2 * Copyright (c) 2002 Luigi Rizzo
3 * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
4 * Copyright (c) 1994 Ugen J.S.Antsilevich
6 * Idea and grammar partially left from:
7 * Copyright (c) 1993 Daniel Boulet
9 * Redistribution and use in source forms, with and without modification,
10 * are permitted provided that this entire comment appears intact.
12 * Redistribution in binary form may occur without any restrictions.
13 * Obviously, it would be nice if you gave credit where credit is due
14 * but requiring it would be too onerous.
16 * This software is provided ``AS IS'' without any warranties of any kind.
18 * NEW command line interface for IP firewall facility
20 * $FreeBSD: src/sbin/ipfw/ipfw2.c,v 1.4.2.13 2003/05/27 22:21:11 gshapiro Exp $
21 * $DragonFly: src/sbin/ipfw/ipfw2.c,v 1.8 2006/06/25 11:02:37 corecode Exp $
24 #include <sys/param.h>
26 #include <sys/socket.h>
27 #include <sys/sockio.h>
28 #include <sys/sysctl.h>
48 #include <netinet/in.h>
49 #include <netinet/in_systm.h>
50 #include <netinet/ip.h>
51 #include <netinet/ip_icmp.h>
52 #include <net/ipfw/ip_fw.h>
53 #include <net/route.h> /* def. of struct route */
54 #include <net/dummynet/ip_dummynet.h>
55 #include <netinet/tcp.h>
56 #include <arpa/inet.h>
58 int s
, /* main RAW socket */
59 do_resolv
, /* Would try to resolve all */
60 do_acct
, /* Show packet/byte count */
61 do_time
, /* Show time stamps */
62 do_quiet
, /* Be quiet in add and flush */
63 do_force
, /* Don't ask for confirmation */
64 do_pipe
, /* this cmd refers to a pipe */
65 do_sort
, /* field to sort results (0 = no) */
66 do_dynamic
, /* display dynamic rules */
67 do_expired
, /* display expired dynamic rules */
68 do_compact
, /* show rules in compact mode */
69 show_sets
, /* display rule sets */
72 #define IP_MASK_ALL 0xffffffff
75 * structure to hold flag names and associated values to be
76 * set in the appropriate masks.
77 * A NULL string terminates the array.
78 * Often, an element with 0 value contains an error string.
86 static struct _s_x f_tcpflags
[] = {
97 static struct _s_x f_tcpopts
[] = {
98 { "mss", IP_FW_TCPOPT_MSS
},
99 { "maxseg", IP_FW_TCPOPT_MSS
},
100 { "window", IP_FW_TCPOPT_WINDOW
},
101 { "sack", IP_FW_TCPOPT_SACK
},
102 { "ts", IP_FW_TCPOPT_TS
},
103 { "timestamp", IP_FW_TCPOPT_TS
},
104 { "cc", IP_FW_TCPOPT_CC
},
110 * IP options span the range 0 to 255 so we need to remap them
111 * (though in fact only the low 5 bits are significant).
113 static struct _s_x f_ipopts
[] = {
114 { "ssrr", IP_FW_IPOPT_SSRR
},
115 { "lsrr", IP_FW_IPOPT_LSRR
},
116 { "rr", IP_FW_IPOPT_RR
},
117 { "ts", IP_FW_IPOPT_TS
},
122 static struct _s_x f_iptos
[] = {
123 { "lowdelay", IPTOS_LOWDELAY
},
124 { "throughput", IPTOS_THROUGHPUT
},
125 { "reliability", IPTOS_RELIABILITY
},
126 { "mincost", IPTOS_MINCOST
},
127 { "congestion", IPTOS_CE
},
128 { "ecntransport", IPTOS_ECT
},
129 { "ip tos option", 0},
133 static struct _s_x limit_masks
[] = {
134 {"all", DYN_SRC_ADDR
|DYN_SRC_PORT
|DYN_DST_ADDR
|DYN_DST_PORT
},
135 {"src-addr", DYN_SRC_ADDR
},
136 {"src-port", DYN_SRC_PORT
},
137 {"dst-addr", DYN_DST_ADDR
},
138 {"dst-port", DYN_DST_PORT
},
143 * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines
144 * This is only used in this code.
146 #define IPPROTO_ETHERTYPE 0x1000
147 static struct _s_x ether_types
[] = {
149 * Note, we cannot use "-:&/" in the names because they are field
150 * separators in the type specifications. Also, we use s = NULL as
151 * end-delimiter, because a type of 0 can be legal.
164 { "pppoe_disc", 0x8863 },
165 { "pppoe_sess", 0x8864 },
166 { "ipx_8022", 0x00E0 },
167 { "ipx_8023", 0x0000 },
168 { "ipx_ii", 0x8137 },
169 { "ipx_snap", 0x8137 },
175 static void show_usage(void);
246 struct _s_x dummynet_params
[] = {
248 { "noerror", TOK_NOERROR
},
249 { "buckets", TOK_BUCKETS
},
250 { "dst-ip", TOK_DSTIP
},
251 { "src-ip", TOK_SRCIP
},
252 { "dst-port", TOK_DSTPORT
},
253 { "src-port", TOK_SRCPORT
},
254 { "proto", TOK_PROTO
},
255 { "weight", TOK_WEIGHT
},
257 { "mask", TOK_MASK
},
258 { "droptail", TOK_DROPTAIL
},
260 { "gred", TOK_GRED
},
262 { "bandwidth", TOK_BW
},
263 { "delay", TOK_DELAY
},
264 { "pipe", TOK_PIPE
},
265 { "queue", TOK_QUEUE
},
266 { "dummynet-params", TOK_NULL
},
270 struct _s_x rule_actions
[] = {
271 { "accept", TOK_ACCEPT
},
272 { "pass", TOK_ACCEPT
},
273 { "allow", TOK_ACCEPT
},
274 { "permit", TOK_ACCEPT
},
275 { "count", TOK_COUNT
},
276 { "pipe", TOK_PIPE
},
277 { "queue", TOK_QUEUE
},
278 { "divert", TOK_DIVERT
},
280 { "fwd", TOK_FORWARD
},
281 { "forward", TOK_FORWARD
},
282 { "skipto", TOK_SKIPTO
},
283 { "deny", TOK_DENY
},
284 { "drop", TOK_DENY
},
285 { "reject", TOK_REJECT
},
286 { "reset", TOK_RESET
},
287 { "unreach", TOK_UNREACH
},
288 { "check-state", TOK_CHECKSTATE
},
293 struct _s_x rule_options
[] = {
297 { "limit", TOK_LIMIT
},
298 { "keep-state", TOK_KEEPSTATE
},
299 { "layer2", TOK_LAYER2
},
301 { "xmit", TOK_XMIT
},
302 { "recv", TOK_RECV
},
304 { "fragment", TOK_FRAG
},
305 { "frag", TOK_FRAG
},
306 { "ipoptions", TOK_IPOPTS
},
307 { "ipopts", TOK_IPOPTS
},
308 { "iplen", TOK_IPLEN
},
309 { "ipid", TOK_IPID
},
310 { "ipprecedence", TOK_IPPRECEDENCE
},
311 { "iptos", TOK_IPTOS
},
312 { "ipttl", TOK_IPTTL
},
313 { "ipversion", TOK_IPVER
},
314 { "ipver", TOK_IPVER
},
315 { "estab", TOK_ESTAB
},
316 { "established", TOK_ESTAB
},
317 { "setup", TOK_SETUP
},
318 { "tcpflags", TOK_TCPFLAGS
},
319 { "tcpflgs", TOK_TCPFLAGS
},
320 { "tcpoptions", TOK_TCPOPTS
},
321 { "tcpopts", TOK_TCPOPTS
},
322 { "tcpseq", TOK_TCPSEQ
},
323 { "tcpack", TOK_TCPACK
},
324 { "tcpwin", TOK_TCPWIN
},
325 { "icmptype", TOK_ICMPTYPES
},
326 { "icmptypes", TOK_ICMPTYPES
},
327 { "dst-ip", TOK_DSTIP
},
328 { "src-ip", TOK_SRCIP
},
329 { "dst-port", TOK_DSTPORT
},
330 { "src-port", TOK_SRCPORT
},
331 { "proto", TOK_PROTO
},
334 { "mac-type", TOK_MACTYPE
},
336 { "not", TOK_NOT
}, /* pseudo option */
337 { "!", /* escape ? */ TOK_NOT
}, /* pseudo option */
338 { "or", TOK_OR
}, /* pseudo option */
339 { "|", /* escape */ TOK_OR
}, /* pseudo option */
340 { "{", TOK_STARTBRACE
}, /* pseudo option */
341 { "(", TOK_STARTBRACE
}, /* pseudo option */
342 { "}", TOK_ENDBRACE
}, /* pseudo option */
343 { ")", TOK_ENDBRACE
}, /* pseudo option */
349 * match_token takes a table and a string, returns the value associated
350 * with the string (0 meaning an error in most cases)
353 match_token(struct _s_x
*table
, char *string
)
356 int i
= strlen(string
);
358 for (pt
= table
; i
&& pt
->s
!= NULL
; pt
++)
359 if (strlen(pt
->s
) == i
&& !bcmp(string
, pt
->s
, i
))
365 match_value(struct _s_x
*p
, u_int32_t value
)
367 for (; p
->s
!= NULL
; p
++)
374 * prints one port, symbolic or numeric
377 print_port(int proto
, u_int16_t port
)
380 if (proto
== IPPROTO_ETHERTYPE
) {
383 if (do_resolv
&& (s
= match_value(ether_types
, port
)) )
386 printf("0x%04x", port
);
388 struct servent
*se
= NULL
;
390 struct protoent
*pe
= getprotobynumber(proto
);
392 se
= getservbyport(htons(port
), pe
? pe
->p_name
: NULL
);
395 printf("%s", se
->s_name
);
402 * print the values in a list of ports
403 * XXX todo: add support for mask.
406 print_newports(ipfw_insn_u16
*cmd
, int proto
, int opcode
)
408 u_int16_t
*p
= cmd
->ports
;
412 if (cmd
->o
.len
& F_NOT
)
415 printf ("%s", opcode
== O_MAC_TYPE
? " mac-type" :
416 (opcode
== O_IP_DSTPORT
? " dst-port" : " src-port"));
417 for (i
= F_LEN((ipfw_insn
*)cmd
) - 1; i
> 0; i
--, p
+= 2) {
419 print_port(proto
, p
[0]);
422 print_port(proto
, p
[1]);
429 * Like strtol, but also translates service names into port numbers
430 * for some protocols.
432 * proto == -1 disables the protocol check;
433 * proto == IPPROTO_ETHERTYPE looks up an internal table
434 * proto == <some value in /etc/protocols> matches the values there.
435 * Returns *end == s in case the parameter is not found.
438 strtoport(char *s
, char **end
, int base
, int proto
)
444 *end
= s
; /* default - not found */
446 return 0; /* not found */
449 return strtol(s
, end
, base
);
452 * find separator. '\\' escapes the next char.
454 for (s1
= s
; *s1
&& (isalnum(*s1
) || *s1
== '\\') ; s1
++)
455 if (*s1
== '\\' && s1
[1] != '\0')
458 buf
= malloc(s1
- s
+ 1);
463 * copy into a buffer skipping backslashes
465 for (p
= s
, i
= 0; p
!= s1
; p
++)
470 if (proto
== IPPROTO_ETHERTYPE
) {
471 i
= match_token(ether_types
, buf
);
473 if (i
!= -1) { /* found */
478 struct protoent
*pe
= NULL
;
482 pe
= getprotobynumber(proto
);
484 se
= getservbyname(buf
, pe
? pe
->p_name
: NULL
);
488 return ntohs(se
->s_port
);
491 return 0; /* not found */
495 * fill the body of the command with the list of port ranges.
496 * At the moment it only understands numeric ranges.
