xref: /freebsd/sbin/pfctl/pfctl.c (revision 4c0d7cdf5d3b64e235140553601c0dd5827429a7)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*
4  * Copyright (c) 2001 Daniel Hartmeier
5  * Copyright (c) 2002,2003 Henning Brauer
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include <sys/types.h>
38 #include <sys/ioctl.h>
39 #include <sys/socket.h>
40 #include <sys/stat.h>
41 
42 #ifdef __FreeBSD__
43 #include <sys/endian.h>
44 #endif
45 
46 #include <net/if.h>
47 #include <netinet/in.h>
48 #include <net/pfvar.h>
49 #include <arpa/inet.h>
50 #include <altq/altq.h>
51 #include <sys/sysctl.h>
52 
53 #include <err.h>
54 #include <errno.h>
55 #include <fcntl.h>
56 #include <limits.h>
57 #include <netdb.h>
58 #include <stdio.h>
59 #include <stdlib.h>
60 #include <string.h>
61 #include <unistd.h>
62 
63 #include "pfctl_parser.h"
64 #include "pfctl.h"
65 
66 void	 usage(void);
67 int	 pfctl_enable(int, int);
68 int	 pfctl_disable(int, int);
69 int	 pfctl_clear_stats(int, int);
70 int	 pfctl_clear_interface_flags(int, int);
71 int	 pfctl_clear_rules(int, int, char *);
72 int	 pfctl_clear_nat(int, int, char *);
73 int	 pfctl_clear_altq(int, int);
74 int	 pfctl_clear_src_nodes(int, int);
75 int	 pfctl_clear_states(int, const char *, int);
76 void	 pfctl_addrprefix(char *, struct pf_addr *);
77 int	 pfctl_kill_src_nodes(int, const char *, int);
78 int	 pfctl_net_kill_states(int, const char *, int);
79 int	 pfctl_label_kill_states(int, const char *, int);
80 int	 pfctl_id_kill_states(int, const char *, int);
81 void	 pfctl_init_options(struct pfctl *);
82 int	 pfctl_load_options(struct pfctl *);
83 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
84 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
85 int	 pfctl_load_debug(struct pfctl *, unsigned int);
86 int	 pfctl_load_logif(struct pfctl *, char *);
87 int	 pfctl_load_hostid(struct pfctl *, unsigned int);
88 int	 pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
89 	    char *);
90 void	 pfctl_print_rule_counters(struct pf_rule *, int);
91 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
92 int	 pfctl_show_nat(int, int, char *);
93 int	 pfctl_show_src_nodes(int, int);
94 int	 pfctl_show_states(int, const char *, int);
95 int	 pfctl_show_status(int, int);
96 int	 pfctl_show_timeouts(int, int);
97 int	 pfctl_show_limits(int, int);
98 void	 pfctl_debug(int, u_int32_t, int);
99 int	 pfctl_test_altqsupport(int, int);
100 int	 pfctl_show_anchors(int, int, char *);
101 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
102 int	 pfctl_load_ruleset(struct pfctl *, char *,
103 		struct pf_ruleset *, int, int);
104 int	 pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
105 const char	*pfctl_lookup_option(char *, const char **);
106 
107 struct pf_anchor_global	 pf_anchors;
108 struct pf_anchor	 pf_main_anchor;
109 
110 const char	*clearopt;
111 char		*rulesopt;
112 const char	*showopt;
113 const char	*debugopt;
114 char		*anchoropt;
115 const char	*optiopt = NULL;
116 char		*pf_device = "/dev/pf";
117 char		*ifaceopt;
118 char		*tableopt;
119 const char	*tblcmdopt;
120 int		 src_node_killers;
121 char		*src_node_kill[2];
122 int		 state_killers;
123 char		*state_kill[2];
124 int		 loadopt;
125 int		 altqsupport;
126 
127 int		 dev = -1;
128 int		 first_title = 1;
129 int		 labels = 0;
130 
131 #define INDENT(d, o)	do {						\
132 				if (o) {				\
