sbin/ipfw3/ipfw3.c

   1 /*
   2  * Copyright (c) 2014 - 2016 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Bill Yuan <bycn82@dragonflybsd.org>
   6  *
   7  * Copyright (c) 2002 Luigi Rizzo
   8  * Copyright (c) 1996 Alex Nash, Paul Traina, Poul-Henning Kamp
   9  * Copyright (c) 1994 Ugen J.S.Antsilevich
  10  *
  11  * Idea and grammar partially left from:
  12  * Copyright (c) 1993 Daniel Boulet
  13  *
  14  *
  15  * Redistribution and use in source forms, with and without modification,
  16  * are permitted provided that this entire comment appears intact.
  17  *
  18  * Redistribution in binary form may occur without any restrictions.
  19  * Obviously, it would be nice if you gave credit where credit is due
  20  * but requiring it would be too onerous.
  21  *
  22  * This software is provided ``AS IS'' without any warranties of any kind.
  23  *
  24  */
  25
  26 #include <sys/param.h>
  27 #include <sys/mbuf.h>
  28 #include <sys/socket.h>
  29 #include <sys/sockio.h>
  30 #include <sys/sysctl.h>
  31 #include <sys/time.h>
  32 #include <sys/wait.h>
  33
  34 #include <arpa/inet.h>
  35 #include <ctype.h>
  36 #include <dlfcn.h>
  37 #include <err.h>
  38 #include <errno.h>
  39 #include <grp.h>
  40 #include <limits.h>
  41 #include <netdb.h>
  42 #include <pwd.h>
  43 #include <sysexits.h>
  44 #include <signal.h>
  45 #include <stdio.h>
  46 #include <stdlib.h>
  47 #include <stdarg.h>
  48 #include <string.h>
  49 #include <timeconv.h>
  50 #include <unistd.h>
  51
  52 #include <netinet/in.h>
  53 #include <netinet/in_systm.h>
  54 #include <netinet/ip.h>
  55 #include <netinet/ip_icmp.h>
  56 #include <netinet/tcp.h>
  57 #include <net/if.h>
  58 #include <net/if_dl.h>
  59 #include <net/route.h>
  60 #include <net/ethernet.h>
  61
  62
  63 #include "../../sys/net/ipfw3/ip_fw3.h"
  64 #include "../../sys/net/ipfw3/ip_fw3_table.h"
  65 #include "../../sys/net/ipfw3/ip_fw3_sync.h"
  66 #include "../../sys/net/dummynet3/ip_dummynet3.h"
  67 #include "../../sys/net/libalias/alias.h"
  68 #include "../../sys/net/ipfw3_basic/ip_fw3_basic.h"
  69 #include "../../sys/net/ipfw3_nat/ip_fw3_nat.h"
  70
  71 #include "ipfw3.h"
  72 #include "ipfw3sync.h"
  73 #include "ipfw3nat.h"
  74
  75
  76 #define KEYWORD_SIZE    256
  77 #define MAPPING_SIZE    256
  78
  79 #define MAX_KEYWORD_LEN 20
  80 #define MAX_ARGS        32
  81 #define WHITESP         " \t\f\v\n\r"
  82 #define IPFW_LIB_PATH   "/usr/lib/libipfw3%s.so"
  83 #define IP_MASK_ALL     0xffffffff
  84 /*
  85  * we use IPPROTO_ETHERTYPE as a fake protocol id to call the print routines
  86  * This is only used in this code.
  87  */
  88 #define IPPROTO_ETHERTYPE       0x1000
  89
  90 /*
  91  * show_rules() prints the body of an ipfw rule.
  92  * Because the standard rule has at least proto src_ip dst_ip, we use
  93  * a helper function to produce these entries if not provided explicitly.
  94  * The first argument is the list of fields we have, the second is
  95  * the list of fields we want to be printed.
  96  *
  97  * Special cases if we have provided a MAC header:
  98  * + if the rule does not contain IP addresses/ports, do not print them;
  99  * + if the rule does not contain an IP proto, print "all" instead of "ip";
 100  *
 101  */
 102 #define HAVE_PROTO      0x0001
 103 #define HAVE_SRCIP      0x0002
 104 #define HAVE_DSTIP      0x0004
 105 #define HAVE_MAC        0x0008
 106 #define HAVE_MACTYPE    0x0010
 107 #define HAVE_OPTIONS    0x8000
 108
 109 #define HAVE_IP         (HAVE_PROTO | HAVE_SRCIP | HAVE_DSTIP)
 110
 111
 112 int             ipfw_socket = -1;       /* main RAW socket */
 113 int             do_resolv,              /* Would try to resolve all */
 114                 do_acct,                /* Show packet/byte count */
 115                 do_time,                /* Show time stamps */
 116                 do_quiet = 1,           /* Be quiet , default is quiet*/
 117                 do_force,               /* Don't ask for confirmation */
 118                 do_pipe,                /* this cmd refers to a pipe */
 119                 do_nat,                 /* Nat configuration. */
 120                 do_sort,                /* field to sort results (0 = no) */
 121                 do_dynamic,             /* display dynamic rules */
 122                 do_expired,             /* display expired dynamic rules */
 123                 do_compact,             /* show rules in compact mode */
 124                 show_sets,              /* display rule sets */
 125                 verbose;
 126
 127 struct char_int_map dummynet_params[] = {
 128         { "plr",                TOK_PLR },
 129         { "noerror",            TOK_NOERROR },
 130         { "buckets",            TOK_BUCKETS },
 131         { "dst-ip",             TOK_DSTIP },
 132         { "src-ip",             TOK_SRCIP },
 133         { "dst-port",           TOK_DSTPORT },
 134         { "src-port",           TOK_SRCPORT },
 135         { "proto",              TOK_PROTO },
 136         { "weight",             TOK_WEIGHT },
 137         { "all",                TOK_ALL },
 138         { "mask",               TOK_MASK },
 139         { "droptail",           TOK_DROPTAIL },
 140         { "red",                TOK_RED },
 141         { "gred",               TOK_GRED },
 142         { "bw",                 TOK_BW },
 143         { "bandwidth",          TOK_BW },
 144         { "delay",              TOK_DELAY },
 145         { "pipe",               TOK_PIPE },
 146         { "queue",              TOK_QUEUE },
 147         { "dummynet-params",    TOK_NULL },
 148         { NULL, 0 }
 149 };
 150
 151 struct ipfw_keyword {
 152         int type;
 153         char word[MAX_KEYWORD_LEN];
 154         int module;
 155         int opcode;
 156 };
 157
 158 struct ipfw_mapping {
 159         int type;
 160         int module;
 161         int opcode;
 162         parser_func parser;
 163         shower_func shower;
 164 };
 165
 166 struct ipfw_keyword keywords[KEYWORD_SIZE];
 167 struct ipfw_mapping mappings[MAPPING_SIZE];
 168
 169 int
 170 match_token(struct char_int_map *table, char *string)
 171 {
 172         while (table->key) {
 173                 if (strcmp(table->key, string) == 0) {
 174                         return table->val;
 175                 }
 176                 table++;
 177         }
 178         return 0;
 179 }
 180
 181 static void
 182 get_modules(char *modules_str, int len)
 183 {
 184         if (do_get_x(IP_FW_MODULE, modules_str, &len) < 0)
 185                 errx(EX_USAGE, "ipfw3 not loaded.");
 186 }
 187
 188 static void
 189 list_modules(int ac, char *av[])
 190 {
 191         void *module_str = NULL;
 192         int len = 1024;
 193         if ((module_str = realloc(module_str, len)) == NULL)
 194                 err(EX_OSERR, "realloc");
 195
 196         get_modules(module_str, len);
 197         printf("%s", (char *)module_str);
 198 }
 199 void
 200 parse_accept(ipfw_insn **cmd, int *ac, char **av[])
 201 {
 202         (*cmd)->opcode = O_BASIC_ACCEPT;
 203         (*cmd)->module = MODULE_BASIC_ID;
 204         (*cmd)->len = (*cmd)->len|LEN_OF_IPFWINSN;
 205         NEXT_ARG1;
 206         if (!strncmp(**av, "log", strlen(**av))) {
 207                 (*cmd)->arg3 = 1;
 208                 NEXT_ARG1;
 209                 if (isdigit(***av)) {
 210                         (*cmd)->arg1 = strtoul(**av, NULL, 10);
 211                         NEXT_ARG1;
 212                 }
 213         }
 214 }
 215
 216 void
 217 parse_deny(ipfw_insn **cmd, int *ac, char **av[])
 218 {
 219         (*cmd)->opcode = O_BASIC_DENY;
 220         (*cmd)->module = MODULE_BASIC_ID;
 221         (*cmd)->len = (*cmd)->len|LEN_OF_IPFWINSN;
 222         NEXT_ARG1;
 223         if (!strncmp(**av, "log", strlen(**av))) {
 224                 (*cmd)->arg3 = 1;
 225                 NEXT_ARG1;
 226                 if (isdigit(***av)) {
 227                         (*cmd)->arg1 = strtoul(**av, NULL, 10);
 228                         NEXT_ARG1;
 229                 }
 230         }
 231 }
 232
 233 void
 234 show_accept(ipfw_insn *cmd, int show_or)
 235 {
 236         printf(" allow");
 237         if (cmd->arg3) {
 238                 printf(" log %d", cmd->arg1);
 239         }
 240 }
 241
 242 void
 243 show_deny(ipfw_insn *cmd, int show_or)
 244 {
 245         printf(" deny");
 246         if (cmd->arg3) {
 247                 printf(" log %d", cmd->arg1);
 248         }
 249 }
 250
 251 static void
 252 load_modules(void)
 253 {
 254         const char *error;
 255         init_module mod_init_func;
 256         void *module_lib;
 257         char module_lib_file[50];
 258         void *module_str = NULL;
 259         int len = 1024;
 260
 261         if ((module_str = realloc(module_str, len)) == NULL)
 262                 err(EX_OSERR, "realloc");
 263
 264         get_modules(module_str, len);
 265
 266         const char s[2] = ",";
 267         char *token;
 268         token = strtok(module_str, s);
 269         while (token != NULL) {
 270                 sprintf(module_lib_file, IPFW_LIB_PATH, token);
 271                 token = strtok(NULL, s);
 272                 module_lib = dlopen(module_lib_file, RTLD_LAZY);
 273                 if (!module_lib) {
 274                         fprintf(stderr, "Couldn't open %s: %s\n",
 275                                 module_lib_file, dlerror());
 276                         exit(EX_SOFTWARE);
 277                 }
 278                 mod_init_func = dlsym(module_lib, "load_module");
 279                 if ((error = dlerror()))
 280                 {
 281                         fprintf(stderr, "Couldn't find init function: %s\n", error);
 282                         exit(EX_SOFTWARE);
 283                 }
 284                 (*mod_init_func)((register_func)register_ipfw_func,
 285                                 (register_keyword)register_ipfw_keyword);
 286         }
 287 }
 288
 289 void
 290 prepare_default_funcs(void)
 291 {
 292         /* register allow*/
 293         register_ipfw_keyword(MODULE_BASIC_ID, O_BASIC_ACCEPT, "allow", ACTION);
 294         register_ipfw_keyword(MODULE_BASIC_ID, O_BASIC_ACCEPT, "accept", ACTION);
 295         register_ipfw_func(MODULE_BASIC_ID, O_BASIC_ACCEPT,
 296                         (parser_func)parse_accept, (shower_func)show_accept);
 297         /* register deny*/
 298         register_ipfw_keyword(MODULE_BASIC_ID, O_BASIC_DENY, "deny", ACTION);
 299         register_ipfw_keyword(MODULE_BASIC_ID, O_BASIC_DENY, "reject", ACTION);
 300         register_ipfw_func(MODULE_BASIC_ID, O_BASIC_DENY,
 301                         (parser_func)parse_deny, (shower_func)show_deny);
 302 }
 303
 304 void
 305 register_ipfw_keyword(int module, int opcode, char *word, int type)
 306 {
 307         struct ipfw_keyword *tmp;
 308
 309         tmp=keywords;
 310         for(;;) {
 311                 if (tmp->type == NONE) {
 312                         strcpy(tmp->word, word);
 313                         tmp->module = module;
 314                         tmp->opcode = opcode;
 315                         tmp->type = type;
 316                         break;
 317                 } else {
 318                         if (strcmp(tmp->word, word) == 0)
 319                                 errx(EX_USAGE, "keyword `%s' exists", word);
 320                         else
 321                                 tmp++;
 322                 }
 323         }
 324 }
 325
 326 void
 327 register_ipfw_func(int module, int opcode, parser_func parser, shower_func shower)
 328 {
 329         struct ipfw_mapping *tmp;
 330
 331         tmp = mappings;
 332         while (1) {
 333                 if (tmp->type == NONE) {
 334                         tmp->module = module;
 335                         tmp->opcode = opcode;
 336                         tmp->parser = parser;
 337                         tmp->shower = shower;
 338                         tmp->type = IN_USE;
 339                         break;
 340                 } else {
 341                         if (tmp->opcode == opcode && tmp->module == module) {
 342                                 errx(EX_USAGE, "func `%d' of module `%d' exists",
 343                                         opcode, module);
 344                                 break;
 345                         } else {
 346                                 tmp++;
 347                         }
 348                 }
 349         }
 350 }
 351
 352 /*
 353  * this func need to check whether 'or' need to be printed,
 354  * when the filter is the first filter with 'or' when dont print
 355  * when not first and same as previous, then print or and no filter name
 356  * when not first but different from previous, print name without 'or'
 357  * show_or = 1: show or and ignore filter name
 358  * show_or = 0: show filter name ignore or
 359  */
 360 void prev_show_chk(ipfw_insn *cmd, uint8_t *prev_module, uint8_t *prev_opcode,
 361                 int *show_or)
 362 {
 363         if (cmd->len & F_OR) {
 364                 if (*prev_module == 0 && *prev_opcode == 0) {
 365                         /* first cmd with 'or' flag */
 366                         *show_or = 0;
 367                         *prev_module = cmd->module;
 368                         *prev_opcode = cmd->opcode;
 369                 } else if (cmd->module == *prev_module &&
 370                                 cmd->opcode == *prev_opcode) {
 371                         /* cmd same as previous, same module and opcode */
 372                         *show_or = 1;
 373                 } else {
 374                         /* cmd different from prev*/
