xref: /freebsd/sbin/pfctl/pfctl.c (revision 4ba91fa0736bb0672d475b6b56d9e7b06e78ff69)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #define PFIOC_USE_LATEST
40 
41 #include <sys/types.h>
42 #include <sys/ioctl.h>
43 #include <sys/nv.h>
44 #include <sys/socket.h>
45 #include <sys/stat.h>
46 #include <sys/endian.h>
47 
48 #include <net/if.h>
49 #include <netinet/in.h>
50 #include <net/pfvar.h>
51 #include <arpa/inet.h>
52 #include <net/altq/altq.h>
53 #include <sys/sysctl.h>
54 
55 #include <err.h>
56 #include <errno.h>
57 #include <fcntl.h>
58 #include <libpfctl.h>
59 #include <limits.h>
60 #include <netdb.h>
61 #include <stdint.h>
62 #include <stdio.h>
63 #include <stdlib.h>
64 #include <string.h>
65 #include <unistd.h>
66 
67 #include "pfctl_parser.h"
68 #include "pfctl.h"
69 
70 void	 usage(void);
71 int	 pfctl_enable(int, int);
72 int	 pfctl_disable(int, int);
73 int	 pfctl_clear_stats(int, int);
74 int	 pfctl_get_skip_ifaces(void);
75 int	 pfctl_check_skip_ifaces(char *);
76 int	 pfctl_adjust_skip_ifaces(struct pfctl *);
77 int	 pfctl_clear_interface_flags(int, int);
78 int	 pfctl_clear_rules(int, int, char *);
79 int	 pfctl_clear_nat(int, int, char *);
80 int	 pfctl_clear_altq(int, int);
81 int	 pfctl_clear_src_nodes(int, int);
82 int	 pfctl_clear_states(int, const char *, int);
83 void	 pfctl_addrprefix(char *, struct pf_addr *);
84 int	 pfctl_kill_src_nodes(int, const char *, int);
85 int	 pfctl_net_kill_states(int, const char *, int);
86 int	 pfctl_label_kill_states(int, const char *, int);
87 int	 pfctl_id_kill_states(int, const char *, int);
88 void	 pfctl_init_options(struct pfctl *);
89 int	 pfctl_load_options(struct pfctl *);
90 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
91 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
92 int	 pfctl_load_debug(struct pfctl *, unsigned int);
93 int	 pfctl_load_logif(struct pfctl *, char *);
94 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
95 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
96 	    char *);
97 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
98 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
99 int	 pfctl_show_nat(int, int, char *);
100 int	 pfctl_show_src_nodes(int, int);
101 int	 pfctl_show_states(int, const char *, int);
102 int	 pfctl_show_status(int, int);
103 int	 pfctl_show_running(int);
104 int	 pfctl_show_timeouts(int, int);
105 int	 pfctl_show_limits(int, int);
106 void	 pfctl_debug(int, u_int32_t, int);
107 int	 pfctl_test_altqsupport(int, int);
108 int	 pfctl_show_anchors(int, int, char *);
109 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *);
110 int	 pfctl_load_ruleset(struct pfctl *, char *,
111 		struct pfctl_ruleset *, int, int);
112 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
113 const char	*pfctl_lookup_option(char *, const char * const *);
114 
115 static struct pfctl_anchor_global	 pf_anchors;
116 static struct pfctl_anchor	 pf_main_anchor;
117 static struct pfr_buffer skip_b;
118 
119 static const char	*clearopt;
120 static char		*rulesopt;
121 static const char	*showopt;
122 static const char	*debugopt;
123 static char		*anchoropt;
124 static const char	*optiopt = NULL;
125 static const char	*pf_device = "/dev/pf";
126 static char		*ifaceopt;
127 static char		*tableopt;
128 static const char	*tblcmdopt;
129 static int		 src_node_killers;
130 static char		*src_node_kill[2];
131 static int		 state_killers;
132 static char		*state_kill[2];
133 int			 loadopt;
134 int			 altqsupport;
135 
136 int			 dev = -1;
137 static int		 first_title = 1;
138 static int		 labels = 0;
139 
140 #define INDENT(d, o)	do {						\
141 				if (o) {				\
142 					int i;				\
143 					for (i=0; i < d; i++)		\
144 						printf("  ");		\
145 				}					\
146 			} while (0);					\
147 
148 
149 static const struct {
150 	const char	*name;
151 	int		index;
152 } pf_limits[] = {
153 	{ "states",		PF_LIMIT_STATES },
154 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
155 	{ "frags",		PF_LIMIT_FRAGS },
156 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
157 	{ NULL,			0 }
158 };
159 
160 struct pf_hint {
161 	const char	*name;
162 	int		timeout;
163 };
164 static const struct pf_hint pf_hint_normal[] = {
165 	{ "tcp.first",		2 * 60 },
166 	{ "tcp.opening",	30 },
167 	{ "tcp.established",	24 * 60 * 60 },
168 	{ "tcp.closing",	15 * 60 },
169 	{ "tcp.finwait",	45 },
170 	{ "tcp.closed",		90 },
171 	{ "tcp.tsdiff",		30 },
172 	{ NULL,			0 }
173 };
174 static const struct pf_hint pf_hint_satellite[] = {
175 	{ "tcp.first",		3 * 60 },
176 	{ "tcp.opening",	30 + 5 },
177 	{ "tcp.established",	24 * 60 * 60 },
178 	{ "tcp.closing",	15 * 60 + 5 },
179 	{ "tcp.finwait",	45 + 5 },
180 	{ "tcp.closed",		90 + 5 },
181 	{ "tcp.tsdiff",		60 },
182 	{ NULL,			0 }
183 };
184 static const struct pf_hint pf_hint_conservative[] = {
185 	{ "tcp.first",		60 * 60 },
186 	{ "tcp.opening",	15 * 60 },
187 	{ "tcp.established",	5 * 24 * 60 * 60 },
188 	{ "tcp.closing",	60 * 60 },
189 	{ "tcp.finwait",	10 * 60 },
190 	{ "tcp.closed",		3 * 60 },
191 	{ "tcp.tsdiff",		60 },
192 	{ NULL,			0 }
193 };
194 static const struct pf_hint pf_hint_aggressive[] = {
195 	{ "tcp.first",		30 },
196 	{ "tcp.opening",	5 },
197 	{ "tcp.established",	5 * 60 * 60 },
198 	{ "tcp.closing",	60 },
199 	{ "tcp.finwait",	30 },
200 	{ "tcp.closed",		30 },
201 	{ "tcp.tsdiff",		10 },
202 	{ NULL,			0 }
203 };
204 
205 static const struct {
206 	const char *name;
207 	const struct pf_hint *hint;
208 } pf_hints[] = {
209 	{ "normal",		pf_hint_normal },
210 	{ "satellite",		pf_hint_satellite },
211 	{ "high-latency",	pf_hint_satellite },
212 	{ "conservative",	pf_hint_conservative },
213 	{ "aggressive",		pf_hint_aggressive },
214 	{ NULL,			NULL }
215 };
216 
217 static const char * const clearopt_list[] = {
218 	"nat", "queue", "rules", "Sources",
219 	"states", "info", "Tables", "osfp", "all", NULL
220 };
221 
222 static const char * const showopt_list[] = {
223 	"nat", "queue", "rules", "Anchors", "Sources", "states", "info",
224 	"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
225 	"Running", "all", NULL
226 };
227 
228 static const char * const tblcmdopt_list[] = {
229 	"kill", "flush", "add", "delete", "load", "replace", "show",
230 	"test", "zero", "expire", NULL
231 };
232 
233 static const char * const debugopt_list[] = {
234 	"none", "urgent", "misc", "loud", NULL
235 };
236 
237 static const char * const optiopt_list[] = {
238 	"none", "basic", "profile", NULL
239 };
240 
241 void
242 usage(void)
243 {
244 	extern char *__progname;
245 
246 	fprintf(stderr,
247 "usage: %s [-AdeghmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
248 	"\t[-f file] [-i interface] [-K host | network]\n"
249 	"\t[-k host | network | label | id] [-o level] [-p device]\n"
250 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
251 	    __progname);
252 
253 	exit(1);
254 }
255 
256 int
257 pfctl_enable(int dev, int opts)
258 {
259 	if (ioctl(dev, DIOCSTART)) {
260 		if (errno == EEXIST)
261 			errx(1, "pf already enabled");
262 		else if (errno == ESRCH)
263 			errx(1, "pfil registeration failed");
264 		else
265 			err(1, "DIOCSTART");
266 	}
267 	if ((opts & PF_OPT_QUIET) == 0)
268 		fprintf(stderr, "pf enabled\n");
269 
270 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
271 		if (errno != EEXIST)
272 			err(1, "DIOCSTARTALTQ");
273 
274 	return (0);
275 }
276 
277 int
278 pfctl_disable(int dev, int opts)
279 {
280 	if (ioctl(dev, DIOCSTOP)) {
281 		if (errno == ENOENT)
282 			errx(1, "pf not enabled");
283 		else
284 			err(1, "DIOCSTOP");
285 	}
286 	if ((opts & PF_OPT_QUIET) == 0)
287 		fprintf(stderr, "pf disabled\n");
288 
289 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
290 			if (errno != ENOENT)
291 				err(1, "DIOCSTOPALTQ");
292 
293 	return (0);
294 }
295 
296 int
297 pfctl_clear_stats(int dev, int opts)
298 {
299 	if (ioctl(dev, DIOCCLRSTATUS))
300 		err(1, "DIOCCLRSTATUS");
301 	if ((opts & PF_OPT_QUIET) == 0)
302 		fprintf(stderr, "pf: statistics cleared\n");
303 	return (0);
304 }
305 
306 int
307 pfctl_get_skip_ifaces(void)
308 {
309 	bzero(&skip_b, sizeof(skip_b));
310 	skip_b.pfrb_type = PFRB_IFACES;
311 	for (;;) {
312 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
313 		skip_b.pfrb_size = skip_b.pfrb_msize;
314 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
315 			err(1, "pfi_get_ifaces");
316 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
317 			break;
318 	}
319 	return (0);
320 }
321 
322 int
323 pfctl_check_skip_ifaces(char *ifname)
324 {
325 	struct pfi_kif		*p;
326 	struct node_host	*h = NULL, *n = NULL;
327 
328 	PFRB_FOREACH(p, &skip_b) {
329 		if (!strcmp(ifname, p->pfik_name) &&
330 		    (p->pfik_flags & PFI_IFLAG_SKIP))
331 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
332 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
333 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
334 				continue;
335 
336 			for (n = h; n != NULL; n = n->next) {
337 				if (p->pfik_ifp == NULL)
338 					continue;
339 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
340 					continue;
341 
342 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
343 			}
344 		}
345 	}
346 	return (0);
347 }
348 
349 int
350 pfctl_adjust_skip_ifaces(struct pfctl *pf)
