| 41 | #include "ipfw2.h" |
| 42 | |
| 43 | static void |
| 44 | help(void) |
| 45 | { |
| 46 | fprintf(stderr, |
| 47 | "ipfw syntax summary (but please do read the ipfw(8) manpage):\n\n" |
| 48 | #ifndef FSTACK |
| 49 | "\tipfw [-abcdefhnNqStTv] <command>\n\n" |
| 50 | #else |
| 51 | "\tipfw -P <f-stack proc_id> [-abcdefhnNqStTv] <command>\n\n" |
| 52 | #endif |
| 53 | "where <command> is one of the following:\n\n" |
| 54 | "add [num] [set N] [prob x] RULE-BODY\n" |
| 55 | "{pipe|queue} N config PIPE-BODY\n" |
| 56 | "[pipe|queue] {zero|delete|show} [N{,N}]\n" |
| 57 | "nat N config {ip IPADDR|if IFNAME|log|deny_in|same_ports|unreg_only|unreg_cgn|\n" |
| 58 | " reset|reverse|proxy_only|redirect_addr linkspec|\n" |
| 59 | " redirect_port linkspec|redirect_proto linkspec}\n" |
| 60 | "set [disable N... enable N...] | move [rule] X to Y | swap X Y | show\n" |
| 61 | "set N {show|list|zero|resetlog|delete} [N{,N}] | flush\n" |
| 62 | "table N {add ip[/bits] [value] | delete ip[/bits] | flush | list}\n" |
| 63 | "table all {flush | list}\n" |
| 64 | "\n" |
| 65 | "RULE-BODY: check-state [PARAMS] | ACTION [PARAMS] ADDR [OPTION_LIST]\n" |
| 66 | "ACTION: check-state | allow | count | deny | unreach{,6} CODE |\n" |
| 67 | " skipto N | {divert|tee} PORT | forward ADDR |\n" |
| 68 | " pipe N | queue N | nat N | setfib FIB | reass\n" |
| 69 | "PARAMS: [log [logamount LOGLIMIT]] [altq QUEUE_NAME]\n" |
| 70 | "ADDR: [ MAC dst src ether_type ] \n" |
| 71 | " [ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]\n" |
| 72 | " [ ipv6|ip6 from IP6ADDR [ PORT ] to IP6ADDR [ PORTLIST ] ]\n" |
| 73 | "IPADDR: [not] { any | me | ip/bits{x,y,z} | table(t[,v]) | IPLIST }\n" |
| 74 | "IP6ADDR: [not] { any | me | me6 | ip6/bits | IP6LIST }\n" |
| 75 | "IP6LIST: { ip6 | ip6/bits }[,IP6LIST]\n" |
| 76 | "IPLIST: { ip | ip/bits | ip:mask }[,IPLIST]\n" |
| 77 | "OPTION_LIST: OPTION [OPTION_LIST]\n" |
| 78 | "OPTION: bridged | diverted | diverted-loopback | diverted-output |\n" |
| 79 | " {dst-ip|src-ip} IPADDR | {dst-ip6|src-ip6|dst-ipv6|src-ipv6} IP6ADDR |\n" |
| 80 | " {dst-port|src-port} LIST |\n" |
| 81 | " estab | frag | {gid|uid} N | icmptypes LIST | in | out | ipid LIST |\n" |
| 82 | " iplen LIST | ipoptions SPEC | ipprecedence | ipsec | iptos SPEC |\n" |
| 83 | " ipttl LIST | ipversion VER | keep-state | layer2 | limit ... |\n" |
| 84 | " icmp6types LIST | ext6hdr LIST | flow-id N[,N] | fib FIB |\n" |
| 85 | " mac ... | mac-type LIST | proto LIST | {recv|xmit|via} {IF|IPADDR} |\n" |
| 86 | " setup | {tcpack|tcpseq|tcpwin} NN | tcpflags SPEC | tcpoptions SPEC |\n" |
| 87 | " tcpdatalen LIST | verrevpath | versrcreach | antispoof\n" |
| 88 | ); |
| 89 | |
| 90 | #ifdef FSTACK |
| 91 | ff_ipc_exit(); |
| 92 | #endif |
| 93 | |
| 94 | exit(0); |
| 95 | } |
| 96 | |
| 97 | /* |
| 98 | * Called with the arguments, including program name because getopt |