ipfwcmp man page on BSDOS

Man page or keyword search:  
man Server   6284 pages
apropos Keyword Search (all sections)
Output format
BSDOS logo
[printable version]

IPFWCMP(8)		  BSD System Manager's Manual		    IPFWCMP(8)

NAME
     ipfwcmp - compile a BSD IP Filter

SYNOPSIS
     ipfwcmp [-cpS] [-s] [-o output] file

DESCRIPTION
     The ipfwcmp utility compiles the BSD IP Filter program stored in file. If
     output is specified by the -o option, the resulting bpf machine code is
     written into the file names output. If not specified, the machine code is
     written to file.filter (after stripping any .ipfw suffix from file.)

     If the -s flag is specified, the output written is bpf assembly code (see
     ipfwasm(8)).  In this case, if the -o flag is not specified, the output
     is written to standard output.  If -s is not specified, the ipfwasm(8)
     assembler will optimize the program.  The optimization may be turned off
     by use of the -S option.  In addition, the -c option may be specified to
     request ipfwasm(8) to try and cache memory loads (may take a long time to
     compute).	The -p option is also passed to ipfwasm(8) to request a pro-
     file of possible paths to be displayed.

     Before compiling the program, ipfwcmp preprocesses the program with
     cpp(1).  Line comments are introduces by the character sequence // and
     extend to the end of the line.  C style comments may also be used.

     Programs may contain lines of bpf assembly code (see ipfwasm(8)).	Be-
     cause of this, ipfwcmp may be used to assemble BSD IP Filter assembly
     programs as well as compile BSD IP Filter programs.

     A BSD IP Fitler  program must follow the following BNF:

     program

	  : statement ...     list of statements

     statement

	  : asm-statement     any statement accepted by ipfwasm(8)

	  : break;	      break out of the current case
			      must be the last statement of a case if the case
			      does not end with a rejection or acceptance of
			      the packet

	  : deny;	      reject the packet.  The synonym reject may be
			      used in place of deny in all forms.

	  : deny [number];    reject the packet and report up to number bytes
			      of the packet to the user level daemon (see
			      ipfwlog(8))  If number is 0, report the entire
			      packet.

	  : deny [number : user-defined];
			      Same as above with the addition that the speci-
			      fied user-defined bits are also returned to the
			      user level daemon.

	  : next;	      Continue on with the next filter in the chain,
			      or reject the packet if this is the last filter
			      in the chain.

	  : permit;	      accept the packet for normal processing The syn-
			      onym accept may be used in place of permit in

			      all forms.

	  : permit [number];  accept the packet for normal processing, and re-
			      port up to number bytes of the packet to the us-
			      er level daemon (see ipfwlog(8)).	 If number is
			      0, report the entire packet.

	  : permit [number : user-defined];
			      Same as above with the addition that the speci-
			      fied user-defined bits are also returned to the
			      user level daemon.

	  : return;	      Return from a call or rate filter with the value
			      stored in the A register .

	  : implicit deny;

	  : return [value];   Return from a call or rate filter with value.

	  : implicit deny;    If the end of the filter is reached, reject the
			      packet

	  : implicit deny [number];
			      If the end of the filter is reached, reject the
			      packet and report up to number bytes of the
			      packet to the user level daemon (see
			      ipfwlog(8)).  If number is 0, report the entire
			      packet.

	  : implicit next;    If the end of the filter is reached go on to the
			      next filter in the chain or reject the packet if
			      this is the last filter in the chain.

	  : implicit deny [number : user-defined];
			      Same as above with the addition that the speci-
			      fied user-defined bits are also returned to the
			      user level daemon.

	  : implicit permit;  If the end of the filter is reached, accept the
			      packet (the default)

	  : implicit permit [number];
			      If the end of the filter is reached, accept the
			      packet (the default) and report up to number
			      bytes of the packet to the user level daemon
			      (see ipfwlog(8)).	 If number is 0, report the
			      entire packet.

	  : implicit permit [number : user-defined];
			      Same as above with the addition that the speci-
			      fied user-defined bits are also returned to the
			      user level daemon.

	  : chain (Ar tag Nm );
			      Chain to the filter from the call chain with the
			      specified tag.

