xref: /freebsd/lib/libpfctl/libpfctl.c (revision 31ba4ce8898f9dfa5e7f054fdbc26e50a599a6e3)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021 Rubicon Communications, LLC (Netgate)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  * $FreeBSD$
32  */
33 
34 #include <sys/cdefs.h>
35 
36 #include <sys/ioctl.h>
37 #include <sys/nv.h>
38 #include <sys/queue.h>
39 #include <sys/types.h>
40 
41 #include <net/if.h>
42 #include <net/pfvar.h>
43 #include <netinet/in.h>
44 
45 #include <assert.h>
46 #include <err.h>
47 #include <errno.h>
48 #include <stdlib.h>
49 #include <string.h>
50 
51 #include "libpfctl.h"
52 
53 static int	_pfctl_clear_states(int , const struct pfctl_kill *,
54 		    unsigned int *, uint64_t);
55 
56 static void
57 pf_nvuint_8_array(const nvlist_t *nvl, const char *name, size_t maxelems,
58     u_int8_t *numbers, size_t *nelems)
59 {
60 	const uint64_t *tmp;
61 	size_t elems;
62 
63 	tmp = nvlist_get_number_array(nvl, name, &elems);
64 	assert(elems <= maxelems);
65 
66 	for (size_t i = 0; i < elems; i++)
67 		numbers[i] = tmp[i];
68 
69 	if (nelems)
70 		*nelems = elems;
71 }
72 
73 static void
74 pf_nvuint_16_array(const nvlist_t *nvl, const char *name, size_t maxelems,
75     u_int16_t *numbers, size_t *nelems)
76 {
77 	const uint64_t *tmp;
78 	size_t elems;
79 
80 	tmp = nvlist_get_number_array(nvl, name, &elems);
81 	assert(elems <= maxelems);
82 
83 	for (size_t i = 0; i < elems; i++)
84 		numbers[i] = tmp[i];
85 
86 	if (nelems)
87 		*nelems = elems;
88 }
89 
90 static void
91 pf_nvuint_32_array(const nvlist_t *nvl, const char *name, size_t maxelems,
92     u_int32_t *numbers, size_t *nelems)
93 {
94 	const uint64_t *tmp;
95 	size_t elems;
96 
97 	tmp = nvlist_get_number_array(nvl, name, &elems);
98 	assert(elems <= maxelems);
99 
100 	for (size_t i = 0; i < elems; i++)
101 		numbers[i] = tmp[i];
102 
103 	if (nelems)
104 		*nelems = elems;
105 }
106 
107 static void
108 pf_nvuint_64_array(const nvlist_t *nvl, const char *name, size_t maxelems,
109     u_int64_t *numbers, size_t *nelems)
110 {
111 	const uint64_t *tmp;
112 	size_t elems;
113 
114 	tmp = nvlist_get_number_array(nvl, name, &elems);
115 	assert(elems <= maxelems);
116 
117 	for (size_t i = 0; i < elems; i++)
118 		numbers[i] = tmp[i];
119 
120 	if (nelems)
121 		*nelems = elems;
122 }
123 
124 static void
125 pfctl_nv_add_addr(nvlist_t *nvparent, const char *name,
126     const struct pf_addr *addr)
127 {
128 	nvlist_t *nvl = nvlist_create(0);
129 
130 	nvlist_add_binary(nvl, "addr", addr, sizeof(*addr));
131 
132 	nvlist_add_nvlist(nvparent, name, nvl);
133 	nvlist_destroy(nvl);
134 }
135 
136 static void
137 pf_nvaddr_to_addr(const nvlist_t *nvl, struct pf_addr *addr)
138 {
139 	size_t len;
140 	const void *data;
141 
142 	data = nvlist_get_binary(nvl, "addr", &len);
143 	assert(len == sizeof(struct pf_addr));
144 	memcpy(addr, data, len);
145 }
146 
147 static void
148 pfctl_nv_add_addr_wrap(nvlist_t *nvparent, const char *name,
149     const struct pf_addr_wrap *addr)
150 {
151 	nvlist_t *nvl = nvlist_create(0);
152 
153 	nvlist_add_number(nvl, "type", addr->type);
154 	nvlist_add_number(nvl, "iflags", addr->iflags);
155 	if (addr->type == PF_ADDR_DYNIFTL)
156 		nvlist_add_string(nvl, "ifname", addr->v.ifname);
157 	if (addr->type == PF_ADDR_TABLE)
