+static int cmd_drop_session(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ sessionidt s;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "<1-%d>", MAXSESSION-1, "Session id to drop", NULL);
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (!argc)
+ {
+ cli_error(cli, "Specify a session id to drop");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ if ((s = atol(argv[i])) <= 0 || (s > MAXSESSION))
+ {
+ cli_error(cli, "Invalid session ID (1-%d)", MAXSESSION-1);
+ continue;
+ }
+
+ if (session[s].ip && session[s].opened && !session[s].die)
+ {
+ cli_print(cli, "Dropping session %d", s);
+ cli_session_actions[s].action |= CLI_SESS_KILL;
+ }
+ else
+ {
+ cli_error(cli, "Session %d is not active.", s);
+ }
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_snoop(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ in_addr_t ip;
+ uint16_t port;
+ sessionidt s;
+
+ if (CLI_HELP_REQUESTED)
+ {
+ switch (argc)
+ {
+ case 1:
+ return cli_arg_help(cli, 0,
+ "USER", "Username of session to snoop", NULL);
+
+ case 2:
+ return cli_arg_help(cli, 0,
+ "A.B.C.D", "IP address of snoop destination", NULL);
+
+ case 3:
+ return cli_arg_help(cli, 0,
+ "N", "Port of snoop destination", NULL);
+
+ case 4:
+ if (!argv[3][1])
+ return cli_arg_help(cli, 1, NULL);
+
+ default:
+ return CLI_OK;
+ }
+ }
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (argc < 3)
+ {
+ cli_error(cli, "Specify username, ip and port");
+ return CLI_OK;
+ }
+
+ if (!(s = sessionbyuser(argv[0])))
+ {
+ cli_error(cli, "User %s is not connected", argv[0]);
+ return CLI_OK;
+ }
+
+ ip = inet_addr(argv[1]);
+ if (!ip || ip == INADDR_NONE)
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[1]);
+ return CLI_OK;
+ }
+
+ port = atoi(argv[2]);
+ if (!port)
+ {
+ cli_error(cli, "Invalid port %s", argv[2]);
+ return CLI_OK;
+ }
+
+ cli_print(cli, "Snooping user %s to %s:%d", argv[0], fmtaddr(ip, 0), port);
+ cli_session_actions[s].snoop_ip = ip;
+ cli_session_actions[s].snoop_port = port;
+ cli_session_actions[s].action |= CLI_SESS_SNOOP;
+
+ return CLI_OK;
+}
+
+static int cmd_no_snoop(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ sessionidt s;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "USER", "Username of session to unsnoop", NULL);
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (!argc)
+ {
+ cli_error(cli, "Specify a user to unsnoop");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ if (!(s = sessionbyuser(argv[i])))
+ {
+ cli_error(cli, "User %s is not connected", argv[i]);
+ continue;
+ }
+
+ cli_print(cli, "Not snooping user %s", argv[i]);
+ cli_session_actions[s].action |= CLI_SESS_NOSNOOP;
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_throttle(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int rate_in = 0;
+ int rate_out = 0;
+ sessionidt s;
+
+ /*
+ throttle USER - throttle in/out to default rate
+ throttle USER RATE - throttle in/out to default rate
+ throttle USER in RATE - throttle input only
+ throttle USER out RATE - throttle output only
+ throttle USER in RATE out RATE - throttle both
+ */
+
+ if (CLI_HELP_REQUESTED)
+ {
+ switch (argc)
+ {
+ case 1:
+ return cli_arg_help(cli, 0,
+ "USER", "Username of session to throttle", NULL);
+
+ case 2:
+ return cli_arg_help(cli, 1,
+ "RATE", "Rate in kbps (in and out)",
+ "in", "Select incoming rate",
+ "out", "Select outgoing rate", NULL);
+
+ case 4:
+ return cli_arg_help(cli, 1,
+ "in", "Select incoming rate",
+ "out", "Select outgoing rate", NULL);
+
+ case 3:
+ if (isdigit(argv[1][0]))
+ return cli_arg_help(cli, 1, NULL);
+
+ case 5:
+ return cli_arg_help(cli, 0, "RATE", "Rate in kbps", NULL);
+
+ default:
+ return cli_arg_help(cli, argc > 1, NULL);
+ }
+ }
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (argc == 0)
+ {
+ cli_error(cli, "Specify a user to throttle");
+ return CLI_OK;
+ }
+
+ if (!(s = sessionbyuser(argv[0])))
+ {
+ cli_error(cli, "User %s is not connected", argv[0]);
+ return CLI_OK;
+ }
+
+ if (argc == 1)
+ {
+ rate_in = rate_out = config->rl_rate;
+ }
+ else if (argc == 2)
+ {
+ rate_in = rate_out = atoi(argv[1]);
+ if (rate_in < 1)
+ {
+ cli_error(cli, "Invalid rate \"%s\"", argv[1]);
+ return CLI_OK;
+ }
+ }
+ else if (argc == 3 || argc == 5)
+ {
+ int i;
+ for (i = 1; i < argc - 1; i += 2)
+ {
+ int r = 0;
+ if (MATCH("in", argv[i]))
+ r = rate_in = atoi(argv[i+1]);
+ else if (MATCH("out", argv[i]))
+ r = rate_out = atoi(argv[i+1]);
+
+ if (r < 1)
+ {
+ cli_error(cli, "Invalid rate specification \"%s %s\"", argv[i], argv[i+1]);
+ return CLI_OK;
+ }
+ }
+ }
+ else
+ {
+ cli_error(cli, "Invalid arguments");
+ return CLI_OK;
+ }
+
+ if ((rate_in && session[s].throttle_in) || (rate_out && session[s].throttle_out))
