1 | #include <machine/rtems-bsd-user-space.h> |
---|
2 | |
---|
3 | /* $OpenBSD: pfctl_table.c,v 1.67 2008/06/10 20:55:02 mcbride Exp $ */ |
---|
4 | |
---|
5 | /* |
---|
6 | * Copyright (c) 2002 Cedric Berger |
---|
7 | * All rights reserved. |
---|
8 | * |
---|
9 | * Redistribution and use in source and binary forms, with or without |
---|
10 | * modification, are permitted provided that the following conditions |
---|
11 | * are met: |
---|
12 | * |
---|
13 | * - Redistributions of source code must retain the above copyright |
---|
14 | * notice, this list of conditions and the following disclaimer. |
---|
15 | * - Redistributions in binary form must reproduce the above |
---|
16 | * copyright notice, this list of conditions and the following |
---|
17 | * disclaimer in the documentation and/or other materials provided |
---|
18 | * with the distribution. |
---|
19 | * |
---|
20 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
---|
21 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
---|
22 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
---|
23 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
---|
24 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
---|
25 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
---|
26 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
---|
27 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
---|
28 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
---|
29 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
---|
30 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
---|
31 | * POSSIBILITY OF SUCH DAMAGE. |
---|
32 | * |
---|
33 | */ |
---|
34 | |
---|
35 | #include <sys/cdefs.h> |
---|
36 | __FBSDID("$FreeBSD$"); |
---|
37 | |
---|
38 | #include <rtems/bsd/sys/types.h> |
---|
39 | #include <sys/ioctl.h> |
---|
40 | #include <sys/socket.h> |
---|
41 | |
---|
42 | #include <net/if.h> |
---|
43 | #include <net/pfvar.h> |
---|
44 | #include <arpa/inet.h> |
---|
45 | |
---|
46 | #include <ctype.h> |
---|
47 | #include <err.h> |
---|
48 | #include <errno.h> |
---|
49 | #include <netdb.h> |
---|
50 | #include <stdarg.h> |
---|
51 | #include <stdio.h> |
---|
52 | #include <stdlib.h> |
---|
53 | #include <string.h> |
---|
54 | #include <time.h> |
---|
55 | |
---|
56 | #include "pfctl_parser.h" |
---|
57 | #include "pfctl.h" |
---|
58 | |
---|
59 | extern void usage(void); |
---|
60 | static int pfctl_table(int, char *[], char *, const char *, char *, |
---|
61 | const char *, int); |
---|
62 | static void print_table(struct pfr_table *, int, int); |
---|
63 | static void print_tstats(struct pfr_tstats *, int); |
---|
64 | static int load_addr(struct pfr_buffer *, int, char *[], char *, int); |
---|
65 | static void print_addrx(struct pfr_addr *, struct pfr_addr *, int); |
---|
66 | static void print_astats(struct pfr_astats *, int); |
---|
67 | static void radix_perror(void); |
---|
68 | static void xprintf(int, const char *, ...); |
---|
69 | static void print_iface(struct pfi_kif *, int); |
---|
70 | |
---|
71 | static const char *stats_text[PFR_DIR_MAX][PFR_OP_TABLE_MAX] = { |