351 {
352 	struct pfi_kif		*p, *pp;
353 	struct node_host	*h = NULL, *n = NULL;
354 
355 	PFRB_FOREACH(p, &skip_b) {
356 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
357 			continue;
358 
359 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
360 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
361 			continue;
362 
363 		for (n = h; n != NULL; n = n->next)
364 			PFRB_FOREACH(pp, &skip_b) {
365 				if (pp->pfik_ifp == NULL)
366 					continue;
367 
368 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
369 					continue;
370 
371 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
372 					pfctl_set_interface_flags(pf,
373 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
374 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
375 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
376 			}
377 	}
378 
379 	PFRB_FOREACH(p, &skip_b) {
380 		if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
381 			continue;
382 
383 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
384 	}
385 
386 	return (0);
387 }
388 
389 int
390 pfctl_clear_interface_flags(int dev, int opts)
391 {
392 	struct pfioc_iface	pi;
393 
394 	if ((opts & PF_OPT_NOACTION) == 0) {
395 		bzero(&pi, sizeof(pi));
396 		pi.pfiio_flags = PFI_IFLAG_SKIP;
397 
398 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
399 			err(1, "DIOCCLRIFFLAG");
400 		if ((opts & PF_OPT_QUIET) == 0)
401 			fprintf(stderr, "pf: interface flags reset\n");
402 	}
403 	return (0);
404 }
405 
406 int
407 pfctl_clear_rules(int dev, int opts, char *anchorname)
408 {
409 	struct pfr_buffer t;
410 
411 	memset(&t, 0, sizeof(t));
412 	t.pfrb_type = PFRB_TRANS;
413 	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
414 	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
415 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
416 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
417 		err(1, "pfctl_clear_rules");
418 	if ((opts & PF_OPT_QUIET) == 0)
419 		fprintf(stderr, "rules cleared\n");
420 	return (0);
421 }
422 
423 int
424 pfctl_clear_nat(int dev, int opts, char *anchorname)
425 {
426 	struct pfr_buffer t;
427 
428 	memset(&t, 0, sizeof(t));
429 	t.pfrb_type = PFRB_TRANS;
430 	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
431 	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
432 	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
433 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
434 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
435 		err(1, "pfctl_clear_nat");
436 	if ((opts & PF_OPT_QUIET) == 0)
437 		fprintf(stderr, "nat cleared\n");
438 	return (0);
439 }
440 
441 int
442 pfctl_clear_altq(int dev, int opts)
443 {
444 	struct pfr_buffer t;
445 
446 	if (!altqsupport)
447 		return (-1);
448 	memset(&t, 0, sizeof(t));
449 	t.pfrb_type = PFRB_TRANS;
450 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
451 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
452 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
453 		err(1, "pfctl_clear_altq");
454 	if ((opts & PF_OPT_QUIET) == 0)
455 		fprintf(stderr, "altq cleared\n");
456 	return (0);
457 }
458 
459 int
460 pfctl_clear_src_nodes(int dev, int opts)
461 {
462 	if (ioctl(dev, DIOCCLRSRCNODES))
463 		err(1, "DIOCCLRSRCNODES");
464 	if ((opts & PF_OPT_QUIET) == 0)
465 		fprintf(stderr, "source tracking entries cleared\n");
466 	return (0);
467 }
468 
469 int
470 pfctl_clear_states(int dev, const char *iface, int opts)
471 {
472 	struct pfioc_state_kill psk;
473 
474 	memset(&psk, 0, sizeof(psk));
475 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
476 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
477 		errx(1, "invalid interface: %s", iface);
478 
479 	if (ioctl(dev, DIOCCLRSTATES, &psk))
480 		err(1, "DIOCCLRSTATES");
481 	if ((opts & PF_OPT_QUIET) == 0)
482 		fprintf(stderr, "%d states cleared\n", psk.psk_killed);
483 	return (0);
484 }
485 
486 void
487 pfctl_addrprefix(char *addr, struct pf_addr *mask)
488 {
489 	char *p;
490 	const char *errstr;
491 	int prefix, ret_ga, q, r;
492 	struct addrinfo hints, *res;
493 
494 	if ((p = strchr(addr, '/')) == NULL)
495 		return;
496 
497 	*p++ = '\0';
498 	prefix = strtonum(p, 0, 128, &errstr);
499 	if (errstr)
500 		errx(1, "prefix is %s: %s", errstr, p);
501 
502 	bzero(&hints, sizeof(hints));
503 	/* prefix only with numeric addresses */
504 	hints.ai_flags |= AI_NUMERICHOST;
505 
506 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
507 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
508 		/* NOTREACHED */
509 	}
510 
511 	if (res->ai_family == AF_INET && prefix > 32)
512 		errx(1, "prefix too long for AF_INET");
513 	else if (res->ai_family == AF_INET6 && prefix > 128)
514 		errx(1, "prefix too long for AF_INET6");
515 
516 	q = prefix >> 3;
517 	r = prefix & 7;
518 	switch (res->ai_family) {
519 	case AF_INET:
520 		bzero(&mask->v4, sizeof(mask->v4));
521 		mask->v4.s_addr = htonl((u_int32_t)
522 		    (0xffffffffffULL << (32 - prefix)));
523 		break;
524 	case AF_INET6:
525 		bzero(&mask->v6, sizeof(mask->v6));
526 		if (q > 0)
527 			memset((void *)&mask->v6, 0xff, q);
528 		if (r > 0)
529 			*((u_char *)&mask->v6 + q) =
530 			    (0xff00 >> r) & 0xff;
531 		break;
532 	}
533 	freeaddrinfo(res);
534 }
535 
536 int
537 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
538 {
539 	struct pfioc_src_node_kill psnk;
540 	struct addrinfo *res[2], *resp[2];
541 	struct sockaddr last_src, last_dst;
542 	int killed, sources, dests;
543 	int ret_ga;
544 
545 	killed = sources = dests = 0;
546 
547 	memset(&psnk, 0, sizeof(psnk));
548 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
549 	    sizeof(psnk.psnk_src.addr.v.a.mask));
550 	memset(&last_src, 0xff, sizeof(last_src));
551 	memset(&last_dst, 0xff, sizeof(last_dst));
552 
553 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
554 
555 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
556 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
557 		/* NOTREACHED */
558 	}
559 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
560 		if (resp[0]->ai_addr == NULL)
561 			continue;
562 		/* We get lots of duplicates.  Catch the easy ones */
563 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
564 			continue;
565 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
566 
567 		psnk.psnk_af = resp[0]->ai_family;
568 		sources++;
569 
570 		if (psnk.psnk_af == AF_INET)
571 			psnk.psnk_src.addr.v.a.addr.v4 =
572 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
573 		else if (psnk.psnk_af == AF_INET6)
574 			psnk.psnk_src.addr.v.a.addr.v6 =
575 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
576 			    sin6_addr;
577 		else
578 			errx(1, "Unknown address family %d", psnk.psnk_af);
579 
580 		if (src_node_killers > 1) {
581 			dests = 0;
582 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
583 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
584 			memset(&last_dst, 0xff, sizeof(last_dst));
585 			pfctl_addrprefix(src_node_kill[1],
586 			    &psnk.psnk_dst.addr.v.a.mask);
587 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
588 			    &res[1]))) {
589 				errx(1, "getaddrinfo: %s",
590 				    gai_strerror(ret_ga));
591 				/* NOTREACHED */
592 			}
593 			for (resp[1] = res[1]; resp[1];
594 			    resp[1] = resp[1]->ai_next) {
595 				if (resp[1]->ai_addr == NULL)
596 					continue;
597 				if (psnk.psnk_af != resp[1]->ai_family)
598 					continue;
599 
600 				if (memcmp(&last_dst, resp[1]->ai_addr,
601 				    sizeof(last_dst)) == 0)
602 					continue;
603 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
604 
605 				dests++;
606 
607 				if (psnk.psnk_af == AF_INET)
608 					psnk.psnk_dst.addr.v.a.addr.v4 =
609 					    ((struct sockaddr_in *)resp[1]->
610 					    ai_addr)->sin_addr;
611 				else if (psnk.psnk_af == AF_INET6)
612 					psnk.psnk_dst.addr.v.a.addr.v6 =
613 					    ((struct sockaddr_in6 *)resp[1]->
614 					    ai_addr)->sin6_addr;
615 				else
616 					errx(1, "Unknown address family %d",
617 					    psnk.psnk_af);
618 
619 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
620 					err(1, "DIOCKILLSRCNODES");
621 				killed += psnk.psnk_killed;
622 			}
623 			freeaddrinfo(res[1]);
624 		} else {
625 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
626 				err(1, "DIOCKILLSRCNODES");
627 			killed += psnk.psnk_killed;
628 		}
629 	}
630 
631 	freeaddrinfo(res[0]);
632 
633 	if ((opts & PF_OPT_QUIET) == 0)
634 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
635 		    "destinations\n", killed, sources, dests);
636 	return (0);
637 }
638 
639 int
640 pfctl_net_kill_states(int dev, const char *iface, int opts)
641 {
642 	struct pfioc_state_kill psk;
643 	struct addrinfo *res[2], *resp[2];
644 	struct sockaddr last_src, last_dst;
645 	int killed, sources, dests;
646 	int ret_ga;
647 
648 	killed = sources = dests = 0;
649 
650 	memset(&psk, 0, sizeof(psk));
651 	memset(&psk.psk_src.addr.v.a.mask, 0xff,
652 	    sizeof(psk.psk_src.addr.v.a.mask));
653 	memset(&last_src, 0xff, sizeof(last_src));
654 	memset(&last_dst, 0xff, sizeof(last_dst));
655 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
656 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
657 		errx(1, "invalid interface: %s", iface);