158 		nvlist_add_string(nvl, "tblname", addr->v.tblname);
159 	pfctl_nv_add_addr(nvl, "addr", &addr->v.a.addr);
160 	pfctl_nv_add_addr(nvl, "mask", &addr->v.a.mask);
161 
162 	nvlist_add_nvlist(nvparent, name, nvl);
163 	nvlist_destroy(nvl);
164 }
165 
166 static void
167 pf_nvaddr_wrap_to_addr_wrap(const nvlist_t *nvl, struct pf_addr_wrap *addr)
168 {
169 	addr->type = nvlist_get_number(nvl, "type");
170 	addr->iflags = nvlist_get_number(nvl, "iflags");
171 	if (addr->type == PF_ADDR_DYNIFTL)
172 		strlcpy(addr->v.ifname, nvlist_get_string(nvl, "ifname"),
173 		    IFNAMSIZ);
174 	if (addr->type == PF_ADDR_TABLE)
175 		strlcpy(addr->v.tblname, nvlist_get_string(nvl, "tblname"),
176 		    PF_TABLE_NAME_SIZE);
177 
178 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "addr"), &addr->v.a.addr);
179 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "mask"), &addr->v.a.mask);
180 }
181 
182 static void
183 pfctl_nv_add_rule_addr(nvlist_t *nvparent, const char *name,
184     const struct pf_rule_addr *addr)
185 {
186 	u_int64_t ports[2];
187 	nvlist_t *nvl = nvlist_create(0);
188 
189 	pfctl_nv_add_addr_wrap(nvl, "addr", &addr->addr);
190 	ports[0] = addr->port[0];
191 	ports[1] = addr->port[1];
192 	nvlist_add_number_array(nvl, "port", ports, 2);
193 	nvlist_add_number(nvl, "neg", addr->neg);
194 	nvlist_add_number(nvl, "port_op", addr->port_op);
195 
196 	nvlist_add_nvlist(nvparent, name, nvl);
197 	nvlist_destroy(nvl);
198 }
199 
200 static void
201 pf_nvrule_addr_to_rule_addr(const nvlist_t *nvl, struct pf_rule_addr *addr)
202 {
203 	pf_nvaddr_wrap_to_addr_wrap(nvlist_get_nvlist(nvl, "addr"), &addr->addr);
204 
205 	pf_nvuint_16_array(nvl, "port", 2, addr->port, NULL);
206 	addr->neg = nvlist_get_number(nvl, "neg");
207 	addr->port_op = nvlist_get_number(nvl, "port_op");
208 }
209 
210 static void
211 pfctl_nv_add_mape(nvlist_t *nvparent, const char *name,
212     const struct pf_mape_portset *mape)
213 {
214 	nvlist_t *nvl = nvlist_create(0);
215 
216 	nvlist_add_number(nvl, "offset", mape->offset);
217 	nvlist_add_number(nvl, "psidlen", mape->psidlen);
218 	nvlist_add_number(nvl, "psid", mape->psid);
219 	nvlist_add_nvlist(nvparent, name, nvl);
220 	nvlist_destroy(nvl);
221 }
222 
223 static void
224 pfctl_nv_add_pool(nvlist_t *nvparent, const char *name,
225     const struct pfctl_pool *pool)
226 {
227 	u_int64_t ports[2];
228 	nvlist_t *nvl = nvlist_create(0);
229 
230 	nvlist_add_binary(nvl, "key", &pool->key, sizeof(pool->key));
231 	pfctl_nv_add_addr(nvl, "counter", &pool->counter);
232 	nvlist_add_number(nvl, "tblidx", pool->tblidx);
233 
234 	ports[0] = pool->proxy_port[0];
235 	ports[1] = pool->proxy_port[1];
236 	nvlist_add_number_array(nvl, "proxy_port", ports, 2);
237 	nvlist_add_number(nvl, "opts", pool->opts);
238 	pfctl_nv_add_mape(nvl, "mape", &pool->mape);
239 
240 	nvlist_add_nvlist(nvparent, name, nvl);
241 	nvlist_destroy(nvl);
242 }
243 
244 static void
245 pf_nvmape_to_mape(const nvlist_t *nvl, struct pf_mape_portset *mape)
246 {
247 	mape->offset = nvlist_get_number(nvl, "offset");
248 	mape->psidlen = nvlist_get_number(nvl, "psidlen");
249 	mape->psid = nvlist_get_number(nvl, "psid");
250 }
251 
252 static void
253 pf_nvpool_to_pool(const nvlist_t *nvl, struct pfctl_pool *pool)
254 {
255 	size_t len;
256 	const void *data;
