xref: /freebsd/sbin/pfctl/pfctl.c (revision b3902af408a98ff5520d50e6af69652d9b2984d5)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 #define PFIOC_USE_LATEST
38 
39 #include <sys/types.h>
40 #include <sys/ioctl.h>
41 #include <sys/socket.h>
42 #include <sys/stat.h>
43 #include <sys/endian.h>
44 
45 #include <net/if.h>
46 #include <netinet/in.h>
47 #include <net/pfvar.h>
48 #include <arpa/inet.h>
49 #include <net/altq/altq.h>
50 
51 #include <err.h>
52 #include <errno.h>
53 #include <fcntl.h>
54 #include <libpfctl.h>
55 #include <limits.h>
56 #include <netdb.h>
57 #include <stdint.h>
58 #include <stdio.h>
59 #include <stdlib.h>
60 #include <string.h>
61 #include <unistd.h>
62 
63 #include "pfctl_parser.h"
64 #include "pfctl.h"
65 
66 void	 usage(void);
67 int	 pfctl_enable(int, int);
68 int	 pfctl_disable(int, int);
69 void	 pfctl_clear_stats(struct pfctl_handle *, int);
70 void	 pfctl_get_skip_ifaces(void);
71 void	 pfctl_check_skip_ifaces(char *);
72 void	 pfctl_adjust_skip_ifaces(struct pfctl *);
73 void	 pfctl_clear_interface_flags(int, int);
74 void	 pfctl_flush_eth_rules(int, int, char *);
75 void	 pfctl_flush_rules(int, int, char *);
76 void	 pfctl_flush_nat(int, int, char *);
77 int	 pfctl_clear_altq(int, int);
78 void	 pfctl_clear_src_nodes(int, int);
79 void	 pfctl_clear_iface_states(int, const char *, int);
80 struct addrinfo *
81 	 pfctl_addrprefix(char *, struct pf_addr *, int);
82 void	 pfctl_kill_src_nodes(int, int);
83 void	 pfctl_net_kill_states(int, const char *, int);
84 void	 pfctl_gateway_kill_states(int, const char *, int);
85 void	 pfctl_label_kill_states(int, const char *, int);
86 void	 pfctl_id_kill_states(int, const char *, int);
87 void	 pfctl_key_kill_states(int, const char *, int);
88 int	 pfctl_parse_host(char *, struct pf_rule_addr *);
89 void	 pfctl_init_options(struct pfctl *);
90 int	 pfctl_load_options(struct pfctl *);
91 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
92 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
93 int	 pfctl_load_debug(struct pfctl *, unsigned int);
94 int	 pfctl_load_logif(struct pfctl *, char *);
95 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
96 int	 pfctl_load_reassembly(struct pfctl *, u_int32_t);
97 int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
98 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
99 	    const char *, int);
100 void	 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *, int);
101 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
102 int	 pfctl_show_eth_rules(int, char *, int, enum pfctl_show, char *, int, int);
103 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int, int);
104 int	 pfctl_show_nat(int, const char *, int, char *, int, int);
105 int	 pfctl_show_src_nodes(int, int);
106 int	 pfctl_show_states(int, const char *, int);
107 int	 pfctl_show_status(int, int);
108 int	 pfctl_show_running(int);
109 int	 pfctl_show_timeouts(int, int);
110 int	 pfctl_show_limits(int, int);
111 void	 pfctl_debug(int, u_int32_t, int);
112 int	 pfctl_test_altqsupport(int, int);
113 int	 pfctl_show_anchors(int, int, char *);
114 int	 pfctl_show_eth_anchors(int, int, char *);
115 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *, bool);
116 int	 pfctl_eth_ruleset_trans(struct pfctl *, char *,
117 	    struct pfctl_eth_anchor *);
118 int	 pfctl_load_eth_ruleset(struct pfctl *, char *,
119 	    struct pfctl_eth_ruleset *, int);
120 int	 pfctl_load_eth_rule(struct pfctl *, char *, struct pfctl_eth_rule *,
121 	    int);
122 int	 pfctl_load_ruleset(struct pfctl *, char *,
123 		struct pfctl_ruleset *, int, int);
124 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
125 const char	*pfctl_lookup_option(char *, const char * const *);
126 void	 pfctl_reset(int, int);
127 
128 static struct pfctl_anchor_global	 pf_anchors;
129 struct pfctl_anchor	 pf_main_anchor;
130 struct pfctl_eth_anchor	 pf_eth_main_anchor;
131 static struct pfr_buffer skip_b;
132 
133 static const char	*clearopt;
134 static char		*rulesopt;
135 static const char	*showopt;
136 static const char	*debugopt;
137 static char		*anchoropt;
138 static const char	*optiopt = NULL;
139 static const char	*pf_device = PF_DEVICE;
140 static char		*ifaceopt;
141 static char		*tableopt;
142 static const char	*tblcmdopt;
143 static int		 src_node_killers;
144 static char		*src_node_kill[2];
145 static int		 state_killers;
146 static char		*state_kill[2];
147 int			 loadopt;
148 int			 altqsupport;
149 
150 int			 dev = -1;
151 struct pfctl_handle	*pfh = NULL;
152 static int		 first_title = 1;
153 static int		 labels = 0;
154 
155 #define INDENT(d, o)	do {						\
156 				if (o) {				\
157 					int i;				\
158 					for (i=0; i < d; i++)		\
159 						printf("  ");		\
160 				}					\
161 			} while (0);					\
162 
163 
164 static const struct {
165 	const char	*name;
166 	int		index;
167 } pf_limits[] = {
168 	{ "states",		PF_LIMIT_STATES },
169 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
170 	{ "frags",		PF_LIMIT_FRAGS },
171 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
172 	{ NULL,			0 }
173 };
174 
175 struct pf_hint {
176 	const char	*name;
177 	int		timeout;
178 };
179 static const struct pf_hint pf_hint_normal[] = {
180 	{ "tcp.first",		2 * 60 },
181 	{ "tcp.opening",	30 },
182 	{ "tcp.established",	24 * 60 * 60 },
183 	{ "tcp.closing",	15 * 60 },
184 	{ "tcp.finwait",	45 },
185 	{ "tcp.closed",		90 },
186 	{ "tcp.tsdiff",		30 },
187 	{ NULL,			0 }
188 };
189 static const struct pf_hint pf_hint_satellite[] = {
190 	{ "tcp.first",		3 * 60 },
191 	{ "tcp.opening",	30 + 5 },
192 	{ "tcp.established",	24 * 60 * 60 },
193 	{ "tcp.closing",	15 * 60 + 5 },
194 	{ "tcp.finwait",	45 + 5 },
195 	{ "tcp.closed",		90 + 5 },
196 	{ "tcp.tsdiff",		60 },
197 	{ NULL,			0 }
198 };
199 static const struct pf_hint pf_hint_conservative[] = {
200 	{ "tcp.first",		60 * 60 },
201 	{ "tcp.opening",	15 * 60 },
202 	{ "tcp.established",	5 * 24 * 60 * 60 },
203 	{ "tcp.closing",	60 * 60 },
204 	{ "tcp.finwait",	10 * 60 },
205 	{ "tcp.closed",		3 * 60 },
206 	{ "tcp.tsdiff",		60 },
207 	{ NULL,			0 }
208 };
209 static const struct pf_hint pf_hint_aggressive[] = {
210 	{ "tcp.first",		30 },
211 	{ "tcp.opening",	5 },
212 	{ "tcp.established",	5 * 60 * 60 },
213 	{ "tcp.closing",	60 },
214 	{ "tcp.finwait",	30 },
215 	{ "tcp.closed",		30 },
216 	{ "tcp.tsdiff",		10 },
217 	{ NULL,			0 }
218 };
219 
220 static const struct {
221 	const char *name;
222 	const struct pf_hint *hint;
223 } pf_hints[] = {
224 	{ "normal",		pf_hint_normal },
225 	{ "satellite",		pf_hint_satellite },
226 	{ "high-latency",	pf_hint_satellite },
227 	{ "conservative",	pf_hint_conservative },
228 	{ "aggressive",		pf_hint_aggressive },
229 	{ NULL,			NULL }
230 };
231 
232 static const char * const clearopt_list[] = {
233 	"nat", "queue", "rules", "Sources",
234 	"states", "info", "Tables", "osfp", "all",
235 	"ethernet", "Reset", NULL
236 };
237 
238 static const char * const showopt_list[] = {
239 	"ether", "nat", "queue", "rules", "Anchors", "Sources", "states",
240 	"info", "Interfaces", "labels", "timeouts", "memory", "Tables",
241 	"osfp", "Running", "all", "creatorids", NULL
242 };
243 
244 static const char * const tblcmdopt_list[] = {
245 	"kill", "flush", "add", "delete", "load", "replace", "show",
246 	"test", "zero", "expire", "reset", NULL
247 };
248 
249 static const char * const debugopt_list[] = {
250 	"none", "urgent", "misc", "loud", NULL
251 };
252 
253 static const char * const optiopt_list[] = {
254 	"none", "basic", "profile", NULL
255 };
256 
257 void
usage(void)258 usage(void)
259 {
260 	extern char *__progname;
261 
262 	fprintf(stderr,
263 "usage: %s [-AdeghMmNnOPqRSrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
264 	"\t[-f file] [-i interface] [-K host | network]\n"
265 	"\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
266 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
267 	    __progname);
268 
269 	exit(1);
270 }
271 
272 /*
273  * Cache protocol number to name translations.
274  *
275  * Translation is performed a lot e.g., when dumping states and
276  * getprotobynumber is incredibly expensive.
277  *
278  * Note from the getprotobynumber(3) manpage:
279  * <quote>
280  * These functions use a thread-specific data space; if the data is needed
281  * for future use, it should be copied before any subsequent calls overwrite
282  * it.  Only the Internet protocols are currently understood.
283  * </quote>
284  *
285  * Consequently we only cache the name and strdup it for safety.
286  *
287  * At the time of writing this comment the last entry in /etc/protocols is:
288  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
289  */
290 const char *
pfctl_proto2name(int proto)291 pfctl_proto2name(int proto)
292 {
293 	static const char *pfctl_proto_cache[259];
294 	struct protoent *p;
295 
296 	if (proto >= nitems(pfctl_proto_cache)) {
297 		p = getprotobynumber(proto);
298 		if (p == NULL) {
299 			return (NULL);
300 		}
301 		return (p->p_name);
302 	}
303 
304 	if (pfctl_proto_cache[proto] == NULL) {
305 		p = getprotobynumber(proto);
306 		if (p == NULL) {
307 			return (NULL);
308 		}
309 		pfctl_proto_cache[proto] = strdup(p->p_name);
310 	}
311 
312 	return (pfctl_proto_cache[proto]);
313 }
314 
315 int
pfctl_enable(int dev,int opts)316 pfctl_enable(int dev, int opts)
317 {
318 	int ret;
319 
320 	if ((ret = pfctl_startstop(pfh, 1)) != 0) {
321 		if (ret == EEXIST)
322 			errx(1, "pf already enabled");
323 		else if (ret == ESRCH)
324 			errx(1, "pfil registeration failed");
325 		else
326 			errc(1, ret, "DIOCSTART");
327 	}
328 	if ((opts & PF_OPT_QUIET) == 0)
329 		fprintf(stderr, "pf enabled\n");
330 
331 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
332 		if (errno != EEXIST)
333 			err(1, "DIOCSTARTALTQ");
334 
335 	return (0);
336 }
337 
338 int
pfctl_disable(int dev,int opts)339 pfctl_disable(int dev, int opts)
340 {
341 	int ret;
342 
343 	if ((ret = pfctl_startstop(pfh, 0)) != 0) {
344 		if (ret == ENOENT)
345 			errx(1, "pf not enabled");
346 		else
347 			errc(1, ret, "DIOCSTOP");
348 	}
349 	if ((opts & PF_OPT_QUIET) == 0)
350 		fprintf(stderr, "pf disabled\n");
351 
352 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
353 			if (errno != ENOENT)
354 				err(1, "DIOCSTOPALTQ");
355 
356 	return (0);
357 }
358 
359 void
pfctl_clear_stats(struct pfctl_handle * h,int opts)360 pfctl_clear_stats(struct pfctl_handle *h, int opts)
361 {
362 	int ret;
363 	if ((ret = pfctl_clear_status(h)) != 0)
364 		errc(1, ret, "DIOCCLRSTATUS");
365 	if ((opts & PF_OPT_QUIET) == 0)
366 		fprintf(stderr, "pf: statistics cleared\n");
367 }
368 
369 void
pfctl_get_skip_ifaces(void)370 pfctl_get_skip_ifaces(void)
371 {
372 	bzero(&skip_b, sizeof(skip_b));
373 	skip_b.pfrb_type = PFRB_IFACES;
374 	for (;;) {
375 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
376 		skip_b.pfrb_size = skip_b.pfrb_msize;
377 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
378 			err(1, "pfi_get_ifaces");
379 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
380 			break;
381 	}
382 }
383 
384 void
pfctl_check_skip_ifaces(char * ifname)385 pfctl_check_skip_ifaces(char *ifname)
386 {
387 	struct pfi_kif		*p;
388 	struct node_host	*h = NULL, *n = NULL;
389 
390 	PFRB_FOREACH(p, &skip_b) {
391 		if (!strcmp(ifname, p->pfik_name) &&
392 		    (p->pfik_flags & PFI_IFLAG_SKIP))
393 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
394 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
395 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
396 				continue;
397 
398 			for (n = h; n != NULL; n = n->next) {
399 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
400 					continue;
401 
402 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
403 			}
404 		}
405 	}
406 }
407 
408 void
pfctl_adjust_skip_ifaces(struct pfctl * pf)409 pfctl_adjust_skip_ifaces(struct pfctl *pf)
410 {
411 	struct pfi_kif		*p, *pp;
412 	struct node_host	*h = NULL, *n = NULL;
413 
414 	PFRB_FOREACH(p, &skip_b) {
415 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
416 			continue;
417 
418 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
419 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
420 			continue;
421 
422 		for (n = h; n != NULL; n = n->next)
423 			PFRB_FOREACH(pp, &skip_b) {
424 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
425 					continue;
426 
427 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
428 					pfctl_set_interface_flags(pf,
429 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
430 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
431 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
432 			}
433 	}
434 
435 	PFRB_FOREACH(p, &skip_b) {
436 		if (! (p->pfik_flags & PFI_IFLAG_SKIP))
437 			continue;
438 
439 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
440 	}
441 }
442 
443 void
pfctl_clear_interface_flags(int dev,int opts)444 pfctl_clear_interface_flags(int dev, int opts)
445 {
446 	struct pfioc_iface	pi;
447 
448 	if ((opts & PF_OPT_NOACTION) == 0) {
449 		bzero(&pi, sizeof(pi));
450 		pi.pfiio_flags = PFI_IFLAG_SKIP;
451 
452 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
453 			err(1, "DIOCCLRIFFLAG");
454 		if ((opts & PF_OPT_QUIET) == 0)
455 			fprintf(stderr, "pf: interface flags reset\n");
456 	}
457 }
458 
459 void
pfctl_flush_eth_rules(int dev,int opts,char * anchorname)460 pfctl_flush_eth_rules(int dev, int opts, char *anchorname)
461 {
462 	int ret;
463 
464 	ret = pfctl_clear_eth_rules(dev, anchorname);
465 	if (ret != 0)
466 		err(1, "pfctl_clear_eth_rules");
467 
468 	if ((opts & PF_OPT_QUIET) == 0)
469 		fprintf(stderr, "Ethernet rules cleared\n");
470 }
471 
472 void
pfctl_flush_rules(int dev,int opts,char * anchorname)473 pfctl_flush_rules(int dev, int opts, char *anchorname)
474 {
475 	int ret;
476 
477 	ret = pfctl_clear_rules(dev, anchorname);
478 	if (ret != 0)
479 		err(1, "pfctl_clear_rules");
480 	if ((opts & PF_OPT_QUIET) == 0)
481 		fprintf(stderr, "rules cleared\n");
482 }
483 
484 void
pfctl_flush_nat(int dev,int opts,char * anchorname)485 pfctl_flush_nat(int dev, int opts, char *anchorname)
486 {
487 	int ret;
488 
489 	ret = pfctl_clear_nat(dev, anchorname);
490 	if (ret != 0)
491 		err(1, "pfctl_clear_nat");
492 	if ((opts & PF_OPT_QUIET) == 0)
493 		fprintf(stderr, "nat cleared\n");
494 }
495 
496 int
pfctl_clear_altq(int dev,int opts)497 pfctl_clear_altq(int dev, int opts)
