xref: /freebsd/lib/libpfctl/libpfctl.c (revision ba3c1f5972d7b90feb6e6da47905ff2757e0fe57)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021 Rubicon Communications, LLC (Netgate)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  * $FreeBSD$
32  */
33 
34 #include <sys/cdefs.h>
35 
36 #include <sys/ioctl.h>
37 #include <sys/nv.h>
38 #include <sys/queue.h>
39 #include <sys/types.h>
40 
41 #include <net/if.h>
42 #include <net/pfvar.h>
43 #include <netinet/in.h>
44 
45 #include <assert.h>
46 #include <err.h>
47 #include <errno.h>
48 #include <stdlib.h>
49 #include <string.h>
50 
51 #include "libpfctl.h"
52 
53 const char* PFCTL_SYNCOOKIES_MODE_NAMES[] = {
54 	"never",
55 	"always",
56 	"adaptive"
57 };
58 
59 static int	_pfctl_clear_states(int , const struct pfctl_kill *,
60 		    unsigned int *, uint64_t);
61 
62 static int
63 pfctl_do_ioctl(int dev, uint cmd, size_t size, nvlist_t **nvl)
64 {
65 	struct pfioc_nv nv;
66 	void *data;
67 	size_t nvlen;
68 	int ret;
69 
70 	data = nvlist_pack(*nvl, &nvlen);
71 	if (nvlen > size)
72 		size = nvlen;
73 
74 retry:
75 	nv.data = malloc(size);
76 	memcpy(nv.data, data, nvlen);
77 	free(data);
78 
79 	nv.len = nvlen;
80 	nv.size = size;
81 
82 	ret = ioctl(dev, cmd, &nv);
83 	if (ret == -1 && errno == ENOSPC) {
84 		size *= 2;
85 		free(nv.data);
86 		goto retry;
87 	}
88 
89 	nvlist_destroy(*nvl);
90 	*nvl = NULL;
91 
92 	if (ret == 0) {
93 		*nvl = nvlist_unpack(nv.data, nv.len, 0);
94 		if (*nvl == NULL) {
95 			free(nv.data);
96 			return (EIO);
97 		}
98 	} else {
99 		ret = errno;
100 	}
101 
102 	free(nv.data);
103 
104 	return (ret);
105 }
106 
107 static void
108 pf_nvuint_8_array(const nvlist_t *nvl, const char *name, size_t maxelems,
109     uint8_t *numbers, size_t *nelems)
110 {
111 	const uint64_t *tmp;
112 	size_t elems;
113 
114 	tmp = nvlist_get_number_array(nvl, name, &elems);
115 	assert(elems <= maxelems);
116 
117 	for (size_t i = 0; i < elems; i++)
118 		numbers[i] = tmp[i];
119 
120 	if (nelems)
121 		*nelems = elems;
122 }
123 
124 static void
125 pf_nvuint_16_array(const nvlist_t *nvl, const char *name, size_t maxelems,
126     uint16_t *numbers, size_t *nelems)
127 {
128 	const uint64_t *tmp;
129 	size_t elems;
130 
131 	tmp = nvlist_get_number_array(nvl, name, &elems);
132 	assert(elems <= maxelems);
133 
134 	for (size_t i = 0; i < elems; i++)
135 		numbers[i] = tmp[i];
136 
137 	if (nelems)
138 		*nelems = elems;
139 }
140 
141 static void
142 pf_nvuint_32_array(const nvlist_t *nvl, const char *name, size_t maxelems,
143     uint32_t *numbers, size_t *nelems)
144 {
145 	const uint64_t *tmp;
146 	size_t elems;
147 
148 	tmp = nvlist_get_number_array(nvl, name, &elems);
149 	assert(elems <= maxelems);
150 
151 	for (size_t i = 0; i < elems; i++)
152 		numbers[i] = tmp[i];
153 
154 	if (nelems)
155 		*nelems = elems;
156 }
157 
158 static void
159 pf_nvuint_64_array(const nvlist_t *nvl, const char *name, size_t maxelems,
160     uint64_t *numbers, size_t *nelems)
161 {
162 	const uint64_t *tmp;
163 	size_t elems;
164 
165 	tmp = nvlist_get_number_array(nvl, name, &elems);
166 	assert(elems <= maxelems);
167 
168 	for (size_t i = 0; i < elems; i++)
169 		numbers[i] = tmp[i];
170 
171 	if (nelems)
172 		*nelems = elems;
173 }
174 
175 static void
176 _pfctl_get_status_counters(const nvlist_t *nvl,
177     struct pfctl_status_counters *counters)
178 {
179 	const uint64_t		*ids, *counts;
180 	const char *const	*names;
181 	size_t id_len, counter_len, names_len;
182 
183 	ids = nvlist_get_number_array(nvl, "ids", &id_len);
184 	counts = nvlist_get_number_array(nvl, "counters", &counter_len);
185 	names = nvlist_get_string_array(nvl, "names", &names_len);
186 	assert(id_len == counter_len);
187 	assert(counter_len == names_len);
188 
189 	TAILQ_INIT(counters);
190 
191 	for (size_t i = 0; i < id_len; i++) {
192 		struct pfctl_status_counter *c;
193 
194 		c = malloc(sizeof(*c));
195 
196 		c->id = ids[i];
197 		c->counter = counts[i];
198 		c->name = strdup(names[i]);
199 
200 		TAILQ_INSERT_TAIL(counters, c, entry);
201 	}
202 }
203 
204 struct pfctl_status *
205 pfctl_get_status(int dev)
206 {
207 	struct pfctl_status	*status;
208 	nvlist_t	*nvl;
209 	size_t		 len;
210 	const void	*chksum;
211 
212 	status = calloc(1, sizeof(*status));
213 	if (status == NULL)
214 		return (NULL);
215 
216 	nvl = nvlist_create(0);
217 
218 	if (pfctl_do_ioctl(dev, DIOCGETSTATUSNV, 4096, &nvl)) {
219 		free(status);
220 		return (NULL);
221 	}
222 
223 	status->running = nvlist_get_bool(nvl, "running");
224 	status->since = nvlist_get_number(nvl, "since");
225 	status->debug = nvlist_get_number(nvl, "debug");
226 	status->hostid = ntohl(nvlist_get_number(nvl, "hostid"));
227 	status->states = nvlist_get_number(nvl, "states");
228 	status->src_nodes = nvlist_get_number(nvl, "src_nodes");
229 	status->syncookies_active = nvlist_get_bool(nvl, "syncookies_active");
230 	status->reass = nvlist_get_number(nvl, "reass");
231 
232 	strlcpy(status->ifname, nvlist_get_string(nvl, "ifname"),
233 	    IFNAMSIZ);
234 	chksum = nvlist_get_binary(nvl, "chksum", &len);
235 	assert(len == PF_MD5_DIGEST_LENGTH);
236 	memcpy(status->pf_chksum, chksum, len);
237 
238 	_pfctl_get_status_counters(nvlist_get_nvlist(nvl, "counters"),
239 	    &status->counters);
240 	_pfctl_get_status_counters(nvlist_get_nvlist(nvl, "lcounters"),
241 	    &status->lcounters);
242 	_pfctl_get_status_counters(nvlist_get_nvlist(nvl, "fcounters"),
243 	    &status->fcounters);
244 	_pfctl_get_status_counters(nvlist_get_nvlist(nvl, "scounters"),
245 	    &status->scounters);
246 
247 	pf_nvuint_64_array(nvl, "pcounters", 2 * 2 * 3,
248 	    (uint64_t *)status->pcounters, NULL);
249 	pf_nvuint_64_array(nvl, "bcounters", 2 * 2,
250 	    (uint64_t *)status->bcounters, NULL);