---|
72 | { "In/Block:", "In/Pass:", "In/XPass:" }, |
---|
73 | { "Out/Block:", "Out/Pass:", "Out/XPass:" } |
---|
74 | }; |
---|
75 | |
---|
76 | static const char *istats_text[2][2][2] = { |
---|
77 | { { "In4/Pass:", "In4/Block:" }, { "Out4/Pass:", "Out4/Block:" } }, |
---|
78 | { { "In6/Pass:", "In6/Block:" }, { "Out6/Pass:", "Out6/Block:" } } |
---|
79 | }; |
---|
80 | |
---|
81 | #define RVTEST(fct) do { \ |
---|
82 | if ((!(opts & PF_OPT_NOACTION) || \ |
---|
83 | (opts & PF_OPT_DUMMYACTION)) && \ |
---|
84 | (fct)) { \ |
---|
85 | radix_perror(); \ |
---|
86 | goto _error; \ |
---|
87 | } \ |
---|
88 | } while (0) |
---|
89 | |
---|
90 | #define CREATE_TABLE do { \ |
---|
91 | table.pfrt_flags |= PFR_TFLAG_PERSIST; \ |
---|
92 | if ((!(opts & PF_OPT_NOACTION) || \ |
---|
93 | (opts & PF_OPT_DUMMYACTION)) && \ |
---|
94 | (pfr_add_tables(&table, 1, &nadd, flags)) && \ |
---|
95 | (errno != EPERM)) { \ |
---|
96 | radix_perror(); \ |
---|
97 | goto _error; \ |
---|
98 | } \ |
---|
99 | if (nadd) { \ |
---|
100 | warn_namespace_collision(table.pfrt_name); \ |
---|
101 | xprintf(opts, "%d table created", nadd); \ |
---|
102 | if (opts & PF_OPT_NOACTION) \ |
---|
103 | return (0); \ |
---|
104 | } \ |
---|
105 | table.pfrt_flags &= ~PFR_TFLAG_PERSIST; \ |
---|
106 | } while(0) |
---|
107 | |
---|
108 | int |
---|
109 | pfctl_clear_tables(const char *anchor, int opts) |
---|
110 | { |
---|
111 | return pfctl_table(0, NULL, NULL, "-F", NULL, anchor, opts); |
---|
112 | } |
---|
113 | |
---|
114 | int |
---|
115 | pfctl_show_tables(const char *anchor, int opts) |
---|
116 | { |
---|
117 | return pfctl_table(0, NULL, NULL, "-s", NULL, anchor, opts); |
---|
118 | } |
---|
119 | |
---|
120 | int |
---|
121 | pfctl_command_tables(int argc, char *argv[], char *tname, |
---|
122 | const char *command, char *file, const char *anchor, int opts) |
---|
123 | { |
---|
124 | if (tname == NULL || command == NULL) |
---|
125 | usage(); |
---|
126 | return pfctl_table(argc, argv, tname, command, file, anchor, opts); |
---|
127 | } |
---|
128 | |
---|
129 | int |
---|
130 | pfctl_table(int argc, char *argv[], char *tname, const char *command, |
---|
131 | char *file, const char *anchor, int opts) |
---|
132 | { |
---|
133 | struct pfr_table table; |
---|
134 | struct pfr_buffer b, b2; |
---|
135 | struct pfr_addr *a, *a2; |
---|
136 | int nadd = 0, ndel = 0, nchange = 0, nzero = 0; |
---|
137 | int rv = 0, flags = 0, nmatch = 0; |
---|
138 | void *p; |
---|
139 | |
---|
140 | if (command == NULL) |
---|
141 | usage(); |
---|
142 | if (opts & PF_OPT_NOACTION) |
---|
143 | flags |= PFR_FLAG_DUMMY; |
---|
144 | |
---|
145 | bzero(&b, sizeof(b)); |
---|
146 | bzero(&b2, sizeof(b2)); |
---|
147 | bzero(&table, sizeof(table)); |
---|
148 | if (tname != NULL) { |
---|
149 | if (strlen(tname) >= PF_TABLE_NAME_SIZE) |
---|
150 | usage(); |
---|
151 | if (strlcpy(table.pfrt_name, tname, |
---|
152 | sizeof(table.pfrt_name)) >= sizeof(table.pfrt_name)) |
---|
153 | errx(1, "pfctl_table: strlcpy"); |
---|
154 | } |
---|