658 
659 	pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
660 
661 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
662 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
663 		/* NOTREACHED */
664 	}
665 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
666 		if (resp[0]->ai_addr == NULL)
667 			continue;
668 		/* We get lots of duplicates.  Catch the easy ones */
669 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
670 			continue;
671 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
672 
673 		psk.psk_af = resp[0]->ai_family;
674 		sources++;
675 
676 		if (psk.psk_af == AF_INET)
677 			psk.psk_src.addr.v.a.addr.v4 =
678 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
679 		else if (psk.psk_af == AF_INET6)
680 			psk.psk_src.addr.v.a.addr.v6 =
681 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
682 			    sin6_addr;
683 		else
684 			errx(1, "Unknown address family %d", psk.psk_af);
685 
686 		if (state_killers > 1) {
687 			dests = 0;
688 			memset(&psk.psk_dst.addr.v.a.mask, 0xff,
689 			    sizeof(psk.psk_dst.addr.v.a.mask));
690 			memset(&last_dst, 0xff, sizeof(last_dst));
691 			pfctl_addrprefix(state_kill[1],
692 			    &psk.psk_dst.addr.v.a.mask);
693 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
694 			    &res[1]))) {
695 				errx(1, "getaddrinfo: %s",
696 				    gai_strerror(ret_ga));
697 				/* NOTREACHED */
698 			}
699 			for (resp[1] = res[1]; resp[1];
700 			    resp[1] = resp[1]->ai_next) {
701 				if (resp[1]->ai_addr == NULL)
702 					continue;
703 				if (psk.psk_af != resp[1]->ai_family)
704 					continue;
705 
706 				if (memcmp(&last_dst, resp[1]->ai_addr,
707 				    sizeof(last_dst)) == 0)
708 					continue;
709 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
710 
711 				dests++;
712 
713 				if (psk.psk_af == AF_INET)
714 					psk.psk_dst.addr.v.a.addr.v4 =
715 					    ((struct sockaddr_in *)resp[1]->
716 					    ai_addr)->sin_addr;
717 				else if (psk.psk_af == AF_INET6)
718 					psk.psk_dst.addr.v.a.addr.v6 =
719 					    ((struct sockaddr_in6 *)resp[1]->
720 					    ai_addr)->sin6_addr;
721 				else
722 					errx(1, "Unknown address family %d",
723 					    psk.psk_af);
724 
725 				if (ioctl(dev, DIOCKILLSTATES, &psk))
726 					err(1, "DIOCKILLSTATES");
727 				killed += psk.psk_killed;
728 			}
729 			freeaddrinfo(res[1]);
730 		} else {
731 			if (ioctl(dev, DIOCKILLSTATES, &psk))
732 				err(1, "DIOCKILLSTATES");
733 			killed += psk.psk_killed;
734 		}
735 	}
736 
737 	freeaddrinfo(res[0]);
738 
739 	if ((opts & PF_OPT_QUIET) == 0)
740 		fprintf(stderr, "killed %d states from %d sources and %d "
741 		    "destinations\n", killed, sources, dests);
742 	return (0);
743 }
744 
745 int
746 pfctl_label_kill_states(int dev, const char *iface, int opts)
747 {
748 	struct pfioc_state_kill psk;
749 
750 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
751 		warnx("no label specified");
752 		usage();
753 	}
754 	memset(&psk, 0, sizeof(psk));
755 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
756 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
757 		errx(1, "invalid interface: %s", iface);
758 
759 	if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
760 	    sizeof(psk.psk_label))
761 		errx(1, "label too long: %s", state_kill[1]);
762 
763 	if (ioctl(dev, DIOCKILLSTATES, &psk))
764 		err(1, "DIOCKILLSTATES");
765 
766 	if ((opts & PF_OPT_QUIET) == 0)
767 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
768 
769 	return (0);
770 }
771 
772 int
773 pfctl_id_kill_states(int dev, const char *iface, int opts)
774 {
775 	struct pfioc_state_kill psk;
776 
777 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
778 		warnx("no id specified");
779 		usage();
780 	}
781 
782 	memset(&psk, 0, sizeof(psk));
783 	if ((sscanf(state_kill[1], "%jx/%x",
784 	    &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
785 		HTONL(psk.psk_pfcmp.creatorid);
786 	else if ((sscanf(state_kill[1], "%jx", &psk.psk_pfcmp.id)) == 1) {
787 		psk.psk_pfcmp.creatorid = 0;
788 	} else {
789 		warnx("wrong id format specified");
790 		usage();
791 	}
792 	if (psk.psk_pfcmp.id == 0) {
793 		warnx("cannot kill id 0");
794 		usage();
795 	}
796 
797 	psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
798 	if (ioctl(dev, DIOCKILLSTATES, &psk))
799 		err(1, "DIOCKILLSTATES");
800 
801 	if ((opts & PF_OPT_QUIET) == 0)
802 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
803 
804 	return (0);
805 }
806 
807 int
808 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
809     u_int32_t ticket, int r_action, char *anchorname)
810 {
811 	struct pfioc_pooladdr pp;
812 	struct pf_pooladdr *pa;
813 	u_int32_t pnr, mpnr;
814 
815 	memset(&pp, 0, sizeof(pp));
816 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
817 	pp.r_action = r_action;
818 	pp.r_num = nr;
819 	pp.ticket = ticket;
820 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
821 		warn("DIOCGETADDRS");
822 		return (-1);
823 	}
824 	mpnr = pp.nr;
825 	TAILQ_INIT(&pool->list);
826 	for (pnr = 0; pnr < mpnr; ++pnr) {
827 		pp.nr = pnr;
828 		if (ioctl(dev, DIOCGETADDR, &pp)) {
829 			warn("DIOCGETADDR");
830 			return (-1);
831 		}
832 		pa = calloc(1, sizeof(struct pf_pooladdr));
833 		if (pa == NULL)
834 			err(1, "calloc");
835 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
836 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
837 	}
838 
839 	return (0);
840 }
841 
842 void
843 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
844 {
845 	struct pf_pooladdr *pa;
846 
847 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
848 		TAILQ_REMOVE(&src->list, pa, entries);
849 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
850 	}
851 }
852 
853 void
854 pfctl_clear_pool(struct pfctl_pool *pool)
855 {
856 	struct pf_pooladdr *pa;
857 
858 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
859 		TAILQ_REMOVE(&pool->list, pa, entries);
860 		free(pa);
861 	}
862 }
863 
864 void
865 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
866 {
867 	if (opts & PF_OPT_DEBUG) {
868 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
869 		    "p", "sa", "sp", "da", "dp" };
870 		int i;
871 
872 		printf("  [ Skip steps: ");
873 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
874 			if (rule->skip[i].nr == rule->nr + 1)
875 				continue;
876 			printf("%s=", t[i]);
877 			if (rule->skip[i].nr == -1)
878 				printf("end ");
879 			else
880 				printf("%u ", rule->skip[i].nr);
881 		}
882 		printf("]\n");
883 
884 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
885 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
886 	}
887 	if (opts & PF_OPT_VERBOSE) {
888 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
889 			    "Bytes: %-10llu  States: %-6ju]\n",
890 			    (unsigned long long)rule->evaluations,
891 			    (unsigned long long)(rule->packets[0] +
892 			    rule->packets[1]),
893 			    (unsigned long long)(rule->bytes[0] +
894 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
895 		if (!(opts & PF_OPT_DEBUG))
896 			printf("  [ Inserted: uid %u pid %u "
897 			    "State Creations: %-6ju]\n",
898 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
899 			    (uintmax_t)rule->states_tot);
900 	}
901 }
902 
903 void
904 pfctl_print_title(char *title)
905 {
906 	if (!first_title)
907 		printf("\n");
908 	first_title = 0;
909 	printf("%s\n", title);
910 }
911 
912 int
913 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
914     char *anchorname, int depth)
915 {
916 	struct pfioc_rule pr;
917 	struct pfctl_rule rule;
918 	u_int32_t nr, mnr, header = 0;
919 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
920 	int numeric = opts & PF_OPT_NUMERIC;
921 	int len = strlen(path);
922 	int brace;
923 	char *p;
924 
925 	if (path[0])
926 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
927 	else
928 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
929 
930 	memset(&pr, 0, sizeof(pr));
931 	memcpy(pr.anchor, path, sizeof(pr.anchor));
932 	if (opts & PF_OPT_SHOWALL) {
933 		pr.rule.action = PF_PASS;
934 		if (ioctl(dev, DIOCGETRULES, &pr)) {
935 			warn("DIOCGETRULES");
936 			goto error;
937 		}
938 		header++;
939 	}
940 	pr.rule.action = PF_SCRUB;
941 	if (ioctl(dev, DIOCGETRULES, &pr)) {
942 		warn("DIOCGETRULES");
943 		goto error;
944 	}
945 	if (opts & PF_OPT_SHOWALL) {
946 		if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
947 			pfctl_print_title("FILTER RULES:");
948 		else if (format == PFCTL_SHOW_LABELS && labels)
949 			pfctl_print_title("LABEL COUNTERS:");
950 	}
951 	mnr = pr.nr;
952 
953 	for (nr = 0; nr < mnr; ++nr) {
954 		pr.nr = nr;
955 		if (pfctl_get_clear_rule(dev, nr, pr.ticket, path, PF_SCRUB,
956 		    &rule, pr.anchor_call, opts & PF_OPT_CLRRULECTRS)) {
957 			warn("DIOCGETRULENV");
958 			goto error;
959 		}
960 
961 		if (pfctl_get_pool(dev, &rule.rpool,
962 		    nr, pr.ticket, PF_SCRUB, path) != 0)
963 			goto error;
964 
965 		switch (format) {
966 		case PFCTL_SHOW_LABELS:
967 			break;
968 		case PFCTL_SHOW_RULES:
969 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
970 				labels = 1;
971 			print_rule(&rule, pr.anchor_call, rule_numbers, numeric);
972 			printf("\n");
973 			pfctl_print_rule_counters(&rule, opts);
974 			break;
