315e76891Sdhartmei src->port[1], 444ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts); 44564b4b616Sfrantzen if (osfp != PF_OSFP_ANY) 44664b4b616Sfrantzen printf(" os \"%s\"", pfctl_lookup_fingerprint(osfp, buf, 44764b4b616Sfrantzen sizeof(buf))); 44815e76891Sdhartmei 44915e76891Sdhartmei printf(" to "); 450d4008a34Sdhartmei if (dst->neg) 45115e76891Sdhartmei printf("! "); 45244f5ed0aScedric print_addr(&dst->addr, af, verbose); 45315e76891Sdhartmei if (dst->port_op) 45415e76891Sdhartmei print_port(dst->port_op, dst->port[0], 45515e76891Sdhartmei dst->port[1], 456ad85696eShenning proto == IPPROTO_TCP ? "tcp" : "udp", opts); 45715e76891Sdhartmei } 45815e76891Sdhartmei } 45915e76891Sdhartmei 46015e76891Sdhartmei void 461e0c302d0Smcbride print_pool(struct pf_pool *pool, u_int16_t p1, u_int16_t p2, 46236754172Smcbride sa_family_t af, int id, int verbose) 4633a44df3cSmcbride { 46436754172Smcbride if (pool->ifname[0]) { 465a2f57b9fSmcbride if (!PF_AZERO(&pool->addr.v.a.addr, af)) { 46636754172Smcbride print_addr(&pool->addr, af, verbose); 467a2f57b9fSmcbride printf("@"); 468a2f57b9fSmcbride } 469a2f57b9fSmcbride printf("%s", pool->ifname); 47036754172Smcbride } else 47136754172Smcbride print_addr(&pool->addr, af, verbose); 472e0c302d0Smcbride switch (id) { 473a64374fdSmcbride case PF_POOL_NAT: 4749782f7a2Smcbride if ((p1 != PF_NAT_PROXY_PORT_LOW || 4759782f7a2Smcbride p2 != PF_NAT_PROXY_PORT_HIGH) && (p1 != 0 || p2 != 0)) { 476e0c302d0Smcbride if (p1 == p2) 477e0c302d0Smcbride printf(" port %u", p1); 478e0c302d0Smcbride else 479e0c302d0Smcbride printf(" port %u:%u", p1, p2); 480e0c302d0Smcbride } 481e0c302d0Smcbride break; 482a64374fdSmcbride case PF_POOL_RDR: 483e0c302d0Smcbride if (p1) { 4848da4e377Smcbride printf(" port %u", p1); 4858da4e377Smcbride if (p2 && (p2 != p1)) 4868da4e377Smcbride printf(":%u", p2); 487e0c302d0Smcbride } 488e0c302d0Smcbride break; 489e0c302d0Smcbride default: 490e0c302d0Smcbride break; 491e0c302d0Smcbride } 492e0c302d0Smcbride switch (pool->opts & PF_POOL_TYPEMASK) { 493e0c302d0Smcbride case PF_POOL_NONE: 494e0c302d0Smcbride break; 495e0c302d0Smcbride case PF_POOL_BITMASK: 496e0c302d0Smcbride printf(" bitmask"); 497e0c302d0Smcbride break; 498e0c302d0Smcbride case PF_POOL_RANDOM: 499e0c302d0Smcbride printf(" random"); 500e0c302d0Smcbride break; 501e0c302d0Smcbride case PF_POOL_SRCHASH: 5020436fa02Smcbride printf(" source-hash 0x%08x%08x%08x%08x", 503e0c302d0Smcbride pool->key.key32[0], pool->key.key32[1], 504e0c302d0Smcbride pool->key.key32[2], pool->key.key32[3]); 505e0c302d0Smcbride break; 506e0c302d0Smcbride case PF_POOL_ROUNDROBIN: 507e0c302d0Smcbride printf(" round-robin"); 508e0c302d0Smcbride break; 509bcb11948Szinke case PF_POOL_LEASTSTATES: 510bcb11948Szinke printf(" least-states"); 511bcb11948Szinke break; 512e0c302d0Smcbride } 513fd777407Smcbride if (pool->opts & PF_POOL_STICKYADDR) 514fd777407Smcbride printf(" sticky-address"); 515a64374fdSmcbride if (id == PF_POOL_NAT && p1 == 0 && p2 == 0) 516e0c302d0Smcbride printf(" static-port"); 5173a44df3cSmcbride } 5183a44df3cSmcbride 519132c30ccShenning const char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 5206b640f62Smcbride const char *pf_lcounters[LCNT_MAX+1] = LCNT_NAMES; 521132c30ccShenning const char *pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; 52219e99d06Sbluhm const char *pf_scounters[SCNT_MAX+1] = FCNT_NAMES; 52319e99d06Sbluhm const char *pf_ncounters[NCNT_MAX+1] = FCNT_NAMES; 52499a73934Sderaadt 52514a9b182Skjell void 5266af76811Shenning print_status(struct pf_status *s, struct pfctl_watermarks *synflwats, int opts) 52714a9b182Skjell { 528a2fdc13dSmcbride char statline[80], *running, *debug; 52963b24bdaSpatrick time_t runtime = 0; 53063b24bdaSpatrick struct timespec uptime; 53199a73934Sderaadt int i; 532a1973c63Ssturm char buf[PF_MD5_DIGEST_LENGTH * 2 + 1]; 533010eb8d3Smpf static const char hex[] = "0123456789abcdef"; 53499a73934Sderaadt 535e45b97acScheloha if (!clock_gettime(CLOCK_BOOTTIME, &uptime)) 53663b24bdaSpatrick runtime = uptime.tv_sec - s->since; 5375191b30fScedric running = s->running ? "Enabled" : "Disabled"; 538c474e331Shenning 53963b24bdaSpatrick if (runtime) { 540b14a9e08Sderaadt unsigned int sec, min, hrs; 541b14a9e08Sderaadt time_t day = runtime; 542d85e4ad6Sdhartmei 543d85e4ad6Sdhartmei sec = day % 60; 544d85e4ad6Sdhartmei day /= 60; 545d85e4ad6Sdhartmei min = day % 60; 546d85e4ad6Sdhartmei day /= 60; 547d85e4ad6Sdhartmei hrs = day % 24; 548d85e4ad6Sdhartmei day /= 24; 549c474e331Shenning snprintf(statline, sizeof(statline), 550b14a9e08Sderaadt "Status: %s for %lld days %.2u:%.2u:%.2u", 551b14a9e08Sderaadt running, (long long)day, hrs, min, sec); 552d85e4ad6Sdhartmei } else 5535191b30fScedric snprintf(statline, sizeof(statline), "Status: %s", running); 554c97b4ee1Shenning printf("%-44s", statline); 555aa48e8d1Smillert if (asprintf(&debug, "Debug: %s", loglevel_to_string(s->debug)) != -1) { 556a2fdc13dSmcbride printf("%15s\n\n", debug); 557e2714f7cSderaadt free(debug); 558aa48e8d1Smillert } 559f6e85b8dSmcbride 560f6e85b8dSmcbride if (opts & PF_OPT_VERBOSE) { 561010eb8d3Smpf printf("Hostid: 0x%08x\n", ntohl(s->hostid)); 562010eb8d3Smpf 563a1973c63Ssturm for (i = 0; i < PF_MD5_DIGEST_LENGTH; i++) { 564010eb8d3Smpf buf[i + i] = hex[s->pf_chksum[i] >> 4]; 565010eb8d3Smpf buf[i + i + 1] = hex[s->pf_chksum[i] & 0x0f]; 566010eb8d3Smpf } 567010eb8d3Smpf buf[i + i] = '\0'; 568010eb8d3Smpf printf("Checksum: 0x%s\n\n", buf); 569f6e85b8dSmcbride } 570010eb8d3Smpf 571c474e331Shenning if (s->ifname[0] != 0) { 572c474e331Shenning printf("Interface Stats for %-16s %5s %16s\n", 573c474e331Shenning s->ifname, "IPv4", "IPv6"); 574c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes In", 575ef22e615Sdhartmei (unsigned long long)s->bcounters[0][0], 576ef22e615Sdhartmei (unsigned long long)s->bcounters[1][0]); 577c474e331Shenning printf(" %-25s %14llu %16llu\n", "Bytes Out", 578ef22e615Sdhartmei (unsigned long long)s->bcounters[0][1], 579ef22e615Sdhartmei (unsigned long long)s->bcounters[1][1]); 580c474e331Shenning printf(" Packets In\n"); 581c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 582ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_PASS], 583ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_PASS]); 584c474e331Shenning printf(" %-23s %14llu %16llu\n", "Blocked", 585ef22e615Sdhartmei (unsigned long long)s->pcounters[0][0][PF_DROP], 586ef22e615Sdhartmei (unsigned long long)s->pcounters[1][0][PF_DROP]); 587c474e331Shenning printf(" Packets Out\n"); 588c474e331Shenning printf(" %-23s %14llu %16llu\n", "Passed", 589ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_PASS], 590ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_PASS]); 591c474e331Shenning printf(" %-23s %14llu %16llu\n\n", "Blocked", 592ef22e615Sdhartmei (unsigned long long)s->pcounters[0][1][PF_DROP], 593ef22e615Sdhartmei (unsigned long long)s->pcounters[1][1][PF_DROP]); 594c474e331Shenning } 595c474e331Shenning printf("%-27s %14s %16s\n", "State Table", "Total", "Rate"); 596c474e331Shenning printf(" %-25s %14u %14s\n", "current entries", s->states, ""); 597b18f971fShenning printf(" %-25s %14u %14s\n", "half-open tcp", s->states_halfopen, ""); 598c474e331Shenning for (i = 0; i < FCNT_MAX; i++) { 599ea4ec064Sitojun printf(" %-25s %14llu ", pf_fcounters[i], 600ea4ec064Sitojun (unsigned long long)s->fcounters[i]); 601c474e331Shenning if (runtime > 0) 602c474e331Shenning printf("%14.1f/s\n", 603c474e331Shenning (double)s->fcounters[i] / (double)runtime); 604c474e331Shenning else 605c474e331Shenning printf("%14s\n", ""); 606c474e331Shenning } 607fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 608fd777407Smcbride printf("Source Tracking Table\n"); 609fd777407Smcbride printf(" %-25s %14u %14s\n", "current entries", 610fd777407Smcbride s->src_nodes, ""); 611fd777407Smcbride for (i = 0; i < SCNT_MAX; i++) { 612fd777407Smcbride printf(" %-25s %14lld ", pf_scounters[i], 613fd777407Smcbride s->scounters[i]); 614fd777407Smcbride if (runtime > 0) 