499 fill_newports(ipfw_insn_u16
*cmd
, char *av
, int proto
)
501 u_int16_t
*p
= cmd
->ports
;
508 a
= strtoport(av
, &s
, 0, proto
);
509 if (s
== av
) /* no parameter */
511 if (*s
== '-') { /* a range */
513 b
= strtoport(av
, &s
, 0, proto
);
514 if (s
== av
) /* no parameter */
518 } else if (*s
== ',' || *s
== '\0' ) {
520 } else { /* invalid separator */
521 errx(EX_DATAERR
, "invalid separator <%c> in <%s>\n",
529 if (i
+1 > F_LEN_MASK
)
530 errx(EX_DATAERR
, "too many ports/ranges\n");
531 cmd
->o
.len
|= i
+1; /* leave F_NOT and F_OR untouched */
536 static struct _s_x icmpcodes
[] = {
537 { "net", ICMP_UNREACH_NET
},
538 { "host", ICMP_UNREACH_HOST
},
539 { "protocol", ICMP_UNREACH_PROTOCOL
},
540 { "port", ICMP_UNREACH_PORT
},
541 { "needfrag", ICMP_UNREACH_NEEDFRAG
},
542 { "srcfail", ICMP_UNREACH_SRCFAIL
},
543 { "net-unknown", ICMP_UNREACH_NET_UNKNOWN
},
544 { "host-unknown", ICMP_UNREACH_HOST_UNKNOWN
},
545 { "isolated", ICMP_UNREACH_ISOLATED
},
546 { "net-prohib", ICMP_UNREACH_NET_PROHIB
},
547 { "host-prohib", ICMP_UNREACH_HOST_PROHIB
},
548 { "tosnet", ICMP_UNREACH_TOSNET
},
549 { "toshost", ICMP_UNREACH_TOSHOST
},
550 { "filter-prohib", ICMP_UNREACH_FILTER_PROHIB
},
551 { "host-precedence", ICMP_UNREACH_HOST_PRECEDENCE
},
552 { "precedence-cutoff", ICMP_UNREACH_PRECEDENCE_CUTOFF
},
557 fill_reject_code(u_short
*codep
, char *str
)
562 val
= strtoul(str
, &s
, 0);
563 if (s
== str
|| *s
!= '\0' || val
>= 0x100)
564 val
= match_token(icmpcodes
, str
);
566 errx(EX_DATAERR
, "unknown ICMP unreachable code ``%s''", str
);
572 print_reject_code(u_int16_t code
)
574 char *s
= match_value(icmpcodes
, code
);
577 printf("unreach %s", s
);
579 printf("unreach %u", code
);
583 * Returns the number of bits set (from left) in a contiguous bitmask,
584 * or -1 if the mask is not contiguous.
585 * XXX this needs a proper fix.
586 * This effectively works on masks in big-endian (network) format.
587 * when compiled on little endian architectures.
589 * First bit is bit 7 of the first byte -- note, for MAC addresses,
590 * the first bit on the wire is bit 0 of the first byte.
591 * len is the max length in bits.
594 contigmask(u_char
*p
, int len
)
597 for (i
=0; i
<len
; i
++)
598 if ( (p
[i
/8] & (1 << (7 - (i
%8)))) == 0) /* first bit unset */
600 for (n
=i
+1; n
< len
; n
++)
601 if ( (p
[n
/8] & (1 << (7 - (n
%8)))) != 0)
602 return -1; /* mask not contiguous */
607 * print flags set/clear in the two bitmasks passed as parameters.
608 * There is a specialized check for f_tcpflags.
611 print_flags(char *name
, ipfw_insn
*cmd
, struct _s_x
*list
)
615 u_char set
= cmd
->arg1
& 0xff;
616 u_char clear
= (cmd
->arg1
>> 8) & 0xff;
618 if (list
== f_tcpflags
&& set
== TH_SYN
&& clear
== TH_ACK
) {
623 printf(" %s ", name
);
624 for (i
=0; list
[i
].x
!= 0; i
++) {
625 if (set
& list
[i
].x
) {
627 printf("%s%s", comma
, list
[i
].s
);
630 if (clear
& list
[i
].x
) {
632 printf("%s!%s", comma
, list
[i
].s
);
639 * Print the ip address contained in a command.
642 print_ip(ipfw_insn_ip
*cmd
, char *s
)
644 struct hostent
*he
= NULL
;
647 printf("%s%s ", cmd
->o
.len
& F_NOT
? " not": "", s
);
649 if (cmd
->o
.opcode
== O_IP_SRC_ME
|| cmd
->o
.opcode
== O_IP_DST_ME
) {
653 if (cmd
->o
.opcode
== O_IP_SRC_SET
|| cmd
->o
.opcode
== O_IP_DST_SET
) {
660 cmd
->addr
.s_addr
= htonl(cmd
->addr
.s_addr
);
661 printf("%s/%d", inet_ntoa(cmd
->addr
),
662 contigmask((u_char
*)&x
, 32));
663 x
= cmd
->addr
.s_addr
= htonl(cmd
->addr
.s_addr
);
664 x
&= 0xff; /* base */
665 d
= (u_int32_t
*)&(cmd
->mask
);
666 for (i
=0; i
< cmd
->o
.arg1
; i
++)
667 if (d
[ i
/32] & (1<<(i
& 31))) {
668 printf("%c%d", comma
, i
+x
);
674 if (cmd
->o
.opcode
== O_IP_SRC
|| cmd
->o
.opcode
== O_IP_DST
)
677 mb
= contigmask((u_char
*)&(cmd
->mask
.s_addr
), 32);
678 if (mb
== 32 && do_resolv
)
679 he
= gethostbyaddr((char *)&(cmd
->addr
.s_addr
),
680 sizeof(u_long
), AF_INET
);
681 if (he
!= NULL
) /* resolved to name */
682 printf("%s", he
->h_name
);
683 else if (mb
== 0) /* any */
685 else { /* numeric IP followed by some kind of mask */
686 printf("%s", inet_ntoa(cmd
->addr
));
688 printf(":%s", inet_ntoa(cmd
->mask
));
695 * prints a MAC address/mask pair
698 print_mac(u_char
*addr
, u_char
*mask
)
700 int l
= contigmask(mask
, 48);
705 printf(" %02x:%02x:%02x:%02x:%02x:%02x",
706 addr
[0], addr
[1], addr
[2], addr
[3], addr
[4], addr
[5]);
708 printf("&%02x:%02x:%02x:%02x:%02x:%02x",
709 mask
[0], mask
[1], mask
[2],
710 mask
[3], mask
[4], mask
[5]);
717 fill_icmptypes(ipfw_insn_u32
*cmd
, char *av
)
726 type
= strtoul(av
, &av
, 0);
728 if (*av
!= ',' && *av
!= '\0')
729 errx(EX_DATAERR
, "invalid ICMP type");
732 errx(EX_DATAERR
, "ICMP type out of range");
734 cmd
->d
[0] |= 1 << type
;
736 cmd
->o
.opcode
= O_ICMPTYPE
;
737 cmd
->o
.len
|= F_INSN_SIZE(ipfw_insn_u32
);
741 print_icmptypes(ipfw_insn_u32
*cmd
)
746 printf(" icmptypes");
747 for (i
= 0; i
< 32; i
++) {
748 if ( (cmd
->d
[0] & (1 << (i
))) == 0)
750 printf("%c%d", sep
, i
);
756 * show_ipfw() prints the body of an ipfw rule.
757 * Because the standard rule has at least proto src_ip dst_ip, we use
758 * a helper function to produce these entries if not provided explicitly.
759 * The first argument is the list of fields we have, the second is
760 * the list of fields we want to be printed.
762 * Special cases if we have provided a MAC header:
763 * + if the rule does not contain IP addresses/ports, do not print them;
764 * + if the rule does not contain an IP proto, print "all" instead of "ip";
766 * Once we have 'have_options', IP header fields are printed as options.
768 #define HAVE_PROTO 0x0001
769 #define HAVE_SRCIP 0x0002
770 #define HAVE_DSTIP 0x0004
771 #define HAVE_MAC 0x0008
772 #define HAVE_MACTYPE 0x0010
773 #define HAVE_OPTIONS 0x8000
775 #define HAVE_IP (HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP)
777 show_prerequisites(int *flags
, int want
, int cmd
)
779 if ( (*flags
& HAVE_IP
) == HAVE_IP
)
780 *flags
|= HAVE_OPTIONS
;
782 if ( (*flags
& (HAVE_MAC
|HAVE_MACTYPE
|HAVE_OPTIONS
)) == HAVE_MAC
&&
785 * mac-type was optimized out by the compiler,
789 *flags
|= HAVE_MACTYPE
| HAVE_OPTIONS
;
792 if ( !(*flags
& HAVE_OPTIONS
)) {
793 if ( !(*flags
& HAVE_PROTO
) && (want
& HAVE_PROTO
))
795 if ( !(*flags
& HAVE_SRCIP
) && (want
& HAVE_SRCIP
))
797 if ( !(*flags
& HAVE_DSTIP
) && (want
& HAVE_DSTIP
))
804 show_ipfw(struct ip_fw
*rule
, int pcwidth
, int bcwidth
)
806 static int twidth
= 0;
809 int proto
= 0; /* default */
810 int flags
= 0; /* prerequisites */
811 ipfw_insn_log
*logptr
= NULL
; /* set if we find an O_LOG */
812 int or_block
= 0; /* we are in an or block */
814 u_int32_t set_disable
= (u_int32_t
)(rule
->next_rule
);
816 if (set_disable
& (1 << rule
->set
)) { /* disabled */
820 printf("# DISABLED ");
822 printf("%05u ", rule
->rulenum
);
825 printf("%*llu %*llu ", pcwidth
, rule
->pcnt
, bcwidth
,
832 strcpy(timestr
, ctime((time_t *)&twidth
));
833 *strchr(timestr
, '\n') = '\0';
834 twidth
= strlen(timestr
);
836 if (rule
->timestamp
) {
837 #if _FreeBSD_version < 500000 /* XXX check */
838 #define _long_to_time(x) (time_t)(x)
840 time_t t
= _long_to_time(rule
->timestamp
);
842 strcpy(timestr
, ctime(&t
));
843 *strchr(timestr
, '\n') = '\0';
844 printf("%s ", timestr
);
846 printf("%*s ", twidth
, " ");
851 printf("set %d ", rule
->set
);
854 * print the optional "match probability"
856 if (rule
->cmd_len
> 0) {
858 if (cmd
->opcode
== O_PROB
) {
859 ipfw_insn_u32
*p
= (ipfw_insn_u32
*)cmd
;
860 double d
= 1.0 * p
->d
[0];
862 d
= (d
/ 0x7fffffff);
863 printf("prob %f ", d
);
868 * first print actions
870 for (l
= rule
->cmd_len
- rule
->act_ofs
, cmd
= ACTION_PTR(rule
);
871 l
> 0 ; l
-= F_LEN(cmd
), cmd
+= F_LEN(cmd
)) {
872 switch(cmd
->opcode
) {
874 printf("check-state");
875 flags
= HAVE_IP
; /* avoid printing anything else */
891 if (cmd
->arg1
== ICMP_REJECT_RST
)
893 else if (cmd
->arg1
== ICMP_UNREACH_HOST
)
896 print_reject_code(cmd
->arg1
);
900 printf("skipto %u", cmd
->arg1
);
904 printf("pipe %u", cmd
->arg1
);
908 printf("queue %u", cmd
->arg1
);
912 printf("divert %u", cmd
->arg1
);
916 printf("tee %u", cmd
->arg1
);
921 ipfw_insn_sa
*s
= (ipfw_insn_sa
*)cmd
;
923 printf("fwd %s", inet_ntoa(s
->sa
.sin_addr
));
925 printf(",%d", s
->sa
.sin_port
);
929 case O_LOG
: /* O_LOG is printed last */
930 logptr
= (ipfw_insn_log
*)cmd
;
934 printf("** unrecognized action %d len %d",
935 cmd
->opcode
, cmd
->len
);
939 if (logptr
->max_log
> 0)
940 printf(" log logamount %d", logptr
->max_log
);
946 * then print the body.