251 
252 	nvlist_destroy(nvl);
253 
254 	return (status);
255 }
256 
257 void
258 pfctl_free_status(struct pfctl_status *status)
259 {
260 	struct pfctl_status_counter *c, *tmp;
261 
262 	TAILQ_FOREACH_SAFE(c, &status->counters, entry, tmp) {
263 		free(c->name);
264 		free(c);
265 	}
266 	TAILQ_FOREACH_SAFE(c, &status->lcounters, entry, tmp) {
267 		free(c->name);
268 		free(c);
269 	}
270 	TAILQ_FOREACH_SAFE(c, &status->fcounters, entry, tmp) {
271 		free(c->name);
272 		free(c);
273 	}
274 	TAILQ_FOREACH_SAFE(c, &status->scounters, entry, tmp) {
275 		free(c->name);
276 		free(c);
277 	}
278 
279 	free(status);
280 }
281 
282 static void
283 pfctl_nv_add_addr(nvlist_t *nvparent, const char *name,
284     const struct pf_addr *addr)
285 {
286 	nvlist_t *nvl = nvlist_create(0);
287 
288 	nvlist_add_binary(nvl, "addr", addr, sizeof(*addr));
289 
290 	nvlist_add_nvlist(nvparent, name, nvl);
291 	nvlist_destroy(nvl);
292 }
293 
294 static void
295 pf_nvaddr_to_addr(const nvlist_t *nvl, struct pf_addr *addr)
296 {
297 	size_t len;
298 	const void *data;
299 
300 	data = nvlist_get_binary(nvl, "addr", &len);
301 	assert(len == sizeof(struct pf_addr));
302 	memcpy(addr, data, len);
303 }
304 
305 static void
306 pfctl_nv_add_addr_wrap(nvlist_t *nvparent, const char *name,
307     const struct pf_addr_wrap *addr)
308 {
309 	nvlist_t *nvl = nvlist_create(0);
310 
311 	nvlist_add_number(nvl, "type", addr->type);
312 	nvlist_add_number(nvl, "iflags", addr->iflags);
313 	if (addr->type == PF_ADDR_DYNIFTL)
314 		nvlist_add_string(nvl, "ifname", addr->v.ifname);
315 	if (addr->type == PF_ADDR_TABLE)
316 		nvlist_add_string(nvl, "tblname", addr->v.tblname);
317 	pfctl_nv_add_addr(nvl, "addr", &addr->v.a.addr);
318 	pfctl_nv_add_addr(nvl, "mask", &addr->v.a.mask);
319 
320 	nvlist_add_nvlist(nvparent, name, nvl);
321 	nvlist_destroy(nvl);
322 }
323 
324 static void
325 pf_nvaddr_wrap_to_addr_wrap(const nvlist_t *nvl, struct pf_addr_wrap *addr)
326 {
327 	bzero(addr, sizeof(*addr));
328 
329 	addr->type = nvlist_get_number(nvl, "type");
330 	addr->iflags = nvlist_get_number(nvl, "iflags");
331 	if (addr->type == PF_ADDR_DYNIFTL) {
332 		strlcpy(addr->v.ifname, nvlist_get_string(nvl, "ifname"),
333 		    IFNAMSIZ);
334 		addr->p.dyncnt = nvlist_get_number(nvl, "dyncnt");
335 	}
336 	if (addr->type == PF_ADDR_TABLE) {
337 		strlcpy(addr->v.tblname, nvlist_get_string(nvl, "tblname"),
338 		    PF_TABLE_NAME_SIZE);
339 		addr->p.tblcnt = nvlist_get_number(nvl, "tblcnt");
340 	}
341 
342 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "addr"), &addr->v.a.addr);
343 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "mask"), &addr->v.a.mask);
344 }
345 
346 static void
347 pfctl_nv_add_rule_addr(nvlist_t *nvparent, const char *name,
348     const struct pf_rule_addr *addr)
349 {
350 	uint64_t ports[2];
351 	nvlist_t *nvl = nvlist_create(0);
352 
353 	pfctl_nv_add_addr_wrap(nvl, "addr", &addr->addr);
354 	ports[0] = addr->port[0];
355 	ports[1] = addr->port[1];
356 	nvlist_add_number_array(nvl, "port", ports, 2);
357 	nvlist_add_number(nvl, "neg", addr->neg);
358 	nvlist_add_number(nvl, "port_op", addr->port_op);
359 
360 	nvlist_add_nvlist(nvparent, name, nvl);
361 	nvlist_destroy(nvl);
362 }
363 
364 static void
365 pf_nvrule_addr_to_rule_addr(const nvlist_t *nvl, struct pf_rule_addr *addr)
366 {
367 	pf_nvaddr_wrap_to_addr_wrap(nvlist_get_nvlist(nvl, "addr"), &addr->addr);
368 
369 	pf_nvuint_16_array(nvl, "port", 2, addr->port, NULL);
370 	addr->neg = nvlist_get_number(nvl, "neg");
371 	addr->port_op = nvlist_get_number(nvl, "port_op");
372 }
373 
374 static void
375 pfctl_nv_add_mape(nvlist_t *nvparent, const char *name,
376     const struct pf_mape_portset *mape)
377 {
378 	nvlist_t *nvl = nvlist_create(0);
379 
380 	nvlist_add_number(nvl, "offset", mape->offset);
381 	nvlist_add_number(nvl, "psidlen", mape->psidlen);
382 	nvlist_add_number(nvl, "psid", mape->psid);
383 	nvlist_add_nvlist(nvparent, name, nvl);
384 	nvlist_destroy(nvl);
385 }
386 
387 static void
388 pfctl_nv_add_pool(nvlist_t *nvparent, const char *name,
389     const struct pfctl_pool *pool)
390 {
391 	uint64_t ports[2];
392 	nvlist_t *nvl = nvlist_create(0);
393 
394 	nvlist_add_binary(nvl, "key", &pool->key, sizeof(pool->key));
395 	pfctl_nv_add_addr(nvl, "counter", &pool->counter);
396 	nvlist_add_number(nvl, "tblidx", pool->tblidx);
397 
398 	ports[0] = pool->proxy_port[0];
399 	ports[1] = pool->proxy_port[1];
400 	nvlist_add_number_array(nvl, "proxy_port", ports, 2);
401 	nvlist_add_number(nvl, "opts", pool->opts);
402 	pfctl_nv_add_mape(nvl, "mape", &pool->mape);
403 
404 	nvlist_add_nvlist(nvparent, name, nvl);
405 	nvlist_destroy(nvl);
406 }
407 
408 static void
409 pf_nvmape_to_mape(const nvlist_t *nvl, struct pf_mape_portset *mape)
410 {
411 	mape->offset = nvlist_get_number(nvl, "offset");
412 	mape->psidlen = nvlist_get_number(nvl, "psidlen");
413 	mape->psid = nvlist_get_number(nvl, "psid");
414 }
415 
416 static void
417 pf_nvpool_to_pool(const nvlist_t *nvl, struct pfctl_pool *pool)
418 {
419 	size_t len;
420 	const void *data;
421 
422 	data = nvlist_get_binary(nvl, "key", &len);
423 	assert(len == sizeof(pool->key));
424 	memcpy(&pool->key, data, len);
425 
426 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "counter"), &pool->counter);
427 
428 	pool->tblidx = nvlist_get_number(nvl, "tblidx");
429 	pf_nvuint_16_array(nvl, "proxy_port", 2, pool->proxy_port, NULL);
430 	pool->opts = nvlist_get_number(nvl, "opts");
431 
432 	if (nvlist_exists_nvlist(nvl, "mape"))
433 		pf_nvmape_to_mape(nvlist_get_nvlist(nvl, "mape"), &pool->mape);
434 }
435 
436 static void
437 pfctl_nv_add_uid(nvlist_t *nvparent, const char *name,
438     const struct pf_rule_uid *uid)
439 {
440 	uint64_t uids[2];