 375                         *show_or = 0;
 376                         *prev_module = cmd->module;
 377                         *prev_opcode = cmd->opcode;
 378
 379                 }
 380         } else {
 381                 *show_or = 0;
 382                 *prev_module = 0;
 383                 *prev_opcode = 0;
 384         }
 385 }
 386
 387 /*
 388  * word can be: proto from to other
 389  * proto show proto
 390  * from show from
 391  * to show to
 392  * other show all other filters
 393  */
 394 int show_filter(ipfw_insn *cmd, char *word, int type)
 395 {
 396         struct ipfw_keyword *k;
 397         struct ipfw_mapping *m;
 398         shower_func fn;
 399         int i, j, show_or;
 400         uint8_t prev_module, prev_opcode;
 401
 402         k = keywords;
 403         m = mappings;
 404         for (i = 1; i < KEYWORD_SIZE; i++, k++) {
 405                 if (k->type == type) {
 406                         if (k->module == cmd->module &&
 407                                         k->opcode == cmd->opcode) {
 408                                 for (j = 1; j < MAPPING_SIZE; j++, m++) {
 409                                         if (m->type == IN_USE &&
 410                                                 k->module == m->module &&
 411                                                 k->opcode == m->opcode) {
 412                                                 prev_show_chk(cmd, &prev_module,
 413                                                         &prev_opcode, &show_or);
 414                                                 if (cmd->len & F_NOT)
 415                                                         printf(" not");
 416
 417                                                 fn = m->shower;
 418                                                 (*fn)(cmd, show_or);
 419                                                 return 1;
 420                                         }
 421                                 }
 422                         }
 423                 }
 424         }
 425         return 0;
 426 }
 427
 428 static void
 429 show_rules(struct ipfw_ioc_rule *rule, int pcwidth, int bcwidth)
 430 {
 431         static int twidth = 0;
 432         ipfw_insn *cmd;
 433         int l;
 434
 435         u_int32_t set_disable = rule->set_disable;
 436
 437         if (set_disable & (1 << rule->set)) { /* disabled */
 438                 if (!show_sets)
 439                         return;
 440                 else
 441                         printf("# DISABLED ");
 442         }
 443         printf("%05u ", rule->rulenum);
 444
 445         if (do_acct)
 446                 printf("%*ju %*ju ", pcwidth, (uintmax_t)rule->pcnt, bcwidth,
 447                         (uintmax_t)rule->bcnt);
 448
 449         if (do_time == 1) {
 450                 char timestr[30];
 451
 452                 if (twidth == 0) {
 453                         strcpy(timestr, ctime((time_t *)&twidth));
 454                         *strchr(timestr, '\n') = '\0';
 455                         twidth = strlen(timestr);
 456                 }
 457                 if (rule->timestamp) {
 458                         time_t t = _long_to_time(rule->timestamp);
 459
 460                         strcpy(timestr, ctime(&t));
 461                         *strchr(timestr, '\n') = '\0';
 462                         printf("%s ", timestr);
 463                 } else {
 464                         printf("%*s ", twidth, " ");
 465                 }
 466         } else if (do_time == 2) {
 467                 printf( "%10u ", rule->timestamp);
 468         }
 469
 470         if (show_sets)
 471                 printf("set %d ", rule->set);
 472
 473
 474         struct ipfw_keyword *k;
 475         struct ipfw_mapping *m;
 476         shower_func fn, comment_fn = NULL;
 477         ipfw_insn *comment_cmd;
 478         int i, j, changed;
 479
 480         /*
 481          * show others and actions
 482          */
 483         for (l = rule->cmd_len - rule->act_ofs, cmd = ACTION_PTR(rule);
 484                 l > 0; l -= F_LEN(cmd),
 485                 cmd = (ipfw_insn *)((uint32_t *)cmd + F_LEN(cmd))) {
 486                 k = keywords;
 487                 m = mappings;
 488                 for (i = 1; i< KEYWORD_SIZE; i++, k++) {
 489                         if ( k->module == cmd->module && k->opcode == cmd->opcode ) {
 490                                 for (j = 1; j< MAPPING_SIZE; j++, m++) {
 491                                         if (m->type == IN_USE &&
 492                                                 m->module == cmd->module &&
 493                                                 m->opcode == cmd->opcode) {
 494                                                 if (cmd->module == MODULE_BASIC_ID &&
 495                                                         cmd->opcode == O_BASIC_COMMENT) {
 496                                                         comment_fn = m->shower;
 497                                                         comment_cmd = cmd;
 498                                                 } else {
 499                                                         fn = m->shower;
 500                                                         (*fn)(cmd, 0);
 501                                                 }
 502                                                 if (cmd->module == MODULE_BASIC_ID &&
 503                                                         cmd->opcode ==
 504                                                                 O_BASIC_CHECK_STATE) {
 505                                                         goto done;
 506                                                 }
 507                                                 break;
 508                                         }
 509                                 }
 510                                 break;
 511                         }
 512                 }
 513         }
 514
 515         /*
 516          * show proto
 517          */
 518         changed=0;
 519         for (l = rule->act_ofs, cmd = rule->cmd; l > 0; l -= F_LEN(cmd),
 520                         cmd = (ipfw_insn *)((uint32_t *)cmd + F_LEN(cmd))) {
 521                 changed = show_filter(cmd, "proto", PROTO);
 522         }
 523         if (!changed && !do_quiet)
 524                 printf(" ip");
 525
 526         /*
 527          * show from
 528          */
 529         changed = 0;
 530         for (l = rule->act_ofs, cmd = rule->cmd; l > 0; l -= F_LEN(cmd),
 531                         cmd = (ipfw_insn *)((uint32_t *)cmd + F_LEN(cmd))) {
 532                 changed = show_filter(cmd, "from", FROM);
 533         }
 534         if (!changed && !do_quiet)
 535                 printf(" from any");
 536
 537         /*
 538          * show to
 539          */
 540         changed = 0;
 541         for (l = rule->act_ofs, cmd = rule->cmd; l > 0; l -= F_LEN(cmd),
 542                         cmd = (ipfw_insn *)((uint32_t *)cmd + F_LEN(cmd))) {
 543                 changed = show_filter(cmd, "to", TO);
 544         }
 545         if (!changed && !do_quiet)
 546                 printf(" to any");
 547
 548         /*
 549          * show other filters
 550          */
 551         for (l = rule->act_ofs, cmd = rule->cmd, m = mappings;
 552                         l > 0; l -= F_LEN(cmd),
 553                         cmd=(ipfw_insn *)((uint32_t *)cmd + F_LEN(cmd))) {
 554                 show_filter(cmd, "other", FILTER);
 555         }
 556
 557         /* show the comment in the end */
 558         if (comment_fn != NULL) {
 559                 (*comment_fn)(comment_cmd, 0);
 560         }
 561 done:
 562         printf("\n");
 563 }
 564
 565 static void
 566 show_states(struct ipfw_ioc_state *d, int pcwidth, int bcwidth)
 567 {
 568         struct protoent *pe;
 569         struct in_addr a;
 570
 571         printf("%05u ", d->rulenum);
 572         if (do_acct) {
 573                 printf("%*ju %*ju ", pcwidth, (uintmax_t)d->pcnt,
 574                                 bcwidth, (uintmax_t)d->bcnt);
 575         }
 576
 577         if (do_time == 1) {
 578                 /* state->timestamp */
 579                 char timestr[30];
 580                 time_t t = _long_to_time(d->timestamp);
 581                 strcpy(timestr, ctime(&t));
 582                 *strchr(timestr, '\n') = '\0';
 583                 printf(" (%s", timestr);
 584
 585                 /* state->lifetime */
 586                 printf(" %ds", d->lifetime);
 587
 588                 /* state->expiry */
 589                 if (d->expiry !=0) {
 590                         t = _long_to_time(d->expiry);
 591                         strcpy(timestr, ctime(&t));
 592                         *strchr(timestr, '\n') = '\0';
 593                         printf(" %s)", timestr);
 594                 } else {
 595                         printf(" 0)");
 596                 }
 597
 598         } else if (do_time == 2) {
 599                 printf("(%u %ds %u) ", d->timestamp, d->lifetime, d->expiry);
 600         }
 601
 602         if ((pe = getprotobynumber(d->flow_id.proto)) != NULL)
 603                 printf(" %s", pe->p_name);
 604         else
 605                 printf(" proto %u", d->flow_id.proto);
 606
 607         a.s_addr = htonl(d->flow_id.src_ip);
 608         printf(" %s %d", inet_ntoa(a), d->flow_id.src_port);
 609
 610         a.s_addr = htonl(d->flow_id.dst_ip);
 611         printf(" <-> %s %d", inet_ntoa(a), d->flow_id.dst_port);
 612         printf(" CPU %d", d->cpuid);
 613         printf("\n");
 614 }
 615
 616 int
 617 sort_q(const void *pa, const void *pb)
 618 {
 619         int rev = (do_sort < 0);
 620         int field = rev ? -do_sort : do_sort;
 621         long long res = 0;
 622         const struct dn_ioc_flowqueue *a = pa;
 623         const struct dn_ioc_flowqueue *b = pb;
 624
 625         switch(field) {
 626         case 1: /* pkts */
 627                 res = a->len - b->len;
 628                 break;
 629         case 2: /* bytes */
 630                 res = a->len_bytes - b->len_bytes;
 631                 break;
 632
 633         case 3: /* tot pkts */
 634                 res = a->tot_pkts - b->tot_pkts;
 635                 break;
 636
 637         case 4: /* tot bytes */
 638                 res = a->tot_bytes - b->tot_bytes;
 639                 break;
 640         }
 641         if (res < 0)
 642                 res = -1;
 643         if (res > 0)
 644                 res = 1;
 645         return (int)(rev ? res : -res);
 646 }
 647
 648 static void
 649 show_queues(struct dn_ioc_flowset *fs, struct dn_ioc_flowqueue *q)
 650 {
 651         int l;
 652
 653         printf("mask: 0x%02x 0x%08x/0x%04x -> 0x%08x/0x%04x\n",
 654                 fs->flow_mask.u.ip.proto,
 655                 fs->flow_mask.u.ip.src_ip, fs->flow_mask.u.ip.src_port,
 656                 fs->flow_mask.u.ip.dst_ip, fs->flow_mask.u.ip.dst_port);
 657         if (fs->rq_elements == 0)
 658                 return;
 659
 660         printf("BKT Prot ___Source IP/port____ "
 661                 "____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp\n");
 662         if (do_sort != 0)
 663                 heapsort(q, fs->rq_elements, sizeof(*q), sort_q);
 664         for (l = 0; l < fs->rq_elements; l++) {
 665                 struct in_addr ina;
 666                 struct protoent *pe;
 667
 668                 ina.s_addr = htonl(q[l].id.u.ip.src_ip);
 669                 printf("%3d ", q[l].hash_slot);
 670                 pe = getprotobynumber(q[l].id.u.ip.proto);
 671                 if (pe)
 672                         printf("%-4s ", pe->p_name);
 673                 else
 674                         printf("%4u ", q[l].id.u.ip.proto);
 675                 printf("%15s/%-5d ",
 676                         inet_ntoa(ina), q[l].id.u.ip.src_port);
 677                 ina.s_addr = htonl(q[l].id.u.ip.dst_ip);
 678                 printf("%15s/%-5d ",
 679                         inet_ntoa(ina), q[l].id.u.ip.dst_port);
 680                 printf("%4ju %8ju %2u %4u %3u\n",
 681                         (uintmax_t)q[l].tot_pkts, (uintmax_t)q[l].tot_bytes,
 682                         q[l].len, q[l].len_bytes, q[l].drops);
 683                 if (verbose)
 684                         printf(" S %20ju F %20ju\n",
 685                                 (uintmax_t)q[l].S, (uintmax_t)q[l].F);
 686         }
 687 }
 688
 689 static void
 690 show_flowset_parms(struct dn_ioc_flowset *fs, char *prefix)
 691 {
 692         char qs[30];
 693         char plr[30];
 694         char red[90];   /* Display RED parameters */
 695         int l;
 696
 697         l = fs->qsize;
 698         if (fs->flags_fs & DN_QSIZE_IS_BYTES) {
 699                 if (l >= 8192)
 700                         sprintf(qs, "%d KB", l / 1024);
 701                 else
 702                         sprintf(qs, "%d B", l);
 703         } else
 704                 sprintf(qs, "%3d sl.", l);
 705         if (fs->plr)
 706                 sprintf(plr, "plr %f", 1.0 * fs->plr / (double)(0x7fffffff));
 707         else
 708                 plr[0] = '\0';
 709         if (fs->flags_fs & DN_IS_RED)   /* RED parameters */
 710                 sprintf(red,
 711                         "\n\t %cRED w_q %f min_th %d max_th %d max_p %f",
 712                         (fs->flags_fs & DN_IS_GENTLE_RED) ? 'G' : ' ',
 713                         1.0 * fs->w_q / (double)(1 << SCALE_RED),
 714                         SCALE_VAL(fs->min_th),
 715                         SCALE_VAL(fs->max_th),
 716                         1.0 * fs->max_p / (double)(1 << SCALE_RED));
 717         else
