xref: /freebsd/sbin/pfctl/pfctl.c (revision 43a5ec4eb41567cc92586503212743d89686d78f)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #define PFIOC_USE_LATEST
40 
41 #include <sys/types.h>
42 #include <sys/ioctl.h>
43 #include <sys/nv.h>
44 #include <sys/socket.h>
45 #include <sys/stat.h>
46 #include <sys/endian.h>
47 
48 #include <net/if.h>
49 #include <netinet/in.h>
50 #include <net/pfvar.h>
51 #include <arpa/inet.h>
52 #include <net/altq/altq.h>
53 #include <sys/sysctl.h>
54 
55 #include <err.h>
56 #include <errno.h>
57 #include <fcntl.h>
58 #include <libpfctl.h>
59 #include <limits.h>
60 #include <netdb.h>
61 #include <stdint.h>
62 #include <stdio.h>
63 #include <stdlib.h>
64 #include <string.h>
65 #include <unistd.h>
66 
67 #include "pfctl_parser.h"
68 #include "pfctl.h"
69 
70 void	 usage(void);
71 int	 pfctl_enable(int, int);
72 int	 pfctl_disable(int, int);
73 int	 pfctl_clear_stats(int, int);
74 int	 pfctl_get_skip_ifaces(void);
75 int	 pfctl_check_skip_ifaces(char *);
76 int	 pfctl_adjust_skip_ifaces(struct pfctl *);
77 int	 pfctl_clear_interface_flags(int, int);
78 int	 pfctl_clear_rules(int, int, char *);
79 int	 pfctl_clear_nat(int, int, char *);
80 int	 pfctl_clear_altq(int, int);
81 int	 pfctl_clear_src_nodes(int, int);
82 int	 pfctl_clear_iface_states(int, const char *, int);
83 void	 pfctl_addrprefix(char *, struct pf_addr *);
84 int	 pfctl_kill_src_nodes(int, const char *, int);
85 int	 pfctl_net_kill_states(int, const char *, int);
86 int	 pfctl_gateway_kill_states(int, const char *, int);
87 int	 pfctl_label_kill_states(int, const char *, int);
88 int	 pfctl_id_kill_states(int, const char *, int);
89 void	 pfctl_init_options(struct pfctl *);
90 int	 pfctl_load_options(struct pfctl *);
91 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
92 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
93 int	 pfctl_load_debug(struct pfctl *, unsigned int);
94 int	 pfctl_load_logif(struct pfctl *, char *);
95 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
96 int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
97 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
98 	    char *);
99 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
100 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
101 int	 pfctl_show_nat(int, int, char *);
102 int	 pfctl_show_src_nodes(int, int);
103 int	 pfctl_show_states(int, const char *, int);
104 int	 pfctl_show_status(int, int);
105 int	 pfctl_show_running(int);
106 int	 pfctl_show_timeouts(int, int);
107 int	 pfctl_show_limits(int, int);
108 void	 pfctl_debug(int, u_int32_t, int);
109 int	 pfctl_test_altqsupport(int, int);
110 int	 pfctl_show_anchors(int, int, char *);
111 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *);
112 int	 pfctl_load_ruleset(struct pfctl *, char *,
113 		struct pfctl_ruleset *, int, int);
114 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
115 const char	*pfctl_lookup_option(char *, const char * const *);
116 
117 static struct pfctl_anchor_global	 pf_anchors;
118 static struct pfctl_anchor	 pf_main_anchor;
119 static struct pfr_buffer skip_b;
120 
121 static const char	*clearopt;
122 static char		*rulesopt;
123 static const char	*showopt;
124 static const char	*debugopt;
125 static char		*anchoropt;
126 static const char	*optiopt = NULL;
127 static const char	*pf_device = "/dev/pf";
128 static char		*ifaceopt;
129 static char		*tableopt;
130 static const char	*tblcmdopt;
131 static int		 src_node_killers;
132 static char		*src_node_kill[2];
133 static int		 state_killers;
134 static char		*state_kill[2];
135 int			 loadopt;
136 int			 altqsupport;
137 
138 int			 dev = -1;
139 static int		 first_title = 1;
140 static int		 labels = 0;
141 
142 #define INDENT(d, o)	do {						\
143 				if (o) {				\
144 					int i;				\
145 					for (i=0; i < d; i++)		\
146 						printf("  ");		\
147 				}					\
148 			} while (0);					\
149 
150 
151 static const struct {
152 	const char	*name;
153 	int		index;
154 } pf_limits[] = {
155 	{ "states",		PF_LIMIT_STATES },
156 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
157 	{ "frags",		PF_LIMIT_FRAGS },
158 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
159 	{ NULL,			0 }
160 };
161 
162 struct pf_hint {
163 	const char	*name;
164 	int		timeout;
165 };
166 static const struct pf_hint pf_hint_normal[] = {
167 	{ "tcp.first",		2 * 60 },
168 	{ "tcp.opening",	30 },
169 	{ "tcp.established",	24 * 60 * 60 },
170 	{ "tcp.closing",	15 * 60 },
171 	{ "tcp.finwait",	45 },
172 	{ "tcp.closed",		90 },
173 	{ "tcp.tsdiff",		30 },
174 	{ NULL,			0 }
175 };
176 static const struct pf_hint pf_hint_satellite[] = {
177 	{ "tcp.first",		3 * 60 },
178 	{ "tcp.opening",	30 + 5 },
179 	{ "tcp.established",	24 * 60 * 60 },
180 	{ "tcp.closing",	15 * 60 + 5 },
181 	{ "tcp.finwait",	45 + 5 },
182 	{ "tcp.closed",		90 + 5 },
183 	{ "tcp.tsdiff",		60 },
184 	{ NULL,			0 }
185 };
186 static const struct pf_hint pf_hint_conservative[] = {
187 	{ "tcp.first",		60 * 60 },
188 	{ "tcp.opening",	15 * 60 },
189 	{ "tcp.established",	5 * 24 * 60 * 60 },
190 	{ "tcp.closing",	60 * 60 },
191 	{ "tcp.finwait",	10 * 60 },
192 	{ "tcp.closed",		3 * 60 },
193 	{ "tcp.tsdiff",		60 },
194 	{ NULL,			0 }
195 };
196 static const struct pf_hint pf_hint_aggressive[] = {
197 	{ "tcp.first",		30 },
198 	{ "tcp.opening",	5 },
199 	{ "tcp.established",	5 * 60 * 60 },
200 	{ "tcp.closing",	60 },
201 	{ "tcp.finwait",	30 },
202 	{ "tcp.closed",		30 },
203 	{ "tcp.tsdiff",		10 },
204 	{ NULL,			0 }
205 };
206 
207 static const struct {
208 	const char *name;
209 	const struct pf_hint *hint;
210 } pf_hints[] = {
211 	{ "normal",		pf_hint_normal },
212 	{ "satellite",		pf_hint_satellite },
213 	{ "high-latency",	pf_hint_satellite },
214 	{ "conservative",	pf_hint_conservative },
215 	{ "aggressive",		pf_hint_aggressive },
216 	{ NULL,			NULL }
217 };
218 
219 static const char * const clearopt_list[] = {
220 	"nat", "queue", "rules", "Sources",
221 	"states", "info", "Tables", "osfp", "all", NULL
222 };
223 
224 static const char * const showopt_list[] = {
225 	"nat", "queue", "rules", "Anchors", "Sources", "states", "info",
226 	"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
227 	"Running", "all", NULL
228 };
229 
230 static const char * const tblcmdopt_list[] = {
231 	"kill", "flush", "add", "delete", "load", "replace", "show",
232 	"test", "zero", "expire", NULL
233 };
234 
235 static const char * const debugopt_list[] = {
236 	"none", "urgent", "misc", "loud", NULL
237 };
238 
239 static const char * const optiopt_list[] = {
240 	"none", "basic", "profile", NULL
241 };
242 
243 void
244 usage(void)
245 {
246 	extern char *__progname;
247 
248 	fprintf(stderr,
249 "usage: %s [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
250 	"\t[-f file] [-i interface] [-K host | network]\n"
251 	"\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
252 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
253 	    __progname);
254 
255 	exit(1);
256 }
257 
258 /*
259  * Cache protocol number to name translations.
260  *
261  * Translation is performed a lot e.g., when dumping states and
262  * getprotobynumber is incredibly expensive.
263  *
264  * Note from the getprotobynumber(3) manpage:
265  * <quote>
266  * These functions use a thread-specific data space; if the data is needed
267  * for future use, it should be copied before any subsequent calls overwrite
268  * it.  Only the Internet protocols are currently understood.
269  * </quote>
270  *
271  * Consequently we only cache the name and strdup it for safety.