948 if (rule
->_pad
& 1) { /* empty rules before options */
950 printf(" ip from any to any");
951 flags
|= HAVE_IP
| HAVE_OPTIONS
;
954 for (l
= rule
->act_ofs
, cmd
= rule
->cmd
;
955 l
> 0 ; l
-= F_LEN(cmd
) , cmd
+= F_LEN(cmd
)) {
957 ipfw_insn_u32
*cmd32
= (ipfw_insn_u32
*)cmd
;
959 show_prerequisites(&flags
, 0, cmd
->opcode
);
961 switch(cmd
->opcode
) {
963 break; /* done already */
966 break; /* no need to print anything here */
969 ipfw_insn_mac
*m
= (ipfw_insn_mac
*)cmd
;
971 if ((cmd
->len
& F_OR
) && !or_block
)
973 if (cmd
->len
& F_NOT
)
977 print_mac( m
->addr
, m
->mask
);
978 print_mac( m
->addr
+ 6, m
->mask
+ 6);
983 if ((cmd
->len
& F_OR
) && !or_block
)
985 print_newports((ipfw_insn_u16
*)cmd
, IPPROTO_ETHERTYPE
,
986 (flags
& HAVE_OPTIONS
) ? cmd
->opcode
: 0);
987 flags
|= HAVE_MAC
| HAVE_MACTYPE
| HAVE_OPTIONS
;
994 show_prerequisites(&flags
, HAVE_PROTO
, 0);
995 if (!(flags
& HAVE_SRCIP
))
997 if ((cmd
->len
& F_OR
) && !or_block
)
999 print_ip((ipfw_insn_ip
*)cmd
,
1000 (flags
& HAVE_OPTIONS
) ? " src-ip" : "");
1001 flags
|= HAVE_SRCIP
;
1008 show_prerequisites(&flags
, HAVE_PROTO
|HAVE_SRCIP
, 0);
1009 if (!(flags
& HAVE_DSTIP
))
1011 if ((cmd
->len
& F_OR
) && !or_block
)
1013 print_ip((ipfw_insn_ip
*)cmd
,
1014 (flags
& HAVE_OPTIONS
) ? " dst-ip" : "");
1015 flags
|= HAVE_DSTIP
;
1019 show_prerequisites(&flags
, HAVE_IP
, 0);
1021 show_prerequisites(&flags
, HAVE_PROTO
|HAVE_SRCIP
, 0);
1022 if ((cmd
->len
& F_OR
) && !or_block
)
1024 print_newports((ipfw_insn_u16
*)cmd
, proto
,
1025 (flags
& HAVE_OPTIONS
) ? cmd
->opcode
: 0);
1029 struct protoent
*pe
;
1031 if ((cmd
->len
& F_OR
) && !or_block
)
1033 if (cmd
->len
& F_NOT
)
1036 pe
= getprotobynumber(cmd
->arg1
);
1037 if (flags
& HAVE_OPTIONS
)
1040 printf(" %s", pe
->p_name
);
1042 printf(" %u", cmd
->arg1
);
1044 flags
|= HAVE_PROTO
;
1047 default: /*options ... */
1048 show_prerequisites(&flags
, HAVE_IP
| HAVE_OPTIONS
, 0);
1049 if ((cmd
->len
& F_OR
) && !or_block
)
1051 if (cmd
->len
& F_NOT
&& cmd
->opcode
!= O_IN
)
1053 switch(cmd
->opcode
) {
1059 printf(cmd
->len
& F_NOT
? " out" : " in");
1069 ipfw_insn_if
*cmdif
= (ipfw_insn_if
*)cmd
;
1071 if (cmd
->opcode
== O_XMIT
)
1073 else if (cmd
->opcode
== O_RECV
)
1075 else if (cmd
->opcode
== O_VIA
)
1079 if (cmdif
->name
[0] == '\0')
1081 inet_ntoa(cmdif
->p
.ip
));
1082 printf(" %s %s", s
, cmdif
->name
);
1087 printf(" ipid %u", cmd
->arg1
);
1091 printf(" ipttl %u", cmd
->arg1
);
1095 printf(" ipver %u", cmd
->arg1
);
1098 case O_IPPRECEDENCE
:
1099 printf(" ipprecedence %u", (cmd
->arg1
) >> 5 );
1103 printf(" iplen %u", cmd
->arg1
);
1107 print_flags("ipoptions", cmd
, f_ipopts
);
1111 print_flags("iptos", cmd
, f_iptos
);
1115 print_icmptypes((ipfw_insn_u32
*)cmd
);
1119 printf(" established");
1123 print_flags("tcpflags", cmd
, f_tcpflags
);
1127 print_flags("tcpoptions", cmd
, f_tcpopts
);
1131 printf(" tcpwin %d", ntohs(cmd
->arg1
));
1135 printf(" tcpack %ld", ntohl(cmd32
->d
[0]));
1139 printf(" tcpseq %ld", ntohl(cmd32
->d
[0]));
1144 struct passwd
*pwd
= getpwuid(cmd32
->d
[0]);
1147 printf(" uid %s", pwd
->pw_name
);
1149 printf(" uid %u", cmd32
->d
[0]);
1155 struct group
*grp
= getgrgid(cmd32
->d
[0]);
1158 printf(" gid %s", grp
->gr_name
);
1160 printf(" gid %u", cmd32
->d
[0]);
1165 printf(" keep-state");
1170 struct _s_x
*p
= limit_masks
;
1171 ipfw_insn_limit
*c
= (ipfw_insn_limit
*)cmd
;
1172 u_int8_t x
= c
->limit_mask
;
1176 for ( ; p
->x
!= 0 ; p
++)
1177 if ((x
& p
->x
) == p
->x
) {
1179 printf("%s%s", comma
, p
->s
);
1182 printf(" %d", c
->conn_limit
);
1187 printf(" [opcode %d len %d]",
1188 cmd
->opcode
, cmd
->len
);
1191 if (cmd
->len
& F_OR
) {
1194 } else if (or_block
) {
1199 show_prerequisites(&flags
, HAVE_IP
, 0);
1205 show_dyn_ipfw(ipfw_dyn_rule
*d
, int pcwidth
, int bcwidth
)
1207 struct protoent
*pe
;
1211 if (!d
->expire
&& !(d
->dyn_type
== O_LIMIT_PARENT
))
1215 printf("%05d %*llu %*llu (%ds)", (int)(d
->rule
), pcwidth
, d
->pcnt
,
1216 bcwidth
, d
->bcnt
, d
->expire
);
1217 switch (d
->dyn_type
) {
1218 case O_LIMIT_PARENT
:
1219 printf(" PARENT %d", d
->count
);
1224 case O_KEEP_STATE
: /* bidir, no mask */
1229 if ((pe
= getprotobynumber(d
->id
.proto
)) != NULL
)
1230 printf(" %s", pe
->p_name
);
1232 printf(" proto %u", d
->id
.proto
);
1234 a
.s_addr
= htonl(d
->id
.src_ip
);
1235 printf(" %s %d", inet_ntoa(a
), d
->id
.src_port
);
1237 a
.s_addr
= htonl(d
->id
.dst_ip
);
1238 printf(" <-> %s %d", inet_ntoa(a
), d
->id
.dst_port
);
1243 sort_q(const void *pa
, const void *pb
)
1245 int rev
= (do_sort
< 0);
1246 int field
= rev
? -do_sort
: do_sort
;
1248 const struct dn_flow_queue
*a
= pa
;
1249 const struct dn_flow_queue
*b
= pb
;
1253 res
= a
->len
- b
->len
;
1256 res
= a
->len_bytes
- b
->len_bytes
;
1259 case 3: /* tot pkts */
1260 res
= a
->tot_pkts
- b
->tot_pkts
;
1263 case 4: /* tot bytes */
1264 res
= a
->tot_bytes
- b
->tot_bytes
;
1271 return (int)(rev
? res
: -res
);
1275 list_queues(struct dn_flow_set
*fs
, struct dn_flow_queue
*q
)
1279 printf(" mask: 0x%02x 0x%08x/0x%04x -> 0x%08x/0x%04x\n",
1280 fs
->flow_mask
.proto
,
1281 fs
->flow_mask
.src_ip
, fs
->flow_mask
.src_port
,
1282 fs
->flow_mask
.dst_ip
, fs
->flow_mask
.dst_port
);
1283 if (fs
->rq_elements
== 0)
1286 printf("BKT Prot ___Source IP/port____ "
1287 "____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp\n");
1289 heapsort(q
, fs
->rq_elements
, sizeof *q
, sort_q
);
1290 for (l
= 0; l
< fs
->rq_elements
; l
++) {
1292 struct protoent
*pe
;
1294 ina
.s_addr
= htonl(q
[l
].id
.src_ip
);
1295 printf("%3d ", q
[l
].hash_slot
);
1296 pe
= getprotobynumber(q
[l
].id
.proto
);
1298 printf("%-4s ", pe
->p_name
);
1300 printf("%4u ", q
[l
].id
.proto
);
1301 printf("%15s/%-5d ",
1302 inet_ntoa(ina
), q
[l
].id
.src_port
);
1303 ina
.s_addr
= htonl(q
[l
].id
.dst_ip
);
1304 printf("%15s/%-5d ",
1305 inet_ntoa(ina
), q
[l
].id
.dst_port
);
1306 printf("%4qu %8qu %2u %4u %3u\n",
1307 q
[l
].tot_pkts
, q
[l
].tot_bytes
,
1308 q
[l
].len
, q
[l
].len_bytes
, q
[l
].drops
);
1310 printf(" S %20qd F %20qd\n",
1316 print_flowset_parms(struct dn_flow_set
*fs
, char *prefix
)
1321 char red
[90]; /* Display RED parameters */
1324 if (fs
->flags_fs
& DN_QSIZE_IS_BYTES
) {
1326 sprintf(qs
, "%d KB", l
/ 1024);
1328 sprintf(qs
, "%d B", l
);
1330 sprintf(qs
, "%3d sl.", l
);
1332 sprintf(plr
, "plr %f", 1.0 * fs
->plr
/ (double)(0x7fffffff));
1335 if (fs
->flags_fs
& DN_IS_RED
) /* RED parameters */
1337 "\n\t %cRED w_q %f min_th %d max_th %d max_p %f",
1338 (fs
->flags_fs
& DN_IS_GENTLE_RED
) ? 'G' : ' ',
1339 1.0 * fs
->w_q
/ (double)(1 << SCALE_RED
),
1340 SCALE_VAL(fs
->min_th
),
1341 SCALE_VAL(fs
->max_th
),
1342 1.0 * fs
->max_p
/ (double)(1 << SCALE_RED
));
1344 sprintf(red
, "droptail");
1346 printf("%s %s%s %d queues (%d buckets) %s\n",
1347 prefix
, qs
, plr
, fs
->rq_elements
, fs
->rq_size
, red
);
1351 list_pipes(void *data
, int nbytes
, int ac
, char *av
[])
1355 struct dn_pipe
*p
= (struct dn_pipe
*) data
;
1356 struct dn_flow_set
*fs
;
1357 struct dn_flow_queue
*q
;
1361 rulenum
= strtoul(*av
++, NULL
, 10);
1364 for (; nbytes
>= sizeof *p
; p
= (struct dn_pipe
*)next
) {
1365 double b
= p
->bandwidth
;
1369 if (p
->next
!= (struct dn_pipe
*)DN_IS_PIPE
)
1370 break; /* done with pipes, now queues */
1373 * compute length, as pipe have variable size
1375 l
= sizeof(*p
) + p
->fs
.rq_elements
* sizeof(*q
);
1376 next
= (void *)p
+ l
;
1379 if (rulenum
!= 0 && rulenum
!= p
->pipe_nr
)
1383 * Print rate (or clocking interface)
1385 if (p
->if_name
[0] != '\0')
1386 sprintf(buf
, "%s", p
->if_name
);
1388 sprintf(buf
, "unlimited");
1389 else if (b
>= 1000000)
1390 sprintf(buf
, "%7.3f Mbit/s", b
/1000000);
1392 sprintf(buf
, "%7.3f Kbit/s", b
/1000);
1394 sprintf(buf
, "%7.3f bit/s ", b
);
1396 sprintf(prefix
, "%05d: %s %4d ms ",
1397 p
->pipe_nr
, buf
, p
->delay
);
1398 print_flowset_parms(&(p
->fs
), prefix
);
1400 printf(" V %20qd\n", p
->V
>> MY_M
);
1402 q
= (struct dn_flow_queue
*)(p
+1);
1403 list_queues(&(p
->fs
), q
);
1405 for (fs
= next
; nbytes
>= sizeof *fs
; fs
= next
) {
1408 if (fs
->next
!= (struct dn_flow_set
*)DN_IS_QUEUE
)
1410 l
= sizeof(*fs
) + fs
->rq_elements
* sizeof(*q
);
1411 next
= (void *)fs
+ l
;
1413 q
= (struct dn_flow_queue
*)(fs
+1);
1414 sprintf(prefix
, "q%05d: weight %d pipe %d ",
1415 fs
->fs_nr
, fs
->weight
, fs
->parent_nr
);
1416 print_flowset_parms(fs
, prefix
);
1422 * This one handles all set-related commands
1423 * ipfw set { show | enable | disable }
1425 * ipfw set move X to Y
1426 * ipfw set move rule X to Y
1429 sets_handler(int ac
, char *av
[])
1431 u_int32_t set_disable
, masks
[2];
1434 u_int8_t cmd
, new_set
;
1440 errx(EX_USAGE
, "set needs command");
1441 if (!strncmp(*av
, "show", strlen(*av
)) ) {
1445 nbytes
= sizeof(struct ip_fw
);
1446 if ((data
= malloc(nbytes
)) == NULL
)
1447 err(EX_OSERR
, "malloc");
1448 if (getsockopt(s
, IPPROTO_IP
, IP_FW_GET
, data
, &nbytes
) < 0)
1449 err(EX_OSERR
, "getsockopt(IP_FW_GET)");
1450 set_disable