155 | if (strlcpy(table.pfrt_anchor, anchor, |
---|
156 | sizeof(table.pfrt_anchor)) >= sizeof(table.pfrt_anchor)) |
---|
157 | errx(1, "pfctl_table: strlcpy"); |
---|
158 | |
---|
159 | if (!strcmp(command, "-F")) { |
---|
160 | if (argc || file != NULL) |
---|
161 | usage(); |
---|
162 | RVTEST(pfr_clr_tables(&table, &ndel, flags)); |
---|
163 | xprintf(opts, "%d tables deleted", ndel); |
---|
164 | } else if (!strcmp(command, "-s")) { |
---|
165 | b.pfrb_type = (opts & PF_OPT_VERBOSE2) ? |
---|
166 | PFRB_TSTATS : PFRB_TABLES; |
---|
167 | if (argc || file != NULL) |
---|
168 | usage(); |
---|
169 | for (;;) { |
---|
170 | pfr_buf_grow(&b, b.pfrb_size); |
---|
171 | b.pfrb_size = b.pfrb_msize; |
---|
172 | if (opts & PF_OPT_VERBOSE2) |
---|
173 | RVTEST(pfr_get_tstats(&table, |
---|
174 | b.pfrb_caddr, &b.pfrb_size, flags)); |
---|
175 | else |
---|
176 | RVTEST(pfr_get_tables(&table, |
---|
177 | b.pfrb_caddr, &b.pfrb_size, flags)); |
---|
178 | if (b.pfrb_size <= b.pfrb_msize) |
---|
179 | break; |
---|
180 | } |
---|
181 | |
---|
182 | if ((opts & PF_OPT_SHOWALL) && b.pfrb_size > 0) |
---|
183 | pfctl_print_title("TABLES:"); |
---|
184 | |
---|
185 | PFRB_FOREACH(p, &b) |
---|
186 | if (opts & PF_OPT_VERBOSE2) |
---|
187 | print_tstats(p, opts & PF_OPT_DEBUG); |
---|
188 | else |
---|
189 | print_table(p, opts & PF_OPT_VERBOSE, |
---|
190 | opts & PF_OPT_DEBUG); |
---|
191 | } else if (!strcmp(command, "kill")) { |
---|
192 | if (argc || file != NULL) |
---|
193 | usage(); |
---|
194 | RVTEST(pfr_del_tables(&table, 1, &ndel, flags)); |
---|
195 | xprintf(opts, "%d table deleted", ndel); |
---|
196 | } else if (!strcmp(command, "flush")) { |
---|
197 | if (argc || file != NULL) |
---|
198 | usage(); |
---|
199 | RVTEST(pfr_clr_addrs(&table, &ndel, flags)); |
---|
200 | xprintf(opts, "%d addresses deleted", ndel); |
---|
201 | } else if (!strcmp(command, "add")) { |
---|
202 | b.pfrb_type = PFRB_ADDRS; |
---|
203 | if (load_addr(&b, argc, argv, file, 0)) |
---|
204 | goto _error; |
---|
205 | CREATE_TABLE; |
---|
206 | if (opts & PF_OPT_VERBOSE) |
---|
207 | flags |= PFR_FLAG_FEEDBACK; |
---|
208 | RVTEST(pfr_add_addrs(&table, b.pfrb_caddr, b.pfrb_size, |
---|
209 | &nadd, flags)); |
---|
210 | xprintf(opts, "%d/%d addresses added", nadd, b.pfrb_size); |
---|
211 | if (opts & PF_OPT_VERBOSE) |
---|
212 | PFRB_FOREACH(a, &b) |
---|
213 | if ((opts & PF_OPT_VERBOSE2) || a->pfra_fback) |
---|
214 | print_addrx(a, NULL, |
---|
215 | opts & PF_OPT_USEDNS); |
---|
216 | } else if (!strcmp(command, "delete")) { |
---|
217 | b.pfrb_type = PFRB_ADDRS; |
---|
218 | if (load_addr(&b, argc, argv, file, 0)) |
---|
219 | goto _error; |
---|
220 | if (opts & PF_OPT_VERBOSE) |
---|
221 | flags |= PFR_FLAG_FEEDBACK; |
---|
222 | RVTEST(pfr_del_addrs(&table, b.pfrb_caddr, b.pfrb_size, |
---|
223 | &ndel, flags)); |
---|
224 | xprintf(opts, "%d/%d addresses deleted", ndel, b.pfrb_size); |
---|
225 | if (opts & PF_OPT_VERBOSE) |
---|
226 | PFRB_FOREACH(a, &b) |
---|
227 | if ((opts & PF_OPT_VERBOSE2) || a->pfra_fback) |
---|
228 | print_addrx(a, NULL, |
