The branch stable/13 has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=4da31fbe58a43cfbd15350fc36c1e8357123b334
commit 4da31fbe58a43cfbd15350fc36c1e8357123b334
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2022-03-05 16:55:48 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2022-03-15 02:52:18 +0000
pfctl: support recursive printing of nat rules
PR: 252617
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D34455
(cherry picked from commit a20773c810814dd130ca1f0fbf08d27fea465555)
---
sbin/pfctl/pfctl.c | 41 ++++++++++++++++++++++++++++++++++-------
1 file changed, 34 insertions(+), 7 deletions(-)
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index a0eec1b09289..342f355a0116 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -98,7 +98,7 @@ int pfctl_get_pool(int, struct pfctl_pool *, u_int32_t,
u_int32_t, int,
char *);
void pfctl_print_rule_counters(struct pfctl_rule *, int);
int pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
-int pfctl_show_nat(int, int, char *);
+int pfctl_show_nat(int, char *, int, char *, int);
int pfctl_show_src_nodes(int, int);
int pfctl_show_states(int, const char *, int);
int pfctl_show_status(int, int);
@@ -1191,17 +1191,19 @@ pfctl_show_rules(int dev, char *path, int opts, enum
pfctl_show format,
}
int
-pfctl_show_nat(int dev, int opts, char *anchorname)
+pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth)
{
struct pfioc_rule pr;
struct pfctl_rule rule;
u_int32_t mnr, nr;
static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
int i, dotitle = opts & PF_OPT_SHOWALL;
+ int brace;
+ char *p;
- memset(&pr, 0, sizeof(pr));
- memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
for (i = 0; i < 3; i++) {
+ memset(&pr, 0, sizeof(pr));
+ memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
pr.rule.action = nattype[i];
if (ioctl(dev, DIOCGETRULES, &pr)) {
warn("DIOCGETRULES");
@@ -1209,6 +1211,9 @@ pfctl_show_nat(int dev, int opts, char *anchorname)
}
mnr = pr.nr;
for (nr = 0; nr < mnr; ++nr) {
+ brace = 0;
+ INDENT(depth, !(opts & PF_OPT_VERBOSE));
+
pr.nr = nr;
if (pfctl_get_rule(dev, nr, pr.ticket, anchorname,
nattype[i], &rule, pr.anchor_call)) {
@@ -1218,15 +1223,37 @@ pfctl_show_nat(int dev, int opts, char *anchorname)
if (pfctl_get_pool(dev, &rule.rpool, nr,
pr.ticket, nattype[i], anchorname) != 0)
return (-1);
+
+ if (pr.anchor_call[0] &&
+ ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
+ (p == pr.anchor_call ||
+ *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
+ brace++;
+ if ((p = strrchr(pr.anchor_call, '/')) !=
+ NULL)
+ p++;
+ else
+ p = &pr.anchor_call[0];
+ } else
+ p = &pr.anchor_call[0];
+
if (dotitle) {
pfctl_print_title("TRANSLATION RULES:");
dotitle = 0;
}
print_rule(&rule, pr.anchor_call,
opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
- printf("\n");
+ if (brace)
+ printf(" {\n");
+ else
+ printf("\n");
pfctl_print_rule_counters(&rule, opts);
pfctl_clear_pool(&rule.rpool);
+ if (brace) {
+ pfctl_show_nat(dev, path, opts, p, depth + 1);
+ INDENT(depth, !(opts & PF_OPT_VERBOSE));
+ printf("}\n");
+ }
}
}
return (0);
@@ -2537,7 +2564,7 @@ main(int argc, char *argv[])
break;
case 'n':
pfctl_load_fingerprints(dev, opts);
- pfctl_show_nat(dev, opts, anchorname);
+ pfctl_show_nat(dev, path, opts, anchorname, 0);
break;
case 'q':
pfctl_show_altq(dev, ifaceopt, opts,
@@ -2565,7 +2592,7 @@ main(int argc, char *argv[])
opts |= PF_OPT_SHOWALL;
pfctl_load_fingerprints(dev, opts);
- pfctl_show_nat(dev, opts, anchorname);
+ pfctl_show_nat(dev, path, opts, anchorname, 0);
pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
pfctl_show_altq(dev, ifaceopt, opts, 0);
pfctl_show_states(dev, ifaceopt, opts);