257 
258 	data = nvlist_get_binary(nvl, "key", &len);
259 	assert(len == sizeof(pool->key));
260 	memcpy(&pool->key, data, len);
261 
262 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "counter"), &pool->counter);
263 
264 	pool->tblidx = nvlist_get_number(nvl, "tblidx");
265 	pf_nvuint_16_array(nvl, "proxy_port", 2, pool->proxy_port, NULL);
266 	pool->opts = nvlist_get_number(nvl, "opts");
267 
268 	if (nvlist_exists_nvlist(nvl, "mape"))
269 		pf_nvmape_to_mape(nvlist_get_nvlist(nvl, "mape"), &pool->mape);
270 }
271 
272 static void
273 pfctl_nv_add_uid(nvlist_t *nvparent, const char *name,
274     const struct pf_rule_uid *uid)
275 {
276 	u_int64_t uids[2];
277 	nvlist_t *nvl = nvlist_create(0);
278 
279 	uids[0] = uid->uid[0];
280 	uids[1] = uid->uid[1];
281 	nvlist_add_number_array(nvl, "uid", uids, 2);
282 	nvlist_add_number(nvl, "op", uid->op);
283 
284 	nvlist_add_nvlist(nvparent, name, nvl);
285 	nvlist_destroy(nvl);
286 }
287 
288 static void
289 pf_nvrule_uid_to_rule_uid(const nvlist_t *nvl, struct pf_rule_uid *uid)
290 {
291 	pf_nvuint_32_array(nvl, "uid", 2, uid->uid, NULL);
292 	uid->op = nvlist_get_number(nvl, "op");
293 }
294 
295 static void
296 pfctl_nv_add_divert(nvlist_t *nvparent, const char *name,
297     const struct pfctl_rule *r)
298 {
299 	nvlist_t *nvl = nvlist_create(0);
300 
301 	pfctl_nv_add_addr(nvl, "addr", &r->divert.addr);
302 	nvlist_add_number(nvl, "port", r->divert.port);
303 
304 	nvlist_add_nvlist(nvparent, name, nvl);
305 	nvlist_destroy(nvl);
306 }
307 
308 static void
309 pf_nvdivert_to_divert(const nvlist_t *nvl, struct pfctl_rule *rule)
310 {
311 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "addr"), &rule->divert.addr);
312 	rule->divert.port = nvlist_get_number(nvl, "port");
313 }
314 
315 static void
316 pf_nvrule_to_rule(const nvlist_t *nvl, struct pfctl_rule *rule)
317 {
318 	const uint64_t *skip;
319 	const char *const *labels;
320 	size_t skipcount, labelcount;
321 
322 	rule->nr = nvlist_get_number(nvl, "nr");
323 
324 	pf_nvrule_addr_to_rule_addr(nvlist_get_nvlist(nvl, "src"), &rule->src);
325 	pf_nvrule_addr_to_rule_addr(nvlist_get_nvlist(nvl, "dst"), &rule->dst);
326 
327 	skip = nvlist_get_number_array(nvl, "skip", &skipcount);
328 	assert(skip);
329 	assert(skipcount == PF_SKIP_COUNT);
330 	for (int i = 0; i < PF_SKIP_COUNT; i++)
331 		rule->skip[i].nr = skip[i];
332 
333 	labels = nvlist_get_string_array(nvl, "labels", &labelcount);
334 	assert(labelcount <= PF_RULE_MAX_LABEL_COUNT);
335 	for (size_t i = 0; i < labelcount; i++)
336 		strlcpy(rule->label[i], labels[i], PF_RULE_LABEL_SIZE);
337 	strlcpy(rule->ifname, nvlist_get_string(nvl, "ifname"), IFNAMSIZ);
338 	strlcpy(rule->qname, nvlist_get_string(nvl, "qname"), PF_QNAME_SIZE);
339 	strlcpy(rule->pqname, nvlist_get_string(nvl, "pqname"), PF_QNAME_SIZE);
340 	strlcpy(rule->tagname, nvlist_get_string(nvl, "tagname"),
341 	    PF_TAG_NAME_SIZE);
342 	strlcpy(rule->match_tagname, nvlist_get_string(nvl, "match_tagname"),
343 	    PF_TAG_NAME_SIZE);
344 
345 	strlcpy(rule->overload_tblname, nvlist_get_string(nvl, "overload_tblname"),
346 	    PF_TABLE_NAME_SIZE);
347 
348 	pf_nvpool_to_pool(nvlist_get_nvlist(nvl, "rpool"), &rule->rpool);
349 
350 	rule->evaluations = nvlist_get_number(nvl, "evaluations");