	  : conditional { program }
			      execute program if conditional evaluates as true

	  : conditional { program } else { program }
			      execute the first program if conditional evalu-
			      ates as true else execute the second program

	  : filter identifier { program }
			      store program as a filter with the name of
			      identifier for later use by bind

	  : bind identifier;  use the filter previously defined with the name
			      of identifier
			      statements following a bind will not be reached

	  : block { case conditional : program [case conditional : ...] [de-
			      fault : program] }
			      execute program associated with first true case
			      if no case evaluates true execute program asso-
			      ciated with default

	  : switch conditional { case range : program [case range : ...] [de-
			      fault : program] }
			      execute program associated with the first case
			      which is in range
			      if no case is in range execute program associat-
			      ed with default
			      a case with no program falls through to the next
			      case with a program
			      range may not contain a list of ranges (i.e.,
			      range1 , range2)

     conditional

	  : ! conditional

	  : NOT conditional   reverse meanings of true and false for
			      conditional

			      note that ! binds tighter than either || or &&.

	  : (conditional)     grouping of conditionals

	  : conditional || conditional

	  : conditional OR conditional
			      true if either conditional is true

	  : conditional && conditional

	  : conditional AND conditional
			      true if both conditionals are true

			      note that && binds tighter than ||.

	  : accumulator (range)
			      evaluate as true if the contents of the accumu-
			      lator (A) is within range
			      provided for use with embedded bpf assembly in-
			      structions

	  : broadcast	      evaluate as true if this packet is a broadcast
			      packet

	  : call (Ar tag Nm )

	  : call (Ar tag Nm : number)
			      Call filter with the specified tag from the call
			      list.  Evaluate as true if the IPFW_ACCEPT bit
			      is set in the return value from the filter.  If
			      number is specified then it is passed to the
			      fitler as filter specific data.

	  : chksrc	      evaluate as true if the input interface and the

			      return interface are the same.

	  : data [number] (range)
			      evaluate as true if the byte located number
			      bytes into the packet is within range

	  : data [number:size] (range)
			      evaluate as true if the word of size (1, 2 or 4)
			      bytes located number bytes into the packet is
			      within range

			      the data will be retrieved from the packet in
			      host byte order

	  : decapsulated      evaluate as true if this packed was decapsulated
			      from a tunnel, only useful for input and pre-in-
			      put filters.

	  : dstaddr (range)   evaluate as true if the destination ip address
			      is within range

	  : dstport (range)   evaluate as true if the destination port is
			      within range (should only be used on tcp and udp
			      packets)

	  : established	      evaluate as true if this (tcp) packet is part of
			      an established connection (either the ACK or RST
			      bit is set)

	  : forwarding	      evaluate as true if this packet is being for-
			      warded

	  : icmpcode (range)  evaluate as true if the icmp code is within
			      range (should only be used on icmp packets)

	  : icmptype (range)  evaluate as true if the icmp type is within
			      range (should only be used on icmp packets)

	  : direction interface (ifacelist)
			      evaluate as true if the direction interface is
			      specified in ifacelist

	  : ipdata [number] (range)
			      evaluate as true if the byte located number
			      bytes into the ip data section of the packet is
			      within range

	  : ipdata [number:size] (range)
			      evaluate as true if the word of size (1, 2 or 4)
			      bytes located number bytes into the ip data sec-
			      tion of the packet is within range

			      the data will be retrieved from the packet in
			      host byte order

	  : ipdontfrag	      evaluate as true if the don't fragment bit is
			      set

	  : ipfirstfrag	      evaluate as true if this is the first fragment
			      of a fragmented packet

	  : ipfrag	      evalute as true if this is a fragment of a pack-
			      et

	  : iphlen (range)    evalute as true if the ip header length is with-

			      in range

	  : ipmorefrag	      evaluate as true if more fragments are to follow

	  : ipoffset (range)  evaluate as true if the ip version number is
			      within range

	  : ipprotocol (range)
			      evaluate as true if the ip protocol is within
			      range

	  : ip-protocol	      evalue as true if this packet of the specified
			      ip protocol

	  : ipv4	      evaluate as true if this is an IP version 4
			      packet

	  : ipv6	      evaluate as true if this is an IP version 6
			      packet

	  : ipversion (range)
			      evaluate as true if the ip version number is
			      within range

	  : packetlength (range)
			      evalute as true if the over all packet length is
			      within range

	  : preheader (range)
			      evaluate as true if the number of bytes in front
			      of this IP header is within range. This will on-
			      ly be non-zero for packets which have been de-
			      capsulated and is only useful for input and pre-
			      input filters.