+ {
+ cli_error(cli, "User %s already throttled, unthrottle first", argv[0]);
+ return CLI_OK;
+ }
+
+ cli_session_actions[s].throttle_in = cli_session_actions[s].throttle_out = -1;
+ if (rate_in && session[s].throttle_in != rate_in)
+ cli_session_actions[s].throttle_in = rate_in;
+
+ if (rate_out && session[s].throttle_out != rate_out)
+ cli_session_actions[s].throttle_out = rate_out;
+
+ if (cli_session_actions[s].throttle_in == -1 &&
+ cli_session_actions[s].throttle_out == -1)
+ {
+ cli_error(cli, "User %s already throttled at this rate", argv[0]);
+ return CLI_OK;
+ }
+
+ cli_print(cli, "Throttling user %s", argv[0]);
+ cli_session_actions[s].action |= CLI_SESS_THROTTLE;
+
+ return CLI_OK;
+}
+
+static int cmd_no_throttle(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ sessionidt s;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "USER", "Username of session to unthrottle", NULL);
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (!argc)
+ {
+ cli_error(cli, "Specify a user to unthrottle");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ if (!(s = sessionbyuser(argv[i])))
+ {
+ cli_error(cli, "User %s is not connected", argv[i]);
+ continue;
+ }
+
+ if (session[s].throttle_in || session[s].throttle_out)
+ {
+ cli_print(cli, "Unthrottling user %s", argv[i]);
+ cli_session_actions[s].action |= CLI_SESS_NOTHROTTLE;
+ }
+ else
+ {
+ cli_error(cli, "User %s not throttled", argv[i]);
+ }
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_debug(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, 1,
+ "all", "Enable debugging for all except \"data\"",
+ "critical", "", // FIXME: add descriptions
+ "error", "",
+ "warning", "",
+ "info", "",
+ "calls", "",
+ "data", "",
+ NULL);
+
+ if (!argc)
+ {
+ char *p = (char *) &debug_flags;
+ for (i = 0; i < sizeof(debug_flags); i++)
+ {
+ if (p[i])
+ {
+ cli_print(cli, "Currently debugging:%s%s%s%s%s%s",
+ (debug_flags.critical) ? " critical" : "",
+ (debug_flags.error) ? " error" : "",
+ (debug_flags.warning) ? " warning" : "",
+ (debug_flags.info) ? " info" : "",
+ (debug_flags.calls) ? " calls" : "",
+ (debug_flags.data) ? " data" : "");
+
+ return CLI_OK;
+ }
+ }
+
+ cli_print(cli, "Debugging off");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ int len = strlen(argv[i]);
+
+ if (argv[i][0] == 'c' && len < 2)
+ len = 2; /* distinguish [cr]itical from [ca]lls */
+
+ if (!strncmp("critical", argv[i], len)) { debug_flags.critical = 1; continue; }
+ if (!strncmp("error", argv[i], len)) { debug_flags.error = 1; continue; }
+ if (!strncmp("warning", argv[i], len)) { debug_flags.warning = 1; continue; }
+ if (!strncmp("info", argv[i], len)) { debug_flags.info = 1; continue; }
+ if (!strncmp("calls", argv[i], len)) { debug_flags.calls = 1; continue; }
+ if (!strncmp("data", argv[i], len)) { debug_flags.data = 1; continue; }
+ if (!strncmp("all", argv[i], len))
+ {
+ memset(&debug_flags, 1, sizeof(debug_flags));
+ debug_flags.data = 0;
+ continue;
+ }
+
+ cli_error(cli, "Invalid debugging flag \"%s\"", argv[i]);
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_no_debug(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, 1,
+ "all", "Disable all debugging",
+ "critical", "", // FIXME: add descriptions
+ "error", "",
+ "warning", "",
+ "info", "",
+ "calls", "",
+ "data", "",
+ NULL);
+
+ if (!argc)
+ {
+ memset(&debug_flags, 0, sizeof(debug_flags));
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ int len = strlen(argv[i]);
+
+ if (argv[i][0] == 'c' && len < 2)
+ len = 2; /* distinguish [cr]itical from [ca]lls */
+
+ if (!strncmp("critical", argv[i], len)) { debug_flags.critical = 0; continue; }
+ if (!strncmp("error", argv[i], len)) { debug_flags.error = 0; continue; }
+ if (!strncmp("warning", argv[i], len)) { debug_flags.warning = 0; continue; }
+ if (!strncmp("info", argv[i], len)) { debug_flags.info = 0; continue; }
+ if (!strncmp("calls", argv[i], len)) { debug_flags.calls = 0; continue; }
+ if (!strncmp("data", argv[i], len)) { debug_flags.data = 0; continue; }
+ if (!strncmp("all", argv[i], len))
+ {
+ memset(&debug_flags, 0, sizeof(debug_flags));
+ continue;
+ }
+
+ cli_error(cli, "Invalid debugging flag \"%s\"", argv[i]);
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_load_plugin(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i, firstfree = 0;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "PLUGIN", "Name of plugin to load", NULL);
+
+ if (argc != 1)
+ {
+ cli_error(cli, "Specify a plugin to load");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < MAXPLUGINS; i++)
+ {
+ if (!*config->plugins[i] && !firstfree)
+ firstfree = i;
+ if (strcmp(config->plugins[i], argv[0]) == 0)
+ {