= (u_int32_t
)(((struct ip_fw
*)data
)->next_rule
);
1452 for (i
= 0, msg
= "disable" ; i
< 31; i
++)
1453 if ( (set_disable
& (1<<i
))) {
1454 printf("%s %d", msg
, i
);
1457 msg
= (set_disable
) ? " enable" : "enable";
1458 for (i
= 0; i
< 31; i
++)
1459 if ( !(set_disable
& (1<<i
))) {
1460 printf("%s %d", msg
, i
);
1464 } else if (!strncmp(*av
, "swap", strlen(*av
))) {
1467 errx(EX_USAGE
, "set swap needs 2 set numbers\n");
1468 rulenum
= atoi(av
[0]);
1469 new_set
= atoi(av
[1]);
1470 if (!isdigit(*(av
[0])) || rulenum
> 30)
1471 errx(EX_DATAERR
, "invalid set number %s\n", av
[0]);
1472 if (!isdigit(*(av
[1])) || new_set
> 30)
1473 errx(EX_DATAERR
, "invalid set number %s\n", av
[1]);
1474 masks
[0] = (4 << 24) | (new_set
<< 16) | (rulenum
);
1475 i
= setsockopt(s
, IPPROTO_IP
, IP_FW_DEL
,
1476 masks
, sizeof(u_int32_t
));
1477 } else if (!strncmp(*av
, "move", strlen(*av
))) {
1479 if (ac
&& !strncmp(*av
, "rule", strlen(*av
))) {
1484 if (ac
!= 3 || strncmp(av
[1], "to", strlen(*av
)))
1485 errx(EX_USAGE
, "syntax: set move [rule] X to Y\n");
1486 rulenum
= atoi(av
[0]);
1487 new_set
= atoi(av
[2]);
1488 if (!isdigit(*(av
[0])) || (cmd
== 3 && rulenum
> 30) ||
1489 (cmd
== 2 && rulenum
== 65535) )
1490 errx(EX_DATAERR
, "invalid source number %s\n", av
[0]);
1491 if (!isdigit(*(av
[2])) || new_set
> 30)
1492 errx(EX_DATAERR
, "invalid dest. set %s\n", av
[1]);
1493 masks
[0] = (cmd
<< 24) | (new_set
<< 16) | (rulenum
);
1494 i
= setsockopt(s
, IPPROTO_IP
, IP_FW_DEL
,
1495 masks
, sizeof(u_int32_t
));
1496 } else if (!strncmp(*av
, "disable", strlen(*av
)) ||
1497 !strncmp(*av
, "enable", strlen(*av
)) ) {
1498 int which
= !strncmp(*av
, "enable", strlen(*av
)) ? 1 : 0;
1501 masks
[0] = masks
[1] = 0;
1504 if (isdigit(**av
)) {
1506 if (i
< 0 || i
> 30)
1508 "invalid set number %d\n", i
);
1509 masks
[which
] |= (1<<i
);
1510 } else if (!strncmp(*av
, "disable", strlen(*av
)))
1512 else if (!strncmp(*av
, "enable", strlen(*av
)))
1516 "invalid set command %s\n", *av
);
1519 if ( (masks
[0] & masks
[1]) != 0 )
1521 "cannot enable and disable the same set\n");
1523 i
= setsockopt(s
, IPPROTO_IP
, IP_FW_DEL
, masks
, sizeof(masks
));
1525 warn("set enable/disable: setsockopt(IP_FW_DEL)");
1527 errx(EX_USAGE
, "invalid set command %s\n", *av
);
1531 sysctl_handler(int ac
, char *av
[], int which
)
1537 warnx("missing keyword to enable/disable\n");
1538 } else if (strncmp(*av
, "firewall", strlen(*av
)) == 0) {
1539 sysctlbyname("net.inet.ip.fw.enable", NULL
, 0,
1540 &which
, sizeof(which
));
1541 } else if (strncmp(*av
, "one_pass", strlen(*av
)) == 0) {
1542 sysctlbyname("net.inet.ip.fw.one_pass", NULL
, 0,
1543 &which
, sizeof(which
));
1544 } else if (strncmp(*av
, "debug", strlen(*av
)) == 0) {
1545 sysctlbyname("net.inet.ip.fw.debug", NULL
, 0,
1546 &which
, sizeof(which
));
1547 } else if (strncmp(*av
, "verbose", strlen(*av
)) == 0) {
1548 sysctlbyname("net.inet.ip.fw.verbose", NULL
, 0,
1549 &which
, sizeof(which
));
1550 } else if (strncmp(*av
, "dyn_keepalive", strlen(*av
)) == 0) {
1551 sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL
, 0,
1552 &which
, sizeof(which
));
1554 warnx("unrecognize enable/disable keyword: %s\n", *av
);
1559 list(int ac
, char *av
[])
1562 ipfw_dyn_rule
*dynrules
, *d
;
1564 void *lim
, *data
= NULL
;
1565 int bcwidth
, n
, nbytes
, nstat
, ndyn
, pcwidth
, width
;
1566 int exitval
= EX_OK
;
1573 const int ocmd
= do_pipe
? IP_DUMMYNET_GET
: IP_FW_GET
;
1574 int nalloc
= 1024; /* start somewhere... */
1579 /* get rules or pipes from kernel, resizing array as necessary */
1582 while (nbytes
>= nalloc
) {
1583 nalloc
= nalloc
* 2 + 200;
1585 if ((data
= realloc(data
, nbytes
)) == NULL
)
1586 err(EX_OSERR
, "realloc");
1587 if (getsockopt(s
, IPPROTO_IP
, ocmd
, data
, &nbytes
) < 0)
1588 err(EX_OSERR
, "getsockopt(IP_%s_GET)",
1589 do_pipe
? "DUMMYNET" : "FW");
1593 list_pipes(data
, nbytes
, ac
, av
);
1598 * Count static rules. They have variable size so we
1599 * need to scan the list to count them.
1601 for (nstat
= 1, r
= data
, lim
= data
+ nbytes
;
1602 r
->rulenum
< 65535 && (void *)r
< lim
;
1603 ++nstat
, r
= (void *)r
+ RULESIZE(r
) )
1607 * Count dynamic rules. This is easier as they have
1610 r
= (void *)r
+ RULESIZE(r
);
1611 dynrules
= (ipfw_dyn_rule
*)r
;
1612 n
= (void *)r
- data
;
1613 ndyn
= (nbytes
- n
) / sizeof *dynrules
;
1615 /* if showing stats, figure out column widths ahead of time */
1616 bcwidth
= pcwidth
= 0;
1618 for (n
= 0, r
= data
; n
< nstat
;
1619 n
++, r
= (void *)r
+ RULESIZE(r
)) {
1620 /* packet counter */
1621 width
= snprintf(NULL
, 0, "%llu", r
->pcnt
);
1622 if (width
> pcwidth
)
1626 width
= snprintf(NULL
, 0, "%llu", r
->bcnt
);
1627 if (width
> bcwidth
)
1631 if (do_dynamic
&& ndyn
) {
1632 for (n
= 0, d
= dynrules
; n
< ndyn
; n
++, d
++) {
1633 width
= snprintf(NULL
, 0, "%llu", d
->pcnt
);
1634 if (width
> pcwidth
)
1637 width
= snprintf(NULL
, 0, "%llu", d
->bcnt
);
1638 if (width
> bcwidth
)
1642 /* if no rule numbers were specified, list all rules */
1644 for (n
= 0, r
= data
; n
< nstat
;
1645 n
++, r
= (void *)r
+ RULESIZE(r
) )
1646 show_ipfw(r
, pcwidth
, bcwidth
);
1648 if (do_dynamic
&& ndyn
) {
1649 printf("## Dynamic rules (%d):\n", ndyn
);
1650 for (n
= 0, d
= dynrules
; n
< ndyn
; n
++, d
++)
1651 show_dyn_ipfw(d
, pcwidth
, bcwidth
);
1656 /* display specific rules requested on command line */
1658 for (lac
= ac
, lav
= av
; lac
!= 0; lac
--) {
1659 /* convert command line rule # */
1660 rnum
= strtoul(*lav
++, &endptr
, 10);
1663 warnx("invalid rule number: %s", *(lav
- 1));
1666 for (n
= seen
= 0, r
= data
; n
< nstat
;
1667 n
++, r
= (void *)r
+ RULESIZE(r
) ) {
1668 if (r
->rulenum
> rnum
)
1670 if (r
->rulenum
== rnum
) {
1671 show_ipfw(r
, pcwidth
, bcwidth
);
1676 /* give precedence to other error(s) */
1677 if (exitval
== EX_OK
)
1678 exitval
= EX_UNAVAILABLE
;
1679 warnx("rule %lu does not exist", rnum
);
1683 if (do_dynamic
&& ndyn
) {
1684 printf("## Dynamic rules:\n");
1685 for (lac
= ac
, lav
= av
; lac
!= 0; lac
--) {
1686 rnum
= strtoul(*lav
++, &endptr
, 10);
1688 /* already warned */
1690 for (n
= 0, d
= dynrules
; n
< ndyn
; n
++, d
++) {
1691 if ((int)(d
->rule
) > rnum
)
1693 if ((int)(d
->rule
) == rnum
)
1694 show_dyn_ipfw(d
, pcwidth
, bcwidth
);
1704 if (exitval
!= EX_OK
)
1711 fprintf(stderr
, "usage: ipfw [options]\n"
1712 " add [number] rule\n"
1713 " pipe number config [pipeconfig]\n"
1714 " queue number config [queueconfig]\n"
1716 " [pipe] delete number ...\n"
1717 " [pipe] {list|show} [number ...]\n"
1718 " {zero|resetlog} [number ...]\n"
1719 "do \"ipfw -h\" or see ipfw manpage for details\n"
1729 fprintf(stderr
, "ipfw syntax summary:\n"
1730 "ipfw add [N] [prob {0..1}] ACTION [log [logamount N]] ADDR OPTIONS\n"
1731 "ipfw {pipe|queue} N config BODY\n"
1732 "ipfw [pipe] {zero|delete|show} [N{,N}]\n"
1734 "RULE: [1..] [PROB] BODY\n"
1735 "RULENUM: INTEGER(1..65534)\n"
1736 "PROB: prob REAL(0..1)\n"
1737 "BODY: check-state [LOG] (no body) |\n"
1738 " ACTION [LOG] MATCH_ADDR [OPTION_LIST]\n"
1739 "ACTION: check-state | allow | count | deny | reject | skipto N |\n"
1740 " {divert|tee} PORT | forward ADDR | pipe N | queue N\n"
1741 "ADDR: [ MAC dst src ether_type ] \n"
1742 " [ from IPLIST [ PORT ] to IPLIST [ PORTLIST ] ]\n"
1743 "IPLIST: IPADDR | ( IPADDR or ... or IPADDR )\n"
1744 "IPADDR: [not] { any | me | ip | ip/bits | ip:mask | ip/bits{x,y,z} }\n"
1745 "OPTION_LIST: OPTION [,OPTION_LIST]\n"
1752 lookup_host (char *host
, struct in_addr
*ipaddr
)
1756 if (!inet_aton(host
, ipaddr
)) {
1757 if ((he
= gethostbyname(host
)) == NULL
)
1759 *ipaddr
= *(struct in_addr
*)he
->h_addr_list
[0];
1765 * fills the addr and mask fields in the instruction as appropriate from av.
1766 * Update length as appropriate.
1767 * The following formats are allowed:
1768 * any matches any IP. Actually returns an empty instruction.
1769 * me returns O_IP_*_ME
1770 * 1.2.3.4 single IP address
1771 * 1.2.3.4:5.6.7.8 address:mask
1772 * 1.2.3.4/24 address/mask
1773 * 1.2.3.4/26{1,6,5,4,23} set of addresses in a subnet
1776 fill_ip(ipfw_insn_ip
*cmd
, char *av
)
1778 char *p
= 0, md
= 0;
1781 cmd
->o
.len
&= ~F_LEN_MASK
; /* zero len */
1783 if (!strncmp(av
, "any", strlen(av
)))
1786 if (!strncmp(av
, "me", strlen(av
))) {
1787 cmd
->o
.len
|= F_INSN_SIZE(ipfw_insn
);
1791 p
= strchr(av
, '/');
1793 p
= strchr(av
, ':');
1799 if (lookup_host(av
, &cmd
->addr
) != 0)
1800 errx(EX_NOHOST
, "hostname ``%s'' unknown", av
);
1803 if (!inet_aton(p
, &cmd
->mask
))
1804 errx(EX_DATAERR
, "bad netmask ``%s''", p
);
1809 cmd
->mask
.s_addr
= htonl(0);
1811 errx(EX_DATAERR
, "bad width ``%s''", p
);
1813 cmd
->mask
.s_addr
= htonl(~0 << (32 - i
));
1816 cmd
->mask
.s_addr
= htonl(~0);
1819 cmd
->addr
.s_addr
&= cmd
->mask
.s_addr
;
1821 * now look if we have a set of addresses. They are stored as follows:
1822 * arg1 is the set size (powers of 2, 2..256)
1823 * addr is the base address IN HOST FORMAT
1824 * mask.. is an array of u_int32_t with bits set.