498 {
499 	struct pfr_buffer t;
500 
501 	if (!altqsupport)
502 		return (-1);
503 	memset(&t, 0, sizeof(t));
504 	t.pfrb_type = PFRB_TRANS;
505 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
506 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
507 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
508 		err(1, "pfctl_clear_altq");
509 	if ((opts & PF_OPT_QUIET) == 0)
510 		fprintf(stderr, "altq cleared\n");
511 	return (0);
512 }
513 
514 void
pfctl_clear_src_nodes(int dev,int opts)515 pfctl_clear_src_nodes(int dev, int opts)
516 {
517 	if (ioctl(dev, DIOCCLRSRCNODES))
518 		err(1, "DIOCCLRSRCNODES");
519 	if ((opts & PF_OPT_QUIET) == 0)
520 		fprintf(stderr, "source tracking entries cleared\n");
521 }
522 
523 void
pfctl_clear_iface_states(int dev,const char * iface,int opts)524 pfctl_clear_iface_states(int dev, const char *iface, int opts)
525 {
526 	struct pfctl_kill kill;
527 	unsigned int killed;
528 	int ret;
529 
530 	memset(&kill, 0, sizeof(kill));
531 	if (iface != NULL && strlcpy(kill.ifname, iface,
532 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
533 		errx(1, "invalid interface: %s", iface);
534 
535 	if (opts & PF_OPT_KILLMATCH)
536 		kill.kill_match = true;
537 
538 	if ((ret = pfctl_clear_states_h(pfh, &kill, &killed)) != 0)
539 		errc(1, ret, "DIOCCLRSTATES");
540 	if ((opts & PF_OPT_QUIET) == 0)
541 		fprintf(stderr, "%d states cleared\n", killed);
542 }
543 
544 struct addrinfo *
pfctl_addrprefix(char * addr,struct pf_addr * mask,int numeric)545 pfctl_addrprefix(char *addr, struct pf_addr *mask, int numeric)
546 {
547 	char *p;
548 	const char *errstr;
549 	int prefix, ret_ga, q, r;
550 	struct addrinfo hints, *res;
551 
552 	bzero(&hints, sizeof(hints));
553 	hints.ai_socktype = SOCK_DGRAM; /* dummy */
554 	if (numeric)
555 		hints.ai_flags = AI_NUMERICHOST;
556 
557 	if ((p = strchr(addr, '/')) != NULL) {
558 		*p++ = '\0';
559 		/* prefix only with numeric addresses */
560 		hints.ai_flags |= AI_NUMERICHOST;
561 	}
562 
563 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
564 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
565 		/* NOTREACHED */
566 	}
567 
568 	if (p == NULL)
569 		return (res);
570 
571 	prefix = strtonum(p, 0, res->ai_family == AF_INET6 ? 128 : 32, &errstr);
572 	if (errstr)
573 		errx(1, "prefix is %s: %s", errstr, p);
574 
575 	q = prefix >> 3;
576 	r = prefix & 7;
577 	switch (res->ai_family) {
578 	case AF_INET:
579 		bzero(&mask->v4, sizeof(mask->v4));
580 		mask->v4.s_addr = htonl((u_int32_t)
581 		    (0xffffffffffULL << (32 - prefix)));
582 		break;
583 	case AF_INET6:
584 		bzero(&mask->v6, sizeof(mask->v6));
585 		if (q > 0)
586 			memset((void *)&mask->v6, 0xff, q);
587 		if (r > 0)
588 			*((u_char *)&mask->v6 + q) =
589 			    (0xff00 >> r) & 0xff;
590 		break;
591 	}
592 
593 	return (res);
594 }
595 
596 void
pfctl_kill_src_nodes(int dev,int opts)597 pfctl_kill_src_nodes(int dev, int opts)
598 {
599 	struct pfioc_src_node_kill psnk;
600 	struct addrinfo *res[2], *resp[2];
601 	struct sockaddr last_src, last_dst;
602 	int killed, sources, dests;
603 
604 	killed = sources = dests = 0;
605 
606 	memset(&psnk, 0, sizeof(psnk));
607 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
608 	    sizeof(psnk.psnk_src.addr.v.a.mask));
609 	memset(&last_src, 0xff, sizeof(last_src));
610 	memset(&last_dst, 0xff, sizeof(last_dst));
611 
612 	res[0] = pfctl_addrprefix(src_node_kill[0],
613 	    &psnk.psnk_src.addr.v.a.mask, (opts & PF_OPT_NODNS));
614 
615 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
616 		if (resp[0]->ai_addr == NULL)
617 			continue;
618 		/* We get lots of duplicates.  Catch the easy ones */
619 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
620 			continue;
621 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
622 
623 		psnk.psnk_af = resp[0]->ai_family;
624 		sources++;
625 
626 		copy_satopfaddr(&psnk.psnk_src.addr.v.a.addr, resp[0]->ai_addr);
627 
628 		if (src_node_killers > 1) {
629 			dests = 0;
630 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
631 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
632 			memset(&last_dst, 0xff, sizeof(last_dst));
633 			res[1] = pfctl_addrprefix(src_node_kill[1],
634 			    &psnk.psnk_dst.addr.v.a.mask,
635 			    (opts & PF_OPT_NODNS));
636 			for (resp[1] = res[1]; resp[1];
637 			    resp[1] = resp[1]->ai_next) {
638 				if (resp[1]->ai_addr == NULL)
639 					continue;
640 				if (psnk.psnk_af != resp[1]->ai_family)
641 					continue;
642 
643 				if (memcmp(&last_dst, resp[1]->ai_addr,
644 				    sizeof(last_dst)) == 0)
645 					continue;
646 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
647 
648 				dests++;
649 
650 				copy_satopfaddr(&psnk.psnk_src.addr.v.a.addr,
651 				    resp[1]->ai_addr);
652 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
653 					err(1, "DIOCKILLSRCNODES");
654 				killed += psnk.psnk_killed;
655 			}
656 			freeaddrinfo(res[1]);
657 		} else {
658 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
659 				err(1, "DIOCKILLSRCNODES");
660 			killed += psnk.psnk_killed;
661 		}
662 	}
663 
664 	freeaddrinfo(res[0]);
665 
666 	if ((opts & PF_OPT_QUIET) == 0)
667 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
668 		    "destinations\n", killed, sources, dests);
669 }
670 
671 void
pfctl_net_kill_states(int dev,const char * iface,int opts)672 pfctl_net_kill_states(int dev, const char *iface, int opts)
673 {
674 	struct pfctl_kill kill;
675 	struct addrinfo *res[2], *resp[2];
676 	struct sockaddr last_src, last_dst;
677 	unsigned int newkilled;
678 	int killed, sources, dests;
679 	int ret;
680 
681 	killed = sources = dests = 0;
682 
683 	memset(&kill, 0, sizeof(kill));
684 	memset(&kill.src.addr.v.a.mask, 0xff,
685 	    sizeof(kill.src.addr.v.a.mask));
686 	memset(&last_src, 0xff, sizeof(last_src));
687 	memset(&last_dst, 0xff, sizeof(last_dst));
688 	if (iface != NULL && strlcpy(kill.ifname, iface,
689 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
690 		errx(1, "invalid interface: %s", iface);
691 
692 	if (state_killers == 2 && (strcmp(state_kill[0], "nat") == 0)) {
693 		kill.nat = true;
694 		state_kill[0] = state_kill[1];
695 		state_killers = 1;
696 	}
697 
698 	res[0] = pfctl_addrprefix(state_kill[0],
699 	    &kill.src.addr.v.a.mask, (opts & PF_OPT_NODNS));
700 
701 	if (opts & PF_OPT_KILLMATCH)
702 		kill.kill_match = true;
703 
704 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
705 		if (resp[0]->ai_addr == NULL)
706 			continue;
707 		/* We get lots of duplicates.  Catch the easy ones */
708 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
709 			continue;
710 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
711 
712 		kill.af = resp[0]->ai_family;
713 		sources++;
714 
715 		copy_satopfaddr(&kill.src.addr.v.a.addr, resp[0]->ai_addr);
716 
717 		if (state_killers > 1) {
718 			dests = 0;
719 			memset(&kill.dst.addr.v.a.mask, 0xff,
720 			    sizeof(kill.dst.addr.v.a.mask));
721 			memset(&last_dst, 0xff, sizeof(last_dst));
722 			res[1] = pfctl_addrprefix(state_kill[1],
723 			    &kill.dst.addr.v.a.mask,
724 			    (opts & PF_OPT_NODNS));
725 			for (resp[1] = res[1]; resp[1];
726 			    resp[1] = resp[1]->ai_next) {
727 				if (resp[1]->ai_addr == NULL)
728 					continue;
729 				if (kill.af != resp[1]->ai_family)
730 					continue;
731 
732 				if (memcmp(&last_dst, resp[1]->ai_addr,
733 				    sizeof(last_dst)) == 0)
734 					continue;
735 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
736 
737 				dests++;
738 
739 				copy_satopfaddr(&kill.src.addr.v.a.addr,
740 				    resp[1]->ai_addr);
741 
742 				if ((ret = pfctl_kill_states_h(pfh, &kill, &newkilled)) != 0)
743 					errc(1, ret, "DIOCKILLSTATES");
744 				killed += newkilled;
745 			}
746 			freeaddrinfo(res[1]);
747 		} else {
748 			if ((ret = pfctl_kill_states_h(pfh, &kill, &newkilled)) != 0)
749 				errc(1, ret, "DIOCKILLSTATES");
750 			killed += newkilled;
751 		}
752 	}
753 
754 	freeaddrinfo(res[0]);
755 
756 	if ((opts & PF_OPT_QUIET) == 0)
757 		fprintf(stderr, "killed %d states from %d sources and %d "
758 		    "destinations\n", killed, sources, dests);
759 }
760 
761 void
pfctl_gateway_kill_states(int dev,const char * iface,int opts)762 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
763 {
764 	struct pfctl_kill kill;
765 	struct addrinfo *res, *resp;
766 	struct sockaddr last_src;
767 	unsigned int newkilled;
768 	int killed = 0;
769 
770 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
771 		warnx("no gateway specified");
772 		usage();
773 	}
774 
775 	memset(&kill, 0, sizeof(kill));
776 	memset(&kill.rt_addr.addr.v.a.mask, 0xff,
777 	    sizeof(kill.rt_addr.addr.v.a.mask));
778 	memset(&last_src, 0xff, sizeof(last_src));
779 	if (iface != NULL && strlcpy(kill.ifname, iface,
780 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
781 		errx(1, "invalid interface: %s", iface);
782 
783 	if (opts & PF_OPT_KILLMATCH)
784 		kill.kill_match = true;
785 
786 	res = pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask,
787 	    (opts & PF_OPT_NODNS));
788 
789 	for (resp = res; resp; resp = resp->ai_next) {
790 		if (resp->ai_addr == NULL)
791 			continue;
792 		/* We get lots of duplicates.  Catch the easy ones */
793 		if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
794 			continue;
795 		last_src = *(struct sockaddr *)resp->ai_addr;
796 
797 		kill.af = resp->ai_family;
798 
799 		copy_satopfaddr(&kill.rt_addr.addr.v.a.addr,
800 		    resp->ai_addr);
801 		if (pfctl_kill_states_h(pfh, &kill, &newkilled))
802 			err(1, "DIOCKILLSTATES");
803 		killed += newkilled;
804 	}
805 
806 	freeaddrinfo(res);
807 
808 	if ((opts & PF_OPT_QUIET) == 0)
809 		fprintf(stderr, "killed %d states\n", killed);
810 }
811 
812 void
pfctl_label_kill_states(int dev,const char * iface,int opts)813 pfctl_label_kill_states(int dev, const char *iface, int opts)
814 {
815 	struct pfctl_kill kill;
816 	unsigned int killed;
817 	int ret;
818 
819 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
820 		warnx("no label specified");
821 		usage();
822 	}
823 	memset(&kill, 0, sizeof(kill));
824 	if (iface != NULL && strlcpy(kill.ifname, iface,
825 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
826 		errx(1, "invalid interface: %s", iface);
827 
828 	if (opts & PF_OPT_KILLMATCH)
829 		kill.kill_match = true;
830 
831 	if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
832 	    sizeof(kill.label))
833 		errx(1, "label too long: %s", state_kill[1]);
834 
835 	if ((ret = pfctl_kill_states_h(pfh, &kill, &killed)) != 0)
836 		errc(1, ret, "DIOCKILLSTATES");
837 
838 	if ((opts & PF_OPT_QUIET) == 0)
839 		fprintf(stderr, "killed %d states\n", killed);
840 }
841 
842 void
pfctl_id_kill_states(int dev,const char * iface,int opts)843 pfctl_id_kill_states(int dev, const char *iface, int opts)
844 {
845 	struct pfctl_kill kill;
846 	unsigned int killed;
847 	int ret;
848 
849 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
850 		warnx("no id specified");
851 		usage();
852 	}
853 
854 	memset(&kill, 0, sizeof(kill));
855 
856 	if (opts & PF_OPT_KILLMATCH)
857 		kill.kill_match = true;
858 
859 	if ((sscanf(state_kill[1], "%jx/%x",
860 	    &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
861 	}
862 	else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
863 		kill.cmp.creatorid = 0;
864 	} else {
865 		warnx("wrong id format specified");
866 		usage();
867 	}
868 	if (kill.cmp.id == 0) {
869 		warnx("cannot kill id 0");
870 		usage();
871 	}
872 
873 	if ((ret = pfctl_kill_states_h(pfh, &kill, &killed)) != 0)
874 		errc(1, ret, "DIOCKILLSTATES");
875 
876 	if ((opts & PF_OPT_QUIET) == 0)
877 		fprintf(stderr, "killed %d states\n", killed);
878 }
879 
880 void
pfctl_key_kill_states(int dev,const char * iface,int opts)881 pfctl_key_kill_states(int dev, const char *iface, int opts)
882 {
883 	struct pfctl_kill kill;
884 	char *s, *token, *tokens[4];
885 	struct protoent *p;
886 	u_int i, sidx, didx;
887 	int ret, killed;
888 
889 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
890 		warnx("no key specified");
891 		usage();
892 	}
893 	memset(&kill, 0, sizeof(kill));
894 
895 	if (iface != NULL &&
896 	    strlcpy(kill.ifname, iface, sizeof(kill.ifname)) >=
897 	    sizeof(kill.ifname))
898 		errx(1, "invalid interface: %s", iface);
899 
900 	s = strdup(state_kill[1]);
901 	if (!s)
902 		errx(1, "%s: strdup", __func__);
903 	i = 0;
904 	while ((token = strsep(&s, " \t")) != NULL)
905 		if (*token != '\0') {
906 			if (i < 4)
907 				tokens[i] = token;
908 			i++;
909 		}
910 	if (i != 4)
911 		errx(1, "%s: key must be "
912 		    "\"protocol host1:port1 direction host2:port2\" format",
913 		    __func__);
914 
915 	if ((p = getprotobyname(tokens[0])) == NULL)
916 		errx(1, "invalid protocol: %s", tokens[0]);
917 	kill.proto = p->p_proto;
918 
919 	if (strcmp(tokens[2], "->") == 0) {
920 		sidx = 1;
921 		didx = 3;
922 	} else if (strcmp(tokens[2], "<-") == 0) {
923 		sidx = 3;
924 		didx = 1;
925 	} else
926 		errx(1, "invalid direction: %s", tokens[2]);
927 
928 	if (pfctl_parse_host(tokens[sidx], &kill.src) == -1)
929 		errx(1, "invalid host: %s", tokens[sidx]);
930 	if (pfctl_parse_host(tokens[didx], &kill.dst) == -1)
931 		errx(1, "invalid host: %s", tokens[didx]);
932 
933 	if ((ret = pfctl_kill_states_h(pfh, &kill, &killed)) != 0)
934 		errc(1, ret, "DIOCKILLSTATES");
935 
936 	if ((opts & PF_OPT_QUIET) == 0)
937 		fprintf(stderr, "killed %d states\n", killed);
938 }
939 
940 int
pfctl_parse_host(char * str,struct pf_rule_addr * addr)941 pfctl_parse_host(char *str, struct pf_rule_addr *addr)
942 {
943 	char *s = NULL, *sbs, *sbe;
944 	struct addrinfo hints, *ai;
945 
946 	s = strdup(str);
947 	if (!s)
948 		errx(1, "pfctl_parse_host: strdup");
949 
950 	memset(&hints, 0, sizeof(hints));
951 	hints.ai_socktype = SOCK_DGRAM; /* dummy */
952 	hints.ai_flags = AI_NUMERICHOST;
953 
954 	if ((sbs = strchr(s, '[')) != NULL && (sbe = strrchr(s, ']')) != NULL) {
955 		hints.ai_family = AF_INET6;
956 		*(sbs++) = *sbe = '\0';
957 	} else if ((sbs = strchr(s, ':')) != NULL) {
958 		hints.ai_family = AF_INET;
959 		*(sbs++) = '\0';
960 	} else {
961 		/* Assume that no ':<number>' means port 0 */
962 	}
963 
964 	if (getaddrinfo(s, sbs, &hints, &ai) != 0)
965 		goto error;
966 
967 	copy_satopfaddr(&addr->addr.v.a.addr, ai->ai_addr);
968 	addr->port[0] = ai->ai_family == AF_INET6 ?