272  *
273  * At the time of writing this comment the last entry in /etc/protocols is:
274  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
275  */
276 const char *
277 pfctl_proto2name(int proto)
278 {
279 	static const char *pfctl_proto_cache[259];
280 	struct protoent *p;
281 
282 	if (proto >= nitems(pfctl_proto_cache)) {
283 		p = getprotobynumber(proto);
284 		if (p == NULL) {
285 			return (NULL);
286 		}
287 		return (p->p_name);
288 	}
289 
290 	if (pfctl_proto_cache[proto] == NULL) {
291 		p = getprotobynumber(proto);
292 		if (p == NULL) {
293 			return (NULL);
294 		}
295 		pfctl_proto_cache[proto] = strdup(p->p_name);
296 	}
297 
298 	return (pfctl_proto_cache[proto]);
299 }
300 
301 int
302 pfctl_enable(int dev, int opts)
303 {
304 	if (ioctl(dev, DIOCSTART)) {
305 		if (errno == EEXIST)
306 			errx(1, "pf already enabled");
307 		else if (errno == ESRCH)
308 			errx(1, "pfil registeration failed");
309 		else
310 			err(1, "DIOCSTART");
311 	}
312 	if ((opts & PF_OPT_QUIET) == 0)
313 		fprintf(stderr, "pf enabled\n");
314 
315 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
316 		if (errno != EEXIST)
317 			err(1, "DIOCSTARTALTQ");
318 
319 	return (0);
320 }
321 
322 int
323 pfctl_disable(int dev, int opts)
324 {
325 	if (ioctl(dev, DIOCSTOP)) {
326 		if (errno == ENOENT)
327 			errx(1, "pf not enabled");
328 		else
329 			err(1, "DIOCSTOP");
330 	}
331 	if ((opts & PF_OPT_QUIET) == 0)
332 		fprintf(stderr, "pf disabled\n");
333 
334 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
335 			if (errno != ENOENT)
336 				err(1, "DIOCSTOPALTQ");
337 
338 	return (0);
339 }
340 
341 int
342 pfctl_clear_stats(int dev, int opts)
343 {
344 	if (ioctl(dev, DIOCCLRSTATUS))
345 		err(1, "DIOCCLRSTATUS");
346 	if ((opts & PF_OPT_QUIET) == 0)
347 		fprintf(stderr, "pf: statistics cleared\n");
348 	return (0);
349 }
350 
351 int
352 pfctl_get_skip_ifaces(void)
353 {
354 	bzero(&skip_b, sizeof(skip_b));
355 	skip_b.pfrb_type = PFRB_IFACES;
356 	for (;;) {
357 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
358 		skip_b.pfrb_size = skip_b.pfrb_msize;
359 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
360 			err(1, "pfi_get_ifaces");
361 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
362 			break;
363 	}
364 	return (0);
365 }
366 
367 int
368 pfctl_check_skip_ifaces(char *ifname)
369 {
370 	struct pfi_kif		*p;
371 	struct node_host	*h = NULL, *n = NULL;
372 
373 	PFRB_FOREACH(p, &skip_b) {
374 		if (!strcmp(ifname, p->pfik_name) &&
375 		    (p->pfik_flags & PFI_IFLAG_SKIP))
376 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
377 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
378 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
379 				continue;
380 
381 			for (n = h; n != NULL; n = n->next) {
382 				if (p->pfik_ifp == NULL)
383 					continue;
384 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
385 					continue;
386 
387 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
388 			}
389 		}
390 	}
391 	return (0);
392 }
393 
394 int
395 pfctl_adjust_skip_ifaces(struct pfctl *pf)
396 {
397 	struct pfi_kif		*p, *pp;
398 	struct node_host	*h = NULL, *n = NULL;
399 
400 	PFRB_FOREACH(p, &skip_b) {
401 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
402 			continue;
403 
404 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
405 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
406 			continue;
407 
408 		for (n = h; n != NULL; n = n->next)
409 			PFRB_FOREACH(pp, &skip_b) {
410 				if (pp->pfik_ifp == NULL)
411 					continue;
412 
413 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
414 					continue;
415 
416 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
417 					pfctl_set_interface_flags(pf,
418 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
419 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
420 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
421 			}
422 	}
423 
424 	PFRB_FOREACH(p, &skip_b) {
425 		if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
426 			continue;
427 
428 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
429 	}
430 
431 	return (0);
432 }
433 
434 int
435 pfctl_clear_interface_flags(int dev, int opts)
436 {
437 	struct pfioc_iface	pi;
438 
439 	if ((opts & PF_OPT_NOACTION) == 0) {
440 		bzero(&pi, sizeof(pi));
441 		pi.pfiio_flags = PFI_IFLAG_SKIP;
442 
443 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
444 			err(1, "DIOCCLRIFFLAG");
445 		if ((opts & PF_OPT_QUIET) == 0)
446 			fprintf(stderr, "pf: interface flags reset\n");
447 	}
448 	return (0);
449 }
450 
451 int
452 pfctl_clear_rules(int dev, int opts, char *anchorname)
453 {
454 	struct pfr_buffer t;
455 
456 	memset(&t, 0, sizeof(t));
457 	t.pfrb_type = PFRB_TRANS;
458 	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
459 	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
460 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
461 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
462 		err(1, "pfctl_clear_rules");
463 	if ((opts & PF_OPT_QUIET) == 0)
464 		fprintf(stderr, "rules cleared\n");
465 	return (0);
466 }
467 
468 int
469 pfctl_clear_nat(int dev, int opts, char *anchorname)
470 {
471 	struct pfr_buffer t;
472 
473 	memset(&t, 0, sizeof(t));
474 	t.pfrb_type = PFRB_TRANS;
475 	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
476 	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
477 	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
478 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
479 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
480 		err(1, "pfctl_clear_nat");
481 	if ((opts & PF_OPT_QUIET) == 0)
482 		fprintf(stderr, "nat cleared\n");
483 	return (0);
484 }
485 
486 int
487 pfctl_clear_altq(int dev, int opts)
488 {
489 	struct pfr_buffer t;
490 
491 	if (!altqsupport)
492 		return (-1);
493 	memset(&t, 0, sizeof(t));
494 	t.pfrb_type = PFRB_TRANS;
495 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
496 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
497 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
498 		err(1, "pfctl_clear_altq");
499 	if ((opts & PF_OPT_QUIET) == 0)
500 		fprintf(stderr, "altq cleared\n");
501 	return (0);
502 }
503 
504 int
505 pfctl_clear_src_nodes(int dev, int opts)
506 {
507 	if (ioctl(dev, DIOCCLRSRCNODES))
508 		err(1, "DIOCCLRSRCNODES");
509 	if ((opts & PF_OPT_QUIET) == 0)
510 		fprintf(stderr, "source tracking entries cleared\n");
511 	return (0);
512 }
513 
514 int
515 pfctl_clear_iface_states(int dev, const char *iface, int opts)
516 {
517 	struct pfctl_kill kill;
518 	unsigned int killed;
519 
520 	memset(&kill, 0, sizeof(kill));
521 	if (iface != NULL && strlcpy(kill.ifname, iface,
522 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
523 		errx(1, "invalid interface: %s", iface);
524 
525 	if (opts & PF_OPT_KILLMATCH)
526 		kill.kill_match = true;
527 
528 	if (pfctl_clear_states(dev, &kill, &killed))
529 		err(1, "DIOCCLRSTATES");
530 	if ((opts & PF_OPT_QUIET) == 0)
531 		fprintf(stderr, "%d states cleared\n", killed);
532 	return (0);
533 }
534 
535 void
536 pfctl_addrprefix(char *addr, struct pf_addr *mask)
537 {
538 	char *p;
539 	const char *errstr;
540 	int prefix, ret_ga, q, r;
541 	struct addrinfo hints, *res;
542 
543 	if ((p = strchr(addr, '/')) == NULL)
544 		return;
545 
546 	*p++ = '\0';
547 	prefix = strtonum(p, 0, 128, &errstr);
548 	if (errstr)
549 		errx(1, "prefix is %s: %s", errstr, p);
550 
551 	bzero(&hints, sizeof(hints));
552 	/* prefix only with numeric addresses */
553 	hints.ai_flags |= AI_NUMERICHOST;
554 
555 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
556 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
557 		/* NOTREACHED */
558 	}
559 
560 	if (res->ai_family == AF_INET && prefix > 32)
561 		errx(1, "prefix too long for AF_INET");
562 	else if (res->ai_family == AF_INET6 && prefix > 128)
563 		errx(1, "prefix too long for AF_INET6");
564 
565 	q = prefix >> 3;
566 	r = prefix & 7;
567 	switch (res->ai_family) {
568 	case AF_INET:
569 		bzero(&mask->v4, sizeof(mask->v4));
570 		mask->v4.s_addr = htonl((u_int32_t)
571 		    (0xffffffffffULL << (32 - prefix)));
572 		break;
573 	case AF_INET6:
574 		bzero(&mask->v6, sizeof(mask->v6));
575 		if (q > 0)
576 			memset((void *)&mask->v6, 0xff, q);
577 		if (r > 0)
578 			*((u_char *)&mask->v6 + q) =
579 			    (0xff00 >> r) & 0xff;
580 		break;
581 	}
582 	freeaddrinfo(res);
583 }
584 
585 int
586 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
587 {
588 	struct pfioc_src_node_kill psnk;
589 	struct addrinfo *res[2], *resp[2];
590 	struct sockaddr last_src, last_dst;
591 	int killed, sources, dests;
592 	int ret_ga;
593 
594 	killed = sources = dests = 0;
595 
596 	memset(&psnk, 0, sizeof(psnk));
597 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
598 	    sizeof(psnk.psnk_src.addr.v.a.mask));
599 	memset(&last_src, 0xff, sizeof(last_src));
600 	memset(&last_dst, 0xff, sizeof(last_dst));
601 
602 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
603 
604 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
605 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
606 		/* NOTREACHED */
607 	}
608 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
609 		if (resp[0]->ai_addr == NULL)
610 			continue;
611 		/* We get lots of duplicates.  Catch the easy ones */
612 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
613 			continue;
614 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
615 
616 		psnk.psnk_af = resp[0]->ai_family;
617 		sources++;
618 
619 		if (psnk.psnk_af == AF_INET)
620 			psnk.psnk_src.addr.v.a.addr.v4 =
621 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
622 		else if (psnk.psnk_af == AF_INET6)
623 			psnk.psnk_src.addr.v.a.addr.v6 =
624 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
625 			    sin6_addr;
626 		else
627 			errx(1, "Unknown address family %d", psnk.psnk_af);
628 
629 		if (src_node_killers > 1) {
630 			dests = 0;
631 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
632 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
633 			memset(&last_dst, 0xff, sizeof(last_dst));
634 			pfctl_addrprefix(src_node_kill[1],
635 			    &psnk.psnk_dst.addr.v.a.mask);
636 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
637 			    &res[1]))) {
638 				errx(1, "getaddrinfo: %s",
639 				    gai_strerror(ret_ga));