1828 if (p
) { /* fetch addresses */
1831 int i
= contigmask((u_char
*)&(cmd
->mask
), 32);
1833 if (i
< 24 || i
> 31) {
1834 fprintf(stderr
, "invalid set with mask %d\n",
1838 cmd
->o
.arg1
= 1<<(32-i
);
1839 cmd
->addr
.s_addr
= ntohl(cmd
->addr
.s_addr
);
1840 d
= (u_int32_t
*)&cmd
->mask
;
1841 cmd
->o
.opcode
= O_IP_DST_SET
; /* default */
1842 cmd
->o
.len
|= F_INSN_SIZE(ipfw_insn_u32
) + (cmd
->o
.arg1
+31)/32;
1843 for (i
= 0; i
< (cmd
->o
.arg1
+31)/32 ; i
++)
1844 d
[i
] = 0; /* clear masks */
1847 low
= cmd
->addr
.s_addr
& 0xff;
1848 high
= low
+ cmd
->o
.arg1
- 1;
1849 while (isdigit(*av
)) {
1851 u_int16_t a
= strtol(av
, &s
, 0);
1853 if (s
== av
) /* no parameter */
1855 if (a
< low
|| a
> high
) {
1856 fprintf(stderr
, "addr %d out of range [%d-%d]\n",
1861 d
[ a
/32] |= 1<<(a
& 31);
1869 if (cmd
->mask
.s_addr
== 0) { /* any */
1870 if (cmd
->o
.len
& F_NOT
)
1871 errx(EX_DATAERR
, "not any never matches");
1872 else /* useless, nuke it */
1874 } else if (cmd
->mask
.s_addr
== IP_MASK_ALL
) /* one IP */
1875 cmd
->o
.len
|= F_INSN_SIZE(ipfw_insn_u32
);
1876 else /* addr/mask */
1877 cmd
->o
.len
|= F_INSN_SIZE(ipfw_insn_ip
);
1882 * helper function to process a set of flags and set bits in the
1883 * appropriate masks.
1886 fill_flags(ipfw_insn
*cmd
, enum ipfw_opcodes opcode
,
1887 struct _s_x
*flags
, char *p
)
1889 u_int8_t set
=0, clear
=0;
1892 char *q
; /* points to the separator */
1894 u_int8_t
*which
; /* mask we are working on */
1904 val
= match_token(flags
, p
);
1906 errx(EX_DATAERR
, "invalid flag %s", p
);
1907 *which
|= (u_int8_t
)val
;
1910 cmd
->opcode
= opcode
;
1911 cmd
->len
= (cmd
->len
& (F_NOT
| F_OR
)) | 1;
1912 cmd
->arg1
= (set
& 0xff) | ( (clear
& 0xff) << 8);
1917 delete(int ac
, char *av
[])
1920 struct dn_pipe pipe
;
1922 int exitval
= EX_OK
;
1925 memset(&pipe
, 0, sizeof pipe
);
1928 if (ac
> 0 && !strncmp(*av
, "set", strlen(*av
))) {
1929 do_set
= 1; /* delete set */
1934 while (ac
&& isdigit(**av
)) {
1935 i
= atoi(*av
); av
++; ac
--;
1941 i
= setsockopt(s
, IPPROTO_IP
, IP_DUMMYNET_DEL
,
1942 &pipe
, sizeof pipe
);
1945 warn("rule %u: setsockopt(IP_DUMMYNET_DEL)",
1946 do_pipe
== 1 ? pipe
.pipe_nr
:
1950 rulenum
= (i
& 0xffff) | (do_set
<< 24);
1951 i
= setsockopt(s
, IPPROTO_IP
, IP_FW_DEL
, &rulenum
,
1954 exitval
= EX_UNAVAILABLE
;
1955 warn("rule %u: setsockopt(IP_FW_DEL)",
1960 if (exitval
!= EX_OK
)
1966 * fill the interface structure. We do not check the name as we can
1967 * create interfaces dynamically, so checking them at insert time
1968 * makes relatively little sense.
1969 * Interface names containing '*', '?', or '[' are assumed to be shell
1970 * patterns which match interfaces.
1973 fill_iface(ipfw_insn_if
*cmd
, char *arg
)
1975 cmd
->name
[0] = '\0';
1976 cmd
->o
.len
|= F_INSN_SIZE(ipfw_insn_if
);
1978 /* Parse the interface or address */
1979 if (!strcmp(arg
, "any"))
1980 cmd
->o
.len
= 0; /* effectively ignore this command */
1981 else if (!isdigit(*arg
)) {
1982 strlcpy(cmd
->name
, arg
, sizeof(cmd
->name
));
1983 cmd
->p
.glob
= strpbrk(arg
, "*?[") != NULL
? 1 : 0;
1984 } else if (!inet_aton(arg
, &cmd
->p
.ip
))
1985 errx(EX_DATAERR
, "bad ip address ``%s''", arg
);
1988 static unsigned long
1989 getbw(const char *str
, u_short
*flags
, int kb
)
1995 val
= strtoul(str
, &end
, 0);
1996 if (*end
== 'k' || *end
== 'K') {
1999 } else if (*end
== 'm' || *end
== 'M') {
2005 * Deal with bits or bytes or b(bits) or B(bytes). If there is no
2006 * trailer assume bits.
2008 if (strncasecmp(end
, "bit", 3) == 0) {
2010 } else if (strncasecmp(end
, "byte", 4) == 0) {
2012 } else if (*end
== 'b') {
2014 } else if (*end
== 'B') {
2019 * Return in bits if flags is NULL, else flag bits
2020 * or bytes in flags and return the unconverted value.
2022 if (inbytes
&& flags
)
2023 *flags
|= DN_QSIZE_IS_BYTES
;
2024 else if (inbytes
&& flags
== NULL
)
2030 * the following macro returns an error message if we run out of
2033 #define NEED1(msg) {if (!ac) errx(EX_USAGE, msg);}
2036 config_pipe(int ac
, char **av
)
2038 struct dn_pipe pipe
;
2044 memset(&pipe
, 0, sizeof pipe
);
2048 if (ac
&& isdigit(**av
)) {
2049 i
= atoi(*av
); av
++; ac
--;
2057 int tok
= match_token(dummynet_params
, *av
);
2062 pipe
.fs
.flags_fs
|= DN_NOERROR
;
2066 NEED1("plr needs argument 0..1\n");
2067 d
= strtod(av
[0], NULL
);
2072 pipe
.fs
.plr
= (int)(d
*0x7fffffff);
2077 NEED1("queue needs queue size\n");
2079 pipe
.fs
.qsize
= getbw(av
[0], &pipe
.fs
.flags_fs
, 1024);
2084 NEED1("buckets needs argument\n");
2085 pipe
.fs
.rq_size
= strtoul(av
[0], NULL
, 0);
2090 NEED1("mask needs mask specifier\n");
2092 * per-flow queue, mask is dst_ip, dst_port,
2093 * src_ip, src_port, proto measured in bits
2097 pipe
.fs
.flow_mask
.dst_ip
= 0;
2098 pipe
.fs
.flow_mask
.src_ip
= 0;
2099 pipe
.fs
.flow_mask
.dst_port
= 0;
2100 pipe
.fs
.flow_mask
.src_port
= 0;
2101 pipe
.fs
.flow_mask
.proto
= 0;
2105 u_int32_t
*p32
= NULL
;
2106 u_int16_t
*p16
= NULL
;
2108 tok
= match_token(dummynet_params
, *av
);
2113 * special case, all bits significant
2115 pipe
.fs
.flow_mask
.dst_ip
= ~0;
2116 pipe
.fs
.flow_mask
.src_ip
= ~0;
2117 pipe
.fs
.flow_mask
.dst_port
= ~0;
2118 pipe
.fs
.flow_mask
.src_port
= ~0;
2119 pipe
.fs
.flow_mask
.proto
= ~0;
2120 pipe
.fs
.flags_fs
|= DN_HAVE_FLOW_MASK
;
2124 p32
= &pipe
.fs
.flow_mask
.dst_ip
;
2128 p32
= &pipe
.fs
.flow_mask
.src_ip
;
2132 p16
= &pipe
.fs
.flow_mask
.dst_port
;
2136 p16
= &pipe
.fs
.flow_mask
.src_port
;
2143 ac
++; av
--; /* backtrack */
2147 errx(EX_USAGE
, "mask: value missing");
2148 if (*av
[0] == '/') {
2149 a
= strtoul(av
[0]+1, &end
, 0);
2150 a
= (a
== 32) ? ~0 : (1 << a
) - 1;
2152 a
= strtoul(av
[0], &end
, 0);
2155 else if (p16
!= NULL
) {
2158 "mask: must be 16 bit");
2159 *p16
= (u_int16_t
)a
;
2163 "mask: must be 8 bit");
2164 pipe
.fs
.flow_mask
.proto
= (u_int8_t
)a
;
2167 pipe
.fs
.flags_fs
|= DN_HAVE_FLOW_MASK
;
2169 } /* end while, config masks */
2175 NEED1("red/gred needs w_q/min_th/max_th/max_p\n");
2176 pipe
.fs
.flags_fs
|= DN_IS_RED
;
2177 if (tok
== TOK_GRED
)
2178 pipe
.fs
.flags_fs
|= DN_IS_GENTLE_RED
;
2180 * the format for parameters is w_q/min_th/max_th/max_p
2182 if ((end
= strsep(&av
[0], "/"))) {
2183 double w_q
= strtod(end
, NULL
);
2184 if (w_q
> 1 || w_q
<= 0)
2185 errx(EX_DATAERR
, "0 < w_q <= 1");
2186 pipe
.fs
.w_q
= (int) (w_q
* (1 << SCALE_RED
));
2188 if ((end
= strsep(&av
[0], "/"))) {
2189 pipe
.fs
.min_th
= strtoul(end
, &end
, 0);
2190 if (*end
== 'K' || *end
== 'k')
2191 pipe
.fs
.min_th
*= 1024;
2193 if ((end
= strsep(&av
[0], "/"))) {
2194 pipe
.fs
.max_th
= strtoul(end
, &end
, 0);
2195 if (*end
== 'K' || *end
== 'k')
2196 pipe
.fs
.max_th
*= 1024;
2198 if ((end
= strsep(&av
[0], "/"))) {
2199 double max_p
= strtod(end
, NULL
);
2200 if (max_p
> 1 || max_p
<= 0)
2201 errx(EX_DATAERR
, "0 < max_p <= 1");
2202 pipe
.fs
.max_p
= (int)(max_p
* (1 << SCALE_RED
));
2208 pipe
.fs
.flags_fs
&= ~(DN_IS_RED
|DN_IS_GENTLE_RED
);
2212 NEED1("bw needs bandwidth or interface\n");
2214 errx(EX_DATAERR
, "bandwidth only valid for pipes");
2216 * set clocking interface or bandwidth value
2218 if (av
[0][0] >= 'a' && av
[0][0] <= 'z') {
2219 int l
= sizeof(pipe
.if_name
)-1;
2220 /* interface name */
2221 strncpy(pipe
.if_name
, av
[0], l
);
2222 pipe
.if_name
[l
] = '\0';
2225 pipe
.if_name
[0] = '\0';
2226 pipe
.bandwidth
= strtoul(av
[0], &end
, 0);
2227 pipe
.bandwidth
= getbw(av
[0], NULL
, 1000);
2228 if (pipe
.bandwidth
< 0)
2229 errx(EX_DATAERR
, "bandwidth too large");
2236 errx(EX_DATAERR
, "delay only valid for pipes");
2237 NEED1("delay needs argument 0..10000ms\n");
2238 pipe
.delay
= strtoul(av
[0], NULL
, 0);
2244 errx(EX_DATAERR
,"weight only valid for queues");
2245 NEED1("weight needs argument 0..100\n");
2246 pipe
.fs
.weight
= strtoul(av
[0], &end
, 0);
2252 errx(EX_DATAERR
,"pipe only valid for queues");
2253 NEED1("pipe needs pipe_number\n");
2254 pipe
.fs
.parent_nr
= strtoul(av
[0], &end
, 0);
2259 errx(EX_DATAERR
, "unrecognised option ``%s''", *av
);
2263 if (pipe
.pipe_nr
== 0)
2264 errx(EX_DATAERR
, "pipe_nr must be > 0");
2265 if (pipe
.delay
> 10000)
2266 errx(EX_DATAERR
, "delay must be < 10000");
2267 } else { /* do_pipe == 2, queue */
2268 if (pipe
.fs
.parent_nr
== 0)
2269 errx(EX_DATAERR
, "pipe must be > 0");
2270 if (pipe
.fs
.weight
>100)
2271 errx(EX_DATAERR
, "weight must be <= 100");
2273 if (pipe
.fs
.flags_fs
& DN_QSIZE_IS_BYTES
) {
2274 if (pipe
.fs
.qsize
> 1024*1024)
2275 errx(EX_DATAERR
, "queue size must be < 1MB");
2277 if (pipe
.fs
.qsize
> 100)
2278 errx(EX_DATAERR
, "2 <= queue size <= 100");
2280 if (pipe
.fs
.flags_fs
& DN_IS_RED
) {
2282 int lookup_depth
, avg_pkt_size
;
2283 double s
, idle
, weight
, w_q
;
2284 struct clockinfo clock
;
2287 if (pipe
.fs
.min_th
>= pipe
.fs
.max_th
)
2288 errx(EX_DATAERR
, "min_th %d must be < than max_th %d",
2289 pipe
.fs
.min_th
, pipe
.fs
.max_th
);
2290 if (pipe
.fs
.max_th
== 0)
2291 errx(EX_DATAERR
, "max_th must be > 0");
2294 if (sysctlbyname("net.inet.ip.dummynet.red_lookup_depth",
2295 &lookup_depth
, &len
, NULL
, 0) == -1)
2297 errx(1, "sysctlbyname(\"%s\")",
2298 "net.inet.ip.dummynet.red_lookup_depth");
2299 if (lookup_depth
== 0)
2300 errx(EX_DATAERR
, "net.inet.ip.dummynet.red_lookup_depth"
2301 " must be greater than zero");
2304 if (sysctlbyname("net.inet.ip.dummynet.red_avg_pkt_size",
2305 &avg_pkt_size
, &len
, NULL
, 0) == -1)
2307 errx(1, "sysctlbyname(\"%s\")",
2308 "net.inet.ip.dummynet.red_avg_pkt_size");
2309 if (avg_pkt_size
== 0)
2311 "net.inet.ip.dummynet.red_avg_pkt_size must"
2312 " be greater than zero");
2314 len
= sizeof(struct clockinfo
);
2315 if (sysctlbyname("kern.clockrate", &clock
, &len
, NULL
, 0) == -1)
2316 errx(1, "sysctlbyname(\"%s\")", "kern.clockrate");
2319 * Ticks needed for sending a medium-sized packet.