975 		case PFCTL_SHOW_NOTHING:
976 			break;
977 		}
978 		pfctl_clear_pool(&rule.rpool);
979 	}
980 	pr.rule.action = PF_PASS;
981 	if (ioctl(dev, DIOCGETRULES, &pr)) {
982 		warn("DIOCGETRULES");
983 		goto error;
984 	}
985 	mnr = pr.nr;
986 	for (nr = 0; nr < mnr; ++nr) {
987 		pr.nr = nr;
988 		if (pfctl_get_clear_rule(dev, nr, pr.ticket, path, PF_PASS,
989 		    &rule, pr.anchor_call, opts & PF_OPT_CLRRULECTRS)) {
990 			warn("DIOCGETRULE");
991 			goto error;
992 		}
993 
994 		if (pfctl_get_pool(dev, &rule.rpool,
995 		    nr, pr.ticket, PF_PASS, path) != 0)
996 			goto error;
997 
998 		switch (format) {
999 		case PFCTL_SHOW_LABELS:
1000 			if (rule.label[0]) {
1001 				printf("%s %llu %llu %llu %llu"
1002 				    " %llu %llu %llu %ju\n",
1003 				    rule.label,
1004 				    (unsigned long long)rule.evaluations,
1005 				    (unsigned long long)(rule.packets[0] +
1006 				    rule.packets[1]),
1007 				    (unsigned long long)(rule.bytes[0] +
1008 				    rule.bytes[1]),
1009 				    (unsigned long long)rule.packets[0],
1010 				    (unsigned long long)rule.bytes[0],
1011 				    (unsigned long long)rule.packets[1],
1012 				    (unsigned long long)rule.bytes[1],
1013 				    (uintmax_t)rule.states_tot);
1014 			}
1015 			break;
1016 		case PFCTL_SHOW_RULES:
1017 			brace = 0;
1018 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1019 				labels = 1;
1020 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1021 			if (pr.anchor_call[0] &&
1022 			   ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
1023 			   ((void *)p == (void *)pr.anchor_call ||
1024 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1025 				brace++;
1026 				if ((p = strrchr(pr.anchor_call, '/')) !=
1027 				    NULL)
1028 					p++;
1029 				else
1030 					p = &pr.anchor_call[0];
1031 			} else
1032 				p = &pr.anchor_call[0];
1033 
1034 			print_rule(&rule, p, rule_numbers, numeric);
1035 			if (brace)
1036 				printf(" {\n");
1037 			else
1038 				printf("\n");
1039 			pfctl_print_rule_counters(&rule, opts);
1040 			if (brace) {
1041 				pfctl_show_rules(dev, path, opts, format,
1042 				    p, depth + 1);
1043 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1044 				printf("}\n");
1045 			}
1046 			break;
1047 		case PFCTL_SHOW_NOTHING:
1048 			break;
1049 		}
1050 		pfctl_clear_pool(&rule.rpool);
1051 	}
1052 	path[len] = '\0';
1053 	return (0);
1054 
1055  error:
1056 	path[len] = '\0';
1057 	return (-1);
1058 }
1059 
1060 int
1061 pfctl_show_nat(int dev, int opts, char *anchorname)
1062 {
1063 	struct pfioc_rule pr;
1064 	struct pfctl_rule rule;
1065 	u_int32_t mnr, nr;
1066 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1067 	int i, dotitle = opts & PF_OPT_SHOWALL;
1068 
1069 	memset(&pr, 0, sizeof(pr));
1070 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
1071 	for (i = 0; i < 3; i++) {
1072 		pr.rule.action = nattype[i];
1073 		if (ioctl(dev, DIOCGETRULES, &pr)) {
1074 			warn("DIOCGETRULES");
1075 			return (-1);
1076 		}
1077 		mnr = pr.nr;
1078 		for (nr = 0; nr < mnr; ++nr) {
1079 			pr.nr = nr;
1080 			if (pfctl_get_rule(dev, nr, pr.ticket, anchorname,
1081 			    nattype[i], &rule, pr.anchor_call)) {
1082 				warn("DIOCGETRULE");
1083 				return (-1);
1084 			}
1085 			if (pfctl_get_pool(dev, &rule.rpool, nr,
1086 			    pr.ticket, nattype[i], anchorname) != 0)
1087 				return (-1);
1088 			if (dotitle) {
1089 				pfctl_print_title("TRANSLATION RULES:");
1090 				dotitle = 0;
1091 			}
1092 			print_rule(&rule, pr.anchor_call,
1093 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1094 			printf("\n");
1095 			pfctl_print_rule_counters(&rule, opts);
1096 			pfctl_clear_pool(&rule.rpool);
1097 		}
1098 	}
1099 	return (0);
1100 }
1101 
1102 int
1103 pfctl_show_src_nodes(int dev, int opts)
1104 {
1105 	struct pfioc_src_nodes psn;
1106 	struct pf_src_node *p;
1107 	char *inbuf = NULL, *newinbuf = NULL;
1108 	unsigned int len = 0;
1109 	int i;
1110 
1111 	memset(&psn, 0, sizeof(psn));
1112 	for (;;) {
1113 		psn.psn_len = len;
1114 		if (len) {
1115 			newinbuf = realloc(inbuf, len);
1116 			if (newinbuf == NULL)
1117 				err(1, "realloc");
1118 			psn.psn_buf = inbuf = newinbuf;
1119 		}
1120 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1121 			warn("DIOCGETSRCNODES");
1122 			free(inbuf);
1123 			return (-1);
1124 		}
1125 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1126 			break;
1127 		if (len == 0 && psn.psn_len == 0)
1128 			goto done;
1129 		if (len == 0 && psn.psn_len != 0)
1130 			len = psn.psn_len;
1131 		if (psn.psn_len == 0)
1132 			goto done;	/* no src_nodes */
1133 		len *= 2;
1134 	}
1135 	p = psn.psn_src_nodes;
1136 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1137 		pfctl_print_title("SOURCE TRACKING NODES:");
1138 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1139 		print_src_node(p, opts);
1140 		p++;
1141 	}
1142 done:
1143 	free(inbuf);
1144 	return (0);
1145 }
1146 
1147 int
1148 pfctl_show_states(int dev, const char *iface, int opts)
1149 {
1150 	struct pfioc_states ps;
1151 	struct pfsync_state *p;
1152 	char *inbuf = NULL, *newinbuf = NULL;
1153 	unsigned int len = 0;
1154 	int i, dotitle = (opts & PF_OPT_SHOWALL);
1155 
1156 	memset(&ps, 0, sizeof(ps));
1157 	for (;;) {
1158 		ps.ps_len = len;
1159 		if (len) {
1160 			newinbuf = realloc(inbuf, len);
1161 			if (newinbuf == NULL)
1162 				err(1, "realloc");
1163 			ps.ps_buf = inbuf = newinbuf;
1164 		}
1165 		if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1166 			warn("DIOCGETSTATES");
1167 			free(inbuf);
1168 			return (-1);
1169 		}
1170 		if (ps.ps_len + sizeof(struct pfioc_states) < len)
1171 			break;
1172 		if (len == 0 && ps.ps_len == 0)
1173 			goto done;
1174 		if (len == 0 && ps.ps_len != 0)
1175 			len = ps.ps_len;
1176 		if (ps.ps_len == 0)
1177 			goto done;	/* no states */
1178 		len *= 2;
1179 	}
1180 	p = ps.ps_states;
1181 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1182 		if (iface != NULL && strcmp(p->ifname, iface))
1183 			continue;
1184 		if (dotitle) {
1185 			pfctl_print_title("STATES:");
1186 			dotitle = 0;
1187 		}
1188 		print_state(p, opts);
1189 	}
1190 done:
1191 	free(inbuf);
1192 	return (0);
1193 }
1194 
1195 int
1196 pfctl_show_status(int dev, int opts)
1197 {
1198 	struct pf_status status;
1199 
1200 	if (ioctl(dev, DIOCGETSTATUS, &status)) {
1201 		warn("DIOCGETSTATUS");
1202 		return (-1);
1203 	}
1204 	if (opts & PF_OPT_SHOWALL)
1205 		pfctl_print_title("INFO:");
1206 	print_status(&status, opts);
1207 	return (0);
1208 }
1209 
1210 int
1211 pfctl_show_running(int dev)
1212 {
1213 	struct pf_status status;
1214 
1215 	if (ioctl(dev, DIOCGETSTATUS, &status)) {
1216 		warn("DIOCGETSTATUS");
1217 		return (-1);
1218 	}
1219 
1220 	print_running(&status);
1221 	return (!status.running);
1222 }
1223 
1224 int
1225 pfctl_show_timeouts(int dev, int opts)
1226 {
1227 	struct pfioc_tm pt;
1228 	int i;
1229 
1230 	if (opts & PF_OPT_SHOWALL)
1231 		pfctl_print_title("TIMEOUTS:");
1232 	memset(&pt, 0, sizeof(pt));
1233 	for (i = 0; pf_timeouts[i].name; i++) {
1234 		pt.timeout = pf_timeouts[i].timeout;
1235 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1236 			err(1, "DIOCGETTIMEOUT");
1237 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1238 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1239 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1240 			printf(" states");
1241 		else
1242 			printf("s");
1243 		printf("\n");
1244 	}
1245 	return (0);
1246 
1247 }
1248 
1249 int
1250 pfctl_show_limits(int dev, int opts)
1251 {
1252 	struct pfioc_limit pl;
1253 	int i;
1254 
1255 	if (opts & PF_OPT_SHOWALL)
1256 		pfctl_print_title("LIMITS:");
1257 	memset(&pl, 0, sizeof(pl));
1258 	for (i = 0; pf_limits[i].name; i++) {
1259 		pl.index = pf_limits[i].index;
1260 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1261 			err(1, "DIOCGETLIMIT");
1262 		printf("%-13s ", pf_limits[i].name);
1263 		if (pl.limit == UINT_MAX)
1264 			printf("unlimited\n");
1265 		else
1266 			printf("hard limit %8u\n", pl.limit);
1267 	}
1268 	return (0);
1269 }
1270 
1271 /* callbacks for rule/nat/rdr/addr */
1272 int
1273 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1274 {
1275 	struct pf_pooladdr *pa;
1276 
1277 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1278 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1279 			err(1, "DIOCBEGINADDRS");
1280 	}
1281 
1282 	pf->paddr.af = af;
1283 	TAILQ_FOREACH(pa, &p->list, entries) {
1284 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1285 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1286 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1287 				err(1, "DIOCADDADDR");
1288 		}
1289 	}
1290 	return (0);
1291 }
1292 
1293 int
1294 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1295     const char *anchor_call)
1296 {
1297 	u_int8_t		rs_num;
1298 	struct pfctl_rule	*rule;
1299 	struct pfctl_ruleset	*rs;
1300 	char 			*p;
1301 
1302 	rs_num = pf_get_ruleset_number(r->action);
1303 	if (rs_num == PF_RULESET_MAX)
1304 		errx(1, "Invalid rule type %d", r->action);
1305 
1306 	rs = &pf->anchor->ruleset;
1307 
1308 	if (anchor_call[0] && r->anchor == NULL) {
1309 		/*
1310 		 * Don't make non-brace anchors part of the main anchor pool.