969 	    ((struct sockaddr_in6 *)ai->ai_addr)->sin6_port :
970 	    ((struct sockaddr_in *)ai->ai_addr)->sin_port;
971 	freeaddrinfo(ai);
972 	free(s);
973 
974 	memset(&addr->addr.v.a.mask, 0xff, sizeof(struct pf_addr));
975 	addr->port_op = PF_OP_EQ;
976 	addr->addr.type = PF_ADDR_ADDRMASK;
977 
978 	return (0);
979 
980 error:
981 	free(s);
982 	return (-1);
983 }
984 
985 int
pfctl_get_pool(int dev,struct pfctl_pool * pool,u_int32_t nr,u_int32_t ticket,int r_action,const char * anchorname,int which)986 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
987     u_int32_t ticket, int r_action, const char *anchorname, int which)
988 {
989 	struct pfioc_pooladdr pp;
990 	struct pf_pooladdr *pa;
991 	u_int32_t pnr, mpnr;
992 	int ret;
993 
994 	memset(&pp, 0, sizeof(pp));
995 	if ((ret = pfctl_get_addrs(pfh, ticket, nr, r_action, anchorname, &mpnr, which)) != 0) {
996 		warnc(ret, "DIOCGETADDRS");
997 		return (-1);
998 	}
999 
1000 	TAILQ_INIT(&pool->list);
1001 	for (pnr = 0; pnr < mpnr; ++pnr) {
1002 		if ((ret = pfctl_get_addr(pfh, ticket, nr, r_action, anchorname, pnr, &pp, which)) != 0) {
1003 			warnc(ret, "DIOCGETADDR");
1004 			return (-1);
1005 		}
1006 		pa = calloc(1, sizeof(struct pf_pooladdr));
1007 		if (pa == NULL)
1008 			err(1, "calloc");
1009 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
1010 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
1011 	}
1012 
1013 	return (0);
1014 }
1015 
1016 void
pfctl_move_pool(struct pfctl_pool * src,struct pfctl_pool * dst)1017 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
1018 {
1019 	struct pf_pooladdr *pa;
1020 
1021 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
1022 		TAILQ_REMOVE(&src->list, pa, entries);
1023 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
1024 	}
1025 }
1026 
1027 void
pfctl_clear_pool(struct pfctl_pool * pool)1028 pfctl_clear_pool(struct pfctl_pool *pool)
1029 {
1030 	struct pf_pooladdr *pa;
1031 
1032 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
1033 		TAILQ_REMOVE(&pool->list, pa, entries);
1034 		free(pa);
1035 	}
1036 }
1037 
1038 void
pfctl_print_eth_rule_counters(struct pfctl_eth_rule * rule,int opts)1039 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *rule, int opts)
1040 {
1041 	if (opts & PF_OPT_VERBOSE) {
1042 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1043 			    "Bytes: %-10llu]\n",
1044 			    (unsigned long long)rule->evaluations,
1045 			    (unsigned long long)(rule->packets[0] +
1046 			    rule->packets[1]),
1047 			    (unsigned long long)(rule->bytes[0] +
1048 			    rule->bytes[1]));
1049 	}
1050 	if (opts & PF_OPT_VERBOSE2) {
1051 		char timestr[30];
1052 
1053 		if (rule->last_active_timestamp != 0) {
1054 			bcopy(ctime(&rule->last_active_timestamp), timestr,
1055 			    sizeof(timestr));
1056 			*strchr(timestr, '\n') = '\0';
1057 		} else {
1058 			snprintf(timestr, sizeof(timestr), "N/A");
1059 		}
1060 		printf("  [ Last Active Time: %s ]\n", timestr);
1061 	}
1062 }
1063 
1064 void
pfctl_print_rule_counters(struct pfctl_rule * rule,int opts)1065 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
1066 {
1067 	if (opts & PF_OPT_DEBUG) {
1068 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
1069 		    "p", "sa", "da", "sp", "dp" };
1070 		int i;
1071 
1072 		printf("  [ Skip steps: ");
1073 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
1074 			if (rule->skip[i].nr == rule->nr + 1)
1075 				continue;
1076 			printf("%s=", t[i]);
1077 			if (rule->skip[i].nr == -1)
1078 				printf("end ");
1079 			else
1080 				printf("%u ", rule->skip[i].nr);
1081 		}
1082 		printf("]\n");
1083 
1084 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1085 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
1086 	}
1087 	if (opts & PF_OPT_VERBOSE) {
1088 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1089 			    "Bytes: %-10llu  States: %-6ju]\n",
1090 			    (unsigned long long)rule->evaluations,
1091 			    (unsigned long long)(rule->packets[0] +
1092 			    rule->packets[1]),
1093 			    (unsigned long long)(rule->bytes[0] +
1094 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
1095 		printf("  [ Source Nodes: %-6ju "
1096 			    "Limit: %-6ju "
1097 			    "NAT/RDR: %-6ju "
1098 			    "Route: %-6ju "
1099 			    "]\n",
1100 			    (uintmax_t)rule->src_nodes,
1101 			    (uintmax_t)rule->src_nodes_type[PF_SN_LIMIT],
1102 			    (uintmax_t)rule->src_nodes_type[PF_SN_NAT],
1103 			    (uintmax_t)rule->src_nodes_type[PF_SN_ROUTE]);
1104 		if (!(opts & PF_OPT_DEBUG))
1105 			printf("  [ Inserted: uid %u pid %u "
1106 			    "State Creations: %-6ju]\n",
1107 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
1108 			    (uintmax_t)rule->states_tot);
1109 	}
1110 	if (opts & PF_OPT_VERBOSE2) {
1111 		char timestr[30];
1112 		if (rule->last_active_timestamp != 0) {
1113 			bcopy(ctime(&rule->last_active_timestamp), timestr,
1114 			    sizeof(timestr));
1115 			*strchr(timestr, '\n') = '\0';
1116 		} else {
1117 			snprintf(timestr, sizeof(timestr), "N/A");
1118 		}
1119 		printf("  [ Last Active Time: %s ]\n", timestr);
1120 	}
1121 }
1122 
1123 void
pfctl_print_title(char * title)1124 pfctl_print_title(char *title)
1125 {
1126 	if (!first_title)
1127 		printf("\n");
1128 	first_title = 0;
1129 	printf("%s\n", title);
1130 }
1131 
1132 int
pfctl_show_eth_rules(int dev,char * path,int opts,enum pfctl_show format,char * anchorname,int depth,int wildcard)1133 pfctl_show_eth_rules(int dev, char *path, int opts, enum pfctl_show format,
1134     char *anchorname, int depth, int wildcard)
1135 {
1136 	char anchor_call[MAXPATHLEN];
1137 	struct pfctl_eth_rules_info info;
1138 	struct pfctl_eth_rule rule;
1139 	int brace;
1140 	int dotitle = opts & PF_OPT_SHOWALL;
1141 	int len = strlen(path);
1142 	int ret;
1143 	char *npath, *p;
1144 
1145 	/*
1146 	 * Truncate a trailing / and * on an anchorname before searching for
1147 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1148 	 * to the kernel.
1149 	 */
1150 	if ((p = strrchr(anchorname, '/')) != NULL &&
1151 			p[1] == '*' && p[2] == '\0') {
1152 		p[0] = '\0';
1153 	}
1154 
1155 	if (anchorname[0] == '/') {
1156 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1157 			errx(1, "calloc");
1158 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1159 	} else {
1160 		if (path[0])
1161 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1162 		else
1163 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1164 		npath = path;
1165 	}
1166 
1167 	/*
1168 	 * If this anchor was called with a wildcard path, go through
1169 	 * the rulesets in the anchor rather than the rules.
1170 	 */
1171 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1172 		struct pfctl_eth_rulesets_info	ri;
1173 		u_int32_t                mnr, nr;
1174 
1175 		if ((ret = pfctl_get_eth_rulesets_info(dev, &ri, npath)) != 0) {
1176 			if (ret == EINVAL) {
1177 				fprintf(stderr, "Anchor '%s' "
1178 						"not found.\n", anchorname);
1179 			} else {
1180 				warnc(ret, "DIOCGETETHRULESETS");
1181 				return (-1);
1182 			}
1183 		}
1184 		mnr = ri.nr;
1185 
1186 		pfctl_print_eth_rule_counters(&rule, opts);
1187 		for (nr = 0; nr < mnr; ++nr) {
1188 			struct pfctl_eth_ruleset_info	rs;
1189 
1190 			if ((ret = pfctl_get_eth_ruleset(dev, npath, nr, &rs)) != 0)
1191 				errc(1, ret, "DIOCGETETHRULESET");
1192 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1193 			printf("anchor \"%s\" all {\n", rs.name);
1194 			pfctl_show_eth_rules(dev, npath, opts,
1195 					format, rs.name, depth + 1, 0);
1196 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1197 			printf("}\n");
1198 		}
1199 		path[len] = '\0';
1200 		return (0);
1201 	}
1202 
1203 	if ((ret = pfctl_get_eth_rules_info(dev, &info, path)) != 0) {
1204 		warnc(ret, "DIOCGETETHRULES");
1205 		return (-1);
1206 	}
1207 	for (int nr = 0; nr < info.nr; nr++) {
1208 		brace = 0;
1209 		INDENT(depth, !(opts & PF_OPT_VERBOSE));
1210 		if ((ret = pfctl_get_eth_rule(dev, nr, info.ticket, path, &rule,
1211 		    opts & PF_OPT_CLRRULECTRS, anchor_call)) != 0) {
1212 			warnc(ret, "DIOCGETETHRULE");
1213 			return (-1);
1214 		}
1215 		if (anchor_call[0] &&
1216 		   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1217 		   (p == anchor_call ||
1218 		   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1219 			brace++;
1220 			int aclen = strlen(anchor_call);
1221 			if (anchor_call[aclen - 1] == '*')
1222 				anchor_call[aclen - 2] = '\0';
1223 		}
1224 		p = &anchor_call[0];
1225 		if (dotitle) {
1226 			pfctl_print_title("ETH RULES:");
1227 			dotitle = 0;
1228 		}
1229 		print_eth_rule(&rule, anchor_call,
1230 		    opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1231 		if (brace)
1232 			printf(" {\n");
1233 		else
1234 			printf("\n");
1235 		pfctl_print_eth_rule_counters(&rule, opts);
1236 		if (brace) {
1237 			pfctl_show_eth_rules(dev, path, opts, format,
1238 			    p, depth + 1, rule.anchor_wildcard);
1239 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1240 			printf("}\n");
1241 		}
1242 	}
1243 
1244 	path[len] = '\0';
1245 	return (0);
1246 }
1247 
1248 int
pfctl_show_rules(int dev,char * path,int opts,enum pfctl_show format,char * anchorname,int depth,int wildcard)1249 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1250     char *anchorname, int depth, int wildcard)
1251 {
1252 	struct pfctl_rules_info ri;
1253 	struct pfctl_rule rule;
1254 	char anchor_call[MAXPATHLEN];
1255 	u_int32_t nr, header = 0;
1256 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1257 	int numeric = opts & PF_OPT_NUMERIC;
1258 	int len = strlen(path), ret = 0;
1259 	char *npath, *p;
1260 
1261 	/*
1262 	 * Truncate a trailing / and * on an anchorname before searching for
1263 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1264 	 * to the kernel.
1265 	 */
1266 	if ((p = strrchr(anchorname, '/')) != NULL &&
1267 	    p[1] == '*' && p[2] == '\0') {
1268 		p[0] = '\0';
1269 	}
1270 
1271 	if (anchorname[0] == '/') {
1272 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1273 			errx(1, "calloc");
1274 		strlcpy(npath, anchorname, MAXPATHLEN);
1275 	} else {
1276 		if (path[0])
1277 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1278 		else
1279 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1280 		npath = path;
1281 	}
1282 
1283 	/*
1284 	 * If this anchor was called with a wildcard path, go through
1285 	 * the rulesets in the anchor rather than the rules.