133 					int i;				\
134 					for (i=0; i < d; i++)		\
135 						printf("  ");		\
136 				}					\
137 			} while (0);					\
138 
139 
140 static const struct {
141 	const char	*name;
142 	int		index;
143 } pf_limits[] = {
144 	{ "states",		PF_LIMIT_STATES },
145 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
146 	{ "frags",		PF_LIMIT_FRAGS },
147 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
148 	{ NULL,			0 }
149 };
150 
151 struct pf_hint {
152 	const char	*name;
153 	int		timeout;
154 };
155 static const struct pf_hint pf_hint_normal[] = {
156 	{ "tcp.first",		2 * 60 },
157 	{ "tcp.opening",	30 },
158 	{ "tcp.established",	24 * 60 * 60 },
159 	{ "tcp.closing",	15 * 60 },
160 	{ "tcp.finwait",	45 },
161 	{ "tcp.closed",		90 },
162 	{ "tcp.tsdiff",		30 },
163 	{ NULL,			0 }
164 };
165 static const struct pf_hint pf_hint_satellite[] = {
166 	{ "tcp.first",		3 * 60 },
167 	{ "tcp.opening",	30 + 5 },
168 	{ "tcp.established",	24 * 60 * 60 },
169 	{ "tcp.closing",	15 * 60 + 5 },
170 	{ "tcp.finwait",	45 + 5 },
171 	{ "tcp.closed",		90 + 5 },
172 	{ "tcp.tsdiff",		60 },
173 	{ NULL,			0 }
174 };
175 static const struct pf_hint pf_hint_conservative[] = {
176 	{ "tcp.first",		60 * 60 },
177 	{ "tcp.opening",	15 * 60 },
178 	{ "tcp.established",	5 * 24 * 60 * 60 },
179 	{ "tcp.closing",	60 * 60 },
180 	{ "tcp.finwait",	10 * 60 },
181 	{ "tcp.closed",		3 * 60 },
182 	{ "tcp.tsdiff",		60 },
183 	{ NULL,			0 }
184 };
185 static const struct pf_hint pf_hint_aggressive[] = {
186 	{ "tcp.first",		30 },
187 	{ "tcp.opening",	5 },
188 	{ "tcp.established",	5 * 60 * 60 },
189 	{ "tcp.closing",	60 },
190 	{ "tcp.finwait",	30 },
191 	{ "tcp.closed",		30 },
192 	{ "tcp.tsdiff",		10 },
193 	{ NULL,			0 }
194 };
195 
196 static const struct {
197 	const char *name;
198 	const struct pf_hint *hint;
199 } pf_hints[] = {
200 	{ "normal",		pf_hint_normal },
201 	{ "satellite",		pf_hint_satellite },
202 	{ "high-latency",	pf_hint_satellite },
203 	{ "conservative",	pf_hint_conservative },
204 	{ "aggressive",		pf_hint_aggressive },
205 	{ NULL,			NULL }
206 };
207 
208 static const char *clearopt_list[] = {
209 	"nat", "queue", "rules", "Sources",
210 	"states", "info", "Tables", "osfp", "all", NULL
211 };
212 
213 static const char *showopt_list[] = {
214 	"nat", "queue", "rules", "Anchors", "Sources", "states", "info",
215 	"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
216 	"all", NULL
217 };
218 
219 static const char *tblcmdopt_list[] = {
220 	"kill", "flush", "add", "delete", "load", "replace", "show",
221 	"test", "zero", "expire", NULL
222 };
223 
224 static const char *debugopt_list[] = {
225 	"none", "urgent", "misc", "loud", NULL
226 };
227 
228 static const char *optiopt_list[] = {
229 	"none", "basic", "profile", NULL
230 };
231 
232 void
233 usage(void)
234 {
235 	extern char *__progname;
236 
237 	fprintf(stderr, "usage: %s [-AdeghmNnOPqRrvz] ", __progname);
238 	fprintf(stderr, "[-a anchor] [-D macro=value] [-F modifier]\n");
239 	fprintf(stderr, "\t[-f file] [-i interface] [-K host | network]\n");
240 	fprintf(stderr, "\t[-k host | network | label | id] ");
241 	fprintf(stderr, "[-o level] [-p device]\n");
242 	fprintf(stderr, "\t[-s modifier] ");
243 	fprintf(stderr, "[-t table -T command [address ...]] [-x level]\n");
244 	exit(1);
245 }
246 
247 int
248 pfctl_enable(int dev, int opts)