441 	nvlist_t *nvl = nvlist_create(0);
442 
443 	uids[0] = uid->uid[0];
444 	uids[1] = uid->uid[1];
445 	nvlist_add_number_array(nvl, "uid", uids, 2);
446 	nvlist_add_number(nvl, "op", uid->op);
447 
448 	nvlist_add_nvlist(nvparent, name, nvl);
449 	nvlist_destroy(nvl);
450 }
451 
452 static void
453 pf_nvrule_uid_to_rule_uid(const nvlist_t *nvl, struct pf_rule_uid *uid)
454 {
455 	pf_nvuint_32_array(nvl, "uid", 2, uid->uid, NULL);
456 	uid->op = nvlist_get_number(nvl, "op");
457 }
458 
459 static void
460 pfctl_nv_add_divert(nvlist_t *nvparent, const char *name,
461     const struct pfctl_rule *r)
462 {
463 	nvlist_t *nvl = nvlist_create(0);
464 
465 	pfctl_nv_add_addr(nvl, "addr", &r->divert.addr);
466 	nvlist_add_number(nvl, "port", r->divert.port);
467 
468 	nvlist_add_nvlist(nvparent, name, nvl);
469 	nvlist_destroy(nvl);
470 }
471 
472 static void
473 pf_nvdivert_to_divert(const nvlist_t *nvl, struct pfctl_rule *rule)
474 {
475 	pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "addr"), &rule->divert.addr);
476 	rule->divert.port = nvlist_get_number(nvl, "port");
477 }
478 
479 static void
480 pf_nvrule_to_rule(const nvlist_t *nvl, struct pfctl_rule *rule)
481 {
482 	const uint64_t *skip;
483 	const char *const *labels;
484 	size_t skipcount, labelcount;
485 
486 	rule->nr = nvlist_get_number(nvl, "nr");
487 
488 	pf_nvrule_addr_to_rule_addr(nvlist_get_nvlist(nvl, "src"), &rule->src);
489 	pf_nvrule_addr_to_rule_addr(nvlist_get_nvlist(nvl, "dst"), &rule->dst);
490 
491 	skip = nvlist_get_number_array(nvl, "skip", &skipcount);
492 	assert(skip);
493 	assert(skipcount == PF_SKIP_COUNT);
494 	for (int i = 0; i < PF_SKIP_COUNT; i++)
495 		rule->skip[i].nr = skip[i];
496 
497 	labels = nvlist_get_string_array(nvl, "labels", &labelcount);
498 	assert(labelcount <= PF_RULE_MAX_LABEL_COUNT);
499 	for (size_t i = 0; i < labelcount; i++)
500 		strlcpy(rule->label[i], labels[i], PF_RULE_LABEL_SIZE);
501 	rule->ridentifier = nvlist_get_number(nvl, "ridentifier");
502 	strlcpy(rule->ifname, nvlist_get_string(nvl, "ifname"), IFNAMSIZ);
503 	strlcpy(rule->qname, nvlist_get_string(nvl, "qname"), PF_QNAME_SIZE);
504 	strlcpy(rule->pqname, nvlist_get_string(nvl, "pqname"), PF_QNAME_SIZE);
505 	strlcpy(rule->tagname, nvlist_get_string(nvl, "tagname"),
506 	    PF_TAG_NAME_SIZE);
507 	strlcpy(rule->match_tagname, nvlist_get_string(nvl, "match_tagname"),
508 	    PF_TAG_NAME_SIZE);
509 
510 	strlcpy(rule->overload_tblname, nvlist_get_string(nvl, "overload_tblname"),
511 	    PF_TABLE_NAME_SIZE);
512 
513 	pf_nvpool_to_pool(nvlist_get_nvlist(nvl, "rpool"), &rule->rpool);
514 
515 	rule->evaluations = nvlist_get_number(nvl, "evaluations");
516 	pf_nvuint_64_array(nvl, "packets", 2, rule->packets, NULL);
517 	pf_nvuint_64_array(nvl, "bytes", 2, rule->bytes, NULL);
518 
519 	if (nvlist_exists_number(nvl, "timestamp")) {
520 		rule->last_active_timestamp = nvlist_get_number(nvl, "timestamp");
521 	}
522 
523 	rule->os_fingerprint = nvlist_get_number(nvl, "os_fingerprint");
524 
525 	rule->rtableid = nvlist_get_number(nvl, "rtableid");
526 	pf_nvuint_32_array(nvl, "timeout", PFTM_MAX, rule->timeout, NULL);
527 	rule->max_states = nvlist_get_number(nvl, "max_states");
528 	rule->max_src_nodes = nvlist_get_number(nvl, "max_src_nodes");
529 	rule->max_src_states = nvlist_get_number(nvl, "max_src_states");
530 	rule->max_src_conn = nvlist_get_number(nvl, "max_src_conn");
531 	rule->max_src_conn_rate.limit =
532 	    nvlist_get_number(nvl, "max_src_conn_rate.limit");
533 	rule->max_src_conn_rate.seconds =
534 	    nvlist_get_number(nvl, "max_src_conn_rate.seconds");
535 	rule->qid = nvlist_get_number(nvl, "qid");
536 	rule->pqid = nvlist_get_number(nvl, "pqid");
537 	rule->dnpipe = nvlist_get_number(nvl, "dnpipe");
538 	rule->dnrpipe = nvlist_get_number(nvl, "dnrpipe");
539 	rule->free_flags = nvlist_get_number(nvl, "dnflags");
540 	rule->prob = nvlist_get_number(nvl, "prob");
541 	rule->cuid = nvlist_get_number(nvl, "cuid");
542 	rule->cpid = nvlist_get_number(nvl, "cpid");
543 
544 	rule->return_icmp = nvlist_get_number(nvl, "return_icmp");
545 	rule->return_icmp6 = nvlist_get_number(nvl, "return_icmp6");
546 	rule->max_mss = nvlist_get_number(nvl, "max_mss");
547 	rule->scrub_flags = nvlist_get_number(nvl, "scrub_flags");
548 
549 	pf_nvrule_uid_to_rule_uid(nvlist_get_nvlist(nvl, "uid"), &rule->uid);
550 	pf_nvrule_uid_to_rule_uid(nvlist_get_nvlist(nvl, "gid"),
551 	    (struct pf_rule_uid *)&rule->gid);
552 
553 	rule->rule_flag = nvlist_get_number(nvl, "rule_flag");
554 	rule->action = nvlist_get_number(nvl, "action");
555 	rule->direction = nvlist_get_number(nvl, "direction");
556 	rule->log = nvlist_get_number(nvl, "log");
557 	rule->logif = nvlist_get_number(nvl, "logif");
558 	rule->quick = nvlist_get_number(nvl, "quick");
559 	rule->ifnot = nvlist_get_number(nvl, "ifnot");
560 	rule->match_tag_not = nvlist_get_number(nvl, "match_tag_not");
561 	rule->natpass = nvlist_get_number(nvl, "natpass");
562 
563 	rule->keep_state = nvlist_get_number(nvl, "keep_state");
564 	rule->af = nvlist_get_number(nvl, "af");
565 	rule->proto = nvlist_get_number(nvl, "proto");
566 	rule->type = nvlist_get_number(nvl, "type");
567 	rule->code = nvlist_get_number(nvl, "code");
568 	rule->flags = nvlist_get_number(nvl, "flags");
569 	rule->flagset = nvlist_get_number(nvl, "flagset");
570 	rule->min_ttl = nvlist_get_number(nvl, "min_ttl");
571 	rule->allow_opts = nvlist_get_number(nvl, "allow_opts");
572 	rule->rt = nvlist_get_number(nvl, "rt");
573 	rule->return_ttl  = nvlist_get_number(nvl, "return_ttl");
574 	rule->tos = nvlist_get_number(nvl, "tos");
575 	rule->set_tos = nvlist_get_number(nvl, "set_tos");
576 	rule->anchor_relative = nvlist_get_number(nvl, "anchor_relative");