615fd777407Smcbride printf("%14.1f/s\n", 616fd777407Smcbride (double)s->scounters[i] / (double)runtime); 617fd777407Smcbride else 618fd777407Smcbride printf("%14s\n", ""); 619fd777407Smcbride } 620fd777407Smcbride } 62119e99d06Sbluhm if (opts & PF_OPT_VERBOSE) { 62219e99d06Sbluhm printf("Fragments\n"); 62319e99d06Sbluhm printf(" %-25s %14u %14s\n", "current entries", 62419e99d06Sbluhm s->fragments, ""); 62519e99d06Sbluhm for (i = 0; i < NCNT_MAX; i++) { 62619e99d06Sbluhm printf(" %-25s %14lld ", pf_ncounters[i], 62719e99d06Sbluhm s->ncounters[i]); 62819e99d06Sbluhm if (runtime > 0) 62919e99d06Sbluhm printf("%14.1f/s\n", 63019e99d06Sbluhm (double)s->ncounters[i] / (double)runtime); 63119e99d06Sbluhm else 63219e99d06Sbluhm printf("%14s\n", ""); 63319e99d06Sbluhm } 63419e99d06Sbluhm } 63599a73934Sderaadt printf("Counters\n"); 636c474e331Shenning for (i = 0; i < PFRES_MAX; i++) { 637ea4ec064Sitojun printf(" %-25s %14llu ", pf_reasons[i], 638ea4ec064Sitojun (unsigned long long)s->counters[i]); 639c474e331Shenning if (runtime > 0) 640c474e331Shenning printf("%14.1f/s\n", 641c474e331Shenning (double)s->counters[i] / (double)runtime); 642c474e331Shenning else 643c474e331Shenning printf("%14s\n", ""); 644c474e331Shenning } 6456b640f62Smcbride if (opts & PF_OPT_VERBOSE) { 6466b640f62Smcbride printf("Limit Counters\n"); 6476b640f62Smcbride for (i = 0; i < LCNT_MAX; i++) { 6486b640f62Smcbride printf(" %-25s %14lld ", pf_lcounters[i], 6496b640f62Smcbride s->lcounters[i]); 6506b640f62Smcbride if (runtime > 0) 6516b640f62Smcbride printf("%14.1f/s\n", 6526b640f62Smcbride (double)s->lcounters[i] / (double)runtime); 6536b640f62Smcbride else 6546b640f62Smcbride printf("%14s\n", ""); 6556b640f62Smcbride } 6566b640f62Smcbride } 6576af76811Shenning if (opts & PF_OPT_VERBOSE) { 6586af76811Shenning printf("Adaptive Syncookies Watermarks\n"); 6596af76811Shenning printf(" %-25s %14d states\n", "start", synflwats->hi); 6606af76811Shenning printf(" %-25s %14d states\n", "end", synflwats->lo); 6616af76811Shenning } 66214a9b182Skjell } 66314a9b182Skjell 66414a9b182Skjell void 665fd777407Smcbride print_src_node(struct pf_src_node *sn, int opts) 666fd777407Smcbride { 667fd777407Smcbride struct pf_addr_wrap aw; 668fd777407Smcbride int min, sec; 669fd777407Smcbride 670fd777407Smcbride memset(&aw, 0, sizeof(aw)); 671fd777407Smcbride if (sn->af == AF_INET) 672fd777407Smcbride aw.v.a.mask.addr32[0] = 0xffffffff; 673fd777407Smcbride else 674fd777407Smcbride memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); 675fd777407Smcbride 676fd777407Smcbride aw.v.a.addr = sn->addr; 677fd777407Smcbride print_addr(&aw, sn->af, opts & PF_OPT_VERBOSE2); 678c3e2fff9Shenning 679c3e2fff9Shenning if (!PF_AZERO(&sn->raddr, sn->af)) { 680c3e2fff9Shenning if (sn->type == PF_SN_NAT) 681c3e2fff9Shenning printf(" nat-to "); 682c3e2fff9Shenning else if (sn->type == PF_SN_RDR) 683c3e2fff9Shenning printf(" rdr-to "); 684c3e2fff9Shenning else if (sn->type == PF_SN_ROUTE) 685c3e2fff9Shenning printf(" route-to "); 686c3e2fff9Shenning else 687c3e2fff9Shenning printf(" ??? (%u) ", sn->type); 688fd777407Smcbride aw.v.a.addr = sn->raddr; 6890cde32ceSclaudio print_addr(&aw, sn->naf ? sn->naf : sn->af, 6900cde32ceSclaudio opts & PF_OPT_VERBOSE2); 691c3e2fff9Shenning } 692c3e2fff9Shenning 6936b640f62Smcbride printf(" ( states %u, connections %u, rate %u.%u/%us )\n", sn->states, 6946b640f62Smcbride sn->conn, sn->conn_rate.count / 1000, 6956b640f62Smcbride (sn->conn_rate.count % 1000) / 100, sn->conn_rate.seconds); 696fd777407Smcbride if (opts & PF_OPT_VERBOSE) { 697fd777407Smcbride sec = sn->creation % 60; 698fd777407Smcbride sn->creation /= 60; 699fd777407Smcbride min = sn->creation % 60; 700fd777407Smcbride sn->creation /= 60; 701fd777407Smcbride printf(" age %.2u:%.2u:%.2u", sn->creation, min, sec); 702fd777407Smcbride if (sn->states == 0) { 703fd777407Smcbride sec = sn->expire % 60; 704fd777407Smcbride sn->expire /= 60; 705fd777407Smcbride min = sn->expire % 60; 706fd777407Smcbride sn->expire /= 60; 707fd777407Smcbride printf(", expires in %.2u:%.2u:%.2u", 708fd777407Smcbride sn->expire, min, sec); 709fd777407Smcbride } 710b19e9e6fSmcbride printf(", %llu pkts, %llu bytes", 711b19e9e6fSmcbride sn->packets[0] + sn->packets[1], 71259b61cdeShenning sn->bytes[0] + sn->bytes[1]); 713fd777407Smcbride if (sn->rule.nr != -1) 714c3e2fff9Shenning printf(", rule %u", sn->rule.nr); 715fd777407Smcbride printf("\n"); 716fd777407Smcbride } 717fd777407Smcbride } 718fd777407Smcbride 719fd777407Smcbride void 720ad85696eShenning print_rule(struct pf_rule *r, const char *anchor_call, int opts) 72114a9b182Skjell { 7220e8bc214Saaron static const char *actiontypes[] = { "pass", "block", "scrub", 723e9953237Shenning "no scrub", "nat", "no nat", "binat", "no binat", "rdr", "no rdr", 724e9953237Shenning "", "", "match"}; 7251173271aScedric static const char *anchortypes[] = { "anchor", "anchor", "anchor", 7260e8bc214Saaron "anchor", "nat-anchor", "nat-anchor", "binat-anchor", 7270e8bc214Saaron "binat-anchor", "rdr-anchor", "rdr-anchor" }; 7286992ade7Shenning int i, ropts; 729ad85696eShenning int verbose = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 730f9a568a2Smcbride char *p; 731cc5f0329Sdhartmei 7328cf23eedSsashan if ((r->rule_flag & PFRULE_EXPIRED) && (!verbose)) 7338cf23eedSsashan return; 7348cf23eedSsashan 73574dc4fddShenning if (verbose) 73678baf774Sdhartmei printf("@%d ", r->nr); 7378cf23eedSsashan 738730c5d01Sjsg if (anchor_call[0]) { 739730c5d01Sjsg if (r->action >= nitems(anchortypes)) { 740730c5d01Sjsg printf("anchor(%d)", r->action); 741730c5d01Sjsg } else { 742f9a568a2Smcbride p = strrchr(anchor_call, '/'); 743f9a568a2Smcbride if (p ? p[1] == '_' : anchor_call[0] == '_') 744305ca21dSmcbride printf("%s", anchortypes[r->action]); 745f9a568a2Smcbride else 746e77e5dc4Sjaredy printf("%s \"%s\"", anchortypes[r->action], 747e77e5dc4Sjaredy anchor_call); 748730c5d01Sjsg } 749730c5d01Sjsg } else { 750730c5d01Sjsg if (r->action >= nitems(actiontypes)) 751730c5d01Sjsg printf("action(%d)", r->action); 752730c5d01Sjsg else 7531173271aScedric printf("%s", actiontypes[r->action]); 754730c5d01Sjsg } 7551173271aScedric if (r->action == PF_DROP) { 7568a87542aShenning if (r->rule_flag & PFRULE_RETURN) 7578a87542aShenning printf(" return"); 7588a87542aShenning else if (r->rule_flag & PFRULE_RETURNRST) { 7591f77cc8aSpb if (!r->return_ttl) 76014a9b182Skjell printf(" return-rst"); 7611f77cc8aSpb else 7621f77cc8aSpb printf(" return-rst(ttl %d)", r->return_ttl); 763328b2decShenning } else if (r->rule_flag & PFRULE_RETURNICMP) { 764328b2decShenning const struct icmpcodeent *ic, *ic6; 765b996d042Sdhartmei 766b996d042Sdhartmei ic = geticmpcodebynumber(r->return_icmp >> 8, 767328b2decShenning r->return_icmp & 255, AF_INET); 768328b2decShenning ic6 = geticmpcodebynumber(r->return_icmp6 >> 8, 769328b2decShenning r->return_icmp6 & 255, AF_INET6); 770d14c53d7Swilfried 771328b2decShenning switch (r->af) { 772328b2decShenning case AF_INET: 773328b2decShenning printf(" return-icmp"); 774d14c53d7Swilfried if (ic == NULL) 775d14c53d7Swilfried printf("(%u)", r->return_icmp & 255); 776b996d042Sdhartmei else 777328b2decShenning printf("(%s)", ic->name); 778328b2decShenning break; 779328b2decShenning case AF_INET6: 780328b2decShenning printf(" return-icmp6"); 781328b2decShenning if (ic6 == NULL) 782328b2decShenning printf("(%u)", r->return_icmp6 & 255); 783328b2decShenning else 784328b2decShenning printf("(%s)", ic6->name); 785328b2decShenning break; 786328b2decShenning default: 787328b2decShenning printf(" return-icmp"); 788328b2decShenning if (ic == NULL) 789328b2decShenning printf("(%u, ", r->return_icmp & 255); 790328b2decShenning else 791328b2decShenning printf("(%s, ", ic->name); 792328b2decShenning if (ic6 == NULL) 793328b2decShenning printf("%u)", r->return_icmp6 & 255); 794328b2decShenning else 795328b2decShenning printf("%s)", ic6->name); 796328b2decShenning break; 797328b2decShenning } 798acf2444cShenning } else 799acf2444cShenning