249 {
250 	if (ioctl(dev, DIOCSTART)) {
251 		if (errno == EEXIST)
252 			errx(1, "pf already enabled");
253 #ifdef __FreeBSD__
254 		else if (errno == ESRCH)
255 			errx(1, "pfil registeration failed");
256 #endif
257 		else
258 			err(1, "DIOCSTART");
259 	}
260 	if ((opts & PF_OPT_QUIET) == 0)
261 		fprintf(stderr, "pf enabled\n");
262 
263 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
264 		if (errno != EEXIST)
265 			err(1, "DIOCSTARTALTQ");
266 
267 	return (0);
268 }
269 
270 int
271 pfctl_disable(int dev, int opts)
272 {
273 	if (ioctl(dev, DIOCSTOP)) {
274 		if (errno == ENOENT)
275 			errx(1, "pf not enabled");
276 		else
277 			err(1, "DIOCSTOP");
278 	}
279 	if ((opts & PF_OPT_QUIET) == 0)
280 		fprintf(stderr, "pf disabled\n");
281 
282 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
283 			if (errno != ENOENT)
284 				err(1, "DIOCSTOPALTQ");
285 
286 	return (0);
287 }
288 
289 int
290 pfctl_clear_stats(int dev, int opts)
291 {
292 	if (ioctl(dev, DIOCCLRSTATUS))
293 		err(1, "DIOCCLRSTATUS");
294 	if ((opts & PF_OPT_QUIET) == 0)
295 		fprintf(stderr, "pf: statistics cleared\n");
296 	return (0);
297 }
298 
299 int
300 pfctl_clear_interface_flags(int dev, int opts)
301 {
302 	struct pfioc_iface	pi;
303 
304 	if ((opts & PF_OPT_NOACTION) == 0) {
305 		bzero(&pi, sizeof(pi));
306 		pi.pfiio_flags = PFI_IFLAG_SKIP;
307 
308 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
309 			err(1, "DIOCCLRIFFLAG");
310 		if ((opts & PF_OPT_QUIET) == 0)
311 			fprintf(stderr, "pf: interface flags reset\n");
312 	}
313 	return (0);
314 }
315 
316 int
317 pfctl_clear_rules(int dev, int opts, char *anchorname)
318 {
319 	struct pfr_buffer t;
320 
321 	memset(&t, 0, sizeof(t));
322 	t.pfrb_type = PFRB_TRANS;
323 	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
324 	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
325 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
326 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
327 		err(1, "pfctl_clear_rules");
328 	if ((opts & PF_OPT_QUIET) == 0)
329 		fprintf(stderr, "rules cleared\n");
330 	return (0);
331 }
332 
333 int
334 pfctl_clear_nat(int dev, int opts, char *anchorname)
335 {
336 	struct pfr_buffer t;
337 
338 	memset(&t, 0, sizeof(t));
339 	t.pfrb_type = PFRB_TRANS;
340 	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
341 	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
342 	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
343 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
344 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
345 		err(1, "pfctl_clear_nat");
346 	if ((opts & PF_OPT_QUIET) == 0)
347 		fprintf(stderr, "nat cleared\n");
348 	return (0);
349 }
350 
351 int
352 pfctl_clear_altq(int dev, int opts)
353 {
354 	struct pfr_buffer t;
355 
356 	if (!altqsupport)
357 		return (-1);
358 	memset(&t, 0, sizeof(t));
359 	t.pfrb_type = PFRB_TRANS;
360 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
361 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
362 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
363 		err(1, "pfctl_clear_altq");
364 	if ((opts & PF_OPT_QUIET) == 0)
365 		fprintf(stderr, "altq cleared\n");
366 	return (0);
367 }
368 
369 int
370 pfctl_clear_src_nodes(int dev, int opts)
371 {
372 	if (ioctl(dev, DIOCCLRSRCNODES))
373 		err(1, "DIOCCLRSRCNODES");