351 	pf_nvuint_64_array(nvl, "packets", 2, rule->packets, NULL);
352 	pf_nvuint_64_array(nvl, "bytes", 2, rule->bytes, NULL);
353 
354 	rule->os_fingerprint = nvlist_get_number(nvl, "os_fingerprint");
355 
356 	rule->rtableid = nvlist_get_number(nvl, "rtableid");
357 	pf_nvuint_32_array(nvl, "timeout", PFTM_MAX, rule->timeout, NULL);
358 	rule->max_states = nvlist_get_number(nvl, "max_states");
359 	rule->max_src_nodes = nvlist_get_number(nvl, "max_src_nodes");
360 	rule->max_src_states = nvlist_get_number(nvl, "max_src_states");
361 	rule->max_src_conn = nvlist_get_number(nvl, "max_src_conn");
362 	rule->max_src_conn_rate.limit =
363 	    nvlist_get_number(nvl, "max_src_conn_rate.limit");
364 	rule->max_src_conn_rate.seconds =
365 	    nvlist_get_number(nvl, "max_src_conn_rate.seconds");
366 	rule->qid = nvlist_get_number(nvl, "qid");
367 	rule->pqid = nvlist_get_number(nvl, "pqid");
368 	rule->prob = nvlist_get_number(nvl, "prob");
369 	rule->cuid = nvlist_get_number(nvl, "cuid");
370 	rule->cpid = nvlist_get_number(nvl, "cpid");
371 
372 	rule->return_icmp = nvlist_get_number(nvl, "return_icmp");
373 	rule->return_icmp6 = nvlist_get_number(nvl, "return_icmp6");
374 	rule->max_mss = nvlist_get_number(nvl, "max_mss");
375 	rule->scrub_flags = nvlist_get_number(nvl, "scrub_flags");
376 
377 	pf_nvrule_uid_to_rule_uid(nvlist_get_nvlist(nvl, "uid"), &rule->uid);
378 	pf_nvrule_uid_to_rule_uid(nvlist_get_nvlist(nvl, "gid"),
379 	    (struct pf_rule_uid *)&rule->gid);
380 
381 	rule->rule_flag = nvlist_get_number(nvl, "rule_flag");
382 	rule->action = nvlist_get_number(nvl, "action");
383 	rule->direction = nvlist_get_number(nvl, "direction");
384 	rule->log = nvlist_get_number(nvl, "log");
385 	rule->logif = nvlist_get_number(nvl, "logif");
386 	rule->quick = nvlist_get_number(nvl, "quick");
387 	rule->ifnot = nvlist_get_number(nvl, "ifnot");
388 	rule->match_tag_not = nvlist_get_number(nvl, "match_tag_not");
389 	rule->natpass = nvlist_get_number(nvl, "natpass");
390 
391 	rule->keep_state = nvlist_get_number(nvl, "keep_state");
392 	rule->af = nvlist_get_number(nvl, "af");
393 	rule->proto = nvlist_get_number(nvl, "proto");
394 	rule->type = nvlist_get_number(nvl, "type");
395 	rule->code = nvlist_get_number(nvl, "code");
396 	rule->flags = nvlist_get_number(nvl, "flags");
397 	rule->flagset = nvlist_get_number(nvl, "flagset");
398 	rule->min_ttl = nvlist_get_number(nvl, "min_ttl");
399 	rule->allow_opts = nvlist_get_number(nvl, "allow_opts");
400 	rule->rt = nvlist_get_number(nvl, "rt");
401 	rule->return_ttl  = nvlist_get_number(nvl, "return_ttl");
402 	rule->tos = nvlist_get_number(nvl, "tos");
403 	rule->set_tos = nvlist_get_number(nvl, "set_tos");
404 	rule->anchor_relative = nvlist_get_number(nvl, "anchor_relative");
405 	rule->anchor_wildcard = nvlist_get_number(nvl, "anchor_wildcard");
406 
407 	rule->flush = nvlist_get_number(nvl, "flush");
408 	rule->prio = nvlist_get_number(nvl, "prio");
409 	pf_nvuint_8_array(nvl, "set_prio", 2, rule->set_prio, NULL);
410 
411 	pf_nvdivert_to_divert(nvlist_get_nvlist(nvl, "divert"), rule);
412 
413 	rule->states_cur = nvlist_get_number(nvl, "states_cur");
414 	rule->states_tot = nvlist_get_number(nvl, "states_tot");
415 	rule->src_nodes = nvlist_get_number(nvl, "src_nodes");
416 }
417 
418 int
419 pfctl_add_rule(int dev, const struct pfctl_rule *r, const char *anchor,