---|
229 | opts & PF_OPT_USEDNS); |
---|
230 | } else if (!strcmp(command, "replace")) { |
---|
231 | b.pfrb_type = PFRB_ADDRS; |
---|
232 | if (load_addr(&b, argc, argv, file, 0)) |
---|
233 | goto _error; |
---|
234 | CREATE_TABLE; |
---|
235 | if (opts & PF_OPT_VERBOSE) |
---|
236 | flags |= PFR_FLAG_FEEDBACK; |
---|
237 | for (;;) { |
---|
238 | int sz2 = b.pfrb_msize; |
---|
239 | |
---|
240 | RVTEST(pfr_set_addrs(&table, b.pfrb_caddr, b.pfrb_size, |
---|
241 | &sz2, &nadd, &ndel, &nchange, flags)); |
---|
242 | if (sz2 <= b.pfrb_msize) { |
---|
243 | b.pfrb_size = sz2; |
---|
244 | break; |
---|
245 | } else |
---|
246 | pfr_buf_grow(&b, sz2); |
---|
247 | } |
---|
248 | if (nadd) |
---|
249 | xprintf(opts, "%d addresses added", nadd); |
---|
250 | if (ndel) |
---|
251 | xprintf(opts, "%d addresses deleted", ndel); |
---|
252 | if (nchange) |
---|
253 | xprintf(opts, "%d addresses changed", nchange); |
---|
254 | if (!nadd && !ndel && !nchange) |
---|
255 | xprintf(opts, "no changes"); |
---|
256 | if (opts & PF_OPT_VERBOSE) |
---|
257 | PFRB_FOREACH(a, &b) |
---|
258 | if ((opts & PF_OPT_VERBOSE2) || a->pfra_fback) |
---|
259 | print_addrx(a, NULL, |
---|
260 | opts & PF_OPT_USEDNS); |
---|
261 | } else if (!strcmp(command, "expire")) { |
---|
262 | const char *errstr; |
---|
263 | u_int lifetime; |
---|
264 | |
---|
265 | b.pfrb_type = PFRB_ASTATS; |
---|
266 | b2.pfrb_type = PFRB_ADDRS; |
---|
267 | if (argc != 1 || file != NULL) |
---|
268 | usage(); |
---|
269 | lifetime = strtonum(*argv, 0, UINT_MAX, &errstr); |
---|
270 | if (errstr) |
---|
271 | errx(1, "expiry time: %s", errstr); |
---|
272 | for (;;) { |
---|
273 | pfr_buf_grow(&b, b.pfrb_size); |
---|
274 | b.pfrb_size = b.pfrb_msize; |
---|
275 | RVTEST(pfr_get_astats(&table, b.pfrb_caddr, |
---|
276 | &b.pfrb_size, flags)); |
---|
277 | if (b.pfrb_size <= b.pfrb_msize) |
---|
278 | break; |
---|
279 | } |
---|
280 | PFRB_FOREACH(p, &b) { |
---|
281 | ((struct pfr_astats *)p)->pfras_a.pfra_fback = 0; |
---|
282 | if (time(NULL) - ((struct pfr_astats *)p)->pfras_tzero > |
---|
283 | lifetime) |
---|
284 | if (pfr_buf_add(&b2, |
---|
285 | &((struct pfr_astats *)p)->pfras_a)) |
---|
286 | err(1, "duplicate buffer"); |
---|
287 | } |
---|
288 | |
---|
289 | if (opts & PF_OPT_VERBOSE) |
---|
290 | flags |= PFR_FLAG_FEEDBACK; |
---|
291 | RVTEST(pfr_del_addrs(&table, b2.pfrb_caddr, b2.pfrb_size, |
---|
292 | &ndel, flags)); |
---|
293 | xprintf(opts, "%d/%d addresses expired", ndel, b2.pfrb_size); |
---|
294 | if (opts & PF_OPT_VERBOSE) |
---|
295 | PFRB_FOREACH(a, &b2) |
---|
296 | if ((opts & PF_OPT_VERBOSE2) || a->pfra_fback) |
---|
297 | print_addrx(a, NULL, |
---|
298 | opts & PF_OPT_USEDNS); |
---|
299 | } else if (!strcmp(command, "show")) { |
---|
300 | b.pfrb_type = (opts & PF_OPT_VERBOSE) ? |
---|
301 | PFRB_ASTATS : PFRB_ADDRS; |
---|
302 | if (argc || file != NULL) |
---|
303 | usage(); |
---|
304 | for (;;) { |
---|
305 | pfr_buf_grow(&b, b.pfrb_size); |
---|
306 | b.pfrb_size = b.pfrb_msize; |
---|
307 | if (opts & PF_OPT_VERBOSE) |