374 	if ((opts & PF_OPT_QUIET) == 0)
375 		fprintf(stderr, "source tracking entries cleared\n");
376 	return (0);
377 }
378 
379 int
380 pfctl_clear_states(int dev, const char *iface, int opts)
381 {
382 	struct pfioc_state_kill psk;
383 
384 	memset(&psk, 0, sizeof(psk));
385 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
386 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
387 		errx(1, "invalid interface: %s", iface);
388 
389 	if (ioctl(dev, DIOCCLRSTATES, &psk))
390 		err(1, "DIOCCLRSTATES");
391 	if ((opts & PF_OPT_QUIET) == 0)
392 		fprintf(stderr, "%d states cleared\n", psk.psk_killed);
393 	return (0);
394 }
395 
396 void
397 pfctl_addrprefix(char *addr, struct pf_addr *mask)
398 {
399 	char *p;
400 	const char *errstr;
401 	int prefix, ret_ga, q, r;
402 	struct addrinfo hints, *res;
403 
404 	if ((p = strchr(addr, '/')) == NULL)
405 		return;
406 
407 	*p++ = '\0';
408 	prefix = strtonum(p, 0, 128, &errstr);
409 	if (errstr)
410 		errx(1, "prefix is %s: %s", errstr, p);
411 
412 	bzero(&hints, sizeof(hints));
413 	/* prefix only with numeric addresses */
414 	hints.ai_flags |= AI_NUMERICHOST;
415 
416 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
417 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
418 		/* NOTREACHED */
419 	}
420 
421 	if (res->ai_family == AF_INET && prefix > 32)
422 		errx(1, "prefix too long for AF_INET");
423 	else if (res->ai_family == AF_INET6 && prefix > 128)
424 		errx(1, "prefix too long for AF_INET6");
425 
426 	q = prefix >> 3;
427 	r = prefix & 7;
428 	switch (res->ai_family) {
429 	case AF_INET:
430 		bzero(&mask->v4, sizeof(mask->v4));
431 		mask->v4.s_addr = htonl((u_int32_t)
432 		    (0xffffffffffULL << (32 - prefix)));
433 		break;
434 	case AF_INET6:
435 		bzero(&mask->v6, sizeof(mask->v6));
436 		if (q > 0)
437 			memset((void *)&mask->v6, 0xff, q);
438 		if (r > 0)
439 			*((u_char *)&mask->v6 + q) =
440 			    (0xff00 >> r) & 0xff;
441 		break;
442 	}
443 	freeaddrinfo(res);
444 }
445 
446 int
447 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
448 {
449 	struct pfioc_src_node_kill psnk;
450 	struct addrinfo *res[2], *resp[2];
451 	struct sockaddr last_src, last_dst;
452 	int killed, sources, dests;
453 	int ret_ga;
454 
455 	killed = sources = dests = 0;
456 
457 	memset(&psnk, 0, sizeof(psnk));
458 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
459 	    sizeof(psnk.psnk_src.addr.v.a.mask));
460 	memset(&last_src, 0xff, sizeof(last_src));
461 	memset(&last_dst, 0xff, sizeof(last_dst));
462 
463 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
464 
465 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
466 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
467 		/* NOTREACHED */
468 	}
469 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
470 		if (resp[0]->ai_addr == NULL)
471 			continue;
472 		/* We get lots of duplicates.  Catch the easy ones */
473 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
474 			continue;
475 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
476 
477 		psnk.psnk_af = resp[0]->ai_family;
478 		sources++;
479 
480 		if (psnk.psnk_af == AF_INET)
481 			psnk.psnk_src.addr.v.a.addr.v4 =
482 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
483 		else if (psnk.psnk_af == AF_INET6)
484 			psnk.psnk_src.addr.v.a.addr.v6 =
485 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