printf(" drop"); 8001173271aScedric } 8017189e280Sdhartmei if (r->direction == PF_IN) 80214a9b182Skjell printf(" in"); 8037189e280Sdhartmei else if (r->direction == PF_OUT) 80414a9b182Skjell printf(" out"); 805a46dc179Sdhartmei if (r->log) { 806a46dc179Sdhartmei printf(" log"); 807f565c2a8Shenning if (r->log & ~PF_LOG || r->logif) { 8081cb19346Sdhartmei int count = 0; 8091cb19346Sdhartmei 810a46dc179Sdhartmei printf(" ("); 8111cb19346Sdhartmei if (r->log & PF_LOG_ALL) 8121cb19346Sdhartmei printf("%sall", count++ ? ", " : ""); 813f496e916Shenning if (r->log & PF_LOG_MATCHES) 814f496e916Shenning printf("%smatches", count++ ? ", " : ""); 815f6d3bf21Sbluhm if (r->log & PF_LOG_USER) 8161cb19346Sdhartmei printf("%suser", count++ ? ", " : ""); 817f565c2a8Shenning if (r->logif) 818f565c2a8Shenning printf("%sto pflog%u", count++ ? ", " : "", 819f565c2a8Shenning r->logif); 820a46dc179Sdhartmei printf(")"); 821a46dc179Sdhartmei } 822a46dc179Sdhartmei } 82314a9b182Skjell if (r->quick) 82414a9b182Skjell printf(" quick"); 8257d0c9138Shenning if (r->ifname[0]) { 8267d0c9138Shenning if (r->ifnot) 8277d0c9138Shenning printf(" on ! %s", r->ifname); 8287d0c9138Shenning else 82914a9b182Skjell printf(" on %s", r->ifname); 8307d0c9138Shenning } 8319e70289eSclaudio if (r->onrdomain >= 0) { 8329e70289eSclaudio if (r->ifnot) 83341d2b8c8Sderaadt printf(" on ! rdomain %d", r->onrdomain); 8349e70289eSclaudio else 83541d2b8c8Sderaadt printf(" on rdomain %d", r->onrdomain); 8369e70289eSclaudio } 83730620b12Sfrantzen if (r->af) { 83830620b12Sfrantzen if (r->af == AF_INET) 83930620b12Sfrantzen printf(" inet"); 84030620b12Sfrantzen else 84130620b12Sfrantzen printf(" inet6"); 84230620b12Sfrantzen } 84314a9b182Skjell if (r->proto) { 844e4ebe044Shenning struct protoent *p; 845ed99c291Sderaadt 846e4ebe044Shenning if ((p = getprotobynumber(r->proto)) != NULL) 84714a9b182Skjell printf(" proto %s", p->p_name); 84814a9b182Skjell else 84914a9b182Skjell printf(" proto %u", r->proto); 85014a9b182Skjell } 85164b4b616Sfrantzen print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto, 852ad85696eShenning opts); 85395b43208Sdlg if (r->rcv_ifname[0]) 8547d0482a9Shenning printf(" %sreceived-on %s", r->rcvifnot ? "!" : "", 8557d0482a9Shenning r->rcv_ifname); 856c16ab608Sdhartmei if (r->uid.op) 857b4de0548Smillert print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user"); 858c16ab608Sdhartmei if (r->gid.op) 859b4de0548Smillert print_ugid(r->gid.op, r->gid.gid[0], r->gid.gid[1], "group"); 86014a9b182Skjell if (r->flags || r->flagset) { 86114a9b182Skjell printf(" flags "); 86214a9b182Skjell print_flags(r->flags); 86314a9b182Skjell printf("/"); 86414a9b182Skjell print_flags(r->flagset); 865e9953237Shenning } else if ((r->action == PF_PASS || r->action == PF_MATCH) && 866bd9b24faSmcbride (!r->proto || r->proto == IPPROTO_TCP) && 867bd9b24faSmcbride !(r->rule_flag & PFRULE_FRAGMENT) && 868be73131dSmcbride !anchor_call[0] && r->keep_state) 869bd9b24faSmcbride printf(" flags any"); 870082ebc44Swilfried if (r->type) { 871b49ca6bbShenning const struct icmptypeent *it; 872082ebc44Swilfried 873b49ca6bbShenning it = geticmptypebynumber(r->type-1, r->af); 874d14c53d7Swilfried if (r->af != AF_INET6) 875d14c53d7Swilfried printf(" icmp-type"); 876082ebc44Swilfried else 877d0cb3502Smcbride printf(" icmp6-type"); 878b49ca6bbShenning if (it != NULL) 879b49ca6bbShenning printf(" %s", it->name); 880d14c53d7Swilfried else 881d14c53d7Swilfried printf(" %u", r->type-1); 882082ebc44Swilfried if (r->code) { 883b49ca6bbShenning const struct icmpcodeent *ic; 884082ebc44Swilfried 885b49ca6bbShenning ic = geticmpcodebynumber(r->type-1, r->code-1, r->af); 886b49ca6bbShenning if (ic != NULL) 887b49ca6bbShenning printf(" code %s", ic->name); 888082ebc44Swilfried else 88914a9b182Skjell printf(" code %u", r->code-1); 890082ebc44Swilfried } 891082ebc44Swilfried } 892e4cbe364Sdhartmei if (r->tos) 893e4cbe364Sdhartmei printf(" tos 0x%2.2x", r->tos); 8947407027eSsthen if (r->prio) 8957407027eSsthen printf(" prio %u", r->prio == PF_PRIO_ZERO ? 0 : r->prio); 8965a4ae9a9Shenning if (r->pktrate.limit) 8975a4ae9a9Shenning printf(" max-pkt-rate %u/%u", r->pktrate.limit, 8985a4ae9a9Shenning r->pktrate.seconds); 8996ac157faSmcbride 900ea700e0fShenning if (r->scrub_flags & PFSTATE_SETMASK || r->qname[0] || 901ea700e0fShenning r->rule_flag & PFRULE_SETDELAY) { 902f8b0ac7eShenning char *comma = ""; 9032aa5186dShenning printf(" set ("); 90408263cb1Shenning if (r->scrub_flags & PFSTATE_SETPRIO) { 905f8b0ac7eShenning if (r->set_prio[0] == r->set_prio[1]) 906f8b0ac7eShenning printf("%sprio %u", comma, r->set_prio[0]); 907f8b0ac7eShenning else 908f8b0ac7eShenning printf("%sprio(%u, %u)", comma, r->set_prio[0], 909f8b0ac7eShenning r->set_prio[1]); 910f8b0ac7eShenning comma = ", "; 911f8b0ac7eShenning } 9120feb7a02Shenning if (r->qname[0]) { 9130feb7a02Shenning if (r->pqname[0]) 9140feb7a02Shenning printf("%squeue(%s, %s)", comma, r->qname, 9150feb7a02Shenning r->pqname); 9160feb7a02Shenning else 9170feb7a02Shenning printf("%squeue %s", comma, r->qname); 9180feb7a02Shenning comma = ", "; 9190feb7a02Shenning } 920f8b0ac7eShenning if (r->scrub_flags & PFSTATE_SETTOS) { 921f8b0ac7eShenning printf("%stos 0x%2.2x", comma, r->set_tos); 922f8b0ac7eShenning comma = ", "; 923f8b0ac7eShenning } 924ea700e0fShenning if (r->rule_flag & PFRULE_SETDELAY) { 925ea700e0fShenning printf("%sdelay %u", comma, r->delay); 926ea700e0fShenning comma = ", "; 927ea700e0fShenning } 9282aa5186dShenning printf(")"); 929f8b0ac7eShenning } 930f8b0ac7eShenning 9316992ade7Shenning ropts = 0; 9326ac157faSmcbride if (r->max_states || r->max_src_nodes || r->max_src_states) 9336992ade7Shenning ropts = 1; 9346ac157faSmcbride if (r->rule_flag & PFRULE_NOSYNC) 9356992ade7Shenning ropts = 1; 9366ac157faSmcbride if (r->rule_flag & PFRULE_SRCTRACK) 9376992ade7Shenning ropts = 1; 9386ac157faSmcbride if (r->rule_flag & PFRULE_IFBOUND) 9396992ade7Shenning ropts = 1; 9406ac157faSmcbride if (r->rule_flag & PFRULE_STATESLOPPY) 9416992ade7Shenning ropts = 1; 9426ac157faSmcbride if (r->rule_flag & PFRULE_PFLOW) 9436992ade7Shenning ropts = 1; 9446992ade7Shenning for (i = 0; !ropts && i < PFTM_MAX; ++i) 9456ac157faSmcbride if (r->timeout[i]) 9466992ade7Shenning ropts = 1; 9476ac157faSmcbride 948bd9b24faSmcbride if (!r->keep_state && r->action == PF_PASS && !anchor_call[0]) 949f644f0ccSmcbride printf(" no state"); 9506992ade7Shenning else if (r->keep_state == PF_STATE_NORMAL && ropts) 95114a9b182Skjell printf(" keep state"); 952b96c47abSfrantzen else if (r->keep_state == PF_STATE_MODULATE) 953b96c47abSfrantzen printf(" modulate state"); 95452e0438eSdhartmei else if (r->keep_state == PF_STATE_SYNPROXY) 95552e0438eSdhartmei printf(" synproxy state"); 95638425613Scedric if (r->prob) { 95738425613Scedric char buf[20]; 95838425613Scedric 95938425613Scedric snprintf(buf, sizeof(buf), "%f", r->prob*100.0/(UINT_MAX+1.0)); 96038425613Scedric for (i = strlen(buf)-1; i > 0; i--) { 96138425613Scedric if (buf[i] == '0') 96238425613Scedric buf[i] = '\0'; 96338425613Scedric else { 96438425613Scedric if (buf[i] == '.') 