xref: /freebsd/sbin/pfctl/pfctl.c (revision 1323ec571215a77ddd21294f0871979d5ad6b992)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #define PFIOC_USE_LATEST
40 
41 #include <sys/types.h>
42 #include <sys/ioctl.h>
43 #include <sys/nv.h>
44 #include <sys/socket.h>
45 #include <sys/stat.h>
46 #include <sys/endian.h>
47 
48 #include <net/if.h>
49 #include <netinet/in.h>
50 #include <net/pfvar.h>
51 #include <arpa/inet.h>
52 #include <net/altq/altq.h>
53 #include <sys/sysctl.h>
54 
55 #include <err.h>
56 #include <errno.h>
57 #include <fcntl.h>
58 #include <libpfctl.h>
59 #include <limits.h>
60 #include <netdb.h>
61 #include <stdint.h>
62 #include <stdio.h>
63 #include <stdlib.h>
64 #include <string.h>
65 #include <unistd.h>
66 
67 #include "pfctl_parser.h"
68 #include "pfctl.h"
69 
70 void	 usage(void);
71 int	 pfctl_enable(int, int);
72 int	 pfctl_disable(int, int);
73 int	 pfctl_clear_stats(int, int);
74 int	 pfctl_get_skip_ifaces(void);
75 int	 pfctl_check_skip_ifaces(char *);
76 int	 pfctl_adjust_skip_ifaces(struct pfctl *);
77 int	 pfctl_clear_interface_flags(int, int);
78 int	 pfctl_flush_eth_rules(int, int, char *);
79 int	 pfctl_flush_rules(int, int, char *);
80 int	 pfctl_flush_nat(int, int, char *);
81 int	 pfctl_clear_altq(int, int);
82 int	 pfctl_clear_src_nodes(int, int);
83 int	 pfctl_clear_iface_states(int, const char *, int);
84 void	 pfctl_addrprefix(char *, struct pf_addr *);
85 int	 pfctl_kill_src_nodes(int, const char *, int);
86 int	 pfctl_net_kill_states(int, const char *, int);
87 int	 pfctl_gateway_kill_states(int, const char *, int);
88 int	 pfctl_label_kill_states(int, const char *, int);
89 int	 pfctl_id_kill_states(int, const char *, int);
90 void	 pfctl_init_options(struct pfctl *);
91 int	 pfctl_load_options(struct pfctl *);
92 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
93 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
94 int	 pfctl_load_debug(struct pfctl *, unsigned int);
95 int	 pfctl_load_logif(struct pfctl *, char *);
96 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
97 int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
98 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
99 	    char *);
100 void	 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *, int);
101 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
102 int	 pfctl_show_eth_rules(int, char *, int, enum pfctl_show, char *, int);
103 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
104 int	 pfctl_show_nat(int, char *, int, char *, int);
105 int	 pfctl_show_src_nodes(int, int);
106 int	 pfctl_show_states(int, const char *, int);
107 int	 pfctl_show_status(int, int);
108 int	 pfctl_show_running(int);
109 int	 pfctl_show_timeouts(int, int);
110 int	 pfctl_show_limits(int, int);
111 void	 pfctl_debug(int, u_int32_t, int);
112 int	 pfctl_test_altqsupport(int, int);
113 int	 pfctl_show_anchors(int, int, char *);
114 int	 pfctl_show_eth_anchors(int, int, char *);
115 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *, bool);
116 int	 pfctl_eth_ruleset_trans(struct pfctl *, char *,
117 	    struct pfctl_eth_anchor *);
118 int	 pfctl_load_eth_ruleset(struct pfctl *, char *,
119 	    struct pfctl_eth_ruleset *, int);
120 int	 pfctl_load_eth_rule(struct pfctl *, char *, struct pfctl_eth_rule *,
121 	    int);
122 int	 pfctl_load_ruleset(struct pfctl *, char *,
123 		struct pfctl_ruleset *, int, int);
124 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
125 const char	*pfctl_lookup_option(char *, const char * const *);
126 
127 static struct pfctl_anchor_global	 pf_anchors;
128 struct pfctl_anchor	 pf_main_anchor;
129 struct pfctl_eth_anchor	 pf_eth_main_anchor;
130 static struct pfr_buffer skip_b;
131 
132 static const char	*clearopt;
133 static char		*rulesopt;
134 static const char	*showopt;
135 static const char	*debugopt;
136 static char		*anchoropt;
137 static const char	*optiopt = NULL;
138 static const char	*pf_device = "/dev/pf";
139 static char		*ifaceopt;
140 static char		*tableopt;
141 static const char	*tblcmdopt;
142 static int		 src_node_killers;
143 static char		*src_node_kill[2];
144 static int		 state_killers;
145 static char		*state_kill[2];
146 int			 loadopt;
147 int			 altqsupport;
148 
149 int			 dev = -1;
150 static int		 first_title = 1;
151 static int		 labels = 0;
152 
153 #define INDENT(d, o)	do {						\
154 				if (o) {				\
155 					int i;				\
156 					for (i=0; i < d; i++)		\
157 						printf("  ");		\
158 				}					\
159 			} while (0);					\
160 
161 
162 static const struct {
163 	const char	*name;
164 	int		index;
165 } pf_limits[] = {
166 	{ "states",		PF_LIMIT_STATES },
167 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
168 	{ "frags",		PF_LIMIT_FRAGS },
169 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
170 	{ NULL,			0 }
171 };
172 
173 struct pf_hint {
174 	const char	*name;
175 	int		timeout;
176 };
177 static const struct pf_hint pf_hint_normal[] = {
178 	{ "tcp.first",		2 * 60 },
179 	{ "tcp.opening",	30 },
180 	{ "tcp.established",	24 * 60 * 60 },
181 	{ "tcp.closing",	15 * 60 },
182 	{ "tcp.finwait",	45 },
183 	{ "tcp.closed",		90 },
184 	{ "tcp.tsdiff",		30 },
185 	{ NULL,			0 }
186 };
187 static const struct pf_hint pf_hint_satellite[] = {
188 	{ "tcp.first",		3 * 60 },
189 	{ "tcp.opening",	30 + 5 },
190 	{ "tcp.established",	24 * 60 * 60 },
191 	{ "tcp.closing",	15 * 60 + 5 },
192 	{ "tcp.finwait",	45 + 5 },
193 	{ "tcp.closed",		90 + 5 },
194 	{ "tcp.tsdiff",		60 },
195 	{ NULL,			0 }
196 };
197 static const struct pf_hint pf_hint_conservative[] = {
198 	{ "tcp.first",		60 * 60 },
199 	{ "tcp.opening",	15 * 60 },
200 	{ "tcp.established",	5 * 24 * 60 * 60 },
201 	{ "tcp.closing",	60 * 60 },
202 	{ "tcp.finwait",	10 * 60 },
203 	{ "tcp.closed",		3 * 60 },
204 	{ "tcp.tsdiff",		60 },
205 	{ NULL,			0 }
206 };
207 static const struct pf_hint pf_hint_aggressive[] = {
208 	{ "tcp.first",		30 },
209 	{ "tcp.opening",	5 },
210 	{ "tcp.established",	5 * 60 * 60 },
211 	{ "tcp.closing",	60 },
212 	{ "tcp.finwait",	30 },
213 	{ "tcp.closed",		30 },
214 	{ "tcp.tsdiff",		10 },
215 	{ NULL,			0 }
216 };
217 
218 static const struct {
219 	const char *name;
220 	const struct pf_hint *hint;
221 } pf_hints[] = {
222 	{ "normal",		pf_hint_normal },
223 	{ "satellite",		pf_hint_satellite },
224 	{ "high-latency",	pf_hint_satellite },
225 	{ "conservative",	pf_hint_conservative },
226 	{ "aggressive",		pf_hint_aggressive },
227 	{ NULL,			NULL }
228 };
229 
230 static const char * const clearopt_list[] = {
231 	"nat", "queue", "rules", "Sources",
232 	"states", "info", "Tables", "osfp", "all",
233 	"ethernet", NULL
234 };
235 
236 static const char * const showopt_list[] = {
237 	"ether", "nat", "queue", "rules", "Anchors", "Sources", "states",
238 	"info", "Interfaces", "labels", "timeouts", "memory", "Tables",
239 	"osfp", "Running", "all", NULL
240 };
241 
242 static const char * const tblcmdopt_list[] = {
243 	"kill", "flush", "add", "delete", "load", "replace", "show",
244 	"test", "zero", "expire", NULL
245 };
246 
247 static const char * const debugopt_list[] = {
248 	"none", "urgent", "misc", "loud", NULL
249 };
250 
251 static const char * const optiopt_list[] = {
252 	"none", "basic", "profile", NULL
253 };
254 
255 void
256 usage(void)
257 {
258 	extern char *__progname;
259 
260 	fprintf(stderr,
261 "usage: %s [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
262 	"\t[-f file] [-i interface] [-K host | network]\n"
263 	"\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
264 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
265 	    __progname);
266 
267 	exit(1);
268 }
269 
270 /*
271  * Cache protocol number to name translations.
272  *
273  * Translation is performed a lot e.g., when dumping states and
274  * getprotobynumber is incredibly expensive.
275  *
276  * Note from the getprotobynumber(3) manpage:
277  * <quote>
278  * These functions use a thread-specific data space; if the data is needed
279  * for future use, it should be copied before any subsequent calls overwrite
280  * it.  Only the Internet protocols are currently understood.
281  * </quote>
282  *
283  * Consequently we only cache the name and strdup it for safety.