 718                 sprintf(red, "droptail");
 719
 720         printf("%s %s%s %d queues (%d buckets) %s\n",
 721                 prefix, qs, plr, fs->rq_elements, fs->rq_size, red);
 722 }
 723
 724 static void
 725 show_pipes(void *data, int nbytes, int ac, char *av[])
 726 {
 727         u_long rulenum;
 728         void *next = data;
 729         struct dn_ioc_pipe *p = (struct dn_ioc_pipe *)data;
 730         struct dn_ioc_flowset *fs;
 731         struct dn_ioc_flowqueue *q;
 732         int l;
 733
 734         if (ac > 0)
 735                 rulenum = strtoul(*av++, NULL, 10);
 736         else
 737                 rulenum = 0;
 738         for (; nbytes >= sizeof(*p); p = (struct dn_ioc_pipe *)next) {
 739                 double b = p->bandwidth;
 740                 char buf[30];
 741                 char prefix[80];
 742
 743                 if (p->fs.fs_type != DN_IS_PIPE)
 744                         break;  /* done with pipes, now queues */
 745
 746                 /*
 747                  * compute length, as pipe have variable size
 748                  */
 749                 l = sizeof(*p) + p->fs.rq_elements * sizeof(*q);
 750                 next = (void *)p + l;
 751                 nbytes -= l;
 752
 753                 if (rulenum != 0 && rulenum != p->pipe_nr)
 754                         continue;
 755
 756                 /*
 757                  * Print rate
 758                  */
 759                 if (b == 0)
 760                         sprintf(buf, "unlimited");
 761                 else if (b >= 1000000)
 762                         sprintf(buf, "%7.3f Mbit/s", b/1000000);
 763                 else if (b >= 1000)
 764                         sprintf(buf, "%7.3f Kbit/s", b/1000);
 765                 else
 766                         sprintf(buf, "%7.3f bit/s ", b);
 767
 768                 sprintf(prefix, "%05d: %s %4d ms ",
 769                         p->pipe_nr, buf, p->delay);
 770                 show_flowset_parms(&p->fs, prefix);
 771                 if (verbose)
 772                         printf(" V %20ju\n", (uintmax_t)p->V >> MY_M);
 773
 774                 q = (struct dn_ioc_flowqueue *)(p+1);
 775                 show_queues(&p->fs, q);
 776         }
 777
 778         for (fs = next; nbytes >= sizeof(*fs); fs = next) {
 779                 char prefix[80];
 780
 781                 if (fs->fs_type != DN_IS_QUEUE)
 782                         break;
 783                 l = sizeof(*fs) + fs->rq_elements * sizeof(*q);
 784                 next = (void *)fs + l;
 785                 nbytes -= l;
 786                 q = (struct dn_ioc_flowqueue *)(fs+1);
 787                 sprintf(prefix, "q%05d: weight %d pipe %d ",
 788                         fs->fs_nr, fs->weight, fs->parent_nr);
 789                 show_flowset_parms(fs, prefix);
 790                 show_queues(fs, q);
 791         }
 792 }
 793
 794 /*
 795  * This one handles all set-related commands
 796  *      ipfw set { show | enable | disable }
 797  *      ipfw set swap X Y
 798  *      ipfw set move X to Y
 799  *      ipfw set move rule X to Y
 800  */
 801 static void
 802 sets_handler(int ac, char *av[])
 803 {
 804         u_int32_t set_disable, masks[2];
 805         u_int16_t rulenum;
 806         u_int8_t cmd, new_set;
 807         int i, nbytes;
 808
 809         NEXT_ARG;
 810         if (!ac)
 811                 errx(EX_USAGE, "set needs command");
 812         if (!strncmp(*av, "show", strlen(*av)) ) {
 813                 void *data = NULL;
 814                 char *msg;
 815                 int nalloc=1000;
 816                 nbytes = nalloc;
 817
 818                 while (nbytes >= nalloc) {
 819                         nalloc = nalloc * 2+321;
 820                         nbytes = nalloc;
 821                         if (data == NULL) {
 822                                 if ((data = malloc(nbytes)) == NULL) {
 823                                         err(EX_OSERR, "malloc");
 824                                 }
 825                         } else if ((data = realloc(data, nbytes)) == NULL) {
 826                                 err(EX_OSERR, "realloc");
 827                         }
 828                         if (do_get_x(IP_FW_GET, data, &nbytes) < 0) {
 829                                 err(EX_OSERR, "getsockopt(IP_FW_GET)");
 830                         }
 831                 }
 832                 set_disable = ((struct ipfw_ioc_rule *)data)->set_disable;
 833                 for (i = 0, msg = "disable" ; i < 31; i++)
 834                         if ( (set_disable & (1<<i))) {
 835                                 printf("%s %d", msg, i);
 836                                 msg = "";
 837                         }
 838                 msg = (set_disable) ? " enable" : "enable";
 839                 for (i = 0; i < 31; i++)
 840                         if ( !(set_disable & (1<<i))) {
 841                                 printf("%s %d", msg, i);
 842                                 msg = "";
 843                         }
 844                 printf("\n");
 845         } else if (!strncmp(*av, "swap", strlen(*av))) {
 846                 NEXT_ARG;
 847                 if (ac != 2)
 848                         errx(EX_USAGE, "set swap needs 2 set numbers\n");
 849                 rulenum = atoi(av[0]);
 850                 new_set = atoi(av[1]);
 851                 if (!isdigit(*(av[0])) || rulenum > 30)
 852                         errx(EX_DATAERR, "invalid set number %s\n", av[0]);
 853                 if (!isdigit(*(av[1])) || new_set > 30)
 854                         errx(EX_DATAERR, "invalid set number %s\n", av[1]);
 855                 masks[0] = (4 << 24) | (new_set << 16) | (rulenum);
 856                 i = do_set_x(IP_FW_DEL, masks, sizeof(u_int32_t));
 857         } else if (!strncmp(*av, "move", strlen(*av))) {
 858                 NEXT_ARG;
 859                 if (ac && !strncmp(*av, "rule", strlen(*av))) {
 860                         cmd = 2;
 861                         NEXT_ARG;
 862                 } else
 863                         cmd = 3;
 864                 if (ac != 3 || strncmp(av[1], "to", strlen(*av)))
 865                         errx(EX_USAGE, "syntax: set move [rule] X to Y\n");
 866                 rulenum = atoi(av[0]);
 867                 new_set = atoi(av[2]);
 868                 if (!isdigit(*(av[0])) || (cmd == 3 && rulenum > 30) ||
 869                                 (cmd == 2 && rulenum == 65535) )
 870                         errx(EX_DATAERR, "invalid source number %s\n", av[0]);
 871                 if (!isdigit(*(av[2])) || new_set > 30)
 872                         errx(EX_DATAERR, "invalid dest. set %s\n", av[1]);
 873                 masks[0] = (cmd << 24) | (new_set << 16) | (rulenum);
 874                 i = do_set_x(IP_FW_DEL, masks, sizeof(u_int32_t));
 875         } else if (!strncmp(*av, "disable", strlen(*av)) ||
 876                         !strncmp(*av, "enable", strlen(*av)) ) {
 877                 int which = !strncmp(*av, "enable", strlen(*av)) ? 1 : 0;
 878
 879                 NEXT_ARG;
 880                 masks[0] = masks[1] = 0;
 881
 882                 while (ac) {
 883                         if (isdigit(**av)) {
 884                                 i = atoi(*av);
 885                                 if (i < 0 || i > 30)
 886                                         errx(EX_DATAERR, "invalid set number %d\n", i);
 887                                 masks[which] |= (1<<i);
 888                         } else if (!strncmp(*av, "disable", strlen(*av)))
 889                                 which = 0;
 890                         else if (!strncmp(*av, "enable", strlen(*av)))
 891                                 which = 1;
 892                         else
 893                                 errx(EX_DATAERR, "invalid set command %s\n", *av);
 894                         NEXT_ARG;
 895                 }
 896                 if ( (masks[0] & masks[1]) != 0 )
 897                         errx(EX_DATAERR, "cannot enable and disable the same set\n");
 898                 i = do_set_x(IP_FW_DEL, masks, sizeof(masks));
 899                 if (i)
 900                         warn("set enable/disable: setsockopt(IP_FW_DEL)");
 901         } else
 902                 errx(EX_USAGE, "invalid set command %s\n", *av);
 903 }
 904
 905 static void
 906 add_state(int ac, char *av[])
 907 {
 908         struct ipfw_ioc_state ioc_state;
 909         ioc_state.expiry = 0;
 910         ioc_state.lifetime = 0;
 911         NEXT_ARG;
 912         if (strcmp(*av, "rulenum") == 0) {
 913                 NEXT_ARG;
 914                 ioc_state.rulenum = atoi(*av);
 915         } else {
 916                 errx(EX_USAGE, "ipfw state add rule");
 917         }
 918         NEXT_ARG;
 919         struct protoent *pe;
 920         pe = getprotobyname(*av);
 921         ioc_state.flow_id.proto = pe->p_proto;
 922
 923         NEXT_ARG;
 924         ioc_state.flow_id.src_ip = inet_addr(*av);
 925
 926         NEXT_ARG;
 927         ioc_state.flow_id.src_port = atoi(*av);
 928
 929         NEXT_ARG;
 930         ioc_state.flow_id.dst_ip = inet_addr(*av);
 931
 932         NEXT_ARG;
 933         ioc_state.flow_id.dst_port = atoi(*av);
 934
 935         NEXT_ARG;
 936         if (strcmp(*av, "live") == 0) {
 937                 NEXT_ARG;
 938                 ioc_state.lifetime = atoi(*av);
 939                 NEXT_ARG;
 940         }
 941
 942         if (strcmp(*av, "expiry") == 0) {
 943                 NEXT_ARG;
 944                 ioc_state.expiry = strtoul(*av, NULL, 10);
 945                 printf("ioc_state.expiry=%d\n", ioc_state.expiry);
 946         }
 947
 948         if (do_set_x(IP_FW_STATE_ADD, &ioc_state, sizeof(struct ipfw_ioc_state)) < 0 ) {
 949                 err(EX_UNAVAILABLE, "do_set_x(IP_FW_STATE_ADD)");
 950         }
 951         if (!do_quiet) {
 952                 printf("Flushed all states.\n");
 953         }
 954 }
 955
 956 static void
 957 delete_state(int ac, char *av[])
 958 {
 959         int rulenum;
 960         NEXT_ARG;
 961         if (ac == 1 && isdigit(**av))
 962                 rulenum = atoi(*av);
 963         if (do_set_x(IP_FW_STATE_DEL, &rulenum, sizeof(int)) < 0 )
 964                 err(EX_UNAVAILABLE, "do_set_x(IP_FW_STATE_DEL)");
 965         if (!do_quiet)
 966                 printf("Flushed all states.\n");
 967 }
 968
 969 static void
 970 flush_state(int ac, char *av[])
 971 {
 972         if (!do_force) {
 973                 int c;
 974
 975                 printf("Are you sure? [yn] ");
 976                 fflush(stdout);
 977                 do {
 978                         c = toupper(getc(stdin));
 979                         while (c != '\n' && getc(stdin) != '\n')
 980                                 if (feof(stdin))
 981                                         return; /* and do not flush */
 982                 } while (c != 'Y' && c != 'N');
 983                 if (c == 'N')   /* user said no */
 984                         return;
 985         }
 986         if (do_set_x(IP_FW_STATE_FLUSH, NULL, 0) < 0 )
 987                 err(EX_UNAVAILABLE, "do_set_x(IP_FW_STATE_FLUSH)");
 988         if (!do_quiet)
 989                 printf("Flushed all states.\n");
 990 }
 991
 992 static int
 993 lookup_host (char *host, struct in_addr *ipaddr)
 994 {
 995         struct hostent *he;
 996
 997         if (!inet_aton(host, ipaddr)) {
 998                 if ((he = gethostbyname(host)) == NULL)
 999                         return(-1);
1000                 *ipaddr = *(struct in_addr *)he->h_addr_list[0];
1001         }
1002         return(0);
1003 }
1004
1005 static void
1006 table_append(int ac, char *av[])
1007 {
1008         struct ipfw_ioc_table tbl;
1009         char *p;
1010         int size;
1011
1012         NEXT_ARG;
1013         if (isdigit(**av))
1014                 tbl.id = atoi(*av);
1015         else
1016                 errx(EX_USAGE, "table id `%s' invalid", *av);
1017
1018         if (tbl.id < 0 || tbl.id > IPFW_TABLES_MAX - 1)
1019                 errx(EX_USAGE, "table id `%d' invalid", tbl.id);
1020
1021         NEXT_ARG;
1022         if (strcmp(*av, "ip") == 0)
1023                 tbl.type = 1;
1024         else if (strcmp(*av, "mac") == 0)
1025                 tbl.type = 2;
1026         else
1027                 errx(EX_USAGE, "table type `%s' not supported", *av);
1028
1029         NEXT_ARG;
1030         if (tbl.type == 1) { /* table type ipv4 */
1031                 struct ipfw_ioc_table_ip_entry ip_ent;
1032                 if (!ac)
1033                         errx(EX_USAGE, "IP address required");
1034
1035                 p = strchr(*av, '/');
1036                 if (p) {
1037                         *p++ = '\0';
1038                         ip_ent.masklen = atoi(p);
1039                         if (ip_ent.masklen > 32)
1040                                 errx(EX_DATAERR, "bad width ``%s''", p);
1041                 } else {
1042                         ip_ent.masklen = 32;
1043                 }
1044
1045                 if (lookup_host(*av, (struct in_addr *)&ip_ent.addr) != 0)
1046                         errx(EX_NOHOST, "hostname ``%s'' unknown", *av);
1047
1048                 tbl.ip_ent[0] = ip_ent;
1049                 size = sizeof(tbl) + sizeof(ip_ent);
1050         } else if (tbl.type == 2) { /* table type mac */
1051                 struct ipfw_ioc_table_mac_entry mac_ent;
1052                 if (!ac)
1053                         errx(EX_USAGE, "MAC address required");
1054
1055                 mac_ent.addr = *ether_aton(*av);
1056                 tbl.mac_ent[0] = mac_ent;