96538425613Scedric buf[i] = '\0'; 96638425613Scedric break; 96738425613Scedric } 96838425613Scedric } 96938425613Scedric printf(" probability %s%%", buf); 97038425613Scedric } 9716992ade7Shenning if (ropts) { 972cc5f0329Sdhartmei printf(" ("); 973cc5f0329Sdhartmei if (r->max_states) { 974cc5f0329Sdhartmei printf("max %u", r->max_states); 9756992ade7Shenning ropts = 0; 976cc5f0329Sdhartmei } 977af80fa86Smcbride if (r->rule_flag & PFRULE_NOSYNC) { 9786992ade7Shenning if (!ropts) 979af80fa86Smcbride printf(", "); 980af80fa86Smcbride printf("no-sync"); 9816992ade7Shenning ropts = 0; 982af80fa86Smcbride } 983fd777407Smcbride if (r->rule_flag & PFRULE_SRCTRACK) { 9846992ade7Shenning if (!ropts) 985fd777407Smcbride printf(", "); 986fd777407Smcbride printf("source-track"); 987fd777407Smcbride if (r->rule_flag & PFRULE_RULESRCTRACK) 988fd777407Smcbride printf(" rule"); 989fd777407Smcbride else 990fd777407Smcbride printf(" global"); 9916992ade7Shenning ropts = 0; 992fd777407Smcbride } 993fd777407Smcbride if (r->max_src_states) { 9946992ade7Shenning if (!ropts) 995fd777407Smcbride printf(", "); 996fd777407Smcbride printf("max-src-states %u", r->max_src_states); 9976992ade7Shenning ropts = 0; 998fd777407Smcbride } 9996b640f62Smcbride if (r->max_src_conn) { 10006992ade7Shenning if (!ropts) 10016b640f62Smcbride printf(", "); 10026b640f62Smcbride printf("max-src-conn %u", r->max_src_conn); 10036992ade7Shenning ropts = 0; 10046b640f62Smcbride } 10056b640f62Smcbride if (r->max_src_conn_rate.limit) { 10066992ade7Shenning if (!ropts) 10076b640f62Smcbride printf(", "); 10086b640f62Smcbride printf("max-src-conn-rate %u/%u", 10096b640f62Smcbride r->max_src_conn_rate.limit, 10106b640f62Smcbride r->max_src_conn_rate.seconds); 10116992ade7Shenning ropts = 0; 10126b640f62Smcbride } 1013fd777407Smcbride if (r->max_src_nodes) { 10146992ade7Shenning if (!ropts) 1015fd777407Smcbride printf(", "); 1016fd777407Smcbride printf("max-src-nodes %u", r->max_src_nodes); 10176992ade7Shenning ropts = 0; 1018fd777407Smcbride } 10196b640f62Smcbride if (r->overload_tblname[0]) { 10206992ade7Shenning if (!ropts) 10216b640f62Smcbride printf(", "); 10226b640f62Smcbride printf("overload <%s>", r->overload_tblname); 10231e320a53Sdhartmei if (r->flush) 10246b640f62Smcbride printf(" flush"); 10251e320a53Sdhartmei if (r->flush & PF_FLUSH_GLOBAL) 10261e320a53Sdhartmei printf(" global"); 10276b640f62Smcbride } 1028ec359bd5Scedric if (r->rule_flag & PFRULE_IFBOUND) { 10296992ade7Shenning if (!ropts) 1030ec359bd5Scedric printf(", "); 1031ec359bd5Scedric printf("if-bound"); 10326992ade7Shenning ropts = 0; 1033ec359bd5Scedric } 10344dc07d4cShenning if (r->rule_flag & PFRULE_STATESLOPPY) { 10356992ade7Shenning if (!ropts) 10364dc07d4cShenning printf(", "); 10374dc07d4cShenning printf("sloppy"); 10386992ade7Shenning ropts = 0; 10394dc07d4cShenning } 104018ae10f7Shenning if (r->rule_flag & PFRULE_PFLOW) { 10416992ade7Shenning if (!ropts) 104218ae10f7Shenning printf(", "); 104318ae10f7Shenning printf("pflow"); 10446992ade7Shenning ropts = 0; 104518ae10f7Shenning } 1046cc5f0329Sdhartmei for (i = 0; i < PFTM_MAX; ++i) 1047cc5f0329Sdhartmei if (r->timeout[i]) { 1048ae233f99Sdhartmei int j; 1049ae233f99Sdhartmei 10506992ade7Shenning if (!ropts) 1051cc5f0329Sdhartmei printf(", "); 10526992ade7Shenning ropts = 0; 10537e5eec99Sdhartmei for (j = 0; pf_timeouts[j].name != NULL; 10547e5eec99Sdhartmei ++j) 1055ae233f99Sdhartmei if (pf_timeouts[j].timeout == i) 1056ae233f99Sdhartmei break; 10577e5eec99Sdhartmei printf("%s %u", pf_timeouts[j].name == NULL ? 10587e5eec99Sdhartmei "inv.timeout" : pf_timeouts[j].name, 10597e5eec99Sdhartmei r->timeout[i]); 1060cc5f0329Sdhartmei } 1061cc5f0329Sdhartmei printf(")"); 1062cc5f0329Sdhartmei } 1063e9953237Shenning 1064ddd010a2Sdavid if (r->rule_flag & PFRULE_FRAGMENT) 1065ddd010a2Sdavid printf(" fragment"); 1066ddd010a2Sdavid 1067c4051035Shenning if (r->scrub_flags & PFSTATE_SCRUBMASK || r->min_ttl || r->max_mss) { 1068e9953237Shenning printf(" scrub ("); 10696992ade7Shenning ropts = 1; 107022923725Shenning if (r->scrub_flags & PFSTATE_NODF) { 107167d2a440Sprovos printf("no-df"); 10726992ade7Shenning ropts = 0; 107322923725Shenning } 107422923725Shenning if (r->scrub_flags & PFSTATE_RANDOMID) { 10756992ade7Shenning if (!ropts) 107622923725Shenning printf(" "); 1077edbe3066Sdhartmei printf("random-id"); 10786992ade7Shenning ropts = 0; 107922923725Shenning } 108022923725Shenning if (r->min_ttl) { 10816992ade7Shenning if (!ropts) 108222923725Shenning printf(" "); 108334c76dcbSprovos printf("min-ttl %d", r->min_ttl); 10846992ade7Shenning ropts = 0; 108522923725Shenning } 108622923725Shenning if (r->scrub_flags & PFSTATE_SCRUB_TCP) { 10876992ade7Shenning if (!ropts) 108822923725Shenning printf(" "); 1089e9953237Shenning printf("reassemble tcp"); 10906992ade7Shenning ropts = 0; 109122923725Shenning } 109222923725Shenning if (r->max_mss) { 10936992ade7Shenning if (!ropts) 109422923725Shenning printf(" "); 1095cfa91859Sjasoni printf("max-mss %d", r->max_mss); 10966992ade7Shenning ropts = 0; 109722923725Shenning } 1098e9953237Shenning printf(")"); 1099e9953237Shenning } 1100e9953237Shenning 1101f48d62b3Sdhartmei if (r->allow_opts) 1102f48d62b3Sdhartmei printf(" allow-opts"); 1103455ef0c1Sdhartmei if (r->label[0]) 1104ff45dfa8Scamield printf(" label \"%s\"", r->label); 110544b1b5a8Smikeb if (r->rule_flag & PFRULE_ONCE) 110644b1b5a8Smikeb printf(" once"); 11078aecb81aShenning if (r->tagname[0]) 11088aecb81aShenning printf(" tag %s", r->tagname); 110936369899Shenning if (r->match_tagname[0]) { 111036369899Shenning if (r->match_tag_not) 111136369899Shenning printf(" !"); 11120a5f7f2fShenning printf(" tagged %s", r->match_tagname); 111336369899Shenning } 11145e931757Shenning if (r->rtableid != -1) 11155e931757Shenning printf(" rtable %u", r->rtableid); 111637fced87Sbluhm switch (r->divert.type) { 111737fced87Sbluhm case PF_DIVERT_NONE: 111837fced87Sbluhm break; 111937fced87Sbluhm case PF_DIVERT_TO: { 1120eb900600Smarkus printf(" divert-to "); 112188d4e2f3Skn print_addr_str(r->af, &r->divert.addr); 1122782435eaSmarkus printf(" port %u", ntohs(r->divert.port)); 112337fced87Sbluhm break; 1124eb900600Smarkus } 112537fced87Sbluhm case PF_DIVERT_REPLY: 112637fced87Sbluhm printf(" divert-reply"); 112737fced87Sbluhm break; 112837fced87Sbluhm case PF_DIVERT_PACKET: 112937fced87Sbluhm printf(" divert-packet port %u", ntohs(r->divert.port)); 113037fced87Sbluhm break; 113137fced87Sbluhm default: 113237fced87Sbluhm printf(" divert ???"); 113337fced87Sbluhm break; 1134eb900600Smarkus } 11350cde32ceSclaudio 11360cde32ceSclaudio if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE && 1137fc302162Smikeb r->rule_flag & PFRULE_AFTO) { 11380cde32ceSclaudio printf(" af-to %s from ", r->naf == AF_INET ? "inet" : "inet6"); 11390cde32ceSclaudio print_pool(&r->nat, r->nat.proxy_port[0], 11400cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af, 11410cde32ceSclaudio PF_POOL_NAT, verbose); 11420cde32ceSclaudio if (r->rdr.addr.type != PF_ADDR_NONE) { 11430cde32ceSclaudio printf(" to "); 11440cde32ceSclaudio print_pool(&r->rdr, r->rdr.proxy_port[0], 11450cde32ceSclaudio r->rdr.proxy_port[1], r->naf ? r->naf : r->af, 11460cde32ceSclaudio PF_POOL_RDR, verbose); 11470cde32ceSclaudio } 11480cde32ceSclaudio } else if (!anchor_call[0] && r->nat.addr.type != PF_ADDR_NONE) { 11490ef3d4feShenning printf (" nat-to "); 11500ef3d4feShenning print_pool(&r->nat, r->nat.proxy_port[0], 11510cde32ceSclaudio r->nat.proxy_port[1], r->naf ? r->naf : r->af, 11520cde32ceSclaudio PF_POOL_NAT, verbose); 11530cde32ceSclaudio } else if (!anchor_call[0] && r->rdr.addr.type != PF_ADDR_NONE) { 11540ef3d4feShenning printf (" rdr-to "); 11550ef3d4feShenning print_pool(&r->rdr, r->rdr.proxy_port[0], 1156a64374fdSmcbride r->rdr.proxy_port[1], r->af, PF_POOL_RDR, verbose); 1157d0aca2f2Shenning } 115869e22b15Sreyk if (r->rt) { 115969e22b15Sreyk if (r->rt == PF_ROUTETO) 116069e22b15Sreyk printf(" route-to"); 116169e22b15Sreyk else if (r->rt == PF_REPLYTO) 116269e22b15Sreyk printf(" reply-to"); 116369e22b15Sreyk else if (r->rt == PF_DUPTO) 116469e22b15Sreyk printf(" dup-to"); 116569e22b15Sreyk printf(" "); 1166a64374fdSmcbride print_pool(&r->route, 0, 0, r->af, PF_POOL_ROUTE, verbose); 116769e22b15Sreyk } 1168a21b78caSsashan 1169a21b78caSsashan if (r->rule_flag & PFRULE_EXPIRED) 1170a21b78caSsashan printf(" # expired"); 117169e22b15Sreyk } 117214a9b182Skjell 11735b6c447dScedric void 11745b6c447dScedric print_tabledef(const char *name, int flags, int addrs, 11755b6c447dScedric struct node_tinithead *nodes) 11765b6c447dScedric { 11775b6c447dScedric struct node_tinit *ti, *nti; 11785b6c447dScedric struct node_host *h; 11795b6c447dScedric 11805b6c447dScedric printf("table <%s>", name); 11815b6c447dScedric if (flags & PFR_TFLAG_CONST) 11825b6c447dScedric printf(" const"); 11835b6c447dScedric if (flags & PFR_TFLAG_PERSIST) 11845b6c447dScedric