284  *
285  * At the time of writing this comment the last entry in /etc/protocols is:
286  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
287  */
288 const char *
289 pfctl_proto2name(int proto)
290 {
291 	static const char *pfctl_proto_cache[259];
292 	struct protoent *p;
293 
294 	if (proto >= nitems(pfctl_proto_cache)) {
295 		p = getprotobynumber(proto);
296 		if (p == NULL) {
297 			return (NULL);
298 		}
299 		return (p->p_name);
300 	}
301 
302 	if (pfctl_proto_cache[proto] == NULL) {
303 		p = getprotobynumber(proto);
304 		if (p == NULL) {
305 			return (NULL);
306 		}
307 		pfctl_proto_cache[proto] = strdup(p->p_name);
308 	}
309 
310 	return (pfctl_proto_cache[proto]);
311 }
312 
313 int
314 pfctl_enable(int dev, int opts)
315 {
316 	if (ioctl(dev, DIOCSTART)) {
317 		if (errno == EEXIST)
318 			errx(1, "pf already enabled");
319 		else if (errno == ESRCH)
320 			errx(1, "pfil registeration failed");
321 		else
322 			err(1, "DIOCSTART");
323 	}
324 	if ((opts & PF_OPT_QUIET) == 0)
325 		fprintf(stderr, "pf enabled\n");
326 
327 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
328 		if (errno != EEXIST)
329 			err(1, "DIOCSTARTALTQ");
330 
331 	return (0);
332 }
333 
334 int
335 pfctl_disable(int dev, int opts)
336 {
337 	if (ioctl(dev, DIOCSTOP)) {
338 		if (errno == ENOENT)
339 			errx(1, "pf not enabled");
340 		else
341 			err(1, "DIOCSTOP");
342 	}
343 	if ((opts & PF_OPT_QUIET) == 0)
344 		fprintf(stderr, "pf disabled\n");
345 
346 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
347 			if (errno != ENOENT)
348 				err(1, "DIOCSTOPALTQ");
349 
350 	return (0);
351 }
352 
353 int
354 pfctl_clear_stats(int dev, int opts)
355 {
356 	if (ioctl(dev, DIOCCLRSTATUS))
357 		err(1, "DIOCCLRSTATUS");
358 	if ((opts & PF_OPT_QUIET) == 0)
359 		fprintf(stderr, "pf: statistics cleared\n");
360 	return (0);
361 }
362 
363 int
364 pfctl_get_skip_ifaces(void)
365 {
366 	bzero(&skip_b, sizeof(skip_b));
367 	skip_b.pfrb_type = PFRB_IFACES;
368 	for (;;) {
369 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
370 		skip_b.pfrb_size = skip_b.pfrb_msize;
371 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
372 			err(1, "pfi_get_ifaces");
373 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
374 			break;
375 	}
376 	return (0);
377 }
378 
379 int
380 pfctl_check_skip_ifaces(char *ifname)
381 {
382 	struct pfi_kif		*p;
383 	struct node_host	*h = NULL, *n = NULL;
384 
385 	PFRB_FOREACH(p, &skip_b) {
386 		if (!strcmp(ifname, p->pfik_name) &&
387 		    (p->pfik_flags & PFI_IFLAG_SKIP))
388 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
389 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
390 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
391 				continue;
392 
393 			for (n = h; n != NULL; n = n->next) {
394 				if (p->pfik_ifp == NULL)
395 					continue;
396 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
397 					continue;
398 
399 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
400 			}
401 		}
402 	}
403 	return (0);
404 }
405 
406 int
407 pfctl_adjust_skip_ifaces(struct pfctl *pf)
408 {
409 	struct pfi_kif		*p, *pp;
410 	struct node_host	*h = NULL, *n = NULL;
411 
412 	PFRB_FOREACH(p, &skip_b) {
413 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
414 			continue;
415 
416 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
417 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
418 			continue;
419 
420 		for (n = h; n != NULL; n = n->next)
421 			PFRB_FOREACH(pp, &skip_b) {
422 				if (pp->pfik_ifp == NULL)
423 					continue;
424 
425 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
426 					continue;
427 
428 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
429 					pfctl_set_interface_flags(pf,
430 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
431 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
432 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
433 			}
434 	}
435 
436 	PFRB_FOREACH(p, &skip_b) {
437 		if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
438 			continue;
439 
440 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
441 	}
442 
443 	return (0);
444 }
445 
446 int
447 pfctl_clear_interface_flags(int dev, int opts)
448 {
449 	struct pfioc_iface	pi;
450 
451 	if ((opts & PF_OPT_NOACTION) == 0) {
452 		bzero(&pi, sizeof(pi));
453 		pi.pfiio_flags = PFI_IFLAG_SKIP;
454 
455 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
456 			err(1, "DIOCCLRIFFLAG");
457 		if ((opts & PF_OPT_QUIET) == 0)
458 			fprintf(stderr, "pf: interface flags reset\n");
459 	}
460 	return (0);
461 }
462 
463 int
464 pfctl_flush_eth_rules(int dev, int opts, char *anchorname)
465 {
466 	int ret;
467 
468 	ret = pfctl_clear_eth_rules(dev, anchorname);
469 	if (ret != 0)
470 		err(1, "pfctl_clear_eth_rules");
471 
472 	if ((opts & PF_OPT_QUIET) == 0)
473 		fprintf(stderr, "Ethernet rules cleared\n");
474 
475 	return (ret);
476 }
477 
478 int
479 pfctl_flush_rules(int dev, int opts, char *anchorname)
480 {
481 	int ret;
482 
483 	ret = pfctl_clear_rules(dev, anchorname);
484 	if (ret != 0)
485 		err(1, "pfctl_clear_rules");
486 	if ((opts & PF_OPT_QUIET) == 0)
487 		fprintf(stderr, "rules cleared\n");
488 	return (0);
489 }
490 
491 int
492 pfctl_flush_nat(int dev, int opts, char *anchorname)
493 {
494 	int ret;
495 
496 	ret = pfctl_clear_nat(dev, anchorname);
497 	if (ret != 0)
498 		err(1, "pfctl_clear_nat");
499 	if ((opts & PF_OPT_QUIET) == 0)
500 		fprintf(stderr, "nat cleared\n");
501 	return (0);
502 }
503 
504 int
505 pfctl_clear_altq(int dev, int opts)
506 {
507 	struct pfr_buffer t;
508 
509 	if (!altqsupport)
510 		return (-1);
511 	memset(&t, 0, sizeof(t));
512 	t.pfrb_type = PFRB_TRANS;
513 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
514 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
515 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
516 		err(1, "pfctl_clear_altq");
517 	if ((opts & PF_OPT_QUIET) == 0)
518 		fprintf(stderr, "altq cleared\n");
519 	return (0);
520 }
521 
522 int
523 pfctl_clear_src_nodes(int dev, int opts)
524 {
525 	if (ioctl(dev, DIOCCLRSRCNODES))
526 		err(1, "DIOCCLRSRCNODES");
527 	if ((opts & PF_OPT_QUIET) == 0)
528 		fprintf(stderr, "source tracking entries cleared\n");
529 	return (0);
530 }
531 
532 int
533 pfctl_clear_iface_states(int dev, const char *iface, int opts)
534 {
535 	struct pfctl_kill kill;
536 	unsigned int killed;
537 
538 	memset(&kill, 0, sizeof(kill));
539 	if (iface != NULL && strlcpy(kill.ifname, iface,
540 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
541 		errx(1, "invalid interface: %s", iface);
542 
543 	if (opts & PF_OPT_KILLMATCH)
544 		kill.kill_match = true;
545 
546 	if (pfctl_clear_states(dev, &kill, &killed))
547 		err(1, "DIOCCLRSTATES");
548 	if ((opts & PF_OPT_QUIET) == 0)
549 		fprintf(stderr, "%d states cleared\n", killed);
550 	return (0);
551 }
552 
553 void
554 pfctl_addrprefix(char *addr, struct pf_addr *mask)
555 {
556 	char *p;
557 	const char *errstr;
558 	int prefix, ret_ga, q, r;
559 	struct addrinfo hints, *res;
560 
561 	if ((p = strchr(addr, '/')) == NULL)
562 		return;
563 
564 	*p++ = '\0';
565 	prefix = strtonum(p, 0, 128, &errstr);
566 	if (errstr)
567 		errx(1, "prefix is %s: %s", errstr, p);
568 
569 	bzero(&hints, sizeof(hints));
570 	/* prefix only with numeric addresses */
571 	hints.ai_flags |= AI_NUMERICHOST;
572 
573 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
574 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
575 		/* NOTREACHED */
576 	}
577 
578 	if (res->ai_family == AF_INET && prefix > 32)
579 		errx(1, "prefix too long for AF_INET");
580 	else if (res->ai_family == AF_INET6 && prefix > 128)
581 		errx(1, "prefix too long for AF_INET6");
582 
583 	q = prefix >> 3;
584 	r = prefix & 7;
585 	switch (res->ai_family) {
586 	case AF_INET:
587 		bzero(&mask->v4, sizeof(mask->v4));
588 		mask->v4.s_addr = htonl((u_int32_t)
589 		    (0xffffffffffULL << (32 - prefix)));
590 		break;
591 	case AF_INET6:
592 		bzero(&mask->v6, sizeof(mask->v6));
593 		if (q > 0)
594 			memset((void *)&mask->v6, 0xff, q);
595 		if (r > 0)
596 			*((u_char *)&mask->v6 + q) =
597 			    (0xff00 >> r) & 0xff;
598 		break;
599 	}
600 	freeaddrinfo(res);
601 }
602 
603 int
604 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
605 {
606 	struct pfioc_src_node_kill psnk;
607 	struct addrinfo *res[2], *resp[2];
608 	struct sockaddr last_src, last_dst;
609 	int killed, sources, dests;
610 	int ret_ga;
611 
612 	killed = sources = dests = 0;
613 
614 	memset(&psnk, 0, sizeof(psnk));
615 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
616 	    sizeof(psnk.psnk_src.addr.v.a.mask));
617 	memset(&last_src, 0xff, sizeof(last_src));
618 	memset(&last_dst, 0xff, sizeof(last_dst));
619 
620 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
621 
622 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
623 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
624 		/* NOTREACHED */
625 	}
626 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
627 		if (resp[0]->ai_addr == NULL)
628 			continue;
629 		/* We get lots of duplicates.  Catch the easy ones */
630 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
631 			continue;
632 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
633 
634 		psnk.psnk_af = resp[0]->ai_family;
635 		sources++;
636 
637 		if (psnk.psnk_af == AF_INET)
638 			psnk.psnk_src.addr.v.a.addr.v4 =
639 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
640 		else if (psnk.psnk_af == AF_INET6)
641 			psnk.psnk_src.addr.v.a.addr.v6 =
642 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
643 			    sin6_addr;
644 		else
645 			errx(1, "Unknown address family %d", psnk.psnk_af);
646 
647 		if (src_node_killers > 1) {
648 			dests = 0;
649 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
650 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
651 			memset(&last_dst, 0xff, sizeof(last_dst));
652 			pfctl_addrprefix(src_node_kill[1],
653 			    &psnk.psnk_dst.addr.v.a.mask);
654 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
655 			    &res[1]))) {
656 				errx(1, "getaddrinfo: %s",
657 				    gai_strerror(ret_ga));
658 				/* NOTREACHED */
659 			}
660 			for (resp[1] = res[1]; resp[1];
661 			    resp[1] = resp[1]->ai_next) {
662 				if (resp[1]->ai_addr == NULL)
663 					continue;
664 				if (psnk.psnk_af != resp[1]->ai_family)
665 					continue;
666 
667 				if (memcmp(&last_dst, resp[1]->ai_addr,
668 				    sizeof(last_dst)) == 0)
669 					continue;
670 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
671 
672 				dests++;
673 
674 				if (psnk.psnk_af == AF_INET)
675 					psnk.psnk_dst.addr.v.a.addr.v4 =
676 					    ((struct sockaddr_in *)resp[1]->
677 					    ai_addr)->sin_addr;
678 				else if (psnk.psnk_af == AF_INET6)
679 					psnk.psnk_dst.addr.v.a.addr.v6 =
680 					    ((struct sockaddr_in6 *)resp[1]->
681 					    ai_addr)->sin6_addr;
682 				else
683 					errx(1, "Unknown address family %d",
684 					    psnk.psnk_af);
685 
686 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
687 					err(1, "DIOCKILLSRCNODES");
688 				killed += psnk.psnk_killed;
689 			}
690 			freeaddrinfo(res[1]);
691 		} else {
692 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
693 				err(1, "DIOCKILLSRCNODES");
694 			killed += psnk.psnk_killed;
695 		}
696 	}
697 
698 	freeaddrinfo(res[0]);
699 
700 	if ((opts & PF_OPT_QUIET) == 0)
701 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
702 		    "destinations\n", killed, sources, dests);
703 	return (0);
704 }
705 
706 int
707 pfctl_net_kill_states(int dev, const char *iface, int opts)
708 {
709 	struct pfctl_kill kill;
710 	struct addrinfo *res[2], *resp[2];
711 	struct sockaddr last_src, last_dst;
712 	unsigned int newkilled;
713 	int killed, sources, dests;
714 	int ret_ga;
715 
716 	killed = sources = dests = 0;
717 
718 	memset(&kill, 0, sizeof(kill));
719 	memset(&kill.src.addr.v.a.mask, 0xff,