486 			    sin6_addr;
487 		else
488 			errx(1, "Unknown address family %d", psnk.psnk_af);
489 
490 		if (src_node_killers > 1) {
491 			dests = 0;
492 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
493 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
494 			memset(&last_dst, 0xff, sizeof(last_dst));
495 			pfctl_addrprefix(src_node_kill[1],
496 			    &psnk.psnk_dst.addr.v.a.mask);
497 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
498 			    &res[1]))) {
499 				errx(1, "getaddrinfo: %s",
500 				    gai_strerror(ret_ga));
501 				/* NOTREACHED */
502 			}
503 			for (resp[1] = res[1]; resp[1];
504 			    resp[1] = resp[1]->ai_next) {
505 				if (resp[1]->ai_addr == NULL)
506 					continue;
507 				if (psnk.psnk_af != resp[1]->ai_family)
508 					continue;
509 
510 				if (memcmp(&last_dst, resp[1]->ai_addr,
511 				    sizeof(last_dst)) == 0)
512 					continue;
513 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
514 
515 				dests++;
516 
517 				if (psnk.psnk_af == AF_INET)
518 					psnk.psnk_dst.addr.v.a.addr.v4 =
519 					    ((struct sockaddr_in *)resp[1]->
520 					    ai_addr)->sin_addr;
521 				else if (psnk.psnk_af == AF_INET6)
522 					psnk.psnk_dst.addr.v.a.addr.v6 =
523 					    ((struct sockaddr_in6 *)resp[1]->
524 					    ai_addr)->sin6_addr;
525 				else
526 					errx(1, "Unknown address family %d",
527 					    psnk.psnk_af);
528 
529 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
530 					err(1, "DIOCKILLSRCNODES");
531 				killed += psnk.psnk_killed;
532 			}
533 			freeaddrinfo(res[1]);
534 		} else {
535 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
536 				err(1, "DIOCKILLSRCNODES");
537 			killed += psnk.psnk_killed;
538 		}
539 	}
540 
541 	freeaddrinfo(res[0]);
542 
543 	if ((opts & PF_OPT_QUIET) == 0)
544 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
545 		    "destinations\n", killed, sources, dests);
546 	return (0);
547 }
548 
549 int
550 pfctl_net_kill_states(int dev, const char *iface, int opts)
551 {
552 	struct pfioc_state_kill psk;
553 	struct addrinfo *res[2], *resp[2];
554 	struct sockaddr last_src, last_dst;
555 	int killed, sources, dests;
556 	int ret_ga;
557 
558 	killed = sources = dests = 0;
559 
560 	memset(&psk, 0, sizeof(psk));
561 	memset(&psk.psk_src.addr.v.a.mask, 0xff,
562 	    sizeof(psk.psk_src.addr.v.a.mask));
563 	memset(&last_src, 0xff, sizeof(last_src));
564 	memset(&last_dst, 0xff, sizeof(last_dst));
565 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
566 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
567 		errx(1, "invalid interface: %s", iface);
568 
569 	pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
570 
571 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
572 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
573 		/* NOTREACHED */
574 	}
575 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
576 		if (resp[0]->ai_addr == NULL)
577 			continue;
578 		/* We get lots of duplicates.  Catch the easy ones */
579 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
580 			continue;
581 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
582 
583 		psk.psk_af = resp[0]->ai_family;
584 		sources++;
585 
586 		if (psk.psk_af == AF_INET)
587 			psk.psk_src.addr.v.a.addr.v4 =
588 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
589 		else if (psk.psk_af == AF_INET6)