+ cli_error(cli, "Plugin is already loaded");
+ return CLI_OK;
+ }
+ }
+
+ if (firstfree)
+ {
+ strncpy(config->plugins[firstfree], argv[0], sizeof(config->plugins[firstfree]) - 1);
+ config->reload_config = 1;
+ cli_print(cli, "Loading plugin %s", argv[0]);
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_remove_plugin(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "PLUGIN", "Name of plugin to unload", NULL);
+
+ if (argc != 1)
+ {
+ cli_error(cli, "Specify a plugin to remove");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < MAXPLUGINS; i++)
+ {
+ if (strcmp(config->plugins[i], argv[0]) == 0)
+ {
+ config->reload_config = 1;
+ memset(config->plugins[i], 0, sizeof(config->plugins[i]));
+ return CLI_OK;
+ }
+ }
+
+ cli_error(cli, "Plugin is not loaded");
+ return CLI_OK;
+}
+
+static char *duration(time_t secs)
+{
+ static char *buf = NULL;
+ int p = 0;
+
+ if (!buf) buf = calloc(64, 1);
+
+ if (secs >= 86400)
+ {
+ int days = secs / 86400;
+ p = sprintf(buf, "%d day%s, ", days, days > 1 ? "s" : "");
+ secs %= 86400;
+ }
+
+ if (secs >= 3600)
+ {
+ int mins = secs / 60;
+ int hrs = mins / 60;
+
+ mins %= 60;
+ sprintf(buf + p, "%d:%02d", hrs, mins);
+ }
+ else if (secs >= 60)
+ {
+ int mins = secs / 60;
+ sprintf(buf + p, "%d min%s", mins, mins > 1 ? "s" : "");
+ }
+ else
+ sprintf(buf, "%ld sec%s", secs, secs > 1 ? "s" : "");
+
+ return buf;
+}
+
+static int cmd_uptime(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ FILE *fh;
+ char buf[100], *p = buf, *loads[3];
+ int i, num_sessions = 0;
+
+ if (CLI_HELP_REQUESTED)
+ return CLI_HELP_NO_ARGS;
+
+ fh = fopen("/proc/loadavg", "r");
+ fgets(buf, 100, fh);
+ fclose(fh);
+
+ for (i = 0; i < 3; i++)
+ loads[i] = strdup(strsep(&p, " "));
+
+ time(&time_now);
+ strftime(buf, 99, "%H:%M:%S", localtime(&time_now));
+
+ for (i = 1; i < MAXSESSION; i++)
+ if (session[i].opened) num_sessions++;
+
+ cli_print(cli, "%s up %s, %d users, load average: %s, %s, %s",
+ buf,
+ duration(time_now - config->start_time),
+ num_sessions,
+ loads[0], loads[1], loads[2]
+ );
+ for (i = 0; i < 3; i++)
+ if (loads[i]) free(loads[i]);
+
+ cli_print(cli, "Bandwidth: %s", config->bandwidth);
+
+ return CLI_OK;
+}
+
+static int cmd_set(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+
+ if (CLI_HELP_REQUESTED)
+ {
+ switch (argc)
+ {
+ case 1:
+ {
+ int len = strlen(argv[0])-1;
+ for (i = 0; config_values[i].key; i++)
+ if (!len || !strncmp(config_values[i].key, argv[0], len))
+ cli_error(cli, " %s", config_values[i].key);
+ }
+
+ return CLI_OK;
+
+ case 2:
+ return cli_arg_help(cli, 0,
+ "VALUE", "Value for variable", NULL);
+
+ case 3:
+ if (!argv[2][1])
+ return cli_arg_help(cli, 1, NULL);
+
+ default:
+ return CLI_OK;
+ }
+ }
+
+ if (argc != 2)
+ {
+ cli_error(cli, "Specify variable and value");
+ return CLI_OK;
+ }
+
+ for (i = 0; config_values[i].key; i++)
+ {
+ void *value = ((void *) config) + config_values[i].offset;
+ if (strcmp(config_values[i].key, argv[0]) == 0)
+ {
+ // Found a value to set
+ cli_print(cli, "Setting \"%s\" to \"%s\"", argv[0], argv[1]);
+ switch (config_values[i].type)
+ {
+ case STRING:
+ snprintf((char *) value, config_values[i].size, "%s", argv[1]);
+ break;
+ case INT:
+ *(int *) value = atoi(argv[1]);
+ break;
+ case UNSIGNED_LONG:
+ *(unsigned long *) value = atol(argv[1]);
+ break;
+ case SHORT:
+ *(short *) value = atoi(argv[1]);
+ break;
+ case IPv4:
+ *(in_addr_t *) value = inet_addr(argv[1]);
+ break;
+ case IPv6:
+ inet_pton(AF_INET6, argv[1], value);
+ break;
+ case BOOL:
+ if (strcasecmp(argv[1], "yes") == 0 || strcasecmp(argv[1], "true") == 0 || strcasecmp(argv[1], "1") == 0)
+ *(int *) value = 1;
+ else
+ *(int *) value = 0;
+ break;
+ default:
+ cli_error(cli, "Unknown variable type");
+ break;
+ }
+ config->reload_config = 1;
+ return CLI_OK;
+ }
+ }
+
+ cli_error(cli, "Unknown variable \"%s\"", argv[0]);
+ return CLI_OK;
+}
+
+int regular_stuff(struct cli_def *cli)
+{
+#ifdef RINGBUFFER
+ int out = 0;
+ int i;
+
+ for (i = debug_rb_tail; i != ringbuffer->tail; i = (i + 1) % RINGBUFFER_SIZE)
+ {
+ char *m = ringbuffer->buffer[i].message;
+ char *p;
+ int show = 0;
+
+ if (!*m) continue;
+
+ switch (ringbuffer->buffer[i].level)
+ {
+ case 0: show = debug_flags.critical; break;
+ case 1: show = debug_flags.error; break;
+ case 2: show = debug_flags.warning; break;
+ case 3: show = debug_flags.info; break;
+ case 4: show = debug_flags.calls; break;
+ case 5: show = debug_flags.data; break;
+ }
+
+ if (!show) continue;
+
+ if (!(p = strchr(m, '\n')))
+ p = m + strlen(m);
+
+ cli_error(cli, "\r%s-%u-%u %.*s",
+ debug_levels[(int)ringbuffer->buffer[i].level],
+ ringbuffer->buffer[i].tunnel,
+ ringbuffer->buffer[i].session,