1311 		 */
1312 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1313 			err(1, "pfctl_append_rule: calloc");
1314 
1315 		pf_init_ruleset(&r->anchor->ruleset);
1316 		r->anchor->ruleset.anchor = r->anchor;
1317 		if (strlcpy(r->anchor->path, anchor_call,
1318 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1319 			errx(1, "pfctl_append_rule: strlcpy");
1320 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1321 			if (!strlen(p))
1322 				err(1, "pfctl_append_rule: bad anchor name %s",
1323 				    anchor_call);
1324 		} else
1325 			p = (char *)anchor_call;
1326 		if (strlcpy(r->anchor->name, p,
1327 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1328 			errx(1, "pfctl_append_rule: strlcpy");
1329 	}
1330 
1331 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1332 		err(1, "calloc");
1333 	bcopy(r, rule, sizeof(*rule));
1334 	TAILQ_INIT(&rule->rpool.list);
1335 	pfctl_move_pool(&r->rpool, &rule->rpool);
1336 
1337 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1338 	return (0);
1339 }
1340 
1341 int
1342 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a)
1343 {
1344 	int osize = pf->trans->pfrb_size;
1345 
1346 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1347 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1348 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1349 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1350 			return (1);
1351 	}
1352 	if (a == pf->astack[0] && ((altqsupport &&
1353 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1354 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1355 			return (2);
1356 	}
1357 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1358 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1359 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1360 			return (3);
1361 	}
1362 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1363 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1364 			return (4);
1365 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1366 		return (5);
1367 
1368 	return (0);
1369 }
1370 
1371 int
1372 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1373     int rs_num, int depth)
1374 {
1375 	struct pfctl_rule *r;
1376 	int		error, len = strlen(path);
1377 	int		brace = 0;
1378 
1379 	pf->anchor = rs->anchor;
1380 
1381 	if (path[0])
1382 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1383 	else
1384 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1385 
1386 	if (depth) {
1387 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1388 			brace++;
1389 			if (pf->opts & PF_OPT_VERBOSE)
1390 				printf(" {\n");
1391 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1392 			    (error = pfctl_ruleset_trans(pf,
1393 			    path, rs->anchor))) {
1394 				printf("pfctl_load_rulesets: "
1395 				    "pfctl_ruleset_trans %d\n", error);
1396 				goto error;
1397 			}
1398 		} else if (pf->opts & PF_OPT_VERBOSE)
1399 			printf("\n");
1400 
1401 	}
1402 
1403 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1404 		pfctl_optimize_ruleset(pf, rs);
1405 
1406 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1407 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1408 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1409 			goto error;
1410 		if (r->anchor) {
1411 			if ((error = pfctl_load_ruleset(pf, path,
1412 			    &r->anchor->ruleset, rs_num, depth + 1)))
1413 				goto error;
1414 		} else if (pf->opts & PF_OPT_VERBOSE)
1415 			printf("\n");
1416 		free(r);
1417 	}
1418 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1419 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1420 		printf("}\n");
1421 	}
1422 	path[len] = '\0';
1423 	return (0);
1424 
1425  error:
1426 	path[len] = '\0';
1427 	return (error);
1428 
1429 }
1430 
1431 int
1432 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
1433 {
1434 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1435 	char			*name;
1436 	u_int32_t		ticket;
1437 	char			anchor[PF_ANCHOR_NAME_SIZE];
1438 	int			len = strlen(path);
1439 
1440 	/* set up anchor before adding to path for anchor_call */
1441 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1442 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1443 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1444 		errx(1, "pfctl_load_rule: strlcpy");
1445 
1446 	if (r->anchor) {
1447 		if (r->anchor->match) {
1448 			if (path[0])
1449 				snprintf(&path[len], MAXPATHLEN - len,
1450 				    "/%s", r->anchor->name);
1451 			else
1452 				snprintf(&path[len], MAXPATHLEN - len,
1453 				    "%s", r->anchor->name);
1454 			name = r->anchor->name;
1455 		} else
1456 			name = r->anchor->path;
1457 	} else
1458 		name = "";
1459 
1460 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1461 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1462 			return (1);
1463 		if (pfctl_add_rule(pf->dev, r, anchor, name, ticket,
1464 		    pf->paddr.ticket))
1465 			err(1, "DIOCADDRULENV");
1466 	}
1467 
1468 	if (pf->opts & PF_OPT_VERBOSE) {
1469 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1470 		print_rule(r, r->anchor ? r->anchor->name : "",
1471 		    pf->opts & PF_OPT_VERBOSE2,
1472 		    pf->opts & PF_OPT_NUMERIC);
1473 	}
1474 	path[len] = '\0';
1475 	pfctl_clear_pool(&r->rpool);
1476 	return (0);
1477 }
1478 
1479 int
1480 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1481 {
1482 	if (altqsupport &&
1483 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1484 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1485 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1486 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1487 				if (errno == ENXIO)
1488 					errx(1, "qtype not configured");
1489 				else if (errno == ENODEV)
1490 					errx(1, "%s: driver does not support "
1491 					    "altq", a->ifname);
1492 				else
1493 					err(1, "DIOCADDALTQ");
1494 			}
1495 		}
1496 		pfaltq_store(&pf->paltq->altq);
1497 	}
1498 	return (0);
1499 }
1500 
1501 int
1502 pfctl_rules(int dev, char *filename, int opts, int optimize,
1503     char *anchorname, struct pfr_buffer *trans)
1504 {
1505 #define ERR(x) do { warn(x); goto _error; } while(0)
1506 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1507 
1508 	struct pfr_buffer	*t, buf;
1509 	struct pfioc_altq	 pa;
1510 	struct pfctl		 pf;
1511 	struct pfctl_ruleset	*rs;
1512 	struct pfr_table	 trs;
1513 	char			*path;
1514 	int			 osize;
1515 
1516 	RB_INIT(&pf_anchors);
1517 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1518 	pf_init_ruleset(&pf_main_anchor.ruleset);
1519 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1520 	if (trans == NULL) {
1521 		bzero(&buf, sizeof(buf));
1522 		buf.pfrb_type = PFRB_TRANS;
1523 		t = &buf;
1524 		osize = 0;
1525 	} else {
1526 		t = trans;
1527 		osize = t->pfrb_size;
1528 	}
1529 
1530 	memset(&pa, 0, sizeof(pa));
1531 	pa.version = PFIOC_ALTQ_VERSION;
1532 	memset(&pf, 0, sizeof(pf));
1533 	memset(&trs, 0, sizeof(trs));
1534 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1535 		ERRX("pfctl_rules: calloc");
1536 	if (strlcpy(trs.pfrt_anchor, anchorname,
1537 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1538 		ERRX("pfctl_rules: strlcpy");
1539 	pf.dev = dev;
1540 	pf.opts = opts;
1541 	pf.optimize = optimize;
1542 	pf.loadopt = loadopt;
1543 
1544 	/* non-brace anchor, create without resolving the path */
1545 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1546 		ERRX("pfctl_rules: calloc");
1547 	rs = &pf.anchor->ruleset;
1548 	pf_init_ruleset(rs);
1549 	rs->anchor = pf.anchor;
1550 	if (strlcpy(pf.anchor->path, anchorname,
1551 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1552 		errx(1, "pfctl_add_rule: strlcpy");
1553 	if (strlcpy(pf.anchor->name, anchorname,
1554 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1555 		errx(1, "pfctl_add_rule: strlcpy");
1556 
1557 
1558 	pf.astack[0] = pf.anchor;
1559 	pf.asd = 0;
1560 	if (anchorname[0])
1561 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1562 	pf.paltq = &pa;
1563 	pf.trans = t;
1564 	pfctl_init_options(&pf);
1565 
1566 	if ((opts & PF_OPT_NOACTION) == 0) {
1567 		/*
1568 		 * XXX For the time being we need to open transactions for
1569 		 * the main ruleset before parsing, because tables are still
1570 		 * loaded at parse time.