420     const char *anchor_call, u_int32_t ticket, u_int32_t pool_ticket)
421 {
422 	struct pfioc_nv nv;
423 	u_int64_t timeouts[PFTM_MAX];
424 	u_int64_t set_prio[2];
425 	nvlist_t *nvl, *nvlr;
426 	size_t labelcount;
427 	int ret;
428 
429 	nvl = nvlist_create(0);
430 	nvlr = nvlist_create(0);
431 
432 	nvlist_add_number(nvl, "ticket", ticket);
433 	nvlist_add_number(nvl, "pool_ticket", pool_ticket);
434 	nvlist_add_string(nvl, "anchor", anchor);
435 	nvlist_add_string(nvl, "anchor_call", anchor_call);
436 
437 	nvlist_add_number(nvlr, "nr", r->nr);
438 	pfctl_nv_add_rule_addr(nvlr, "src", &r->src);
439 	pfctl_nv_add_rule_addr(nvlr, "dst", &r->dst);
440 
441 	labelcount = 0;
442 	while (r->label[labelcount][0] != 0 &&
443 	    labelcount < PF_RULE_MAX_LABEL_COUNT) {
444 		nvlist_append_string_array(nvlr, "labels",
445 		    r->label[labelcount]);
446 		labelcount++;
447 	}
448 
449 	nvlist_add_string(nvlr, "ifname", r->ifname);
450 	nvlist_add_string(nvlr, "qname", r->qname);
451 	nvlist_add_string(nvlr, "pqname", r->pqname);
452 	nvlist_add_string(nvlr, "tagname", r->tagname);
453 	nvlist_add_string(nvlr, "match_tagname", r->match_tagname);
454 	nvlist_add_string(nvlr, "overload_tblname", r->overload_tblname);
455 
456 	pfctl_nv_add_pool(nvlr, "rpool", &r->rpool);
457 
458 	nvlist_add_number(nvlr, "os_fingerprint", r->os_fingerprint);
459 
460 	nvlist_add_number(nvlr, "rtableid", r->rtableid);
461 	for (int i = 0; i < PFTM_MAX; i++)
462 		timeouts[i] = r->timeout[i];
463 	nvlist_add_number_array(nvlr, "timeout", timeouts, PFTM_MAX);
464 	nvlist_add_number(nvlr, "max_states", r->max_states);
465 	nvlist_add_number(nvlr, "max_src_nodes", r->max_src_nodes);
466 	nvlist_add_number(nvlr, "max_src_states", r->max_src_states);
467 	nvlist_add_number(nvlr, "max_src_conn", r->max_src_conn);
468 	nvlist_add_number(nvlr, "max_src_conn_rate.limit",
469 	    r->max_src_conn_rate.limit);
470 	nvlist_add_number(nvlr, "max_src_conn_rate.seconds",
471 	    r->max_src_conn_rate.seconds);
472 	nvlist_add_number(nvlr, "prob", r->prob);
473 	nvlist_add_number(nvlr, "cuid", r->cuid);
474 	nvlist_add_number(nvlr, "cpid", r->cpid);
475 
476 	nvlist_add_number(nvlr, "return_icmp", r->return_icmp);
477 	nvlist_add_number(nvlr, "return_icmp6", r->return_icmp6);
478 
479 	nvlist_add_number(nvlr, "max_mss", r->max_mss);
480 	nvlist_add_number(nvlr, "scrub_flags", r->scrub_flags);
481 
482 	pfctl_nv_add_uid(nvlr, "uid", &r->uid);
483 	pfctl_nv_add_uid(nvlr, "gid", (const struct pf_rule_uid *)&r->gid);
484 
485 	nvlist_add_number(nvlr, "rule_flag", r->rule_flag);
486 	nvlist_add_number(nvlr, "action", r->action);
487 	nvlist_add_number(nvlr, "direction", r->direction);
488 	nvlist_add_number(nvlr, "log", r->log);
489 	nvlist_add_number(nvlr, "logif", r->logif);
490 	nvlist_add_number(nvlr, "quick", r->quick);
491 	nvlist_add_number(nvlr, "ifnot", r->ifnot);
492 	nvlist_add_number(nvlr, "match_tag_not", r->match_tag_not);
493 	nvlist_add_number(nvlr, "natpass", r->natpass);
494 
495 	nvlist_add_number(nvlr, "keep_state", r->keep_state);
496 	nvlist_add_number(nvlr, "af", r->af);
497 	nvlist_add_number(nvlr, "proto", r->proto);
498 	nvlist_add_number(nvlr, "type", r->type);
499 	nvlist_add_number(nvlr, "code", r->code);