+ (int) (p - m), m);
+
+ out++;
+ }
+
+ debug_rb_tail = ringbuffer->tail;
+ if (out)
+ cli_reprompt(cli);
+#endif
+ return CLI_OK;
+}
+
+#ifdef BGP
+static int cmd_router_bgp(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int as;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "<1-65535>", "Autonomous system number", NULL);
+
+ if (argc != 1 || (as = atoi(argv[0])) < 1 || as > 65535)
+ {
+ cli_error(cli, "Invalid autonomous system number");
+ return CLI_OK;
+ }
+
+ if (bgp_configured && as != config->as_number)
+ {
+ cli_error(cli, "Can't change local AS on a running system");
+ return CLI_OK;
+ }
+
+ config->as_number = as;
+ cli_set_configmode(cli, MODE_CONFIG_BGP, "router");
+
+ return CLI_OK;
+}
+
+static int find_bgp_neighbour(char const *name)
+{
+ int i;
+ int new = -1;
+ struct hostent *h;
+ in_addr_t addrs[4] = { 0 };
+ char **a;
+
+ if (!(h = gethostbyname(name)) || h->h_addrtype != AF_INET)
+ return -2;
+
+ for (i = 0; i < sizeof(addrs) / sizeof(*addrs) && h->h_addr_list[i]; i++)
+ memcpy(&addrs[i], h->h_addr_list[i], sizeof(*addrs));
+
+ for (i = 0; i < BGP_NUM_PEERS; i++)
+ {
+ if (!config->neighbour[i].name[0])
+ {
+ if (new == -1) new = i;
+ continue;
+ }
+
+ if (!strcmp(name, config->neighbour[i].name))
+ return i;
+
+ if (!(h = gethostbyname(config->neighbour[i].name)) || h->h_addrtype != AF_INET)
+ continue;
+
+ for (a = h->h_addr_list; *a; a++)
+ {
+ int j;
+ for (j = 0; j < sizeof(addrs) / sizeof(*addrs) && addrs[j]; j++)
+ if (!memcmp(&addrs[j], *a, sizeof(*addrs)))
+ return i;
+ }
+ }
+
+ return new;
+}
+
+static int cmd_router_bgp_neighbour(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ int keepalive;
+ int hold;
+
+ if (CLI_HELP_REQUESTED)
+ {
+ switch (argc)
+ {
+ case 1:
+ return cli_arg_help(cli, 0,
+ "A.B.C.D", "BGP neighbour address",
+ "NAME", "BGP neighbour name",
+ NULL);
+
+ case 2:
+ return cli_arg_help(cli, 0,
+ "remote-as", "Set remote autonomous system number",
+ "timers", "Set timers",
+ NULL);
+
+ default:
+ if (MATCH("remote-as", argv[1]))
+ return cli_arg_help(cli, argv[2][1], "<1-65535>", "Autonomous system number", NULL);
+
+ if (MATCH("timers", argv[1]))
+ {
+ if (argc == 3)
+ return cli_arg_help(cli, 0, "<1-65535>", "Keepalive time", NULL);
+
+ if (argc == 4)
+ return cli_arg_help(cli, argv[3][1], "<3-65535>", "Hold time", NULL);
+
+ if (argc == 5 && !argv[4][1])
+ return cli_arg_help(cli, 1, NULL);
+ }
+
+ return CLI_OK;
+ }
+ }
+
+ if (argc < 3)
+ {
+ cli_error(cli, "Invalid arguments");
+ return CLI_OK;
+ }
+
+ if ((i = find_bgp_neighbour(argv[0])) == -2)
+ {
+ cli_error(cli, "Invalid neighbour");
+ return CLI_OK;
+ }
+
+ if (i == -1)
+ {
+ cli_error(cli, "Too many neighbours (max %d)", BGP_NUM_PEERS);
+ return CLI_OK;
+ }
+
+ if (MATCH("remote-as", argv[1]))
+ {
+ int as = atoi(argv[2]);
+ if (as < 0 || as > 65535)
+ {
+ cli_error(cli, "Invalid autonomous system number");
+ return CLI_OK;
+ }
+
+ if (!config->neighbour[i].name[0])
+ {
+ snprintf(config->neighbour[i].name, sizeof(config->neighbour[i].name), "%s", argv[0]);
+ config->neighbour[i].keepalive = -1;
+ config->neighbour[i].hold = -1;
+ }
+
+ config->neighbour[i].as = as;
+ return CLI_OK;
+ }
+
+ if (argc != 4 || !MATCH("timers", argv[1]))
+ {
+ cli_error(cli, "Invalid arguments");
+ return CLI_OK;
+ }
+
+ if (!config->neighbour[i].name[0])
+ {
+ cli_error(cli, "Specify remote-as first");
+ return CLI_OK;
+ }
+
+ keepalive = atoi(argv[2]);
+ hold = atoi(argv[3]);
+
+ if (keepalive < 1 || keepalive > 65535)
+ {
+ cli_error(cli, "Invalid keepalive time");
+ return CLI_OK;
+ }
+
+ if (hold < 3 || hold > 65535)
+ {
+ cli_error(cli, "Invalid hold time");
+ return CLI_OK;
+ }
+
+ if (keepalive == BGP_KEEPALIVE_TIME)
+ keepalive = -1; // using default value
+
+ if (hold == BGP_HOLD_TIME)
+ hold = -1;
+
+ config->neighbour[i].keepalive = keepalive;
+ config->neighbour[i].hold = hold;
+
+ return CLI_OK;
+}
+
+static int cmd_router_bgp_no_neighbour(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 0,
+ "A.B.C.D", "BGP neighbour address",
+ "NAME", "BGP neighbour name",
+ NULL);
+
+ if (argc != 1)
+ {
+ cli_error(cli, "Specify a BGP neighbour");
+ return CLI_OK;
+ }
+
+ if ((i = find_bgp_neighbour(argv[0])) == -2)
+ {
+ cli_error(cli, "Invalid neighbour");
+ return CLI_OK;
+ }
+
+ if (i < 0 || !config->neighbour[i].name[0])
+ {
+ cli_error(cli, "Neighbour %s not configured", argv[0]);
+ return CLI_OK;
+ }
+
+ memset(&config->neighbour[i], 0, sizeof(config->neighbour[i]));
+ return CLI_OK;
+}
+
+static int cmd_show_bgp(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ int hdr = 0;
+ char *addr;
+
+ if (!bgp_configured)
+ return CLI_OK;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, 1,