640 				/* NOTREACHED */
641 			}
642 			for (resp[1] = res[1]; resp[1];
643 			    resp[1] = resp[1]->ai_next) {
644 				if (resp[1]->ai_addr == NULL)
645 					continue;
646 				if (psnk.psnk_af != resp[1]->ai_family)
647 					continue;
648 
649 				if (memcmp(&last_dst, resp[1]->ai_addr,
650 				    sizeof(last_dst)) == 0)
651 					continue;
652 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
653 
654 				dests++;
655 
656 				if (psnk.psnk_af == AF_INET)
657 					psnk.psnk_dst.addr.v.a.addr.v4 =
658 					    ((struct sockaddr_in *)resp[1]->
659 					    ai_addr)->sin_addr;
660 				else if (psnk.psnk_af == AF_INET6)
661 					psnk.psnk_dst.addr.v.a.addr.v6 =
662 					    ((struct sockaddr_in6 *)resp[1]->
663 					    ai_addr)->sin6_addr;
664 				else
665 					errx(1, "Unknown address family %d",
666 					    psnk.psnk_af);
667 
668 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
669 					err(1, "DIOCKILLSRCNODES");
670 				killed += psnk.psnk_killed;
671 			}
672 			freeaddrinfo(res[1]);
673 		} else {
674 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
675 				err(1, "DIOCKILLSRCNODES");
676 			killed += psnk.psnk_killed;
677 		}
678 	}
679 
680 	freeaddrinfo(res[0]);
681 
682 	if ((opts & PF_OPT_QUIET) == 0)
683 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
684 		    "destinations\n", killed, sources, dests);
685 	return (0);
686 }
687 
688 int
689 pfctl_net_kill_states(int dev, const char *iface, int opts)
690 {
691 	struct pfctl_kill kill;
692 	struct addrinfo *res[2], *resp[2];
693 	struct sockaddr last_src, last_dst;
694 	unsigned int newkilled;
695 	int killed, sources, dests;
696 	int ret_ga;
697 
698 	killed = sources = dests = 0;
699 
700 	memset(&kill, 0, sizeof(kill));
701 	memset(&kill.src.addr.v.a.mask, 0xff,
702 	    sizeof(kill.src.addr.v.a.mask));
703 	memset(&last_src, 0xff, sizeof(last_src));
704 	memset(&last_dst, 0xff, sizeof(last_dst));
705 	if (iface != NULL && strlcpy(kill.ifname, iface,
706 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
707 		errx(1, "invalid interface: %s", iface);
708 
709 	pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask);
710 
711 	if (opts & PF_OPT_KILLMATCH)
712 		kill.kill_match = true;
713 
714 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
715 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
716 		/* NOTREACHED */
717 	}
718 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
719 		if (resp[0]->ai_addr == NULL)
720 			continue;
721 		/* We get lots of duplicates.  Catch the easy ones */
722 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
723 			continue;
724 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
725 
726 		kill.af = resp[0]->ai_family;
727 		sources++;
728 
729 		if (kill.af == AF_INET)
730 			kill.src.addr.v.a.addr.v4 =
731 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
732 		else if (kill.af == AF_INET6)
733 			kill.src.addr.v.a.addr.v6 =
734 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
735 			    sin6_addr;
736 		else
737 			errx(1, "Unknown address family %d", kill.af);
738 
739 		if (state_killers > 1) {
740 			dests = 0;
741 			memset(&kill.dst.addr.v.a.mask, 0xff,
742 			    sizeof(kill.dst.addr.v.a.mask));
743 			memset(&last_dst, 0xff, sizeof(last_dst));
744 			pfctl_addrprefix(state_kill[1],
745 			    &kill.dst.addr.v.a.mask);
746 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
747 			    &res[1]))) {
748 				errx(1, "getaddrinfo: %s",
749 				    gai_strerror(ret_ga));
750 				/* NOTREACHED */
751 			}
752 			for (resp[1] = res[1]; resp[1];
753 			    resp[1] = resp[1]->ai_next) {
754 				if (resp[1]->ai_addr == NULL)
755 					continue;
756 				if (kill.af != resp[1]->ai_family)
757 					continue;
758 
759 				if (memcmp(&last_dst, resp[1]->ai_addr,
760 				    sizeof(last_dst)) == 0)
761 					continue;
762 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
763 
764 				dests++;
765 
766 				if (kill.af == AF_INET)
767 					kill.dst.addr.v.a.addr.v4 =
768 					    ((struct sockaddr_in *)resp[1]->
769 					    ai_addr)->sin_addr;
770 				else if (kill.af == AF_INET6)
771 					kill.dst.addr.v.a.addr.v6 =
772 					    ((struct sockaddr_in6 *)resp[1]->
773 					    ai_addr)->sin6_addr;
774 				else
775 					errx(1, "Unknown address family %d",
776 					    kill.af);
777 
778 				if (pfctl_kill_states(dev, &kill, &newkilled))
779 					err(1, "DIOCKILLSTATES");
780 				killed += newkilled;
781 			}
782 			freeaddrinfo(res[1]);
783 		} else {
784 			if (pfctl_kill_states(dev, &kill, &newkilled))
785 				err(1, "DIOCKILLSTATES");
786 			killed += newkilled;
787 		}
788 	}
789 
790 	freeaddrinfo(res[0]);
791 
792 	if ((opts & PF_OPT_QUIET) == 0)
793 		fprintf(stderr, "killed %d states from %d sources and %d "
794 		    "destinations\n", killed, sources, dests);
795 	return (0);
796 }
797 
798 int
799 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
800 {
801 	struct pfctl_kill kill;
802 	struct addrinfo *res, *resp;
803 	struct sockaddr last_src;
804 	unsigned int newkilled;
805 	int killed = 0;
806 	int ret_ga;
807 
808 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
809 		warnx("no gateway specified");
810 		usage();
811 	}
812 
813 	memset(&kill, 0, sizeof(kill));
814 	memset(&kill.rt_addr.addr.v.a.mask, 0xff,
815 	    sizeof(kill.rt_addr.addr.v.a.mask));
816 	memset(&last_src, 0xff, sizeof(last_src));
817 	if (iface != NULL && strlcpy(kill.ifname, iface,
818 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
819 		errx(1, "invalid interface: %s", iface);
820 
821 	if (opts & PF_OPT_KILLMATCH)
822 		kill.kill_match = true;
823 
824 	pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask);
825 
826 	if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, &res))) {
827 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
828 		/* NOTREACHED */
829 	}
830 	for (resp = res; resp; resp = resp->ai_next) {
831 		if (resp->ai_addr == NULL)
832 			continue;
833 		/* We get lots of duplicates.  Catch the easy ones */
834 		if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
835 			continue;
836 		last_src = *(struct sockaddr *)resp->ai_addr;
837 
838 		kill.af = resp->ai_family;
839 
840 		if (kill.af == AF_INET)
841 			kill.rt_addr.addr.v.a.addr.v4 =
842 			    ((struct sockaddr_in *)resp->ai_addr)->sin_addr;
843 		else if (kill.af == AF_INET6)
844 			kill.rt_addr.addr.v.a.addr.v6 =
845 			    ((struct sockaddr_in6 *)resp->ai_addr)->
846 			    sin6_addr;
847 		else
848 			errx(1, "Unknown address family %d", kill.af);
849 
850 		if (pfctl_kill_states(dev, &kill, &newkilled))
851 			err(1, "DIOCKILLSTATES");
852 		killed += newkilled;
853 	}
854 
855 	freeaddrinfo(res);
856 
857 	if ((opts & PF_OPT_QUIET) == 0)
858 		fprintf(stderr, "killed %d states\n", killed);
859 	return (0);
860 }
861 
862 int
863 pfctl_label_kill_states(int dev, const char *iface, int opts)
864 {
865 	struct pfctl_kill kill;
866 	unsigned int killed;
867 
868 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
869 		warnx("no label specified");
870 		usage();
871 	}
872 	memset(&kill, 0, sizeof(kill));
873 	if (iface != NULL && strlcpy(kill.ifname, iface,
874 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
875 		errx(1, "invalid interface: %s", iface);
876 
877 	if (opts & PF_OPT_KILLMATCH)
878 		kill.kill_match = true;
879 
880 	if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
881 	    sizeof(kill.label))
882 		errx(1, "label too long: %s", state_kill[1]);
883 
884 	if (pfctl_kill_states(dev, &kill, &killed))
885 		err(1, "DIOCKILLSTATES");
886 
887 	if ((opts & PF_OPT_QUIET) == 0)
888 		fprintf(stderr, "killed %d states\n", killed);
889 
890 	return (0);
891 }
892 
893 int
894 pfctl_id_kill_states(int dev, const char *iface, int opts)
895 {
896 	struct pfctl_kill kill;
897 	unsigned int killed;
898 
899 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
900 		warnx("no id specified");
901 		usage();
902 	}
903 
904 	memset(&kill, 0, sizeof(kill));
905 
906 	if (opts & PF_OPT_KILLMATCH)
907 		kill.kill_match = true;
908 
909 	if ((sscanf(state_kill[1], "%jx/%x",
910 	    &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
911 	}
912 	else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
913 		kill.cmp.creatorid = 0;
914 	} else {
915 		warnx("wrong id format specified");
916 		usage();
917 	}
918 	if (kill.cmp.id == 0) {
919 		warnx("cannot kill id 0");
920 		usage();
921 	}
922 
923 	if (pfctl_kill_states(dev, &kill, &killed))
924 		err(1, "DIOCKILLSTATES");
925 
926 	if ((opts & PF_OPT_QUIET) == 0)
927 		fprintf(stderr, "killed %d states\n", killed);
928 
929 	return (0);
930 }
931 
932 int
933 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
934     u_int32_t ticket, int r_action, char *anchorname)
935 {
936 	struct pfioc_pooladdr pp;
937 	struct pf_pooladdr *pa;
938 	u_int32_t pnr, mpnr;
939 
940 	memset(&pp, 0, sizeof(pp));
941 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
942 	pp.r_action = r_action;
943 	pp.r_num = nr;
944 	pp.ticket = ticket;
945 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
946 		warn("DIOCGETADDRS");
947 		return (-1);
948 	}
949 	mpnr = pp.nr;
950 	TAILQ_INIT(&pool->list);
951 	for (pnr = 0; pnr < mpnr; ++pnr) {
952 		pp.nr = pnr;
953 		if (ioctl(dev, DIOCGETADDR, &pp)) {
954 			warn("DIOCGETADDR");
955 			return (-1);
956 		}
957 		pa = calloc(1, sizeof(struct pf_pooladdr));
958 		if (pa == NULL)
959 			err(1, "calloc");
960 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
961 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
962 	}
963 
964 	return (0);
965 }
966 
967 void
968 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
969 {
970 	struct pf_pooladdr *pa;
971 
972 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
973 		TAILQ_REMOVE(&src->list, pa, entries);
974 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
975 	}
976 }
977 
978 void
979 pfctl_clear_pool(struct pfctl_pool *pool)
980 {
981 	struct pf_pooladdr *pa;
982 
983 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
984 		TAILQ_REMOVE(&pool->list, pa, entries);
985 		free(pa);
986 	}
987 }
988 
989 void
990 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
991 {
992 	if (opts & PF_OPT_DEBUG) {
993 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
994 		    "p", "sa", "sp", "da", "dp" };
995 		int i;
996 
997 		printf("  [ Skip steps: ");
998 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