500 	nvlist_add_number(nvlr, "flags", r->flags);
501 	nvlist_add_number(nvlr, "flagset", r->flagset);
502 	nvlist_add_number(nvlr, "min_ttl", r->min_ttl);
503 	nvlist_add_number(nvlr, "allow_opts", r->allow_opts);
504 	nvlist_add_number(nvlr, "rt", r->rt);
505 	nvlist_add_number(nvlr, "return_ttl", r->return_ttl);
506 	nvlist_add_number(nvlr, "tos", r->tos);
507 	nvlist_add_number(nvlr, "set_tos", r->set_tos);
508 	nvlist_add_number(nvlr, "anchor_relative", r->anchor_relative);
509 	nvlist_add_number(nvlr, "anchor_wildcard", r->anchor_wildcard);
510 
511 	nvlist_add_number(nvlr, "flush", r->flush);
512 
513 	nvlist_add_number(nvlr, "prio", r->prio);
514 	set_prio[0] = r->set_prio[0];
515 	set_prio[1] = r->set_prio[1];
516 	nvlist_add_number_array(nvlr, "set_prio", set_prio, 2);
517 
518 	pfctl_nv_add_divert(nvlr, "divert", r);
519 
520 	nvlist_add_nvlist(nvl, "rule", nvlr);
521 	nvlist_destroy(nvlr);
522 
523 	/* Now do the call. */
524 	nv.data = nvlist_pack(nvl, &nv.len);
525 	nv.size = nv.len;
526 
527 	ret = ioctl(dev, DIOCADDRULENV, &nv);
528 
529 	free(nv.data);
530 	nvlist_destroy(nvl);
531 
532 	return (ret);
533 }
534 
535 int
536 pfctl_get_rule(int dev, u_int32_t nr, u_int32_t ticket, const char *anchor,
537     u_int32_t ruleset, struct pfctl_rule *rule, char *anchor_call)
538 {
539 	return (pfctl_get_clear_rule(dev, nr, ticket, anchor, ruleset, rule,
540 	    anchor_call, false));
541 }
542 
543 int	pfctl_get_clear_rule(int dev, u_int32_t nr, u_int32_t ticket,
544 	    const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule,
545 	    char *anchor_call, bool clear)
546 {
547 	struct pfioc_nv nv;
548 	nvlist_t *nvl;
549 	void *nvlpacked;
550 	int ret;
551 
552 	nvl = nvlist_create(0);
553 	if (nvl == 0)
554 		return (ENOMEM);
555 
556 	nvlist_add_number(nvl, "nr", nr);
557 	nvlist_add_number(nvl, "ticket", ticket);
558 	nvlist_add_string(nvl, "anchor", anchor);
559 	nvlist_add_number(nvl, "ruleset", ruleset);
560 
561 	if (clear)
562 		nvlist_add_bool(nvl, "clear_counter", true);
563 
564 	nvlpacked = nvlist_pack(nvl, &nv.len);
565 	if (nvlpacked == NULL) {
566 		nvlist_destroy(nvl);
567 		return (ENOMEM);
568 	}
569 	nv.data = malloc(8182);
570 	nv.size = 8192;
571 	assert(nv.len <= nv.size);
572 	memcpy(nv.data, nvlpacked, nv.len);
573 	nvlist_destroy(nvl);
574 	nvl = NULL;
575 	free(nvlpacked);
576 
577 	ret = ioctl(dev, DIOCGETRULENV, &nv);
578 	if (ret != 0) {
579 		free(nv.data);
580 		return (ret);
581 	}
582 
583 	nvl = nvlist_unpack(nv.data, nv.len, 0);
584 	if (nvl == NULL) {
585 		free(nv.data);
586 		return (EIO);
587 	}
588 
589 	pf_nvrule_to_rule(nvlist_get_nvlist(nvl, "rule"), rule);
590 
591 	if (anchor_call)
592 		strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
593 		    MAXPATHLEN);
594 
595 	free(nv.data);
596 	nvlist_destroy(nvl);
597 
598 	return (0);
599 }
600 
601 int
602 pfctl_set_keepcounters(int dev, bool keep)
603 {
604 	struct pfioc_nv	 nv;
605 	nvlist_t	*nvl;
606 	int		 ret;
607 
608 	nvl = nvlist_create(0);
609 
610 	nvlist_add_bool(nvl, "keep_counters", keep);
611 
612 	nv.data = nvlist_pack(nvl, &nv.len);
613 	nv.size = nv.len;
614 
615 	nvlist_destroy(nvl);
616 
617 	ret = ioctl(dev, DIOCKEEPCOUNTERS, &nv);
618 
619 	free(nv.data);
620 	return (ret);
621 }
622 
623 static void
624 pfctl_nv_add_state_cmp(nvlist_t *nvl, const char *name,