+ "A.B.C.D", "BGP neighbour address",
+ "NAME", "BGP neighbour name",
+ NULL);
+
+ cli_print(cli, "BGPv%d router identifier %s, local AS number %d",
+ BGP_VERSION, fmtaddr(my_address, 0), (int) config->as_number);
+
+ time(&time_now);
+
+ for (i = 0; i < BGP_NUM_PEERS; i++)
+ {
+ if (!*bgp_peers[i].name)
+ continue;
+
+ addr = fmtaddr(bgp_peers[i].addr, 0);
+ if (argc && strcmp(addr, argv[0]) &&
+ strncmp(bgp_peers[i].name, argv[0], strlen(argv[0])))
+ continue;
+
+ if (!hdr++)
+ {
+ cli_print(cli, "");
+ cli_print(cli, "Peer AS Address "
+ "State Retries Retry in Route Pend Timers");
+ cli_print(cli, "------------------ ----- --------------- "
+ "----------- ------- -------- ----- ---- ---------");
+ }
+
+ cli_print(cli, "%-18.18s %5d %15s %-11s %7d %7lds %5s %4s %4d %4d",
+ bgp_peers[i].name,
+ bgp_peers[i].as,
+ addr,
+ bgp_state_str(bgp_peers[i].state),
+ bgp_peers[i].retry_count,
+ bgp_peers[i].retry_time ? bgp_peers[i].retry_time - time_now : 0,
+ bgp_peers[i].routing ? "yes" : "no",
+ bgp_peers[i].update_routes ? "yes" : "no",
+ bgp_peers[i].keepalive,
+ bgp_peers[i].hold);
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_suspend_bgp(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ char *addr;
+
+ if (!bgp_configured)
+ return CLI_OK;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, 1,
+ "A.B.C.D", "BGP neighbour address",
+ "NAME", "BGP neighbour name",
+ NULL);
+
+ for (i = 0; i < BGP_NUM_PEERS; i++)
+ {
+ if (bgp_peers[i].state != Established)
+ continue;
+
+ if (!bgp_peers[i].routing)
+ continue;
+
+ addr = fmtaddr(bgp_peers[i].addr, 0);
+ if (argc && strcmp(addr, argv[0]) && strcmp(bgp_peers[i].name, argv[0]))
+ continue;
+
+ bgp_peers[i].cli_flag = BGP_CLI_SUSPEND;
+ cli_print(cli, "Suspending peer %s", bgp_peers[i].name);
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_no_suspend_bgp(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ char *addr;
+
+ if (!bgp_configured)
+ return CLI_OK;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, 1,
+ "A.B.C.D", "BGP neighbour address",
+ "NAME", "BGP neighbour name",
+ NULL);
+
+ for (i = 0; i < BGP_NUM_PEERS; i++)
+ {
+ if (bgp_peers[i].state != Established)
+ continue;
+
+ if (bgp_peers[i].routing)
+ continue;
+
+ addr = fmtaddr(bgp_peers[i].addr, 0);
+ if (argc && strcmp(addr, argv[0]) &&
+ strncmp(bgp_peers[i].name, argv[0], strlen(argv[0])))
+ continue;
+
+ bgp_peers[i].cli_flag = BGP_CLI_ENABLE;
+ cli_print(cli, "Un-suspending peer %s", bgp_peers[i].name);
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_restart_bgp(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ char *addr;
+
+ if (!bgp_configured)
+ return CLI_OK;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, 1,
+ "A.B.C.D", "BGP neighbour address",
+ "NAME", "BGP neighbour name",
+ NULL);
+
+ for (i = 0; i < BGP_NUM_PEERS; i++)
+ {
+ if (!*bgp_peers[i].name)
+ continue;
+
+ addr = fmtaddr(bgp_peers[i].addr, 0);
+ if (argc && strcmp(addr, argv[0]) &&
+ strncmp(bgp_peers[i].name, argv[0], strlen(argv[0])))
+ continue;
+
+ bgp_peers[i].cli_flag = BGP_CLI_RESTART;
+ cli_print(cli, "Restarting peer %s", bgp_peers[i].name);
+ }
+
+ return CLI_OK;
+}
+#endif /* BGP*/
+
+static int filt;
+static int access_list(struct cli_def *cli, char **argv, int argc, int add)
+{
+ int extended;
+
+ if (CLI_HELP_REQUESTED)
+ {
+ switch (argc)
+ {
+ case 1:
+ return cli_arg_help(cli, 0,
+ "standard", "Standard syntax",
+ "extended", "Extended syntax",
+ NULL);
+
+ case 2:
+ return cli_arg_help(cli, argv[1][1],
+ "NAME", "Access-list name",
+ NULL);
+
+ default:
+ if (argc == 3 && !argv[2][1])
+ return cli_arg_help(cli, 1, NULL);
+
+ return CLI_OK;
+ }
+ }
+
+ if (argc != 2)
+ {
+ cli_error(cli, "Specify access-list type and name");
+ return CLI_OK;
+ }
+
+ if (MATCH("standard", argv[0]))
+ extended = 0;
+ else if (MATCH("extended", argv[0]))
+ extended = 1;
+ else
+ {
+ cli_error(cli, "Invalid access-list type");
+ return CLI_OK;
+ }
+
+ if (strlen(argv[1]) > sizeof(ip_filters[0].name) - 1 ||
+ strspn(argv[1], "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-") != strlen(argv[1]))
+ {
+ cli_error(cli, "Invalid access-list name");
+ return CLI_OK;
+ }
+
+ filt = find_filter(argv[1], strlen(argv[1]));
+ if (add)
+ {
+ if (filt < 0)
+ {
+ cli_error(cli, "Too many access-lists");
+ return CLI_OK;
+ }
+
+ // racy
+ if (!*ip_filters[filt].name)
+ {
+ memset(&ip_filters[filt], 0, sizeof(ip_filters[filt]));
+ strcpy(ip_filters[filt].name, argv[1]);
+ ip_filters[filt].extended = extended;
+ }
+ else if (ip_filters[filt].extended != extended)
+ {
+ cli_error(cli, "Access-list is %s",
+ ip_filters[filt].extended ? "extended" : "standard");
+
+ return CLI_OK;