1057                 size = sizeof(tbl) + sizeof(mac_ent);
1058         }
1059         if (do_set_x(IP_FW_TABLE_APPEND, &tbl, size) < 0 )
1060                 errx(EX_USAGE, "do_set_x(IP_FW_TABLE_APPEND) "
1061                         "table `%d' append `%s' failed", tbl.id, *av);
1062 }
1063
1064 static void
1065 table_remove(int ac, char *av[])
1066 {
1067         struct ipfw_ioc_table tbl;
1068         struct ipfw_ioc_table_ip_entry ip_ent;
1069         char *p;
1070         int size;
1071
1072         NEXT_ARG;
1073         if (isdigit(**av))
1074                 tbl.id = atoi(*av);
1075         else
1076                 errx(EX_USAGE, "table id `%s' invalid", *av);
1077
1078         if (tbl.id < 0 || tbl.id > IPFW_TABLES_MAX - 1)
1079                 errx(EX_USAGE, "table id `%d' invalid", tbl.id);
1080
1081         NEXT_ARG;
1082         if (strcmp(*av, "ip") == 0)
1083                 tbl.type = 1;
1084         else if (strcmp(*av, "mac") == 0)
1085                 tbl.type = 2;
1086         else
1087                 errx(EX_USAGE, "table type `%s' not supported", *av);
1088
1089         NEXT_ARG;
1090         if (!ac)
1091                 errx(EX_USAGE, "IP address required");
1092         p = strchr(*av, '/');
1093         if (p) {
1094                 *p++ = '\0';
1095                 ip_ent.masklen = atoi(p);
1096                 if (ip_ent.masklen > 32)
1097                         errx(EX_DATAERR, "bad width ``%s''", p);
1098         } else {
1099                 ip_ent.masklen = 32;
1100         }
1101
1102         if (lookup_host(*av, (struct in_addr *)&ip_ent.addr) != 0)
1103                 errx(EX_NOHOST, "hostname ``%s'' unknown", *av);
1104
1105         tbl.ip_ent[0] = ip_ent;
1106         size = sizeof(tbl) + sizeof(ip_ent);
1107         if (do_set_x(IP_FW_TABLE_REMOVE, &tbl, size) < 0 ) {
1108                 errx(EX_USAGE, "do_set_x(IP_FW_TABLE_REMOVE) "
1109                         "table `%d' append `%s' failed", tbl.id, *av);
1110         }
1111 }
1112
1113 static void
1114 table_flush(int ac, char *av[])
1115 {
1116         struct ipfw_ioc_table ioc_table;
1117         struct ipfw_ioc_table *t = &ioc_table;
1118
1119         NEXT_ARG;
1120         if (isdigit(**av)) {
1121                 t->id = atoi(*av);
1122                 if (t->id < 0 || t->id > IPFW_TABLES_MAX - 1)
1123                         errx(EX_USAGE, "table id `%d' invalid", t->id);
1124         } else {
1125                 errx(EX_USAGE, "table id `%s' invalid", *av);
1126         }
1127         if (do_set_x(IP_FW_TABLE_FLUSH, t, sizeof(struct ipfw_ioc_table)) < 0 )
1128                 errx(EX_USAGE, "do_set_x(IP_FW_TABLE_FLUSH) "
1129                                         "table `%s' flush failed", *av);
1130 }
1131
1132 static void
1133 table_list(int ac, char *av[])
1134 {
1135         struct ipfw_ioc_table *ioc_table;
1136         int i, count, nbytes, nalloc = 1024;
1137         void *data = NULL;
1138         NEXT_ARG;
1139         if (strcmp(*av, "list") == 0) {
1140                 nbytes = nalloc;
1141                 while (nbytes >= nalloc) {
1142                         nalloc = nalloc * 2 ;
1143                         nbytes = nalloc;
1144                         if ((data = realloc(data, nbytes)) == NULL)
1145                                 err(EX_OSERR, "realloc");
1146                         if (do_get_x(IP_FW_TABLE_LIST, data, &nbytes) < 0)
1147                                 err(EX_OSERR, "do_get_x(IP_FW_TABLE_LIST)");
1148                 }
1149                 ioc_table = (struct ipfw_ioc_table *)data;
1150                 count = nbytes / sizeof(struct ipfw_ioc_table);
1151                 for (i = 0; i < count; i++, ioc_table++) {
1152                         if (ioc_table->type > 0) {
1153                                 printf("table %d",ioc_table->id);
1154                                 if (ioc_table->type == 1)
1155                                         printf(" type ip");
1156                                 else if (ioc_table->type == 2)
1157                                         printf(" type mac");
1158                                 printf(" count %d",ioc_table->count);
1159                                 if (strlen(ioc_table->name) > 0)
1160                                         printf(" name %s",ioc_table->name);
1161                                 printf("\n");
1162
1163                         }
1164                 }
1165         } else {
1166                 errx(EX_USAGE, "ipfw3 table `%s' delete invalid", *av);
1167         }
1168 }
1169
1170 void
1171 print_table(struct ipfw_ioc_table * tbl)
1172 {
1173         int i;
1174         if (tbl->type == 0)
1175                 errx(EX_USAGE, "table %d is not in use", tbl->id);
1176
1177         printf("table %d", tbl->id);
1178         if (tbl->type == 1)
1179                 printf(" type ip");
1180         else if (tbl->type == 2)
1181                 printf(" type mac");
1182
1183         printf(" count %d", tbl->count);
1184         if (strlen(tbl->name) > 0)
1185                 printf(" name %s", tbl->name);
1186
1187         printf("\n");
1188
1189         if (tbl->type == 1) {
1190                 struct ipfw_ioc_table_ip_entry *ip_ent;
1191                 ip_ent = tbl->ip_ent;
1192                 for (i = 0; i < tbl->count; i++) {
1193                         printf("%s", inet_ntoa(*(struct in_addr *)&ip_ent->addr));
1194                         printf("/%d ", ip_ent->masklen);
1195                         printf("\n");
1196                         ip_ent++;
1197                 }
1198         } else if (tbl->type == 2) {
1199                 struct ipfw_ioc_table_mac_entry *mac_ent;
1200                 mac_ent = tbl->mac_ent;
1201                 for (i = 0; i < tbl->count; i++) {
1202                         printf("%s", ether_ntoa(&mac_ent->addr));
1203                         printf("\n");
1204                         mac_ent++;
1205                 }
1206         }
1207 }
1208
1209 static void
1210 table_show(int ac, char *av[])
1211 {
1212         int nbytes, nalloc = 1024;
1213         void *data = NULL;
1214         NEXT_ARG;
1215         if (isdigit(**av)) {
1216                 nbytes = nalloc;
1217                 while (nbytes >= nalloc) {
1218                         nalloc = nalloc * 2 + 256;
1219                         nbytes = nalloc;
1220                         if (data == NULL) {
1221                                 if ((data = malloc(nbytes)) == NULL) {
1222                                         err(EX_OSERR, "malloc");
1223                                 }
1224                         } else if ((data = realloc(data, nbytes)) == NULL) {
1225                                 err(EX_OSERR, "realloc");
1226                         }
1227                         /* store table id in the header of data */
1228                         int *head = (int *)data;
1229                         *head = atoi(*av);
1230                         if (*head < 0 || *head > IPFW_TABLES_MAX - 1)
1231                                 errx(EX_USAGE, "table id `%d' invalid", *head);
1232                         if (do_get_x(IP_FW_TABLE_SHOW, data, &nbytes) < 0)
1233                                 err(EX_OSERR, "do_get_x(IP_FW_TABLE_LIST)");
1234                         struct ipfw_ioc_table *tbl;
1235                         tbl = (struct ipfw_ioc_table *)data;
1236                         print_table(tbl);
1237                 }
1238         } else {
1239                 errx(EX_USAGE, "ipfw3 table `%s' show invalid", *av);
1240         }
1241 }
1242
1243 static void
1244 table_create(int ac, char *av[])
1245 {
1246         struct ipfw_ioc_table ioc_table;
1247         struct ipfw_ioc_table *t = &ioc_table;
1248
1249         NEXT_ARG;
1250         if (ac < 2)
1251                 errx(EX_USAGE, "table parameters invalid");
1252         if (isdigit(**av)) {
1253                 t->id = atoi(*av);
1254                 if (t->id < 0 || t->id > IPFW_TABLES_MAX - 1)
1255                         errx(EX_USAGE, "table id `%d' invalid", t->id);
1256         } else {
1257                 errx(EX_USAGE, "table id `%s' invalid", *av);
1258         }
1259         NEXT_ARG;
1260         if (strcmp(*av, "ip") == 0)
1261                 t->type = 1;
1262         else if (strcmp(*av, "mac") == 0)
1263                 t->type = 2;
1264         else
1265                 errx(EX_USAGE, "table type `%s' not supported", *av);
1266
1267         NEXT_ARG;
1268         memset(t->name, 0, IPFW_TABLE_NAME_LEN);
1269         if (ac == 2 && strcmp(*av, "name") == 0) {
1270                 NEXT_ARG;
1271                 if (strlen(*av) < IPFW_TABLE_NAME_LEN) {
1272                         strncpy(t->name, *av, strlen(*av));
1273                 } else {
1274                         errx(EX_USAGE, "table name `%s' too long", *av);
1275                 }
1276         } else if (ac == 1) {
1277                 errx(EX_USAGE, "table `%s' invalid", *av);
1278         }
1279
1280         if (do_set_x(IP_FW_TABLE_CREATE, t, sizeof(struct ipfw_ioc_table)) < 0)
1281                 errx(EX_USAGE, "do_set_x(IP_FW_TABLE_CREATE) "
1282                                         "table `%d' in use", t->id);
1283 }
1284
1285 static void
1286 table_delete(int ac, char *av[])
1287 {
1288         struct ipfw_ioc_table ioc_table;
1289         struct ipfw_ioc_table *t = &ioc_table;
1290
1291         NEXT_ARG;
1292         if (isdigit(**av)) {
1293                 t->id = atoi(*av);
1294                 if (t->id < 0 || t->id > IPFW_TABLES_MAX - 1)
1295                         errx(EX_USAGE, "table id `%d' invalid", t->id);
1296         } else {
1297                 errx(EX_USAGE, "table id `%s' invalid", *av);
1298         }
1299         if (t->id < 0 || t->id > IPFW_TABLES_MAX - 1)
1300                 errx(EX_USAGE, "table id `%d' invalid", t->id);
1301
1302         if (do_set_x(IP_FW_TABLE_DELETE, t, sizeof(struct ipfw_ioc_table)) < 0)
1303                 errx(EX_USAGE, "do_set_x(IP_FW_TABLE_DELETE) "
1304                                         "table `%s' delete failed", *av);
1305 }
1306
1307 static void
1308 table_test(int ac, char *av[])
1309 {
1310         struct ipfw_ioc_table tbl;
1311         int size;
1312
1313         NEXT_ARG;
1314         if (isdigit(**av))
1315                 tbl.id = atoi(*av);
1316         else
1317                 errx(EX_USAGE, "table id `%s' invalid", *av);
1318
1319         if (tbl.id < 0 || tbl.id > IPFW_TABLES_MAX - 1)
1320                 errx(EX_USAGE, "table id `%d' invalid", tbl.id);
1321
1322         NEXT_ARG;
1323         if (strcmp(*av, "ip") == 0)
1324                 tbl.type = 1;
1325         else if (strcmp(*av, "mac") == 0)
1326                 tbl.type = 2;
1327         else
1328                 errx(EX_USAGE, "table type `%s' not supported", *av);
1329
1330         NEXT_ARG;
1331         if (tbl.type == 1) { /* table type ipv4 */
1332                 struct ipfw_ioc_table_ip_entry ip_ent;
1333                 if (lookup_host(*av, (struct in_addr *)&ip_ent.addr) != 0)
1334                         errx(EX_NOHOST, "hostname ``%s'' unknown", *av);
1335
1336                 tbl.ip_ent[0] = ip_ent;
1337                 size = sizeof(tbl) + sizeof(ip_ent);
1338         } else if (tbl.type == 2) { /* table type mac */
1339                 struct ipfw_ioc_table_mac_entry mac_ent;
1340                 if (!ac)
1341                         errx(EX_USAGE, "MAC address required");
1342
1343                 mac_ent.addr = *ether_aton(*av);
1344                 tbl.mac_ent[0] = mac_ent;
1345                 size = sizeof(tbl) + sizeof(mac_ent);
1346         }
1347         if (do_set_x(IP_FW_TABLE_TEST, &tbl, size) < 0 ) {
1348                 printf("NO, %s not exists in table %d\n", *av, tbl.id);
1349         } else {
1350                 printf("YES, %s exists in table %d\n", *av, tbl.id);
1351         }
1352 }
1353
1354 static void
1355 table_rename(int ac, char *av[])
1356 {
1357         struct ipfw_ioc_table tbl;
1358         int size;
1359
1360         bzero(&tbl, sizeof(tbl));
1361         NEXT_ARG;
1362         if (isdigit(**av))
1363                 tbl.id = atoi(*av);
1364         else
1365                 errx(EX_USAGE, "table id `%s' invalid", *av);
1366
1367         if (tbl.id < 0 || tbl.id > IPFW_TABLES_MAX - 1)
1368                 errx(EX_USAGE, "table id `%d' invalid", tbl.id);
1369
1370         NEXT_ARG;
1371         strlcpy(tbl.name, *av, IPFW_TABLE_NAME_LEN);
1372         size = sizeof(tbl);
1373         if (do_set_x(IP_FW_TABLE_RENAME, &tbl, size) < 0 )
1374                 errx(EX_USAGE, "do_set_x(IP_FW_TABLE_RENAME) "
1375                                         "table `%d' not in use", tbl.id);
1376 }
1377
1378 static void
1379 list(int ac, char *av[])
1380 {
1381         struct ipfw_ioc_state *dynrules, *d;
1382         struct ipfw_ioc_rule *r;
1383
1384         u_long rnum;
1385         void *data = NULL;
1386         int bcwidth, n, nbytes, nstat, ndyn, pcwidth, width;
1387         int exitval = EX_OK, lac;
1388         char **lav, *endptr;
1389         int seen = 0;
1390         int nalloc = 1024;
1391
1392         NEXT_ARG;
1393
1394         /* get rules or pipes from kernel, resizing array as necessary */
1395         nbytes = nalloc;
1396
1397         while (nbytes >= nalloc) {
1398                 nalloc = nalloc * 2 ;
1399                 nbytes = nalloc;
1400                 if ((data = realloc(data, nbytes)) == NULL)
1401                         err(EX_OSERR, "realloc");
1402                 if (do_get_x(IP_FW_GET, data, &nbytes) < 0)
1403                         err(EX_OSERR, "do_get_x(IP_FW_GET)");
1404         }
1405
1406         /*
1407          * Count static rules.