720 	    sizeof(kill.src.addr.v.a.mask));
721 	memset(&last_src, 0xff, sizeof(last_src));
722 	memset(&last_dst, 0xff, sizeof(last_dst));
723 	if (iface != NULL && strlcpy(kill.ifname, iface,
724 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
725 		errx(1, "invalid interface: %s", iface);
726 
727 	pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask);
728 
729 	if (opts & PF_OPT_KILLMATCH)
730 		kill.kill_match = true;
731 
732 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
733 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
734 		/* NOTREACHED */
735 	}
736 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
737 		if (resp[0]->ai_addr == NULL)
738 			continue;
739 		/* We get lots of duplicates.  Catch the easy ones */
740 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
741 			continue;
742 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
743 
744 		kill.af = resp[0]->ai_family;
745 		sources++;
746 
747 		if (kill.af == AF_INET)
748 			kill.src.addr.v.a.addr.v4 =
749 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
750 		else if (kill.af == AF_INET6)
751 			kill.src.addr.v.a.addr.v6 =
752 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
753 			    sin6_addr;
754 		else
755 			errx(1, "Unknown address family %d", kill.af);
756 
757 		if (state_killers > 1) {
758 			dests = 0;
759 			memset(&kill.dst.addr.v.a.mask, 0xff,
760 			    sizeof(kill.dst.addr.v.a.mask));
761 			memset(&last_dst, 0xff, sizeof(last_dst));
762 			pfctl_addrprefix(state_kill[1],
763 			    &kill.dst.addr.v.a.mask);
764 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
765 			    &res[1]))) {
766 				errx(1, "getaddrinfo: %s",
767 				    gai_strerror(ret_ga));
768 				/* NOTREACHED */
769 			}
770 			for (resp[1] = res[1]; resp[1];
771 			    resp[1] = resp[1]->ai_next) {
772 				if (resp[1]->ai_addr == NULL)
773 					continue;
774 				if (kill.af != resp[1]->ai_family)
775 					continue;
776 
777 				if (memcmp(&last_dst, resp[1]->ai_addr,
778 				    sizeof(last_dst)) == 0)
779 					continue;
780 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
781 
782 				dests++;
783 
784 				if (kill.af == AF_INET)
785 					kill.dst.addr.v.a.addr.v4 =
786 					    ((struct sockaddr_in *)resp[1]->
787 					    ai_addr)->sin_addr;
788 				else if (kill.af == AF_INET6)
789 					kill.dst.addr.v.a.addr.v6 =
790 					    ((struct sockaddr_in6 *)resp[1]->
791 					    ai_addr)->sin6_addr;
792 				else
793 					errx(1, "Unknown address family %d",
794 					    kill.af);
795 
796 				if (pfctl_kill_states(dev, &kill, &newkilled))
797 					err(1, "DIOCKILLSTATES");
798 				killed += newkilled;
799 			}
800 			freeaddrinfo(res[1]);
801 		} else {
802 			if (pfctl_kill_states(dev, &kill, &newkilled))
803 				err(1, "DIOCKILLSTATES");
804 			killed += newkilled;
805 		}
806 	}
807 
808 	freeaddrinfo(res[0]);
809 
810 	if ((opts & PF_OPT_QUIET) == 0)
811 		fprintf(stderr, "killed %d states from %d sources and %d "
812 		    "destinations\n", killed, sources, dests);
813 	return (0);
814 }
815 
816 int
817 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
818 {
819 	struct pfctl_kill kill;
820 	struct addrinfo *res, *resp;
821 	struct sockaddr last_src;
822 	unsigned int newkilled;
823 	int killed = 0;
824 	int ret_ga;
825 
826 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
827 		warnx("no gateway specified");
828 		usage();
829 	}
830 
831 	memset(&kill, 0, sizeof(kill));
832 	memset(&kill.rt_addr.addr.v.a.mask, 0xff,
833 	    sizeof(kill.rt_addr.addr.v.a.mask));
834 	memset(&last_src, 0xff, sizeof(last_src));
835 	if (iface != NULL && strlcpy(kill.ifname, iface,
836 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
837 		errx(1, "invalid interface: %s", iface);
838 
839 	if (opts & PF_OPT_KILLMATCH)
840 		kill.kill_match = true;
841 
842 	pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask);
843 
844 	if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, &res))) {
845 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
846 		/* NOTREACHED */
847 	}
848 	for (resp = res; resp; resp = resp->ai_next) {
849 		if (resp->ai_addr == NULL)
850 			continue;
851 		/* We get lots of duplicates.  Catch the easy ones */
852 		if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
853 			continue;
854 		last_src = *(struct sockaddr *)resp->ai_addr;
855 
856 		kill.af = resp->ai_family;
857 
858 		if (kill.af == AF_INET)
859 			kill.rt_addr.addr.v.a.addr.v4 =
860 			    ((struct sockaddr_in *)resp->ai_addr)->sin_addr;
861 		else if (kill.af == AF_INET6)
862 			kill.rt_addr.addr.v.a.addr.v6 =
863 			    ((struct sockaddr_in6 *)resp->ai_addr)->
864 			    sin6_addr;
865 		else
866 			errx(1, "Unknown address family %d", kill.af);
867 
868 		if (pfctl_kill_states(dev, &kill, &newkilled))
869 			err(1, "DIOCKILLSTATES");
870 		killed += newkilled;
871 	}
872 
873 	freeaddrinfo(res);
874 
875 	if ((opts & PF_OPT_QUIET) == 0)
876 		fprintf(stderr, "killed %d states\n", killed);
877 	return (0);
878 }
879 
880 int
881 pfctl_label_kill_states(int dev, const char *iface, int opts)
882 {
883 	struct pfctl_kill kill;
884 	unsigned int killed;
885 
886 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
887 		warnx("no label specified");
888 		usage();
889 	}
890 	memset(&kill, 0, sizeof(kill));
891 	if (iface != NULL && strlcpy(kill.ifname, iface,
892 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
893 		errx(1, "invalid interface: %s", iface);
894 
895 	if (opts & PF_OPT_KILLMATCH)
896 		kill.kill_match = true;
897 
898 	if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
899 	    sizeof(kill.label))
900 		errx(1, "label too long: %s", state_kill[1]);
901 
902 	if (pfctl_kill_states(dev, &kill, &killed))
903 		err(1, "DIOCKILLSTATES");
904 
905 	if ((opts & PF_OPT_QUIET) == 0)
906 		fprintf(stderr, "killed %d states\n", killed);
907 
908 	return (0);
909 }
910 
911 int
912 pfctl_id_kill_states(int dev, const char *iface, int opts)
913 {
914 	struct pfctl_kill kill;
915 	unsigned int killed;
916 
917 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
918 		warnx("no id specified");
919 		usage();
920 	}
921 
922 	memset(&kill, 0, sizeof(kill));
923 
924 	if (opts & PF_OPT_KILLMATCH)
925 		kill.kill_match = true;
926 
927 	if ((sscanf(state_kill[1], "%jx/%x",
928 	    &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
929 	}
930 	else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
931 		kill.cmp.creatorid = 0;
932 	} else {
933 		warnx("wrong id format specified");
934 		usage();
935 	}
936 	if (kill.cmp.id == 0) {
937 		warnx("cannot kill id 0");
938 		usage();
939 	}
940 
941 	if (pfctl_kill_states(dev, &kill, &killed))
942 		err(1, "DIOCKILLSTATES");
943 
944 	if ((opts & PF_OPT_QUIET) == 0)
945 		fprintf(stderr, "killed %d states\n", killed);
946 
947 	return (0);
948 }
949 
950 int
951 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
952     u_int32_t ticket, int r_action, char *anchorname)
953 {
954 	struct pfioc_pooladdr pp;
955 	struct pf_pooladdr *pa;
956 	u_int32_t pnr, mpnr;
957 
958 	memset(&pp, 0, sizeof(pp));
959 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
960 	pp.r_action = r_action;
961 	pp.r_num = nr;
962 	pp.ticket = ticket;
963 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
964 		warn("DIOCGETADDRS");
965 		return (-1);
966 	}
967 	mpnr = pp.nr;
968 	TAILQ_INIT(&pool->list);
969 	for (pnr = 0; pnr < mpnr; ++pnr) {
970 		pp.nr = pnr;
971 		if (ioctl(dev, DIOCGETADDR, &pp)) {
972 			warn("DIOCGETADDR");
973 			return (-1);
974 		}
975 		pa = calloc(1, sizeof(struct pf_pooladdr));
976 		if (pa == NULL)
977 			err(1, "calloc");
978 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
979 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
980 	}
981 
982 	return (0);
983 }
984 
985 void
986 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
987 {
988 	struct pf_pooladdr *pa;
989 
990 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
991 		TAILQ_REMOVE(&src->list, pa, entries);
992 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
993 	}
994 }
995 
996 void
997 pfctl_clear_pool(struct pfctl_pool *pool)
998 {
999 	struct pf_pooladdr *pa;
1000 
1001 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
1002 		TAILQ_REMOVE(&pool->list, pa, entries);
1003 		free(pa);
1004 	}
1005 }
1006 
1007 void
1008 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *rule, int opts)
1009 {
1010 	if (opts & PF_OPT_VERBOSE) {
1011 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1012 			    "Bytes: %-10llu]\n",
1013 			    (unsigned long long)rule->evaluations,
1014 			    (unsigned long long)(rule->packets[0] +
1015 			    rule->packets[1]),
1016 			    (unsigned long long)(rule->bytes[0] +
1017 			    rule->bytes[1]));
1018 	}
1019 }
1020 
1021 void
1022 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
1023 {
1024 	if (opts & PF_OPT_DEBUG) {
1025 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
1026 		    "p", "sa", "sp", "da", "dp" };
1027 		int i;
1028 
1029 		printf("  [ Skip steps: ");
1030 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
1031 			if (rule->skip[i].nr == rule->nr + 1)
1032 				continue;
1033 			printf("%s=", t[i]);
1034 			if (rule->skip[i].nr == -1)
1035 				printf("end ");
1036 			else
1037 				printf("%u ", rule->skip[i].nr);
1038 		}
1039 		printf("]\n");
1040 
1041 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1042 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
1043 	}
1044 	if (opts & PF_OPT_VERBOSE) {
1045 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1046 			    "Bytes: %-10llu  States: %-6ju]\n",
1047 			    (unsigned long long)rule->evaluations,
1048 			    (unsigned long long)(rule->packets[0] +
1049 			    rule->packets[1]),
1050 			    (unsigned long long)(rule->bytes[0] +
1051 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
1052 		if (!(opts & PF_OPT_DEBUG))
1053 			printf("  [ Inserted: uid %u pid %u "
1054 			    "State Creations: %-6ju]\n",
1055 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
1056 			    (uintmax_t)rule->states_tot);
1057 	}
1058 }
1059 
1060 void
1061 pfctl_print_title(char *title)
1062 {
1063 	if (!first_title)
1064 		printf("\n");
1065 	first_title = 0;
1066 	printf("%s\n", title);
1067 }
1068 
1069 int
1070 pfctl_show_eth_rules(int dev, char *path, int opts, enum pfctl_show format,
1071     char *anchorname, int depth)
1072 {
1073 	char anchor_call[MAXPATHLEN];
1074 	struct pfctl_eth_rules_info info;
1075 	struct pfctl_eth_rule rule;
1076 	int dotitle = opts & PF_OPT_SHOWALL;
1077 	int len = strlen(path);
1078 	int brace;
1079 	char *p;
1080 
1081 	if (path[0])
1082 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1083 	else
1084 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1085 
1086 	if (pfctl_get_eth_rules_info(dev, &info, path)) {
1087 		warn("DIOCGETETHRULES");
1088 		return (-1);
1089 	}
1090 	for (int nr = 0; nr < info.nr; nr++) {
1091 		brace = 0;
1092 		INDENT(depth, !(opts & PF_OPT_VERBOSE));
1093 		if (pfctl_get_eth_rule(dev, nr, info.ticket, path, &rule,
1094 		    opts & PF_OPT_CLRRULECTRS, anchor_call) != 0) {
1095 			warn("DIOCGETETHRULE");
1096 			return (-1);
1097 		}
1098 		if (anchor_call[0] &&
1099 		   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1100 		   (p == anchor_call ||
1101 		   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1102 			brace++;
1103 			if ((p = strrchr(anchor_call, '/')) !=
1104 			    NULL)
1105 				p++;
1106 			else
1107 				p = &anchor_call[0];
1108 		} else
1109 			p = &anchor_call[0];
1110 		if (dotitle) {
1111 			pfctl_print_title("ETH RULES:");
1112 			dotitle = 0;
1113 		}
1114 		print_eth_rule(&rule, anchor_call,
1115 		    opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1116 		if (brace)
1117 			printf(" {\n");
1118 		else
1119 			printf("\n");
1120 		pfctl_print_eth_rule_counters(&rule, opts);
1121 		if (brace) {
1122 			pfctl_show_eth_rules(dev, path, opts, format,