printf(" persist"); 11855f03a6e1Smcbride if (flags & PFR_TFLAG_COUNTERS) 11865f03a6e1Smcbride printf(" counters"); 11875b6c447dScedric SIMPLEQ_FOREACH(ti, nodes, entries) { 11885b6c447dScedric if (ti->file) { 11895b6c447dScedric printf(" file \"%s\"", ti->file); 11905b6c447dScedric continue; 11915b6c447dScedric } 11925b6c447dScedric printf(" {"); 11935b6c447dScedric for (;;) { 11945b6c447dScedric for (h = ti->host; h != NULL; h = h->next) { 11955b6c447dScedric printf(h->not ? " !" : " "); 11965b6c447dScedric print_addr(&h->addr, h->af, 0); 119736754172Smcbride if (h->ifname) 119836754172Smcbride printf("@%s", h->ifname); 11995b6c447dScedric } 12005b6c447dScedric nti = SIMPLEQ_NEXT(ti, entries); 12015b6c447dScedric if (nti != NULL && nti->file == NULL) 12025b6c447dScedric ti = nti; /* merge lists */ 12035b6c447dScedric else 12045b6c447dScedric break; 12055b6c447dScedric } 12065b6c447dScedric printf(" }"); 12075b6c447dScedric } 12085b6c447dScedric if (addrs && SIMPLEQ_EMPTY(nodes)) 12095b6c447dScedric printf(" { }"); 12105b6c447dScedric printf("\n"); 12115b6c447dScedric } 12125b6c447dScedric 1213f8d11d7cShenning void 1214f8d11d7cShenning print_bwspec(const char *prefix, struct pf_queue_bwspec *bw) 1215f8d11d7cShenning { 1216*42a2f8b7Sdlg uint64_t rate; 1217f8d11d7cShenning int i; 1218f8d11d7cShenning static const char unit[] = " KMG"; 1219f8d11d7cShenning 1220f8d11d7cShenning if (bw->percent) 1221f8d11d7cShenning printf("%s%u%%", prefix, bw->percent); 1222f8d11d7cShenning else if (bw->absolute) { 1223f8d11d7cShenning rate = bw->absolute; 1224f4219643Smikeb for (i = 0; rate >= 1000 && i <= 3 && (rate % 1000 == 0); i++) 1225f8d11d7cShenning rate /= 1000; 1226*42a2f8b7Sdlg printf("%s%llu%c", prefix, rate, unit[i]); 1227f8d11d7cShenning } 1228f8d11d7cShenning } 1229f8d11d7cShenning 1230f8d11d7cShenning void 1231f8d11d7cShenning print_scspec(const char *prefix, struct pf_queue_scspec *sc) 1232f8d11d7cShenning { 1233f8d11d7cShenning print_bwspec(prefix, &sc->m2); 1234f8d11d7cShenning if (sc->d) { 1235f8d11d7cShenning printf(" burst "); 1236f8d11d7cShenning print_bwspec("", &sc->m1); 1237f8d11d7cShenning printf(" for %ums", sc->d); 1238f8d11d7cShenning } 1239f8d11d7cShenning } 1240f8d11d7cShenning 1241f8d11d7cShenning void 1242f8d11d7cShenning print_queuespec(struct pf_queuespec *q) 1243f8d11d7cShenning { 1244f8d11d7cShenning printf("queue %s", q->qname); 124570b55ec8Smikeb if (q->parent[0]) 1246f8d11d7cShenning printf(" parent %s", q->parent); 1247cd984deeSmikeb else if (q->ifname[0]) 1248f8d11d7cShenning printf(" on %s", q->ifname); 124970b55ec8Smikeb if (q->flags & PFQS_FLOWQUEUE) { 125070b55ec8Smikeb printf(" flows %u", q->flowqueue.flows); 125170b55ec8Smikeb if (q->flowqueue.quantum > 0) 125270b55ec8Smikeb printf(" quantum %u", q->flowqueue.quantum); 125370b55ec8Smikeb if (q->flowqueue.interval > 0) 125470b55ec8Smikeb printf(" interval %ums", 125570b55ec8Smikeb q->flowqueue.interval / 1000000); 125670b55ec8Smikeb if (q->flowqueue.target > 0) 125770b55ec8Smikeb printf(" target %ums", 125870b55ec8Smikeb q->flowqueue.target / 1000000); 125990944f0fSmikeb } 126090944f0fSmikeb if (q->linkshare.m1.absolute || q->linkshare.m2.absolute) { 1261f8d11d7cShenning print_scspec(" bandwidth ", &q->linkshare); 1262f8d11d7cShenning print_scspec(", min ", &q->realtime); 1263f8d11d7cShenning print_scspec(", max ", &q->upperlimit); 126470b55ec8Smikeb } 126570b55ec8Smikeb if (q->flags & PFQS_DEFAULT) 1266f8d11d7cShenning printf(" default"); 1267f8d11d7cShenning if (q->qlimit) 1268f8d11d7cShenning printf(" qlimit %u", q->qlimit); 1269f8d11d7cShenning printf("\n"); 1270f8d11d7cShenning } 1271f8d11d7cShenning 12721f8f21bdSmillert int 1273ff352a37Smarkus parse_flags(char *s) 127414a9b182Skjell { 1275ff352a37Smarkus char *p, *q; 127614a9b182Skjell u_int8_t f = 0; 127781a15e5dSderaadt 1278ff352a37Smarkus for (p = s; *p; p++) { 1279ff352a37Smarkus if ((q = strchr(tcpflags, *p)) == NULL) 1280ff352a37Smarkus return -1; 1281ff352a37Smarkus else 1282ff352a37Smarkus f |= 1 << (q - tcpflags); 128314a9b182Skjell } 1284bc795af0Shugh return (f ? f : PF_TH_ALL); 128514a9b182Skjell } 128694e9410bShenning 128794e9410bShenning void 1288c04427ddSkn set_ipmask(struct node_host *h, int bb) 128994e9410bShenning { 129094e9410bShenning struct pf_addr *m, *n; 129194e9410bShenning int i, j = 0; 1292c04427ddSkn u_int8_t b; 129394e9410bShenning 129494e9410bShenning m = &h->addr.v.a.mask; 1295ab648bf6Sfrantzen memset(m, 0, sizeof(*m)); 129694e9410bShenning 1297c04427ddSkn if (bb == -1) 1298c04427ddSkn b = h->af == AF_INET ? 32 : 128; 1299c04427ddSkn else 1300c04427ddSkn b = bb; 1301c04427ddSkn 130294e9410bShenning while (b >= 32) { 130394e9410bShenning m->addr32[j++] = 0xffffffff; 130494e9410bShenning b -= 32; 130594e9410bShenning } 130694e9410bShenning for (i = 31; i > 31-b; --i) 130794e9410bShenning m->addr32[j] |= (1 << i); 130894e9410bShenning if (b) 130994e9410bShenning m->addr32[j] = htonl(m->addr32[j]); 131094e9410bShenning 131194e9410bShenning /* Mask off bits of the address that will never be used. */ 131294e9410bShenning n = &h->addr.v.a.addr; 1313ff626af1Shenning if (h->addr.type == PF_ADDR_ADDRMASK) 131494e9410bShenning for (i = 0; i < 4; i++) 131594e9410bShenning n->addr32[i] = n->addr32[i] & m->addr32[i]; 131694e9410bShenning } 131794e9410bShenning 131852f4a4a4Shenning int 131952f4a4a4Shenning check_netmask(struct node_host *h, sa_family_t af) 132052f4a4a4Shenning { 132152f4a4a4Shenning struct node_host *n = NULL; 132252f4a4a4Shenning struct pf_addr *m; 132352f4a4a4Shenning 132452f4a4a4Shenning for (n = h; n != NULL; n = n->next) { 132575d911b5Scedric if (h->addr.type == PF_ADDR_TABLE) 132675d911b5Scedric continue; 132752f4a4a4Shenning m = &h->addr.v.a.mask; 132852f4a4a4Shenning /* netmasks > 32 bit are invalid on v4 */ 132952f4a4a4Shenning if (af == AF_INET && 133052f4a4a4Shenning (m->addr32[1] || m->addr32[2] || m->addr32[3])) { 133152f4a4a4Shenning fprintf(stderr, "netmask %u invalid for IPv4 address\n", 1332f0bb6ca5Skn unmask(m)); 133352f4a4a4Shenning return (1); 133452f4a4a4Shenning } 133552f4a4a4Shenning } 133652f4a4a4Shenning return (0); 133752f4a4a4Shenning } 133852f4a4a4Shenning 1339c64927a6Smikeb struct node_host * 1340c64927a6Smikeb gen_dynnode(struct node_host *h, sa_family_t af) 1341c64927a6Smikeb { 1342c64927a6Smikeb struct node_host *n; 1343c64927a6Smikeb 1344c64927a6Smikeb if (h->addr.type != PF_ADDR_DYNIFTL) 1345c64927a6Smikeb return (NULL); 1346c64927a6Smikeb 1347c64927a6Smikeb if ((n = calloc(1, sizeof(*n))) == NULL) 1348c64927a6Smikeb return (NULL); 1349c64927a6Smikeb bcopy(h, n, sizeof(*n)); 1350c64927a6Smikeb n->ifname = NULL; 1351c64927a6Smikeb n->next = NULL; 1352c64927a6Smikeb n->tail = NULL; 1353c64927a6Smikeb 1354c64927a6Smikeb /* fix up netmask */ 13559e1cf8acSkn if (af == AF_INET && unmask(&n->addr.v.a.mask) > 32) 1356c64927a6Smikeb set_ipmask(n, 32); 1357c64927a6Smikeb 1358c64927a6Smikeb return (n); 1359c64927a6Smikeb } 1360c64927a6Smikeb 136194e9410bShenning /* interface lookup routines */ 136294e9410bShenning 136394e9410bShenning struct node_host *iftab; 136494e9410bShenning 136594e9410bShenning void 136694e9410bShenning ifa_load(void) 136794e9410bShenning { 136894e9410bShenning struct ifaddrs *ifap, *ifa; 136994e9410bShenning struct node_host *n = NULL, *h = NULL; 137094e9410bShenning 1371df69c215Sderaadt if (getifaddrs(&ifap) == -1) 137294e9410bShenning err(1, "getifaddrs"); 137394e9410bShenning 137494e9410bShenning for (ifa = ifap; ifa; ifa = ifa->ifa_next) { 1375ff7f4978Sbenno if (ifa->ifa_addr == NULL || 1376ff7f4978Sbenno !