999 			if (rule->skip[i].nr == rule->nr + 1)
1000 				continue;
1001 			printf("%s=", t[i]);
1002 			if (rule->skip[i].nr == -1)
1003 				printf("end ");
1004 			else
1005 				printf("%u ", rule->skip[i].nr);
1006 		}
1007 		printf("]\n");
1008 
1009 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1010 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
1011 	}
1012 	if (opts & PF_OPT_VERBOSE) {
1013 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1014 			    "Bytes: %-10llu  States: %-6ju]\n",
1015 			    (unsigned long long)rule->evaluations,
1016 			    (unsigned long long)(rule->packets[0] +
1017 			    rule->packets[1]),
1018 			    (unsigned long long)(rule->bytes[0] +
1019 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
1020 		if (!(opts & PF_OPT_DEBUG))
1021 			printf("  [ Inserted: uid %u pid %u "
1022 			    "State Creations: %-6ju]\n",
1023 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
1024 			    (uintmax_t)rule->states_tot);
1025 	}
1026 }
1027 
1028 void
1029 pfctl_print_title(char *title)
1030 {
1031 	if (!first_title)
1032 		printf("\n");
1033 	first_title = 0;
1034 	printf("%s\n", title);
1035 }
1036 
1037 int
1038 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1039     char *anchorname, int depth)
1040 {
1041 	struct pfioc_rule pr;
1042 	struct pfctl_rule rule;
1043 	u_int32_t nr, mnr, header = 0;
1044 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1045 	int numeric = opts & PF_OPT_NUMERIC;
1046 	int len = strlen(path);
1047 	int brace;
1048 	char *p;
1049 
1050 	if (path[0])
1051 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1052 	else
1053 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1054 
1055 	memset(&pr, 0, sizeof(pr));
1056 	memcpy(pr.anchor, path, sizeof(pr.anchor));
1057 	if (opts & PF_OPT_SHOWALL) {
1058 		pr.rule.action = PF_PASS;
1059 		if (ioctl(dev, DIOCGETRULES, &pr)) {
1060 			warn("DIOCGETRULES");
1061 			goto error;
1062 		}
1063 		header++;
1064 	}
1065 	pr.rule.action = PF_SCRUB;
1066 	if (ioctl(dev, DIOCGETRULES, &pr)) {
1067 		warn("DIOCGETRULES");
1068 		goto error;
1069 	}
1070 	if (opts & PF_OPT_SHOWALL) {
1071 		if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
1072 			pfctl_print_title("FILTER RULES:");
1073 		else if (format == PFCTL_SHOW_LABELS && labels)
1074 			pfctl_print_title("LABEL COUNTERS:");
1075 	}
1076 	mnr = pr.nr;
1077 
1078 	for (nr = 0; nr < mnr; ++nr) {
1079 		pr.nr = nr;
1080 		if (pfctl_get_clear_rule(dev, nr, pr.ticket, path, PF_SCRUB,
1081 		    &rule, pr.anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1082 			warn("DIOCGETRULENV");
1083 			goto error;
1084 		}
1085 
1086 		if (pfctl_get_pool(dev, &rule.rpool,
1087 		    nr, pr.ticket, PF_SCRUB, path) != 0)
1088 			goto error;
1089 
1090 		switch (format) {
1091 		case PFCTL_SHOW_LABELS:
1092 			break;
1093 		case PFCTL_SHOW_RULES:
1094 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1095 				labels = 1;
1096 			print_rule(&rule, pr.anchor_call, rule_numbers, numeric);
1097 			printf("\n");
1098 			pfctl_print_rule_counters(&rule, opts);
1099 			break;
1100 		case PFCTL_SHOW_NOTHING:
1101 			break;
1102 		}
1103 		pfctl_clear_pool(&rule.rpool);
1104 	}
1105 	pr.rule.action = PF_PASS;
1106 	if (ioctl(dev, DIOCGETRULES, &pr)) {
1107 		warn("DIOCGETRULES");
1108 		goto error;
1109 	}
1110 	mnr = pr.nr;
1111 	for (nr = 0; nr < mnr; ++nr) {
1112 		pr.nr = nr;
1113 		if (pfctl_get_clear_rule(dev, nr, pr.ticket, path, PF_PASS,
1114 		    &rule, pr.anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1115 			warn("DIOCGETRULE");
1116 			goto error;
1117 		}
1118 
1119 		if (pfctl_get_pool(dev, &rule.rpool,
1120 		    nr, pr.ticket, PF_PASS, path) != 0)
1121 			goto error;
1122 
1123 		switch (format) {
1124 		case PFCTL_SHOW_LABELS: {
1125 			bool show = false;
1126 			int i = 0;
1127 
1128 			while (rule.label[i][0]) {
1129 				printf("%s ", rule.label[i++]);
1130 				show = true;
1131 			}
1132 
1133 			if (show) {
1134 				printf("%llu %llu %llu %llu"
1135 				    " %llu %llu %llu %ju\n",
1136 				    (unsigned long long)rule.evaluations,
1137 				    (unsigned long long)(rule.packets[0] +
1138 				    rule.packets[1]),
1139 				    (unsigned long long)(rule.bytes[0] +
1140 				    rule.bytes[1]),
1141 				    (unsigned long long)rule.packets[0],
1142 				    (unsigned long long)rule.bytes[0],
1143 				    (unsigned long long)rule.packets[1],
1144 				    (unsigned long long)rule.bytes[1],
1145 				    (uintmax_t)rule.states_tot);
1146 			}
1147 			break;
1148 		}
1149 		case PFCTL_SHOW_RULES:
1150 			brace = 0;
1151 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1152 				labels = 1;
1153 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1154 			if (pr.anchor_call[0] &&
1155 			   ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
1156 			   ((void *)p == (void *)pr.anchor_call ||
1157 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1158 				brace++;
1159 				if ((p = strrchr(pr.anchor_call, '/')) !=
1160 				    NULL)
1161 					p++;
1162 				else
1163 					p = &pr.anchor_call[0];
1164 			} else
1165 				p = &pr.anchor_call[0];
1166 
1167 			print_rule(&rule, p, rule_numbers, numeric);
1168 			if (brace)
1169 				printf(" {\n");
1170 			else
1171 				printf("\n");
1172 			pfctl_print_rule_counters(&rule, opts);
1173 			if (brace) {
1174 				pfctl_show_rules(dev, path, opts, format,
1175 				    p, depth + 1);
1176 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1177 				printf("}\n");
1178 			}
1179 			break;
1180 		case PFCTL_SHOW_NOTHING:
1181 			break;
1182 		}
1183 		pfctl_clear_pool(&rule.rpool);
1184 	}
1185 	path[len] = '\0';
1186 	return (0);
1187 
1188  error:
1189 	path[len] = '\0';
1190 	return (-1);
1191 }
1192 
1193 int
1194 pfctl_show_nat(int dev, int opts, char *anchorname)
1195 {
1196 	struct pfioc_rule pr;
1197 	struct pfctl_rule rule;
1198 	u_int32_t mnr, nr;
1199 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1200 	int i, dotitle = opts & PF_OPT_SHOWALL;
1201 
1202 	memset(&pr, 0, sizeof(pr));
1203 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
1204 	for (i = 0; i < 3; i++) {
1205 		pr.rule.action = nattype[i];
1206 		if (ioctl(dev, DIOCGETRULES, &pr)) {
1207 			warn("DIOCGETRULES");
1208 			return (-1);
1209 		}
1210 		mnr = pr.nr;
1211 		for (nr = 0; nr < mnr; ++nr) {
1212 			pr.nr = nr;
1213 			if (pfctl_get_rule(dev, nr, pr.ticket, anchorname,
1214 			    nattype[i], &rule, pr.anchor_call)) {
1215 				warn("DIOCGETRULE");
1216 				return (-1);
1217 			}
1218 			if (pfctl_get_pool(dev, &rule.rpool, nr,
1219 			    pr.ticket, nattype[i], anchorname) != 0)
1220 				return (-1);
1221 			if (dotitle) {
1222 				pfctl_print_title("TRANSLATION RULES:");
1223 				dotitle = 0;
1224 			}
1225 			print_rule(&rule, pr.anchor_call,
1226 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1227 			printf("\n");
1228 			pfctl_print_rule_counters(&rule, opts);
1229 			pfctl_clear_pool(&rule.rpool);
1230 		}
1231 	}
1232 	return (0);
1233 }
1234 
1235 int
1236 pfctl_show_src_nodes(int dev, int opts)
1237 {
1238 	struct pfioc_src_nodes psn;
1239 	struct pf_src_node *p;
1240 	char *inbuf = NULL, *newinbuf = NULL;
1241 	unsigned int len = 0;
1242 	int i;
1243 
1244 	memset(&psn, 0, sizeof(psn));
1245 	for (;;) {
1246 		psn.psn_len = len;
1247 		if (len) {
1248 			newinbuf = realloc(inbuf, len);
1249 			if (newinbuf == NULL)
1250 				err(1, "realloc");
1251 			psn.psn_buf = inbuf = newinbuf;
1252 		}
1253 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1254 			warn("DIOCGETSRCNODES");
1255 			free(inbuf);
1256 			return (-1);
1257 		}
1258 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1259 			break;
1260 		if (len == 0 && psn.psn_len == 0)
1261 			goto done;
1262 		if (len == 0 && psn.psn_len != 0)
1263 			len = psn.psn_len;
1264 		if (psn.psn_len == 0)
1265 			goto done;	/* no src_nodes */
1266 		len *= 2;
1267 	}
1268 	p = psn.psn_src_nodes;
1269 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1270 		pfctl_print_title("SOURCE TRACKING NODES:");
1271 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1272 		print_src_node(p, opts);
1273 		p++;
1274 	}
1275 done:
1276 	free(inbuf);
1277 	return (0);
1278 }
1279 
1280 int
1281 pfctl_show_states(int dev, const char *iface, int opts)
1282 {
1283 	struct pfctl_states states;
1284 	struct pfctl_state *s;
1285 	int dotitle = (opts & PF_OPT_SHOWALL);
1286 
1287 	memset(&states, 0, sizeof(states));
1288 
1289 	if (pfctl_get_states(dev, &states))
1290 		return (-1);
1291 
1292 	TAILQ_FOREACH(s, &states.states, entry) {
1293 		if (iface != NULL && strcmp(s->ifname, iface))
1294 			continue;
1295 		if (dotitle) {
1296 			pfctl_print_title("STATES:");
1297 			dotitle = 0;
1298 		}
1299 		print_state(s, opts);
1300 	}
1301 
1302 	pfctl_free_states(&states);
1303 
1304 	return (0);
1305 }
1306 
1307 int
1308 pfctl_show_status(int dev, int opts)
1309 {
1310 	struct pfctl_status	*status;
1311 	struct pfctl_syncookies	cookies;
1312 
1313 	if ((status = pfctl_get_status(dev)) == NULL) {
1314 		warn("DIOCGETSTATUS");
1315 		return (-1);
1316 	}
1317 	if (pfctl_get_syncookies(dev, &cookies)) {
1318 		pfctl_free_status(status);
1319 		warn("DIOCGETSYNCOOKIES");
1320 		return (-1);
1321 	}
1322 	if (opts & PF_OPT_SHOWALL)
1323 		pfctl_print_title("INFO:");
1324 	print_status(status, &cookies, opts);
1325 	pfctl_free_status(status);
1326 	return (0);
1327 }
1328 
1329 int
1330 pfctl_show_running(int dev)
1331 {
1332 	struct pfctl_status *status;
1333 	int running;
1334 
1335 	if ((status = pfctl_get_status(dev)) == NULL) {
1336 		warn("DIOCGETSTATUS");
1337 		return (-1);
1338 	}
1339 
1340 	running = status->running;
1341 
1342 	print_running(status);
1343 	pfctl_free_status(status);
1344 	return (!running);
1345 }
1346 
1347 int
1348 pfctl_show_timeouts(int dev, int opts)
1349 {
1350 	struct pfioc_tm pt;
1351 	int i;
1352 
1353 	if (opts & PF_OPT_SHOWALL)
1354 		pfctl_print_title("TIMEOUTS:");
1355 	memset(&pt, 0, sizeof(pt));
1356 	for (i = 0; pf_timeouts[i].name; i++) {
1357 		pt.timeout = pf_timeouts[i].timeout;
1358 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1359 			err(1, "DIOCGETTIMEOUT");
1360 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1361 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1362 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1363 			printf(" states");