1286 	 */
1287 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1288 		struct pfioc_ruleset     prs;
1289 		u_int32_t                mnr, nr;
1290 
1291 		memset(&prs, 0, sizeof(prs));
1292 		if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) {
1293 			if (ret == EINVAL)
1294 				fprintf(stderr, "Anchor '%s' "
1295 				    "not found.\n", anchorname);
1296 			else
1297 				errc(1, ret, "DIOCGETRULESETS");
1298 		}
1299 
1300 		for (nr = 0; nr < mnr; ++nr) {
1301 			if ((ret = pfctl_get_ruleset(pfh, npath, nr, &prs)) != 0)
1302 				errc(1, ret, "DIOCGETRULESET");
1303 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1304 			printf("anchor \"%s\" all {\n", prs.name);
1305 			pfctl_show_rules(dev, npath, opts,
1306 			    format, prs.name, depth + 1, 0);
1307 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1308 			printf("}\n");
1309 		}
1310 		path[len] = '\0';
1311 		return (0);
1312 	}
1313 
1314 	if (opts & PF_OPT_SHOWALL) {
1315 		ret = pfctl_get_rules_info_h(pfh, &ri, PF_PASS, path);
1316 		if (ret != 0) {
1317 			warnc(ret, "DIOCGETRULES");
1318 			goto error;
1319 		}
1320 		header++;
1321 	}
1322 	ret = pfctl_get_rules_info_h(pfh, &ri, PF_SCRUB, path);
1323 	if (ret != 0) {
1324 		warnc(ret, "DIOCGETRULES");
1325 		goto error;
1326 	}
1327 	if (opts & PF_OPT_SHOWALL) {
1328 		if (format == PFCTL_SHOW_RULES && (ri.nr > 0 || header))
1329 			pfctl_print_title("FILTER RULES:");
1330 		else if (format == PFCTL_SHOW_LABELS && labels)
1331 			pfctl_print_title("LABEL COUNTERS:");
1332 	}
1333 
1334 	for (nr = 0; nr < ri.nr; ++nr) {
1335 		if ((ret = pfctl_get_clear_rule_h(pfh, nr, ri.ticket, path, PF_SCRUB,
1336 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) != 0) {
1337 			warnc(ret, "DIOCGETRULENV");
1338 			goto error;
1339 		}
1340 
1341 		if (pfctl_get_pool(dev, &rule.rdr,
1342 		    nr, ri.ticket, PF_SCRUB, path, PF_RDR) != 0)
1343 			goto error;
1344 
1345 		if (pfctl_get_pool(dev, &rule.nat,
1346 		    nr, ri.ticket, PF_SCRUB, path, PF_NAT) != 0)
1347 			goto error;
1348 
1349 		if (pfctl_get_pool(dev, &rule.route,
1350 		    nr, ri.ticket, PF_SCRUB, path, PF_RT) != 0)
1351 			goto error;
1352 
1353 		switch (format) {
1354 		case PFCTL_SHOW_LABELS:
1355 			break;
1356 		case PFCTL_SHOW_RULES:
1357 			if (rule.label[0][0] && (opts & PF_OPT_SHOWALL))
1358 				labels = 1;
1359 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1360 			printf("\n");
1361 			pfctl_print_rule_counters(&rule, opts);
1362 			break;
1363 		case PFCTL_SHOW_NOTHING:
1364 			break;
1365 		}
1366 		pfctl_clear_pool(&rule.rdr);
1367 		pfctl_clear_pool(&rule.nat);
1368 		pfctl_clear_pool(&rule.route);
1369 	}
1370 	ret = pfctl_get_rules_info_h(pfh, &ri, PF_PASS, path);
1371 	if (ret != 0) {
1372 		warnc(ret, "DIOCGETRULES");
1373 		goto error;
1374 	}
1375 	for (nr = 0; nr < ri.nr; ++nr) {
1376 		if ((ret = pfctl_get_clear_rule_h(pfh, nr, ri.ticket, path, PF_PASS,
1377 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) != 0) {
1378 			warnc(ret, "DIOCGETRULE");
1379 			goto error;
1380 		}
1381 
1382 		if (pfctl_get_pool(dev, &rule.rdr,
1383 		    nr, ri.ticket, PF_PASS, path, PF_RDR) != 0)
1384 			goto error;
1385 
1386 		if (pfctl_get_pool(dev, &rule.nat,
1387 		    nr, ri.ticket, PF_PASS, path, PF_NAT) != 0)
1388 			goto error;
1389 
1390 		if (pfctl_get_pool(dev, &rule.route,
1391 		    nr, ri.ticket, PF_PASS, path, PF_RT) != 0)
1392 			goto error;
1393 
1394 		switch (format) {
1395 		case PFCTL_SHOW_LABELS: {
1396 			bool show = false;
1397 			int i = 0;
1398 
1399 			while (rule.label[i][0]) {
1400 				printf("%s ", rule.label[i++]);
1401 				show = true;
1402 			}
1403 
1404 			if (show) {
1405 				printf("%llu %llu %llu %llu"
1406 				    " %llu %llu %llu %ju\n",
1407 				    (unsigned long long)rule.evaluations,
1408 				    (unsigned long long)(rule.packets[0] +
1409 				    rule.packets[1]),
1410 				    (unsigned long long)(rule.bytes[0] +
1411 				    rule.bytes[1]),
1412 				    (unsigned long long)rule.packets[0],
1413 				    (unsigned long long)rule.bytes[0],
1414 				    (unsigned long long)rule.packets[1],
1415 				    (unsigned long long)rule.bytes[1],
1416 				    (uintmax_t)rule.states_tot);
1417 			}
1418 
1419 			if (anchor_call[0] &&
1420 			    (((p = strrchr(anchor_call, '/')) ?
1421 			      p[1] == '_' : anchor_call[0] == '_') ||
1422 			     opts & PF_OPT_RECURSE)) {
1423 				pfctl_show_rules(dev, npath, opts, format,
1424 				    anchor_call, depth, rule.anchor_wildcard);
1425 			}
1426 			break;
1427 		}
1428 		case PFCTL_SHOW_RULES:
1429 			if (rule.label[0][0] && (opts & PF_OPT_SHOWALL))
1430 				labels = 1;
1431 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1432 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1433 
1434 			/*
1435 			 * If this is a 'unnamed' brace notation
1436 			 * anchor, OR the user has explicitly requested
1437 			 * recursion, print it recursively.
1438 			 */
1439 			if (anchor_call[0] &&
1440 			    (((p = strrchr(anchor_call, '/')) ?
1441 			      p[1] == '_' : anchor_call[0] == '_') ||
1442 			     opts & PF_OPT_RECURSE)) {
1443 				printf(" {\n");
1444 				pfctl_print_rule_counters(&rule, opts);
1445 				pfctl_show_rules(dev, npath, opts, format,
1446 				    anchor_call, depth + 1,
1447 				    rule.anchor_wildcard);
1448 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1449 				printf("}\n");
1450 			} else {
1451 				printf("\n");
1452 				pfctl_print_rule_counters(&rule, opts);
1453 			}
1454 			break;
1455 		case PFCTL_SHOW_NOTHING:
1456 			break;
1457 		}
1458 		pfctl_clear_pool(&rule.rdr);
1459 		pfctl_clear_pool(&rule.nat);
1460 	}
1461 
1462  error:
1463 	path[len] = '\0';
1464 	return (ret);
1465 }
1466 
1467 int
pfctl_show_nat(int dev,const char * path,int opts,char * anchorname,int depth,int wildcard)1468 pfctl_show_nat(int dev, const char *path, int opts, char *anchorname, int depth,
1469     int wildcard)
1470 {
1471 	struct pfctl_rules_info ri;
1472 	struct pfctl_rule rule;
1473 	char anchor_call[MAXPATHLEN];
1474 	u_int32_t nr;
1475 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1476 	int i, dotitle = opts & PF_OPT_SHOWALL;
1477 	int ret;
1478 	int len = strlen(path);
1479 	char *npath, *p;
1480 
1481 	/*
1482 	 * Truncate a trailing / and * on an anchorname before searching for
1483 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1484 	 * to the kernel.
1485 	 */
1486 	if ((p = strrchr(anchorname, '/')) != NULL &&
1487 	    p[1] == '*' && p[2] == '\0') {
1488 		p[0] = '\0';
1489 	}
1490 
1491 	if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1492 		errx(1, "calloc");
1493 
1494 	if (anchorname[0] == '/') {
1495 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1496 	} else {
1497 		snprintf(npath, MAXPATHLEN, "%s", path);
1498 		if (npath[0])
1499 			snprintf(&npath[len], MAXPATHLEN - len, "/%s", anchorname);
1500 		else
1501 			snprintf(&npath[len], MAXPATHLEN - len, "%s", anchorname);
1502 	}
1503 
1504 	/*
1505 	 * If this anchor was called with a wildcard path, go through
1506 	 * the rulesets in the anchor rather than the rules.
1507 	 */
1508 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1509 		struct pfioc_ruleset     prs;
1510 		u_int32_t                mnr, nr;
1511 		memset(&prs, 0, sizeof(prs));
1512 		if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) {
1513 			if (ret == EINVAL)
1514 				fprintf(stderr, "NAT anchor '%s' "
1515 				    "not found.\n", anchorname);
1516 			else
1517 				errc(1, ret, "DIOCGETRULESETS");
1518 		}
1519 
1520 		for (nr = 0; nr < mnr; ++nr) {
1521 			if ((ret = pfctl_get_ruleset(pfh, npath, nr, &prs)) != 0)
1522 				errc(1, ret, "DIOCGETRULESET");
1523 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1524 			printf("nat-anchor \"%s\" all {\n", prs.name);
1525 			pfctl_show_nat(dev, npath, opts,
1526 			    prs.name, depth + 1, 0);
1527 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1528 			printf("}\n");
1529 		}
1530 		npath[len] = '\0';
1531 		return (0);
1532 	}
1533 
1534 	for (i = 0; i < 3; i++) {
1535 		ret = pfctl_get_rules_info_h(pfh, &ri, nattype[i], npath);
1536 		if (ret != 0) {
1537 			warnc(ret, "DIOCGETRULES");
1538 			return (-1);
1539 		}
1540 		for (nr = 0; nr < ri.nr; ++nr) {
1541 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1542 
1543 			if ((ret = pfctl_get_rule_h(pfh, nr, ri.ticket, npath,
1544 			    nattype[i], &rule, anchor_call)) != 0) {
1545 				warnc(ret, "DIOCGETRULE");
1546 				return (-1);
1547 			}
1548 			if (pfctl_get_pool(dev, &rule.rdr, nr,
1549 			    ri.ticket, nattype[i], npath, PF_RDR) != 0)
1550 				return (-1);
1551 			if (pfctl_get_pool(dev, &rule.nat, nr,
1552 			    ri.ticket, nattype[i], npath, PF_NAT) != 0)
1553 				return (-1);
1554 			if (pfctl_get_pool(dev, &rule.route, nr,
1555 			    ri.ticket, nattype[i], npath, PF_RT) != 0)
1556 				return (-1);
1557 
1558 			if (dotitle) {
1559 				pfctl_print_title("TRANSLATION RULES:");
1560 				dotitle = 0;
1561 			}
1562 			print_rule(&rule, anchor_call,
1563 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1564 			if (anchor_call[0] &&
1565 			    (((p = strrchr(anchor_call, '/')) ?
1566 			      p[1] == '_' : anchor_call[0] == '_') ||
1567 			     opts & PF_OPT_RECURSE)) {
1568 				printf(" {\n");
1569 				pfctl_print_rule_counters(&rule, opts);
1570 				pfctl_show_nat(dev, npath, opts, anchor_call,
1571 				    depth + 1, rule.anchor_wildcard);
1572 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1573 				printf("}\n");
1574 			} else {
1575 				printf("\n");
1576 				pfctl_print_rule_counters(&rule, opts);
1577 			}
1578 		}
1579 	}
1580 	return (0);
1581 }
1582 
1583 static int
pfctl_print_src_node(struct pfctl_src_node * sn,void * arg)1584 pfctl_print_src_node(struct pfctl_src_node *sn, void *arg)
1585 {
1586 	int *opts = (int *)arg;
1587 
1588 	if (*opts & PF_OPT_SHOWALL) {
1589 		pfctl_print_title("SOURCE TRACKING NODES:");
1590 		*opts &= ~PF_OPT_SHOWALL;
1591 	}
1592 
1593 	print_src_node(sn, *opts);
1594 
1595 	return (0);
1596 }
1597 
1598 int
pfctl_show_src_nodes(int dev,int opts)1599 pfctl_show_src_nodes(int dev, int opts)
1600 {
1601 	int error;
1602 
1603 	error = pfctl_get_srcnodes(pfh, pfctl_print_src_node, &opts);
1604 
1605 	return (error);
1606 }
1607 
1608 struct pfctl_show_state_arg {
1609 	int opts;
1610 	int dotitle;
1611 	const char *iface;
1612 };
1613 
1614 static int
pfctl_show_state(struct pfctl_state * s,void * arg)1615 pfctl_show_state(struct pfctl_state *s, void *arg)
1616 {
1617 	struct pfctl_show_state_arg *a = (struct pfctl_show_state_arg *)arg;
1618 
1619 	if (a->dotitle) {
1620 		pfctl_print_title("STATES:");
1621 		a->dotitle = 0;
1622 	}
1623 	print_state(s, a->opts);
1624 
1625 	return (0);
1626 }
1627 
1628 int
pfctl_show_states(int dev,const char * iface,int opts)1629 pfctl_show_states(int dev, const char *iface, int opts)
1630 {
1631 	struct pfctl_show_state_arg arg;
1632 	struct pfctl_state_filter filter = {};
1633 
1634 	if (iface != NULL)
1635 		strlcpy(filter.ifname, iface, IFNAMSIZ);
1636 
1637 	arg.opts = opts;
1638 	arg.dotitle = opts & PF_OPT_SHOWALL;
1639 	arg.iface = iface;
1640 
1641 	if (pfctl_get_filtered_states_iter(&filter, pfctl_show_state, &arg))
1642 		return (-1);
1643 
1644 	return (0);
1645 }
1646 
1647 int
pfctl_show_status(int dev,int opts)1648 pfctl_show_status(int dev, int opts)
1649 {
1650 	struct pfctl_status	*status;
1651 	struct pfctl_syncookies	cookies;
1652 	int ret;
1653 
1654 	if ((status = pfctl_get_status_h(pfh)) == NULL) {
1655 		warn("DIOCGETSTATUS");
1656 		return (-1);
1657 	}
1658 	if ((ret = pfctl_get_syncookies(dev, &cookies)) != 0) {
1659 		pfctl_free_status(status);
1660 		warnc(ret, "DIOCGETSYNCOOKIES");
1661 		return (-1);
1662 	}
1663 	if (opts & PF_OPT_SHOWALL)
1664 		pfctl_print_title("INFO:");
1665 	print_status(status, &cookies, opts);
1666 	pfctl_free_status(status);
1667 	return (0);
1668 }
1669 
1670 int
pfctl_show_running(int dev)1671 pfctl_show_running(int dev)
1672 {
1673 	struct pfctl_status *status;
1674 	int running;
1675 
1676 	if ((status = pfctl_get_status_h(pfh)) == NULL) {
1677 		warn("DIOCGETSTATUS");
1678 		return (-1);
1679 	}
1680 
1681 	running = status->running;
1682 
1683 	print_running(status);
1684 	pfctl_free_status(status);
1685 	return (!running);
1686 }
1687 
1688 int
pfctl_show_timeouts(int dev,int opts)1689 pfctl_show_timeouts(int dev, int opts)
1690 {
1691 	uint32_t seconds;
1692 	int i;
1693 	int ret;
1694 
1695 	if (opts & PF_OPT_SHOWALL)
1696 		pfctl_print_title("TIMEOUTS:");
1697 	for (i = 0; pf_timeouts[i].name; i++) {
1698 		if ((ret = pfctl_get_timeout(pfh, pf_timeouts[i].timeout, &seconds)) != 0)
1699 			errc(1, ret, "DIOCGETTIMEOUT");
1700 		printf("%-20s %10d", pf_timeouts[i].name, seconds);
1701 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1702 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1703 			printf(" states");
1704 		else
1705 			printf("s");
1706 		printf("\n");
1707 	}
1708 	return (0);
1709 
1710 }
1711 
1712 int
pfctl_show_limits(int dev,int opts)1713 pfctl_show_limits(int dev, int opts)
1714 {
1715 	unsigned int limit;
1716 	int i;
1717 	int ret;
1718 
1719 	if (opts & PF_OPT_SHOWALL)
1720 		pfctl_print_title("LIMITS:");
1721 	for (i = 0; pf_limits[i].name; i++) {
1722 		if ((ret = pfctl_get_limit(pfh, pf_limits[i].index, &limit)) != 0)
1723 			errc(1, ret, "DIOCGETLIMIT");
1724 		printf("%-13s ", pf_limits[i].name);
1725 		if (limit == UINT_MAX)
1726 			printf("unlimited\n");
1727 		else
1728 			printf("hard limit %8u\n", limit);
1729 	}
1730 	return (0);
1731 }
1732 
1733 void
pfctl_show_creators(int opts)1734 pfctl_show_creators(int opts)
1735 {
1736 	int ret;
1737 	uint32_t creators[16];
1738 	size_t count = nitems(creators);
1739 
1740 	ret = pfctl_get_creatorids(pfh, creators, &count);
1741 	if (ret != 0)
1742 		errx(ret, "Failed to retrieve creators");
1743 
1744 	printf("Creator IDs:\n");
1745 	for (size_t i = 0; i < count; i++)
1746 		printf("%08x\n", creators[i]);
1747 }
1748 
1749 /* callbacks for rule/nat/rdr/addr */
1750 int
pfctl_add_pool(struct pfctl * pf,struct pfctl_pool * p,sa_family_t af,int which)1751 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af, int which)
1752 {
1753 	struct pf_pooladdr *pa;
1754 	int ret;
1755 
1756 	pf->paddr.af = af;
1757 	TAILQ_FOREACH(pa, &p->list, entries) {
1758 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1759 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1760 			if ((ret = pfctl_add_addr(pf->h, &pf->paddr, which)) != 0)
1761 				errc(1, ret, "DIOCADDADDR");
1762 		}
1763 	}
1764 	return (0);
1765 }
1766 
1767 void
pfctl_init_rule(struct pfctl_rule * r)1768 pfctl_init_rule(struct pfctl_rule *r)
1769 {
1770 	memset(r, 0, sizeof(struct pfctl_rule));
1771 	TAILQ_INIT(&(r->rdr.list));
1772 	TAILQ_INIT(&(r->nat.list));
1773 	TAILQ_INIT(&(r->route.list));
1774 }
1775 
1776 int
pfctl_append_rule(struct pfctl * pf,struct pfctl_rule * r,const char * anchor_call)1777 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1778     const char *anchor_call)
1779 {
1780 	u_int8_t		rs_num;
1781 	struct pfctl_rule	*rule;
1782 	struct pfctl_ruleset	*rs;
1783 	char 			*p;
1784 
1785 	rs_num = pf_get_ruleset_number(r->action);
1786 	if (rs_num == PF_RULESET_MAX)
1787 		errx(1, "Invalid rule type %d", r->action);
1788 
1789 	rs = &pf->anchor->ruleset;
1790 
1791 	if (anchor_call[0] && r->anchor == NULL) {
1792 		/*
1793 		 * Don't make non-brace anchors part of the main anchor pool.