1571 		 */
1572 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1573 			ERRX("pfctl_rules");
1574 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1575 			pa.ticket =
1576 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1577 		if (pf.loadopt & PFCTL_FLAG_TABLE)
1578 			pf.astack[0]->ruleset.tticket =
1579 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1580 	}
1581 
1582 	if (parse_config(filename, &pf) < 0) {
1583 		if ((opts & PF_OPT_NOACTION) == 0)
1584 			ERRX("Syntax error in config file: "
1585 			    "pf rules not loaded");
1586 		else
1587 			goto _error;
1588 	}
1589 	if (loadopt & PFCTL_FLAG_OPTION)
1590 		pfctl_adjust_skip_ifaces(&pf);
1591 
1592 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1593 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1594 	    (pf.loadopt & PFCTL_FLAG_NAT &&
1595 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1596 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1597 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1598 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
1599 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1600 		if ((opts & PF_OPT_NOACTION) == 0)
1601 			ERRX("Unable to load rules into kernel");
1602 		else
1603 			goto _error;
1604 	}
1605 
1606 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1607 		if (check_commit_altq(dev, opts) != 0)
1608 			ERRX("errors in altq config");
1609 
1610 	/* process "load anchor" directives */
1611 	if (!anchorname[0])
1612 		if (pfctl_load_anchors(dev, &pf, t) == -1)
1613 			ERRX("load anchors");
1614 
1615 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1616 		if (!anchorname[0])
1617 			if (pfctl_load_options(&pf))
1618 				goto _error;
1619 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1620 			ERR("DIOCXCOMMIT");
1621 	}
1622 	free(path);
1623 	return (0);
1624 
1625 _error:
1626 	if (trans == NULL) {	/* main ruleset */
1627 		if ((opts & PF_OPT_NOACTION) == 0)
1628 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1629 				err(1, "DIOCXROLLBACK");
1630 		exit(1);
1631 	} else {		/* sub ruleset */
1632 		free(path);
1633 		return (-1);
1634 	}
1635 
1636 #undef ERR
1637 #undef ERRX
1638 }
1639 
1640 FILE *
1641 pfctl_fopen(const char *name, const char *mode)
1642 {
1643 	struct stat	 st;
1644 	FILE		*fp;
1645 
1646 	fp = fopen(name, mode);
1647 	if (fp == NULL)
1648 		return (NULL);
1649 	if (fstat(fileno(fp), &st)) {
1650 		fclose(fp);
1651 		return (NULL);
1652 	}
1653 	if (S_ISDIR(st.st_mode)) {
1654 		fclose(fp);
1655 		errno = EISDIR;
1656 		return (NULL);
1657 	}
1658 	return (fp);
1659 }
1660 
1661 void
1662 pfctl_init_options(struct pfctl *pf)
1663 {
1664 
1665 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1666 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1667 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1668 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1669 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1670 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1671 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1672 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1673 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1674 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1675 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1676 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1677 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1678 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1679 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1680 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1681 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1682 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1683 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1684 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1685 
1686 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1687 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1688 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1689 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1690 
1691 	pf->debug = PF_DEBUG_URGENT;
1692 }
1693 
1694 int
1695 pfctl_load_options(struct pfctl *pf)
1696 {
1697 	int i, error = 0;
1698 
1699 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1700 		return (0);
1701 
1702 	/* load limits */
1703 	for (i = 0; i < PF_LIMIT_MAX; i++) {
1704 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1705 			continue;
1706 		if (pfctl_load_limit(pf, i, pf->limit[i]))
1707 			error = 1;
1708 	}
1709 
1710 	/*
1711 	 * If we've set the limit, but haven't explicitly set adaptive
1712 	 * timeouts, do it now with a start of 60% and end of 120%.
1713 	 */
1714 	if (pf->limit_set[PF_LIMIT_STATES] &&
1715 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1716 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1717 		pf->timeout[PFTM_ADAPTIVE_START] =
1718 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
1719 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1720 		pf->timeout[PFTM_ADAPTIVE_END] =
1721 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
1722 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1723 	}
1724 
1725 	/* load timeouts */
1726 	for (i = 0; i < PFTM_MAX; i++) {
1727 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1728 			continue;
1729 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1730 			error = 1;
1731 	}
1732 
1733 	/* load debug */
1734 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1735 		if (pfctl_load_debug(pf, pf->debug))
1736 			error = 1;
1737 
1738 	/* load logif */
1739 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1740 		if (pfctl_load_logif(pf, pf->ifname))
1741 			error = 1;
1742 
1743 	/* load hostid */
1744 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1745 		if (pfctl_load_hostid(pf, pf->hostid))
1746 			error = 1;
1747 
1748 	/* load keepcounters */
1749 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
1750 		error = 1;
1751 
1752 	return (error);
1753 }
1754 
1755 int
1756 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1757 {
1758 	int i;
1759 
1760 
1761 	for (i = 0; pf_limits[i].name; i++) {
1762 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
1763 			pf->limit[pf_limits[i].index] = limit;
1764 			pf->limit_set[pf_limits[i].index] = 1;
1765 			break;
1766 		}
1767 	}
1768 	if (pf_limits[i].name == NULL) {
1769 		warnx("Bad pool name.");
1770 		return (1);
1771 	}
1772 
1773 	if (pf->opts & PF_OPT_VERBOSE)
1774 		printf("set limit %s %d\n", opt, limit);
1775 
1776 	return (0);
1777 }
1778 
1779 int
1780 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1781 {
1782 	struct pfioc_limit pl;
1783 
1784 	memset(&pl, 0, sizeof(pl));
1785 	pl.index = index;
1786 	pl.limit = limit;
1787 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1788 		if (errno == EBUSY)
1789 			warnx("Current pool size exceeds requested hard limit");
1790 		else
1791 			warnx("DIOCSETLIMIT");
1792 		return (1);
1793 	}
1794 	return (0);
1795 }
1796 
1797 int
1798 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1799 {
1800 	int i;
1801 
1802 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1803 		return (0);
1804 
1805 	for (i = 0; pf_timeouts[i].name; i++) {
1806 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1807 			pf->timeout[pf_timeouts[i].timeout] = seconds;
1808 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
1809 			break;
1810 		}
1811 	}
1812 
1813 	if (pf_timeouts[i].name == NULL) {
1814 		warnx("Bad timeout name.");
1815 		return (1);
1816 	}
1817 
1818 
1819 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1820 		printf("set timeout %s %d\n", opt, seconds);
1821 
1822 	return (0);
1823 }
1824 
1825 int
1826 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1827 {
1828 	struct pfioc_tm pt;
1829 
1830 	memset(&pt, 0, sizeof(pt));
1831 	pt.timeout = timeout;
1832 	pt.seconds = seconds;
1833 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1834 		warnx("DIOCSETTIMEOUT");
1835 		return (1);
1836 	}
1837 	return (0);
1838 }
1839 
1840 int
1841 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1842 {
1843 	const struct pf_hint *hint;
1844 	int i, r;
1845 
1846 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1847 		return (0);
1848 
1849 	for (i = 0; pf_hints[i].name; i++)
1850 		if (strcasecmp(opt, pf_hints[i].name) == 0)
1851 			break;
1852 
1853 	hint = pf_hints[i].hint;
1854 	if (hint == NULL) {
1855 		warnx("invalid state timeouts optimization");
1856 		return (1);
1857 	}
1858 
1859 	for (i = 0; hint[i].name; i++)
1860 		if ((r = pfctl_set_timeout(pf, hint[i].name,
1861 		    hint[i].timeout, 1)))
1862 			return (r);
1863 
1864 	if (pf->opts & PF_OPT_VERBOSE)
1865 		printf("set optimization %s\n", opt);
1866 