577 	rule->anchor_wildcard = nvlist_get_number(nvl, "anchor_wildcard");
578 
579 	rule->flush = nvlist_get_number(nvl, "flush");
580 	rule->prio = nvlist_get_number(nvl, "prio");
581 	pf_nvuint_8_array(nvl, "set_prio", 2, rule->set_prio, NULL);
582 
583 	pf_nvdivert_to_divert(nvlist_get_nvlist(nvl, "divert"), rule);
584 
585 	rule->states_cur = nvlist_get_number(nvl, "states_cur");
586 	rule->states_tot = nvlist_get_number(nvl, "states_tot");
587 	rule->src_nodes = nvlist_get_number(nvl, "src_nodes");
588 }
589 
590 static void
591 pfctl_nveth_addr_to_eth_addr(const nvlist_t *nvl, struct pfctl_eth_addr *addr)
592 {
593 	static const u_int8_t EMPTY_MAC[ETHER_ADDR_LEN] = { 0 };
594 	size_t len;
595 	const void *data;
596 
597 	data = nvlist_get_binary(nvl, "addr", &len);
598 	assert(len == sizeof(addr->addr));
599 	memcpy(addr->addr, data, sizeof(addr->addr));
600 
601 	data = nvlist_get_binary(nvl, "mask", &len);
602 	assert(len == sizeof(addr->mask));
603 	memcpy(addr->mask, data, sizeof(addr->mask));
604 
605 	addr->neg = nvlist_get_bool(nvl, "neg");
606 
607 	/* To make checks for 'is this address set?' easier. */
608 	addr->isset = memcmp(addr->addr, EMPTY_MAC, ETHER_ADDR_LEN) != 0;
609 }
610 
611 static nvlist_t *
612 pfctl_eth_addr_to_nveth_addr(const struct pfctl_eth_addr *addr)
613 {
614 	nvlist_t *nvl;
615 
616 	nvl = nvlist_create(0);
617 	if (nvl == NULL)
618 		return (NULL);
619 
620 	nvlist_add_bool(nvl, "neg", addr->neg);
621 	nvlist_add_binary(nvl, "addr", &addr->addr, ETHER_ADDR_LEN);
622 	nvlist_add_binary(nvl, "mask", &addr->mask, ETHER_ADDR_LEN);
623 
624 	return (nvl);
625 }
626 
627 static void
628 pfctl_nveth_rule_to_eth_rule(const nvlist_t *nvl, struct pfctl_eth_rule *rule)
629 {
630 	const char *const *labels;
631 	size_t labelcount, i;
632 
633 	rule->nr = nvlist_get_number(nvl, "nr");
634 	rule->quick = nvlist_get_bool(nvl, "quick");
635 	strlcpy(rule->ifname, nvlist_get_string(nvl, "ifname"), IFNAMSIZ);
636 	rule->ifnot = nvlist_get_bool(nvl, "ifnot");
637 	rule->direction = nvlist_get_number(nvl, "direction");
638 	rule->proto = nvlist_get_number(nvl, "proto");
639 	strlcpy(rule->match_tagname, nvlist_get_string(nvl, "match_tagname"),
640 	    PF_TAG_NAME_SIZE);
641 	rule->match_tag = nvlist_get_number(nvl, "match_tag");
642 	rule->match_tag_not = nvlist_get_bool(nvl, "match_tag_not");
643 
644 	labels = nvlist_get_string_array(nvl, "labels", &labelcount);
645 	assert(labelcount <= PF_RULE_MAX_LABEL_COUNT);
646 	for (i = 0; i < labelcount; i++)
647 		strlcpy(rule->label[i], labels[i], PF_RULE_LABEL_SIZE);
648 	rule->ridentifier = nvlist_get_number(nvl, "ridentifier");
649 
650 	pfctl_nveth_addr_to_eth_addr(nvlist_get_nvlist(nvl, "src"),
651 	    &rule->src);
652 	pfctl_nveth_addr_to_eth_addr(nvlist_get_nvlist(nvl, "dst"),
653 	    &rule->dst);
654 
655 	pf_nvrule_addr_to_rule_addr(nvlist_get_nvlist(nvl, "ipsrc"),
656 	    &rule->ipsrc);
657 	pf_nvrule_addr_to_rule_addr(nvlist_get_nvlist(nvl, "ipdst"),
658 	    &rule->ipdst);
659 
660 	rule->evaluations = nvlist_get_number(nvl, "evaluations");
661 	rule->packets[0] = nvlist_get_number(nvl, "packets-in");
662 	rule->packets[1] = nvlist_get_number(nvl, "packets-out");
663 	rule->bytes[0] = nvlist_get_number(nvl, "bytes-in");
664 	rule->bytes[1] = nvlist_get_number(nvl, "bytes-out");
665 
666 	if (nvlist_exists_number(nvl, "timestamp")) {
667 		rule->last_active_timestamp = nvlist_get_number(nvl, "timestamp");
668 	}
669 
670 	strlcpy(rule->qname, nvlist_get_string(nvl, "qname"), PF_QNAME_SIZE);
671 	strlcpy(rule->tagname, nvlist_get_string(nvl, "tagname"),
672 	    PF_TAG_NAME_SIZE);
673 
674 	rule->dnpipe = nvlist_get_number(nvl, "dnpipe");
675 	rule->dnflags = nvlist_get_number(nvl, "dnflags");
676 
677 	rule->anchor_relative = nvlist_get_number(nvl, "anchor_relative");
678 	rule->anchor_wildcard = nvlist_get_number(nvl, "anchor_wildcard");
679 
680 	strlcpy(rule->bridge_to, nvlist_get_string(nvl, "bridge_to"),
681 	    IFNAMSIZ);
682 
683 	rule->action = nvlist_get_number(nvl, "action");
684 }
685 
686 int
687 pfctl_get_eth_rulesets_info(int dev, struct pfctl_eth_rulesets_info *ri,
688     const char *path)
689 {
690 	nvlist_t *nvl;
691 	int ret;
692 
693 	bzero(ri, sizeof(*ri));
694 
695 	nvl = nvlist_create(0);
696 	nvlist_add_string(nvl, "path", path);
697 
698 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULESETS, 256, &nvl)) != 0)
699 		return (ret);
700 
701 	ri->nr = nvlist_get_number(nvl, "nr");
702 
703 	nvlist_destroy(nvl);
704 	return (0);
705 }
706 
707 int
708 pfctl_get_eth_ruleset(int dev, const char *path, int nr,
709     struct pfctl_eth_ruleset_info *ri)
710 {
711 	nvlist_t *nvl;
712 	int ret;
713 
714 	bzero(ri, sizeof(*ri));
715 
716 	nvl = nvlist_create(0);
717 	nvlist_add_string(nvl, "path", path);
718 	nvlist_add_number(nvl, "nr", nr);
719 
720 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULESET, 1024, &nvl)) != 0)
721 		return (ret);
722 
723 	ri->nr = nvlist_get_number(nvl, "nr");
724 	strlcpy(ri->path, nvlist_get_string(nvl, "path"), MAXPATHLEN);
725 	strlcpy(ri->name, nvlist_get_string(nvl, "name"),
726 	    PF_ANCHOR_NAME_SIZE);
727 
728 	return (0);
729 }
730 
731 int
732 pfctl_get_eth_rules_info(int dev, struct pfctl_eth_rules_info *rules,
733     const char *path)
734 {
735 	nvlist_t *nvl;
736 	int ret;
737 
738 	bzero(rules, sizeof(*rules));
739 
740 	nvl = nvlist_create(0);
741 	nvlist_add_string(nvl, "anchor", path);
742 
743 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULES, 1024, &nvl)) != 0)
744 		return (ret);
745 
746 	rules->nr = nvlist_get_number(nvl, "nr");
747 	rules->ticket = nvlist_get_number(nvl, "ticket");
748 
749 	nvlist_destroy(nvl);
750 	return (0);
751 }
752 
753 int
754 pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