1794 		 */
1795 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1796 			err(1, "pfctl_append_rule: calloc");
1797 
1798 		pf_init_ruleset(&r->anchor->ruleset);
1799 		r->anchor->ruleset.anchor = r->anchor;
1800 		if (strlcpy(r->anchor->path, anchor_call,
1801 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1802 			errx(1, "pfctl_append_rule: strlcpy");
1803 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1804 			if (!strlen(p))
1805 				err(1, "pfctl_append_rule: bad anchor name %s",
1806 				    anchor_call);
1807 		} else
1808 			p = (char *)anchor_call;
1809 		if (strlcpy(r->anchor->name, p,
1810 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1811 			errx(1, "pfctl_append_rule: strlcpy");
1812 	}
1813 
1814 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1815 		err(1, "calloc");
1816 	bcopy(r, rule, sizeof(*rule));
1817 	TAILQ_INIT(&rule->rdr.list);
1818 	pfctl_move_pool(&r->rdr, &rule->rdr);
1819 	TAILQ_INIT(&rule->nat.list);
1820 	pfctl_move_pool(&r->nat, &rule->nat);
1821 	TAILQ_INIT(&rule->route.list);
1822 	pfctl_move_pool(&r->route, &rule->route);
1823 
1824 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1825 	return (0);
1826 }
1827 
1828 int
pfctl_append_eth_rule(struct pfctl * pf,struct pfctl_eth_rule * r,const char * anchor_call)1829 pfctl_append_eth_rule(struct pfctl *pf, struct pfctl_eth_rule *r,
1830     const char *anchor_call)
1831 {
1832 	struct pfctl_eth_rule		*rule;
1833 	struct pfctl_eth_ruleset	*rs;
1834 	char 				*p;
1835 
1836 	rs = &pf->eanchor->ruleset;
1837 
1838 	if (anchor_call[0] && r->anchor == NULL) {
1839 		/*
1840 		 * Don't make non-brace anchors part of the main anchor pool.
1841 		 */
1842 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1843 			err(1, "pfctl_append_rule: calloc");
1844 
1845 		pf_init_eth_ruleset(&r->anchor->ruleset);
1846 		r->anchor->ruleset.anchor = r->anchor;
1847 		if (strlcpy(r->anchor->path, anchor_call,
1848 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1849 			errx(1, "pfctl_append_rule: strlcpy");
1850 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1851 			if (!strlen(p))
1852 				err(1, "pfctl_append_eth_rule: bad anchor name %s",
1853 				    anchor_call);
1854 		} else
1855 			p = (char *)anchor_call;
1856 		if (strlcpy(r->anchor->name, p,
1857 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1858 			errx(1, "pfctl_append_eth_rule: strlcpy");
1859 	}
1860 
1861 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1862 		err(1, "calloc");
1863 	bcopy(r, rule, sizeof(*rule));
1864 
1865 	TAILQ_INSERT_TAIL(&rs->rules, rule, entries);
1866 	return (0);
1867 }
1868 
1869 int
pfctl_eth_ruleset_trans(struct pfctl * pf,char * path,struct pfctl_eth_anchor * a)1870 pfctl_eth_ruleset_trans(struct pfctl *pf, char *path,
1871     struct pfctl_eth_anchor *a)
1872 {
1873 	int osize = pf->trans->pfrb_size;
1874 
1875 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0) {
1876 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1877 			return (1);
1878 	}
1879 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1880 		return (5);
1881 
1882 	return (0);
1883 }
1884 
1885 int
pfctl_ruleset_trans(struct pfctl * pf,char * path,struct pfctl_anchor * a,bool do_eth)1886 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a, bool do_eth)
1887 {
1888 	int osize = pf->trans->pfrb_size;
1889 
1890 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0 && do_eth) {
1891 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1892 			return (1);
1893 	}
1894 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1895 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1896 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1897 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1898 			return (1);
1899 	}
1900 	if (a == pf->astack[0] && ((altqsupport &&
1901 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1902 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1903 			return (2);
1904 	}
1905 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1906 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1907 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1908 			return (3);
1909 	}
1910 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1911 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1912 			return (4);
1913 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1914 		return (5);
1915 
1916 	return (0);
1917 }
1918 
1919 int
pfctl_load_eth_ruleset(struct pfctl * pf,char * path,struct pfctl_eth_ruleset * rs,int depth)1920 pfctl_load_eth_ruleset(struct pfctl *pf, char *path,
1921     struct pfctl_eth_ruleset *rs, int depth)
1922 {
1923 	struct pfctl_eth_rule	*r;
1924 	int	error, len = strlen(path);
1925 	int	brace = 0;
1926 
1927 	pf->eanchor = rs->anchor;
1928 	if (path[0])
1929 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->eanchor->name);
1930 	else
1931 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->eanchor->name);
1932 
1933 	if (depth) {
1934 		if (TAILQ_FIRST(&rs->rules) != NULL) {
1935 			brace++;
1936 			if (pf->opts & PF_OPT_VERBOSE)
1937 				printf(" {\n");
1938 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1939 			    (error = pfctl_eth_ruleset_trans(pf,
1940 			    path, rs->anchor))) {
1941 				printf("pfctl_load_eth_rulesets: "
1942 				    "pfctl_eth_ruleset_trans %d\n", error);
1943 				goto error;
1944 			}
1945 		} else if (pf->opts & PF_OPT_VERBOSE)
1946 			printf("\n");
1947 	}
1948 
1949 	while ((r = TAILQ_FIRST(&rs->rules)) != NULL) {
1950 		TAILQ_REMOVE(&rs->rules, r, entries);
1951 
1952 		error = pfctl_load_eth_rule(pf, path, r, depth);
1953 		if (error)
1954 			return (error);
1955 
1956 		if (r->anchor) {
1957 			if ((error = pfctl_load_eth_ruleset(pf, path,
1958 			    &r->anchor->ruleset, depth + 1)))
1959 				return (error);
1960 		} else if (pf->opts & PF_OPT_VERBOSE)
1961 			printf("\n");
1962 		free(r);
1963 	}
1964 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1965 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1966 		printf("}\n");
1967 	}
1968 	path[len] = '\0';
1969 
1970 	return (0);
1971 error:
1972 	path[len] = '\0';
1973 	return (error);
1974 }
1975 
1976 int
pfctl_load_eth_rule(struct pfctl * pf,char * path,struct pfctl_eth_rule * r,int depth)1977 pfctl_load_eth_rule(struct pfctl *pf, char *path, struct pfctl_eth_rule *r,
1978     int depth)
1979 {
1980 	char			*name;
1981 	char			anchor[PF_ANCHOR_NAME_SIZE];
1982 	int			len = strlen(path);
1983 	int			ret;
1984 
1985 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1986 		errx(1, "pfctl_load_eth_rule: strlcpy");
1987 
1988 	if (r->anchor) {
1989 		if (r->anchor->match) {
1990 			if (path[0])
1991 				snprintf(&path[len], MAXPATHLEN - len,
1992 				    "/%s", r->anchor->name);
1993 			else
1994 				snprintf(&path[len], MAXPATHLEN - len,
1995 				    "%s", r->anchor->name);
1996 			name = r->anchor->name;
1997 		} else
1998 			name = r->anchor->path;
1999 	} else
2000 		name = "";
2001 
2002 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2003 		if ((ret = pfctl_add_eth_rule(pf->dev, r, anchor, name,
2004 		    pf->eth_ticket)) != 0)
2005 			errc(1, ret, "DIOCADDETHRULENV");
2006 
2007 	if (pf->opts & PF_OPT_VERBOSE) {
2008 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
2009 		print_eth_rule(r, r->anchor ? r->anchor->name : "",
2010 		    pf->opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
2011 	}
2012 
2013 	path[len] = '\0';
2014 
2015 	return (0);
2016 }
2017 
2018 int
pfctl_load_ruleset(struct pfctl * pf,char * path,struct pfctl_ruleset * rs,int rs_num,int depth)2019 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
2020     int rs_num, int depth)
2021 {
2022 	struct pfctl_rule *r;
2023 	int		error, len = strlen(path);
2024 	int		brace = 0;
2025 
2026 	pf->anchor = rs->anchor;
2027 
2028 	if (path[0])
2029 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
2030 	else
2031 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
2032 
2033 	if (depth) {
2034 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
2035 			brace++;
2036 			if (pf->opts & PF_OPT_VERBOSE)
2037 				printf(" {\n");
2038 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
2039 			    (error = pfctl_ruleset_trans(pf,
2040 			    path, rs->anchor, false))) {
2041 				printf("pfctl_load_rulesets: "
2042 				    "pfctl_ruleset_trans %d\n", error);
2043 				goto error;
2044 			}
2045 		} else if (pf->opts & PF_OPT_VERBOSE)
2046 			printf("\n");
2047 	}
2048 
2049 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
2050 		pfctl_optimize_ruleset(pf, rs);
2051 
2052 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
2053 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
2054 
2055 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
2056 			expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
2057 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
2058 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
2059 
2060 		if ((error = pfctl_load_rule(pf, path, r, depth)))
2061 			goto error;
2062 		if (r->anchor) {
2063 			if ((error = pfctl_load_ruleset(pf, path,
2064 			    &r->anchor->ruleset, rs_num, depth + 1)))
2065 				goto error;
2066 		} else if (pf->opts & PF_OPT_VERBOSE)
2067 			printf("\n");
2068 		free(r);
2069 	}
2070 	if (brace && pf->opts & PF_OPT_VERBOSE) {
2071 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
2072 		printf("}\n");
2073 	}
2074 	path[len] = '\0';
2075 	return (0);
2076 
2077  error:
2078 	path[len] = '\0';
2079 	return (error);
2080 
2081 }
2082 
2083 int
pfctl_load_rule(struct pfctl * pf,char * path,struct pfctl_rule * r,int depth)2084 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
2085 {
2086 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
2087 	char			*name;
2088 	u_int32_t		ticket;
2089 	char			anchor[PF_ANCHOR_NAME_SIZE];
2090 	int			len = strlen(path);
2091 	int			error;
2092 	bool			was_present;
2093 
2094 	/* set up anchor before adding to path for anchor_call */
2095 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2096 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
2097 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
2098 		errx(1, "pfctl_load_rule: strlcpy");
2099 
2100 	if (r->anchor) {
2101 		if (r->anchor->match) {
2102 			if (path[0])
2103 				snprintf(&path[len], MAXPATHLEN - len,
2104 				    "/%s", r->anchor->name);
2105 			else
2106 				snprintf(&path[len], MAXPATHLEN - len,
2107 				    "%s", r->anchor->name);
2108 			name = r->anchor->name;
2109 		} else
2110 			name = r->anchor->path;
2111 	} else
2112 		name = "";
2113 
2114 	was_present = false;
2115 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2116 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
2117 			if ((error = pfctl_begin_addrs(pf->h,
2118 			    &pf->paddr.ticket)) != 0)
2119 				errc(1, error, "DIOCBEGINADDRS");
2120 		}
2121 
2122 		if (pfctl_add_pool(pf, &r->rdr, r->af, PF_RDR))
2123 			return (1);
2124 		if (pfctl_add_pool(pf, &r->nat, r->naf ? r->naf : r->af, PF_NAT))
2125 			return (1);
2126 		if (pfctl_add_pool(pf, &r->route, r->af, PF_RT))
2127 			return (1);
2128 		error = pfctl_add_rule_h(pf->h, r, anchor, name, ticket,
2129 		    pf->paddr.ticket);
2130 		switch (error) {
2131 		case 0:
2132 			/* things worked, do nothing */
2133 			break;
2134 		case EEXIST:
2135 			/* an identical rule is already present */
2136 			was_present = true;
2137 			break;
2138 		default:
2139 			errc(1, error, "DIOCADDRULE");
2140 		}
2141 	}
2142 
2143 	if (pf->opts & PF_OPT_VERBOSE) {
2144 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
2145 		print_rule(r, name,
2146 		    pf->opts & PF_OPT_VERBOSE2,
2147 		    pf->opts & PF_OPT_NUMERIC);
2148 		if (was_present)
2149 			printf(" -- rule was already present");
2150 	}
2151 	path[len] = '\0';
2152 	pfctl_clear_pool(&r->rdr);
2153 	pfctl_clear_pool(&r->nat);
2154 	return (0);
2155 }
2156 
2157 int
pfctl_add_altq(struct pfctl * pf,struct pf_altq * a)2158 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
2159 {
2160 	if (altqsupport &&
2161 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
2162 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
2163 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
2164 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
2165 				if (errno == ENXIO)
2166 					errx(1, "qtype not configured");
2167 				else if (errno == ENODEV)
2168 					errx(1, "%s: driver does not support "
2169 					    "altq", a->ifname);
2170 				else
2171 					err(1, "DIOCADDALTQ");
2172 			}
2173 		}
2174 		pfaltq_store(&pf->paltq->altq);
2175 	}
2176 	return (0);
2177 }
2178 
2179 int