1364 		else
1365 			printf("s");
1366 		printf("\n");
1367 	}
1368 	return (0);
1369 
1370 }
1371 
1372 int
1373 pfctl_show_limits(int dev, int opts)
1374 {
1375 	struct pfioc_limit pl;
1376 	int i;
1377 
1378 	if (opts & PF_OPT_SHOWALL)
1379 		pfctl_print_title("LIMITS:");
1380 	memset(&pl, 0, sizeof(pl));
1381 	for (i = 0; pf_limits[i].name; i++) {
1382 		pl.index = pf_limits[i].index;
1383 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1384 			err(1, "DIOCGETLIMIT");
1385 		printf("%-13s ", pf_limits[i].name);
1386 		if (pl.limit == UINT_MAX)
1387 			printf("unlimited\n");
1388 		else
1389 			printf("hard limit %8u\n", pl.limit);
1390 	}
1391 	return (0);
1392 }
1393 
1394 /* callbacks for rule/nat/rdr/addr */
1395 int
1396 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1397 {
1398 	struct pf_pooladdr *pa;
1399 
1400 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1401 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1402 			err(1, "DIOCBEGINADDRS");
1403 	}
1404 
1405 	pf->paddr.af = af;
1406 	TAILQ_FOREACH(pa, &p->list, entries) {
1407 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1408 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1409 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1410 				err(1, "DIOCADDADDR");
1411 		}
1412 	}
1413 	return (0);
1414 }
1415 
1416 int
1417 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1418     const char *anchor_call)
1419 {
1420 	u_int8_t		rs_num;
1421 	struct pfctl_rule	*rule;
1422 	struct pfctl_ruleset	*rs;
1423 	char 			*p;
1424 
1425 	rs_num = pf_get_ruleset_number(r->action);
1426 	if (rs_num == PF_RULESET_MAX)
1427 		errx(1, "Invalid rule type %d", r->action);
1428 
1429 	rs = &pf->anchor->ruleset;
1430 
1431 	if (anchor_call[0] && r->anchor == NULL) {
1432 		/*
1433 		 * Don't make non-brace anchors part of the main anchor pool.
1434 		 */
1435 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1436 			err(1, "pfctl_append_rule: calloc");
1437 
1438 		pf_init_ruleset(&r->anchor->ruleset);
1439 		r->anchor->ruleset.anchor = r->anchor;
1440 		if (strlcpy(r->anchor->path, anchor_call,
1441 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1442 			errx(1, "pfctl_append_rule: strlcpy");
1443 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1444 			if (!strlen(p))
1445 				err(1, "pfctl_append_rule: bad anchor name %s",
1446 				    anchor_call);
1447 		} else
1448 			p = (char *)anchor_call;
1449 		if (strlcpy(r->anchor->name, p,
1450 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1451 			errx(1, "pfctl_append_rule: strlcpy");
1452 	}
1453 
1454 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1455 		err(1, "calloc");
1456 	bcopy(r, rule, sizeof(*rule));
1457 	TAILQ_INIT(&rule->rpool.list);
1458 	pfctl_move_pool(&r->rpool, &rule->rpool);
1459 
1460 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1461 	return (0);
1462 }
1463 
1464 int
1465 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a)
1466 {
1467 	int osize = pf->trans->pfrb_size;
1468 
1469 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1470 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1471 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1472 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1473 			return (1);
1474 	}
1475 	if (a == pf->astack[0] && ((altqsupport &&
1476 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1477 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1478 			return (2);
1479 	}
1480 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1481 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1482 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1483 			return (3);
1484 	}
1485 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1486 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1487 			return (4);
1488 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1489 		return (5);
1490 
1491 	return (0);
1492 }
1493 
1494 int
1495 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1496     int rs_num, int depth)
1497 {
1498 	struct pfctl_rule *r;
1499 	int		error, len = strlen(path);
1500 	int		brace = 0;
1501 
1502 	pf->anchor = rs->anchor;
1503 
1504 	if (path[0])
1505 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1506 	else
1507 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1508 
1509 	if (depth) {
1510 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1511 			brace++;
1512 			if (pf->opts & PF_OPT_VERBOSE)
1513 				printf(" {\n");
1514 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1515 			    (error = pfctl_ruleset_trans(pf,
1516 			    path, rs->anchor))) {
1517 				printf("pfctl_load_rulesets: "
1518 				    "pfctl_ruleset_trans %d\n", error);
1519 				goto error;
1520 			}
1521 		} else if (pf->opts & PF_OPT_VERBOSE)
1522 			printf("\n");
1523 
1524 	}
1525 
1526 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1527 		pfctl_optimize_ruleset(pf, rs);
1528 
1529 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1530 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1531 
1532 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1533 			expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
1534 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
1535 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
1536 
1537 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1538 			goto error;
1539 		if (r->anchor) {
1540 			if ((error = pfctl_load_ruleset(pf, path,
1541 			    &r->anchor->ruleset, rs_num, depth + 1)))
1542 				goto error;
1543 		} else if (pf->opts & PF_OPT_VERBOSE)
1544 			printf("\n");
1545 		free(r);
1546 	}
1547 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1548 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1549 		printf("}\n");
1550 	}
1551 	path[len] = '\0';
1552 	return (0);
1553 
1554  error:
1555 	path[len] = '\0';
1556 	return (error);
1557 
1558 }
1559 
1560 int
1561 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
1562 {
1563 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1564 	char			*name;
1565 	u_int32_t		ticket;
1566 	char			anchor[PF_ANCHOR_NAME_SIZE];
1567 	int			len = strlen(path);
1568 
1569 	/* set up anchor before adding to path for anchor_call */
1570 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1571 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1572 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1573 		errx(1, "pfctl_load_rule: strlcpy");
1574 
1575 	if (r->anchor) {
1576 		if (r->anchor->match) {
1577 			if (path[0])
1578 				snprintf(&path[len], MAXPATHLEN - len,
1579 				    "/%s", r->anchor->name);
1580 			else
1581 				snprintf(&path[len], MAXPATHLEN - len,
1582 				    "%s", r->anchor->name);
1583 			name = r->anchor->name;
1584 		} else
1585 			name = r->anchor->path;
1586 	} else
1587 		name = "";
1588 
1589 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1590 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1591 			return (1);
1592 		if (pfctl_add_rule(pf->dev, r, anchor, name, ticket,
1593 		    pf->paddr.ticket))
1594 			err(1, "DIOCADDRULENV");
1595 	}
1596 
1597 	if (pf->opts & PF_OPT_VERBOSE) {
1598 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1599 		print_rule(r, r->anchor ? r->anchor->name : "",
1600 		    pf->opts & PF_OPT_VERBOSE2,
1601 		    pf->opts & PF_OPT_NUMERIC);
1602 	}
1603 	path[len] = '\0';
1604 	pfctl_clear_pool(&r->rpool);
1605 	return (0);
1606 }
1607 
1608 int
1609 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1610 {
1611 	if (altqsupport &&
1612 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1613 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1614 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1615 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1616 				if (errno == ENXIO)
1617 					errx(1, "qtype not configured");
1618 				else if (errno == ENODEV)
1619 					errx(1, "%s: driver does not support "
1620 					    "altq", a->ifname);
1621 				else
1622 					err(1, "DIOCADDALTQ");
1623 			}
1624 		}
1625 		pfaltq_store(&pf->paltq->altq);
1626 	}
1627 	return (0);
1628 }
1629 
1630 int
1631 pfctl_rules(int dev, char *filename, int opts, int optimize,
1632     char *anchorname, struct pfr_buffer *trans)
1633 {
1634 #define ERR(x) do { warn(x); goto _error; } while(0)
1635 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1636 
1637 	struct pfr_buffer	*t, buf;
1638 	struct pfioc_altq	 pa;
1639 	struct pfctl		 pf;
1640 	struct pfctl_ruleset	*rs;
1641 	struct pfr_table	 trs;
1642 	char			*path;
1643 	int			 osize;
1644 
1645 	RB_INIT(&pf_anchors);
1646 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1647 	pf_init_ruleset(&pf_main_anchor.ruleset);
1648 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1649 	if (trans == NULL) {
1650 		bzero(&buf, sizeof(buf));
1651 		buf.pfrb_type = PFRB_TRANS;
1652 		t = &buf;
1653 		osize = 0;
1654 	} else {
1655 		t = trans;
1656 		osize = t->pfrb_size;
1657 	}
1658 
1659 	memset(&pa, 0, sizeof(pa));
1660 	pa.version = PFIOC_ALTQ_VERSION;
1661 	memset(&pf, 0, sizeof(pf));
1662 	memset(&trs, 0, sizeof(trs));
1663 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1664 		ERRX("pfctl_rules: calloc");
1665 	if (strlcpy(trs.pfrt_anchor, anchorname,
1666 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1667 		ERRX("pfctl_rules: strlcpy");
1668 	pf.dev = dev;
1669 	pf.opts = opts;
1670 	pf.optimize = optimize;
1671 	pf.loadopt = loadopt;
1672 
1673 	/* non-brace anchor, create without resolving the path */
1674 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1675 		ERRX("pfctl_rules: calloc");
1676 	rs = &pf.anchor->ruleset;
1677 	pf_init_ruleset(rs);
1678 	rs->anchor = pf.anchor;
1679 	if (strlcpy(pf.anchor->path, anchorname,
1680 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1681 		errx(1, "pfctl_add_rule: strlcpy");
1682 	if (strlcpy(pf.anchor->name, anchorname,
1683 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1684 		errx(1, "pfctl_add_rule: strlcpy");
1685 
1686 
1687 	pf.astack[0] = pf.anchor;
1688 	pf.asd = 0;
1689 	if (anchorname[0])
1690 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1691 	pf.paltq = &pa;
1692 	pf.trans = t;
1693 	pfctl_init_options(&pf);
1694 
1695 	if ((opts & PF_OPT_NOACTION) == 0) {
1696 		/*
1697 		 * XXX For the time being we need to open transactions for
1698 		 * the main ruleset before parsing, because tables are still
1699 		 * loaded at parse time.