755     const char *path, struct pfctl_eth_rule *rule, bool clear,
756     char *anchor_call)
757 {
758 	nvlist_t *nvl;
759 	int ret;
760 
761 	nvl = nvlist_create(0);
762 
763 	nvlist_add_string(nvl, "anchor", path);
764 	nvlist_add_number(nvl, "ticket", ticket);
765 	nvlist_add_number(nvl, "nr", nr);
766 	nvlist_add_bool(nvl, "clear", clear);
767 
768 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULE, 4096, &nvl)) != 0)
769 		return (ret);
770 
771 	pfctl_nveth_rule_to_eth_rule(nvl, rule);
772 
773 	if (anchor_call)
774 		strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
775 		    MAXPATHLEN);
776 
777 	nvlist_destroy(nvl);
778 	return (0);
779 }
780 
781 int
782 pfctl_add_eth_rule(int dev, const struct pfctl_eth_rule *r, const char *anchor,
783     const char *anchor_call, uint32_t ticket)
784 {
785 	struct pfioc_nv nv;
786 	nvlist_t *nvl, *addr;
787 	void *packed;
788 	int error = 0;
789 	size_t labelcount, size;
790 
791 	nvl = nvlist_create(0);
792 
793 	nvlist_add_number(nvl, "ticket", ticket);
794 	nvlist_add_string(nvl, "anchor", anchor);
795 	nvlist_add_string(nvl, "anchor_call", anchor_call);
796 
797 	nvlist_add_number(nvl, "nr", r->nr);
798 	nvlist_add_bool(nvl, "quick", r->quick);
799 	nvlist_add_string(nvl, "ifname", r->ifname);
800 	nvlist_add_bool(nvl, "ifnot", r->ifnot);
801 	nvlist_add_number(nvl, "direction", r->direction);
802 	nvlist_add_number(nvl, "proto", r->proto);
803 	nvlist_add_string(nvl, "match_tagname", r->match_tagname);
804 	nvlist_add_bool(nvl, "match_tag_not", r->match_tag_not);
805 
806 	addr = pfctl_eth_addr_to_nveth_addr(&r->src);
807 	if (addr == NULL) {
808 		nvlist_destroy(nvl);
809 		return (ENOMEM);
810 	}
811 	nvlist_add_nvlist(nvl, "src", addr);
812 	nvlist_destroy(addr);
813 
814 	addr = pfctl_eth_addr_to_nveth_addr(&r->dst);
815 	if (addr == NULL) {
816 		nvlist_destroy(nvl);
817 		return (ENOMEM);
818 	}
819 	nvlist_add_nvlist(nvl, "dst", addr);
820 	nvlist_destroy(addr);
821 
822 	pfctl_nv_add_rule_addr(nvl, "ipsrc", &r->ipsrc);
823 	pfctl_nv_add_rule_addr(nvl, "ipdst", &r->ipdst);
824 
825 	labelcount = 0;
826 	while (r->label[labelcount][0] != 0 &&
827 	    labelcount < PF_RULE_MAX_LABEL_COUNT) {
828 		nvlist_append_string_array(nvl, "labels",
829 		    r->label[labelcount]);
830 		labelcount++;
831 	}
832 	nvlist_add_number(nvl, "ridentifier", r->ridentifier);
833 
834 	nvlist_add_string(nvl, "qname", r->qname);
835 	nvlist_add_string(nvl, "tagname", r->tagname);
836 	nvlist_add_number(nvl, "dnpipe", r->dnpipe);
837 	nvlist_add_number(nvl, "dnflags", r->dnflags);
838 
839 	nvlist_add_string(nvl, "bridge_to", r->bridge_to);
840 
841 	nvlist_add_number(nvl, "action", r->action);
842 
843 	packed = nvlist_pack(nvl, &size);
844 	if (packed == NULL) {
845 		nvlist_destroy(nvl);
846 		return (ENOMEM);
847 	}
848 
849 	nv.len = size;
850 	nv.size = size;
851 	nv.data = packed;
852 
853 	if (ioctl(dev, DIOCADDETHRULE, &nv) != 0)
854 		error = errno;
855 
856 	free(packed);
857 	nvlist_destroy(nvl);
858 
859 	return (error);
860 }
861 
862 int
863 pfctl_add_rule(int dev, const struct pfctl_rule *r, const char *anchor,
864     const char *anchor_call, uint32_t ticket, uint32_t pool_ticket)
865 {
866 	struct pfioc_nv nv;
867 	uint64_t timeouts[PFTM_MAX];
868 	uint64_t set_prio[2];
869 	nvlist_t *nvl, *nvlr;
870 	size_t labelcount;
871 	int ret;
872 
873 	nvl = nvlist_create(0);
874 	nvlr = nvlist_create(0);
875 
876 	nvlist_add_number(nvl, "ticket", ticket);
877 	nvlist_add_number(nvl, "pool_ticket", pool_ticket);
878 	nvlist_add_string(nvl, "anchor", anchor);
879 	nvlist_add_string(nvl, "anchor_call", anchor_call);
880 
881 	nvlist_add_number(nvlr, "nr", r->nr);
882 	pfctl_nv_add_rule_addr(nvlr, "src", &r->src);
883 	pfctl_nv_add_rule_addr(nvlr, "dst", &r->dst);
884 
885 	labelcount = 0;
886 	while (r->label[labelcount][0] != 0 &&
887 	    labelcount < PF_RULE_MAX_LABEL_COUNT) {
888 		nvlist_append_string_array(nvlr, "labels",
889 		    r->label[labelcount]);
890 		labelcount++;
891 	}
892 	nvlist_add_number(nvlr, "ridentifier", r->ridentifier);
893 
894 	nvlist_add_string(nvlr, "ifname", r->ifname);
895 	nvlist_add_string(nvlr, "qname", r->qname);
896 	nvlist_add_string(nvlr, "pqname", r->pqname);
897 	nvlist_add_string(nvlr, "tagname", r->tagname);
898 	nvlist_add_string(nvlr, "match_tagname", r->match_tagname);
899 	nvlist_add_string(nvlr, "overload_tblname", r->overload_tblname);
900 
901 	pfctl_nv_add_pool(nvlr, "rpool", &r->rpool);
902 
903 	nvlist_add_number(nvlr, "os_fingerprint", r->os_fingerprint);
904 
905 	nvlist_add_number(nvlr, "rtableid", r->rtableid);
906 	for (int i = 0; i < PFTM_MAX; i++)
907 		timeouts[i] = r->timeout[i];
908 	nvlist_add_number_array(nvlr, "timeout", timeouts, PFTM_MAX);
909 	nvlist_add_number(nvlr, "max_states", r->max_states);
910 	nvlist_add_number(nvlr, "max_src_nodes", r->max_src_nodes);
911 	nvlist_add_number(nvlr, "max_src_states", r->max_src_states);
912 	nvlist_add_number(nvlr, "max_src_conn", r->max_src_conn);
913 	nvlist_add_number(nvlr, "max_src_conn_rate.limit",
914 	    r->max_src_conn_rate.limit);
915 	nvlist_add_number(nvlr, "max_src_conn_rate.seconds",
916 	    r->max_src_conn_rate.seconds);
917 	nvlist_add_number(nvlr, "dnpipe", r->dnpipe);
918 	nvlist_add_number(nvlr, "dnrpipe", r->dnrpipe);
919 	nvlist_add_number(nvlr, "dnflags", r->free_flags);
920 	nvlist_add_number(nvlr, "prob", r->prob);
921 	nvlist_add_number(nvlr, "cuid", r->cuid);
922 	nvlist_add_number(nvlr, "cpid", r->cpid);
923 
924 	nvlist_add_number(nvlr, "return_icmp", r->return_icmp);
925 	nvlist_add_number(nvlr, "return_icmp6", r->return_icmp6);
926 
927 	nvlist_add_number(nvlr, "max_mss", r->max_mss);
928 	nvlist_add_number(nvlr, "scrub_flags", r->scrub_flags);
929 
930 	pfctl_nv_add_uid(nvlr, "uid", &r->uid);