1123 			    p, depth + 1);
1124 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1125 			printf("}\n");
1126 		}
1127 	}
1128 
1129 	path[len] = '\0';
1130 	return (0);
1131 }
1132 
1133 int
1134 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1135     char *anchorname, int depth)
1136 {
1137 	struct pfctl_rules_info ri;
1138 	struct pfctl_rule rule;
1139 	char anchor_call[MAXPATHLEN];
1140 	u_int32_t nr, header = 0;
1141 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1142 	int numeric = opts & PF_OPT_NUMERIC;
1143 	int len = strlen(path);
1144 	int brace;
1145 	int ret;
1146 	char *p;
1147 
1148 	if (path[0])
1149 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1150 	else
1151 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1152 
1153 	if (opts & PF_OPT_SHOWALL) {
1154 		ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1155 		if (ret != 0) {
1156 			warn("DIOCGETRULES");
1157 			goto error;
1158 		}
1159 		header++;
1160 	}
1161 	ret = pfctl_get_rules_info(dev, &ri, PF_SCRUB, path);
1162 	if (ret != 0) {
1163 		warn("DIOCGETRULES");
1164 		goto error;
1165 	}
1166 	if (opts & PF_OPT_SHOWALL) {
1167 		if (format == PFCTL_SHOW_RULES && (ri.nr > 0 || header))
1168 			pfctl_print_title("FILTER RULES:");
1169 		else if (format == PFCTL_SHOW_LABELS && labels)
1170 			pfctl_print_title("LABEL COUNTERS:");
1171 	}
1172 
1173 	for (nr = 0; nr < ri.nr; ++nr) {
1174 		if (pfctl_get_clear_rule(dev, nr, ri.ticket, path, PF_SCRUB,
1175 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1176 			warn("DIOCGETRULENV");
1177 			goto error;
1178 		}
1179 
1180 		if (pfctl_get_pool(dev, &rule.rpool,
1181 		    nr, ri.ticket, PF_SCRUB, path) != 0)
1182 			goto error;
1183 
1184 		switch (format) {
1185 		case PFCTL_SHOW_LABELS:
1186 			break;
1187 		case PFCTL_SHOW_RULES:
1188 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1189 				labels = 1;
1190 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1191 			printf("\n");
1192 			pfctl_print_rule_counters(&rule, opts);
1193 			break;
1194 		case PFCTL_SHOW_NOTHING:
1195 			break;
1196 		}
1197 		pfctl_clear_pool(&rule.rpool);
1198 	}
1199 	ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1200 	if (ret != 0) {
1201 		warn("DIOCGETRULES");
1202 		goto error;
1203 	}
1204 	for (nr = 0; nr < ri.nr; ++nr) {
1205 		if (pfctl_get_clear_rule(dev, nr, ri.ticket, path, PF_PASS,
1206 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1207 			warn("DIOCGETRULE");
1208 			goto error;
1209 		}
1210 
1211 		if (pfctl_get_pool(dev, &rule.rpool,
1212 		    nr, ri.ticket, PF_PASS, path) != 0)
1213 			goto error;
1214 
1215 		switch (format) {
1216 		case PFCTL_SHOW_LABELS: {
1217 			bool show = false;
1218 			int i = 0;
1219 
1220 			while (rule.label[i][0]) {
1221 				printf("%s ", rule.label[i++]);
1222 				show = true;
1223 			}
1224 
1225 			if (show) {
1226 				printf("%llu %llu %llu %llu"
1227 				    " %llu %llu %llu %ju\n",
1228 				    (unsigned long long)rule.evaluations,
1229 				    (unsigned long long)(rule.packets[0] +
1230 				    rule.packets[1]),
1231 				    (unsigned long long)(rule.bytes[0] +
1232 				    rule.bytes[1]),
1233 				    (unsigned long long)rule.packets[0],
1234 				    (unsigned long long)rule.bytes[0],
1235 				    (unsigned long long)rule.packets[1],
1236 				    (unsigned long long)rule.bytes[1],
1237 				    (uintmax_t)rule.states_tot);
1238 			}
1239 			break;
1240 		}
1241 		case PFCTL_SHOW_RULES:
1242 			brace = 0;
1243 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1244 				labels = 1;
1245 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1246 			if (anchor_call[0] &&
1247 			   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1248 			   ((void *)p == (void *)anchor_call ||
1249 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1250 				brace++;
1251 				if ((p = strrchr(anchor_call, '/')) !=
1252 				    NULL)
1253 					p++;
1254 				else
1255 					p = &anchor_call[0];
1256 			} else
1257 				p = &anchor_call[0];
1258 
1259 			print_rule(&rule, p, rule_numbers, numeric);
1260 			if (brace)
1261 				printf(" {\n");
1262 			else
1263 				printf("\n");
1264 			pfctl_print_rule_counters(&rule, opts);
1265 			if (brace) {
1266 				pfctl_show_rules(dev, path, opts, format,
1267 				    p, depth + 1);
1268 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1269 				printf("}\n");
1270 			}
1271 			break;
1272 		case PFCTL_SHOW_NOTHING:
1273 			break;
1274 		}
1275 		pfctl_clear_pool(&rule.rpool);
1276 	}
1277 	path[len] = '\0';
1278 	return (0);
1279 
1280  error:
1281 	path[len] = '\0';
1282 	return (-1);
1283 }
1284 
1285 int
1286 pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth)
1287 {
1288 	struct pfctl_rules_info ri;
1289 	struct pfctl_rule rule;
1290 	char anchor_call[MAXPATHLEN];
1291 	u_int32_t nr;
1292 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1293 	int i, dotitle = opts & PF_OPT_SHOWALL;
1294 	int brace, ret;
1295 	int len = strlen(path);
1296 	char *p;
1297 
1298 	if (path[0])
1299 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1300 	else
1301 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1302 
1303 	for (i = 0; i < 3; i++) {
1304 		ret = pfctl_get_rules_info(dev, &ri, nattype[i], path);
1305 		if (ret != 0) {
1306 			warn("DIOCGETRULES");
1307 			return (-1);
1308 		}
1309 		for (nr = 0; nr < ri.nr; ++nr) {
1310 			brace = 0;
1311 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1312 
1313 			if (pfctl_get_rule(dev, nr, ri.ticket, path,
1314 			    nattype[i], &rule, anchor_call)) {
1315 				warn("DIOCGETRULE");
1316 				return (-1);
1317 			}
1318 			if (pfctl_get_pool(dev, &rule.rpool, nr,
1319 			    ri.ticket, nattype[i], path) != 0)
1320 				return (-1);
1321 
1322 			if (anchor_call[0] &&
1323 			   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1324 			   (p == anchor_call ||
1325 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1326 				brace++;
1327 				if ((p = strrchr(anchor_call, '/')) !=
1328 				    NULL)
1329 					p++;
1330 				else
1331 					p = &anchor_call[0];
1332 			} else
1333 				p = &anchor_call[0];
1334 
1335 			if (dotitle) {
1336 				pfctl_print_title("TRANSLATION RULES:");
1337 				dotitle = 0;
1338 			}
1339 			print_rule(&rule, anchor_call,
1340 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1341 			if (brace)
1342 				printf(" {\n");
1343 			else
1344 				printf("\n");
1345 			pfctl_print_rule_counters(&rule, opts);
1346 			pfctl_clear_pool(&rule.rpool);
1347 			if (brace) {
1348 				pfctl_show_nat(dev, path, opts, p, depth + 1);
1349 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1350 				printf("}\n");
1351 			}
1352 		}
1353 	}
1354 	return (0);
1355 }
1356 
1357 int
1358 pfctl_show_src_nodes(int dev, int opts)
1359 {
1360 	struct pfioc_src_nodes psn;
1361 	struct pf_src_node *p;
1362 	char *inbuf = NULL, *newinbuf = NULL;
1363 	unsigned int len = 0;
1364 	int i;
1365 
1366 	memset(&psn, 0, sizeof(psn));
1367 	for (;;) {
1368 		psn.psn_len = len;
1369 		if (len) {
1370 			newinbuf = realloc(inbuf, len);
1371 			if (newinbuf == NULL)
1372 				err(1, "realloc");
1373 			psn.psn_buf = inbuf = newinbuf;
1374 		}
1375 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1376 			warn("DIOCGETSRCNODES");
1377 			free(inbuf);
1378 			return (-1);
1379 		}
1380 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1381 			break;
1382 		if (len == 0 && psn.psn_len == 0)
1383 			goto done;
1384 		if (len == 0 && psn.psn_len != 0)
1385 			len = psn.psn_len;
1386 		if (psn.psn_len == 0)
1387 			goto done;	/* no src_nodes */
1388 		len *= 2;
1389 	}
1390 	p = psn.psn_src_nodes;
1391 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1392 		pfctl_print_title("SOURCE TRACKING NODES:");
1393 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1394 		print_src_node(p, opts);
1395 		p++;
1396 	}
1397 done:
1398 	free(inbuf);
1399 	return (0);
1400 }
1401 
1402 int
1403 pfctl_show_states(int dev, const char *iface, int opts)
1404 {
1405 	struct pfctl_states states;
1406 	struct pfctl_state *s;
1407 	int dotitle = (opts & PF_OPT_SHOWALL);
1408 
1409 	memset(&states, 0, sizeof(states));
1410 
1411 	if (pfctl_get_states(dev, &states))
1412 		return (-1);
1413 
1414 	TAILQ_FOREACH(s, &states.states, entry) {
1415 		if (iface != NULL && strcmp(s->ifname, iface))
1416 			continue;
1417 		if (dotitle) {
1418 			pfctl_print_title("STATES:");
1419 			dotitle = 0;
1420 		}
1421 		print_state(s, opts);
1422 	}
1423 
1424 	pfctl_free_states(&states);
1425 
1426 	return (0);
1427 }
1428 
1429 int
1430 pfctl_show_status(int dev, int opts)
1431 {
1432 	struct pfctl_status	*status;
1433 	struct pfctl_syncookies	cookies;
1434 
1435 	if ((status = pfctl_get_status(dev)) == NULL) {
1436 		warn("DIOCGETSTATUS");
1437 		return (-1);
1438 	}
1439 	if (pfctl_get_syncookies(dev, &cookies)) {
1440 		pfctl_free_status(status);
1441 		warn("DIOCGETSYNCOOKIES");
1442 		return (-1);
1443 	}
1444 	if (opts & PF_OPT_SHOWALL)
1445 		pfctl_print_title("INFO:");
1446 	print_status(status, &cookies, opts);
1447 	pfctl_free_status(status);
1448 	return (0);
1449 }
1450 
1451 int
1452 pfctl_show_running(int dev)
1453 {
1454 	struct pfctl_status *status;
1455 	int running;
1456 
1457 	if ((status = pfctl_get_status(dev)) == NULL) {
1458 		warn("DIOCGETSTATUS");
1459 		return (-1);
1460 	}
1461 
1462 	running = status->running;
1463 
1464 	print_running(status);
1465 	pfctl_free_status(status);
1466 	return (!running);
1467 }
1468 
1469 int
1470 pfctl_show_timeouts(int dev, int opts)
1471 {
1472 	struct pfioc_tm pt;
1473 	int i;
1474 
1475 	if (opts & PF_OPT_SHOWALL)
1476 		pfctl_print_title("TIMEOUTS:");
1477 	memset(&pt, 0, sizeof(pt));
1478 	for (i = 0; pf_timeouts[i].name; i++) {
1479 		pt.timeout = pf_timeouts[i].timeout;
1480 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1481 			err(1, "DIOCGETTIMEOUT");
1482 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1483 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1484 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1485 			printf(" states");
1486 		else
1487 			printf("s");
1488 		printf("\n");
1489 	}
1490 	return (0);
1491 
1492 }
1493 
1494 int
1495 pfctl_show_limits(int dev, int opts)
1496 {
1497 	struct pfioc_limit pl;
1498 	int i;
1499 
1500 	if (opts & PF_OPT_SHOWALL)
1501 		pfctl_print_title("LIMITS:");
1502 	memset(&pl, 0, sizeof(pl));
1503 	for (i = 0; pf_limits[i].name; i++) {
1504 		pl.index = pf_limits[i].index;
1505 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1506 			err(1, "DIOCGETLIMIT");
1507 		printf("%-13s ", pf_limits[i].name);
1508 		if (pl.limit == UINT_MAX)
1509 			printf("unlimited\n");
1510 		else
1511 			printf("hard limit %8u\n", pl.limit);
1512 	}
1513 	return (0);
1514 }
1515 
1516 /* callbacks for rule/nat/rdr/addr */
1517 int
1518 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1519 {
1520 	struct pf_pooladdr *pa;
1521 
1522 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1523 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1524 			err(1, "DIOCBEGINADDRS");
1525 	}
1526 
1527 	pf->paddr.af = af;
1528 	TAILQ_FOREACH(pa, &p->list, entries) {
1529 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1530 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1531 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1532 				err(1, "DIOCADDADDR");
1533 		}
1534 	}
1535 	return (0);
1536 }
1537 
1538 int
1539 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1540     const char *anchor_call)
1541 {
1542 	u_int8_t		rs_num;
1543 	struct pfctl_rule	*rule;
1544 	struct pfctl_ruleset	*rs;
1545 	char 			*p;
1546 
1547 	rs_num = pf_get_ruleset_number(r->action);
1548 	if (rs_num == PF_RULESET_MAX)
1549 		errx(1, "Invalid rule type %d", r->action);
1550 
1551 	rs = &pf->anchor->ruleset;
1552 
1553 	if (anchor_call[0] && r->anchor == NULL) {
1554 		/*
1555 		 * Don't make non-brace anchors part of the main anchor pool.