2320 * Unfortunately, when we are configuring a WF2Q+ queue, we
2321 * do not have bandwidth information, because that is stored
2322 * in the parent pipe, and also we have multiple queues
2323 * competing for it. So we set s=0, which is not very
2324 * correct. But on the other hand, why do we want RED with
2327 if (pipe
.bandwidth
==0) /* this is a WF2Q+ queue */
2330 s
= clock
.hz
* avg_pkt_size
* 8 / pipe
.bandwidth
;
2333 * max idle time (in ticks) before avg queue size becomes 0.
2334 * NOTA: (3/w_q) is approx the value x so that
2335 * (1-w_q)^x < 10^-3.
2337 w_q
= ((double)pipe
.fs
.w_q
) / (1 << SCALE_RED
);
2338 idle
= s
* 3. / w_q
;
2339 pipe
.fs
.lookup_step
= (int)idle
/ lookup_depth
;
2340 if (!pipe
.fs
.lookup_step
)
2341 pipe
.fs
.lookup_step
= 1;
2343 for (t
= pipe
.fs
.lookup_step
; t
> 0; --t
)
2345 pipe
.fs
.lookup_weight
= (int)(weight
* (1 << SCALE_RED
));
2347 i
= setsockopt(s
, IPPROTO_IP
, IP_DUMMYNET_CONFIGURE
, &pipe
,
2350 err(1, "setsockopt(%s)", "IP_DUMMYNET_CONFIGURE");
2354 get_mac_addr_mask(char *p
, u_char
*addr
, u_char
*mask
)
2359 addr
[i
] = mask
[i
] = 0;
2360 if (!strcmp(p
, "any"))
2363 for (i
=0; *p
&& i
<6;i
++, p
++) {
2364 addr
[i
] = strtol(p
, &p
, 16);
2365 if (*p
!= ':') /* we start with the mask */
2368 if (*p
== '/') { /* mask len */
2369 l
= strtol(p
+1, &p
, 0);
2370 for (i
=0; l
>0; l
-=8, i
++)
2371 mask
[i
] = (l
>=8) ? 0xff : (~0) << (8-l
);
2372 } else if (*p
== '&') { /* mask */
2373 for (i
=0, p
++; *p
&& i
<6;i
++, p
++) {
2374 mask
[i
] = strtol(p
, &p
, 16);
2378 } else if (*p
== '\0') {
2387 * helper function, updates the pointer to cmd with the length
2388 * of the current command, and also cleans up the first word of
2389 * the new command in case it has been clobbered before.
2392 next_cmd(ipfw_insn
*cmd
)
2395 bzero(cmd
, sizeof(*cmd
));
2400 * A function to fill simple commands of size 1.
2401 * Existing flags are preserved.
2404 fill_cmd(ipfw_insn
*cmd
, enum ipfw_opcodes opcode
, int flags
, u_int16_t arg
)
2406 cmd
->opcode
= opcode
;
2407 cmd
->len
= ((cmd
->len
| flags
) & (F_NOT
| F_OR
)) | 1;
2412 * Fetch and add the MAC address and type, with masks. This generates one or
2413 * two microinstructions, and returns the pointer to the last one.
2416 add_mac(ipfw_insn
*cmd
, int ac
, char *av
[])
2421 errx(EX_DATAERR
, "MAC dst src");
2423 cmd
->opcode
= O_MACADDR2
;
2424 cmd
->len
= (cmd
->len
& (F_NOT
| F_OR
)) | F_INSN_SIZE(ipfw_insn_mac
);
2426 mac
= (ipfw_insn_mac
*)cmd
;
2427 get_mac_addr_mask(av
[0], mac
->addr
, mac
->mask
); /* dst */
2428 get_mac_addr_mask(av
[1], &(mac
->addr
[6]), &(mac
->mask
[6])); /* src */
2433 add_mactype(ipfw_insn
*cmd
, int ac
, char *av
)
2436 errx(EX_DATAERR
, "missing MAC type");
2437 if (strcmp(av
, "any") != 0) { /* we have a non-null type */
2438 fill_newports((ipfw_insn_u16
*)cmd
, av
, IPPROTO_ETHERTYPE
);
2439 cmd
->opcode
= O_MAC_TYPE
;
2446 add_proto(ipfw_insn
*cmd
, char *av
)
2448 struct protoent
*pe
;
2451 if (!strncmp(av
, "all", strlen(av
)))
2452 ; /* same as "ip" */
2453 else if ((proto
= atoi(av
)) > 0)
2455 else if ((pe
= getprotobyname(av
)) != NULL
)
2456 proto
= pe
->p_proto
;
2459 if (proto
!= IPPROTO_IP
)
2460 fill_cmd(cmd
, O_PROTO
, 0, proto
);
2465 add_srcip(ipfw_insn
*cmd
, char *av
)
2467 fill_ip((ipfw_insn_ip
*)cmd
, av
);
2468 if (cmd
->opcode
== O_IP_DST_SET
) /* set */
2469 cmd
->opcode
= O_IP_SRC_SET
;
2470 else if (F_LEN(cmd
) == F_INSN_SIZE(ipfw_insn
)) /* me */
2471 cmd
->opcode
= O_IP_SRC_ME
;
2472 else if (F_LEN(cmd
) == F_INSN_SIZE(ipfw_insn_u32
)) /* one IP */
2473 cmd
->opcode
= O_IP_SRC
;
2474 else if (F_LEN(cmd
) == F_INSN_SIZE(ipfw_insn_ip
)) /* addr/mask */
2475 cmd
->opcode
= O_IP_SRC_MASK
;
2480 add_dstip(ipfw_insn
*cmd
, char *av
)
2482 fill_ip((ipfw_insn_ip
*)cmd
, av
);
2483 if (cmd
->opcode
== O_IP_DST_SET
) /* set */
2485 else if (F_LEN(cmd
) == F_INSN_SIZE(ipfw_insn
)) /* me */
2486 cmd
->opcode
= O_IP_DST_ME
;
2487 else if (F_LEN(cmd
) == F_INSN_SIZE(ipfw_insn_u32
)) /* one IP */
2488 cmd
->opcode
= O_IP_DST
;
2489 else if (F_LEN(cmd
) == F_INSN_SIZE(ipfw_insn_ip
)) /* addr/mask */
2490 cmd
->opcode
= O_IP_DST_MASK
;
2495 add_ports(ipfw_insn
*cmd
, char *av
, u_char proto
, int opcode
)
2497 if (!strncmp(av
, "any", strlen(av
))) {
2499 } else if (fill_newports((ipfw_insn_u16
*)cmd
, av
, proto
)) {
2500 /* XXX todo: check that we have a protocol with ports */
2501 cmd
->opcode
= opcode
;
2508 * Parse arguments and assemble the microinstructions which make up a rule.
2509 * Rules are added into the 'rulebuf' and then copied in the correct order
2510 * into the actual rule.
2512 * The syntax for a rule starts with the action, followed by an
2513 * optional log action, and the various match patterns.
2514 * In the assembled microcode, the first opcode must be a O_PROBE_STATE
2515 * (generated if the rule includes a keep-state option), then the
2516 * various match patterns, the "log" action, and the actual action.
2520 add(int ac
, char *av
[])
2523 * rules are added into the 'rulebuf' and then copied in
2524 * the correct order into the actual rule.
2525 * Some things that need to go out of order (prob, action etc.)
2528 static u_int32_t rulebuf
[255], actbuf
[255], cmdbuf
[255];
2530 ipfw_insn
*src
, *dst
, *cmd
, *action
, *prev
= NULL
;
2531 ipfw_insn
*first_cmd
; /* first match pattern */
2536 * various flags used to record that we entered some fields.