1700 		 */
1701 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1702 			ERRX("pfctl_rules");
1703 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1704 			pa.ticket =
1705 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1706 		if (pf.loadopt & PFCTL_FLAG_TABLE)
1707 			pf.astack[0]->ruleset.tticket =
1708 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1709 	}
1710 
1711 	if (parse_config(filename, &pf) < 0) {
1712 		if ((opts & PF_OPT_NOACTION) == 0)
1713 			ERRX("Syntax error in config file: "
1714 			    "pf rules not loaded");
1715 		else
1716 			goto _error;
1717 	}
1718 	if (loadopt & PFCTL_FLAG_OPTION)
1719 		pfctl_adjust_skip_ifaces(&pf);
1720 
1721 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1722 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1723 	    (pf.loadopt & PFCTL_FLAG_NAT &&
1724 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1725 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1726 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1727 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
1728 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1729 		if ((opts & PF_OPT_NOACTION) == 0)
1730 			ERRX("Unable to load rules into kernel");
1731 		else
1732 			goto _error;
1733 	}
1734 
1735 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1736 		if (check_commit_altq(dev, opts) != 0)
1737 			ERRX("errors in altq config");
1738 
1739 	/* process "load anchor" directives */
1740 	if (!anchorname[0])
1741 		if (pfctl_load_anchors(dev, &pf, t) == -1)
1742 			ERRX("load anchors");
1743 
1744 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1745 		if (!anchorname[0])
1746 			if (pfctl_load_options(&pf))
1747 				goto _error;
1748 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1749 			ERR("DIOCXCOMMIT");
1750 	}
1751 	free(path);
1752 	return (0);
1753 
1754 _error:
1755 	if (trans == NULL) {	/* main ruleset */
1756 		if ((opts & PF_OPT_NOACTION) == 0)
1757 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1758 				err(1, "DIOCXROLLBACK");
1759 		exit(1);
1760 	} else {		/* sub ruleset */
1761 		free(path);
1762 		return (-1);
1763 	}
1764 
1765 #undef ERR
1766 #undef ERRX
1767 }
1768 
1769 FILE *
1770 pfctl_fopen(const char *name, const char *mode)
1771 {
1772 	struct stat	 st;
1773 	FILE		*fp;
1774 
1775 	fp = fopen(name, mode);
1776 	if (fp == NULL)
1777 		return (NULL);
1778 	if (fstat(fileno(fp), &st)) {
1779 		fclose(fp);
1780 		return (NULL);
1781 	}
1782 	if (S_ISDIR(st.st_mode)) {
1783 		fclose(fp);
1784 		errno = EISDIR;
1785 		return (NULL);
1786 	}
1787 	return (fp);
1788 }
1789 
1790 void
1791 pfctl_init_options(struct pfctl *pf)
1792 {
1793 
1794 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1795 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1796 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1797 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1798 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1799 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1800 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1801 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1802 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1803 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1804 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1805 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1806 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1807 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1808 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1809 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1810 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1811 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1812 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1813 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1814 
1815 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1816 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1817 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1818 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1819 
1820 	pf->debug = PF_DEBUG_URGENT;
1821 
1822 	pf->syncookies = false;
1823 	pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
1824 	pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
1825 }
1826 
1827 int
1828 pfctl_load_options(struct pfctl *pf)
1829 {
1830 	int i, error = 0;
1831 
1832 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1833 		return (0);
1834 
1835 	/* load limits */
1836 	for (i = 0; i < PF_LIMIT_MAX; i++) {
1837 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1838 			continue;
1839 		if (pfctl_load_limit(pf, i, pf->limit[i]))
1840 			error = 1;
1841 	}
1842 
1843 	/*
1844 	 * If we've set the limit, but haven't explicitly set adaptive
1845 	 * timeouts, do it now with a start of 60% and end of 120%.
1846 	 */
1847 	if (pf->limit_set[PF_LIMIT_STATES] &&
1848 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1849 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1850 		pf->timeout[PFTM_ADAPTIVE_START] =
1851 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
1852 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1853 		pf->timeout[PFTM_ADAPTIVE_END] =
1854 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
1855 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1856 	}
1857 
1858 	/* load timeouts */
1859 	for (i = 0; i < PFTM_MAX; i++) {
1860 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1861 			continue;
1862 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1863 			error = 1;
1864 	}
1865 
1866 	/* load debug */
1867 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1868 		if (pfctl_load_debug(pf, pf->debug))
1869 			error = 1;
1870 
1871 	/* load logif */
1872 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1873 		if (pfctl_load_logif(pf, pf->ifname))
1874 			error = 1;
1875 
1876 	/* load hostid */
1877 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1878 		if (pfctl_load_hostid(pf, pf->hostid))
1879 			error = 1;
1880 
1881 	/* load keepcounters */
1882 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
1883 		error = 1;
1884 
1885 	/* load syncookies settings */
1886 	if (pfctl_load_syncookies(pf, pf->syncookies))
1887 		error = 1;
1888 
1889 	return (error);
1890 }
1891 
1892 int
1893 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1894 {
1895 	int i;
1896 
1897 
1898 	for (i = 0; pf_limits[i].name; i++) {
1899 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
1900 			pf->limit[pf_limits[i].index] = limit;
1901 			pf->limit_set[pf_limits[i].index] = 1;
1902 			break;
1903 		}
1904 	}
1905 	if (pf_limits[i].name == NULL) {
1906 		warnx("Bad pool name.");
1907 		return (1);
1908 	}
1909 
1910 	if (pf->opts & PF_OPT_VERBOSE)
1911 		printf("set limit %s %d\n", opt, limit);
1912 
1913 	return (0);
1914 }
1915 
1916 int
1917 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1918 {
1919 	struct pfioc_limit pl;
1920 
1921 	memset(&pl, 0, sizeof(pl));
1922 	pl.index = index;
1923 	pl.limit = limit;
1924 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1925 		if (errno == EBUSY)
1926 			warnx("Current pool size exceeds requested hard limit");
1927 		else
1928 			warnx("DIOCSETLIMIT");
1929 		return (1);
1930 	}
1931 	return (0);
1932 }
1933 
1934 int
1935 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1936 {
1937 	int i;
1938 
1939 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1940 		return (0);
1941 
1942 	for (i = 0; pf_timeouts[i].name; i++) {
1943 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1944 			pf->timeout[pf_timeouts[i].timeout] = seconds;
1945 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
1946 			break;
1947 		}
1948 	}
1949 
1950 	if (pf_timeouts[i].name == NULL) {
1951 		warnx("Bad timeout name.");
1952 		return (1);
1953 	}
1954 
1955 
1956 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1957 		printf("set timeout %s %d\n", opt, seconds);
1958 
1959 	return (0);
1960 }
1961 
1962 int
1963 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1964 {
1965 	struct pfioc_tm pt;
1966 
1967 	memset(&pt, 0, sizeof(pt));
1968 	pt.timeout = timeout;
1969 	pt.seconds = seconds;
1970 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1971 		warnx("DIOCSETTIMEOUT");
1972 		return (1);
1973 	}
1974 	return (0);
1975 }
1976 
1977 int
1978 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1979 {
1980 	const struct pf_hint *hint;
1981 	int i, r;
1982 
1983 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1984 		return (0);
1985 
1986 	for (i = 0; pf_hints[i].name; i++)
1987 		if (strcasecmp(opt, pf_hints[i].name) == 0)
1988 			break;
1989 
1990 	hint = pf_hints[i].hint;
1991 	if (hint == NULL) {
1992 		warnx("invalid state timeouts optimization");
1993 		return (1);
1994 	}
1995 
1996 	for (i = 0; hint[i].name; i++)
1997 		if ((r = pfctl_set_timeout(pf, hint[i].name,
1998 		    hint[i].timeout, 1)))
1999 			return (r);
2000 
2001 	if (pf->opts & PF_OPT_VERBOSE)
2002 		printf("set optimization %s\n", opt);
2003 
2004 	return (0);
2005 }
2006 
2007 int
2008 pfctl_set_logif(struct pfctl *pf, char *ifname)
2009 {
2010 
2011 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2012 		return (0);
2013 
2014 	if (!strcmp(ifname, "none")) {
2015 		free(pf->ifname);
2016 		pf->ifname = NULL;
2017 	} else {
2018 		pf->ifname = strdup(ifname);
2019 		if (!pf->ifname)
2020 			errx(1, "pfctl_set_logif: strdup");
2021 	}
2022 	pf->ifname_set = 1;
2023 
2024 	if (pf->opts & PF_OPT_VERBOSE)