625     const struct pfctl_state_cmp *cmp)
626 {
627 	nvlist_t	*nv;
628 
629 	nv = nvlist_create(0);
630 
631 	nvlist_add_number(nv, "id", cmp->id);
632 	nvlist_add_number(nv, "creatorid", cmp->creatorid);
633 	nvlist_add_number(nv, "direction", cmp->direction);
634 
635 	nvlist_add_nvlist(nvl, name, nv);
636 	nvlist_destroy(nv);
637 }
638 
639 static void
640 pf_state_key_export_to_state_key(struct pfctl_state_key *ps,
641     const struct pf_state_key_export *s)
642 {
643 	bcopy(s->addr, ps->addr, sizeof(ps->addr[0]) * 2);
644 	ps->port[0] = s->port[0];
645 	ps->port[1] = s->port[1];
646 }
647 
648 static void
649 pf_state_peer_export_to_state_peer(struct pfctl_state_peer *ps,
650     const struct pf_state_peer_export *s)
651 {
652 	/* Ignore scrub. */
653 	ps->seqlo = s->seqlo;
654 	ps->seqhi = s->seqhi;
655 	ps->seqdiff = s->seqdiff;
656 	/* Ignore max_win & mss */
657 	ps->state = s->state;
658 	ps->wscale = s->wscale;
659 }
660 
661 static void
662 pf_state_export_to_state(struct pfctl_state *ps, const struct pf_state_export *s)
663 {
664 	assert(s->version >= PF_STATE_VERSION);
665 
666 	ps->id = s->id;
667 	strlcpy(ps->ifname, s->ifname, sizeof(ps->ifname));
668 	strlcpy(ps->orig_ifname, s->orig_ifname, sizeof(ps->orig_ifname));
669 	pf_state_key_export_to_state_key(&ps->key[0], &s->key[0]);
670 	pf_state_key_export_to_state_key(&ps->key[1], &s->key[1]);
671 	pf_state_peer_export_to_state_peer(&ps->src, &s->src);
672 	pf_state_peer_export_to_state_peer(&ps->dst, &s->dst);
673 	bcopy(&s->rt_addr, &ps->rt_addr, sizeof(ps->rt_addr));
674 	ps->rule = s->rule;
675 	ps->anchor = s->anchor;
676 	ps->nat_rule = s->nat_rule;
677 	ps->creation = s->creation;
678 	ps->expire = s->expire;
679 	ps->packets[0] = s->packets[0];
680 	ps->packets[1] = s->packets[1];
681 	ps->bytes[0] = s->bytes[0];
682 	ps->bytes[1] = s->bytes[1];
683 	ps->creatorid = s->creatorid;
684 	ps->key[0].proto = s->proto;
685 	ps->key[1].proto = s->proto;
686 	ps->key[0].af = s->af;
687 	ps->key[1].af = s->af;
688 	ps->direction = s->direction;
689 	ps->state_flags = s->state_flags;
690 	ps->sync_flags = s->sync_flags;
691 }
692 
693 int
694 pfctl_get_states(int dev, struct pfctl_states *states)
695 {
696 	struct pfioc_states_v2 ps;
697 	struct pf_state_export *p;
698 	char *inbuf = NULL, *newinbuf = NULL;
699 	unsigned int len = 0;
700 	int i, error;
701 
702 	bzero(&ps, sizeof(ps));
703 	ps.ps_req_version = PF_STATE_VERSION;
704 
705 	bzero(states, sizeof(*states));
706 	TAILQ_INIT(&states->states);
707 
708 	for (;;) {
709 		ps.ps_len = len;
710 		if (len) {
711 			newinbuf = realloc(inbuf, len);
712 			if (newinbuf == NULL)
713 				return (ENOMEM);
714 			ps.ps_buf = inbuf = newinbuf;
715 		}
716 		if ((error = ioctl(dev, DIOCGETSTATESV2, &ps)) < 0) {
717 			free(inbuf);
718 			return (error);
719 		}
720 		if (ps.ps_len + sizeof(struct pfioc_states_v2) < len)
721 			break;
722 		if (len == 0 && ps.ps_len == 0)
723 			goto out;
724 		if (len == 0 && ps.ps_len != 0)
725 			len = ps.ps_len;
726 		if (ps.ps_len == 0)
727 			goto out;      /* no states */
728 		len *= 2;
729 	}
730 	p = ps.ps_states;
731 
732 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
733 		struct pfctl_state *s = malloc(sizeof(*s));
734 		if (s == NULL) {
735 			pfctl_free_states(states);