1556 		 */
1557 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1558 			err(1, "pfctl_append_rule: calloc");
1559 
1560 		pf_init_ruleset(&r->anchor->ruleset);
1561 		r->anchor->ruleset.anchor = r->anchor;
1562 		if (strlcpy(r->anchor->path, anchor_call,
1563 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1564 			errx(1, "pfctl_append_rule: strlcpy");
1565 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1566 			if (!strlen(p))
1567 				err(1, "pfctl_append_rule: bad anchor name %s",
1568 				    anchor_call);
1569 		} else
1570 			p = (char *)anchor_call;
1571 		if (strlcpy(r->anchor->name, p,
1572 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1573 			errx(1, "pfctl_append_rule: strlcpy");
1574 	}
1575 
1576 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1577 		err(1, "calloc");
1578 	bcopy(r, rule, sizeof(*rule));
1579 	TAILQ_INIT(&rule->rpool.list);
1580 	pfctl_move_pool(&r->rpool, &rule->rpool);
1581 
1582 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1583 	return (0);
1584 }
1585 
1586 int
1587 pfctl_append_eth_rule(struct pfctl *pf, struct pfctl_eth_rule *r,
1588     const char *anchor_call)
1589 {
1590 	struct pfctl_eth_rule		*rule;
1591 	struct pfctl_eth_ruleset	*rs;
1592 	char 				*p;
1593 
1594 	rs = &pf->eanchor->ruleset;
1595 
1596 	if (anchor_call[0] && r->anchor == NULL) {
1597 		/*
1598 		 * Don't make non-brace anchors part of the main anchor pool.
1599 		 */
1600 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1601 			err(1, "pfctl_append_rule: calloc");
1602 
1603 		pf_init_eth_ruleset(&r->anchor->ruleset);
1604 		r->anchor->ruleset.anchor = r->anchor;
1605 		if (strlcpy(r->anchor->path, anchor_call,
1606 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1607 			errx(1, "pfctl_append_rule: strlcpy");
1608 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1609 			if (!strlen(p))
1610 				err(1, "pfctl_append_eth_rule: bad anchor name %s",
1611 				    anchor_call);
1612 		} else
1613 			p = (char *)anchor_call;
1614 		if (strlcpy(r->anchor->name, p,
1615 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1616 			errx(1, "pfctl_append_eth_rule: strlcpy");
1617 	}
1618 
1619 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1620 		err(1, "calloc");
1621 	bcopy(r, rule, sizeof(*rule));
1622 
1623 	TAILQ_INSERT_TAIL(&rs->rules, rule, entries);
1624 	return (0);
1625 }
1626 
1627 int
1628 pfctl_eth_ruleset_trans(struct pfctl *pf, char *path,
1629     struct pfctl_eth_anchor *a)
1630 {
1631 	int osize = pf->trans->pfrb_size;
1632 
1633 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0) {
1634 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1635 			return (1);
1636 	}
1637 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1638 		return (5);
1639 
1640 	return (0);
1641 }
1642 
1643 int
1644 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a, bool do_eth)
1645 {
1646 	int osize = pf->trans->pfrb_size;
1647 
1648 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0 && do_eth) {
1649 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1650 			return (1);
1651 	}
1652 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1653 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1654 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1655 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1656 			return (1);
1657 	}
1658 	if (a == pf->astack[0] && ((altqsupport &&
1659 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1660 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1661 			return (2);
1662 	}
1663 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1664 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1665 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1666 			return (3);
1667 	}
1668 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1669 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1670 			return (4);
1671 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1672 		return (5);
1673 
1674 	return (0);
1675 }
1676 
1677 int
1678 pfctl_load_eth_ruleset(struct pfctl *pf, char *path,
1679     struct pfctl_eth_ruleset *rs, int depth)
1680 {
1681 	struct pfctl_eth_rule	*r;
1682 	int	error, len = strlen(path);
1683 	int	brace = 0;
1684 
1685 	pf->eanchor = rs->anchor;
1686 	if (path[0])
1687 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->eanchor->name);
1688 	else
1689 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->eanchor->name);
1690 
1691 	if (depth) {
1692 		if (TAILQ_FIRST(&rs->rules) != NULL) {
1693 			brace++;
1694 			if (pf->opts & PF_OPT_VERBOSE)
1695 				printf(" {\n");
1696 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1697 			    (error = pfctl_eth_ruleset_trans(pf,
1698 			    path, rs->anchor))) {
1699 				printf("pfctl_load_eth_rulesets: "
1700 				    "pfctl_eth_ruleset_trans %d\n", error);
1701 				goto error;
1702 			}
1703 		} else if (pf->opts & PF_OPT_VERBOSE)
1704 			printf("\n");
1705 	}
1706 
1707 	while ((r = TAILQ_FIRST(&rs->rules)) != NULL) {
1708 		TAILQ_REMOVE(&rs->rules, r, entries);
1709 
1710 		error = pfctl_load_eth_rule(pf, path, r, depth);
1711 		if (error)
1712 			return (error);
1713 
1714 		if (r->anchor) {
1715 			if ((error = pfctl_load_eth_ruleset(pf, path,
1716 			    &r->anchor->ruleset, depth + 1)))
1717 				return (error);
1718 		} else if (pf->opts & PF_OPT_VERBOSE)
1719 			printf("\n");
1720 		free(r);
1721 	}
1722 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1723 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1724 		printf("}\n");
1725 	}
1726 	path[len] = '\0';
1727 
1728 	return (0);
1729 error:
1730 	path[len] = '\0';
1731 	return (error);
1732 }
1733 
1734 int
1735 pfctl_load_eth_rule(struct pfctl *pf, char *path, struct pfctl_eth_rule *r,
1736     int depth)
1737 {
1738 	char			*name;
1739 	char			anchor[PF_ANCHOR_NAME_SIZE];
1740 	int			len = strlen(path);
1741 
1742 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1743 		errx(1, "pfctl_load_eth_rule: strlcpy");
1744 
1745 	if (r->anchor) {
1746 		if (r->anchor->match) {
1747 			if (path[0])
1748 				snprintf(&path[len], MAXPATHLEN - len,
1749 				    "/%s", r->anchor->name);
1750 			else
1751 				snprintf(&path[len], MAXPATHLEN - len,
1752 				    "%s", r->anchor->name);
1753 			name = r->anchor->name;
1754 		} else
1755 			name = r->anchor->path;
1756 	} else
1757 		name = "";
1758 
1759 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1760 		if (pfctl_add_eth_rule(pf->dev, r, anchor, name,
1761 		    pf->eth_ticket))
1762 			err(1, "DIOCADDETHRULENV");
1763 
1764 	if (pf->opts & PF_OPT_VERBOSE) {
1765 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1766 		print_eth_rule(r, r->anchor ? r->anchor->name : "",
1767 		    pf->opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1768 	}
1769 
1770 	path[len] = '\0';
1771 
1772 	return (0);
1773 }
1774 
1775 int
1776 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1777     int rs_num, int depth)
1778 {
1779 	struct pfctl_rule *r;
1780 	int		error, len = strlen(path);
1781 	int		brace = 0;
1782 
1783 	pf->anchor = rs->anchor;
1784 
1785 	if (path[0])
1786 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1787 	else
1788 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1789 
1790 	if (depth) {
1791 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1792 			brace++;
1793 			if (pf->opts & PF_OPT_VERBOSE)
1794 				printf(" {\n");
1795 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1796 			    (error = pfctl_ruleset_trans(pf,
1797 			    path, rs->anchor, false))) {
1798 				printf("pfctl_load_rulesets: "
1799 				    "pfctl_ruleset_trans %d\n", error);
1800 				goto error;
1801 			}
1802 		} else if (pf->opts & PF_OPT_VERBOSE)
1803 			printf("\n");
1804 
1805 	}
1806 
1807 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1808 		pfctl_optimize_ruleset(pf, rs);
1809 
1810 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1811 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1812 
1813 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1814 			expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
1815 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
1816 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
1817 
1818 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1819 			goto error;
1820 		if (r->anchor) {
1821 			if ((error = pfctl_load_ruleset(pf, path,
1822 			    &r->anchor->ruleset, rs_num, depth + 1)))
1823 				goto error;
1824 		} else if (pf->opts & PF_OPT_VERBOSE)
1825 			printf("\n");
1826 		free(r);
1827 	}
1828 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1829 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1830 		printf("}\n");
1831 	}
1832 	path[len] = '\0';
1833 	return (0);
1834 
1835  error:
1836 	path[len] = '\0';
1837 	return (error);
1838 
1839 }
1840 
1841 int
1842 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
1843 {
1844 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1845 	char			*name;
1846 	u_int32_t		ticket;
1847 	char			anchor[PF_ANCHOR_NAME_SIZE];
1848 	int			len = strlen(path);
1849 	int			error;
1850 	bool			was_present;
1851 
1852 	/* set up anchor before adding to path for anchor_call */
1853 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1854 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1855 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1856 		errx(1, "pfctl_load_rule: strlcpy");
1857 
1858 	if (r->anchor) {
1859 		if (r->anchor->match) {
1860 			if (path[0])
1861 				snprintf(&path[len], MAXPATHLEN - len,
1862 				    "/%s", r->anchor->name);
1863 			else
1864 				snprintf(&path[len], MAXPATHLEN - len,
1865 				    "%s", r->anchor->name);
1866 			name = r->anchor->name;
1867 		} else
1868 			name = r->anchor->path;
1869 	} else
1870 		name = "";
1871 
1872 	was_present = false;
1873 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1874 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1875 			return (1);
1876 		error = pfctl_add_rule(pf->dev, r, anchor, name, ticket,
1877 		    pf->paddr.ticket);
1878 		switch (error) {
1879 		case 0:
1880 			/* things worked, do nothing */
1881 			break;
1882 		case EEXIST:
1883 			/* an identical rule is already present */
1884 			was_present = true;
1885 			break;
1886 		default:
1887 			err(1, "DIOCADDRULENV");
1888 		}
1889 	}
1890 
1891 	if (pf->opts & PF_OPT_VERBOSE) {
1892 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1893 		print_rule(r, r->anchor ? r->anchor->name : "",
1894 		    pf->opts & PF_OPT_VERBOSE2,
1895 		    pf->opts & PF_OPT_NUMERIC);
1896 		if (was_present)
1897 			printf(" -- rule was already present");
1898 	}
1899 	path[len] = '\0';
1900 	pfctl_clear_pool(&r->rpool);
1901 	return (0);
1902 }
1903 
1904 int
1905 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1906 {
1907 	if (altqsupport &&
1908 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1909 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1910 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1911 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1912 				if (errno == ENXIO)
1913 					errx(1, "qtype not configured");
1914 				else if (errno == ENODEV)
1915 					errx(1, "%s: driver does not support "
1916 					    "altq", a->ifname);
1917 				else
1918 					err(1, "DIOCADDALTQ");
1919 			}
1920 		}
1921 		pfaltq_store(&pf->paltq->altq);
1922 	}
1923 	return (0);
1924 }
1925 
1926 int
1927 pfctl_rules(int dev, char *filename, int opts, int optimize,
1928     char *anchorname, struct pfr_buffer *trans)
1929 {
1930 #define ERR(x) do { warn(x); goto _error; } while(0)
1931 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1932 
1933 	struct pfr_buffer	*t, buf;
1934 	struct pfioc_altq	 pa;
1935 	struct pfctl		 pf;
1936 	struct pfctl_ruleset	*rs;
1937 	struct pfctl_eth_ruleset	*ethrs;
1938 	struct pfr_table	 trs;
1939 	char			*path;
1940 	int			 osize;
1941 
1942 	RB_INIT(&pf_anchors);
1943 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1944 	pf_init_ruleset(&pf_main_anchor.ruleset);
1945 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1946 
1947 	memset(&pf_eth_main_anchor, 0, sizeof(pf_eth_main_anchor));
1948 	pf_init_eth_ruleset(&pf_eth_main_anchor.ruleset);
1949 	pf_eth_main_anchor.ruleset.anchor = &pf_eth_main_anchor;
1950 
1951 	if (trans == NULL) {
1952 		bzero(&buf, sizeof(buf));
1953 		buf.pfrb_type = PFRB_TRANS;
1954 		t = &buf;
1955 		osize = 0;
1956 	} else {
1957 		t = trans;
1958 		osize = t->pfrb_size;
1959 	}
1960 
1961 	memset(&pa, 0, sizeof(pa));
1962 	pa.version = PFIOC_ALTQ_VERSION;
1963 	memset(&pf, 0, sizeof(pf));
1964 	memset(&trs, 0, sizeof(trs));
1965 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1966 		ERRX("pfctl_rules: calloc");
1967 	if (strlcpy(trs.pfrt_anchor, anchorname,
1968 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1969 		ERRX("pfctl_rules: strlcpy");
1970 	pf.dev = dev;
1971 	pf.opts = opts;
1972 	pf.optimize = optimize;
1973 	pf.loadopt = loadopt;
1974 
1975 	/* non-brace anchor, create without resolving the path */
1976 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1977 		ERRX("pfctl_rules: calloc");
1978 	rs = &pf.anchor->ruleset;
1979 	pf_init_ruleset(rs);
1980 	rs->anchor = pf.anchor;
1981 	if (strlcpy(pf.anchor->path, anchorname,
1982 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1983 		errx(1, "pfctl_rules: strlcpy");
1984 	if (strlcpy(pf.anchor->name, anchorname,
1985 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1986 		errx(1, "pfctl_rules: strlcpy");
1987 
1988 
1989 	pf.astack[0] = pf.anchor;
1990 	pf.asd = 0;
1991 	if (anchorname[0])
1992 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1993 	pf.paltq = &pa;
1994 	pf.trans = t;
1995 	pfctl_init_options(&pf);
1996 
1997 	/* Set up ethernet anchor */
1998 	if ((pf.eanchor = calloc(1, sizeof(*pf.eanchor))) == NULL)
1999 		ERRX("pfctl_rules: calloc");
2000 
2001 	if (strlcpy(pf.eanchor->path, anchorname,
2002 	    sizeof(pf.eanchor->path)) >= sizeof(pf.eanchor->path))
2003 		errx(1, "pfctl_rules: strlcpy");
2004 	if (strlcpy(pf.eanchor->name, anchorname,
2005 	    sizeof(pf.eanchor->name)) >= sizeof(pf.eanchor->name))
2006 		errx(1, "pfctl_rules: strlcpy");
2007 
2008 	ethrs = &pf.eanchor->ruleset;
2009 	pf_init_eth_ruleset(ethrs);
2010 	ethrs->anchor = pf.eanchor;
2011 	pf.eastack[0] = pf.eanchor;
2012 
2013 	if ((opts & PF_OPT_NOACTION) == 0) {
2014 		/*
2015 		 * XXX For the time being we need to open transactions for
2016 		 * the main ruleset before parsing, because tables are still
2017 		 * loaded at parse time.