2538 ipfw_insn
*have_state
= NULL
; /* check-state or keep-state */
2542 int open_par
= 0; /* open parenthesis ( */
2544 /* proto is here because it is used to fetch ports */
2545 u_char proto
= IPPROTO_IP
; /* default protocol */
2547 double match_prob
= 1; /* match probability, default is always match */
2549 bzero(actbuf
, sizeof(actbuf
)); /* actions go here */
2550 bzero(cmdbuf
, sizeof(cmdbuf
));
2551 bzero(rulebuf
, sizeof(rulebuf
));
2553 rule
= (struct ip_fw
*)rulebuf
;
2554 cmd
= (ipfw_insn
*)cmdbuf
;
2555 action
= (ipfw_insn
*)actbuf
;
2559 /* [rule N] -- Rule number optional */
2560 if (ac
&& isdigit(**av
)) {
2561 rule
->rulenum
= atoi(*av
);
2566 /* [set N] -- set number (0..30), optional */
2567 if (ac
> 1 && !strncmp(*av
, "set", strlen(*av
))) {
2568 int set
= strtoul(av
[1], NULL
, 10);
2569 if (set
< 0 || set
> 30)
2570 errx(EX_DATAERR
, "illegal set %s", av
[1]);
2575 /* [prob D] -- match probability, optional */
2576 if (ac
> 1 && !strncmp(*av
, "prob", strlen(*av
))) {
2577 match_prob
= strtod(av
[1], NULL
);
2579 if (match_prob
<= 0 || match_prob
> 1)
2580 errx(EX_DATAERR
, "illegal match prob. %s", av
[1]);
2584 /* action -- mandatory */
2585 NEED1("missing action");
2586 i
= match_token(rule_actions
, *av
);
2588 action
->len
= 1; /* default */
2590 case TOK_CHECKSTATE
:
2591 have_state
= action
;
2592 action
->opcode
= O_CHECK_STATE
;
2596 action
->opcode
= O_ACCEPT
;
2600 action
->opcode
= O_DENY
;
2605 action
->opcode
= O_REJECT
;
2606 action
->arg1
= ICMP_UNREACH_HOST
;
2610 action
->opcode
= O_REJECT
;
2611 action
->arg1
= ICMP_REJECT_RST
;
2615 action
->opcode
= O_REJECT
;
2616 NEED1("missing reject code");
2617 fill_reject_code(&action
->arg1
, *av
);
2622 action
->opcode
= O_COUNT
;
2627 action
->len
= F_INSN_SIZE(ipfw_insn_pipe
);
2630 action
->opcode
= O_QUEUE
;
2631 else if (i
== TOK_PIPE
)
2632 action
->opcode
= O_PIPE
;
2633 else if (i
== TOK_SKIPTO
)
2634 action
->opcode
= O_SKIPTO
;
2635 NEED1("missing skipto/pipe/queue number");
2636 action
->arg1
= strtoul(*av
, NULL
, 10);
2642 action
->opcode
= (i
== TOK_DIVERT
) ? O_DIVERT
: O_TEE
;
2643 NEED1("missing divert/tee port");
2644 action
->arg1
= strtoul(*av
, NULL
, 0);
2645 if (action
->arg1
== 0) {
2648 s
= getservbyname(av
[0], "divert");
2650 action
->arg1
= ntohs(s
->s_port
);
2652 errx(EX_DATAERR
, "illegal divert/tee port");
2658 ipfw_insn_sa
*p
= (ipfw_insn_sa
*)action
;
2661 NEED1("missing forward address[:port]");
2663 action
->opcode
= O_FORWARD_IP
;
2664 action
->len
= F_INSN_SIZE(ipfw_insn_sa
);
2666 p
->sa
.sin_len
= sizeof(struct sockaddr_in
);
2667 p
->sa
.sin_family
= AF_INET
;
2670 * locate the address-port separator (':' or ',')
2672 s
= strchr(*av
, ':');
2674 s
= strchr(*av
, ',');
2677 i
= strtoport(s
, &end
, 0 /* base */, 0 /* proto */);
2680 "illegal forwarding port ``%s''", s
);
2681 p
->sa
.sin_port
= (u_short
)i
;
2683 lookup_host(*av
, &(p
->sa
.sin_addr
));
2689 errx(EX_DATAERR
, "invalid action %s\n", av
[-1]);
2691 action
= next_cmd(action
);
2694 * [log [logamount N]] -- log, optional
2696 * If exists, it goes first in the cmdbuf, but then it is
2697 * skipped in the copy section to the end of the buffer.
2699 if (ac
&& !strncmp(*av
, "log", strlen(*av
))) {
2700 ipfw_insn_log
*c
= (ipfw_insn_log
*)cmd
;
2702 cmd
->len
= F_INSN_SIZE(ipfw_insn_log
);
2703 cmd
->opcode
= O_LOG
;
2705 if (ac
&& !strncmp(*av
, "logamount", strlen(*av
))) {
2707 NEED1("logamount requires argument");
2708 c
->max_log
= atoi(*av
);
2710 errx(EX_DATAERR
, "logamount must be positive");
2713 cmd
= next_cmd(cmd
);
2716 if (have_state
) /* must be a check-state, we are done */
2719 #define OR_START(target) \
2720 if (ac && (*av[0] == '(' || *av[0] == '{')) { \
2722 errx(EX_USAGE, "nested \"(\" not allowed\n"); \
2725 if ( (av[0])[1] == '\0') { \
2736 !strncmp(*av, ")", strlen(*av)) || \
2737 !strncmp(*av, "}", strlen(*av)) )) { \
2742 errx(EX_USAGE, "missing \")\"\n"); \
2746 if (ac && !strncmp(*av, "not", strlen(*av))) { \
2747 if (cmd->len & F_NOT) \
2748 errx(EX_USAGE, "double \"not\" not allowed\n"); \
2749 cmd->len |= F_NOT; \
2753 #define OR_BLOCK(target) \
2754 if (ac && !strncmp(*av, "or", strlen(*av))) { \
2755 if (prev == NULL || open_par == 0) \
2756 errx(EX_DATAERR, "invalid OR block"); \
2757 prev->len |= F_OR; \
2767 * MAC addresses, optional.
2768 * If we have this, we skip the part "proto from src to dst"
2769 * and jump straight to the option parsing.
2772 NEED1("missing protocol");
2773 if (!strncmp(*av
, "MAC", strlen(*av
)) ||
2774 !strncmp(*av
, "mac", strlen(*av
))) {
2775 ac
--; av
++; /* the "MAC" keyword */
2776 add_mac(cmd
, ac
, av
); /* exits in case of errors */
2777 cmd
= next_cmd(cmd
);
2778 ac
-= 2; av
+= 2; /* dst-mac and src-mac */
2780 NEED1("missing mac type");
2781 if (add_mactype(cmd
, ac
, av
[0]))
2782 cmd
= next_cmd(cmd
);
2783 ac
--; av
++; /* any or mac-type */
2789 * protocol, mandatory
2791 OR_START(get_proto
);
2793 NEED1("missing protocol");
2794 if (add_proto(cmd
, *av
)) {
2796 if (F_LEN(cmd
) == 0) /* plain IP */
2801 cmd
= next_cmd(cmd
);
2803 } else if (first_cmd
!= cmd
) {
2804 errx(EX_DATAERR
, "invalid protocol ``%s''", *av
);
2807 OR_BLOCK(get_proto
);
2812 if (!ac
|| strncmp(*av
, "from", strlen(*av
)))
2813 errx(EX_USAGE
, "missing ``from''");
2817 * source IP, mandatory
2819 OR_START(source_ip
);
2820 NOT_BLOCK
; /* optional "not" */
2821 NEED1("missing source address");
2822 if (add_srcip(cmd
, *av
)) {
2824 if (F_LEN(cmd
) != 0) { /* ! any */
2826 cmd
= next_cmd(cmd
);
2829 OR_BLOCK(source_ip
);
2832 * source ports, optional
2834 NOT_BLOCK
; /* optional "not" */
2836 if (!strncmp(*av
, "any", strlen(*av
)) ||
2837 add_ports(cmd
, *av
, proto
, O_IP_SRCPORT
)) {
2839 if (F_LEN(cmd
) != 0)
2840 cmd
= next_cmd(cmd
);
2847 if (!ac
|| strncmp(*av
, "to", strlen(*av
)))
2848 errx(EX_USAGE
, "missing ``to''");
2852 * destination, mandatory
2855 NOT_BLOCK
; /* optional "not" */
2856 NEED1("missing dst address");
2857 if (add_dstip(cmd
, *av
)) {
2859 if (F_LEN(cmd
) != 0) { /* ! any */
2861 cmd
= next_cmd(cmd
);
2867 * dest. ports, optional
2869 NOT_BLOCK
; /* optional "not" */
2871 if (!strncmp(*av
, "any", strlen(*av
)) ||
2872 add_ports(cmd
, *av
, proto
, O_IP_DSTPORT
)) {
2874 if (F_LEN(cmd
) != 0)
2875 cmd
= next_cmd(cmd
);
2880 if (ac
&& first_cmd
== cmd
) {
2882 * nothing specified so far, store in the rule to ease
2890 ipfw_insn_u32
*cmd32
; /* alias for cmd */
2893 cmd32
= (ipfw_insn_u32
*)cmd
;
2895 if (*s
== '!') { /* alternate syntax for NOT */
2896 if (cmd
->len
& F_NOT
)
2897 errx(EX_USAGE
, "double \"not\" not allowed\n");
2901 i
= match_token(rule_options
, s
);
2905 if (cmd
->len
& F_NOT
)
2906 errx(EX_USAGE
, "double \"not\" not allowed\n");
2911 if (open_par
== 0 || prev
== NULL
)
2912 errx(EX_USAGE
, "invalid \"or\" block\n");
2916 case TOK_STARTBRACE
:
2918 errx(EX_USAGE
, "+nested \"(\" not allowed\n");
2924 errx(EX_USAGE
, "+missing \")\"\n");
2930 fill_cmd(cmd
, O_IN
, 0, 0);
2934 cmd
->len
^= F_NOT
; /* toggle F_NOT */
2935 fill_cmd(cmd
, O_IN
, 0, 0);
2939 fill_cmd(cmd
, O_FRAG
, 0, 0);
2943 fill_cmd(cmd
, O_LAYER2
, 0, 0);
2949 NEED1("recv, xmit, via require interface name"
2951 fill_iface((ipfw_insn_if
*)cmd
, av
[0]);
2953 if (F_LEN(cmd
) == 0) /* not a valid address */
2956 cmd
->opcode
= O_XMIT
;
2957 else if (i
== TOK_RECV
)
2958 cmd
->opcode
= O_RECV
;
2959 else if (i
== TOK_VIA
)
2960 cmd
->opcode
= O_VIA
;
2964 NEED1("icmptypes requires list of types");
2965 fill_icmptypes((ipfw_insn_u32
*)cmd
, *av
);
2970 NEED1("ipttl requires TTL");
2971 fill_cmd(cmd
, O_IPTTL
, 0, strtoul(*av
, NULL
, 0));
2976 NEED1("ipid requires length");
2977 fill_cmd(cmd
, O_IPID
, 0, strtoul(*av
, NULL
, 0));
2982 NEED1("iplen requires length");
2983 fill_cmd(cmd
, O_IPLEN
, 0, strtoul(*av
, NULL
, 0));
2988 NEED1("ipver requires version");
2989 fill_cmd(cmd
, O_IPVER
, 0, strtoul(*av
, NULL
, 0));
2993 case TOK_IPPRECEDENCE
:
2994 NEED1("ipprecedence requires value");
2995 fill_cmd(cmd
, O_IPPRECEDENCE
, 0,
2996 (strtoul(*av
, NULL
, 0) & 7) << 5);
3001 NEED1("missing argument for ipoptions");
3002 fill_flags(cmd
, O_IPOPT
, f_ipopts
, *av
);
3007 NEED1("missing argument for iptos");
3008 fill_flags(cmd
, O_IPTOS
, f_iptos
, *av
);
3013 NEED1("uid requires argument");
3019 cmd
->opcode
= O_UID
;
3020 uid
= strtoul(*av
, &end
, 0);
3021 pwd
= (*end
== '\0') ? getpwuid(uid
) : getpwnam(*av
);
3023 errx(EX_DATAERR
, "uid \"%s\" nonexistent", *av
);
3024 cmd32
->d
[0] = pwd
->pw_uid
;
3025 cmd
->len
= F_INSN_SIZE(ipfw_insn_u32
);
3031 NEED1("gid requires argument");
3037 cmd
->opcode
= O_GID
;
3038 gid
= strtoul(*av
, &end
, 0);
3039 grp
= (*end
== '\0') ? getgrgid(gid
) : getgrnam(*av
);
3041 errx(EX_DATAERR
, "gid \"%s\" nonexistent", *av
);
3042 cmd32
->d
[0] = grp
->gr_gid
;
3043 cmd
->len
= F_INSN_SIZE(ipfw_insn_u32
);
3049 fill_cmd(cmd
, O_ESTAB
, 0, 0);
3053 fill_cmd(cmd
, O_TCPFLAGS
, 0,
3054 (TH_SYN
) | ( (TH_ACK
) & 0xff) <<8 );
3058 NEED1("missing argument for tcpoptions");
3059 fill_flags(cmd
, O_TCPOPTS
, f_tcpopts
, *av
);
3065 NEED1("tcpseq/tcpack requires argument");
3066 cmd
->len
= F_INSN_SIZE(ipfw_insn_u32
);
3067 cmd
->opcode
= (i
== TOK_TCPSEQ
) ? O_TCPSEQ
: O_TCPACK
;
3068 cmd32
->d
[0] = htonl(strtoul(*av
, NULL
, 0));
3073 NEED1("tcpwin requires length");
3074 fill_cmd(cmd
, O_TCPWIN
, 0,
3075 htons(strtoul(*av
, NULL
, 0)));
3080 NEED1("missing argument for tcpflags");
3081 cmd
->opcode
= O_TCPFLAGS
;
3082 fill_flags(cmd
, O_TCPFLAGS
, f_tcpflags
, *av
);
3088 errx(EX_USAGE
, "keep-state cannot be part "
3091 errx(EX_USAGE
, "only one of keep-state "
3092 "and limit is allowed");
3094 fill_cmd(cmd
, O_KEEP_STATE
, 0, 0);
3099 errx(EX_USAGE
, "limit cannot be part "
3102 errx(EX_USAGE
, "only one of keep-state "
3103 "and limit is allowed");
3104 NEED1("limit needs mask and # of connections");
3107 ipfw_insn_limit
*c
= (ipfw_insn_limit
*)cmd
;
3109 cmd
->len
= F_INSN_SIZE(ipfw_insn_limit
);
3110 cmd
->opcode
= O_LIMIT
;
3116 val
= match_token(limit_masks
, *av
);
3119 c
->limit_mask
|= val
;
3122 c
->conn_limit
= atoi(*av
);
3123 if (c
->conn_limit
== 0)
3124 errx(EX_USAGE
, "limit: limit must be >0");
3125 if (c
->limit_mask
== 0)
3126 errx(EX_USAGE
, "missing limit mask");
3132 NEED1("missing protocol");
3133 if (add_proto(cmd
, *av
)) {
3137 errx(EX_DATAERR
, "invalid protocol ``%s''", *av
);
3141 NEED1("missing source IP");
3142 if (add_srcip(cmd
, *av
)) {
3148 NEED1("missing destination IP");
3149 if (add_dstip(cmd
, *av
)) {
3155 NEED1("missing source port");
3156 if (!strncmp(*av
, "any", strlen(*av
)) ||
3157 add_ports(cmd
, *av
, proto
, O_IP_SRCPORT
)) {
3160 errx(EX_DATAERR
, "invalid source port %s", *av
);
3164 NEED1("missing destination port");
3165 if (!strncmp(*av
, "any", strlen(*av
)) ||
3166 add_ports(cmd
, *av
, proto
, O_IP_DSTPORT
)) {
3169 errx(EX_DATAERR
, "invalid destination port %s",
3175 errx(EX_USAGE
, "MAC dst-mac src-mac");
3176 if (add_mac(cmd
, ac
, av
)) {
3182 NEED1("missing mac type");
3183 if (!add_mactype(cmd
, ac
, *av
))
3184 errx(EX_DATAERR
, "invalid mac type %s", *av
);
3189 errx(EX_USAGE
, "unrecognised option [%d] %s\n", i
, s
);
3191 if (F_LEN(cmd
) > 0) { /* prepare to advance */
3193 cmd
= next_cmd(cmd
);
3199 * Now copy stuff into the rule.