931 	pfctl_nv_add_uid(nvlr, "gid", (const struct pf_rule_uid *)&r->gid);
932 
933 	nvlist_add_number(nvlr, "rule_flag", r->rule_flag);
934 	nvlist_add_number(nvlr, "action", r->action);
935 	nvlist_add_number(nvlr, "direction", r->direction);
936 	nvlist_add_number(nvlr, "log", r->log);
937 	nvlist_add_number(nvlr, "logif", r->logif);
938 	nvlist_add_number(nvlr, "quick", r->quick);
939 	nvlist_add_number(nvlr, "ifnot", r->ifnot);
940 	nvlist_add_number(nvlr, "match_tag_not", r->match_tag_not);
941 	nvlist_add_number(nvlr, "natpass", r->natpass);
942 
943 	nvlist_add_number(nvlr, "keep_state", r->keep_state);
944 	nvlist_add_number(nvlr, "af", r->af);
945 	nvlist_add_number(nvlr, "proto", r->proto);
946 	nvlist_add_number(nvlr, "type", r->type);
947 	nvlist_add_number(nvlr, "code", r->code);
948 	nvlist_add_number(nvlr, "flags", r->flags);
949 	nvlist_add_number(nvlr, "flagset", r->flagset);
950 	nvlist_add_number(nvlr, "min_ttl", r->min_ttl);
951 	nvlist_add_number(nvlr, "allow_opts", r->allow_opts);
952 	nvlist_add_number(nvlr, "rt", r->rt);
953 	nvlist_add_number(nvlr, "return_ttl", r->return_ttl);
954 	nvlist_add_number(nvlr, "tos", r->tos);
955 	nvlist_add_number(nvlr, "set_tos", r->set_tos);
956 	nvlist_add_number(nvlr, "anchor_relative", r->anchor_relative);
957 	nvlist_add_number(nvlr, "anchor_wildcard", r->anchor_wildcard);
958 
959 	nvlist_add_number(nvlr, "flush", r->flush);
960 
961 	nvlist_add_number(nvlr, "prio", r->prio);
962 	set_prio[0] = r->set_prio[0];
963 	set_prio[1] = r->set_prio[1];
964 	nvlist_add_number_array(nvlr, "set_prio", set_prio, 2);
965 
966 	pfctl_nv_add_divert(nvlr, "divert", r);
967 
968 	nvlist_add_nvlist(nvl, "rule", nvlr);
969 	nvlist_destroy(nvlr);
970 
971 	/* Now do the call. */
972 	nv.data = nvlist_pack(nvl, &nv.len);
973 	nv.size = nv.len;
974 
975 	ret = ioctl(dev, DIOCADDRULENV, &nv);
976 	if (ret == -1)
977 		ret = errno;
978 
979 	free(nv.data);
980 	nvlist_destroy(nvl);
981 
982 	return (ret);
983 }
984 
985 int
986 pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules, uint32_t ruleset,
987     const char *path)
988 {
989 	struct pfioc_rule pr;
990 	int ret;
991 
992 	bzero(&pr, sizeof(pr));
993 	if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
994 		return (E2BIG);
995 
996 	pr.rule.action = ruleset;
997 	ret = ioctl(dev, DIOCGETRULES, &pr);
998 	if (ret != 0)
999 		return (ret);
1000 
1001 	rules->nr = pr.nr;
1002 	rules->ticket = pr.ticket;
1003 
1004 	return (0);
1005 }
1006 
1007 int
1008 pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket, const char *anchor,
1009     uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call)
1010 {
1011 	return (pfctl_get_clear_rule(dev, nr, ticket, anchor, ruleset, rule,
1012 	    anchor_call, false));
1013 }
1014 
1015 int	pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
1016 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
1017 	    char *anchor_call, bool clear)
1018 {
1019 	nvlist_t *nvl;
1020 	int ret;
1021 
1022 	nvl = nvlist_create(0);
1023 	if (nvl == 0)
1024 		return (ENOMEM);
1025 
1026 	nvlist_add_number(nvl, "nr", nr);
1027 	nvlist_add_number(nvl, "ticket", ticket);
1028 	nvlist_add_string(nvl, "anchor", anchor);
1029 	nvlist_add_number(nvl, "ruleset", ruleset);
1030 
1031 	if (clear)
1032 		nvlist_add_bool(nvl, "clear_counter", true);
1033 
1034 	if ((ret = pfctl_do_ioctl(dev, DIOCGETRULENV, 8192, &nvl)) != 0)
1035 		return (ret);
1036 
1037 	pf_nvrule_to_rule(nvlist_get_nvlist(nvl, "rule"), rule);
1038 
1039 	if (anchor_call)
1040 		strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
1041 		    MAXPATHLEN);
1042 
1043 	nvlist_destroy(nvl);
1044 
1045 	return (0);
1046 }
1047 
1048 int
1049 pfctl_set_keepcounters(int dev, bool keep)
1050 {
1051 	struct pfioc_nv	 nv;
1052 	nvlist_t	*nvl;
1053 	int		 ret;
1054 
1055 	nvl = nvlist_create(0);
1056 
1057 	nvlist_add_bool(nvl, "keep_counters", keep);
1058 
1059 	nv.data = nvlist_pack(nvl, &nv.len);
1060 	nv.size = nv.len;
1061 
1062 	nvlist_destroy(nvl);
1063 
1064 	ret = ioctl(dev, DIOCKEEPCOUNTERS, &nv);
1065 
1066 	free(nv.data);
1067 	return (ret);
1068 }
1069 
1070 static void
1071 pfctl_nv_add_state_cmp(nvlist_t *nvl, const char *name,
1072     const struct pfctl_state_cmp *cmp)
1073 {
1074 	nvlist_t	*nv;
1075 
1076 	nv = nvlist_create(0);
1077 
1078 	nvlist_add_number(nv, "id", cmp->id);
1079 	nvlist_add_number(nv, "creatorid", htonl(cmp->creatorid));
1080 	nvlist_add_number(nv, "direction", cmp->direction);
1081 
1082 	nvlist_add_nvlist(nvl, name, nv);
1083 	nvlist_destroy(nv);
1084 }
1085 
1086 static void
1087 pf_state_key_export_to_state_key(struct pfctl_state_key *ps,
1088     const struct pf_state_key_export *s)
1089 {
1090 	bcopy(s->addr, ps->addr, sizeof(ps->addr[0]) * 2);
1091 	ps->port[0] = s->port[0];
1092 	ps->port[1] = s->port[1];
1093 }
1094 
1095 static void
1096 pf_state_peer_export_to_state_peer(struct pfctl_state_peer *ps,
1097     const struct pf_state_peer_export *s)
1098 {
1099 	/* Ignore scrub. */
1100 	ps->seqlo = s->seqlo;
1101 	ps->seqhi = s->seqhi;
1102 	ps->seqdiff = s->seqdiff;
1103 	/* Ignore max_win & mss */
1104 	ps->state = s->state;
1105 	ps->wscale = s->wscale;
1106 }
1107 
1108 static void
1109 pf_state_export_to_state(struct pfctl_state *ps, const struct pf_state_export *s)
1110 {
1111 	assert(s->version >= PF_STATE_VERSION);
1112 
1113 	ps->id = s->id;
1114 	strlcpy(ps->ifname, s->ifname, sizeof(ps->ifname));
1115 	strlcpy(ps->orig_ifname, s->orig_ifname, sizeof(ps->orig_ifname));
1116 	strlcpy(ps->rt_ifname, s->rt_ifname, sizeof(ps->rt_ifname));
1117 	pf_state_key_export_to_state_key(&ps->key[0], &s->key[0]);
1118 	pf_state_key_export_to_state_key(&ps->key[1], &s->key[1]);
1119 	pf_state_peer_export_to_state_peer(&ps->src, &s->src);