590 			psk.psk_src.addr.v.a.addr.v6 =
591 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
592 			    sin6_addr;
593 		else
594 			errx(1, "Unknown address family %d", psk.psk_af);
595 
596 		if (state_killers > 1) {
597 			dests = 0;
598 			memset(&psk.psk_dst.addr.v.a.mask, 0xff,
599 			    sizeof(psk.psk_dst.addr.v.a.mask));
600 			memset(&last_dst, 0xff, sizeof(last_dst));
601 			pfctl_addrprefix(state_kill[1],
602 			    &psk.psk_dst.addr.v.a.mask);
603 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
604 			    &res[1]))) {
605 				errx(1, "getaddrinfo: %s",
606 				    gai_strerror(ret_ga));
607 				/* NOTREACHED */
608 			}
609 			for (resp[1] = res[1]; resp[1];
610 			    resp[1] = resp[1]->ai_next) {
611 				if (resp[1]->ai_addr == NULL)
612 					continue;
613 				if (psk.psk_af != resp[1]->ai_family)
614 					continue;
615 
616 				if (memcmp(&last_dst, resp[1]->ai_addr,
617 				    sizeof(last_dst)) == 0)
618 					continue;
619 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
620 
621 				dests++;
622 
623 				if (psk.psk_af == AF_INET)
624 					psk.psk_dst.addr.v.a.addr.v4 =
625 					    ((struct sockaddr_in *)resp[1]->
626 					    ai_addr)->sin_addr;
627 				else if (psk.psk_af == AF_INET6)
628 					psk.psk_dst.addr.v.a.addr.v6 =
629 					    ((struct sockaddr_in6 *)resp[1]->
630 					    ai_addr)->sin6_addr;
631 				else
632 					errx(1, "Unknown address family %d",
633 					    psk.psk_af);
634 
635 				if (ioctl(dev, DIOCKILLSTATES, &psk))
636 					err(1, "DIOCKILLSTATES");
637 				killed += psk.psk_killed;
638 			}
639 			freeaddrinfo(res[1]);
640 		} else {
641 			if (ioctl(dev, DIOCKILLSTATES, &psk))
642 				err(1, "DIOCKILLSTATES");
643 			killed += psk.psk_killed;
644 		}
645 	}
646 
647 	freeaddrinfo(res[0]);
648 
649 	if ((opts & PF_OPT_QUIET) == 0)
650 		fprintf(stderr, "killed %d states from %d sources and %d "
651 		    "destinations\n", killed, sources, dests);
652 	return (0);
653 }
654 
655 int
656 pfctl_label_kill_states(int dev, const char *iface, int opts)
657 {
658 	struct pfioc_state_kill psk;
659 
660 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
661 		warnx("no label specified");
662 		usage();
663 	}
664 	memset(&psk, 0, sizeof(psk));
665 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
666 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
667 		errx(1, "invalid interface: %s", iface);
668 
669 	if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
670 	    sizeof(psk.psk_label))
671 		errx(1, "label too long: %s", state_kill[1]);
672 
673 	if (ioctl(dev, DIOCKILLSTATES, &psk))
674 		err(1, "DIOCKILLSTATES");
675 
676 	if ((opts & PF_OPT_QUIET) == 0)
677 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
678 
679 	return (0);
680 }
681 
682 int
683 pfctl_id_kill_states(int dev, const char *iface, int opts)
684 {
685 	struct pfioc_state_kill psk;
686 
687 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
688 		warnx("no id specified");
689 		usage();
690 	}
691 
692 	memset(&psk, 0, sizeof(psk));
693 	if ((sscanf(state_kill[1], "%jx/%x",
694 	    &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
695 		HTONL(psk.psk_pfcmp.creatorid);
696 	else if ((sscanf(state_kill[1], "%jx", &psk.psk_pfcmp.id)) == 1) {
697 		psk.psk_pfcmp.creatorid = 0;
698 	} else {
699 		warnx("wrong id format specified");
700 		usage();
701 	}