(ifa->ifa_addr->sa_family == AF_INET || 137794e9410bShenning ifa->ifa_addr->sa_family == AF_INET6 || 137894e9410bShenning ifa->ifa_addr->sa_family == AF_LINK)) 137994e9410bShenning continue; 138094e9410bShenning n = calloc(1, sizeof(struct node_host)); 138194e9410bShenning if (n == NULL) 1382f79f34e1Skn err(1, "%s: calloc", __func__); 138394e9410bShenning n->af = ifa->ifa_addr->sa_family; 138494e9410bShenning n->ifa_flags = ifa->ifa_flags; 138594e9410bShenning #ifdef __KAME__ 138694e9410bShenning if (n->af == AF_INET6 && 138794e9410bShenning IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 138894e9410bShenning ifa->ifa_addr)->sin6_addr) && 1389ab642153Shenning ((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_scope_id == 1390ab642153Shenning 0) { 139194e9410bShenning struct sockaddr_in6 *sin6; 139294e9410bShenning 139394e9410bShenning sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 139494e9410bShenning sin6->sin6_scope_id = sin6->sin6_addr.s6_addr[2] << 8 | 139594e9410bShenning sin6->sin6_addr.s6_addr[3]; 139694e9410bShenning sin6->sin6_addr.s6_addr[2] = 0; 139794e9410bShenning sin6->sin6_addr.s6_addr[3] = 0; 139894e9410bShenning } 139994e9410bShenning #endif 140094e9410bShenning n->ifindex = 0; 1401675ff33bSkn if (n->af == AF_LINK) 1402918dda86Smikeb n->ifindex = ((struct sockaddr_dl *) 1403918dda86Smikeb ifa->ifa_addr)->sdl_index; 1404675ff33bSkn else { 1405675ff33bSkn copy_satopfaddr(&n->addr.v.a.addr, ifa->ifa_addr); 14061fef2296Sbluhm ifa->ifa_netmask->sa_family = ifa->ifa_addr->sa_family; 1407675ff33bSkn copy_satopfaddr(&n->addr.v.a.mask, ifa->ifa_netmask); 14081fef2296Sbluhm if (ifa->ifa_broadaddr != NULL) { 14091fef2296Sbluhm ifa->ifa_broadaddr->sa_family = ifa->ifa_addr->sa_family; 1410675ff33bSkn copy_satopfaddr(&n->bcast, ifa->ifa_broadaddr); 14111fef2296Sbluhm } 14121fef2296Sbluhm if (ifa->ifa_dstaddr != NULL) { 14131fef2296Sbluhm ifa->ifa_dstaddr->sa_family = ifa->ifa_addr->sa_family; 1414675ff33bSkn copy_satopfaddr(&n->peer, ifa->ifa_dstaddr); 14151fef2296Sbluhm } 1416675ff33bSkn if (n->af == AF_INET6) 1417675ff33bSkn n->ifindex = ((struct sockaddr_in6 *) 1418675ff33bSkn ifa->ifa_addr)->sin6_scope_id; 141994e9410bShenning } 142094e9410bShenning if ((n->ifname = strdup(ifa->ifa_name)) == NULL) 1421f79f34e1Skn err(1, "%s: strdup", __func__); 142294e9410bShenning n->next = NULL; 142394e9410bShenning n->tail = n; 142494e9410bShenning if (h == NULL) 142594e9410bShenning h = n; 142694e9410bShenning else { 142794e9410bShenning h->tail->next = n; 142894e9410bShenning h->tail = n; 142994e9410bShenning } 143094e9410bShenning } 1431ec359bd5Scedric 143294e9410bShenning iftab = h; 143394e9410bShenning freeifaddrs(ifap); 143494e9410bShenning } 143594e9410bShenning 1436918dda86Smikeb unsigned int 1437918dda86Smikeb ifa_nametoindex(const char *ifa_name) 1438918dda86Smikeb { 1439918dda86Smikeb struct node_host *p; 1440918dda86Smikeb 1441918dda86Smikeb for (p = iftab; p; p = p->next) { 1442918dda86Smikeb if (p->af == AF_LINK && strcmp(p->ifname, ifa_name) == 0) 1443918dda86Smikeb return (p->ifindex); 1444918dda86Smikeb } 1445918dda86Smikeb errno = ENXIO; 1446918dda86Smikeb return (0); 1447918dda86Smikeb } 1448918dda86Smikeb 1449918dda86Smikeb char * 1450918dda86Smikeb ifa_indextoname(unsigned int ifindex, char *ifa_name) 1451918dda86Smikeb { 1452918dda86Smikeb struct node_host *p; 1453918dda86Smikeb 1454918dda86Smikeb for (p = iftab; p; p = p->next) { 1455918dda86Smikeb if (p->af == AF_LINK && ifindex == p->ifindex) { 1456918dda86Smikeb strlcpy(ifa_name, p->ifname, IFNAMSIZ); 1457918dda86Smikeb return (ifa_name); 1458918dda86Smikeb } 1459918dda86Smikeb } 1460918dda86Smikeb errno = ENXIO; 1461918dda86Smikeb return (NULL); 1462918dda86Smikeb } 1463918dda86Smikeb 146494e9410bShenning struct node_host * 14656c3582faShenning ifa_exists(const char *ifa_name) 146694e9410bShenning { 146794e9410bShenning struct node_host *n; 14682ff5b035Shenning struct ifgroupreq ifgr; 14692ff5b035Shenning int s; 147094e9410bShenning 147194e9410bShenning if (iftab == NULL) 147294e9410bShenning ifa_load(); 147394e9410bShenning 1474855d4e83Ssobrado /* check whether this is a group */ 14752ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 14762ff5b035Shenning err(1, "socket"); 14772ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 14782ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 14792ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == 0) { 14802ff5b035Shenning /* fake a node_host */ 14812ff5b035Shenning if ((n = calloc(1, sizeof(*n))) == NULL) 14822ff5b035Shenning err(1, "calloc"); 14832ff5b035Shenning if ((n->ifname = strdup(ifa_name)) == NULL) 14842ff5b035Shenning err(1, "strdup"); 14852ff5b035Shenning close(s); 14862ff5b035Shenning return (n); 14872ff5b035Shenning } 14882ff5b035Shenning close(s); 14892ff5b035Shenning 149094e9410bShenning for (n = iftab; n; n = n->next) { 149194e9410bShenning if (n->af == AF_LINK && !strncmp(n->ifname, ifa_name, IFNAMSIZ)) 149294e9410bShenning return (n); 149394e9410bShenning } 1494655a9f8aShenning 149594e9410bShenning return (NULL); 149694e9410bShenning } 149794e9410bShenning 149894e9410bShenning struct node_host * 14992ff5b035Shenning ifa_grouplookup(const char *ifa_name, int flags) 15002ff5b035Shenning { 15012ff5b035Shenning struct ifg_req *ifg; 15022ff5b035Shenning struct ifgroupreq ifgr; 15032ff5b035Shenning int s, len; 1504727cb2f7Sdhartmei struct node_host *n, *h = NULL; 15052ff5b035Shenning 15062ff5b035Shenning if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 15072ff5b035Shenning err(1, "socket"); 15082ff5b035Shenning bzero(&ifgr, sizeof(ifgr)); 15092ff5b035Shenning strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name)); 15102ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) { 15112ff5b035Shenning close(s); 15122ff5b035Shenning return (NULL); 15132ff5b035Shenning } 15142ff5b035Shenning 15152ff5b035Shenning len = ifgr.ifgr_len; 15162ff5b035Shenning if ((ifgr.ifgr_groups = calloc(1, len)) == NULL) 15172ff5b035Shenning err(1, "calloc"); 15182ff5b035Shenning if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) 15192ff5b035Shenning err(1, "SIOCGIFGMEMB"); 15202ff5b035Shenning 15212ff5b035Shenning for (ifg = ifgr.ifgr_groups; ifg && len >= sizeof(struct ifg_req); 15222ff5b035Shenning ifg++) { 15232ff5b035Shenning len -= sizeof(struct ifg_req); 152417b44c41Shenning if ((n = ifa_lookup(ifg->ifgrq_member, flags)) == NULL) 152517b44c41Shenning continue; 15262ff5b035Shenning if (h == NULL) 15272ff5b035Shenning h = n; 15282ff5b035Shenning else { 1529727cb2f7Sdhartmei h->tail->next = n; 1530727cb2f7Sdhartmei h->tail = n->tail; 15312ff5b035Shenning } 15322ff5b035Shenning } 15332ff5b035Shenning free(ifgr.ifgr_groups); 15342ff5b035Shenning close(s); 15352ff5b035Shenning 15362ff5b035Shenning return (h); 15372ff5b035Shenning } 15382ff5b035Shenning 15392ff5b035Shenning struct node_host * 1540ec359bd5Scedric ifa_lookup(const char *ifa_name, int flags) 154194e9410bShenning { 154294e9410bShenning struct node_host *p = NULL, *h = NULL, *n = NULL; 15437ad220f2Scedric int got4 = 0, got6 = 0; 1544ec359bd5Scedric const char *last_if = NULL; 154594e9410bShenning 15462ff5b035Shenning if ((h = ifa_grouplookup(ifa_name, flags)) != NULL) 15472ff5b035Shenning return (h); 15482ff5b035Shenning 154994e9410bShenning if (!strncmp(ifa_name, "self", IFNAMSIZ)) 15507ad220f2Scedric ifa_name = NULL; 155194e9410bShenning 155294e9410bShenning if (iftab == NULL) 155394e9410bShenning ifa_load(); 155494e9410bShenning 155594e9410bShenning for (p = iftab; p; p = p->next) { 15567ad220f2Scedric if (ifa_skip_if(ifa_name, p)) 155794e9410bShenning continue; 1558ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && p->af != AF_INET) 155994e9410bShenning continue; 1560ec359bd5Scedric if ((flags & PFI_AFLAG_BROADCAST) && 1561ec359bd5Scedric !(p->ifa_flags & IFF_BROADCAST)) 156294e9410bShenning continue; 1563cf181e99Sbluhm if ((flags & PFI_AFLAG_BROADCAST) && p->bcast.v4.s_addr == 0) 1564cf181e99Sbluhm continue; 1565ec359bd5Scedric if ((flags & PFI_AFLAG_PEER) && 1566ec359bd5Scedric !