1408          */
1409         r = data;
1410         nstat = r->static_count;
1411
1412         /*
1413          * Count dynamic rules. This is easier as they have
1414          * fixed size.
1415          */
1416         dynrules = (struct ipfw_ioc_state *)((void *)r + r->static_len);
1417         ndyn = (nbytes - r->static_len) / sizeof(*dynrules);
1418
1419         /* if showing stats, figure out column widths ahead of time */
1420         bcwidth = pcwidth = 0;
1421         if (do_acct) {
1422                 for (n = 0, r = data; n < nstat;
1423                         n++, r = (void *)r + IOC_RULESIZE(r)) {
1424                         /* packet counter */
1425                         width = snprintf(NULL, 0, "%ju", (uintmax_t)r->pcnt);
1426                         if (width > pcwidth)
1427                                 pcwidth = width;
1428
1429                         /* byte counter */
1430                         width = snprintf(NULL, 0, "%ju", (uintmax_t)r->bcnt);
1431                         if (width > bcwidth)
1432                                 bcwidth = width;
1433                 }
1434         }
1435         if (do_dynamic && ndyn) {
1436                 for (n = 0, d = dynrules; n < ndyn; n++, d++) {
1437                         width = snprintf(NULL, 0, "%ju", (uintmax_t)d->pcnt);
1438                         if (width > pcwidth)
1439                                 pcwidth = width;
1440
1441                         width = snprintf(NULL, 0, "%ju", (uintmax_t)d->bcnt);
1442                         if (width > bcwidth)
1443                                 bcwidth = width;
1444                 }
1445         }
1446
1447         /* if no rule numbers were specified, list all rules */
1448         if (ac == 0) {
1449                 if (do_dynamic != 2) {
1450                         for (n = 0, r = data; n < nstat; n++,
1451                                 r = (void *)r + IOC_RULESIZE(r)) {
1452                                 show_rules(r, pcwidth, bcwidth);
1453                         }
1454                 }
1455                 if (do_dynamic && ndyn) {
1456                         if (do_dynamic != 2) {
1457                                 printf("## States (%d):\n", ndyn);
1458                         }
1459                         for (n = 0, d = dynrules; n < ndyn; n++, d++)
1460                                 show_states(d, pcwidth, bcwidth);
1461                 }
1462                 goto done;
1463         }
1464
1465         /* display specific rules requested on command line */
1466
1467         if (do_dynamic != 2) {
1468                 for (lac = ac, lav = av; lac != 0; lac--) {
1469                         /* convert command line rule # */
1470                         rnum = strtoul(*lav++, &endptr, 10);
1471                         if (*endptr) {
1472                                 exitval = EX_USAGE;
1473                                 warnx("invalid rule number: %s", *(lav - 1));
1474                                 continue;
1475                         }
1476                         for (n = seen = 0, r = data; n < nstat;
1477                                 n++, r = (void *)r + IOC_RULESIZE(r) ) {
1478                                 if (r->rulenum > rnum)
1479                                         break;
1480                                 if (r->rulenum == rnum) {
1481                                         show_rules(r, pcwidth, bcwidth);
1482                                         seen = 1;
1483                                 }
1484                         }
1485                         if (!seen) {
1486                                 /* give precedence to other error(s) */
1487                                 if (exitval == EX_OK)
1488                                         exitval = EX_UNAVAILABLE;
1489                                 warnx("rule %lu does not exist", rnum);
1490                         }
1491                 }
1492         }
1493
1494         if (do_dynamic && ndyn) {
1495                 if (do_dynamic != 2) {
1496                         printf("## States (%d):\n", ndyn);
1497                 }
1498                 for (lac = ac, lav = av; lac != 0; lac--) {
1499                         rnum = strtoul(*lav++, &endptr, 10);
1500                         if (*endptr)
1501                                 /* already warned */
1502                                 continue;
1503                         for (n = 0, d = dynrules; n < ndyn; n++, d++) {
1504                                 if (d->rulenum > rnum)
1505                                         break;
1506                                 if (d->rulenum == rnum)
1507                                         show_states(d, pcwidth, bcwidth);
1508                         }
1509                 }
1510         }
1511
1512         ac = 0;
1513
1514 done:
1515         free(data);
1516
1517         if (exitval != EX_OK)
1518                 exit(exitval);
1519 }
1520
1521 static void
1522 show_dummynet(int ac, char *av[])
1523 {
1524         void *data = NULL;
1525         int nbytes;
1526         int nalloc = 1024;      /* start somewhere... */
1527
1528         NEXT_ARG;
1529
1530         nbytes = nalloc;
1531         while (nbytes >= nalloc) {
1532                 nalloc = nalloc * 2 + 200;
1533                 nbytes = nalloc;
1534                 if ((data = realloc(data, nbytes)) == NULL)
1535                         err(EX_OSERR, "realloc");
1536                 if (do_get_x(IP_DUMMYNET_GET, data, &nbytes) < 0) {
1537                         err(EX_OSERR, "do_get_x(IP_%s_GET)",
1538                                 do_pipe ? "DUMMYNET" : "FW");
1539                 }
1540         }
1541
1542         show_pipes(data, nbytes, ac, av);
1543         free(data);
1544 }
1545
1546 static void
1547 help(void)
1548 {
1549         fprintf(stderr, "usage: ipfw [options]\n"
1550                         "       ipfw add [rulenum] [set id] action filters\n"
1551                         "       ipfw delete [rulenum]\n"
1552                         "       ipfw flush\n"
1553                         "       ipfw list [rulenum]\n"
1554                         "       ipfw show [rulenum]\n"
1555                         "       ipfw zero [rulenum]\n"
1556                         "       ipfw set [show|enable|disable]\n"
1557                         "       ipfw module\n"
1558                         "       ipfw [enable|disable]\n"
1559                         "       ipfw log [reset|off|on]\n"
1560                         "       ipfw nat [config|show|delete]\n"
1561                         "       ipfw pipe [config|show|delete]\n"
1562                         "       ipfw state [add|delete|list|show]"
1563                         "\nsee ipfw manpage for details\n");
1564         exit(EX_USAGE);
1565 }
1566
1567
1568 static void
1569 delete_rules(int ac, char *av[])
1570 {
1571         struct dn_ioc_pipe pipe;
1572         u_int32_t rulenum;
1573         int exitval = EX_OK;
1574         int do_set = 0;
1575         int i;
1576
1577         memset(&pipe, 0, sizeof pipe);
1578
1579         NEXT_ARG;
1580         if (ac > 0 && !strncmp(*av, "set", strlen(*av))) {
1581                 do_set = 1;     /* delete set */
1582                 NEXT_ARG;
1583         }
1584
1585         /* Rule number */
1586         while (ac && isdigit(**av)) {
1587                 i = atoi(*av);
1588                 NEXT_ARG;
1589                 if (do_pipe) {
1590                         if (do_pipe == 1)
1591                                 pipe.pipe_nr = i;
1592                         else
1593                                 pipe.fs.fs_nr = i;
1594
1595                         i = do_set_x(IP_DUMMYNET_DEL, &pipe, sizeof pipe);
1596                         if (i) {
1597                                 exitval = 1;
1598                                 warn("rule %u: setsockopt(IP_DUMMYNET_DEL)",
1599                                         do_pipe == 1 ? pipe.pipe_nr :
1600                                         pipe.fs.fs_nr);
1601                         }
1602                 } else {
1603                         rulenum = (i & 0xffff) | (do_set << 24);
1604                         i = do_set_x(IP_FW_DEL, &rulenum, sizeof rulenum);
1605                         if (i) {
1606                                 exitval = EX_UNAVAILABLE;
1607                                 warn("rule %u: setsockopt(IP_FW_DEL)",
1608                                         rulenum);
1609                         }
1610                 }
1611         }
1612         if (exitval != EX_OK)
1613                 exit(exitval);
1614 }
1615
1616
1617 static unsigned long
1618 getbw(const char *str, u_short *flags, int kb)
1619 {
1620         unsigned long val;
1621         int inbytes = 0;
1622         char *end;
1623
1624         val = strtoul(str, &end, 0);
1625         if (*end == 'k' || *end == 'K') {
1626                 ++end;
1627                 val *= kb;
1628         } else if (*end == 'm' || *end == 'M') {
1629                 ++end;
1630                 val *= kb * kb;
1631         }
1632
1633         /*
1634          * Deal with bits or bytes or b(bits) or B(bytes). If there is no
1635          * trailer assume bits.
1636          */
1637         if (strncasecmp(end, "bit", 3) == 0) {
1638                 ;
1639         } else if (strncasecmp(end, "byte", 4) == 0) {
1640                 inbytes = 1;
1641         } else if (*end == 'b') {
1642                 ;
1643         } else if (*end == 'B') {
1644                 inbytes = 1;
1645         }
1646
1647         /*
1648          * Return in bits if flags is NULL, else flag bits
1649          * or bytes in flags and return the unconverted value.