1120 	pf_state_peer_export_to_state_peer(&ps->dst, &s->dst);
1121 	bcopy(&s->rt_addr, &ps->rt_addr, sizeof(ps->rt_addr));
1122 	ps->rule = ntohl(s->rule);
1123 	ps->anchor = ntohl(s->anchor);
1124 	ps->nat_rule = ntohl(s->nat_rule);
1125 	ps->creation = ntohl(s->creation);
1126 	ps->expire = ntohl(s->expire);
1127 	ps->packets[0] = s->packets[0];
1128 	ps->packets[1] = s->packets[1];
1129 	ps->bytes[0] = s->bytes[0];
1130 	ps->bytes[1] = s->bytes[1];
1131 	ps->creatorid = ntohl(s->creatorid);
1132 	ps->key[0].proto = s->proto;
1133 	ps->key[1].proto = s->proto;
1134 	ps->key[0].af = s->af;
1135 	ps->key[1].af = s->af;
1136 	ps->direction = s->direction;
1137 	ps->state_flags = ntohs(s->state_flags);
1138 	ps->sync_flags = ntohs(s->sync_flags);
1139 	ps->qid = ntohs(s->qid);
1140 	ps->pqid = ntohs(s->pqid);
1141 	ps->dnpipe = ntohs(s->dnpipe);
1142 	ps->dnrpipe = ntohs(s->dnrpipe);
1143 	ps->rtableid = ntohl(s->rtableid);
1144 	ps->min_ttl = s->min_ttl;
1145 	ps->set_tos = s->set_tos;
1146 	ps->max_mss = ntohs(s->max_mss);
1147 	ps->rt = s->rt;
1148 	ps->set_prio[0] = s->set_prio[0];
1149 	ps->set_prio[1] = s->set_prio[1];
1150 }
1151 
1152 int
1153 pfctl_get_states(int dev, struct pfctl_states *states)
1154 {
1155 	struct pfioc_states_v2 ps;
1156 	struct pf_state_export *p;
1157 	char *inbuf = NULL, *newinbuf = NULL;
1158 	unsigned int len = 0;
1159 	int i, error;
1160 
1161 	bzero(&ps, sizeof(ps));
1162 	ps.ps_req_version = PF_STATE_VERSION;
1163 
1164 	bzero(states, sizeof(*states));
1165 	TAILQ_INIT(&states->states);
1166 
1167 	for (;;) {
1168 		ps.ps_len = len;
1169 		if (len) {
1170 			newinbuf = realloc(inbuf, len);
1171 			if (newinbuf == NULL)
1172 				return (ENOMEM);
1173 			ps.ps_buf = inbuf = newinbuf;
1174 		}
1175 		if ((error = ioctl(dev, DIOCGETSTATESV2, &ps)) < 0) {
1176 			free(inbuf);
1177 			return (error);
1178 		}
1179 		if (ps.ps_len + sizeof(struct pfioc_states_v2) < len)
1180 			break;
1181 		if (len == 0 && ps.ps_len == 0)
1182 			goto out;
1183 		if (len == 0 && ps.ps_len != 0)
1184 			len = ps.ps_len;
1185 		if (ps.ps_len == 0)
1186 			goto out;      /* no states */
1187 		len *= 2;
1188 	}
1189 	p = ps.ps_states;
1190 
1191 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1192 		struct pfctl_state *s = malloc(sizeof(*s));
1193 		if (s == NULL) {
1194 			pfctl_free_states(states);
1195 			error = ENOMEM;
1196 			goto out;
1197 		}
1198 
1199 		pf_state_export_to_state(s, p);
1200 		TAILQ_INSERT_TAIL(&states->states, s, entry);
1201 	}
1202 
1203 out:
1204 	free(inbuf);
1205 	return (error);
1206 }
1207 
1208 void
1209 pfctl_free_states(struct pfctl_states *states)
1210 {
1211 	struct pfctl_state *s, *tmp;
1212 
1213 	TAILQ_FOREACH_SAFE(s, &states->states, entry, tmp) {
1214 		free(s);
1215 	}
1216 
1217 	bzero(states, sizeof(*states));
1218 }
1219 
1220 static int
1221 _pfctl_clear_states(int dev, const struct pfctl_kill *kill,
1222     unsigned int *killed, uint64_t ioctlval)
1223 {
1224 	nvlist_t	*nvl;
1225 	int		 ret;
1226 
1227 	nvl = nvlist_create(0);
1228 
1229 	pfctl_nv_add_state_cmp(nvl, "cmp", &kill->cmp);
1230 	nvlist_add_number(nvl, "af", kill->af);
1231 	nvlist_add_number(nvl, "proto", kill->proto);
1232 	pfctl_nv_add_rule_addr(nvl, "src", &kill->src);
1233 	pfctl_nv_add_rule_addr(nvl, "dst", &kill->dst);
1234 	pfctl_nv_add_rule_addr(nvl, "rt_addr", &kill->rt_addr);
1235 	nvlist_add_string(nvl, "ifname", kill->ifname);
1236 	nvlist_add_string(nvl, "label", kill->label);
1237 	nvlist_add_bool(nvl, "kill_match", kill->kill_match);
1238 
1239 	if ((ret = pfctl_do_ioctl(dev, ioctlval, 1024, &nvl)) != 0)
1240 		return (ret);
1241 
1242 	if (killed)
1243 		*killed = nvlist_get_number(nvl, "killed");
1244 
1245 	nvlist_destroy(nvl);
1246 
1247 	return (ret);
1248 }
1249 
1250 int
1251 pfctl_clear_states(int dev, const struct pfctl_kill *kill,
1252     unsigned int *killed)
1253 {
1254 	return (_pfctl_clear_states(dev, kill, killed, DIOCCLRSTATESNV));
1255 }
1256 
1257 int
1258 pfctl_kill_states(int dev, const struct pfctl_kill *kill, unsigned int *killed)
1259 {
1260 	return (_pfctl_clear_states(dev, kill, killed, DIOCKILLSTATESNV));
1261 }
1262 
1263 int
1264 pfctl_clear_rules(int dev, const char *anchorname)
1265 {
1266 	struct pfioc_trans trans;
1267 	struct pfioc_trans_e transe[2];
1268 	int ret;
1269 
1270 	bzero(&trans, sizeof(trans));
1271 	bzero(&transe, sizeof(transe));
1272 
1273 	transe[0].rs_num = PF_RULESET_SCRUB;
1274 	if (strlcpy(transe[0].anchor, anchorname, sizeof(transe[0].anchor))
1275 	    >= sizeof(transe[0].anchor))
1276 		return (E2BIG);
1277 
1278 	transe[1].rs_num = PF_RULESET_FILTER;
1279 	if (strlcpy(transe[1].anchor, anchorname, sizeof(transe[1].anchor))
1280 	    >= sizeof(transe[1].anchor))
1281 		return (E2BIG);
1282 
1283 	trans.size = 2;
1284 	trans.esize = sizeof(transe[0]);
1285 	trans.array = transe;
1286 
1287 	ret = ioctl(dev, DIOCXBEGIN, &trans);
1288 	if (ret != 0)
1289 		return (ret);
1290 	return ioctl(dev, DIOCXCOMMIT, &trans);
1291 }
1292 
1293 int
1294 pfctl_clear_nat(int dev, const char *anchorname)
1295 {
1296 	struct pfioc_trans trans;
1297 	struct pfioc_trans_e transe[3];
1298 	int ret;
1299 
1300 	bzero(&trans, sizeof(trans));
1301 	bzero(&transe, sizeof(transe));
1302 
1303 	transe[0].rs_num = PF_RULESET_NAT;
1304 	if (strlcpy(transe[0].anchor, anchorname, sizeof(transe[0].anchor))
1305 	    >= sizeof(transe[0].anchor))
1306 		return (E2BIG);
1307 
1308 	transe[1].rs_num = PF_RULESET_BINAT;
1309 	if (strlcpy(transe[1].anchor, anchorname, sizeof(transe[1].anchor))
1310 	    >= sizeof(transe[0].anchor))
1311 		return (E2BIG);
1312 
1313 	transe[2].rs_num = PF_RULESET_RDR;
1314 	if (strlcpy(transe[2].anchor, anchorname, sizeof(transe[2].anchor))
1315 	    >= sizeof(transe[2].anchor))
1316 		return (E2BIG);