pfctl_rules(int dev,char * filename,int opts,int optimize,char * anchorname,struct pfr_buffer * trans)2180 pfctl_rules(int dev, char *filename, int opts, int optimize,
2181     char *anchorname, struct pfr_buffer *trans)
2182 {
2183 #define ERR(...) do { warn(__VA_ARGS__); goto _error; } while(0)
2184 #define ERRX(...) do { warnx(__VA_ARGS__); goto _error; } while(0)
2185 
2186 	struct pfr_buffer	*t, buf;
2187 	struct pfioc_altq	 pa;
2188 	struct pfctl		 pf;
2189 	struct pfctl_ruleset	*rs;
2190 	struct pfctl_eth_ruleset	*ethrs;
2191 	struct pfr_table	 trs;
2192 	char			*path = NULL;
2193 	int			 osize;
2194 
2195 	RB_INIT(&pf_anchors);
2196 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
2197 	pf_init_ruleset(&pf_main_anchor.ruleset);
2198 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
2199 
2200 	memset(&pf_eth_main_anchor, 0, sizeof(pf_eth_main_anchor));
2201 	pf_init_eth_ruleset(&pf_eth_main_anchor.ruleset);
2202 	pf_eth_main_anchor.ruleset.anchor = &pf_eth_main_anchor;
2203 
2204 	if (trans == NULL) {
2205 		bzero(&buf, sizeof(buf));
2206 		buf.pfrb_type = PFRB_TRANS;
2207 		t = &buf;
2208 		osize = 0;
2209 	} else {
2210 		t = trans;
2211 		osize = t->pfrb_size;
2212 	}
2213 
2214 	memset(&pa, 0, sizeof(pa));
2215 	pa.version = PFIOC_ALTQ_VERSION;
2216 	memset(&pf, 0, sizeof(pf));
2217 	memset(&trs, 0, sizeof(trs));
2218 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2219 		ERRX("%s: calloc", __func__);
2220 	if (strlcpy(trs.pfrt_anchor, anchorname,
2221 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
2222 		ERRX("%s: strlcpy", __func__);
2223 	pf.dev = dev;
2224 	pf.h = pfh;
2225 	pf.opts = opts;
2226 	pf.optimize = optimize;
2227 	pf.loadopt = loadopt;
2228 
2229 	/* non-brace anchor, create without resolving the path */
2230 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
2231 		ERRX("%s: calloc", __func__);
2232 	rs = &pf.anchor->ruleset;
2233 	pf_init_ruleset(rs);
2234 	rs->anchor = pf.anchor;
2235 	if (strlcpy(pf.anchor->path, anchorname,
2236 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
2237 		errx(1, "%s: strlcpy", __func__);
2238 	if (strlcpy(pf.anchor->name, anchorname,
2239 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
2240 		errx(1, "%s: strlcpy", __func__);
2241 
2242 
2243 	pf.astack[0] = pf.anchor;
2244 	pf.asd = 0;
2245 	if (anchorname[0])
2246 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
2247 	pf.paltq = &pa;
2248 	pf.trans = t;
2249 	pfctl_init_options(&pf);
2250 
2251 	/* Set up ethernet anchor */
2252 	if ((pf.eanchor = calloc(1, sizeof(*pf.eanchor))) == NULL)
2253 		ERRX("%s: calloc", __func__);
2254 
2255 	if (strlcpy(pf.eanchor->path, anchorname,
2256 	    sizeof(pf.eanchor->path)) >= sizeof(pf.eanchor->path))
2257 		errx(1, "%s: strlcpy", __func__);
2258 	if (strlcpy(pf.eanchor->name, anchorname,
2259 	    sizeof(pf.eanchor->name)) >= sizeof(pf.eanchor->name))
2260 		errx(1, "%s: strlcpy", __func__);
2261 
2262 	ethrs = &pf.eanchor->ruleset;
2263 	pf_init_eth_ruleset(ethrs);
2264 	ethrs->anchor = pf.eanchor;
2265 	pf.eastack[0] = pf.eanchor;
2266 
2267 	if ((opts & PF_OPT_NOACTION) == 0) {
2268 		/*
2269 		 * XXX For the time being we need to open transactions for
2270 		 * the main ruleset before parsing, because tables are still
2271 		 * loaded at parse time.
2272 		 */
2273 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor, true))
2274 			ERRX("%s", __func__);
2275 		if (pf.loadopt & PFCTL_FLAG_ETH)
2276 			pf.eth_ticket = pfctl_get_ticket(t, PF_RULESET_ETH, anchorname);
2277 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
2278 			pa.ticket =
2279 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
2280 		if (pf.loadopt & PFCTL_FLAG_TABLE)
2281 			pf.astack[0]->ruleset.tticket =
2282 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
2283 	}
2284 
2285 	if (parse_config(filename, &pf) < 0) {
2286 		if ((opts & PF_OPT_NOACTION) == 0)
2287 			ERRX("Syntax error in config file: "
2288 			    "pf rules not loaded");
2289 		else
2290 			goto _error;
2291 	}
2292 	if (loadopt & PFCTL_FLAG_OPTION)
2293 		pfctl_adjust_skip_ifaces(&pf);
2294 
2295 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
2296 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
2297 	    (pf.loadopt & PFCTL_FLAG_ETH &&
2298 	    (pfctl_load_eth_ruleset(&pf, path, ethrs, 0))) ||
2299 	    (pf.loadopt & PFCTL_FLAG_NAT &&
2300 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
2301 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
2302 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
2303 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
2304 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
2305 		if ((opts & PF_OPT_NOACTION) == 0)
2306 			ERRX("Unable to load rules into kernel");
2307 		else
2308 			goto _error;
2309 	}
2310 
2311 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
2312 		if (check_commit_altq(dev, opts) != 0)
2313 			ERRX("errors in altq config");
2314 
2315 	if (trans == NULL) {
2316 		/* process "load anchor" directives */
2317 		if (pfctl_load_anchors(dev, &pf, t) == -1)
2318 			ERRX("load anchors");
2319 
2320 		if ((opts & PF_OPT_NOACTION) == 0) {
2321 			if (!anchorname[0] && pfctl_load_options(&pf))
2322 				goto _error;
2323 			if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
2324 				ERR("DIOCXCOMMIT");
2325 		}
2326 	}
2327 	free(path);
2328 	return (0);
2329 
2330 _error:
2331 	if (trans == NULL) {	/* main ruleset */
2332 		if ((opts & PF_OPT_NOACTION) == 0)
2333 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
2334 				err(1, "DIOCXROLLBACK");
2335 		exit(1);
2336 	} else {		/* sub ruleset */
2337 		free(path);
2338 		return (-1);
2339 	}
2340 
2341 #undef ERR
2342 #undef ERRX
2343 }
2344 
2345 FILE *
pfctl_fopen(const char * name,const char * mode)2346 pfctl_fopen(const char *name, const char *mode)
2347 {
2348 	struct stat	 st;
2349 	FILE		*fp;
2350 
2351 	fp = fopen(name, mode);
2352 	if (fp == NULL)
2353 		return (NULL);
2354 	if (fstat(fileno(fp), &st)) {
2355 		fclose(fp);
2356 		return (NULL);
2357 	}
2358 	if (S_ISDIR(st.st_mode)) {
2359 		fclose(fp);
2360 		errno = EISDIR;
2361 		return (NULL);
2362 	}
2363 	return (fp);
2364 }
2365 
2366 void
pfctl_init_options(struct pfctl * pf)2367 pfctl_init_options(struct pfctl *pf)
2368 {
2369 
2370 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2371 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
2372 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2373 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2374 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
2375 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2376 	pf->timeout[PFTM_SCTP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2377 	pf->timeout[PFTM_SCTP_OPENING] = PFTM_TCP_OPENING_VAL;
2378 	pf->timeout[PFTM_SCTP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2379 	pf->timeout[PFTM_SCTP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2380 	pf->timeout[PFTM_SCTP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2381 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
2382 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
2383 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
2384 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
2385 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
2386 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
2387 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
2388 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
2389 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
2390 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
2391 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
2392 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
2393 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
2394 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
2395 
2396 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
2397 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
2398 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
2399 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
2400 
2401 	pf->debug = PF_DEBUG_URGENT;
2402 	pf->reassemble = 0;
2403 
2404 	pf->syncookies = false;
2405 	pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
2406 	pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
2407 }
2408 
2409 int
pfctl_load_options(struct pfctl * pf)2410 pfctl_load_options(struct pfctl *pf)
2411 {
2412 	int i, error = 0;
2413 
2414 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2415 		return (0);
2416 
2417 	/* load limits */
2418 	for (i = 0; i < PF_LIMIT_MAX; i++) {
2419 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
2420 			continue;
2421 		if (pfctl_load_limit(pf, i, pf->limit[i]))
2422 			error = 1;
2423 	}
2424 
2425 	/*
2426 	 * If we've set the states limit, but haven't explicitly set adaptive
2427 	 * timeouts, do it now with a start of 60% and end of 120%.
2428 	 */
2429 	if (pf->limit_set[PF_LIMIT_STATES] &&
2430 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
2431 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
2432 		pf->timeout[PFTM_ADAPTIVE_START] =
2433 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
2434 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
2435 		pf->timeout[PFTM_ADAPTIVE_END] =
2436 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
2437 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
2438 	}
2439 
2440 	/* load timeouts */
2441 	for (i = 0; i < PFTM_MAX; i++) {
2442 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
2443 			continue;
2444 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
2445 			error = 1;
2446 	}
2447 
2448 	/* load debug */
2449 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
2450 		if (pfctl_load_debug(pf, pf->debug))
2451 			error = 1;
2452 
2453 	/* load logif */
2454 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
2455 		if (pfctl_load_logif(pf, pf->ifname))
2456 			error = 1;
2457 
2458 	/* load hostid */
2459 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
2460 		if (pfctl_load_hostid(pf, pf->hostid))
2461 			error = 1;
2462 
2463 	/* load reassembly settings */
2464 	if (!(pf->opts & PF_OPT_MERGE) || pf->reass_set)
2465 		if (pfctl_load_reassembly(pf, pf->reassemble))
2466 			error = 1;
2467 
2468 	/* load keepcounters */
2469 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
2470 		error = 1;
2471 
2472 	/* load syncookies settings */
2473 	if (pfctl_load_syncookies(pf, pf->syncookies))
2474 		error = 1;
2475 
2476 	return (error);
2477 }
2478 
2479 int
pfctl_apply_limit(struct pfctl * pf,const char * opt,unsigned int limit)2480 pfctl_apply_limit(struct pfctl *pf, const char *opt, unsigned int limit)
2481 {
2482 	int i;
2483 
2484 
2485 	for (i = 0; pf_limits[i].name; i++) {
2486 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
2487 			pf->limit[pf_limits[i].index] = limit;
2488 			pf->limit_set[pf_limits[i].index] = 1;
2489 			break;
2490 		}
2491 	}
2492 	if (pf_limits[i].name == NULL) {
2493 		warnx("Bad pool name.");
2494 		return (1);
2495 	}
2496 
2497 	if (pf->opts & PF_OPT_VERBOSE)
2498 		printf("set limit %s %d\n", opt, limit);
2499 
2500 	return (0);
2501 }
2502 
2503 int
pfctl_load_limit(struct pfctl * pf,unsigned int index,unsigned int limit)2504 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
2505 {
2506 	if (pfctl_set_limit(pf->h, index, limit)) {
2507 		if (errno == EBUSY)
2508 			warnx("Current pool size exceeds requested %s limit %u",
2509 			    pf_limits[index].name, limit);
2510 		else
2511 			warnx("Cannot set %s limit to %u",
2512 			    pf_limits[index].name, limit);
2513 		return (1);
2514 	}
2515 	return (0);
2516 }
2517 
2518 int
pfctl_apply_timeout(struct pfctl * pf,const char * opt,int seconds,int quiet)2519 pfctl_apply_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
2520 {
2521 	int i;
2522 
2523 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2524 		return (0);
2525 
2526 	for (i = 0; pf_timeouts[i].name; i++) {
2527 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
2528 			pf->timeout[pf_timeouts[i].timeout] = seconds;
2529 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
2530 			break;
2531 		}
2532 	}
2533 
2534 	if (pf_timeouts[i].name == NULL) {
2535 		warnx("Bad timeout name.");
2536 		return (1);
2537 	}
2538 
2539 
2540 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
2541 		printf("set timeout %s %d\n", opt, seconds);
2542 
2543 	return (0);
2544 }
2545 
2546 int
pfctl_load_timeout(struct pfctl * pf,unsigned int timeout,unsigned int seconds)2547 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
2548 {
2549 	if (pfctl_set_timeout(pf->h, timeout, seconds)) {
2550 		warnx("DIOCSETTIMEOUT");