2025 		printf("set loginterface %s\n", ifname);
2026 
2027 	return (0);
2028 }
2029 
2030 int
2031 pfctl_load_logif(struct pfctl *pf, char *ifname)
2032 {
2033 	struct pfioc_if pi;
2034 
2035 	memset(&pi, 0, sizeof(pi));
2036 	if (ifname && strlcpy(pi.ifname, ifname,
2037 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
2038 		warnx("pfctl_load_logif: strlcpy");
2039 		return (1);
2040 	}
2041 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
2042 		warnx("DIOCSETSTATUSIF");
2043 		return (1);
2044 	}
2045 	return (0);
2046 }
2047 
2048 int
2049 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2050 {
2051 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2052 		return (0);
2053 
2054 	HTONL(hostid);
2055 
2056 	pf->hostid = hostid;
2057 	pf->hostid_set = 1;
2058 
2059 	if (pf->opts & PF_OPT_VERBOSE)
2060 		printf("set hostid 0x%08x\n", ntohl(hostid));
2061 
2062 	return (0);
2063 }
2064 
2065 int
2066 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2067 {
2068 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2069 		warnx("DIOCSETHOSTID");
2070 		return (1);
2071 	}
2072 	return (0);
2073 }
2074 
2075 int
2076 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2077 {
2078 	struct pfctl_syncookies	cookies;
2079 
2080 	bzero(&cookies, sizeof(cookies));
2081 
2082 	cookies.mode = val;
2083 	cookies.lowwater = pf->syncookieswat[0];
2084 	cookies.highwater = pf->syncookieswat[1];
2085 
2086 	if (pfctl_set_syncookies(dev, &cookies)) {
2087 		warnx("DIOCSETSYNCOOKIES");
2088 		return (1);
2089 	}
2090 	return (0);
2091 }
2092 
2093 int
2094 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2095 {
2096 	if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2097 		warnx("syncookies start/end only apply to adaptive");
2098 		return (1);
2099 	}
2100 	if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2101 		if (!w->hi)
2102 			w->hi = PF_SYNCOOKIES_HIWATPCT;
2103 		if (!w->lo)
2104 			w->lo = w->hi / 2;
2105 		if (w->lo >= w->hi) {
2106 			warnx("start must be higher than end");
2107 			return (1);
2108 		}
2109 		pf->syncookieswat[0] = w->lo;
2110 		pf->syncookieswat[1] = w->hi;
2111 		pf->syncookieswat_set = 1;
2112 	}
2113 
2114 	if (pf->opts & PF_OPT_VERBOSE) {
2115 		if (val == PF_SYNCOOKIES_NEVER)
2116 			printf("set syncookies never\n");
2117 		else if (val == PF_SYNCOOKIES_ALWAYS)
2118 			printf("set syncookies always\n");
2119 		else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2120 			if (pf->syncookieswat_set)
2121 				printf("set syncookies adaptive (start %u%%, "
2122 				    "end %u%%)\n", pf->syncookieswat[1],
2123 				    pf->syncookieswat[0]);
2124 			else
2125 				printf("set syncookies adaptive\n");
2126 		} else {        /* cannot happen */
2127 			warnx("king bula ate all syncookies");
2128 			return (1);
2129 		}
2130 	}
2131 
2132 	pf->syncookies = val;
2133 	return (0);
2134 }
2135 
2136 int
2137 pfctl_set_debug(struct pfctl *pf, char *d)
2138 {
2139 	u_int32_t	level;
2140 
2141 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2142 		return (0);
2143 
2144 	if (!strcmp(d, "none"))
2145 		pf->debug = PF_DEBUG_NONE;
2146 	else if (!strcmp(d, "urgent"))
2147 		pf->debug = PF_DEBUG_URGENT;
2148 	else if (!strcmp(d, "misc"))
2149 		pf->debug = PF_DEBUG_MISC;
2150 	else if (!strcmp(d, "loud"))
2151 		pf->debug = PF_DEBUG_NOISY;
2152 	else {
2153 		warnx("unknown debug level \"%s\"", d);
2154 		return (-1);
2155 	}
2156 
2157 	pf->debug_set = 1;
2158 	level = pf->debug;
2159 
2160 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2161 		if (ioctl(dev, DIOCSETDEBUG, &level))
2162 			err(1, "DIOCSETDEBUG");
2163 
2164 	if (pf->opts & PF_OPT_VERBOSE)
2165 		printf("set debug %s\n", d);
2166 
2167 	return (0);
2168 }
2169 
2170 int
2171 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2172 {
2173 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
2174 		warnx("DIOCSETDEBUG");
2175 		return (1);
2176 	}
2177 	return (0);
2178 }
2179 
2180 int
2181 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2182 {
2183 	struct pfioc_iface	pi;
2184 	struct node_host	*h = NULL, *n = NULL;
2185 
2186 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2187 		return (0);
2188 
2189 	bzero(&pi, sizeof(pi));
2190 
2191 	pi.pfiio_flags = flags;
2192 
2193 	/* Make sure our cache matches the kernel. If we set or clear the flag
2194 	 * for a group this applies to all members. */
2195 	h = ifa_grouplookup(ifname, 0);
2196 	for (n = h; n != NULL; n = n->next)
2197 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2198 
2199 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2200 	    sizeof(pi.pfiio_name))
2201 		errx(1, "pfctl_set_interface_flags: strlcpy");
2202 
2203 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2204 		if (how == 0) {
2205 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2206 				err(1, "DIOCCLRIFFLAG");
2207 		} else {
2208 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2209 				err(1, "DIOCSETIFFLAG");
2210 			pfctl_check_skip_ifaces(ifname);
2211 		}
2212 	}
2213 	return (0);
2214 }
2215 
2216 void
2217 pfctl_debug(int dev, u_int32_t level, int opts)
2218 {
2219 	if (ioctl(dev, DIOCSETDEBUG, &level))
2220 		err(1, "DIOCSETDEBUG");
2221 	if ((opts & PF_OPT_QUIET) == 0) {
2222 		fprintf(stderr, "debug level set to '");
2223 		switch (level) {
2224 		case PF_DEBUG_NONE:
2225 			fprintf(stderr, "none");
2226 			break;
2227 		case PF_DEBUG_URGENT:
2228 			fprintf(stderr, "urgent");
2229 			break;
2230 		case PF_DEBUG_MISC:
2231 			fprintf(stderr, "misc");
2232 			break;
2233 		case PF_DEBUG_NOISY:
2234 			fprintf(stderr, "loud");
2235 			break;
2236 		default:
2237 			fprintf(stderr, "<invalid>");
2238 			break;
2239 		}
2240 		fprintf(stderr, "'\n");
2241 	}
2242 }
2243 
2244 int
2245 pfctl_test_altqsupport(int dev, int opts)
2246 {
2247 	struct pfioc_altq pa;
2248 
2249 	pa.version = PFIOC_ALTQ_VERSION;
2250 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2251 		if (errno == ENODEV) {
2252 			if (opts & PF_OPT_VERBOSE)
2253 				fprintf(stderr, "No ALTQ support in kernel\n"
2254 				    "ALTQ related functions disabled\n");
2255 			return (0);
2256 		} else
2257 			err(1, "DIOCGETALTQS");
2258 	}
2259 	return (1);
2260 }
2261 
2262 int
2263 pfctl_show_anchors(int dev, int opts, char *anchorname)
2264 {
2265 	struct pfioc_ruleset	 pr;
2266 	u_int32_t		 mnr, nr;
2267 
2268 	memset(&pr, 0, sizeof(pr));
2269 	memcpy(pr.path, anchorname, sizeof(pr.path));
2270 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2271 		if (errno == EINVAL)
2272 			fprintf(stderr, "Anchor '%s' not found.\n",
2273 			    anchorname);
2274 		else
2275 			err(1, "DIOCGETRULESETS");
2276 		return (-1);
2277 	}
2278 	mnr = pr.nr;
2279 	for (nr = 0; nr < mnr; ++nr) {
2280 		char sub[MAXPATHLEN];
2281 
2282 		pr.nr = nr;
2283 		if (ioctl(dev, DIOCGETRULESET, &pr))
2284 			err(1, "DIOCGETRULESET");
2285 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2286 			continue;
2287 		sub[0] = 0;
2288 		if (pr.path[0]) {
2289 			strlcat(sub, pr.path, sizeof(sub));
2290 			strlcat(sub, "/", sizeof(sub));
2291 		}
2292 		strlcat(sub, pr.name, sizeof(sub));
2293 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2294 			printf("  %s\n", sub);
2295 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2296 			return (-1);
2297 	}
2298 	return (0);
2299 }
2300 
2301 const char *
2302 pfctl_lookup_option(char *cmd, const char * const *list)
2303 {
2304 	if (cmd != NULL && *cmd)
2305 		for (; *list; list++)
2306 			if (!strncmp(cmd, *list, strlen(cmd)))
2307 				return (*list);
2308 	return (NULL);
2309 }
2310 
2311 int
2312 main(int argc, char *argv[])
2313 {
2314 	int	 error = 0;
2315 	int	 ch;
2316 	int	 mode = O_RDONLY;
2317 	int	 opts = 0;
2318 	int	 optimize = PF_OPTIMIZE_BASIC;
2319 	char	 anchorname[MAXPATHLEN];
2320 	char	*path;
2321 
2322 	if (argc < 2)
2323 		usage();
2324 
2325 	while ((ch = getopt(argc, argv,
2326 	    "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2327 		switch (ch) {
2328 		case 'a':
2329 			anchoropt = optarg;
2330 			break;
2331 		case 'd':
2332 			opts |= PF_OPT_DISABLE;
2333 			mode = O_RDWR;
2334 			break;
2335 		case 'D':
2336 			if (pfctl_cmdline_symset(optarg) < 0)
2337 				warnx("could not parse macro definition %s",
2338 				    optarg);
2339 			break;
2340 		case 'e':
2341 			opts |= PF_OPT_ENABLE;
2342 			mode = O_RDWR;
2343 			break;
2344 		case 'q':
2345 			opts |= PF_OPT_QUIET;
2346 			break;
2347 		case 'F':
2348 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2349 			if (clearopt == NULL) {
2350 				warnx("Unknown flush modifier '%s'", optarg);
2351 				usage();
2352 			}
2353 			mode = O_RDWR;
2354 			break;
2355 		case 'i':
2356 			ifaceopt = optarg;
2357 			break;
2358 		case 'k':
2359 			if (state_killers >= 2) {
2360 				warnx("can only specify -k twice");
2361 				usage();
2362 				/* NOTREACHED */
2363 			}
2364 			state_kill[state_killers++] = optarg;
2365 			mode = O_RDWR;
2366 			break;
2367 		case 'K':
2368 			if (src_node_killers >= 2) {
2369 				warnx("can only specify -K twice");
2370 				usage();
2371 				/* NOTREACHED */
2372 			}
2373 			src_node_kill[src_node_killers++] = optarg;
2374 			mode = O_RDWR;
2375 			break;
2376 		case 'm':
2377 			opts |= PF_OPT_MERGE;
2378 			break;
2379 		case 'M':
2380 			opts |= PF_OPT_KILLMATCH;
2381 			break;
2382 		case 'n':
2383 			opts |= PF_OPT_NOACTION;
2384 			break;
2385 		case 'N':
2386 			loadopt |= PFCTL_FLAG_NAT;
2387 			break;