3200 * If we have a keep-state option, the first instruction
3201 * must be a PROBE_STATE (which is generated here).
3202 * If we have a LOG option, it was stored as the first command,
3203 * and now must be moved to the top of the action part.
3205 dst
= (ipfw_insn
*)rule
->cmd
;
3208 * First thing to write into the command stream is the match probability.
3210 if (match_prob
!= 1) { /* 1 means always match */
3211 dst
->opcode
= O_PROB
;
3213 *((int32_t *)(dst
+1)) = (int32_t)(match_prob
* 0x7fffffff);
3218 * generate O_PROBE_STATE if necessary
3220 if (have_state
&& have_state
->opcode
!= O_CHECK_STATE
) {
3221 fill_cmd(dst
, O_PROBE_STATE
, 0, 0);
3222 dst
= next_cmd(dst
);
3225 * copy all commands but O_LOG, O_KEEP_STATE, O_LIMIT
3227 for (src
= (ipfw_insn
*)cmdbuf
; src
!= cmd
; src
+= i
) {
3230 switch (src
->opcode
) {
3236 bcopy(src
, dst
, i
* sizeof(u_int32_t
));
3242 * put back the have_state command as last opcode
3244 if (have_state
&& have_state
->opcode
!= O_CHECK_STATE
) {
3245 i
= F_LEN(have_state
);
3246 bcopy(have_state
, dst
, i
* sizeof(u_int32_t
));
3250 * start action section
3252 rule
->act_ofs
= dst
- rule
->cmd
;
3255 * put back O_LOG if necessary
3257 src
= (ipfw_insn
*)cmdbuf
;
3258 if ( src
->opcode
== O_LOG
) {
3260 bcopy(src
, dst
, i
* sizeof(u_int32_t
));
3264 * copy all other actions
3266 for (src
= (ipfw_insn
*)actbuf
; src
!= action
; src
+= i
) {
3268 bcopy(src
, dst
, i
* sizeof(u_int32_t
));
3272 rule
->cmd_len
= (u_int32_t
*)dst
- (u_int32_t
*)(rule
->cmd
);
3273 i
= (void *)dst
- (void *)rule
;
3274 if (getsockopt(s
, IPPROTO_IP
, IP_FW_ADD
, rule
, &i
) == -1)
3275 err(EX_UNAVAILABLE
, "getsockopt(%s)", "IP_FW_ADD");
3277 show_ipfw(rule
, 10, 10);
3281 zero(int ac
, char *av
[])
3289 /* clear all entries */
3290 if (setsockopt(s
, IPPROTO_IP
, IP_FW_ZERO
, NULL
, 0) < 0)
3291 err(EX_UNAVAILABLE
, "setsockopt(%s)", "IP_FW_ZERO");
3293 printf("Accounting cleared.\n");
3300 if (isdigit(**av
)) {
3301 rulenum
= atoi(*av
);
3304 if (setsockopt(s
, IPPROTO_IP
,
3305 IP_FW_ZERO
, &rulenum
, sizeof rulenum
)) {
3306 warn("rule %u: setsockopt(IP_FW_ZERO)",
3308 failed
= EX_UNAVAILABLE
;
3309 } else if (!do_quiet
)
3310 printf("Entry %d cleared\n", rulenum
);
3312 errx(EX_USAGE
, "invalid rule number ``%s''", *av
);
3315 if (failed
!= EX_OK
)
3320 resetlog(int ac
, char *av
[])
3328 /* clear all entries */
3329 if (setsockopt(s
, IPPROTO_IP
, IP_FW_RESETLOG
, NULL
, 0) < 0)
3330 err(EX_UNAVAILABLE
, "setsockopt(IP_FW_RESETLOG)");
3332 printf("Logging counts reset.\n");
3339 if (isdigit(**av
)) {
3340 rulenum
= atoi(*av
);
3343 if (setsockopt(s
, IPPROTO_IP
,
3344 IP_FW_RESETLOG
, &rulenum
, sizeof rulenum
)) {
3345 warn("rule %u: setsockopt(IP_FW_RESETLOG)",
3347 failed
= EX_UNAVAILABLE
;
3348 } else if (!do_quiet
)
3349 printf("Entry %d logging count reset\n",
3352 errx(EX_DATAERR
, "invalid rule number ``%s''", *av
);
3355 if (failed
!= EX_OK
)
3362 int cmd
= do_pipe
? IP_DUMMYNET_FLUSH
: IP_FW_FLUSH
;
3364 if (!do_force
&& !do_quiet
) { /* need to ask user */
3367 printf("Are you sure? [yn] ");
3370 c
= toupper(getc(stdin
));
3371 while (c
!= '\n' && getc(stdin
) != '\n')
3373 return; /* and do not flush */
3374 } while (c
!= 'Y' && c
!= 'N');
3376 if (c
== 'N') /* user said no */
3379 if (setsockopt(s
, IPPROTO_IP
, cmd
, NULL
, 0) < 0)
3380 err(EX_UNAVAILABLE
, "setsockopt(IP_%s_FLUSH)",
3381 do_pipe
? "DUMMYNET" : "FW");
3383 printf("Flushed all %s.\n", do_pipe
? "pipes" : "rules");
3387 ipfw_main(int ac
, char **av
)
3394 /* Set the force flag for non-interactive processes */
3395 do_force
= !isatty(STDIN_FILENO
);
3397 optind
= optreset
= 1;
3398 while ((ch
= getopt(ac
, av
, "hs:acdefNqStv")) != -1)
3400 case 'h': /* help */
3402 break; /* NOTREACHED */
3404 case 's': /* sort */
3405 do_sort
= atoi(optarg
);
3434 case 'v': /* verbose */
3443 NEED1("bad arguments, for usage summary ``ipfw''");
3446 * optional: pipe or queue
3448 if (!strncmp(*av
, "pipe", strlen(*av
))) {
3452 } else if (!strncmp(*av
, "queue", strlen(*av
))) {
3457 NEED1("missing command");
3460 * for pipes and queues we normally say 'pipe NN config'
3461 * but the code is easier to parse as 'pipe config NN'
3462 * so we swap the two arguments.
3464 if (do_pipe
> 0 && ac
> 1 && *av
[0] >= '0' && *av
[0] <= '9') {
3469 if (!strncmp(*av
, "add", strlen(*av
)))
3471 else if (do_pipe
&& !strncmp(*av
, "config", strlen(*av
)))
3472 config_pipe(ac
, av
);
3473 else if (!strncmp(*av
, "delete", strlen(*av
)))
3475 else if (!strncmp(*av
, "flush", strlen(*av
)))
3477 else if (!strncmp(*av
, "zero", strlen(*av
)))
3479 else if (!strncmp(*av
, "resetlog", strlen(*av
)))
3481 else if (!strncmp(*av
, "print", strlen(*av
)) ||
3482 !strncmp(*av
, "list", strlen(*av
)))
3484 else if (!strncmp(*av
, "enable", strlen(*av
)))
3485 sysctl_handler(ac
, av
, 1);
3486 else if (!strncmp(*av
, "disable", strlen(*av
)))
3487 sysctl_handler(ac
, av
, 0);
3488 else if (!strncmp(*av
, "set", strlen(*av
)))
3489 sets_handler(ac
, av
);
3490 else if (!strncmp(*av
, "show", strlen(*av
))) {
3494 errx(EX_USAGE
, "bad command `%s'", *av
);
3500 ipfw_readfile(int ac
, char *av
[])
3503 #define WHITESP " \t\f\v\n\r"
3505 char *a
, *p
, *args
[MAX_ARGS
], *cmd
= NULL
;
3507 int i
=0, lineno
=0, qflag
=0, pflag
=0, status
;
3512 while ((c
= getopt(ac
, av
, "D:U:p:q")) != -1)
3516 errx(EX_USAGE
, "-D requires -p");
3517 if (i
> MAX_ARGS
- 2)
3519 "too many -D or -U options");
3526 errx(EX_USAGE
, "-U requires -p");
3527 if (i
> MAX_ARGS
- 2)
3529 "too many -D or -U options");
3546 errx(EX_USAGE
, "bad arguments, for usage"
3547 " summary ``ipfw''");
3553 errx(EX_USAGE
, "extraneous filename arguments");
3555 if ((f
= fopen(av
[0], "r")) == NULL
)
3556 err(EX_UNAVAILABLE
, "fopen: %s", av
[0]);
3559 /* pipe through preprocessor (cpp or m4) */
3564 if (pipe(pipedes
) == -1)
3565 err(EX_OSERR
, "cannot create pipe");
3567 switch((preproc
= fork())) {
3569 err(EX_OSERR
, "cannot fork");
3573 if (dup2(fileno(f
), 0) == -1
3574 || dup2(pipedes
[1], 1) == -1)
3575 err(EX_OSERR
, "dup2()");
3580 err(EX_OSERR
, "execvp(%s) failed", cmd
);
3586 if ((f
= fdopen(pipedes
[0], "r")) == NULL
) {
3587 int savederrno
= errno
;
3589 kill(preproc
, SIGTERM
);
3591 err(EX_OSERR
, "fdopen()");
3596 while (fgets(buf
, BUFSIZ
, f
)) {
3598 sprintf(linename
, "Line %d", lineno
);
3603 if ((p
= strchr(buf
, '#')) != NULL
)
3608 for (a
= strtok(buf
, WHITESP
);
3609 a
&& i
< MAX_ARGS
; a
= strtok(NULL
, WHITESP
), i
++)
3611 if (i
== (qflag
? 2: 1))
3614 errx(EX_USAGE
, "%s: too many arguments",
3622 if (waitpid(preproc
, &status
, 0) == -1)
3623 errx(EX_OSERR
, "waitpid()");
3624 if (WIFEXITED(status
) && WEXITSTATUS(status
) != EX_OK
)
3625 errx(EX_UNAVAILABLE
,
3626 "preprocessor exited with status %d",
3627 WEXITSTATUS(status
));
3628 else if (WIFSIGNALED(status
))
3629 errx(EX_UNAVAILABLE
,
3630 "preprocessor exited with signal %d",
3636 main(int ac
, char *av
[])
3638 s
= socket(AF_INET
, SOCK_RAW
, IPPROTO_RAW
);
3640 err(EX_UNAVAILABLE
, "socket");
3643 * If the last argument is an absolute pathname, interpret it
3644 * as a file to be preprocessed.
3647 if (ac
> 1 && av
[ac
- 1][0] == '/' && access(av
[ac
- 1], R_OK
) == 0)
3648 ipfw_readfile(ac
, av
);