2551 		return (1);
2552 	}
2553 	return (0);
2554 }
2555 
2556 int
pfctl_set_reassembly(struct pfctl * pf,int on,int nodf)2557 pfctl_set_reassembly(struct pfctl *pf, int on, int nodf)
2558 {
2559 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2560 		return (0);
2561 
2562 	pf->reass_set = 1;
2563 	if (on) {
2564 		pf->reassemble = PF_REASS_ENABLED;
2565 		if (nodf)
2566 			pf->reassemble |= PF_REASS_NODF;
2567 	} else {
2568 		pf->reassemble = 0;
2569 	}
2570 
2571 	if (pf->opts & PF_OPT_VERBOSE)
2572 		printf("set reassemble %s %s\n", on ? "yes" : "no",
2573 		    nodf ? "no-df" : "");
2574 
2575 	return (0);
2576 }
2577 
2578 int
pfctl_set_optimization(struct pfctl * pf,const char * opt)2579 pfctl_set_optimization(struct pfctl *pf, const char *opt)
2580 {
2581 	const struct pf_hint *hint;
2582 	int i, r;
2583 
2584 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2585 		return (0);
2586 
2587 	for (i = 0; pf_hints[i].name; i++)
2588 		if (strcasecmp(opt, pf_hints[i].name) == 0)
2589 			break;
2590 
2591 	hint = pf_hints[i].hint;
2592 	if (hint == NULL) {
2593 		warnx("invalid state timeouts optimization");
2594 		return (1);
2595 	}
2596 
2597 	for (i = 0; hint[i].name; i++)
2598 		if ((r = pfctl_apply_timeout(pf, hint[i].name,
2599 		    hint[i].timeout, 1)))
2600 			return (r);
2601 
2602 	if (pf->opts & PF_OPT_VERBOSE)
2603 		printf("set optimization %s\n", opt);
2604 
2605 	return (0);
2606 }
2607 
2608 int
pfctl_set_logif(struct pfctl * pf,char * ifname)2609 pfctl_set_logif(struct pfctl *pf, char *ifname)
2610 {
2611 
2612 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2613 		return (0);
2614 
2615 	if (!strcmp(ifname, "none")) {
2616 		free(pf->ifname);
2617 		pf->ifname = NULL;
2618 	} else {
2619 		pf->ifname = strdup(ifname);
2620 		if (!pf->ifname)
2621 			errx(1, "pfctl_set_logif: strdup");
2622 	}
2623 	pf->ifname_set = 1;
2624 
2625 	if (pf->opts & PF_OPT_VERBOSE)
2626 		printf("set loginterface %s\n", ifname);
2627 
2628 	return (0);
2629 }
2630 
2631 int
pfctl_load_logif(struct pfctl * pf,char * ifname)2632 pfctl_load_logif(struct pfctl *pf, char *ifname)
2633 {
2634 	if (ifname != NULL && strlen(ifname) >= IFNAMSIZ) {
2635 		warnx("pfctl_load_logif: strlcpy");
2636 		return (1);
2637 	}
2638 	return (pfctl_set_statusif(pfh, ifname ? ifname : ""));
2639 }
2640 
2641 void
pfctl_set_hostid(struct pfctl * pf,u_int32_t hostid)2642 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2643 {
2644 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2645 		return;
2646 
2647 	HTONL(hostid);
2648 
2649 	pf->hostid = hostid;
2650 	pf->hostid_set = 1;
2651 
2652 	if (pf->opts & PF_OPT_VERBOSE)
2653 		printf("set hostid 0x%08x\n", ntohl(hostid));
2654 }
2655 
2656 int
pfctl_load_hostid(struct pfctl * pf,u_int32_t hostid)2657 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2658 {
2659 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2660 		warnx("DIOCSETHOSTID");
2661 		return (1);
2662 	}
2663 	return (0);
2664 }
2665 
2666 int
pfctl_load_reassembly(struct pfctl * pf,u_int32_t reassembly)2667 pfctl_load_reassembly(struct pfctl *pf, u_int32_t reassembly)
2668 {
2669 	if (ioctl(dev, DIOCSETREASS, &reassembly)) {
2670 		warnx("DIOCSETREASS");
2671 		return (1);
2672 	}
2673 	return (0);
2674 }
2675 
2676 int
pfctl_load_syncookies(struct pfctl * pf,u_int8_t val)2677 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2678 {
2679 	struct pfctl_syncookies	cookies;
2680 
2681 	bzero(&cookies, sizeof(cookies));
2682 
2683 	cookies.mode = val;
2684 	cookies.lowwater = pf->syncookieswat[0];
2685 	cookies.highwater = pf->syncookieswat[1];
2686 
2687 	if (pfctl_set_syncookies(dev, &cookies)) {
2688 		warnx("DIOCSETSYNCOOKIES");
2689 		return (1);
2690 	}
2691 	return (0);
2692 }
2693 
2694 int
pfctl_cfg_syncookies(struct pfctl * pf,uint8_t val,struct pfctl_watermarks * w)2695 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2696 {
2697 	if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2698 		warnx("syncookies start/end only apply to adaptive");
2699 		return (1);
2700 	}
2701 	if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2702 		if (!w->hi)
2703 			w->hi = PF_SYNCOOKIES_HIWATPCT;
2704 		if (!w->lo)
2705 			w->lo = w->hi / 2;
2706 		if (w->lo >= w->hi) {
2707 			warnx("start must be higher than end");
2708 			return (1);
2709 		}
2710 		pf->syncookieswat[0] = w->lo;
2711 		pf->syncookieswat[1] = w->hi;
2712 		pf->syncookieswat_set = 1;
2713 	}
2714 
2715 	if (pf->opts & PF_OPT_VERBOSE) {
2716 		if (val == PF_SYNCOOKIES_NEVER)
2717 			printf("set syncookies never\n");
2718 		else if (val == PF_SYNCOOKIES_ALWAYS)
2719 			printf("set syncookies always\n");
2720 		else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2721 			if (pf->syncookieswat_set)
2722 				printf("set syncookies adaptive (start %u%%, "
2723 				    "end %u%%)\n", pf->syncookieswat[1],
2724 				    pf->syncookieswat[0]);
2725 			else
2726 				printf("set syncookies adaptive\n");
2727 		} else {        /* cannot happen */
2728 			warnx("king bula ate all syncookies");
2729 			return (1);
2730 		}
2731 	}
2732 
2733 	pf->syncookies = val;
2734 	return (0);
2735 }
2736 
2737 int
pfctl_do_set_debug(struct pfctl * pf,char * d)2738 pfctl_do_set_debug(struct pfctl *pf, char *d)
2739 {
2740 	u_int32_t	level;
2741 	int		ret;
2742 
2743 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2744 		return (0);
2745 
2746 	if (!strcmp(d, "none"))
2747 		pf->debug = PF_DEBUG_NONE;
2748 	else if (!strcmp(d, "urgent"))
2749 		pf->debug = PF_DEBUG_URGENT;
2750 	else if (!strcmp(d, "misc"))
2751 		pf->debug = PF_DEBUG_MISC;
2752 	else if (!strcmp(d, "loud"))
2753 		pf->debug = PF_DEBUG_NOISY;
2754 	else {
2755 		warnx("unknown debug level \"%s\"", d);
2756 		return (-1);
2757 	}
2758 
2759 	pf->debug_set = 1;
2760 	level = pf->debug;
2761 
2762 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2763 		if ((ret = pfctl_set_debug(pfh, level)) != 0)
2764 			errc(1, ret, "DIOCSETDEBUG");
2765 
2766 	if (pf->opts & PF_OPT_VERBOSE)
2767 		printf("set debug %s\n", d);
2768 
2769 	return (0);
2770 }
2771 
2772 int
pfctl_load_debug(struct pfctl * pf,unsigned int level)2773 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2774 {
2775 	if (pfctl_set_debug(pf->h, level)) {
2776 		warnx("DIOCSETDEBUG");
2777 		return (1);
2778 	}
2779 	return (0);
2780 }
2781 
2782 int
pfctl_set_interface_flags(struct pfctl * pf,char * ifname,int flags,int how)2783 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2784 {
2785 	struct pfioc_iface	pi;
2786 	struct node_host	*h = NULL, *n = NULL;
2787 
2788 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2789 		return (0);
2790 
2791 	bzero(&pi, sizeof(pi));
2792 
2793 	pi.pfiio_flags = flags;
2794 
2795 	/* Make sure our cache matches the kernel. If we set or clear the flag
2796 	 * for a group this applies to all members. */
2797 	h = ifa_grouplookup(ifname, 0);
2798 	for (n = h; n != NULL; n = n->next)
2799 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2800 
2801 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2802 	    sizeof(pi.pfiio_name))
2803 		errx(1, "pfctl_set_interface_flags: strlcpy");
2804 
2805 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2806 		if (how == 0) {
2807 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2808 				err(1, "DIOCCLRIFFLAG");
2809 		} else {
2810 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2811 				err(1, "DIOCSETIFFLAG");
2812 			pfctl_check_skip_ifaces(ifname);
2813 		}
2814 	}
2815 	return (0);
2816 }
2817 
2818 void
pfctl_debug(int dev,u_int32_t level,int opts)2819 pfctl_debug(int dev, u_int32_t level, int opts)
2820 {
2821 	int ret;
2822 
2823 	if ((ret = pfctl_set_debug(pfh, level)) != 0)
2824 		errc(1, ret, "DIOCSETDEBUG");
2825 	if ((opts & PF_OPT_QUIET) == 0) {
2826 		fprintf(stderr, "debug level set to '");
2827 		switch (level) {
2828 		case PF_DEBUG_NONE:
2829 			fprintf(stderr, "none");
2830 			break;
2831 		case PF_DEBUG_URGENT:
2832 			fprintf(stderr, "urgent");
2833 			break;
2834 		case PF_DEBUG_MISC:
2835 			fprintf(stderr, "misc");
2836 			break;
2837 		case PF_DEBUG_NOISY:
2838 			fprintf(stderr, "loud");
2839 			break;
2840 		default:
2841 			fprintf(stderr, "<invalid>");
2842 			break;
2843 		}
2844 		fprintf(stderr, "'\n");
2845 	}
2846 }
2847 
2848 int
pfctl_test_altqsupport(int dev,int opts)2849 pfctl_test_altqsupport(int dev, int opts)
2850 {
2851 	struct pfioc_altq pa;
2852 
2853 	pa.version = PFIOC_ALTQ_VERSION;
2854 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2855 		if (errno == ENODEV) {
2856 			if (opts & PF_OPT_VERBOSE)
2857 				fprintf(stderr, "No ALTQ support in kernel\n"
2858 				    "ALTQ related functions disabled\n");
2859 			return (0);
2860 		} else
2861 			err(1, "DIOCGETALTQS");
2862 	}
2863 	return (1);
2864 }
2865 
2866 int
pfctl_show_anchors(int dev,int opts,char * anchorname)2867 pfctl_show_anchors(int dev, int opts, char *anchorname)
2868 {
2869 	struct pfioc_ruleset	 pr;
2870 	u_int32_t		 mnr, nr;
2871 	int			 ret;
2872 
2873 	memset(&pr, 0, sizeof(pr));
2874 	if ((ret = pfctl_get_rulesets(pfh, anchorname, &mnr)) != 0) {
2875 		if (ret == EINVAL)
2876 			fprintf(stderr, "Anchor '%s' not found.\n",
2877 			    anchorname);
2878 		else
2879 			errc(1, ret, "DIOCGETRULESETS");
2880 		return (-1);
2881 	}
2882 	for (nr = 0; nr < mnr; ++nr) {
2883 		char sub[MAXPATHLEN];
2884 
2885 		if ((ret = pfctl_get_ruleset(pfh, anchorname, nr, &pr)) != 0)
2886 			errc(1, ret, "DIOCGETRULESET");
2887 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2888 			continue;
2889 		sub[0] = '\0';
2890 		if (pr.path[0]) {
2891 			strlcat(sub, pr.path, sizeof(sub));
2892 			strlcat(sub, "/", sizeof(sub));
2893 		}
2894 		strlcat(sub, pr.name, sizeof(sub));
2895 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2896 			printf("  %s\n", sub);
2897 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2898 			return (-1);
2899 	}
2900 	return (0);
2901 }
2902 
2903 int
pfctl_show_eth_anchors(int dev,int opts,char * anchorname)2904 pfctl_show_eth_anchors(int dev, int opts, char *anchorname)
2905 {
2906 	struct pfctl_eth_rulesets_info ri;
2907 	struct pfctl_eth_ruleset_info rs;
2908 	int ret;
2909 
2910 	if ((ret = pfctl_get_eth_rulesets_info(dev, &ri, anchorname)) != 0) {
2911 		if (ret == ENOENT)
2912 			fprintf(stderr, "Anchor '%s' not found.\n",
2913 			    anchorname);
2914 		else
2915 			errc(1, ret, "DIOCGETETHRULESETS");
2916 		return (-1);
2917 	}
2918 
2919 	for (int nr = 0; nr < ri.nr; nr++) {
2920 		char sub[MAXPATHLEN];
2921 
2922 		if ((ret = pfctl_get_eth_ruleset(dev, anchorname, nr, &rs)) != 0)
2923 			errc(1, ret, "DIOCGETETHRULESET");
2924 
2925 		if (!strcmp(rs.name, PF_RESERVED_ANCHOR))
2926 			continue;
2927 		sub[0] = 0;
2928 		if (rs.path[0]) {
2929 			strlcat(sub, rs.path, sizeof(sub));
2930 			strlcat(sub, "/", sizeof(sub));
2931 		}
2932 		strlcat(sub, rs.name, sizeof(sub));
2933 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2934 			printf("  %s\n", sub);
2935 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_eth_anchors(dev, opts, sub))
2936 			return (-1);
2937 	}
2938 	return (0);
2939 }
2940 
2941 const char *
pfctl_lookup_option(char * cmd,const char * const * list)2942 pfctl_lookup_option(char *cmd, const char * const *list)
2943 {
2944 	if (cmd != NULL && *cmd)
2945 		for (; *list; list++)
2946 			if (!strncmp(cmd, *list, strlen(cmd)))
2947 				return (*list);
2948 	return (NULL);
2949 }
2950 
2951 void
pfctl_reset(int dev,int opts)2952 pfctl_reset(int dev, int opts)
2953 {
2954 	struct pfctl pf;
2955 	struct pfr_buffer t;
2956 	int i;
2957 
2958 	pf.dev = dev;
2959 	pf.h = pfh;
2960 	pfctl_init_options(&pf);
2961 
2962 	/* Force reset upon pfctl_load_options() */
2963 	pf.debug_set = 1;
2964 	pf.reass_set = 1;
2965 	pf.syncookieswat_set = 1;
2966 	pf.ifname = strdup("none");
2967 	if (pf.ifname == NULL)
2968 		err(1, "%s: strdup", __func__);
2969 	pf.ifname_set = 1;
2970 
2971 	memset(&t, 0, sizeof(t));
2972 	t.pfrb_type = PFRB_TRANS;
2973 	if (pfctl_trans(dev, &t, DIOCXBEGIN, 0))
2974 		err(1, "%s: DIOCXBEGIN", __func__);
2975 
2976 	for (i = 0; pf_limits[i].name; i++)
2977 		pf.limit_set[pf_limits[i].index] = 1;
2978 
2979 	for (i = 0; pf_timeouts[i].name; i++)
2980 		pf.timeout_set[pf_timeouts[i].timeout] = 1;
2981 
2982 	pfctl_load_options(&pf);
2983 
2984 	if (pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
2985 		err(1, "%s: DIOCXCOMMIT", __func__);
2986 
2987 	pfctl_clear_interface_flags(dev, opts);
2988 }
2989 
2990 int
main(int argc,char * argv[])2991 main(int argc, char *argv[])
2992 {
2993 	int	 error = 0;
2994 	int	 ch;
2995 	int	 mode = O_RDONLY;