2388 		case 'r':
2389 			opts |= PF_OPT_USEDNS;
2390 			break;
2391 		case 'f':
2392 			rulesopt = optarg;
2393 			mode = O_RDWR;
2394 			break;
2395 		case 'g':
2396 			opts |= PF_OPT_DEBUG;
2397 			break;
2398 		case 'A':
2399 			loadopt |= PFCTL_FLAG_ALTQ;
2400 			break;
2401 		case 'R':
2402 			loadopt |= PFCTL_FLAG_FILTER;
2403 			break;
2404 		case 'o':
2405 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2406 			if (optiopt == NULL) {
2407 				warnx("Unknown optimization '%s'", optarg);
2408 				usage();
2409 			}
2410 			opts |= PF_OPT_OPTIMIZE;
2411 			break;
2412 		case 'O':
2413 			loadopt |= PFCTL_FLAG_OPTION;
2414 			break;
2415 		case 'p':
2416 			pf_device = optarg;
2417 			break;
2418 		case 'P':
2419 			opts |= PF_OPT_NUMERIC;
2420 			break;
2421 		case 's':
2422 			showopt = pfctl_lookup_option(optarg, showopt_list);
2423 			if (showopt == NULL) {
2424 				warnx("Unknown show modifier '%s'", optarg);
2425 				usage();
2426 			}
2427 			break;
2428 		case 't':
2429 			tableopt = optarg;
2430 			break;
2431 		case 'T':
2432 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2433 			if (tblcmdopt == NULL) {
2434 				warnx("Unknown table command '%s'", optarg);
2435 				usage();
2436 			}
2437 			break;
2438 		case 'v':
2439 			if (opts & PF_OPT_VERBOSE)
2440 				opts |= PF_OPT_VERBOSE2;
2441 			opts |= PF_OPT_VERBOSE;
2442 			break;
2443 		case 'x':
2444 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2445 			if (debugopt == NULL) {
2446 				warnx("Unknown debug level '%s'", optarg);
2447 				usage();
2448 			}
2449 			mode = O_RDWR;
2450 			break;
2451 		case 'z':
2452 			opts |= PF_OPT_CLRRULECTRS;
2453 			mode = O_RDWR;
2454 			break;
2455 		case 'h':
2456 			/* FALLTHROUGH */
2457 		default:
2458 			usage();
2459 			/* NOTREACHED */
2460 		}
2461 	}
2462 
2463 	if (tblcmdopt != NULL) {
2464 		argc -= optind;
2465 		argv += optind;
2466 		ch = *tblcmdopt;
2467 		if (ch == 'l') {
2468 			loadopt |= PFCTL_FLAG_TABLE;
2469 			tblcmdopt = NULL;
2470 		} else
2471 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2472 	} else if (argc != optind) {
2473 		warnx("unknown command line argument: %s ...", argv[optind]);
2474 		usage();
2475 		/* NOTREACHED */
2476 	}
2477 	if (loadopt == 0)
2478 		loadopt = ~0;
2479 
2480 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2481 		errx(1, "pfctl: calloc");
2482 	memset(anchorname, 0, sizeof(anchorname));
2483 	if (anchoropt != NULL) {
2484 		int len = strlen(anchoropt);
2485 
2486 		if (anchoropt[len - 1] == '*') {
2487 			if (len >= 2 && anchoropt[len - 2] == '/')
2488 				anchoropt[len - 2] = '\0';
2489 			else
2490 				anchoropt[len - 1] = '\0';
2491 			opts |= PF_OPT_RECURSE;
2492 		}
2493 		if (strlcpy(anchorname, anchoropt,
2494 		    sizeof(anchorname)) >= sizeof(anchorname))
2495 			errx(1, "anchor name '%s' too long",
2496 			    anchoropt);
2497 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2498 	}
2499 
2500 	if ((opts & PF_OPT_NOACTION) == 0) {
2501 		dev = open(pf_device, mode);
2502 		if (dev == -1)
2503 			err(1, "%s", pf_device);
2504 		altqsupport = pfctl_test_altqsupport(dev, opts);
2505 	} else {
2506 		dev = open(pf_device, O_RDONLY);
2507 		if (dev >= 0)
2508 			opts |= PF_OPT_DUMMYACTION;
2509 		/* turn off options */
2510 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2511 		clearopt = showopt = debugopt = NULL;
2512 #if !defined(ENABLE_ALTQ)
2513 		altqsupport = 0;
2514 #else
2515 		altqsupport = 1;
2516 #endif
2517 	}
2518 
2519 	if (opts & PF_OPT_DISABLE)
2520 		if (pfctl_disable(dev, opts))
2521 			error = 1;
2522 
2523 	if (showopt != NULL) {
2524 		switch (*showopt) {
2525 		case 'A':
2526 			pfctl_show_anchors(dev, opts, anchorname);
2527 			break;
2528 		case 'r':
2529 			pfctl_load_fingerprints(dev, opts);
2530 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2531 			    anchorname, 0);
2532 			break;
2533 		case 'l':
2534 			pfctl_load_fingerprints(dev, opts);
2535 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2536 			    anchorname, 0);
2537 			break;
2538 		case 'n':
2539 			pfctl_load_fingerprints(dev, opts);
2540 			pfctl_show_nat(dev, opts, anchorname);
2541 			break;
2542 		case 'q':
2543 			pfctl_show_altq(dev, ifaceopt, opts,
2544 			    opts & PF_OPT_VERBOSE2);
2545 			break;
2546 		case 's':
2547 			pfctl_show_states(dev, ifaceopt, opts);
2548 			break;
2549 		case 'S':
2550 			pfctl_show_src_nodes(dev, opts);
2551 			break;
2552 		case 'i':
2553 			pfctl_show_status(dev, opts);
2554 			break;
2555 		case 'R':
2556 			error = pfctl_show_running(dev);
2557 			break;
2558 		case 't':
2559 			pfctl_show_timeouts(dev, opts);
2560 			break;
2561 		case 'm':
2562 			pfctl_show_limits(dev, opts);
2563 			break;
2564 		case 'a':
2565 			opts |= PF_OPT_SHOWALL;
2566 			pfctl_load_fingerprints(dev, opts);
2567 
2568 			pfctl_show_nat(dev, opts, anchorname);
2569 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2570 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2571 			pfctl_show_states(dev, ifaceopt, opts);
2572 			pfctl_show_src_nodes(dev, opts);
2573 			pfctl_show_status(dev, opts);
2574 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2575 			pfctl_show_timeouts(dev, opts);
2576 			pfctl_show_limits(dev, opts);
2577 			pfctl_show_tables(anchorname, opts);
2578 			pfctl_show_fingerprints(opts);
2579 			break;
2580 		case 'T':
2581 			pfctl_show_tables(anchorname, opts);
2582 			break;
2583 		case 'o':
2584 			pfctl_load_fingerprints(dev, opts);
2585 			pfctl_show_fingerprints(opts);
2586 			break;
2587 		case 'I':
2588 			pfctl_show_ifaces(ifaceopt, opts);
2589 			break;
2590 		}
2591 	}
2592 
2593 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2594 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2595 		    anchorname, 0);
2596 
2597 	if (clearopt != NULL) {
2598 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2599 			errx(1, "anchor names beginning with '_' cannot "
2600 			    "be modified from the command line");
2601 
2602 		switch (*clearopt) {
2603 		case 'r':
2604 			pfctl_clear_rules(dev, opts, anchorname);
2605 			break;
2606 		case 'n':
2607 			pfctl_clear_nat(dev, opts, anchorname);
2608 			break;
2609 		case 'q':
2610 			pfctl_clear_altq(dev, opts);
2611 			break;
2612 		case 's':
2613 			pfctl_clear_iface_states(dev, ifaceopt, opts);
2614 			break;
2615 		case 'S':
2616 			pfctl_clear_src_nodes(dev, opts);
2617 			break;
2618 		case 'i':
2619 			pfctl_clear_stats(dev, opts);
2620 			break;
2621 		case 'a':
2622 			pfctl_clear_rules(dev, opts, anchorname);
2623 			pfctl_clear_nat(dev, opts, anchorname);
2624 			pfctl_clear_tables(anchorname, opts);
2625 			if (!*anchorname) {
2626 				pfctl_clear_altq(dev, opts);
2627 				pfctl_clear_iface_states(dev, ifaceopt, opts);
2628 				pfctl_clear_src_nodes(dev, opts);
2629 				pfctl_clear_stats(dev, opts);
2630 				pfctl_clear_fingerprints(dev, opts);
2631 				pfctl_clear_interface_flags(dev, opts);
2632 			}
2633 			break;
2634 		case 'o':
2635 			pfctl_clear_fingerprints(dev, opts);
2636 			break;
2637 		case 'T':
2638 			pfctl_clear_tables(anchorname, opts);
2639 			break;
2640 		}
2641 	}
2642 	if (state_killers) {
2643 		if (!strcmp(state_kill[0], "label"))
2644 			pfctl_label_kill_states(dev, ifaceopt, opts);
2645 		else if (!strcmp(state_kill[0], "id"))
2646 			pfctl_id_kill_states(dev, ifaceopt, opts);
2647 		else if (!strcmp(state_kill[0], "gateway"))
2648 			pfctl_gateway_kill_states(dev, ifaceopt, opts);
2649 		else
2650 			pfctl_net_kill_states(dev, ifaceopt, opts);
2651 	}
2652 
2653 	if (src_node_killers)
2654 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
2655 
2656 	if (tblcmdopt != NULL) {
2657 		error = pfctl_command_tables(argc, argv, tableopt,
2658 		    tblcmdopt, rulesopt, anchorname, opts);
2659 		rulesopt = NULL;
2660 	}
2661 	if (optiopt != NULL) {
2662 		switch (*optiopt) {
2663 		case 'n':
2664 			optimize = 0;
2665 			break;
2666 		case 'b':
2667 			optimize |= PF_OPTIMIZE_BASIC;
2668 			break;
2669 		case 'o':
2670 		case 'p':
2671 			optimize |= PF_OPTIMIZE_PROFILE;
2672 			break;
2673 		}
2674 	}
2675 
2676 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2677 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
2678 		if (pfctl_get_skip_ifaces())
2679 			error = 1;
2680 
2681 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2682 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2683 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2684 			error = 1;
2685 
2686 	if (rulesopt != NULL) {
2687 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2688 			errx(1, "anchor names beginning with '_' cannot "
2689 			    "be modified from the command line");
2690 		if (pfctl_rules(dev, rulesopt, opts, optimize,
2691 		    anchorname, NULL))
2692 			error = 1;
2693 		else if (!(opts & PF_OPT_NOACTION) &&
2694 		    (loadopt & PFCTL_FLAG_TABLE))
2695 			warn_namespace_collision(NULL);
2696 	}
2697 
2698 	if (opts & PF_OPT_ENABLE)
2699 		if (pfctl_enable(dev, opts))
2700 			error = 1;
2701 
2702 	if (debugopt != NULL) {
2703 		switch (*debugopt) {
2704 		case 'n':
2705 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
2706 			break;
2707 		case 'u':
2708 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2709 			break;
2710 		case 'm':
2711 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
2712 			break;
2713 		case 'l':
2714 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2715 			break;
2716 		}
2717 	}
2718 
2719 	exit(error);
2720 }
2721