(p->ifa_flags & IFF_POINTOPOINT)) 1567ec359bd5Scedric continue; 1568ec359bd5Scedric if ((flags & PFI_AFLAG_NETWORK) && p->ifindex > 0) 1569ec359bd5Scedric continue; 1570ec359bd5Scedric if (last_if == NULL || strcmp(last_if, p->ifname)) 1571ec359bd5Scedric got4 = got6 = 0; 1572ec359bd5Scedric last_if = p->ifname; 1573ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) 1574ec359bd5Scedric continue; 1575ec359bd5Scedric if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) 1576ec359bd5Scedric continue; 1577ec359bd5Scedric if (p->af == AF_INET) 1578ec359bd5Scedric got4 = 1; 1579ec359bd5Scedric else 1580ec359bd5Scedric got6 = 1; 158194e9410bShenning n = calloc(1, sizeof(struct node_host)); 158294e9410bShenning if (n == NULL) 1583f79f34e1Skn err(1, "%s: calloc", __func__); 158494e9410bShenning n->af = p->af; 1585ec359bd5Scedric if (flags & PFI_AFLAG_BROADCAST) 158694e9410bShenning memcpy(&n->addr.v.a.addr, &p->bcast, 158794e9410bShenning sizeof(struct pf_addr)); 1588ec359bd5Scedric else if (flags & PFI_AFLAG_PEER) 1589ec359bd5Scedric memcpy(&n->addr.v.a.addr, &p->peer, 1590ec359bd5Scedric sizeof(struct pf_addr)); 159194e9410bShenning else 159294e9410bShenning memcpy(&n->addr.v.a.addr, &p->addr.v.a.addr, 159394e9410bShenning sizeof(struct pf_addr)); 1594ec359bd5Scedric if (flags & PFI_AFLAG_NETWORK) 1595f0bb6ca5Skn set_ipmask(n, unmask(&p->addr.v.a.mask)); 159694e9410bShenning else 1597c04427ddSkn set_ipmask(n, -1); 159894e9410bShenning n->ifindex = p->ifindex; 159994e9410bShenning 160094e9410bShenning n->next = NULL; 160194e9410bShenning n->tail = n; 160294e9410bShenning if (h == NULL) 160394e9410bShenning h = n; 160494e9410bShenning else { 160594e9410bShenning h->tail->next = n; 160694e9410bShenning h->tail = n; 160794e9410bShenning } 160894e9410bShenning } 160994e9410bShenning return (h); 161094e9410bShenning } 161194e9410bShenning 16127ad220f2Scedric int 16137ad220f2Scedric ifa_skip_if(const char *filter, struct node_host *p) 16147ad220f2Scedric { 16157ad220f2Scedric int n; 16167ad220f2Scedric 16177ad220f2Scedric if (p->af != AF_INET && p->af != AF_INET6) 16187ad220f2Scedric return (1); 16197ad220f2Scedric if (filter == NULL || !*filter) 16207ad220f2Scedric return (0); 16217ad220f2Scedric if (!strcmp(p->ifname, filter)) 16227ad220f2Scedric return (0); /* exact match */ 16237ad220f2Scedric n = strlen(filter); 16247ad220f2Scedric if (n < 1 || n >= IFNAMSIZ) 16257ad220f2Scedric return (1); /* sanity check */ 16267ad220f2Scedric if (filter[n-1] >= '0' && filter[n-1] <= '9') 16277ad220f2Scedric return (1); /* only do exact match in that case */ 16287ad220f2Scedric if (strncmp(p->ifname, filter, n)) 16297ad220f2Scedric return (1); /* prefix doesn't match */ 16307ad220f2Scedric return (p->ifname[n] < '0' || p->ifname[n] > '9'); 16317ad220f2Scedric } 16327ad220f2Scedric 163394e9410bShenning struct node_host * 16347c8726d4Sbenno host(const char *s, int opts) 163594e9410bShenning { 163636754172Smcbride struct node_host *h = NULL, *n; 163717e25e94Skn int mask = -1; 16385812a4adSdlg char *p, *ps; 1639e351e6cbSkn const char *errstr; 164094e9410bShenning 164136754172Smcbride if ((ps = strdup(s)) == NULL) 1642e7f9714dSkn err(1, "%s: strdup", __func__); 164336754172Smcbride 1644dfaca142Skn if ((p = strchr(ps, '/')) != NULL) { 164517e25e94Skn mask = strtonum(p+1, 0, 128, &errstr); 1646e351e6cbSkn if (errstr) { 1647e351e6cbSkn fprintf(stderr, "netmask is %s: %s\n", errstr, p); 1648a98f6f5fSkn goto error; 164994e9410bShenning } 165036754172Smcbride p[0] = '\0'; 1651e7f9714dSkn } 165294e9410bShenning 1653a98f6f5fSkn if ((h = host_if(ps, mask)) == NULL && 16541b6fdc2fSkn (h = host_ip(ps, mask)) == NULL && 165517e25e94Skn (h = host_dns(ps, mask, (opts & PF_OPT_NODNS))) == NULL) { 1656a98f6f5fSkn fprintf(stderr, "no IP address found for %s\n", s); 1657a98f6f5fSkn goto error; 1658a98f6f5fSkn } 16592a6c1abaShenning 1660cbdc262eSmcbride for (n = h; n != NULL; n = n->next) { 1661d20cfe34Smcbride n->addr.type = PF_ADDR_ADDRMASK; 1662cbdc262eSmcbride n->weight = 0; 1663cbdc262eSmcbride } 1664a98f6f5fSkn 1665a98f6f5fSkn error: 1666a98f6f5fSkn free(ps); 16672a6c1abaShenning return (h); 16682a6c1abaShenning } 16692a6c1abaShenning 16702a6c1abaShenning struct node_host * 1671f2370d27Shenning host_if(const char *s, int mask) 16722a6c1abaShenning { 16732a6c1abaShenning struct node_host *n, *h = NULL; 16744a36d485Shenning char *p, *ps; 1675ec359bd5Scedric int flags = 0; 16762a6c1abaShenning 1677ec359bd5Scedric if ((ps = strdup(s)) == NULL) 1678ec359bd5Scedric err(1, "host_if: strdup"); 1679ec359bd5Scedric while ((p = strrchr(ps, ':')) != NULL) { 16804a36d485Shenning if (!strcmp(p+1, "network")) 1681ec359bd5Scedric flags |= PFI_AFLAG_NETWORK; 1682ec359bd5Scedric else if (!strcmp(p+1, "broadcast")) 1683ec359bd5Scedric flags |= PFI_AFLAG_BROADCAST; 1684ec359bd5Scedric else if (!strcmp(p+1, "peer")) 1685ec359bd5Scedric flags |= PFI_AFLAG_PEER; 1686ec359bd5Scedric else if (!strcmp(p+1, "0")) 1687ec359bd5Scedric flags |= PFI_AFLAG_NOALIAS; 1688d1273114Skn else 1689d1273114Skn goto error; 1690ec359bd5Scedric *p = '\0'; 1691ec359bd5Scedric } 1692ec359bd5Scedric if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */ 1693ec359bd5Scedric fprintf(stderr, "illegal combination of interface modifiers\n"); 1694d1273114Skn goto error; 1695ec359bd5Scedric } 1696ec359bd5Scedric if ((flags & (PFI_AFLAG_NETWORK|PFI_AFLAG_BROADCAST)) && mask > -1) { 16974a36d485Shenning fprintf(stderr, "network or broadcast lookup, but " 16984a36d485Shenning "extra netmask given\n"); 1699d1273114Skn goto error; 17004a36d485Shenning } 17016c3582faShenning if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ)) { 17022a6c1abaShenning /* interface with this name exists */ 1703ec359bd5Scedric h = ifa_lookup(ps, flags); 1704c04427ddSkn if (mask > -1) 1705c04427ddSkn for (n = h; n != NULL; n = n->next) 17062a6c1abaShenning set_ipmask(n, mask); 17072a6c1abaShenning } 17084a36d485Shenning 1709d1273114Skn error: 17104a36d485Shenning free(ps); 17112a6c1abaShenning return (h); 17122a6c1abaShenning } 17132a6c1abaShenning 17142a6c1abaShenning struct node_host * 17151b6fdc2fSkn host_ip(const char *s, int mask) 17162a6c1abaShenning { 17172a6c1abaShenning struct addrinfo hints, *res; 17182a6c1abaShenning struct node_host *h = NULL; 171994e9410bShenning 172094e9410bShenning memset(&hints, 0, sizeof(hints)); 17211b6fdc2fSkn hints.ai_family = AF_UNSPEC; 172294e9410bShenning hints.ai_socktype = SOCK_DGRAM; /*dummy*/ 172394e9410bShenning hints.ai_flags = AI_NUMERICHOST; 17241b6fdc2fSkn if (getaddrinfo(s, NULL, &hints, &res) == 0) { 17251b6fdc2fSkn h = calloc(1, sizeof(*h)); 17262a6c1abaShenning if (h == NULL) 17271b6fdc2fSkn err(1, "%s: calloc", __func__); 17281b6fdc2fSkn h->af = res->ai_family; 1729675ff33bSkn copy_satopfaddr(&h->addr.v.a.addr, res->ai_addr); 17301b6fdc2fSkn if (h->af == AF_INET6) 17312a6c1abaShenning h->ifindex = 17322a6c1abaShenning ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; 173394e9410bShenning freeaddrinfo(res); 17341b6fdc2fSkn } else { /* ie. for 10/8 parsing */ 17351b6fdc2fSkn if (mask == -1) 17361b6fdc2fSkn return (NULL); 17371b6fdc2fSkn h = calloc(1, sizeof(*h)); 17381b6fdc2fSkn if (h == NULL) 17391b6fdc2fSkn err(1, "%s: calloc", __func__); 17401b6fdc2fSkn h->af = AF_INET; 17411b6fdc2fSkn if (inet_net_pton(AF_INET, s, &h->addr.v.a.addr.v4, 17421b6fdc2fSkn sizeof(h->addr.v.a.addr.v4)) == -1) { 17431b6fdc2fSkn free(h); 17441b6fdc2fSkn return (NULL); 17451b6fdc2fSkn } 17461b6fdc2fSkn } 17471b6fdc2fSkn set_ipmask(h, mask); 17481b6fdc2fSkn h->ifname = NULL; 17492a6c1abaShenning h->next = NULL; 17502a6c1abaShenning h->tail = h; 175194e9410bShenning 17522a6c1abaShenning return (h); 17532a6c1abaShenning } 17542a6c1abaShenning 17552a6c1abaShenning struct node_host * 175617e25e94Skn host_dns(const char *s, int mask, int numeric) 17572a6c1abaShenning { 17582a6c1abaShenning struct addrinfo hints, *res0, *res; 17592a6c1abaShenning struct node_host *n, *h = NULL; 1760da7f49d7Skn int noalias = 0, got4 = 0, got6 = 0; 1761ec359bd5Scedric char *p, *ps; 17622a6c1abaShenning 1763ec359bd5Scedric if ((ps = strdup(s)) == NULL) 176422dee42fShenning err(1, "host_dns: strdup"); 1765ec359bd5Scedric if ((p = strrchr(ps, ':')) != NULL && !strcmp(p, ":0")) { 1766ec359bd5Scedric noalias = 1; 1767ec359bd5Scedric *p = '\0'; 1768ec359bd5Scedric } 176994e9410bShenning