+ }
+
+ cli_set_configmode(cli, MODE_CONFIG_NACL, extended ? "ext-nacl" : "std-nacl");
+ return CLI_OK;
+ }
+
+ if (filt < 0 || !*ip_filters[filt].name)
+ {
+ cli_error(cli, "Access-list not defined");
+ return CLI_OK;
+ }
+
+ // racy
+ if (ip_filters[filt].used)
+ {
+ cli_error(cli, "Access-list in use");
+ return CLI_OK;
+ }
+
+ memset(&ip_filters[filt], 0, sizeof(ip_filters[filt]));
+ return CLI_OK;
+}
+
+static int cmd_ip_access_list(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ return access_list(cli, argv, argc, 1);
+}
+
+static int cmd_no_ip_access_list(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ return access_list(cli, argv, argc, 0);
+}
+
+static int show_ip_wild(char *buf, in_addr_t ip, in_addr_t wild)
+{
+ if (ip == INADDR_ANY && wild == INADDR_BROADCAST)
+ return sprintf(buf, " any");
+
+ if (wild == INADDR_ANY)
+ return sprintf(buf, " host %s", fmtaddr(ip, 0));
+
+ return sprintf(buf, " %s %s", fmtaddr(ip, 0), fmtaddr(wild, 1));
+}
+
+static int show_ports(char *buf, ip_filter_portt *ports)
+{
+ switch (ports->op)
+ {
+ case FILTER_PORT_OP_EQ: return sprintf(buf, " eq %u", ports->port);
+ case FILTER_PORT_OP_NEQ: return sprintf(buf, " neq %u", ports->port);
+ case FILTER_PORT_OP_GT: return sprintf(buf, " gt %u", ports->port);
+ case FILTER_PORT_OP_LT: return sprintf(buf, " lt %u", ports->port);
+ case FILTER_PORT_OP_RANGE: return sprintf(buf, " range %u %u", ports->port, ports->port2);
+ }
+
+ return 0;
+}
+
+static char const *show_access_list_rule(int extended, ip_filter_rulet *rule)
+{
+ static char buf[256];
+ char *p = buf;
+
+ p += sprintf(p, " %s", rule->action == FILTER_ACTION_PERMIT ? "permit" : "deny");
+ if (extended)
+ {
+ struct protoent *proto = getprotobynumber(rule->proto);
+ p += sprintf(p, " %s", proto ? proto->p_name : "ERR");
+ }
+
+ p += show_ip_wild(p, rule->src_ip, rule->src_wild);
+ if (!extended)
+ return buf;
+
+ if (rule->proto == IPPROTO_TCP || rule->proto == IPPROTO_UDP)
+ p += show_ports(p, &rule->src_ports);
+
+ p += show_ip_wild(p, rule->dst_ip, rule->dst_wild);
+ if (rule->proto == IPPROTO_TCP || rule->proto == IPPROTO_UDP)
+ p += show_ports(p, &rule->dst_ports);
+
+ if (rule->proto == IPPROTO_TCP && rule->tcp_flag_op)
+ {
+ switch (rule->tcp_flag_op)
+ {
+ case FILTER_FLAG_OP_EST:
+ p += sprintf(p, " established");
+ break;
+
+ case FILTER_FLAG_OP_ANY:
+ case FILTER_FLAG_OP_ALL:
+ p += sprintf(p, " match-%s", rule->tcp_flag_op == FILTER_FLAG_OP_ALL ? "all" : "any");
+ if (rule->tcp_sflags & TCP_FLAG_FIN) p += sprintf(p, " +fin");
+ if (rule->tcp_cflags & TCP_FLAG_FIN) p += sprintf(p, " -fin");
+ if (rule->tcp_sflags & TCP_FLAG_SYN) p += sprintf(p, " +syn");
+ if (rule->tcp_cflags & TCP_FLAG_SYN) p += sprintf(p, " -syn");
+ if (rule->tcp_sflags & TCP_FLAG_RST) p += sprintf(p, " +rst");
+ if (rule->tcp_cflags & TCP_FLAG_RST) p += sprintf(p, " -rst");
+ if (rule->tcp_sflags & TCP_FLAG_PSH) p += sprintf(p, " +psh");
+ if (rule->tcp_cflags & TCP_FLAG_PSH) p += sprintf(p, " -psh");
+ if (rule->tcp_sflags & TCP_FLAG_ACK) p += sprintf(p, " +ack");
+ if (rule->tcp_cflags & TCP_FLAG_ACK) p += sprintf(p, " -ack");
+ if (rule->tcp_sflags & TCP_FLAG_URG) p += sprintf(p, " +urg");
+ if (rule->tcp_cflags & TCP_FLAG_URG) p += sprintf(p, " -urg");
+ break;
+ }
+ }
+
+ if (rule->frag)
+ p += sprintf(p, " fragments");
+
+ return buf;
+}
+
+static ip_filter_rulet *access_list_rule_ext(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ static ip_filter_rulet rule;
+ struct in_addr addr;
+ int i;
+ int a;
+
+ if (CLI_HELP_REQUESTED)
+ {
+ if (argc == 1)
+ {
+ cli_arg_help(cli, 0,
+ "ip", "Match IP packets",
+ "tcp", "Match TCP packets",
+ "udp", "Match UDP packets",
+ NULL);
+
+ return NULL;
+ }
+
+ // *sigh*, too darned complex
+ cli_arg_help(cli, 0, "RULE", "SOURCE [PORTS] DEST [PORTS] FLAGS", NULL);
+ return NULL;
+ }
+
+ if (argc < 3)
+ {
+ cli_error(cli, "Specify rule details");
+ return NULL;
+ }
+
+ memset(&rule, 0, sizeof(rule));
+ rule.action = (command[0] == 'p')
+ ? FILTER_ACTION_PERMIT
+ : FILTER_ACTION_DENY;
+
+ if (MATCH("ip", argv[0]))
+ rule.proto = IPPROTO_IP;
+ else if (MATCH("udp", argv[0]))
+ rule.proto = IPPROTO_UDP;
+ else if (MATCH("tcp", argv[0]))
+ rule.proto = IPPROTO_TCP;
+ else
+ {
+ cli_error(cli, "Invalid protocol \"%s\"", argv[0]);
+ return NULL;
+ }
+
+ for (a = 1, i = 0; i < 2; i++)
+ {
+ in_addr_t *ip;
+ in_addr_t *wild;
+ ip_filter_portt *port;
+
+ if (i == 0)
+ {
+ ip = &rule.src_ip;
+ wild = &rule.src_wild;
+ port = &rule.src_ports;
+ }
+ else
+ {
+ ip = &rule.dst_ip;
+ wild = &rule.dst_wild;
+ port = &rule.dst_ports;
+ if (a >= argc)
+ {
+ cli_error(cli, "Specify destination");
+ return NULL;
+ }
+ }
+
+ if (MATCH("any", argv[a]))