1317 
1318 	trans.size = 3;
1319 	trans.esize = sizeof(transe[0]);
1320 	trans.array = transe;
1321 
1322 	ret = ioctl(dev, DIOCXBEGIN, &trans);
1323 	if (ret != 0)
1324 		return (ret);
1325 	return ioctl(dev, DIOCXCOMMIT, &trans);
1326 }
1327 int
1328 pfctl_clear_eth_rules(int dev, const char *anchorname)
1329 {
1330 	struct pfioc_trans trans;
1331 	struct pfioc_trans_e transe;
1332 	int ret;
1333 
1334 	bzero(&trans, sizeof(trans));
1335 	bzero(&transe, sizeof(transe));
1336 
1337 	transe.rs_num = PF_RULESET_ETH;
1338 	if (strlcpy(transe.anchor, anchorname, sizeof(transe.anchor))
1339 	    >= sizeof(transe.anchor))
1340 		return (E2BIG);
1341 
1342 	trans.size = 1;
1343 	trans.esize = sizeof(transe);
1344 	trans.array = &transe;
1345 
1346 	ret = ioctl(dev, DIOCXBEGIN, &trans);
1347 	if (ret != 0)
1348 		return (ret);
1349 	return ioctl(dev, DIOCXCOMMIT, &trans);
1350 }
1351 
1352 static int
1353 pfctl_get_limit(int dev, const int index, uint *limit)
1354 {
1355 	struct pfioc_limit pl;
1356 
1357 	bzero(&pl, sizeof(pl));
1358 	pl.index = index;
1359 
1360 	if (ioctl(dev, DIOCGETLIMIT, &pl) == -1)
1361 		return (errno);
1362 
1363 	*limit = pl.limit;
1364 
1365 	return (0);
1366 }
1367 
1368 int
1369 pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s)
1370 {
1371 	struct pfioc_nv	 nv;
1372 	nvlist_t	*nvl;
1373 	int		 ret;
1374 	uint		 state_limit;
1375 	uint64_t	 lim, hi, lo;
1376 
1377 	ret = pfctl_get_limit(dev, PF_LIMIT_STATES, &state_limit);
1378 	if (ret != 0)
1379 		return (ret);
1380 
1381 	lim = state_limit;
1382 	hi = lim * s->highwater / 100;
1383 	lo = lim * s->lowwater / 100;
1384 
1385 	if (lo == hi)
1386 		hi++;
1387 
1388 	nvl = nvlist_create(0);
1389 
1390 	nvlist_add_bool(nvl, "enabled", s->mode != PFCTL_SYNCOOKIES_NEVER);
1391 	nvlist_add_bool(nvl, "adaptive", s->mode == PFCTL_SYNCOOKIES_ADAPTIVE);
1392 	nvlist_add_number(nvl, "highwater", hi);
1393 	nvlist_add_number(nvl, "lowwater", lo);
1394 
1395 	nv.data = nvlist_pack(nvl, &nv.len);
1396 	nv.size = nv.len;
1397 	nvlist_destroy(nvl);
1398 	nvl = NULL;
1399 
1400 	ret = ioctl(dev, DIOCSETSYNCOOKIES, &nv);
1401 
1402 	free(nv.data);
1403 	return (ret);
1404 }
1405 
1406 int
1407 pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
1408 {
1409 	nvlist_t	*nvl;
1410 	int		 ret;
1411 	uint		 state_limit;
1412 	bool		 enabled, adaptive;
1413 
1414 	ret = pfctl_get_limit(dev, PF_LIMIT_STATES, &state_limit);
1415 	if (ret != 0)
1416 		return (ret);
1417 
1418 	bzero(s, sizeof(*s));
1419 
1420 	nvl = nvlist_create(0);
1421 
1422 	if ((ret = pfctl_do_ioctl(dev, DIOCGETSYNCOOKIES, 256, &nvl)) != 0)
1423 		return (errno);
1424 
1425 	enabled = nvlist_get_bool(nvl, "enabled");
1426 	adaptive = nvlist_get_bool(nvl, "adaptive");
1427 
1428 	if (enabled) {
1429 		if (adaptive)
1430 			s->mode = PFCTL_SYNCOOKIES_ADAPTIVE;
1431 		else
1432 			s->mode = PFCTL_SYNCOOKIES_ALWAYS;
1433 	} else {
1434 		s->mode = PFCTL_SYNCOOKIES_NEVER;
1435 	}
1436 
1437 	s->highwater = nvlist_get_number(nvl, "highwater") * 100 / state_limit;
1438 	s->lowwater = nvlist_get_number(nvl, "lowwater") * 100 / state_limit;
1439 
1440 	nvlist_destroy(nvl);
1441 
1442 	return (0);
1443 }
1444 
1445 int
1446 pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
1447     *addr, int size, int *nadd, int flags)
1448 {
1449 	struct pfioc_table io;
1450 
1451 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
1452 		return (EINVAL);
1453 	}
1454 	bzero(&io, sizeof io);
1455 	io.pfrio_flags = flags;
1456 	io.pfrio_table = *tbl;
1457 	io.pfrio_buffer = addr;
1458 	io.pfrio_esize = sizeof(*addr);
1459 	io.pfrio_size = size;
1460 
1461 	if (ioctl(dev, DIOCRADDADDRS, &io))
1462 		return (errno);
1463 	if (nadd != NULL)
1464 		*nadd = io.pfrio_nadd;
1465 	return (0);
1466 }
1467 
1468 int
1469 pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
1470     *addr, int size, int *ndel, int flags)
1471 {
1472 	struct pfioc_table io;
1473 
1474 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
1475 		return (EINVAL);
1476 	}
1477 	bzero(&io, sizeof io);
1478 	io.pfrio_flags = flags;
1479 	io.pfrio_table = *tbl;
1480 	io.pfrio_buffer = addr;
1481 	io.pfrio_esize = sizeof(*addr);
1482 	io.pfrio_size = size;
1483 
1484 	if (ioctl(dev, DIOCRDELADDRS, &io))
1485 		return (errno);
1486 	if (ndel != NULL)
1487 		*ndel = io.pfrio_ndel;
1488 	return (0);
1489 }
1490 
1491 int
1492 pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
1493     *addr, int size, int *size2, int *nadd, int *ndel, int *nchange, int flags)
1494 {
1495 	struct pfioc_table io;
1496 
1497 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
1498 		return (EINVAL);
1499 	}
1500 	bzero(&io, sizeof io);
1501 	io.pfrio_flags = flags;
1502 	io.pfrio_table = *tbl;
1503 	io.pfrio_buffer = addr;
1504 	io.pfrio_esize = sizeof(*addr);
1505 	io.pfrio_size = size;
1506 	io.pfrio_size2 = (size2 != NULL) ? *size2 : 0;
1507 	if (ioctl(dev, DIOCRSETADDRS, &io))
1508 		return (-1);
1509 	if (nadd != NULL)
1510 		*nadd = io.pfrio_nadd;
1511 	if (ndel != NULL)
1512 		*ndel = io.pfrio_ndel;
1513 	if (nchange != NULL)
1514 		*nchange = io.pfrio_nchange;
1515 	if (size2 != NULL)
1516 		*size2 = io.pfrio_size2;
1517 	return (0);
1518 }
1519 
1520 int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr,
1521     int *size, int flags)
1522 {
1523 	struct pfioc_table io;
1524 
1525 	if (tbl == NULL || size == NULL || *size < 0 ||
1526 	    (*size && addr == NULL)) {
1527 		return (EINVAL);
1528 	}
1529 	bzero(&io, sizeof io);
1530 	io.pfrio_flags = flags;
1531 	io.pfrio_table = *tbl;
1532 	io.pfrio_buffer = addr;
1533 	io.pfrio_esize = sizeof(*addr);
1534 	io.pfrio_size = *size;
1535 	if (ioctl(dev, DIOCRGETADDRS, &io))
1536 		return (-1);
1537 	*size = io.pfrio_size;
1538 	return (0);
1539 }
1540