memset(&hints, 0, sizeof(hints)); 177094e9410bShenning hints.ai_family = PF_UNSPEC; 177194e9410bShenning hints.ai_socktype = SOCK_STREAM; /* DUMMY */ 17727c8726d4Sbenno if (numeric) 17737c8726d4Sbenno hints.ai_flags = AI_NUMERICHOST; 1774da7f49d7Skn if (getaddrinfo(ps, NULL, &hints, &res0) != 0) 1775da7f49d7Skn goto error; 17762a6c1abaShenning 177794e9410bShenning for (res = res0; res; res = res->ai_next) { 177894e9410bShenning if (res->ai_family != AF_INET && 177994e9410bShenning res->ai_family != AF_INET6) 178094e9410bShenning continue; 1781ec359bd5Scedric if (noalias) { 1782ec359bd5Scedric if (res->ai_family == AF_INET) { 1783ec359bd5Scedric if (got4) 1784ec359bd5Scedric continue; 1785ec359bd5Scedric got4 = 1; 1786ec359bd5Scedric } else { 1787ec359bd5Scedric if (got6) 1788ec359bd5Scedric continue; 1789ec359bd5Scedric got6 = 1; 1790ec359bd5Scedric } 1791ec359bd5Scedric } 179294e9410bShenning n = calloc(1, sizeof(struct node_host)); 179394e9410bShenning if (n == NULL) 17942a6c1abaShenning err(1, "host_dns: calloc"); 179594e9410bShenning n->ifname = NULL; 179694e9410bShenning n->af = res->ai_family; 1797675ff33bSkn copy_satopfaddr(&n->addr.v.a.addr, res->ai_addr); 1798675ff33bSkn if (res->ai_family == AF_INET6) 179994e9410bShenning n->ifindex = 1800675ff33bSkn ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id; 1801c04427ddSkn set_ipmask(n, mask); 180294e9410bShenning n->next = NULL; 180394e9410bShenning n->tail = n; 180494e9410bShenning if (h == NULL) 180594e9410bShenning h = n; 180694e9410bShenning else { 180794e9410bShenning h->tail->next = n; 180894e9410bShenning h->tail = n; 180994e9410bShenning } 181094e9410bShenning } 181194e9410bShenning freeaddrinfo(res0); 1812da7f49d7Skn error: 1813ec359bd5Scedric free(ps); 181494e9410bShenning 181594e9410bShenning return (h); 181694e9410bShenning } 181742e05679Scedric 181842e05679Scedric /* 181942e05679Scedric * convert a hostname to a list of addresses and put them in the given buffer. 182042e05679Scedric * test: 182142e05679Scedric * if set to 1, only simple addresses are accepted (no netblock, no "!"). 182242e05679Scedric */ 182342e05679Scedric int 18247c8726d4Sbenno append_addr(struct pfr_buffer *b, char *s, int test, int opts) 182542e05679Scedric { 1826cbdc262eSmcbride static int previous = 0; 1827cbdc262eSmcbride static int expect = 0; 1828cbdc262eSmcbride struct pfr_addr *a; 1829b88a8d5dScedric struct node_host *h, *n; 1830cbdc262eSmcbride char *r; 1831cbdc262eSmcbride const char *errstr; 1832cbdc262eSmcbride int rv, not = 0, i = 0; 1833cbdc262eSmcbride u_int16_t weight; 1834cbdc262eSmcbride 1835cbdc262eSmcbride /* skip weight if given */ 1836cbdc262eSmcbride if (strcmp(s, "weight") == 0) { 1837cbdc262eSmcbride expect = 1; 1838cbdc262eSmcbride return (1); /* expecting further call */ 1839cbdc262eSmcbride } 1840cbdc262eSmcbride 1841cbdc262eSmcbride /* check if previous host is set */ 1842cbdc262eSmcbride if (expect) { 1843cbdc262eSmcbride /* parse and append load balancing weight */ 1844cbdc262eSmcbride weight = strtonum(s, 1, USHRT_MAX, &errstr); 1845cbdc262eSmcbride if (errstr) { 1846cbdc262eSmcbride fprintf(stderr, "failed to convert weight %s\n", s); 1847cbdc262eSmcbride return (-1); 1848cbdc262eSmcbride } 1849cbdc262eSmcbride if (previous != -1) { 1850cbdc262eSmcbride PFRB_FOREACH(a, b) { 1851cbdc262eSmcbride if (++i >= previous) { 1852cbdc262eSmcbride a->pfra_weight = weight; 1853cbdc262eSmcbride a->pfra_type = PFRKE_COST; 1854cbdc262eSmcbride } 1855cbdc262eSmcbride } 1856cbdc262eSmcbride } 1857cbdc262eSmcbride expect = 0; 1858cbdc262eSmcbride return (0); 1859cbdc262eSmcbride } 18605b6c447dScedric 18615b6c447dScedric for (r = s; *r == '!'; r++) 18625b6c447dScedric not = !not; 18637c8726d4Sbenno if ((n = host(r, opts)) == NULL) { 18645b6c447dScedric errno = 0; 18655b6c447dScedric return (-1); 18665b6c447dScedric } 1867b88a8d5dScedric rv = append_addr_host(b, n, test, not); 1868cbdc262eSmcbride previous = b->pfrb_size; 1869b88a8d5dScedric do { 1870b88a8d5dScedric h = n; 1871b88a8d5dScedric n = n->next; 1872b88a8d5dScedric free(h); 1873b88a8d5dScedric } while (n != NULL); 1874b88a8d5dScedric return (rv); 187542e05679Scedric } 187642e05679Scedric 187742e05679Scedric /* 18785b6c447dScedric * same as previous function, but with a pre-parsed input and the ability 1879b88a8d5dScedric * to "negate" the result. Does not free the node_host list. 188042e05679Scedric * not: 188142e05679Scedric * setting it to 1 is equivalent to adding "!" in front of parameter s. 188242e05679Scedric */ 188342e05679Scedric int 18845b6c447dScedric append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not) 188542e05679Scedric { 188642e05679Scedric int bits; 188742e05679Scedric struct pfr_addr addr; 188842e05679Scedric 188942e05679Scedric do { 189042e05679Scedric bzero(&addr, sizeof(addr)); 18915b6c447dScedric addr.pfra_not = n->not ^ not; 189242e05679Scedric addr.pfra_af = n->af; 1893f0bb6ca5Skn addr.pfra_net = unmask(&n->addr.v.a.mask); 189436754172Smcbride if (n->ifname) { 189536754172Smcbride if (strlcpy(addr.pfra_ifname, n->ifname, 189636754172Smcbride sizeof(addr.pfra_ifname)) >= sizeof(addr.pfra_ifname)) 189736754172Smcbride errx(1, "append_addr_host: strlcpy"); 189836754172Smcbride addr.pfra_type = PFRKE_ROUTE; 189936754172Smcbride } 1900cbdc262eSmcbride if (n->weight > 0) { 1901cbdc262eSmcbride addr.pfra_weight = n->weight; 1902cbdc262eSmcbride addr.pfra_type = PFRKE_COST; 1903cbdc262eSmcbride } 190442e05679Scedric switch (n->af) { 190542e05679Scedric case AF_INET: 190642e05679Scedric addr.pfra_ip4addr.s_addr = n->addr.v.a.addr.addr32[0]; 190742e05679Scedric bits = 32; 190842e05679Scedric break; 190942e05679Scedric case AF_INET6: 191042e05679Scedric memcpy(&addr.pfra_ip6addr, &n->addr.v.a.addr.v6, 191142e05679Scedric sizeof(struct in6_addr)); 191242e05679Scedric bits = 128; 191342e05679Scedric break; 191442e05679Scedric default: 191542e05679Scedric errno = EINVAL; 191642e05679Scedric return (-1); 191742e05679Scedric } 191842e05679Scedric if ((test && (not || addr.pfra_net != bits)) || 191942e05679Scedric addr.pfra_net > bits) { 192042e05679Scedric errno = EINVAL; 192142e05679Scedric return (-1); 192242e05679Scedric } 192342e05679Scedric if (pfr_buf_add(b, &addr)) 192442e05679Scedric return (-1); 1925b88a8d5dScedric } while ((n = n->next) != NULL); 192642e05679Scedric 192742e05679Scedric return (0); 192842e05679Scedric } 192979cc0068Scedric 193079cc0068Scedric int 19319f66a89aShenning pfctl_add_trans(struct pfr_buffer *buf, int type, const char *anchor) 193279cc0068Scedric { 193379cc0068Scedric struct pfioc_trans_e trans; 193479cc0068Scedric 193579cc0068Scedric bzero(&trans, sizeof(trans)); 19369f66a89aShenning trans.type = type; 193779cc0068Scedric if (strlcpy(trans.anchor, anchor, 1938d9ad7941Sdhartmei sizeof(trans.anchor)) >= sizeof(trans.anchor)) 193979cc0068Scedric errx(1, "pfctl_add_trans: strlcpy"); 194079cc0068Scedric 194179cc0068Scedric return pfr_buf_add(buf, &trans); 194279cc0068Scedric } 194379cc0068Scedric 194479cc0068Scedric u_int32_t 19459f66a89aShenning pfctl_get_ticket(struct pfr_buffer *buf, int type, const char *anchor) 194679cc0068Scedric { 194779cc0068Scedric struct pfioc_trans_e *p; 194879cc0068Scedric 194979cc0068Scedric PFRB_FOREACH(p, buf) 19509f66a89aShenning if (type == p->type && !strcmp(anchor, p->anchor)) 195179cc0068Scedric return (p->ticket); 195222dee42fShenning errx(1, "pfctl_get_ticket: assertion failed"); 195379cc0068Scedric } 195479cc0068Scedric 195579cc0068Scedric int 19563060c195Shenning pfctl_trans(int dev, struct pfr_buffer *buf, u_long cmd, int from) 195779cc0068Scedric { 195879cc0068Scedric struct pfioc_trans trans; 195979cc0068Scedric 196079cc0068Scedric bzero(&trans, sizeof(trans)); 196179cc0068Scedric trans.size = buf->pfrb_size - from; 196279cc0068Scedric trans.esize = sizeof(struct pfioc_trans_e); 196379cc0068Scedric trans.array = ((struct pfioc_trans_e *)buf->pfrb_caddr) + from; 196479cc0068Scedric return ioctl(dev, cmd, &trans); 196579cc0068Scedric } 1966