1867 	return (0);
1868 }
1869 
1870 int
1871 pfctl_set_logif(struct pfctl *pf, char *ifname)
1872 {
1873 
1874 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1875 		return (0);
1876 
1877 	if (!strcmp(ifname, "none")) {
1878 		free(pf->ifname);
1879 		pf->ifname = NULL;
1880 	} else {
1881 		pf->ifname = strdup(ifname);
1882 		if (!pf->ifname)
1883 			errx(1, "pfctl_set_logif: strdup");
1884 	}
1885 	pf->ifname_set = 1;
1886 
1887 	if (pf->opts & PF_OPT_VERBOSE)
1888 		printf("set loginterface %s\n", ifname);
1889 
1890 	return (0);
1891 }
1892 
1893 int
1894 pfctl_load_logif(struct pfctl *pf, char *ifname)
1895 {
1896 	struct pfioc_if pi;
1897 
1898 	memset(&pi, 0, sizeof(pi));
1899 	if (ifname && strlcpy(pi.ifname, ifname,
1900 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1901 		warnx("pfctl_load_logif: strlcpy");
1902 		return (1);
1903 	}
1904 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1905 		warnx("DIOCSETSTATUSIF");
1906 		return (1);
1907 	}
1908 	return (0);
1909 }
1910 
1911 int
1912 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1913 {
1914 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1915 		return (0);
1916 
1917 	HTONL(hostid);
1918 
1919 	pf->hostid = hostid;
1920 	pf->hostid_set = 1;
1921 
1922 	if (pf->opts & PF_OPT_VERBOSE)
1923 		printf("set hostid 0x%08x\n", ntohl(hostid));
1924 
1925 	return (0);
1926 }
1927 
1928 int
1929 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
1930 {
1931 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
1932 		warnx("DIOCSETHOSTID");
1933 		return (1);
1934 	}
1935 	return (0);
1936 }
1937 
1938 int
1939 pfctl_set_debug(struct pfctl *pf, char *d)
1940 {
1941 	u_int32_t	level;
1942 
1943 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1944 		return (0);
1945 
1946 	if (!strcmp(d, "none"))
1947 		pf->debug = PF_DEBUG_NONE;
1948 	else if (!strcmp(d, "urgent"))
1949 		pf->debug = PF_DEBUG_URGENT;
1950 	else if (!strcmp(d, "misc"))
1951 		pf->debug = PF_DEBUG_MISC;
1952 	else if (!strcmp(d, "loud"))
1953 		pf->debug = PF_DEBUG_NOISY;
1954 	else {
1955 		warnx("unknown debug level \"%s\"", d);
1956 		return (-1);
1957 	}
1958 
1959 	pf->debug_set = 1;
1960 	level = pf->debug;
1961 
1962 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1963 		if (ioctl(dev, DIOCSETDEBUG, &level))
1964 			err(1, "DIOCSETDEBUG");
1965 
1966 	if (pf->opts & PF_OPT_VERBOSE)
1967 		printf("set debug %s\n", d);
1968 
1969 	return (0);
1970 }
1971 
1972 int
1973 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1974 {
1975 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1976 		warnx("DIOCSETDEBUG");
1977 		return (1);
1978 	}
1979 	return (0);
1980 }
1981 
1982 int
1983 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1984 {
1985 	struct pfioc_iface	pi;
1986 	struct node_host	*h = NULL, *n = NULL;
1987 
1988 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1989 		return (0);
1990 
1991 	bzero(&pi, sizeof(pi));
1992 
1993 	pi.pfiio_flags = flags;
1994 
1995 	/* Make sure our cache matches the kernel. If we set or clear the flag
1996 	 * for a group this applies to all members. */
1997 	h = ifa_grouplookup(ifname, 0);
1998 	for (n = h; n != NULL; n = n->next)
1999 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2000 
2001 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2002 	    sizeof(pi.pfiio_name))
2003 		errx(1, "pfctl_set_interface_flags: strlcpy");
2004 
2005 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2006 		if (how == 0) {
2007 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2008 				err(1, "DIOCCLRIFFLAG");
2009 		} else {
2010 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2011 				err(1, "DIOCSETIFFLAG");
2012 			pfctl_check_skip_ifaces(ifname);
2013 		}
2014 	}
2015 	return (0);
2016 }
2017 
2018 void
2019 pfctl_debug(int dev, u_int32_t level, int opts)
2020 {
2021 	if (ioctl(dev, DIOCSETDEBUG, &level))
2022 		err(1, "DIOCSETDEBUG");
2023 	if ((opts & PF_OPT_QUIET) == 0) {
2024 		fprintf(stderr, "debug level set to '");
2025 		switch (level) {
2026 		case PF_DEBUG_NONE:
2027 			fprintf(stderr, "none");
2028 			break;
2029 		case PF_DEBUG_URGENT:
2030 			fprintf(stderr, "urgent");
2031 			break;
2032 		case PF_DEBUG_MISC:
2033 			fprintf(stderr, "misc");
2034 			break;
2035 		case PF_DEBUG_NOISY:
2036 			fprintf(stderr, "loud");
2037 			break;
2038 		default:
2039 			fprintf(stderr, "<invalid>");
2040 			break;
2041 		}
2042 		fprintf(stderr, "'\n");
2043 	}
2044 }
2045 
2046 int
2047 pfctl_test_altqsupport(int dev, int opts)
2048 {
2049 	struct pfioc_altq pa;
2050 
2051 	pa.version = PFIOC_ALTQ_VERSION;
2052 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2053 		if (errno == ENODEV) {
2054 			if (opts & PF_OPT_VERBOSE)
2055 				fprintf(stderr, "No ALTQ support in kernel\n"
2056 				    "ALTQ related functions disabled\n");
2057 			return (0);
2058 		} else
2059 			err(1, "DIOCGETALTQS");
2060 	}
2061 	return (1);
2062 }
2063 
2064 int
2065 pfctl_show_anchors(int dev, int opts, char *anchorname)
2066 {
2067 	struct pfioc_ruleset	 pr;
2068 	u_int32_t		 mnr, nr;
2069 
2070 	memset(&pr, 0, sizeof(pr));
2071 	memcpy(pr.path, anchorname, sizeof(pr.path));
2072 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2073 		if (errno == EINVAL)
2074 			fprintf(stderr, "Anchor '%s' not found.\n",
2075 			    anchorname);
2076 		else
2077 			err(1, "DIOCGETRULESETS");
2078 		return (-1);
2079 	}
2080 	mnr = pr.nr;
2081 	for (nr = 0; nr < mnr; ++nr) {
2082 		char sub[MAXPATHLEN];
2083 
2084 		pr.nr = nr;
2085 		if (ioctl(dev, DIOCGETRULESET, &pr))
2086 			err(1, "DIOCGETRULESET");
2087 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2088 			continue;
2089 		sub[0] = 0;
2090 		if (pr.path[0]) {
2091 			strlcat(sub, pr.path, sizeof(sub));
2092 			strlcat(sub, "/", sizeof(sub));
2093 		}
2094 		strlcat(sub, pr.name, sizeof(sub));
2095 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2096 			printf("  %s\n", sub);
2097 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2098 			return (-1);
2099 	}
2100 	return (0);
2101 }
2102 
2103 const char *
2104 pfctl_lookup_option(char *cmd, const char * const *list)
2105 {
2106 	if (cmd != NULL && *cmd)
2107 		for (; *list; list++)
2108 			if (!strncmp(cmd, *list, strlen(cmd)))
2109 				return (*list);
2110 	return (NULL);
2111 }
2112 
2113 int
2114 main(int argc, char *argv[])
2115 {
2116 	int	 error = 0;
2117 	int	 ch;
2118 	int	 mode = O_RDONLY;
2119 	int	 opts = 0;
2120 	int	 optimize = PF_OPTIMIZE_BASIC;
2121 	char	 anchorname[MAXPATHLEN];
2122 	char	*path;
2123 
2124 	if (argc < 2)
2125 		usage();
2126 
2127 	while ((ch = getopt(argc, argv,
2128 	    "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2129 		switch (ch) {
2130 		case 'a':
2131 			anchoropt = optarg;
2132 			break;
2133 		case 'd':
2134 			opts |= PF_OPT_DISABLE;
2135 			mode = O_RDWR;
2136 			break;
2137 		case 'D':
2138 			if (pfctl_cmdline_symset(optarg) < 0)
2139 				warnx("could not parse macro definition %s",
2140 				    optarg);
2141 			break;
2142 		case 'e':
2143 			opts |= PF_OPT_ENABLE;
2144 			mode = O_RDWR;
2145 			break;
2146 		case 'q':
2147 			opts |= PF_OPT_QUIET;
2148 			break;
2149 		case 'F':
2150 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2151 			if (clearopt == NULL) {
2152 				warnx("Unknown flush modifier '%s'", optarg);
2153 				usage();
2154 			}
2155 			mode = O_RDWR;
2156 			break;
2157 		case 'i':
2158 			ifaceopt = optarg;
2159 			break;
2160 		case 'k':
2161 			if (state_killers >= 2) {
2162 				warnx("can only specify -k twice");
2163 				usage();
2164 				/* NOTREACHED */
2165 			}
2166 			state_kill[state_killers++] = optarg;
2167 			mode = O_RDWR;
2168 			break;
2169 		case 'K':
2170 			if (src_node_killers >= 2) {
2171 				warnx("can only specify -K twice");
2172 				usage();
2173 				/* NOTREACHED */
2174 			}
2175 			src_node_kill[src_node_killers++] = optarg;
2176 			mode = O_RDWR;
2177 			break;
2178 		case 'm':
2179 			opts |= PF_OPT_MERGE;
2180 			break;
2181 		case 'n':
2182 			opts |= PF_OPT_NOACTION;
2183 			break;
2184 		case 'N':
2185 			loadopt |= PFCTL_FLAG_NAT;
2186 			break;
2187 		case 'r':
2188 			opts |= PF_OPT_USEDNS;
2189 			break;
2190 		case 'f':
2191 			rulesopt = optarg;
2192 			mode = O_RDWR;
2193 			break;
2194 		case 'g':
2195 			opts |= PF_OPT_DEBUG;
2196 			break;
2197 		case 'A':
2198 			loadopt |= PFCTL_FLAG_ALTQ;
2199 			break;
2200 		case 'R':
2201 			loadopt |= PFCTL_FLAG_FILTER;
2202 			break;
2203 		case 'o':
2204 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2205 			if (optiopt == NULL) {
2206 				warnx("Unknown optimization '%s'", optarg);
2207 				usage();
2208 			}
2209 			opts |= PF_OPT_OPTIMIZE;
2210 			break;
2211 		case 'O':
2212 			loadopt |= PFCTL_FLAG_OPTION;