+ {
+ *ip = INADDR_ANY;
+ *wild = INADDR_BROADCAST;
+ a++;
+ }
+ else if (MATCH("host", argv[a]))
+ {
+ if (++a >= argc)
+ {
+ cli_error(cli, "Specify host ip address");
+ return NULL;
+ }
+
+ if (!inet_aton(argv[a], &addr))
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ *ip = addr.s_addr;
+ *wild = INADDR_ANY;
+ a++;
+ }
+ else
+ {
+ if (a >= argc - 1)
+ {
+ cli_error(cli, "Specify %s ip address and wildcard", i ? "destination" : "source");
+ return NULL;
+ }
+
+ if (!inet_aton(argv[a], &addr))
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ *ip = addr.s_addr;
+
+ if (!inet_aton(argv[++a], &addr))
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ *wild = addr.s_addr;
+ a++;
+ }
+
+ if (rule.proto == IPPROTO_IP || a >= argc)
+ continue;
+
+ port->op = 0;
+ if (MATCH("eq", argv[a]))
+ port->op = FILTER_PORT_OP_EQ;
+ else if (MATCH("neq", argv[a]))
+ port->op = FILTER_PORT_OP_NEQ;
+ else if (MATCH("gt", argv[a]))
+ port->op = FILTER_PORT_OP_GT;
+ else if (MATCH("lt", argv[a]))
+ port->op = FILTER_PORT_OP_LT;
+ else if (MATCH("range", argv[a]))
+ port->op = FILTER_PORT_OP_RANGE;
+
+ if (!port->op)
+ continue;
+
+ if (++a >= argc)
+ {
+ cli_error(cli, "Specify port");
+ return NULL;
+ }
+
+ if (!(port->port = atoi(argv[a])))
+ {
+ cli_error(cli, "Invalid port \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ a++;
+ if (port->op != FILTER_PORT_OP_RANGE)
+ continue;
+
+ if (a >= argc)
+ {
+ cli_error(cli, "Specify port");
+ return NULL;
+ }
+
+ if (!(port->port2 = atoi(argv[a])) || port->port2 < port->port)
+ {
+ cli_error(cli, "Invalid port \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ a++;
+ }
+
+ if (rule.proto == IPPROTO_TCP && a < argc)
+ {
+ if (MATCH("established", argv[a]))
+ {
+ rule.tcp_flag_op = FILTER_FLAG_OP_EST;
+ a++;
+ }
+ else if (!strcmp(argv[a], "match-any") || !strcmp(argv[a], "match-an") ||
+ !strcmp(argv[a], "match-all") || !strcmp(argv[a], "match-al"))
+ {
+ rule.tcp_flag_op = argv[a][7] == 'n'
+ ? FILTER_FLAG_OP_ANY
+ : FILTER_FLAG_OP_ALL;
+
+ if (++a >= argc)
+ {
+ cli_error(cli, "Specify tcp flags");
+ return NULL;
+ }
+
+ while (a < argc && (argv[a][0] == '+' || argv[a][0] == '-'))
+ {
+ uint8_t *f;
+
+ f = (argv[a][0] == '+') ? &rule.tcp_sflags : &rule.tcp_cflags;
+
+ if (MATCH("fin", &argv[a][1])) *f |= TCP_FLAG_FIN;
+ else if (MATCH("syn", &argv[a][1])) *f |= TCP_FLAG_SYN;
+ else if (MATCH("rst", &argv[a][1])) *f |= TCP_FLAG_RST;
+ else if (MATCH("psh", &argv[a][1])) *f |= TCP_FLAG_PSH;
+ else if (MATCH("ack", &argv[a][1])) *f |= TCP_FLAG_ACK;
+ else if (MATCH("urg", &argv[a][1])) *f |= TCP_FLAG_URG;
+ else
+ {
+ cli_error(cli, "Invalid tcp flag \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ a++;
+ }
+ }
+ }
+
+ if (a < argc && MATCH("fragments", argv[a]))
+ {
+ if (rule.src_ports.op || rule.dst_ports.op || rule.tcp_flag_op)
+ {
+ cli_error(cli, "Can't specify \"fragments\" on rules with layer 4 matches");
+ return NULL;
+ }
+
+ rule.frag = 1;
+ a++;
+ }
+
+ if (a < argc)
+ {
+ cli_error(cli, "Invalid flag \"%s\"", argv[a]);
+ return NULL;
+ }
+
+ return &rule;
+}
+
+static ip_filter_rulet *access_list_rule_std(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ static ip_filter_rulet rule;
+ struct in_addr addr;
+
+ if (CLI_HELP_REQUESTED)
+ {
+ if (argc == 1)
+ {
+ cli_arg_help(cli, argv[0][1],
+ "A.B.C.D", "Source address",
+ "any", "Any source address",
+ "host", "Source host",
+ NULL);
+
+ return NULL;
+ }
+
+ if (MATCH("any", argv[0]))
+ {
+ if (argc == 2 && !argv[1][1])
+ cli_arg_help(cli, 1, NULL);
+ }
+ else if (MATCH("host", argv[0]))
+ {
+ if (argc == 2)
+ {
+ cli_arg_help(cli, argv[1][1],
+ "A.B.C.D", "Host address",
+ NULL);
+ }
+ else if (argc == 3 && !argv[2][1])
+ cli_arg_help(cli, 1, NULL);
+ }
+ else
+ {
+ if (argc == 2)
+ {
+ cli_arg_help(cli, 1,
+ "A.B.C.D", "Wildcard bits",
+ NULL);
+ }
+ else if (argc == 3 && !argv[2][1])
+ cli_arg_help(cli, 1, NULL);
+ }
+
+ return NULL;
+ }
+
+ if (argc < 1)
+ {
+ cli_error(cli, "Specify rule details");
+ return NULL;
+ }
+
+ memset(&rule, 0, sizeof(rule));
+ rule.action = (command[0] == 'p')
+ ? FILTER_ACTION_PERMIT
+ : FILTER_ACTION_DENY;
+
+ rule.proto = IPPROTO_IP;
+ if (MATCH("any", argv[0]))
+ {
+ rule.src_ip = INADDR_ANY;
+ rule.src_wild = INADDR_BROADCAST;
+ }
+ else if (MATCH("host", argv[0]))
+ {
+ if (argc != 2)
+ {
+ cli_error(cli, "Specify host ip address");
+ return NULL;
+ }
+
+ if (!inet_aton(argv[1], &addr))
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[1]);
+ return NULL;
+ }
+
+ rule.src_ip = addr.s_addr;
+ rule.src_wild = INADDR_ANY;
+ }
+ else
+ {
+ if (argc > 2)
+ {
+ cli_error(cli, "Specify source ip address and wildcard");
+ return NULL;