1650          */
1651         if (inbytes && flags)
1652                 *flags |= DN_QSIZE_IS_BYTES;
1653         else if (inbytes && flags == NULL)
1654                 val *= 8;
1655
1656         return(val);
1657 }
1658
1659 /*
1660  * config dummynet pipe/queue
1661  */
1662 static void
1663 config_dummynet(int ac, char **av)
1664 {
1665         struct dn_ioc_pipe pipe;
1666         u_int32_t a;
1667         void *par = NULL;
1668         int i;
1669         char *end;
1670
1671         NEXT_ARG;
1672         memset(&pipe, 0, sizeof pipe);
1673         /* Pipe number */
1674         if (ac && isdigit(**av)) {
1675                 i = atoi(*av);
1676                 NEXT_ARG;
1677                 if (do_pipe == 1)
1678                         pipe.pipe_nr = i;
1679                 else
1680                         pipe.fs.fs_nr = i;
1681         }
1682
1683         while (ac > 0) {
1684                 double d;
1685
1686                 int tok = match_token(dummynet_params, *av);
1687                 NEXT_ARG;
1688
1689                 switch(tok) {
1690                 case TOK_NOERROR:
1691                         pipe.fs.flags_fs |= DN_NOERROR;
1692                         break;
1693
1694                 case TOK_PLR:
1695                         NEED1("plr needs argument 0..1\n");
1696                         d = strtod(av[0], NULL);
1697                         if (d > 1)
1698                                 d = 1;
1699                         else if (d < 0)
1700                                 d = 0;
1701                         pipe.fs.plr = (int)(d*0x7fffffff);
1702                         NEXT_ARG;
1703                         break;
1704
1705                 case TOK_QUEUE:
1706                         NEED1("queue needs queue size\n");
1707                         end = NULL;
1708                         pipe.fs.qsize = getbw(av[0], &pipe.fs.flags_fs, 1024);
1709                         NEXT_ARG;
1710                         break;
1711
1712                 case TOK_BUCKETS:
1713                         NEED1("buckets needs argument\n");
1714                         pipe.fs.rq_size = strtoul(av[0], NULL, 0);
1715                         NEXT_ARG;
1716                         break;
1717
1718                 case TOK_MASK:
1719                         NEED1("mask needs mask specifier\n");
1720                         /*
1721                          * per-flow queue, mask is dst_ip, dst_port,
1722                          * src_ip, src_port, proto measured in bits
1723                          */
1724                         par = NULL;
1725
1726                         pipe.fs.flow_mask.type = ETHERTYPE_IP;
1727                         pipe.fs.flow_mask.u.ip.dst_ip = 0;
1728                         pipe.fs.flow_mask.u.ip.src_ip = 0;
1729                         pipe.fs.flow_mask.u.ip.dst_port = 0;
1730                         pipe.fs.flow_mask.u.ip.src_port = 0;
1731                         pipe.fs.flow_mask.u.ip.proto = 0;
1732                         end = NULL;
1733
1734                         while (ac >= 1) {
1735                                 u_int32_t *p32 = NULL;
1736                                 u_int16_t *p16 = NULL;
1737
1738                                 tok = match_token(dummynet_params, *av);
1739                                 NEXT_ARG;
1740                                 switch(tok) {
1741                                 case TOK_ALL:
1742                                         /*
1743                                          * special case, all bits significant
1744                                          */
1745                                         pipe.fs.flow_mask.u.ip.dst_ip = ~0;
1746                                         pipe.fs.flow_mask.u.ip.src_ip = ~0;
1747                                         pipe.fs.flow_mask.u.ip.dst_port = ~0;
1748                                         pipe.fs.flow_mask.u.ip.src_port = ~0;
1749                                         pipe.fs.flow_mask.u.ip.proto = ~0;
1750                                         pipe.fs.flags_fs |= DN_HAVE_FLOW_MASK;
1751                                         goto end_mask;
1752
1753                                 case TOK_DSTIP:
1754                                         p32 = &pipe.fs.flow_mask.u.ip.dst_ip;
1755                                         break;
1756
1757                                 case TOK_SRCIP:
1758                                         p32 = &pipe.fs.flow_mask.u.ip.src_ip;
1759                                         break;
1760
1761                                 case TOK_DSTPORT:
1762                                         p16 = &pipe.fs.flow_mask.u.ip.dst_port;
1763                                         break;
1764
1765                                 case TOK_SRCPORT:
1766                                         p16 = &pipe.fs.flow_mask.u.ip.src_port;
1767                                         break;
1768
1769                                 case TOK_PROTO:
1770                                         break;
1771
1772                                 default:
1773                                         NEXT_ARG;
1774                                         goto end_mask;
1775                                 }
1776                                 if (ac < 1)
1777                                         errx(EX_USAGE, "mask: value missing");
1778                                 if (*av[0] == '/') {
1779                                         a = strtoul(av[0]+1, &end, 0);
1780                                         a = (a == 32) ? ~0 : (1 << a) - 1;
1781                                 } else
1782                                         a = strtoul(av[0], &end, 0);
1783                                 if (p32 != NULL)
1784                                         *p32 = a;
1785                                 else if (p16 != NULL) {
1786                                         if (a > 65535)
1787                                                 errx(EX_DATAERR,
1788                                                 "mask: must be 16 bit");
1789                                         *p16 = (u_int16_t)a;
1790                                 } else {
1791                                         if (a > 255)
1792                                                 errx(EX_DATAERR,
1793                                                 "mask: must be 8 bit");
1794                                         pipe.fs.flow_mask.u.ip.proto =
1795                                                 (uint8_t)a;
1796                                 }
1797                                 if (a != 0)
1798                                         pipe.fs.flags_fs |= DN_HAVE_FLOW_MASK;
1799                                 NEXT_ARG;
1800                         } /* end while, config masks */
1801
1802 end_mask:
1803                         break;
1804
1805                 case TOK_RED:
1806                 case TOK_GRED:
1807                         NEED1("red/gred needs w_q/min_th/max_th/max_p\n");
1808                         pipe.fs.flags_fs |= DN_IS_RED;
1809                         if (tok == TOK_GRED)
1810                                 pipe.fs.flags_fs |= DN_IS_GENTLE_RED;
1811                         /*
1812                          * the format for parameters is w_q/min_th/max_th/max_p
1813                          */
1814                         if ((end = strsep(&av[0], "/"))) {
1815                                 double w_q = strtod(end, NULL);
1816                                 if (w_q > 1 || w_q <= 0)
1817                                         errx(EX_DATAERR, "0 < w_q <= 1");
1818                                 pipe.fs.w_q = (int) (w_q * (1 << SCALE_RED));
1819                         }
1820                         if ((end = strsep(&av[0], "/"))) {
1821                                 pipe.fs.min_th = strtoul(end, &end, 0);
1822                                 if (*end == 'K' || *end == 'k')
1823                                         pipe.fs.min_th *= 1024;
1824                         }
1825                         if ((end = strsep(&av[0], "/"))) {
1826                                 pipe.fs.max_th = strtoul(end, &end, 0);
1827                                 if (*end == 'K' || *end == 'k')
1828                                         pipe.fs.max_th *= 1024;
1829                         }
1830                         if ((end = strsep(&av[0], "/"))) {
1831                                 double max_p = strtod(end, NULL);
1832                                 if (max_p > 1 || max_p <= 0)
1833                                         errx(EX_DATAERR, "0 < max_p <= 1");
1834                                 pipe.fs.max_p = (int)(max_p * (1 << SCALE_RED));
1835                         }
1836                         NEXT_ARG;
1837                         break;
1838
1839                 case TOK_DROPTAIL:
1840                         pipe.fs.flags_fs &= ~(DN_IS_RED|DN_IS_GENTLE_RED);
1841                         break;
1842
1843                 case TOK_BW:
1844                         NEED1("bw needs bandwidth\n");
1845                         if (do_pipe != 1)
1846                                 errx(EX_DATAERR,
1847                                         "bandwidth only valid for pipes");
1848                         /*
1849                          * set bandwidth value
1850                          */
1851                         pipe.bandwidth = getbw(av[0], NULL, 1000);
1852                         if (pipe.bandwidth < 0)
1853                                 errx(EX_DATAERR, "bandwidth too large");
1854                         NEXT_ARG;
1855                         break;
1856
1857                 case TOK_DELAY:
1858                         if (do_pipe != 1)
1859                                 errx(EX_DATAERR, "delay only valid for pipes");
1860                         NEED1("delay needs argument 0..10000ms\n");
1861                         pipe.delay = strtoul(av[0], NULL, 0);
1862                         NEXT_ARG;
1863                         break;
1864
1865                 case TOK_WEIGHT:
1866                         if (do_pipe == 1)
1867                                 errx(EX_DATAERR,
1868                                         "weight only valid for queues");
1869                         NEED1("weight needs argument 0..100\n");
1870                         pipe.fs.weight = strtoul(av[0], &end, 0);
1871                         NEXT_ARG;
1872                         break;
1873
1874                 case TOK_PIPE:
1875                         if (do_pipe == 1)
1876                                 errx(EX_DATAERR, "pipe only valid for queues");
1877                         NEED1("pipe needs pipe_number\n");
1878                         pipe.fs.parent_nr = strtoul(av[0], &end, 0);
1879                         NEXT_ARG;
1880                         break;
1881
1882                 default:
1883                         errx(EX_DATAERR, "unrecognised option ``%s''", *av);
1884                 }
1885         }
1886         if (do_pipe == 1) {
1887                 if (pipe.pipe_nr == 0)
1888                         errx(EX_DATAERR, "pipe_nr must be > 0");
1889                 if (pipe.delay > 10000)
1890                         errx(EX_DATAERR, "delay must be < 10000");
1891         } else { /* do_pipe == 2, queue */
1892                 if (pipe.fs.parent_nr == 0)
1893                         errx(EX_DATAERR, "pipe must be > 0");
1894                 if (pipe.fs.weight >100)
1895                         errx(EX_DATAERR, "weight must be <= 100");
1896         }
1897         if (pipe.fs.flags_fs & DN_QSIZE_IS_BYTES) {
1898                 if (pipe.fs.qsize > 1024*1024)
1899                         errx(EX_DATAERR, "queue size must be < 1MB");
1900         } else {
1901                 if (pipe.fs.qsize > 100)
1902                         errx(EX_DATAERR, "2 <= queue size <= 100");
1903         }
1904         if (pipe.fs.flags_fs & DN_IS_RED) {
1905                 size_t len;
1906                 int lookup_depth, avg_pkt_size;
1907                 double s, idle, weight, w_q;
1908                 int clock_hz;
1909                 int t;
1910
1911                 if (pipe.fs.min_th >= pipe.fs.max_th)
1912                         errx(EX_DATAERR, "min_th %d must be < than max_th %d",
1913                         pipe.fs.min_th, pipe.fs.max_th);
1914                 if (pipe.fs.max_th == 0)
1915                         errx(EX_DATAERR, "max_th must be > 0");
1916
1917                 len = sizeof(int);
1918                 if (sysctlbyname("net.inet.ip.dummynet.red_lookup_depth",
1919                         &lookup_depth, &len, NULL, 0) == -1)
1920
1921                         errx(1, "sysctlbyname(\"%s\")",
1922                                 "net.inet.ip.dummynet.red_lookup_depth");
1923                 if (lookup_depth == 0)
1924                         errx(EX_DATAERR, "net.inet.ip.dummynet.red_lookup_depth"
1925                                 " must be greater than zero");
1926
1927                 len = sizeof(int);
1928                 if (sysctlbyname("net.inet.ip.dummynet.red_avg_pkt_size",
1929                         &avg_pkt_size, &len, NULL, 0) == -1)
1930
1931                         errx(1, "sysctlbyname(\"%s\")",
1932                                 "net.inet.ip.dummynet.red_avg_pkt_size");
1933                 if (avg_pkt_size == 0)
1934                         errx(EX_DATAERR,
1935                                 "net.inet.ip.dummynet.red_avg_pkt_size must"
1936                                 " be greater than zero");
1937
1938                 len = sizeof(clock_hz);
1939                 if (sysctlbyname("net.inet.ip.dummynet.hz", &clock_hz, &len,
1940                                  NULL, 0) == -1) {
1941                         errx(1, "sysctlbyname(\"%s\")",
1942                                  "net.inet.ip.dummynet.hz");
1943                 }
1944
1945                 /*
1946                  * Ticks needed for sending a medium-sized packet.
1947                  * Unfortunately, when we are configuring a WF2Q+ queue, we
1948                  * do not have bandwidth information, because that is stored
1949                  * in the parent pipe, and also we have multiple queues
1950                  * competing for it. So we set s=0, which is not very
1951                  * correct. But on the other hand, why do we want RED with
1952                  * WF2Q+ ?
1953                  */
1954                 if (pipe.bandwidth == 0) /* this is a WF2Q+ queue */
1955                         s = 0;
1956                 else
1957                         s = clock_hz * avg_pkt_size * 8 / pipe.bandwidth;
1958
1959                 /*
1960                  * max idle time (in ticks) before avg queue size becomes 0.
1961                  * NOTA: (3/w_q) is approx the value x so that
1962                  * (1-w_q)^x < 10^-3.
1963                  */
1964                 w_q = ((double)pipe.fs.w_q) / (1 << SCALE_RED);
1965                 idle = s * 3. / w_q;
1966                 pipe.fs.lookup_step = (int)idle / lookup_depth;
1967                 if (!pipe.fs.lookup_step)
1968                         pipe.fs.lookup_step = 1;
1969                 weight = 1 - w_q;
1970                 for (t = pipe.fs.lookup_step; t > 0; --t)
1971                         weight *= weight;
1972                 pipe.fs.lookup_weight = (int)(weight * (1 << SCALE_RED));
1973         }
1974         i = do_set_x(IP_DUMMYNET_CONFIGURE, &pipe, sizeof pipe);
1975         if (i)
1976                 err(1, "do_set_x(%s)", "IP_DUMMYNET_CONFIGURE");
1977 }
1978
1979 /*
1980  * helper function, updates the pointer to cmd with the length
1981  * of the current command, and also cleans up the first word of
1982  * the new command in case it has been clobbered before.
1983  */
1984 static ipfw_insn*
1985 next_cmd(ipfw_insn *cmd)
1986 {
1987         cmd += F_LEN(cmd);
1988         bzero(cmd, sizeof(*cmd));
1989         return cmd;
1990 }
1991
1992 /*
1993  * Parse arguments and assemble the microinstructions which make up a rule.
1994  * Rules are added into the 'rulebuf' and then copied in the correct order
1995  * into the actual rule.
1996  *
1997  *
1998  */
1999 static void
2000 add(int ac, char *av[])
2001 {
2002         /*
2003          * rules are added into the 'rulebuf' and then copied in
2004          * the correct order into the actual rule.
2005          * Some things that need to go out of order (prob, action etc.)
2006          * go into actbuf[].