2996 	int	 opts = 0;
2997 	int	 optimize = PF_OPTIMIZE_BASIC;
2998 	char	 anchorname[MAXPATHLEN];
2999 	char	*path;
3000 
3001 	if (argc < 2)
3002 		usage();
3003 
3004 	while ((ch = getopt(argc, argv,
3005 	    "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:St:T:vx:z")) != -1) {
3006 		switch (ch) {
3007 		case 'a':
3008 			anchoropt = optarg;
3009 			break;
3010 		case 'd':
3011 			opts |= PF_OPT_DISABLE;
3012 			mode = O_RDWR;
3013 			break;
3014 		case 'D':
3015 			if (pfctl_cmdline_symset(optarg) < 0)
3016 				warnx("could not parse macro definition %s",
3017 				    optarg);
3018 			break;
3019 		case 'e':
3020 			opts |= PF_OPT_ENABLE;
3021 			mode = O_RDWR;
3022 			break;
3023 		case 'q':
3024 			opts |= PF_OPT_QUIET;
3025 			break;
3026 		case 'F':
3027 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
3028 			if (clearopt == NULL) {
3029 				warnx("Unknown flush modifier '%s'", optarg);
3030 				usage();
3031 			}
3032 			mode = O_RDWR;
3033 			break;
3034 		case 'i':
3035 			ifaceopt = optarg;
3036 			break;
3037 		case 'k':
3038 			if (state_killers >= 2) {
3039 				warnx("can only specify -k twice");
3040 				usage();
3041 				/* NOTREACHED */
3042 			}
3043 			state_kill[state_killers++] = optarg;
3044 			mode = O_RDWR;
3045 			break;
3046 		case 'K':
3047 			if (src_node_killers >= 2) {
3048 				warnx("can only specify -K twice");
3049 				usage();
3050 				/* NOTREACHED */
3051 			}
3052 			src_node_kill[src_node_killers++] = optarg;
3053 			mode = O_RDWR;
3054 			break;
3055 		case 'm':
3056 			opts |= PF_OPT_MERGE;
3057 			break;
3058 		case 'M':
3059 			opts |= PF_OPT_KILLMATCH;
3060 			break;
3061 		case 'n':
3062 			opts |= PF_OPT_NOACTION;
3063 			break;
3064 		case 'N':
3065 			loadopt |= PFCTL_FLAG_NAT;
3066 			break;
3067 		case 'r':
3068 			opts |= PF_OPT_USEDNS;
3069 			break;
3070 		case 'f':
3071 			rulesopt = optarg;
3072 			mode = O_RDWR;
3073 			break;
3074 		case 'g':
3075 			opts |= PF_OPT_DEBUG;
3076 			break;
3077 		case 'A':
3078 			loadopt |= PFCTL_FLAG_ALTQ;
3079 			break;
3080 		case 'R':
3081 			loadopt |= PFCTL_FLAG_FILTER;
3082 			break;
3083 		case 'o':
3084 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
3085 			if (optiopt == NULL) {
3086 				warnx("Unknown optimization '%s'", optarg);
3087 				usage();
3088 			}
3089 			opts |= PF_OPT_OPTIMIZE;
3090 			break;
3091 		case 'O':
3092 			loadopt |= PFCTL_FLAG_OPTION;
3093 			break;
3094 		case 'p':
3095 			pf_device = optarg;
3096 			break;
3097 		case 'P':
3098 			opts |= PF_OPT_NUMERIC;
3099 			break;
3100 		case 's':
3101 			showopt = pfctl_lookup_option(optarg, showopt_list);
3102 			if (showopt == NULL) {
3103 				warnx("Unknown show modifier '%s'", optarg);
3104 				usage();
3105 			}
3106 			break;
3107 		case 'S':
3108 			opts |= PF_OPT_NODNS;
3109 			break;
3110 		case 't':
3111 			tableopt = optarg;
3112 			break;
3113 		case 'T':
3114 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
3115 			if (tblcmdopt == NULL) {
3116 				warnx("Unknown table command '%s'", optarg);
3117 				usage();
3118 			}
3119 			break;
3120 		case 'v':
3121 			if (opts & PF_OPT_VERBOSE)
3122 				opts |= PF_OPT_VERBOSE2;
3123 			opts |= PF_OPT_VERBOSE;
3124 			break;
3125 		case 'x':
3126 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
3127 			if (debugopt == NULL) {
3128 				warnx("Unknown debug level '%s'", optarg);
3129 				usage();
3130 			}
3131 			mode = O_RDWR;
3132 			break;
3133 		case 'z':
3134 			opts |= PF_OPT_CLRRULECTRS;
3135 			mode = O_RDWR;
3136 			break;
3137 		case 'h':
3138 			/* FALLTHROUGH */
3139 		default:
3140 			usage();
3141 			/* NOTREACHED */
3142 		}
3143 	}
3144 
3145 	if ((opts & PF_OPT_NODNS) && (opts & PF_OPT_USEDNS))
3146 		errx(1, "-N and -r are mutually exclusive");
3147 
3148 	if ((tblcmdopt == NULL) ^ (tableopt == NULL))
3149 		usage();
3150 
3151 	if (tblcmdopt != NULL) {
3152 		argc -= optind;
3153 		argv += optind;
3154 		ch = *tblcmdopt;
3155 		if (ch == 'l') {
3156 			loadopt |= PFCTL_FLAG_TABLE;
3157 			tblcmdopt = NULL;
3158 		} else
3159 			mode = strchr("st", ch) ? O_RDONLY : O_RDWR;
3160 	} else if (argc != optind) {
3161 		warnx("unknown command line argument: %s ...", argv[optind]);
3162 		usage();
3163 		/* NOTREACHED */
3164 	}
3165 	if (loadopt == 0)
3166 		loadopt = ~0;
3167 
3168 	memset(anchorname, 0, sizeof(anchorname));
3169 	if (anchoropt != NULL) {
3170 		int len = strlen(anchoropt);
3171 
3172 		if (anchoropt[0] == '\0')
3173 			errx(1, "anchor name must not be empty");
3174 		if (mode == O_RDONLY && showopt == NULL && tblcmdopt == NULL) {
3175 			warnx("anchors apply to -f, -F, -s, and -T only");
3176 			usage();
3177 		}
3178 		if (mode == O_RDWR && tblcmdopt == NULL &&
3179 		    (anchoropt[0] == '_' || strstr(anchoropt, "/_") != NULL))
3180 			errx(1, "anchor names beginning with '_' cannot "
3181 			    "be modified from the command line");
3182 
3183 		if (len >= 1 && anchoropt[len - 1] == '*') {
3184 			if (len >= 2 && anchoropt[len - 2] == '/')
3185 				anchoropt[len - 2] = '\0';
3186 			else
3187 				anchoropt[len - 1] = '\0';
3188 			opts |= PF_OPT_RECURSE;
3189 		}
3190 		if (strlcpy(anchorname, anchoropt,
3191 		    sizeof(anchorname)) >= sizeof(anchorname))
3192 			errx(1, "anchor name '%s' too long",
3193 			    anchoropt);
3194 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE|PFCTL_FLAG_ETH;
3195 	}
3196 
3197 	if ((opts & PF_OPT_NOACTION) == 0) {
3198 		dev = open(pf_device, mode);
3199 		if (dev == -1)
3200 			err(1, "%s", pf_device);
3201 		altqsupport = pfctl_test_altqsupport(dev, opts);
3202 	} else {
3203 		dev = open(pf_device, O_RDONLY);
3204 		if (dev >= 0)
3205 			opts |= PF_OPT_DUMMYACTION;
3206 		/* turn off options */
3207 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
3208 		clearopt = showopt = debugopt = NULL;
3209 #if !defined(ENABLE_ALTQ)
3210 		altqsupport = 0;
3211 #else
3212 		altqsupport = 1;
3213 #endif
3214 	}
3215 	pfh = pfctl_open(pf_device);
3216 	if (pfh == NULL)
3217 		err(1, "Failed to open netlink");
3218 
3219 	if (opts & PF_OPT_DISABLE)
3220 		if (pfctl_disable(dev, opts))
3221 			error = 1;
3222 
3223 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
3224 		errx(1, "%s: calloc", __func__);
3225 
3226 	if (showopt != NULL) {
3227 		switch (*showopt) {
3228 		case 'A':
3229 			pfctl_show_anchors(dev, opts, anchorname);
3230 			if (opts & PF_OPT_VERBOSE2)
3231 				printf("Ethernet:\n");
3232 			pfctl_show_eth_anchors(dev, opts, anchorname);
3233 			break;
3234 		case 'r':
3235 			pfctl_load_fingerprints(dev, opts);
3236 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
3237 			    anchorname, 0, 0);
3238 			break;
3239 		case 'l':
3240 			pfctl_load_fingerprints(dev, opts);
3241 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
3242 			    anchorname, 0, 0);
3243 			break;
3244 		case 'n':
3245 			pfctl_load_fingerprints(dev, opts);
3246 			pfctl_show_nat(dev, path, opts, anchorname, 0, 0);
3247 			break;
3248 		case 'q':
3249 			pfctl_show_altq(dev, ifaceopt, opts,
3250 			    opts & PF_OPT_VERBOSE2);
3251 			break;
3252 		case 's':
3253 			pfctl_show_states(dev, ifaceopt, opts);
3254 			break;
3255 		case 'S':
3256 			pfctl_show_src_nodes(dev, opts);
3257 			break;
3258 		case 'i':
3259 			pfctl_show_status(dev, opts);
3260 			break;
3261 		case 'R':
3262 			error = pfctl_show_running(dev);
3263 			break;
3264 		case 't':
3265 			pfctl_show_timeouts(dev, opts);
3266 			break;
3267 		case 'm':
3268 			pfctl_show_limits(dev, opts);
3269 			break;
3270 		case 'e':
3271 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0,
3272 			    0);
3273 			break;
3274 		case 'a':
3275 			opts |= PF_OPT_SHOWALL;
3276 			pfctl_load_fingerprints(dev, opts);
3277 
3278 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0,
3279 			    0);
3280 
3281 			pfctl_show_nat(dev, path, opts, anchorname, 0, 0);
3282 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
3283 			    anchorname, 0, 0);
3284 			pfctl_show_altq(dev, ifaceopt, opts, 0);
3285 			pfctl_show_states(dev, ifaceopt, opts);
3286 			pfctl_show_src_nodes(dev, opts);
3287 			pfctl_show_status(dev, opts);
3288 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
3289 			    anchorname, 0, 0);
3290 			pfctl_show_timeouts(dev, opts);
3291 			pfctl_show_limits(dev, opts);
3292 			pfctl_show_tables(anchorname, opts);
3293 			pfctl_show_fingerprints(opts);
3294 			break;
3295 		case 'T':
3296 			pfctl_show_tables(anchorname, opts);
3297 			break;
3298 		case 'o':
3299 			pfctl_load_fingerprints(dev, opts);
3300 			pfctl_show_fingerprints(opts);
3301 			break;
3302 		case 'I':
3303 			pfctl_show_ifaces(ifaceopt, opts);
3304 			break;
3305 		case 'c':
3306 			pfctl_show_creators(opts);
3307 			break;
3308 		}
3309 	}
3310 
3311 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL) {
3312 		pfctl_show_eth_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
3313 		    anchorname, 0, 0);
3314 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
3315 		    anchorname, 0, 0);
3316 	}
3317 
3318 	if (clearopt != NULL) {
3319 		switch (*clearopt) {
3320 		case 'e':
3321 			pfctl_flush_eth_rules(dev, opts, anchorname);
3322 			break;
3323 		case 'r':
3324 			pfctl_flush_rules(dev, opts, anchorname);
3325 			break;
3326 		case 'n':
3327 			pfctl_flush_nat(dev, opts, anchorname);
3328 			break;
3329 		case 'q':
3330 			pfctl_clear_altq(dev, opts);
3331 			break;
3332 		case 's':
3333 			pfctl_clear_iface_states(dev, ifaceopt, opts);
3334 			break;
3335 		case 'S':
3336 			pfctl_clear_src_nodes(dev, opts);
3337 			break;
3338 		case 'i':
3339 			pfctl_clear_stats(pfh, opts);
3340 			break;
3341 		case 'a':
3342 			if (ifaceopt) {
3343 				warnx("don't specify an interface with -Fall");
3344 				usage();
3345 				/* NOTREACHED */
3346 			}
3347 			pfctl_flush_eth_rules(dev, opts, anchorname);
3348 			pfctl_flush_rules(dev, opts, anchorname);
3349 			pfctl_flush_nat(dev, opts, anchorname);
3350 			pfctl_do_clear_tables(anchorname, opts);
3351 			if (!*anchorname) {
3352 				pfctl_clear_altq(dev, opts);
3353 				pfctl_clear_iface_states(dev, ifaceopt, opts);
3354 				pfctl_clear_src_nodes(dev, opts);
3355 				pfctl_clear_stats(pfh, opts);
3356 				pfctl_clear_fingerprints(dev, opts);
3357 				pfctl_reset(dev, opts);
3358 			}
3359 			break;
3360 		case 'o':
3361 			pfctl_clear_fingerprints(dev, opts);
3362 			break;
3363 		case 'T':
3364 			pfctl_do_clear_tables(anchorname, opts);
3365 			break;
3366 		case 'R':
3367 			pfctl_reset(dev, opts);
3368 			break;
3369 		}
3370 	}
3371 	if (state_killers) {
3372 		if (!strcmp(state_kill[0], "label"))
3373 			pfctl_label_kill_states(dev, ifaceopt, opts);
3374 		else if (!strcmp(state_kill[0], "id"))
3375 			pfctl_id_kill_states(dev, ifaceopt, opts);
3376 		else if (!strcmp(state_kill[0], "gateway"))
3377 			pfctl_gateway_kill_states(dev, ifaceopt, opts);
3378 		else if (!strcmp(state_kill[0], "key"))
3379 			pfctl_key_kill_states(dev, ifaceopt, opts);
3380 		else
3381 			pfctl_net_kill_states(dev, ifaceopt, opts);
3382 	}
3383 
3384 	if (src_node_killers)
3385 		pfctl_kill_src_nodes(dev, opts);
3386 
3387 	if (tblcmdopt != NULL) {
3388 		error = pfctl_table(argc, argv, tableopt,
3389 		    tblcmdopt, rulesopt, anchorname, opts);
3390 		rulesopt = NULL;
3391 	}
3392 	if (optiopt != NULL) {
3393 		switch (*optiopt) {
3394 		case 'n':
3395 			optimize = 0;
3396 			break;
3397 		case 'b':
3398 			optimize |= PF_OPTIMIZE_BASIC;
3399 			break;
3400 		case 'o':
3401 		case 'p':
3402 			optimize |= PF_OPTIMIZE_PROFILE;
3403 			break;
3404 		}
3405 	}
3406 
3407 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
3408 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
3409 		pfctl_get_skip_ifaces();
3410 
3411 	if (rulesopt != NULL && !(opts & PF_OPT_MERGE) &&
3412 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
3413 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
3414 			error = 1;
3415 
3416 	if (rulesopt != NULL) {
3417 		if (pfctl_rules(dev, rulesopt, opts, optimize,
3418 		    anchorname, NULL))
3419 			error = 1;
3420 	}
3421 
3422 	if (opts & PF_OPT_ENABLE)
3423 		if (pfctl_enable(dev, opts))
3424 			error = 1;
3425 
3426 	if (debugopt != NULL) {
3427 		switch (*debugopt) {
3428 		case 'n':
3429 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
3430 			break;
3431 		case 'u':
3432 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
3433 			break;
3434 		case 'm':
3435 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
3436 			break;
3437 		case 'l':
3438 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
3439 			break;
3440 		}
3441 	}
3442 
3443 	exit(error);
3444 }
3445