	  : srcaddr (range)   evaluate as true if the source ip address is
			      within range

	  : srcport (range)   evaluate as true if the source port is within
			      range (should only be used on tcp and udp pack-
			      ets)

	  : tcpflags (range)  evaluate as true if any of the specified flags
			      are set (should only be used on tcp packets)

	  : toobig	      evaluate as true if this fragment would cause
			      the packet to be larger than 65535 bytes.

     range

	  : number	      evaluate as true if the value is equal to the
			      specified number

	  : number - number   evaluate as true if the value is between the
			      specified numbers, inclusive

	  : number / number   evaluate as true if the value matches the first
			      number using a netmask of the second number of
			      bits
			      dotted quads are treated as networks (ala KA9Q)
			      rather than IP addresses
			      this implies 127.1 is 127.0.0.1 while 127.1/24
			      is 127.1.0.0 & 0xffffff00

	  : number & number   evaluate as true if the value anded with the

			      second number equals the first number

	  : < number	      evaluate as true if the value is less than num-
			      ber

	  : <= number	      evaluate as true if the value is less than or
			      equal to number

	  : > number	      evaluate as true if the value is greater than
			      number

	  : >= number	      evaluate as true if the value is greater than or
			      equal to number

	  : range , range     a series of ranges, any of which may be matched
			      to evaluate as true

     number

	  : decimal-number    a series of digits starting with 1-9

	  : octal-number      a series of digit ([0-7]) starting with 0

	  : hexadecimal-number
			      a series of digit ([0-9a-f]) starting with 0x

	  : dotted-quad	      an ip address in dotted quad format

	  : service (name/proto)
			      port number returned by getservbyname(3) by
			      looking up name with proto in the /etc/services
			      file

	  : hostname (name)   the ip address associated with name

	  : tcp-flag	      One of the following tcp flags: ack, fin, push,
			      rst, syn, urg

	  : ip-protocol	      One of the following IP protocols: ah, dstopts,
			      egp, encap, eon, esp, fragment, ggp, icmp,
			      icmpv6, idp, igmp, ip, ipip, none, pup, routing,
			      tcp, tp, udp

	  : icmp-type	      One of the following ICMP message types: echo,
			      echoreply, ireq, ireqreply, maskreply, maskreq,
			      paramprob, redirect, routeradvert,
			      routersolicit, sourcequench, timxceed, tstamp,
			      tstampreply, unreach

	  : icmp-code	      One of the following ICMP message sub-codes:
			      paramprob_optabsent, redirect_host,
			      redirect_net, redirect_toshost, redirect_tosnet,
			      timxceed_intrans, timxceed_reass, unreach_host,
			      unreach_host_prohib, unreach_host_unknown,
			      unreach_isolated, unreach_needfrag, unreach_net,
			      unreach_net_prohib, unreach_net_unknown,
			      unreach_port, unreach_protocol, unreach_srcfail,
			      unreach_toshost, unreach_tosnet

     direction

	  : input	      the index of the interface this packet came in
			      on

	  : output	      the index of the interface this packet is going

			      out on

	  : return	      the index of the interface to which we would re-
			      turn this packet

     ifacelist

	  : interface-name    the name of a network interface (e.g., ef0)

	  : ifacelist , ifacelist
			      a list of interfaces that can be matched

     identifier
	  one or more characters, optionally enclosed in double quotes (")
	  the identifier must begin with an alphabetic character or an under-
	  score (_)
	  the following characters may also include digits (0-9), dashes (-),
	  at signs (@), slashes (/) and dots (.)
	  if not enclosed in quotes the identifier must not match any key
	  words

     user-defined

	  : userN [...]	      User defined value N in the range of 0 - 255,
			      inclusive.

	  : userbtN [...]     User defined bit N in the range of 0 - 7, inclu-
			      sive.

SEE ALSO
     cpp(1),  ipfw(8),	ipfwasm(8),  ipfwdis(8),  ipfwlog(8)

				 June 12, 1997				     7
[top]
                             _         _         _ 
                            | |       | |       | |     
                            | |       | |       | |     
                         __ | | __ __ | | __ __ | | __  
                         \ \| |/ / \ \| |/ / \ \| |/ /  
                          \ \ / /   \ \ / /   \ \ / /   
                           \   /     \   /     \   /    
                            \_/       \_/       \_/ 
More information is available in HTML format for server BSDOS

List of man pages available for BSDOS

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net