2018 		 */
2019 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor, true))
2020 			ERRX("pfctl_rules");
2021 		if (pf.loadopt & PFCTL_FLAG_ETH)
2022 			pf.eth_ticket = pfctl_get_ticket(t, PF_RULESET_ETH, anchorname);
2023 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
2024 			pa.ticket =
2025 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
2026 		if (pf.loadopt & PFCTL_FLAG_TABLE)
2027 			pf.astack[0]->ruleset.tticket =
2028 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
2029 	}
2030 
2031 	if (parse_config(filename, &pf) < 0) {
2032 		if ((opts & PF_OPT_NOACTION) == 0)
2033 			ERRX("Syntax error in config file: "
2034 			    "pf rules not loaded");
2035 		else
2036 			goto _error;
2037 	}
2038 	if (loadopt & PFCTL_FLAG_OPTION)
2039 		pfctl_adjust_skip_ifaces(&pf);
2040 
2041 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
2042 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
2043 	    (pf.loadopt & PFCTL_FLAG_ETH &&
2044 	    (pfctl_load_eth_ruleset(&pf, path, ethrs, 0))) ||
2045 	    (pf.loadopt & PFCTL_FLAG_NAT &&
2046 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
2047 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
2048 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
2049 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
2050 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
2051 		if ((opts & PF_OPT_NOACTION) == 0)
2052 			ERRX("Unable to load rules into kernel");
2053 		else
2054 			goto _error;
2055 	}
2056 
2057 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
2058 		if (check_commit_altq(dev, opts) != 0)
2059 			ERRX("errors in altq config");
2060 
2061 	/* process "load anchor" directives */
2062 	if (!anchorname[0])
2063 		if (pfctl_load_anchors(dev, &pf, t) == -1)
2064 			ERRX("load anchors");
2065 
2066 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
2067 		if (!anchorname[0])
2068 			if (pfctl_load_options(&pf))
2069 				goto _error;
2070 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
2071 			ERR("DIOCXCOMMIT");
2072 	}
2073 	free(path);
2074 	return (0);
2075 
2076 _error:
2077 	if (trans == NULL) {	/* main ruleset */
2078 		if ((opts & PF_OPT_NOACTION) == 0)
2079 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
2080 				err(1, "DIOCXROLLBACK");
2081 		exit(1);
2082 	} else {		/* sub ruleset */
2083 		free(path);
2084 		return (-1);
2085 	}
2086 
2087 #undef ERR
2088 #undef ERRX
2089 }
2090 
2091 FILE *
2092 pfctl_fopen(const char *name, const char *mode)
2093 {
2094 	struct stat	 st;
2095 	FILE		*fp;
2096 
2097 	fp = fopen(name, mode);
2098 	if (fp == NULL)
2099 		return (NULL);
2100 	if (fstat(fileno(fp), &st)) {
2101 		fclose(fp);
2102 		return (NULL);
2103 	}
2104 	if (S_ISDIR(st.st_mode)) {
2105 		fclose(fp);
2106 		errno = EISDIR;
2107 		return (NULL);
2108 	}
2109 	return (fp);
2110 }
2111 
2112 void
2113 pfctl_init_options(struct pfctl *pf)
2114 {
2115 
2116 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2117 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
2118 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2119 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2120 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
2121 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2122 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
2123 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
2124 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
2125 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
2126 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
2127 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
2128 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
2129 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
2130 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
2131 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
2132 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
2133 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
2134 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
2135 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
2136 
2137 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
2138 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
2139 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
2140 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
2141 
2142 	pf->debug = PF_DEBUG_URGENT;
2143 
2144 	pf->syncookies = false;
2145 	pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
2146 	pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
2147 }
2148 
2149 int
2150 pfctl_load_options(struct pfctl *pf)
2151 {
2152 	int i, error = 0;
2153 
2154 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2155 		return (0);
2156 
2157 	/* load limits */
2158 	for (i = 0; i < PF_LIMIT_MAX; i++) {
2159 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
2160 			continue;
2161 		if (pfctl_load_limit(pf, i, pf->limit[i]))
2162 			error = 1;
2163 	}
2164 
2165 	/*
2166 	 * If we've set the limit, but haven't explicitly set adaptive
2167 	 * timeouts, do it now with a start of 60% and end of 120%.
2168 	 */
2169 	if (pf->limit_set[PF_LIMIT_STATES] &&
2170 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
2171 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
2172 		pf->timeout[PFTM_ADAPTIVE_START] =
2173 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
2174 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
2175 		pf->timeout[PFTM_ADAPTIVE_END] =
2176 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
2177 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
2178 	}
2179 
2180 	/* load timeouts */
2181 	for (i = 0; i < PFTM_MAX; i++) {
2182 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
2183 			continue;
2184 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
2185 			error = 1;
2186 	}
2187 
2188 	/* load debug */
2189 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
2190 		if (pfctl_load_debug(pf, pf->debug))
2191 			error = 1;
2192 
2193 	/* load logif */
2194 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
2195 		if (pfctl_load_logif(pf, pf->ifname))
2196 			error = 1;
2197 
2198 	/* load hostid */
2199 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
2200 		if (pfctl_load_hostid(pf, pf->hostid))
2201 			error = 1;
2202 
2203 	/* load keepcounters */
2204 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
2205 		error = 1;
2206 
2207 	/* load syncookies settings */
2208 	if (pfctl_load_syncookies(pf, pf->syncookies))
2209 		error = 1;
2210 
2211 	return (error);
2212 }
2213 
2214 int
2215 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
2216 {
2217 	int i;
2218 
2219 
2220 	for (i = 0; pf_limits[i].name; i++) {
2221 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
2222 			pf->limit[pf_limits[i].index] = limit;
2223 			pf->limit_set[pf_limits[i].index] = 1;
2224 			break;
2225 		}
2226 	}
2227 	if (pf_limits[i].name == NULL) {
2228 		warnx("Bad pool name.");
2229 		return (1);
2230 	}
2231 
2232 	if (pf->opts & PF_OPT_VERBOSE)
2233 		printf("set limit %s %d\n", opt, limit);
2234 
2235 	return (0);
2236 }
2237 
2238 int
2239 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
2240 {
2241 	struct pfioc_limit pl;
2242 
2243 	memset(&pl, 0, sizeof(pl));
2244 	pl.index = index;
2245 	pl.limit = limit;
2246 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
2247 		if (errno == EBUSY)
2248 			warnx("Current pool size exceeds requested hard limit");
2249 		else
2250 			warnx("DIOCSETLIMIT");
2251 		return (1);
2252 	}
2253 	return (0);
2254 }
2255 
2256 int
2257 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
2258 {
2259 	int i;
2260 
2261 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2262 		return (0);
2263 
2264 	for (i = 0; pf_timeouts[i].name; i++) {
2265 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
2266 			pf->timeout[pf_timeouts[i].timeout] = seconds;
2267 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
2268 			break;
2269 		}
2270 	}
2271 
2272 	if (pf_timeouts[i].name == NULL) {
2273 		warnx("Bad timeout name.");
2274 		return (1);
2275 	}
2276 
2277 
2278 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
2279 		printf("set timeout %s %d\n", opt, seconds);
2280 
2281 	return (0);
2282 }
2283 
2284 int
2285 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
2286 {
2287 	struct pfioc_tm pt;
2288 
2289 	memset(&pt, 0, sizeof(pt));
2290 	pt.timeout = timeout;
2291 	pt.seconds = seconds;
2292 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
2293 		warnx("DIOCSETTIMEOUT");
2294 		return (1);
2295 	}
2296 	return (0);
2297 }
2298 
2299 int
2300 pfctl_set_optimization(struct pfctl *pf, const char *opt)
2301 {
2302 	const struct pf_hint *hint;
2303 	int i, r;
2304 
2305 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2306 		return (0);
2307 
2308 	for (i = 0; pf_hints[i].name; i++)
2309 		if (strcasecmp(opt, pf_hints[i].name) == 0)
2310 			break;
2311 
2312 	hint = pf_hints[i].hint;
2313 	if (hint == NULL) {
2314 		warnx("invalid state timeouts optimization");
2315 		return (1);
2316 	}
2317 
2318 	for (i = 0; hint[i].name; i++)
2319 		if ((r = pfctl_set_timeout(pf, hint[i].name,
2320 		    hint[i].timeout, 1)))
2321 			return (r);
2322 
2323 	if (pf->opts & PF_OPT_VERBOSE)
2324 		printf("set optimization %s\n", opt);
2325 
2326 	return (0);
2327 }
2328 
2329 int
2330 pfctl_set_logif(struct pfctl *pf, char *ifname)
2331 {
2332 
2333 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2334 		return (0);
2335 
2336 	if (!strcmp(ifname, "none")) {
2337 		free(pf->ifname);
2338 		pf->ifname = NULL;
2339 	} else {
2340 		pf->ifname = strdup(ifname);
2341 		if (!pf->ifname)
2342 			errx(1, "pfctl_set_logif: strdup");
2343 	}
2344 	pf->ifname_set = 1;
2345 
2346 	if (pf->opts & PF_OPT_VERBOSE)
2347 		printf("set loginterface %s\n", ifname);
2348 
2349 	return (0);
2350 }
2351 
2352 int
2353 pfctl_load_logif(struct pfctl *pf, char *ifname)
2354 {
2355 	struct pfioc_if pi;
2356 
2357 	memset(&pi, 0, sizeof(pi));
2358 	if (ifname && strlcpy(pi.ifname, ifname,
2359 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
2360 		warnx("pfctl_load_logif: strlcpy");