+ }
+
+ if (!inet_aton(argv[0], &addr))
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[0]);
+ return NULL;
+ }
+
+ rule.src_ip = addr.s_addr;
+
+ if (argc > 1)
+ {
+ if (!inet_aton(argv[1], &addr))
+ {
+ cli_error(cli, "Cannot parse IP \"%s\"", argv[1]);
+ return NULL;
+ }
+
+ rule.src_wild = addr.s_addr;
+ }
+ else
+ rule.src_wild = INADDR_ANY;
+ }
+
+ return &rule;
+}
+
+static int cmd_ip_access_list_rule(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ ip_filter_rulet *rule = ip_filters[filt].extended
+ ? access_list_rule_ext(cli, command, argv, argc)
+ : access_list_rule_std(cli, command, argv, argc);
+
+ if (!rule)
+ return CLI_OK;
+
+ for (i = 0; i < MAXFILTER_RULES - 1; i++) // -1: list always terminated by empty rule
+ {
+ if (!ip_filters[filt].rules[i].action)
+ {
+ memcpy(&ip_filters[filt].rules[i], rule, sizeof(*rule));
+ return CLI_OK;
+ }
+
+ if (!memcmp(&ip_filters[filt].rules[i], rule, offsetof(ip_filter_rulet, counter)))
+ return CLI_OK;
+ }
+
+ cli_error(cli, "Too many rules");
+ return CLI_OK;
+}
+
+static int cmd_filter(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ sessionidt s;
+ int i;
+
+ /* filter USER {in|out} FILTER ... */
+ if (CLI_HELP_REQUESTED)
+ {
+ switch (argc)
+ {
+ case 1:
+ return cli_arg_help(cli, 0,
+ "USER", "Username of session to filter", NULL);
+
+ case 2:
+ case 4:
+ return cli_arg_help(cli, 0,
+ "in", "Set incoming filter",
+ "out", "Set outgoing filter", NULL);
+
+ case 3:
+ case 5:
+ return cli_arg_help(cli, argc == 5 && argv[4][1],
+ "NAME", "Filter name", NULL);
+
+ default:
+ return cli_arg_help(cli, argc > 1, NULL);
+ }
+ }
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (argc != 3 && argc != 5)
+ {
+ cli_error(cli, "Specify a user and filters");
+ return CLI_OK;
+ }
+
+ if (!(s = sessionbyuser(argv[0])))
+ {
+ cli_error(cli, "User %s is not connected", argv[0]);
+ return CLI_OK;
+ }
+
+ cli_session_actions[s].filter_in = cli_session_actions[s].filter_out = -1;
+ for (i = 1; i < argc; i += 2)
+ {
+ int *f = 0;
+ int v;
+
+ if (MATCH("in", argv[i]))
+ {
+ if (session[s].filter_in)
+ {
+ cli_error(cli, "Input already filtered");
+ return CLI_OK;
+ }
+ f = &cli_session_actions[s].filter_in;
+ }
+ else if (MATCH("out", argv[i]))
+ {
+ if (session[s].filter_out)
+ {
+ cli_error(cli, "Output already filtered");
+ return CLI_OK;
+ }
+ f = &cli_session_actions[s].filter_out;
+ }
+ else
+ {
+ cli_error(cli, "Invalid filter specification");
+ return CLI_OK;
+ }
+
+ v = find_filter(argv[i+1], strlen(argv[i+1]));
+ if (v < 0 || !*ip_filters[v].name)
+ {
+ cli_error(cli, "Access-list %s not defined", argv[i+1]);
+ return CLI_OK;
+ }
+
+ *f = v + 1;
+ }
+
+ cli_print(cli, "Filtering user %s", argv[0]);
+ cli_session_actions[s].action |= CLI_SESS_FILTER;
+
+ return CLI_OK;
+}
+
+static int cmd_no_filter(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+ sessionidt s;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1,
+ "USER", "Username of session to remove filters from", NULL);
+
+ if (!config->cluster_iam_master)
+ {
+ cli_error(cli, "Can't do this on a slave. Do it on %s",
+ fmtaddr(config->cluster_master_address, 0));
+
+ return CLI_OK;
+ }
+
+ if (!argc)
+ {
+ cli_error(cli, "Specify a user to remove filters from");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ if (!(s = sessionbyuser(argv[i])))
+ {
+ cli_error(cli, "User %s is not connected", argv[i]);
+ continue;
+ }
+
+ if (session[s].filter_in || session[s].filter_out)
+ {
+ cli_print(cli, "Removing filters from user %s", argv[i]);
+ cli_session_actions[s].action |= CLI_SESS_NOFILTER;
+ }
+ else
+ {
+ cli_error(cli, "User %s not filtered", argv[i]);
+ }
+ }
+
+ return CLI_OK;
+}
+
+static int cmd_show_access_list(struct cli_def *cli, char *command, char **argv, int argc)
+{
+ int i;
+
+ if (CLI_HELP_REQUESTED)
+ return cli_arg_help(cli, argc > 1, "NAME", "Filter name", NULL);
+
+ if (argc < 1)
+ {
+ cli_error(cli, "Specify a filter name");
+ return CLI_OK;
+ }
+
+ for (i = 0; i < argc; i++)
+ {
+ int f = find_filter(argv[i], strlen(argv[i]));
+ ip_filter_rulet *rules;
+
+ if (f < 0 || !*ip_filters[f].name)
+ {
+ cli_error(cli, "Access-list %s not defined", argv[i]);
+ return CLI_OK;
+ }
+
+ if (i)
+ cli_print(cli, "");
+
+ cli_print(cli, "%s IP access list %s",
+ ip_filters[f].extended ? "Extended" : "Standard",
+ ip_filters[f].name);
+
+ for (rules = ip_filters[f].rules; rules->action; rules++)
+ {
+ char const *r = show_access_list_rule(ip_filters[f].extended, rules);
+ if (rules->counter)
+ cli_print(cli, "%s (%u match%s)", r,
+ rules->counter, rules->counter > 1 ? "es" : "");
+ else
+ cli_print(cli, "%s", r);
+ }
+ }
+
+ return CLI_OK;
projects / l2tpns.git / blobdiff