---|
308 | RVTEST(pfr_get_astats(&table, b.pfrb_caddr, |
---|
309 | &b.pfrb_size, flags)); |
---|
310 | else |
---|
311 | RVTEST(pfr_get_addrs(&table, b.pfrb_caddr, |
---|
312 | &b.pfrb_size, flags)); |
---|
313 | if (b.pfrb_size <= b.pfrb_msize) |
---|
314 | break; |
---|
315 | } |
---|
316 | PFRB_FOREACH(p, &b) |
---|
317 | if (opts & PF_OPT_VERBOSE) |
---|
318 | print_astats(p, opts & PF_OPT_USEDNS); |
---|
319 | else |
---|
320 | print_addrx(p, NULL, opts & PF_OPT_USEDNS); |
---|
321 | } else if (!strcmp(command, "test")) { |
---|
322 | b.pfrb_type = PFRB_ADDRS; |
---|
323 | b2.pfrb_type = PFRB_ADDRS; |
---|
324 | |
---|
325 | if (load_addr(&b, argc, argv, file, 1)) |
---|
326 | goto _error; |
---|
327 | if (opts & PF_OPT_VERBOSE2) { |
---|
328 | flags |= PFR_FLAG_REPLACE; |
---|
329 | PFRB_FOREACH(a, &b) |
---|
330 | if (pfr_buf_add(&b2, a)) |
---|
331 | err(1, "duplicate buffer"); |
---|
332 | } |
---|
333 | RVTEST(pfr_tst_addrs(&table, b.pfrb_caddr, b.pfrb_size, |
---|
334 | &nmatch, flags)); |
---|
335 | xprintf(opts, "%d/%d addresses match", nmatch, b.pfrb_size); |
---|
336 | if ((opts & PF_OPT_VERBOSE) && !(opts & PF_OPT_VERBOSE2)) |
---|
337 | PFRB_FOREACH(a, &b) |
---|
338 | if (a->pfra_fback == PFR_FB_MATCH) |
---|
339 | print_addrx(a, NULL, |
---|
340 | opts & PF_OPT_USEDNS); |
---|
341 | if (opts & PF_OPT_VERBOSE2) { |
---|
342 | a2 = NULL; |
---|
343 | PFRB_FOREACH(a, &b) { |
---|
344 | a2 = pfr_buf_next(&b2, a2); |
---|
345 | print_addrx(a2, a, opts & PF_OPT_USEDNS); |
---|
346 | } |
---|
347 | } |
---|
348 | if (nmatch < b.pfrb_size) |
---|
349 | rv = 2; |
---|
350 | } else if (!strcmp(command, "zero")) { |
---|
351 | if (argc || file != NULL) |
---|
352 | usage(); |
---|
353 | flags |= PFR_FLAG_ADDRSTOO; |
---|
354 | RVTEST(pfr_clr_tstats(&table, 1, &nzero, flags)); |
---|
355 | xprintf(opts, "%d table/stats cleared", nzero); |
---|
356 | } else |
---|
357 | warnx("pfctl_table: unknown command '%s'", command); |
---|
358 | goto _cleanup; |
---|
359 | |
---|
360 | _error: |
---|
361 | rv = -1; |
---|
362 | _cleanup: |
---|
363 | pfr_buf_clear(&b); |
---|
364 | pfr_buf_clear(&b2); |
---|
365 | return (rv); |
---|
366 | } |
---|
367 | |
---|
368 | void |
---|
369 | print_table(struct pfr_table *ta, int verbose, int debug) |
---|
370 | { |
---|
371 | if (!debug && !(ta->pfrt_flags & PFR_TFLAG_ACTIVE)) |
---|
372 | return; |
---|
373 | if (verbose) { |
---|
374 | printf("%c%c%c%c%c%c%c\t%s", |
---|
375 | (ta->pfrt_flags & PFR_TFLAG_CONST) ? 'c' : '-', |
---|
376 | (ta->pfrt_flags & PFR_TFLAG_PERSIST) ? 'p' : '-', |
---|
377 | (ta->pfrt_flags & PFR_TFLAG_ACTIVE) ? 'a' : '-', |
---|
378 | (ta->pfrt_flags & PFR_TFLAG_INACTIVE) ? 'i' : '-', |
---|
379 | (ta->pfrt_flags & PFR_TFLAG_REFERENCED) ? 'r' : '-', |
---|
380 | (ta->pfrt_flags & PFR_TFLAG_REFDANCHOR) ? 'h' : '-', |
---|
381 | (ta->pfrt_flags & PFR_TFLAG_COUNTERS) ? 'C' : '-', |
---|
382 | ta->pfrt_name); |
---|
383 | if (ta->pfrt_anchor[0]) |
---|
384 | printf("\t%s", ta->pfrt_anchor); |
---|
385 | puts(""); |
---|
386 | } else |
---|
387 | puts(ta->pfrt_name); |