2361 		return (1);
2362 	}
2363 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
2364 		warnx("DIOCSETSTATUSIF");
2365 		return (1);
2366 	}
2367 	return (0);
2368 }
2369 
2370 int
2371 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2372 {
2373 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2374 		return (0);
2375 
2376 	HTONL(hostid);
2377 
2378 	pf->hostid = hostid;
2379 	pf->hostid_set = 1;
2380 
2381 	if (pf->opts & PF_OPT_VERBOSE)
2382 		printf("set hostid 0x%08x\n", ntohl(hostid));
2383 
2384 	return (0);
2385 }
2386 
2387 int
2388 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2389 {
2390 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2391 		warnx("DIOCSETHOSTID");
2392 		return (1);
2393 	}
2394 	return (0);
2395 }
2396 
2397 int
2398 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2399 {
2400 	struct pfctl_syncookies	cookies;
2401 
2402 	bzero(&cookies, sizeof(cookies));
2403 
2404 	cookies.mode = val;
2405 	cookies.lowwater = pf->syncookieswat[0];
2406 	cookies.highwater = pf->syncookieswat[1];
2407 
2408 	if (pfctl_set_syncookies(dev, &cookies)) {
2409 		warnx("DIOCSETSYNCOOKIES");
2410 		return (1);
2411 	}
2412 	return (0);
2413 }
2414 
2415 int
2416 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2417 {
2418 	if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2419 		warnx("syncookies start/end only apply to adaptive");
2420 		return (1);
2421 	}
2422 	if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2423 		if (!w->hi)
2424 			w->hi = PF_SYNCOOKIES_HIWATPCT;
2425 		if (!w->lo)
2426 			w->lo = w->hi / 2;
2427 		if (w->lo >= w->hi) {
2428 			warnx("start must be higher than end");
2429 			return (1);
2430 		}
2431 		pf->syncookieswat[0] = w->lo;
2432 		pf->syncookieswat[1] = w->hi;
2433 		pf->syncookieswat_set = 1;
2434 	}
2435 
2436 	if (pf->opts & PF_OPT_VERBOSE) {
2437 		if (val == PF_SYNCOOKIES_NEVER)
2438 			printf("set syncookies never\n");
2439 		else if (val == PF_SYNCOOKIES_ALWAYS)
2440 			printf("set syncookies always\n");
2441 		else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2442 			if (pf->syncookieswat_set)
2443 				printf("set syncookies adaptive (start %u%%, "
2444 				    "end %u%%)\n", pf->syncookieswat[1],
2445 				    pf->syncookieswat[0]);
2446 			else
2447 				printf("set syncookies adaptive\n");
2448 		} else {        /* cannot happen */
2449 			warnx("king bula ate all syncookies");
2450 			return (1);
2451 		}
2452 	}
2453 
2454 	pf->syncookies = val;
2455 	return (0);
2456 }
2457 
2458 int
2459 pfctl_set_debug(struct pfctl *pf, char *d)
2460 {
2461 	u_int32_t	level;
2462 
2463 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2464 		return (0);
2465 
2466 	if (!strcmp(d, "none"))
2467 		pf->debug = PF_DEBUG_NONE;
2468 	else if (!strcmp(d, "urgent"))
2469 		pf->debug = PF_DEBUG_URGENT;
2470 	else if (!strcmp(d, "misc"))
2471 		pf->debug = PF_DEBUG_MISC;
2472 	else if (!strcmp(d, "loud"))
2473 		pf->debug = PF_DEBUG_NOISY;
2474 	else {
2475 		warnx("unknown debug level \"%s\"", d);
2476 		return (-1);
2477 	}
2478 
2479 	pf->debug_set = 1;
2480 	level = pf->debug;
2481 
2482 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2483 		if (ioctl(dev, DIOCSETDEBUG, &level))
2484 			err(1, "DIOCSETDEBUG");
2485 
2486 	if (pf->opts & PF_OPT_VERBOSE)
2487 		printf("set debug %s\n", d);
2488 
2489 	return (0);
2490 }
2491 
2492 int
2493 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2494 {
2495 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
2496 		warnx("DIOCSETDEBUG");
2497 		return (1);
2498 	}
2499 	return (0);
2500 }
2501 
2502 int
2503 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2504 {
2505 	struct pfioc_iface	pi;
2506 	struct node_host	*h = NULL, *n = NULL;
2507 
2508 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2509 		return (0);
2510 
2511 	bzero(&pi, sizeof(pi));
2512 
2513 	pi.pfiio_flags = flags;
2514 
2515 	/* Make sure our cache matches the kernel. If we set or clear the flag
2516 	 * for a group this applies to all members. */
2517 	h = ifa_grouplookup(ifname, 0);
2518 	for (n = h; n != NULL; n = n->next)
2519 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2520 
2521 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2522 	    sizeof(pi.pfiio_name))
2523 		errx(1, "pfctl_set_interface_flags: strlcpy");
2524 
2525 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2526 		if (how == 0) {
2527 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2528 				err(1, "DIOCCLRIFFLAG");
2529 		} else {
2530 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2531 				err(1, "DIOCSETIFFLAG");
2532 			pfctl_check_skip_ifaces(ifname);
2533 		}
2534 	}
2535 	return (0);
2536 }
2537 
2538 void
2539 pfctl_debug(int dev, u_int32_t level, int opts)
2540 {
2541 	if (ioctl(dev, DIOCSETDEBUG, &level))
2542 		err(1, "DIOCSETDEBUG");
2543 	if ((opts & PF_OPT_QUIET) == 0) {
2544 		fprintf(stderr, "debug level set to '");
2545 		switch (level) {
2546 		case PF_DEBUG_NONE:
2547 			fprintf(stderr, "none");
2548 			break;
2549 		case PF_DEBUG_URGENT:
2550 			fprintf(stderr, "urgent");
2551 			break;
2552 		case PF_DEBUG_MISC:
2553 			fprintf(stderr, "misc");
2554 			break;
2555 		case PF_DEBUG_NOISY:
2556 			fprintf(stderr, "loud");
2557 			break;
2558 		default:
2559 			fprintf(stderr, "<invalid>");
2560 			break;
2561 		}
2562 		fprintf(stderr, "'\n");
2563 	}
2564 }
2565 
2566 int
2567 pfctl_test_altqsupport(int dev, int opts)
2568 {
2569 	struct pfioc_altq pa;
2570 
2571 	pa.version = PFIOC_ALTQ_VERSION;
2572 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2573 		if (errno == ENODEV) {
2574 			if (opts & PF_OPT_VERBOSE)
2575 				fprintf(stderr, "No ALTQ support in kernel\n"
2576 				    "ALTQ related functions disabled\n");
2577 			return (0);
2578 		} else
2579 			err(1, "DIOCGETALTQS");
2580 	}
2581 	return (1);
2582 }
2583 
2584 int
2585 pfctl_show_anchors(int dev, int opts, char *anchorname)
2586 {
2587 	struct pfioc_ruleset	 pr;
2588 	u_int32_t		 mnr, nr;
2589 
2590 	memset(&pr, 0, sizeof(pr));
2591 	memcpy(pr.path, anchorname, sizeof(pr.path));
2592 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2593 		if (errno == EINVAL)
2594 			fprintf(stderr, "Anchor '%s' not found.\n",
2595 			    anchorname);
2596 		else
2597 			err(1, "DIOCGETRULESETS");
2598 		return (-1);
2599 	}
2600 	mnr = pr.nr;
2601 	for (nr = 0; nr < mnr; ++nr) {
2602 		char sub[MAXPATHLEN];
2603 
2604 		pr.nr = nr;
2605 		if (ioctl(dev, DIOCGETRULESET, &pr))
2606 			err(1, "DIOCGETRULESET");
2607 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2608 			continue;
2609 		sub[0] = 0;
2610 		if (pr.path[0]) {
2611 			strlcat(sub, pr.path, sizeof(sub));
2612 			strlcat(sub, "/", sizeof(sub));
2613 		}
2614 		strlcat(sub, pr.name, sizeof(sub));
2615 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2616 			printf("  %s\n", sub);
2617 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2618 			return (-1);
2619 	}
2620 	return (0);
2621 }
2622 
2623 int
2624 pfctl_show_eth_anchors(int dev, int opts, char *anchorname)
2625 {
2626 	struct pfctl_eth_rulesets_info ri;
2627 	struct pfctl_eth_ruleset_info rs;
2628 	int ret;
2629 
2630 	if ((ret = pfctl_get_eth_rulesets_info(dev, &ri, anchorname)) != 0) {
2631 		if (ret == ENOENT)
2632 			fprintf(stderr, "Anchor '%s' not found.\n",
2633 			    anchorname);
2634 		else
2635 			err(1, "DIOCGETETHRULESETS");
2636 		return (-1);
2637 	}
2638 
2639 	for (int nr = 0; nr < ri.nr; nr++) {
2640 		char sub[MAXPATHLEN];
2641 
2642 		if (pfctl_get_eth_ruleset(dev, anchorname, nr, &rs) != 0)
2643 			err(1, "DIOCGETETHRULESET");
2644 
2645 		if (!strcmp(rs.name, PF_RESERVED_ANCHOR))
2646 			continue;
2647 		sub[0] = 0;
2648 		if (rs.path[0]) {
2649 			strlcat(sub, rs.path, sizeof(sub));
2650 			strlcat(sub, "/", sizeof(sub));
2651 		}
2652 		strlcat(sub, rs.name, sizeof(sub));
2653 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2654 			printf("  %s\n", sub);
2655 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_eth_anchors(dev, opts, sub))
2656 			return (-1);
2657 	}
2658 	return (0);
2659 }
2660 
2661 const char *
2662 pfctl_lookup_option(char *cmd, const char * const *list)
2663 {
2664 	if (cmd != NULL && *cmd)
2665 		for (; *list; list++)
2666 			if (!strncmp(cmd, *list, strlen(cmd)))
2667 				return (*list);
2668 	return (NULL);
2669 }
2670 
2671 int
2672 main(int argc, char *argv[])
2673 {
2674 	int	 error = 0;
2675 	int	 ch;
2676 	int	 mode = O_RDONLY;
2677 	int	 opts = 0;
2678 	int	 optimize = PF_OPTIMIZE_BASIC;
2679 	char	 anchorname[MAXPATHLEN];
2680 	char	*path;
2681 
2682 	if (argc < 2)
2683 		usage();
2684 
2685 	while ((ch = getopt(argc, argv,
2686 	    "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2687 		switch (ch) {
2688 		case 'a':
2689 			anchoropt = optarg;
2690 			break;
2691 		case 'd':
2692 			opts |= PF_OPT_DISABLE;
2693 			mode = O_RDWR;
2694 			break;
2695 		case 'D':
2696 			if (pfctl_cmdline_symset(optarg) < 0)
2697 				warnx("could not parse macro definition %s",
2698 				    optarg);
2699 			break;
2700 		case 'e':
2701 			opts |= PF_OPT_ENABLE;
2702 			mode = O_RDWR;
2703 			break;
2704 		case 'q':
2705 			opts |= PF_OPT_QUIET;
2706 			break;
2707 		case 'F':
2708 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2709 			if (clearopt == NULL) {
2710 				warnx("Unknown flush modifier '%s'", optarg);
2711 				usage();
2712 			}
2713 			mode = O_RDWR;
2714 			break;
2715 		case 'i':
2716 			ifaceopt = optarg;
2717 			break;
2718 		case 'k':
2719 			if (state_killers >= 2) {
2720 				warnx("can only specify -k twice");
2721 				usage();
2722 				/* NOTREACHED */
2723 			}
2724 			state_kill[state_killers++] = optarg;
2725 			mode = O_RDWR;
2726 			break;
2727 		case 'K':
2728 			if (src_node_killers >= 2) {
2729 				warnx("can only specify -K twice");
2730 				usage();
2731 				/* NOTREACHED */
2732 			}
2733 			src_node_kill[src_node_killers++] = optarg;
2734 			mode = O_RDWR;
2735 			break;
2736 		case 'm':
2737 			opts |= PF_OPT_MERGE;
2738 			break;
2739 		case 'M':
2740 			opts |= PF_OPT_KILLMATCH;
2741 			break;
2742 		case 'n':