2007          */
2008         static uint32_t rulebuf[IPFW_RULE_SIZE_MAX];
2009         static uint32_t actbuf[IPFW_RULE_SIZE_MAX];
2010         static uint32_t othbuf[IPFW_RULE_SIZE_MAX];
2011         static uint32_t cmdbuf[IPFW_RULE_SIZE_MAX];
2012
2013         ipfw_insn *src, *dst, *cmd, *action, *other;
2014         ipfw_insn *prev;
2015         char *prev_av;
2016         ipfw_insn *the_comment = NULL;
2017         struct ipfw_ioc_rule *rule;
2018         struct ipfw_keyword *key;
2019         struct ipfw_mapping *map;
2020         parser_func fn;
2021         int i, j;
2022
2023         bzero(actbuf, sizeof(actbuf));          /* actions go here */
2024         bzero(othbuf, sizeof(actbuf));          /* others */
2025         bzero(cmdbuf, sizeof(cmdbuf));          /* filters */
2026         bzero(rulebuf, sizeof(rulebuf));
2027
2028         rule = (struct ipfw_ioc_rule *)rulebuf;
2029         cmd = (ipfw_insn *)cmdbuf;
2030         action = (ipfw_insn *)actbuf;
2031         other = (ipfw_insn *)othbuf;
2032
2033         NEED2("need more parameters");
2034         NEXT_ARG;
2035
2036         /* [rule N]     -- Rule number optional */
2037         if (ac && isdigit(**av)) {
2038                 rule->rulenum = atoi(*av);
2039                 NEXT_ARG;
2040         }
2041
2042         /* [set N]      -- set number (0..30), optional */
2043         if (ac > 1 && !strncmp(*av, "set", strlen(*av))) {
2044                 int set = strtoul(av[1], NULL, 10);
2045                 if (set < 0 || set > 30)
2046                         errx(EX_DATAERR, "illegal set %s", av[1]);
2047                 rule->set = set;
2048                 av += 2; ac -= 2;
2049         }
2050
2051         /*
2052          * parse before
2053          */
2054         for (;;) {
2055                 for (i = 0, key = keywords; i < KEYWORD_SIZE; i++, key++) {
2056                         if (key->type == BEFORE &&
2057                                 strcmp(key->word, *av) == 0) {
2058                                 for (j = 0, map = mappings;
2059                                         j < MAPPING_SIZE; j++, map++) {
2060                                         if (map->type == IN_USE &&
2061                                                 map->module == key->module &&
2062                                                 map->opcode == key->opcode ) {
2063                                                 fn = map->parser;
2064                                                 (*fn)(&other, &ac, &av);
2065                                                 break;
2066                                         }
2067                                 }
2068                                 break;
2069                         }
2070                 }
2071                 if (i >= KEYWORD_SIZE) {
2072                         break;
2073                 } else if (F_LEN(other) > 0) {
2074                         if (other->module == MODULE_BASIC_ID &&
2075                                 other->opcode == O_BASIC_CHECK_STATE) {
2076                                 other = next_cmd(other);
2077                                 goto done;
2078                         }
2079                         other = next_cmd(other);
2080                 }
2081         }
2082
2083         /*
2084          * parse actions
2085          *
2086          * only accept 1 action
2087          */
2088         NEED1("missing action");
2089         for (i = 0, key = keywords; i < KEYWORD_SIZE; i++, key++) {
2090                 if (ac > 0 && key->type == ACTION &&
2091                         strcmp(key->word, *av) == 0) {
2092                         for (j = 0, map = mappings;
2093                                         j < MAPPING_SIZE; j++, map++) {
2094                                 if (map->type == IN_USE &&
2095                                         map->module == key->module &&
2096                                         map->opcode == key->opcode) {
2097                                         fn = map->parser;
2098                                         (*fn)(&action, &ac, &av);
2099                                         break;
2100                                 }
2101                         }
2102                         break;
2103                 }
2104         }
2105         if (F_LEN(action) > 0)
2106                 action = next_cmd(action);
2107
2108         /*
2109          * parse protocol
2110          */
2111         if (strcmp(*av, "proto") == 0){
2112                 NEXT_ARG;
2113         }
2114
2115         NEED1("missing protocol");
2116         for (i = 0, key = keywords; i < KEYWORD_SIZE; i++, key++) {
2117                 if (key->type == PROTO &&
2118                         strcmp(key->word, "proto") == 0) {
2119                         for (j = 0, map = mappings;
2120                                         j < MAPPING_SIZE; j++, map++) {
2121                                 if (map->type == IN_USE &&
2122                                         map->module == key->module &&
2123                                         map->opcode == key->opcode ) {
2124                                         fn = map->parser;
2125                                         (*fn)(&cmd, &ac, &av);
2126                                         break;
2127                                 }
2128                         }
2129                         break;
2130                 }
2131         }
2132         if (F_LEN(cmd) > 0)
2133                 cmd = next_cmd(cmd);
2134
2135         /*
2136          * other filters
2137          */
2138         while (ac > 0) {
2139                 char *s, *cur;          /* current filter */
2140                 ipfw_insn_u32 *cmd32;   /* alias for cmd */
2141
2142                 s = *av;
2143                 cmd32 = (ipfw_insn_u32 *)cmd;
2144                 if (strcmp(*av, "or") == 0) {
2145                         if (prev == NULL)
2146                                 errx(EX_USAGE, "'or' should"
2147                                                 "between two filters\n");
2148                         prev->len |= F_OR;
2149                         cmd->len = F_OR;
2150                         *av = prev_av;
2151                 }
2152                 if (strcmp(*av, "not") == 0) {
2153                         if (cmd->len & F_NOT)
2154                                 errx(EX_USAGE, "double \"not\" not allowed\n");
2155                         cmd->len = F_NOT;
2156                         NEXT_ARG;
2157                         continue;
2158                 }
2159                 cur = *av;
2160                 for (i = 0, key = keywords; i < KEYWORD_SIZE; i++, key++) {
2161                         if ((key->type == FILTER ||
2162                                 key->type == AFTER ||
2163                                 key->type == FROM ||
2164                                 key->type == TO) &&
2165                                 strcmp(key->word, cur) == 0) {
2166                                 for (j = 0, map = mappings;
2167                                         j< MAPPING_SIZE; j++, map++) {
2168                                         if (map->type == IN_USE &&
2169                                                 map->module == key->module &&
2170                                                 map->opcode == key->opcode ) {
2171                                                 fn = map->parser;
2172                                                 (*fn)(&cmd, &ac, &av);
2173                                                 break;
2174                                         }
2175                                 }
2176                                 break;
2177                         } else if (i == KEYWORD_SIZE - 1) {
2178                                 errx(EX_USAGE, "bad command `%s'", cur);
2179                         }
2180                 }
2181                 if (i >= KEYWORD_SIZE) {
2182                         break;
2183                 } else if (F_LEN(cmd) > 0) {
2184                         prev = cmd;
2185                         prev_av = cur;
2186                         cmd = next_cmd(cmd);
2187                 }
2188         }
2189
2190 done:
2191         if (ac>0)
2192                 errx(EX_USAGE, "bad command `%s'", *av);
2193
2194         /*
2195          * Now copy stuff into the rule.
2196          * [filters][others][action][comment]
2197          */
2198         dst = (ipfw_insn *)rule->cmd;
2199         /*
2200          * copy all filters, except comment
2201          */
2202         src = (ipfw_insn *)cmdbuf;
2203         for (src = (ipfw_insn *)cmdbuf; src != cmd; src += i) {
2204                 /* pick comment out */
2205                 i = F_LEN(src);
2206                 if (src->module == MODULE_BASIC_ID &&
2207                                 src->opcode == O_BASIC_COMMENT) {
2208                         the_comment=src;
2209                 } else {
2210                         bcopy(src, dst, i * sizeof(u_int32_t));
2211                         dst = (ipfw_insn *)((uint32_t *)dst + i);
2212                 }
2213         }
2214
2215         /*
2216          * start action section, it begin with others
2217          */
2218         rule->act_ofs = (uint32_t *)dst - (uint32_t *)(rule->cmd);
2219
2220         /*
2221          * copy all other others
2222          */
2223         for (src = (ipfw_insn *)othbuf; src != other; src += i) {
2224                 i = F_LEN(src);
2225                 bcopy(src, dst, i * sizeof(u_int32_t));
2226                 dst = (ipfw_insn *)((uint32_t *)dst + i);
2227         }
2228
2229         /* copy the action to the end of rule */
2230         src = (ipfw_insn *)actbuf;
2231         i = F_LEN(src);
2232         bcopy(src, dst, i * sizeof(u_int32_t));
2233         dst = (ipfw_insn *)((uint32_t *)dst + i);
2234
2235         /*
2236          * comment place behind the action
2237          */
2238         if (the_comment != NULL) {
2239                 i = F_LEN(the_comment);
2240                 bcopy(the_comment, dst, i * sizeof(u_int32_t));
2241                 dst = (ipfw_insn *)((uint32_t *)dst + i);
2242         }
2243
2244         rule->cmd_len = (u_int32_t *)dst - (u_int32_t *)(rule->cmd);
2245         i = (void *)dst - (void *)rule;
2246         if (do_set_x(IP_FW_ADD, (void *)rule, i) == -1) {
2247                 err(EX_UNAVAILABLE, "getsockopt(%s)", "IP_FW_ADD");
2248         }
2249         if (!do_quiet)
2250                 show_rules(rule, 10, 10);
2251 }
2252
2253 static void
2254 zero(int ac, char *av[])
2255 {
2256         int rulenum;
2257         int failed = EX_OK;
2258
2259         NEXT_ARG;
2260
2261         if (!ac) {
2262                 /* clear all entries */
2263                 if (do_set_x(IP_FW_ZERO, NULL, 0) < 0)
2264                         err(EX_UNAVAILABLE, "do_set_x(IP_FW_ZERO)");
2265                 if (!do_quiet)
2266                         printf("Accounting cleared.\n");
2267                 return;
2268         }
2269
2270         while (ac) {
2271                 /* Rule number */
2272                 if (isdigit(**av)) {
2273                         rulenum = atoi(*av);
2274                         NEXT_ARG;
2275                         if (do_set_x(IP_FW_ZERO, &rulenum, sizeof rulenum)) {
2276                                 warn("rule %u: do_set_x(IP_FW_ZERO)", rulenum);
2277                                 failed = EX_UNAVAILABLE;
2278                         } else if (!do_quiet)
2279                                 printf("Entry %d cleared\n", rulenum);
2280                 } else {
2281                         errx(EX_USAGE, "invalid rule number ``%s''", *av);
2282                 }
2283         }
2284         if (failed != EX_OK)
2285                 exit(failed);
2286 }
2287
2288 static void
2289 resetlog(int ac, char *av[])
2290 {
2291         int rulenum;
2292         int failed = EX_OK;
2293
2294         NEXT_ARG;
2295
2296         if (!ac) {
2297                 /* clear all entries */
2298                 if (setsockopt(ipfw_socket, IPPROTO_IP,
2299                                         IP_FW_RESETLOG, NULL, 0) < 0)
2300                         err(EX_UNAVAILABLE, "setsockopt(IP_FW_RESETLOG)");
2301                 if (!do_quiet)
2302                         printf("Logging counts reset.\n");
2303
2304                 return;
2305         }
2306
2307         while (ac) {
2308                 /* Rule number */
2309                 if (isdigit(**av)) {
2310                         rulenum = atoi(*av);
2311                         NEXT_ARG;
2312                         if (setsockopt(ipfw_socket, IPPROTO_IP,
2313                                 IP_FW_RESETLOG, &rulenum, sizeof rulenum)) {
2314                                 warn("rule %u: setsockopt(IP_FW_RESETLOG)",
2315                                                 rulenum);
2316                                 failed = EX_UNAVAILABLE;
2317                         } else if (!do_quiet)
2318                                 printf("Entry %d logging count reset\n",
2319                                                 rulenum);
2320                 } else {
2321                         errx(EX_DATAERR, "invalid rule number ``%s''", *av);
2322                 }
2323         }
2324         if (failed != EX_OK)
2325                 exit(failed);
2326 }
2327
2328 static void
2329 flush(void)
2330 {
2331         int cmd = IP_FW_FLUSH;
2332         if (do_pipe) {
2333                 cmd = IP_DUMMYNET_FLUSH;
2334         }
2335         if (!do_force) {
2336                 int c;
2337
2338                 printf("Are you sure? [yn] ");
2339                 fflush(stdout);
2340                 do {
2341                         c = toupper(getc(stdin));
2342                         while (c != '\n' && getc(stdin) != '\n')
2343                                 if (feof(stdin))
2344                                         return; /* and do not flush */
2345                 } while (c != 'Y' && c != 'N');
2346                 if (c == 'N')   /* user said no */
2347                         return;
2348         }
2349         if (do_set_x(cmd, NULL, 0) < 0 ) {
2350                 if (do_pipe)
2351                         errx(EX_USAGE, "pipe/queue in use");
2352                 else
2353                         errx(EX_USAGE, "do_set_x(IP_FW_FLUSH) failed");
2354         }
2355         if (!do_quiet) {
2356                 printf("Flushed all %s.\n", do_pipe ? "pipes" : "rules");
2357         }
2358 }
2359
2360 /*
2361  * do_set_x - extended version og do_set
2362  * insert a x_header in the beginning of the rule buf
2363  * and call setsockopt() with IP_FW_X.
2364  */
2365 int
2366 do_set_x(int optname, void *rule, int optlen)
2367 {
2368         int len, *newbuf;
2369
2370         ip_fw_x_header *x_header;
2371         if (ipfw_socket < 0)
2372                 err(EX_UNAVAILABLE, "socket not avaialble");
2373         len = optlen + sizeof(ip_fw_x_header);
2374         newbuf = malloc(len);
2375         if (newbuf == NULL)
2376                 err(EX_OSERR, "malloc newbuf in do_set_x");
2377         bzero(newbuf, len);
2378         x_header = (ip_fw_x_header *)newbuf;
2379         x_header->opcode = optname;
2380         /* copy the rule into the newbuf, just after the x_header*/
2381         bcopy(rule, ++x_header, optlen);
2382         return setsockopt(ipfw_socket, IPPROTO_IP, IP_FW_X, newbuf, len);
2383 }
2384
2385 /*
2386  * same as do_set_x
2387  */
2388 int
2389 do_get_x(int optname, void *rule, int *optlen)
2390 {
2391         int len, *newbuf, retval;
2392
2393         ip_fw_x_header *x_header;
2394         if (ipfw_socket < 0)
2395                 err(EX_UNAVAILABLE, "socket not avaialble");
2396         len = *optlen + sizeof(ip_fw_x_header);
2397         newbuf = malloc(len);
2398         if (newbuf == NULL)
2399                 err(EX_OSERR, "malloc newbuf in do_get_x");
2400         bzero(newbuf, len);
2401         x_header = (ip_fw_x_header *)newbuf;
2402         x_header->opcode = optname;
2403         /* copy the rule into the newbuf, just after the x_header*/
2404         bcopy(rule, ++x_header, *optlen);
2405         retval = getsockopt(ipfw_socket, IPPROTO_IP, IP_FW_X, newbuf, &len);
2406         bcopy(newbuf, rule, len);
2407         *optlen=len;
2408         return retval;
2409 }
2410
2411 static int
2412 ipfw_main(int ac, char **av)
2413 {
2414         int ch;
2415
2416         if (ac == 1)
2417                 help();
2418
2419         /* Set the force flag for non-interactive processes */
2420         do_force = !isatty(STDIN_FILENO);
2421
2422         optind = optreset = 1;
2423         while ((ch = getopt(ac, av, "hs:acdDefNStTv")) != -1)
2424                 switch (ch) {
2425                 case 'h': /* help */
2426                         help();
2427                         break;  /* NOTREACHED */
2428
2429                 case 's': /* sort */
2430                         do_sort = atoi(optarg);
2431                         break;
2432                 case 'a':
2433                         do_acct = 1;
2434                         break;
2435                 case 'c':
2436                         do_compact = 1;
2437                         break;
2438                 case 'd':
2439                         do_dynamic = 1;
2440                         break;
2441                 case 'D':
2442                         do_dynamic = 2;
2443                         break;
2444                 case 'e':
2445                         do_expired = 1;
2446                         break;
2447                 case 'f':
2448                         do_force = 1;
2449                         break;
2450                 case 'N':
2451                         do_resolv = 1;
2452                         break;
2453                 case 'S':
2454                         show_sets = 1;
2455                         break;
2456                 case 't':
2457                         do_time = 1;
2458                         break;
2459                 case 'T':
2460                         do_time = 2;
2461                         break;
2462                 case 'v':
2463                         do_quiet = 0;
2464                         verbose++;
2465                         break;
2466                 default:
2467                         help();
2468                 }
2469
2470         ac -= optind;
2471         av += optind;
2472         NEED1("bad arguments, for usage summary ``ipfw''");
2473
2474         /*
2475          * optional: pipe or queue or nat
2476          */
2477         do_nat = 0;
2478         do_pipe = 0;
2479         if (!strncmp(*av, "nat", strlen(*av)))
2480                 do_nat = 1;
2481         else if (!strncmp(*av, "pipe", strlen(*av))) {
2482                 do_pipe = 1;
2483         } else if (!strncmp(*av, "queue", strlen(*av))) {
2484                 do_pipe = 2;
2485         }
2486         NEED1("missing command");
2487
2488         /*
2489          * for pipes and queues and nat we normally say 'pipe NN config'
2490          * but the code is easier to parse as 'pipe config NN'
2491          * so we swap the two arguments.