736 			error = ENOMEM;
737 			goto out;
738 		}
739 
740 		pf_state_export_to_state(s, p);
741 		TAILQ_INSERT_TAIL(&states->states, s, entry);
742 	}
743 
744 out:
745 	free(inbuf);
746 	return (error);
747 }
748 
749 void
750 pfctl_free_states(struct pfctl_states *states)
751 {
752 	struct pfctl_state *s, *tmp;
753 
754 	TAILQ_FOREACH_SAFE(s, &states->states, entry, tmp) {
755 		free(s);
756 	}
757 
758 	bzero(states, sizeof(*states));
759 }
760 
761 static int
762 _pfctl_clear_states(int dev, const struct pfctl_kill *kill,
763     unsigned int *killed, uint64_t ioctlval)
764 {
765 	struct pfioc_nv	 nv;
766 	nvlist_t	*nvl;
767 	int		 ret;
768 
769 	nvl = nvlist_create(0);
770 
771 	pfctl_nv_add_state_cmp(nvl, "cmp", &kill->cmp);
772 	nvlist_add_number(nvl, "af", kill->af);
773 	nvlist_add_number(nvl, "proto", kill->proto);
774 	pfctl_nv_add_rule_addr(nvl, "src", &kill->src);
775 	pfctl_nv_add_rule_addr(nvl, "dst", &kill->dst);
776 	pfctl_nv_add_rule_addr(nvl, "rt_addr", &kill->rt_addr);
777 	nvlist_add_string(nvl, "ifname", kill->ifname);
778 	nvlist_add_string(nvl, "label", kill->label);
779 	nvlist_add_bool(nvl, "kill_match", kill->kill_match);
780 
781 	nv.data = nvlist_pack(nvl, &nv.len);
782 	nv.size = nv.len;
783 	nvlist_destroy(nvl);
784 	nvl = NULL;
785 
786 	ret = ioctl(dev, ioctlval, &nv);
787 	if (ret != 0) {
788 		free(nv.data);
789 		return (ret);
790 	}
791 
792 	nvl = nvlist_unpack(nv.data, nv.len, 0);
793 	if (nvl == NULL) {
794 		free(nv.data);
795 		return (EIO);
796 	}
797 
798 	if (killed)
799 		*killed = nvlist_get_number(nvl, "killed");
800 
801 	nvlist_destroy(nvl);
802 	free(nv.data);
803 
804 	return (ret);
805 }
806 
807 int
808 pfctl_clear_states(int dev, const struct pfctl_kill *kill,
809     unsigned int *killed)
810 {
811 	return (_pfctl_clear_states(dev, kill, killed, DIOCCLRSTATESNV));
812 }
813 
814 int
815 pfctl_kill_states(int dev, const struct pfctl_kill *kill, unsigned int *killed)
816 {
817 	return (_pfctl_clear_states(dev, kill, killed, DIOCKILLSTATESNV));
818 }
819 
820 int
821 pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s)
822 {
823 	struct pfioc_nv	 nv;
824 	nvlist_t	*nvl;
825 	int		 ret;
826 
827 	nvl = nvlist_create(0);
828 
829 	nvlist_add_bool(nvl, "enabled", s->mode != PFCTL_SYNCOOKIES_NEVER);
830 	nvlist_add_bool(nvl, "adaptive", false); /* XXX TODO */
831 
832 	nv.data = nvlist_pack(nvl, &nv.len);
833 	nv.size = nv.len;
834 	nvlist_destroy(nvl);
835 	nvl = NULL;
836 
837 	ret = ioctl(dev, DIOCSETSYNCOOKIES, &nv);
838 
839 	free(nv.data);
840 	return (ret);
841 }
842 
843 int
844 pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
845 {
846 	struct pfioc_nv	 nv;
847 	nvlist_t	*nvl;
848 	bool		enabled, adaptive;
849 
850 	bzero(s, sizeof(*s));
851 
852 	nv.data = malloc(128);
853 	nv.len = nv.size = 128;
854 
855 	if (ioctl(dev, DIOCGETSYNCOOKIES, &nv)) {
856 		free(nv.data);
857 		return (errno);
858 	}
859 
860 	nvl = nvlist_unpack(nv.data, nv.len, 0);
861 	free(nv.data);
862 	if (nvl == NULL) {
863 		free(nv.data);
864 		return (EIO);
865 	}
866 
867 	enabled = nvlist_get_bool(nvl, "enabled");
868 	adaptive = nvlist_get_bool(nvl, "adaptive");
869 
870 	s->mode = enabled ? PFCTL_SYNCOOKIES_ALWAYS : PFCTL_SYNCOOKIES_NEVER;
871 
872 	nvlist_destroy(nvl);
873 
874 	return (0);
875 }
876