2743 			opts |= PF_OPT_NOACTION;
2744 			break;
2745 		case 'N':
2746 			loadopt |= PFCTL_FLAG_NAT;
2747 			break;
2748 		case 'r':
2749 			opts |= PF_OPT_USEDNS;
2750 			break;
2751 		case 'f':
2752 			rulesopt = optarg;
2753 			mode = O_RDWR;
2754 			break;
2755 		case 'g':
2756 			opts |= PF_OPT_DEBUG;
2757 			break;
2758 		case 'A':
2759 			loadopt |= PFCTL_FLAG_ALTQ;
2760 			break;
2761 		case 'R':
2762 			loadopt |= PFCTL_FLAG_FILTER;
2763 			break;
2764 		case 'o':
2765 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2766 			if (optiopt == NULL) {
2767 				warnx("Unknown optimization '%s'", optarg);
2768 				usage();
2769 			}
2770 			opts |= PF_OPT_OPTIMIZE;
2771 			break;
2772 		case 'O':
2773 			loadopt |= PFCTL_FLAG_OPTION;
2774 			break;
2775 		case 'p':
2776 			pf_device = optarg;
2777 			break;
2778 		case 'P':
2779 			opts |= PF_OPT_NUMERIC;
2780 			break;
2781 		case 's':
2782 			showopt = pfctl_lookup_option(optarg, showopt_list);
2783 			if (showopt == NULL) {
2784 				warnx("Unknown show modifier '%s'", optarg);
2785 				usage();
2786 			}
2787 			break;
2788 		case 't':
2789 			tableopt = optarg;
2790 			break;
2791 		case 'T':
2792 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2793 			if (tblcmdopt == NULL) {
2794 				warnx("Unknown table command '%s'", optarg);
2795 				usage();
2796 			}
2797 			break;
2798 		case 'v':
2799 			if (opts & PF_OPT_VERBOSE)
2800 				opts |= PF_OPT_VERBOSE2;
2801 			opts |= PF_OPT_VERBOSE;
2802 			break;
2803 		case 'x':
2804 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2805 			if (debugopt == NULL) {
2806 				warnx("Unknown debug level '%s'", optarg);
2807 				usage();
2808 			}
2809 			mode = O_RDWR;
2810 			break;
2811 		case 'z':
2812 			opts |= PF_OPT_CLRRULECTRS;
2813 			mode = O_RDWR;
2814 			break;
2815 		case 'h':
2816 			/* FALLTHROUGH */
2817 		default:
2818 			usage();
2819 			/* NOTREACHED */
2820 		}
2821 	}
2822 
2823 	if (tblcmdopt != NULL) {
2824 		argc -= optind;
2825 		argv += optind;
2826 		ch = *tblcmdopt;
2827 		if (ch == 'l') {
2828 			loadopt |= PFCTL_FLAG_TABLE;
2829 			tblcmdopt = NULL;
2830 		} else
2831 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2832 	} else if (argc != optind) {
2833 		warnx("unknown command line argument: %s ...", argv[optind]);
2834 		usage();
2835 		/* NOTREACHED */
2836 	}
2837 	if (loadopt == 0)
2838 		loadopt = ~0;
2839 
2840 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2841 		errx(1, "pfctl: calloc");
2842 	memset(anchorname, 0, sizeof(anchorname));
2843 	if (anchoropt != NULL) {
2844 		int len = strlen(anchoropt);
2845 
2846 		if (anchoropt[len - 1] == '*') {
2847 			if (len >= 2 && anchoropt[len - 2] == '/')
2848 				anchoropt[len - 2] = '\0';
2849 			else
2850 				anchoropt[len - 1] = '\0';
2851 			opts |= PF_OPT_RECURSE;
2852 		}
2853 		if (strlcpy(anchorname, anchoropt,
2854 		    sizeof(anchorname)) >= sizeof(anchorname))
2855 			errx(1, "anchor name '%s' too long",
2856 			    anchoropt);
2857 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE|PFCTL_FLAG_ETH;
2858 	}
2859 
2860 	if ((opts & PF_OPT_NOACTION) == 0) {
2861 		dev = open(pf_device, mode);
2862 		if (dev == -1)
2863 			err(1, "%s", pf_device);
2864 		altqsupport = pfctl_test_altqsupport(dev, opts);
2865 	} else {
2866 		dev = open(pf_device, O_RDONLY);
2867 		if (dev >= 0)
2868 			opts |= PF_OPT_DUMMYACTION;
2869 		/* turn off options */
2870 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2871 		clearopt = showopt = debugopt = NULL;
2872 #if !defined(ENABLE_ALTQ)
2873 		altqsupport = 0;
2874 #else
2875 		altqsupport = 1;
2876 #endif
2877 	}
2878 
2879 	if (opts & PF_OPT_DISABLE)
2880 		if (pfctl_disable(dev, opts))
2881 			error = 1;
2882 
2883 	if (showopt != NULL) {
2884 		switch (*showopt) {
2885 		case 'A':
2886 			pfctl_show_anchors(dev, opts, anchorname);
2887 			pfctl_show_eth_anchors(dev, opts, anchorname);
2888 			break;
2889 		case 'r':
2890 			pfctl_load_fingerprints(dev, opts);
2891 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2892 			    anchorname, 0);
2893 			break;
2894 		case 'l':
2895 			pfctl_load_fingerprints(dev, opts);
2896 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2897 			    anchorname, 0);
2898 			break;
2899 		case 'n':
2900 			pfctl_load_fingerprints(dev, opts);
2901 			pfctl_show_nat(dev, path, opts, anchorname, 0);
2902 			break;
2903 		case 'q':
2904 			pfctl_show_altq(dev, ifaceopt, opts,
2905 			    opts & PF_OPT_VERBOSE2);
2906 			break;
2907 		case 's':
2908 			pfctl_show_states(dev, ifaceopt, opts);
2909 			break;
2910 		case 'S':
2911 			pfctl_show_src_nodes(dev, opts);
2912 			break;
2913 		case 'i':
2914 			pfctl_show_status(dev, opts);
2915 			break;
2916 		case 'R':
2917 			error = pfctl_show_running(dev);
2918 			break;
2919 		case 't':
2920 			pfctl_show_timeouts(dev, opts);
2921 			break;
2922 		case 'm':
2923 			pfctl_show_limits(dev, opts);
2924 			break;
2925 		case 'e':
2926 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0);
2927 			break;
2928 		case 'a':
2929 			opts |= PF_OPT_SHOWALL;
2930 			pfctl_load_fingerprints(dev, opts);
2931 
2932 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0);
2933 
2934 			pfctl_show_nat(dev, path, opts, anchorname, 0);
2935 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2936 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2937 			pfctl_show_states(dev, ifaceopt, opts);
2938 			pfctl_show_src_nodes(dev, opts);
2939 			pfctl_show_status(dev, opts);
2940 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2941 			pfctl_show_timeouts(dev, opts);
2942 			pfctl_show_limits(dev, opts);
2943 			pfctl_show_tables(anchorname, opts);
2944 			pfctl_show_fingerprints(opts);
2945 			break;
2946 		case 'T':
2947 			pfctl_show_tables(anchorname, opts);
2948 			break;
2949 		case 'o':
2950 			pfctl_load_fingerprints(dev, opts);
2951 			pfctl_show_fingerprints(opts);
2952 			break;
2953 		case 'I':
2954 			pfctl_show_ifaces(ifaceopt, opts);
2955 			break;
2956 		}
2957 	}
2958 
2959 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL) {
2960 		pfctl_show_eth_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2961 		    anchorname, 0);
2962 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2963 		    anchorname, 0);
2964 	}
2965 
2966 	if (clearopt != NULL) {
2967 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2968 			errx(1, "anchor names beginning with '_' cannot "
2969 			    "be modified from the command line");
2970 
2971 		switch (*clearopt) {
2972 		case 'e':
2973 			pfctl_flush_eth_rules(dev, opts, anchorname);
2974 			break;
2975 		case 'r':
2976 			pfctl_flush_rules(dev, opts, anchorname);
2977 			break;
2978 		case 'n':
2979 			pfctl_flush_nat(dev, opts, anchorname);
2980 			break;
2981 		case 'q':
2982 			pfctl_clear_altq(dev, opts);
2983 			break;
2984 		case 's':
2985 			pfctl_clear_iface_states(dev, ifaceopt, opts);
2986 			break;
2987 		case 'S':
2988 			pfctl_clear_src_nodes(dev, opts);
2989 			break;
2990 		case 'i':
2991 			pfctl_clear_stats(dev, opts);
2992 			break;
2993 		case 'a':
2994 			pfctl_flush_eth_rules(dev, opts, anchorname);
2995 			pfctl_flush_rules(dev, opts, anchorname);
2996 			pfctl_flush_nat(dev, opts, anchorname);
2997 			pfctl_clear_tables(anchorname, opts);
2998 			if (!*anchorname) {
2999 				pfctl_clear_altq(dev, opts);
3000 				pfctl_clear_iface_states(dev, ifaceopt, opts);
3001 				pfctl_clear_src_nodes(dev, opts);
3002 				pfctl_clear_stats(dev, opts);
3003 				pfctl_clear_fingerprints(dev, opts);
3004 				pfctl_clear_interface_flags(dev, opts);
3005 			}
3006 			break;
3007 		case 'o':
3008 			pfctl_clear_fingerprints(dev, opts);
3009 			break;
3010 		case 'T':
3011 			pfctl_clear_tables(anchorname, opts);
3012 			break;
3013 		}
3014 	}
3015 	if (state_killers) {
3016 		if (!strcmp(state_kill[0], "label"))
3017 			pfctl_label_kill_states(dev, ifaceopt, opts);
3018 		else if (!strcmp(state_kill[0], "id"))
3019 			pfctl_id_kill_states(dev, ifaceopt, opts);
3020 		else if (!strcmp(state_kill[0], "gateway"))
3021 			pfctl_gateway_kill_states(dev, ifaceopt, opts);
3022 		else
3023 			pfctl_net_kill_states(dev, ifaceopt, opts);
3024 	}
3025 
3026 	if (src_node_killers)
3027 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
3028 
3029 	if (tblcmdopt != NULL) {
3030 		error = pfctl_command_tables(argc, argv, tableopt,
3031 		    tblcmdopt, rulesopt, anchorname, opts);
3032 		rulesopt = NULL;
3033 	}
3034 	if (optiopt != NULL) {
3035 		switch (*optiopt) {
3036 		case 'n':
3037 			optimize = 0;
3038 			break;
3039 		case 'b':
3040 			optimize |= PF_OPTIMIZE_BASIC;
3041 			break;
3042 		case 'o':
3043 		case 'p':
3044 			optimize |= PF_OPTIMIZE_PROFILE;
3045 			break;
3046 		}
3047 	}
3048 
3049 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
3050 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
3051 		if (pfctl_get_skip_ifaces())
3052 			error = 1;
3053 
3054 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
3055 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
3056 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
3057 			error = 1;
3058 
3059 	if (rulesopt != NULL) {
3060 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
3061 			errx(1, "anchor names beginning with '_' cannot "
3062 			    "be modified from the command line");
3063 		if (pfctl_rules(dev, rulesopt, opts, optimize,
3064 		    anchorname, NULL))
3065 			error = 1;
3066 		else if (!(opts & PF_OPT_NOACTION) &&
3067 		    (loadopt & PFCTL_FLAG_TABLE))
3068 			warn_namespace_collision(NULL);
3069 	}
3070 
3071 	if (opts & PF_OPT_ENABLE)
3072 		if (pfctl_enable(dev, opts))
3073 			error = 1;
3074 
3075 	if (debugopt != NULL) {
3076 		switch (*debugopt) {
3077 		case 'n':
3078 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
3079 			break;
3080 		case 'u':
3081 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
3082 			break;
3083 		case 'm':
3084 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
3085 			break;
3086 		case 'l':
3087 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
3088 			break;
3089 		}
3090 	}
3091 
3092 	exit(error);
3093 }
3094