2492          */
2493         if ((do_pipe || do_nat) && ac > 2 && isdigit(*(av[1]))) {
2494                 char *p = av[1];
2495                 av[1] = av[2];
2496                 av[2] = p;
2497         }
2498
2499         if (!strncmp(*av, "add", strlen(*av))) {
2500                 load_modules();
2501                 add(ac, av);
2502         } else if (!strncmp(*av, "delete", strlen(*av))) {
2503                 delete_rules(ac, av);
2504         } else if (!strncmp(*av, "flush", strlen(*av))) {
2505                 flush();
2506         } else if (!strncmp(*av, "list", strlen(*av))) {
2507                 load_modules();
2508                 list(ac, av);
2509         } else if (!strncmp(*av, "show", strlen(*av))) {
2510                 do_acct++;
2511                 load_modules();
2512                 list(ac, av);
2513         } else if (!strncmp(*av, "zero", strlen(*av))) {
2514                 zero(ac, av);
2515         } else if (!strncmp(*av, "set", strlen(*av))) {
2516                 sets_handler(ac, av);
2517         } else if (!strncmp(*av, "module", strlen(*av))) {
2518                 NEXT_ARG;
2519                 if (!strncmp(*av, "show", strlen(*av)) ||
2520                         !strncmp(*av, "show", strlen(*av))) {
2521                         list_modules(ac, av);
2522                 } else {
2523                         errx(EX_USAGE, "bad ipfw module command `%s'", *av);
2524                 }
2525         } else if (!strncmp(*av, "resetlog", strlen(*av))) {
2526                 resetlog(ac, av);
2527         } else if (!strncmp(*av, "log", strlen(*av))) {
2528                 NEXT_ARG;
2529                 if (!strncmp(*av, "reset", strlen(*av))) {
2530                         resetlog(ac, av);
2531                 } else if (!strncmp(*av, "off", strlen(*av))) {
2532
2533                 } else if (!strncmp(*av, "on", strlen(*av))) {
2534
2535                 } else {
2536                         errx(EX_USAGE, "bad command `%s'", *av);
2537                 }
2538         } else if (!strncmp(*av, "nat", strlen(*av))) {
2539                 NEXT_ARG;
2540                 nat_main(ac, av);
2541         } else if (!strncmp(*av, "pipe", strlen(*av)) ||
2542                 !strncmp(*av, "queue", strlen(*av))) {
2543                 NEXT_ARG;
2544                 if (!strncmp(*av, "config", strlen(*av))) {
2545                         config_dummynet(ac, av);
2546                 } else if (!strncmp(*av, "flush", strlen(*av))) {
2547                         flush();
2548                 } else if (!strncmp(*av, "show", strlen(*av))) {
2549                         show_dummynet(ac, av);
2550                 } else {
2551                         errx(EX_USAGE, "bad ipfw pipe command `%s'", *av);
2552                 }
2553         } else if (!strncmp(*av, "state", strlen(*av))) {
2554                 NEXT_ARG;
2555                 if (!strncmp(*av, "add", strlen(*av))) {
2556                         add_state(ac, av);
2557                 } else if (!strncmp(*av, "delete", strlen(*av))) {
2558                         delete_state(ac, av);
2559                 } else if (!strncmp(*av, "flush", strlen(*av))) {
2560                         flush_state(ac, av);
2561                 } else if (!strncmp(*av, "list", strlen(*av))) {
2562                         do_dynamic = 2;
2563                         list(ac, av);
2564                 } else if (!strncmp(*av, "show", strlen(*av))) {
2565                         do_acct = 1;
2566                         do_dynamic =2;
2567                         list(ac, av);
2568                 } else {
2569                         errx(EX_USAGE, "bad ipfw state command `%s'", *av);
2570                 }
2571         } else if (!strncmp(*av, "table", strlen(*av))) {
2572                 if (ac > 2 && isdigit(*(av[1]))) {
2573                         char *p = av[1];
2574                         av[1] = av[2];
2575                         av[2] = p;
2576                 }
2577                 NEXT_ARG;
2578                 if (!strncmp(*av, "append", strlen(*av))) {
2579                         table_append(ac, av);
2580                 } else if (!strncmp(*av, "remove", strlen(*av))) {
2581                         table_remove(ac, av);
2582                 } else if (!strncmp(*av, "flush", strlen(*av))) {
2583                         table_flush(ac, av);
2584                 } else if (!strncmp(*av, "list", strlen(*av))) {
2585                         table_list(ac, av);
2586                 } else if (!strncmp(*av, "show", strlen(*av))) {
2587                         table_show(ac, av);
2588                 } else if (!strncmp(*av, "type", strlen(*av))) {
2589                         table_create(ac, av);
2590                 } else if (!strncmp(*av, "delete", strlen(*av))) {
2591                         table_delete(ac, av);
2592                 } else if (!strncmp(*av, "test", strlen(*av))) {
2593                         table_test(ac,av);
2594                 } else if (!strncmp(*av, "name", strlen(*av))) {
2595                         table_rename(ac, av);
2596                 } else {
2597                         errx(EX_USAGE, "bad ipfw table command `%s'", *av);
2598                 }
2599         } else if (!strncmp(*av, "sync", strlen(*av))) {
2600                 NEXT_ARG;
2601                 if (!strncmp(*av, "edge", strlen(*av))) {
2602                         sync_config_edge(ac, av);
2603                 } else if (!strncmp(*av, "centre", strlen(*av))) {
2604                         sync_config_centre(ac, av);
2605                 } else if (!strncmp(*av, "show", strlen(*av))) {
2606                         NEXT_ARG;
2607                         if (!strncmp(*av, "config", strlen(*av))) {
2608                                 sync_show_config(ac, av);
2609                         } else if (!strncmp(*av, "status", strlen(*av))) {
2610                                 sync_show_status(ac, av);
2611                         } else {
2612                                 errx(EX_USAGE, "bad show command `%s'", *av);
2613                         }
2614                 } else if (!strncmp(*av, "start", strlen(*av))) {
2615                         NEXT_ARG;
2616                         if (!strncmp(*av, "edge", strlen(*av))) {
2617                                 sync_edge_start(ac, av);
2618                         } else if (!strncmp(*av, "centre", strlen(*av))) {
2619                                 sync_centre_start(ac, av);
2620                         }
2621                 } else if (!strncmp(*av, "stop", strlen(*av))) {
2622                         NEXT_ARG;
2623                         if (!strncmp(*av, "edge", strlen(*av))) {
2624                                 sync_edge_stop(ac, av);
2625                         } else if (!strncmp(*av, "centre", strlen(*av))) {
2626                                 sync_centre_stop(ac, av);
2627                         }
2628                 } else if (!strncmp(*av, "clear", strlen(*av))) {
2629                         NEXT_ARG;
2630                         if (!strncmp(*av, "edge", strlen(*av))) {
2631                                 sync_edge_clear(ac, av);
2632                         } else if (!strncmp(*av, "centre", strlen(*av))) {
2633                                 sync_centre_clear(ac, av);
2634                         }
2635                 } else if (!strncmp(*av, "test", strlen(*av))) {
2636                         NEXT_ARG;
2637                         if (!strncmp(*av, "edge", strlen(*av))) {
2638                                 sync_edge_test(ac, av);
2639                         } else if (!strncmp(*av, "centre", strlen(*av))) {
2640                                 sync_centre_test(ac, av);
2641                         }
2642                 } else {
2643                         errx(EX_USAGE, "bad ipfw sync command `%s'", *av);
2644                 }
2645         } else {
2646                 errx(EX_USAGE, "bad ipfw command `%s'", *av);
2647         }
2648         return 0;
2649 }
2650
2651 static void
2652 ipfw_readfile(int ac, char *av[])
2653 {
2654         char    buf[BUFSIZ];
2655         char    *a, *p, *args[MAX_ARGS], *cmd = NULL;
2656         char    linename[10];
2657         int     i=0, lineno=0, qflag=0, pflag=0, status;
2658         FILE    *f = NULL;
2659         pid_t   preproc = 0;
2660         int     c;
2661
2662         while ((c = getopt(ac, av, "D:U:p:q")) != -1) {
2663                 switch (c) {
2664                 case 'D':
2665                         if (!pflag)
2666                                 errx(EX_USAGE, "-D requires -p");
2667                         if (i > MAX_ARGS - 2)
2668                                 errx(EX_USAGE, "too many -D or -U options");
2669                         args[i++] = "-D";
2670                         args[i++] = optarg;
2671                         break;
2672
2673                 case 'U':
2674                         if (!pflag)
2675                                 errx(EX_USAGE, "-U requires -p");
2676                         if (i > MAX_ARGS - 2)
2677                                 errx(EX_USAGE, "too many -D or -U options");
2678                         args[i++] = "-U";
2679                         args[i++] = optarg;
2680                         break;
2681
2682                 case 'p':
2683                         pflag = 1;
2684                         cmd = optarg;
2685                         args[0] = cmd;
2686                         i = 1;
2687                         break;
2688
2689                 case 'q':
2690                         qflag = 1;
2691                         break;
2692
2693                 default:
2694                         errx(EX_USAGE, "bad arguments, for usage"
2695                             " summary ``ipfw''");
2696                 }
2697         }
2698
2699         av += optind;
2700         ac -= optind;
2701         if (ac != 1)
2702                 errx(EX_USAGE, "extraneous filename arguments");
2703
2704         if ((f = fopen(av[0], "r")) == NULL)
2705                 err(EX_UNAVAILABLE, "fopen: %s", av[0]);
2706
2707         if (pflag) {
2708                 /* pipe through preprocessor (cpp or m4) */
2709                 int pipedes[2];
2710
2711                 args[i] = NULL;
2712
2713                 if (pipe(pipedes) == -1)
2714                         err(EX_OSERR, "cannot create pipe");
2715
2716                 switch ((preproc = fork())) {
2717                 case -1:
2718                         err(EX_OSERR, "cannot fork");
2719
2720                 case 0:
2721                         /* child */
2722                         if (dup2(fileno(f), 0) == -1 ||
2723                             dup2(pipedes[1], 1) == -1) {
2724                                 err(EX_OSERR, "dup2()");
2725                         }
2726                         fclose(f);
2727                         close(pipedes[1]);
2728                         close(pipedes[0]);
2729                         execvp(cmd, args);
2730                         err(EX_OSERR, "execvp(%s) failed", cmd);
2731
2732                 default:
2733                         /* parent */
2734                         fclose(f);
2735                         close(pipedes[1]);
2736                         if ((f = fdopen(pipedes[0], "r")) == NULL) {
2737                                 int savederrno = errno;
2738
2739                                 kill(preproc, SIGTERM);
2740                                 errno = savederrno;
2741                                 err(EX_OSERR, "fdopen()");
2742                         }
2743                 }
2744         }
2745
2746         while (fgets(buf, BUFSIZ, f)) {
2747                 lineno++;
2748                 sprintf(linename, "Line %d", lineno);
2749                 args[0] = linename;
2750
2751                 if (*buf == '#')
2752                         continue;
2753                 if ((p = strchr(buf, '#')) != NULL)
2754                         *p = '\0';
2755                 i = 1;
2756                 if (qflag)
2757                         args[i++] = "-q";
2758                 for (a = strtok(buf, WHITESP); a && i < MAX_ARGS;
2759                         a = strtok(NULL, WHITESP), i++) {
2760                         args[i] = a;
2761                 }
2762
2763                 if (i == (qflag? 2: 1))
2764                         continue;
2765                 if (i == MAX_ARGS)
2766                         errx(EX_USAGE, "%s: too many arguments", linename);
2767
2768                 args[i] = NULL;
2769                 ipfw_main(i, args);
2770         }
2771         fclose(f);
2772         if (pflag) {
2773                 if (waitpid(preproc, &status, 0) == -1)
2774                         errx(EX_OSERR, "waitpid()");
2775                 if (WIFEXITED(status) && WEXITSTATUS(status) != EX_OK)
2776                         errx(EX_UNAVAILABLE, "preprocessor exited with status %d",
2777                                 WEXITSTATUS(status));
2778                 else if (WIFSIGNALED(status))
2779                         errx(EX_UNAVAILABLE, "preprocessor exited with signal %d",
2780                                 WTERMSIG(status));
2781         }
2782 }
2783
2784 int
2785 main(int ac, char *av[])
2786 {
2787         ipfw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
2788         if (ipfw_socket < 0)
2789                 err(EX_UNAVAILABLE, "socket");
2790
2791         memset(keywords, 0, sizeof(struct ipfw_keyword) * KEYWORD_SIZE);
2792         memset(mappings, 0, sizeof(struct ipfw_mapping) * MAPPING_SIZE);
2793
2794         prepare_default_funcs();
2795
2796         if (ac > 1 && av[ac - 1][0] == '/' && access(av[ac - 1], R_OK) == 0)
2797                 ipfw_readfile(ac, av);
2798         else
2799                 ipfw_main(ac, av);
2800         return EX_OK;
2801 }