2213 			break;
2214 		case 'p':
2215 			pf_device = optarg;
2216 			break;
2217 		case 'P':
2218 			opts |= PF_OPT_NUMERIC;
2219 			break;
2220 		case 's':
2221 			showopt = pfctl_lookup_option(optarg, showopt_list);
2222 			if (showopt == NULL) {
2223 				warnx("Unknown show modifier '%s'", optarg);
2224 				usage();
2225 			}
2226 			break;
2227 		case 't':
2228 			tableopt = optarg;
2229 			break;
2230 		case 'T':
2231 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2232 			if (tblcmdopt == NULL) {
2233 				warnx("Unknown table command '%s'", optarg);
2234 				usage();
2235 			}
2236 			break;
2237 		case 'v':
2238 			if (opts & PF_OPT_VERBOSE)
2239 				opts |= PF_OPT_VERBOSE2;
2240 			opts |= PF_OPT_VERBOSE;
2241 			break;
2242 		case 'x':
2243 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2244 			if (debugopt == NULL) {
2245 				warnx("Unknown debug level '%s'", optarg);
2246 				usage();
2247 			}
2248 			mode = O_RDWR;
2249 			break;
2250 		case 'z':
2251 			opts |= PF_OPT_CLRRULECTRS;
2252 			mode = O_RDWR;
2253 			break;
2254 		case 'h':
2255 			/* FALLTHROUGH */
2256 		default:
2257 			usage();
2258 			/* NOTREACHED */
2259 		}
2260 	}
2261 
2262 	if (tblcmdopt != NULL) {
2263 		argc -= optind;
2264 		argv += optind;
2265 		ch = *tblcmdopt;
2266 		if (ch == 'l') {
2267 			loadopt |= PFCTL_FLAG_TABLE;
2268 			tblcmdopt = NULL;
2269 		} else
2270 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2271 	} else if (argc != optind) {
2272 		warnx("unknown command line argument: %s ...", argv[optind]);
2273 		usage();
2274 		/* NOTREACHED */
2275 	}
2276 	if (loadopt == 0)
2277 		loadopt = ~0;
2278 
2279 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2280 		errx(1, "pfctl: calloc");
2281 	memset(anchorname, 0, sizeof(anchorname));
2282 	if (anchoropt != NULL) {
2283 		int len = strlen(anchoropt);
2284 
2285 		if (anchoropt[len - 1] == '*') {
2286 			if (len >= 2 && anchoropt[len - 2] == '/')
2287 				anchoropt[len - 2] = '\0';
2288 			else
2289 				anchoropt[len - 1] = '\0';
2290 			opts |= PF_OPT_RECURSE;
2291 		}
2292 		if (strlcpy(anchorname, anchoropt,
2293 		    sizeof(anchorname)) >= sizeof(anchorname))
2294 			errx(1, "anchor name '%s' too long",
2295 			    anchoropt);
2296 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2297 	}
2298 
2299 	if ((opts & PF_OPT_NOACTION) == 0) {
2300 		dev = open(pf_device, mode);
2301 		if (dev == -1)
2302 			err(1, "%s", pf_device);
2303 		altqsupport = pfctl_test_altqsupport(dev, opts);
2304 	} else {
2305 		dev = open(pf_device, O_RDONLY);
2306 		if (dev >= 0)
2307 			opts |= PF_OPT_DUMMYACTION;
2308 		/* turn off options */
2309 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2310 		clearopt = showopt = debugopt = NULL;
2311 #if !defined(ENABLE_ALTQ)
2312 		altqsupport = 0;
2313 #else
2314 		altqsupport = 1;
2315 #endif
2316 	}
2317 
2318 	if (opts & PF_OPT_DISABLE)
2319 		if (pfctl_disable(dev, opts))
2320 			error = 1;
2321 
2322 	if (showopt != NULL) {
2323 		switch (*showopt) {
2324 		case 'A':
2325 			pfctl_show_anchors(dev, opts, anchorname);
2326 			break;
2327 		case 'r':
2328 			pfctl_load_fingerprints(dev, opts);
2329 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2330 			    anchorname, 0);
2331 			break;
2332 		case 'l':
2333 			pfctl_load_fingerprints(dev, opts);
2334 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2335 			    anchorname, 0);
2336 			break;
2337 		case 'n':
2338 			pfctl_load_fingerprints(dev, opts);
2339 			pfctl_show_nat(dev, opts, anchorname);
2340 			break;
2341 		case 'q':
2342 			pfctl_show_altq(dev, ifaceopt, opts,
2343 			    opts & PF_OPT_VERBOSE2);
2344 			break;
2345 		case 's':
2346 			pfctl_show_states(dev, ifaceopt, opts);
2347 			break;
2348 		case 'S':
2349 			pfctl_show_src_nodes(dev, opts);
2350 			break;
2351 		case 'i':
2352 			pfctl_show_status(dev, opts);
2353 			break;
2354 		case 'R':
2355 			error = pfctl_show_running(dev);
2356 			break;
2357 		case 't':
2358 			pfctl_show_timeouts(dev, opts);
2359 			break;
2360 		case 'm':
2361 			pfctl_show_limits(dev, opts);
2362 			break;
2363 		case 'a':
2364 			opts |= PF_OPT_SHOWALL;
2365 			pfctl_load_fingerprints(dev, opts);
2366 
2367 			pfctl_show_nat(dev, opts, anchorname);
2368 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2369 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2370 			pfctl_show_states(dev, ifaceopt, opts);
2371 			pfctl_show_src_nodes(dev, opts);
2372 			pfctl_show_status(dev, opts);
2373 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2374 			pfctl_show_timeouts(dev, opts);
2375 			pfctl_show_limits(dev, opts);
2376 			pfctl_show_tables(anchorname, opts);
2377 			pfctl_show_fingerprints(opts);
2378 			break;
2379 		case 'T':
2380 			pfctl_show_tables(anchorname, opts);
2381 			break;
2382 		case 'o':
2383 			pfctl_load_fingerprints(dev, opts);
2384 			pfctl_show_fingerprints(opts);
2385 			break;
2386 		case 'I':
2387 			pfctl_show_ifaces(ifaceopt, opts);
2388 			break;
2389 		}
2390 	}
2391 
2392 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2393 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2394 		    anchorname, 0);
2395 
2396 	if (clearopt != NULL) {
2397 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2398 			errx(1, "anchor names beginning with '_' cannot "
2399 			    "be modified from the command line");
2400 
2401 		switch (*clearopt) {
2402 		case 'r':
2403 			pfctl_clear_rules(dev, opts, anchorname);
2404 			break;
2405 		case 'n':
2406 			pfctl_clear_nat(dev, opts, anchorname);
2407 			break;
2408 		case 'q':
2409 			pfctl_clear_altq(dev, opts);
2410 			break;
2411 		case 's':
2412 			pfctl_clear_states(dev, ifaceopt, opts);
2413 			break;
2414 		case 'S':
2415 			pfctl_clear_src_nodes(dev, opts);
2416 			break;
2417 		case 'i':
2418 			pfctl_clear_stats(dev, opts);
2419 			break;
2420 		case 'a':
2421 			pfctl_clear_rules(dev, opts, anchorname);
2422 			pfctl_clear_nat(dev, opts, anchorname);
2423 			pfctl_clear_tables(anchorname, opts);
2424 			if (!*anchorname) {
2425 				pfctl_clear_altq(dev, opts);
2426 				pfctl_clear_states(dev, ifaceopt, opts);
2427 				pfctl_clear_src_nodes(dev, opts);
2428 				pfctl_clear_stats(dev, opts);
2429 				pfctl_clear_fingerprints(dev, opts);
2430 				pfctl_clear_interface_flags(dev, opts);
2431 			}
2432 			break;
2433 		case 'o':
2434 			pfctl_clear_fingerprints(dev, opts);
2435 			break;
2436 		case 'T':
2437 			pfctl_clear_tables(anchorname, opts);
2438 			break;
2439 		}
2440 	}
2441 	if (state_killers) {
2442 		if (!strcmp(state_kill[0], "label"))
2443 			pfctl_label_kill_states(dev, ifaceopt, opts);
2444 		else if (!strcmp(state_kill[0], "id"))
2445 			pfctl_id_kill_states(dev, ifaceopt, opts);
2446 		else
2447 			pfctl_net_kill_states(dev, ifaceopt, opts);
2448 	}
2449 
2450 	if (src_node_killers)
2451 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
2452 
2453 	if (tblcmdopt != NULL) {
2454 		error = pfctl_command_tables(argc, argv, tableopt,
2455 		    tblcmdopt, rulesopt, anchorname, opts);
2456 		rulesopt = NULL;
2457 	}
2458 	if (optiopt != NULL) {
2459 		switch (*optiopt) {
2460 		case 'n':
2461 			optimize = 0;
2462 			break;
2463 		case 'b':
2464 			optimize |= PF_OPTIMIZE_BASIC;
2465 			break;
2466 		case 'o':
2467 		case 'p':
2468 			optimize |= PF_OPTIMIZE_PROFILE;
2469 			break;
2470 		}
2471 	}
2472 
2473 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2474 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
2475 		if (pfctl_get_skip_ifaces())
2476 			error = 1;
2477 
2478 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2479 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2480 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2481 			error = 1;
2482 
2483 	if (rulesopt != NULL) {
2484 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2485 			errx(1, "anchor names beginning with '_' cannot "
2486 			    "be modified from the command line");
2487 		if (pfctl_rules(dev, rulesopt, opts, optimize,
2488 		    anchorname, NULL))
2489 			error = 1;
2490 		else if (!(opts & PF_OPT_NOACTION) &&
2491 		    (loadopt & PFCTL_FLAG_TABLE))
2492 			warn_namespace_collision(NULL);
2493 	}
2494 
2495 	if (opts & PF_OPT_ENABLE)
2496 		if (pfctl_enable(dev, opts))
2497 			error = 1;
2498 
2499 	if (debugopt != NULL) {
2500 		switch (*debugopt) {
2501 		case 'n':
2502 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
2503 			break;
2504 		case 'u':
2505 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2506 			break;
2507 		case 'm':
2508 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
2509 			break;
2510 		case 'l':
2511 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2512 			break;
2513 		}
2514 	}
2515 
2516 	exit(error);
2517 }
2518