---|
388 | } |
---|
389 | |
---|
390 | void |
---|
391 | print_tstats(struct pfr_tstats *ts, int debug) |
---|
392 | { |
---|
393 | time_t time = ts->pfrts_tzero; |
---|
394 | int dir, op; |
---|
395 | |
---|
396 | if (!debug && !(ts->pfrts_flags & PFR_TFLAG_ACTIVE)) |
---|
397 | return; |
---|
398 | print_table(&ts->pfrts_t, 1, debug); |
---|
399 | printf("\tAddresses: %d\n", ts->pfrts_cnt); |
---|
400 | printf("\tCleared: %s", ctime(&time)); |
---|
401 | printf("\tReferences: [ Anchors: %-18d Rules: %-18d ]\n", |
---|
402 | ts->pfrts_refcnt[PFR_REFCNT_ANCHOR], |
---|
403 | ts->pfrts_refcnt[PFR_REFCNT_RULE]); |
---|
404 | printf("\tEvaluations: [ NoMatch: %-18llu Match: %-18llu ]\n", |
---|
405 | (unsigned long long)ts->pfrts_nomatch, |
---|
406 | (unsigned long long)ts->pfrts_match); |
---|
407 | for (dir = 0; dir < PFR_DIR_MAX; dir++) |
---|
408 | for (op = 0; op < PFR_OP_TABLE_MAX; op++) |
---|
409 | printf("\t%-12s [ Packets: %-18llu Bytes: %-18llu ]\n", |
---|
410 | stats_text[dir][op], |
---|
411 | (unsigned long long)ts->pfrts_packets[dir][op], |
---|
412 | (unsigned long long)ts->pfrts_bytes[dir][op]); |
---|
413 | } |
---|
414 | |
---|
415 | int |
---|
416 | load_addr(struct pfr_buffer *b, int argc, char *argv[], char *file, |
---|
417 | int nonetwork) |
---|
418 | { |
---|
419 | while (argc--) |
---|
420 | if (append_addr(b, *argv++, nonetwork)) { |
---|
421 | if (errno) |
---|
422 | warn("cannot decode %s", argv[-1]); |
---|
423 | return (-1); |
---|
424 | } |
---|
425 | if (pfr_buf_load(b, file, nonetwork, append_addr)) { |
---|
426 | warn("cannot load %s", file); |
---|
427 | return (-1); |
---|
428 | } |
---|
429 | return (0); |
---|
430 | } |
---|
431 | |
---|
432 | void |
---|
433 | print_addrx(struct pfr_addr *ad, struct pfr_addr *rad, int dns) |
---|
434 | { |
---|
435 | char ch, buf[256] = "{error}"; |
---|
436 | char fb[] = { ' ', 'M', 'A', 'D', 'C', 'Z', 'X', ' ', 'Y', ' ' }; |
---|
437 | unsigned int fback, hostnet; |
---|
438 | |
---|
439 | fback = (rad != NULL) ? rad->pfra_fback : ad->pfra_fback; |
---|
440 | ch = (fback < sizeof(fb)/sizeof(*fb)) ? fb[fback] : '?'; |
---|
441 | hostnet = (ad->pfra_af == AF_INET6) ? 128 : 32; |
---|
442 | inet_ntop(ad->pfra_af, &ad->pfra_u, buf, sizeof(buf)); |
---|
443 | printf("%c %c%s", ch, (ad->pfra_not?'!':' '), buf); |
---|
444 | if (ad->pfra_net < hostnet) |
---|
445 | printf("/%d", ad->pfra_net); |
---|
446 | if (rad != NULL && fback != PFR_FB_NONE) { |
---|
447 | if (strlcpy(buf, "{error}", sizeof(buf)) >= sizeof(buf)) |
---|
448 | errx(1, "print_addrx: strlcpy"); |
---|
449 | inet_ntop(rad->pfra_af, &rad->pfra_u, buf, sizeof(buf)); |
---|
450 | printf("\t%c%s", (rad->pfra_not?'!':' '), buf); |
---|
451 | if (rad->pfra_net < hostnet) |
---|
452 | printf("/%d", rad->pfra_net); |
---|
453 | } |
---|
454 | if (rad != NULL && fback == PFR_FB_NONE) |
---|
455 | printf("\t nomatch"); |
---|
456 | if (dns && ad->pfra_net == hostnet) { |
---|
457 | char host[NI_MAXHOST]; |
---|
458 | union sockaddr_union sa; |
---|
459 | |
---|
460 | strlcpy(host, "?", sizeof(host)); |
---|
461 | bzero(&sa, sizeof(sa)); |
---|
462 | sa.sa.sa_family = ad->pfra_af; |
---|
463 | if (sa.sa.sa_family == AF_INET) { |
---|
464 | sa.sa.sa_len = sizeof(sa.sin); |
---|
465 | sa.sin.sin_addr = ad->pfra_ip4addr; |
---|
466 | } else { |
---|
467 | sa.sa.sa_len = sizeof(sa.sin6); |
---|
468 | sa.sin6.sin6_addr = ad->pfra_ip6addr; |
---|
469 | } |
---|
470 | if (getnameinfo(&sa.sa, sa.sa.sa_len, host, sizeof(host), |
---|
471 | NULL, 0, NI_NAMEREQD) == 0) |
---|
472 | printf("\t(%s)", host); |
---|
473 | } |
---|
474 | printf("\n"); |
---|
475 | } |
---|
476 | |
---|
477 | void |
---|
478 | print_astats(struct pfr_astats *as, int dns) |
---|
479 | { |
---|
480 | time_t time = as->pfras_tzero; |
---|
481 | int dir, op; |
---|
482 | |
---|
483 | print_addrx(&as->pfras_a, NULL, dns); |
---|
484 | printf("\tCleared: %s", ctime(&time)); |
---|
485 | if (as->pfras_a.pfra_fback == PFR_FB_NOCOUNT) |
---|
486 | return; |
---|
487 | for (dir = 0; dir < PFR_DIR_MAX; dir++) |
---|
488 | for (op = 0; op < PFR_OP_ADDR_MAX; op++) |
---|
489 | printf("\t%-12s [ Packets: %-18llu Bytes: %-18llu ]\n", |
---|
490 | stats_text[dir][op], |
---|
491 | (unsigned long long)as->pfras_packets[dir][op], |
---|
492 | (unsigned long long)as->pfras_bytes[dir][op]); |
---|
493 | } |
---|
494 | |
---|
495 | void |
---|
496 | radix_perror(void) |
---|
497 | { |
---|
498 | extern char *__progname; |
---|
499 | fprintf(stderr, "%s: %s.\n", __progname, pfr_strerror(errno)); |
---|
500 | } |
---|
501 | |
---|
502 | int |
---|
503 | pfctl_define_table(char *name, int flags, int addrs, const char *anchor, |
---|
504 | struct pfr_buffer *ab, u_int32_t ticket) |
---|
505 | { |
---|
506 | struct pfr_table tbl; |
---|
507 | |
---|
508 | bzero(&tbl, sizeof(tbl)); |
---|
509 | if (strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)) >= |
---|
510 | sizeof(tbl.pfrt_name) || strlcpy(tbl.pfrt_anchor, anchor, |
---|
511 | sizeof(tbl.pfrt_anchor)) >= sizeof(tbl.pfrt_anchor)) |
---|
512 | errx(1, "pfctl_define_table: strlcpy"); |
---|
513 | tbl.pfrt_flags = flags; |
---|
514 | |
---|
515 | return pfr_ina_define(&tbl, ab->pfrb_caddr, ab->pfrb_size, NULL, |
---|
516 | NULL, ticket, addrs ? PFR_FLAG_ADDRSTOO : 0); |
---|
517 | } |
---|
518 | |
---|
519 | void |
---|
520 | warn_namespace_collision(const char *filter) |
---|
521 | { |
---|
522 | struct pfr_buffer b; |
---|
523 | struct pfr_table *t; |
---|
524 | const char *name = NULL, *lastcoll; |
---|
525 | int coll = 0; |
---|
526 | |
---|
527 | bzero(&b, sizeof(b)); |
---|
528 | b.pfrb_type = PFRB_TABLES; |
---|
529 | for (;;) { |
---|
530 | pfr_buf_grow(&b, b.pfrb_size); |
---|
531 | b.pfrb_size = b.pfrb_msize; |
---|
532 | if (pfr_get_tables(NULL, b.pfrb_caddr, |
---|
533 | &b.pfrb_size, PFR_FLAG_ALLRSETS)) |
---|
534 | err(1, "pfr_get_tables"); |
---|
535 | if (b.pfrb_size <= b.pfrb_msize) |
---|
536 | break; |
---|
537 | } |
---|
538 | PFRB_FOREACH(t, &b) { |
---|
539 | if (!(t->pfrt_flags & PFR_TFLAG_ACTIVE)) |
---|
540 | continue; |
---|
541 | if (filter != NULL && strcmp(filter, t->pfrt_name)) |
---|
542 | continue; |
---|
543 | if (!t->pfrt_anchor[0]) |
---|
544 | name = t->pfrt_name; |
---|
545 | else if (name != NULL && !strcmp(name, t->pfrt_name)) { |
---|
546 | coll++; |
---|
547 | lastcoll = name; |
---|
548 | name = NULL; |
---|
549 | } |
---|
550 | } |
---|
551 | if (coll == 1) |
---|
552 | warnx("warning: namespace collision with <%s> global table.", |
---|
553 | lastcoll); |
---|
554 | else if (coll > 1) |
---|
555 | warnx("warning: namespace collisions with %d global tables.", |
---|
556 | coll); |
---|
557 | pfr_buf_clear(&b); |
---|
558 | } |
---|
559 | |
---|
560 | void |
---|
561 | xprintf(int opts, const char *fmt, ...) |
---|
562 | { |
---|
563 | va_list args; |
---|
564 | |
---|
565 | if (opts & PF_OPT_QUIET) |
---|
566 | return; |
---|
567 | |
---|
568 | va_start(args, fmt); |
---|
569 | vfprintf(stderr, fmt, args); |
---|
570 | va_end(args); |
---|
571 | |
---|
572 | if (opts & PF_OPT_DUMMYACTION) |
---|
573 | fprintf(stderr, " (dummy).\n"); |
---|
574 | else if (opts & PF_OPT_NOACTION) |
---|
575 | fprintf(stderr, " (syntax only).\n"); |
---|
576 | else |
---|
577 | fprintf(stderr, ".\n"); |
---|
578 | } |
---|
579 | |
---|
580 | |
---|
581 | /* interface stuff */ |
---|
582 | |
---|
583 | int |
---|
584 | pfctl_show_ifaces(const char *filter, int opts) |
---|
585 | { |
---|
586 | struct pfr_buffer b; |
---|
587 | struct pfi_kif *p; |
---|
588 | int i = 0; |
---|
589 | |
---|
590 | bzero(&b, sizeof(b)); |
---|
591 | b.pfrb_type = PFRB_IFACES; |
---|
592 | for (;;) { |
---|
593 | pfr_buf_grow(&b, b.pfrb_size); |
---|
594 | b.pfrb_size = b.pfrb_msize; |
---|
595 | if (pfi_get_ifaces(filter, b.pfrb_caddr, &b.pfrb_size)) { |
---|
596 | radix_perror(); |
---|
597 | return (1); |
---|
598 | } |
---|
599 | if (b.pfrb_size <= b.pfrb_msize) |
---|
600 | break; |
---|
601 | i++; |
---|
602 | } |
---|
603 | if (opts & PF_OPT_SHOWALL) |
---|
604 | pfctl_print_title("INTERFACES:"); |
---|
605 | PFRB_FOREACH(p, &b) |
---|
606 | print_iface(p, opts); |
---|
607 | return (0); |
---|
608 | } |
---|
609 | |
---|
610 | void |
---|
611 | print_iface(struct pfi_kif *p, int opts) |
---|
612 | { |
---|
613 | time_t tzero = p->pfik_tzero; |
---|
614 | int i, af, dir, act; |
---|
615 | |
---|
616 | printf("%s", p->pfik_name); |
---|
617 | if (opts & PF_OPT_VERBOSE) { |
---|
618 | if (p->pfik_flags & PFI_IFLAG_SKIP) |
---|
619 | printf(" (skip)"); |
---|
620 | } |
---|
621 | printf("\n"); |
---|
622 | |
---|
623 | if (!(opts & PF_OPT_VERBOSE2)) |
---|
624 | return; |
---|
625 | printf("\tCleared: %s", ctime(&tzero)); |
---|
626 | printf("\tReferences: [ States: %-18d Rules: %-18d ]\n", |
---|
627 | p->pfik_states, p->pfik_rules); |
---|
628 | for (i = 0; i < 8; i++) { |
---|
629 | af = (i>>2) & 1; |
---|
630 | dir = (i>>1) &1; |
---|
631 | act = i & 1; |
---|
632 | printf("\t%-12s [ Packets: %-18llu Bytes: %-18llu ]\n", |
---|
633 | istats_text[af][dir][act], |
---|
634 | (unsigned long long)p->pfik_packets[af][dir][act], |
---|
635 | (unsigned long long)p->pfik_bytes[af][dir][act]); |
---|
636 | } |
---|
637 | } |
---|