702 	if (psk.psk_pfcmp.id == 0) {
703 		warnx("cannot kill id 0");
704 		usage();
705 	}
706 
707 	psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
708 	if (ioctl(dev, DIOCKILLSTATES, &psk))
709 		err(1, "DIOCKILLSTATES");
710 
711 	if ((opts & PF_OPT_QUIET) == 0)
712 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
713 
714 	return (0);
715 }
716 
717 int
718 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
719     u_int32_t ticket, int r_action, char *anchorname)
720 {
721 	struct pfioc_pooladdr pp;
722 	struct pf_pooladdr *pa;
723 	u_int32_t pnr, mpnr;
724 
725 	memset(&pp, 0, sizeof(pp));
726 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
727 	pp.r_action = r_action;
728 	pp.r_num = nr;
729 	pp.ticket = ticket;
730 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
731 		warn("DIOCGETADDRS");
732 		return (-1);
733 	}
734 	mpnr = pp.nr;
735 	TAILQ_INIT(&pool->list);
736 	for (pnr = 0; pnr < mpnr; ++pnr) {
737 		pp.nr = pnr;
738 		if (ioctl(dev, DIOCGETADDR, &pp)) {
739 			warn("DIOCGETADDR");
740 			return (-1);
741 		}
742 		pa = calloc(1, sizeof(struct pf_pooladdr));
743 		if (pa == NULL)
744 			err(1, "calloc");
745 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
746 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
747 	}
748 
749 	return (0);
750 }
751 
752 void
753 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
754 {
755 	struct pf_pooladdr *pa;
756 
757 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
758 		TAILQ_REMOVE(&src->list, pa, entries);
759 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
760 	}
761 }
762 
763 void
764 pfctl_clear_pool(struct pf_pool *pool)
765 {
766 	struct pf_pooladdr *pa;
767 
768 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
769 		TAILQ_REMOVE(&pool->list, pa, entries);
770 		free(pa);
771 	}
772 }
773 
774 void
775 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
776 {
777 	if (opts & PF_OPT_DEBUG) {
778 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
779 		    "p", "sa", "sp", "da", "dp" };
780 		int i;
781 
782 		printf("  [ Skip steps: ");
783 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
784 			if (rule->skip[i].nr == rule->nr + 1)
785 				continue;
786 			printf("%s=", t[i]);
787 			if (rule->skip[i].nr == -1)
788 				printf("end ");
789 			else
790 				printf("%u ", rule->skip[i].nr);
791 		}
792 		printf("]\n");
793 
794 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
795 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
796 	}
797 	if (opts & PF_OPT_VERBOSE) {
798 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
799 			    "Bytes: %-10llu  States: %-6u]\n",
800 			    (unsigned long long)rule->evaluations,
801 			    (unsigned long long)(rule->packets[0] +
802 			    rule->packets[1]),
803 			    (unsigned long long)(rule->bytes[0] +
804 			    rule->bytes[1]), rule->states_cur);
805 		if (!(opts & PF_OPT_DEBUG))
806 			printf("  [ Inserted: uid %u pid %u "
807 			    "State Creations: %-6u]\n",
808 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
809 			    rule->states_tot);
810 	}
811 }
812 
813 void
814 pfctl_print_title(char *title)
815 {
816 	if (!first_title)
817 		printf("\n");
818 	first_title = 0;
819 	printf("%s\n", title);
820 }
821 
822 int
823 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
824     char *anchorname, int depth)
825 {
826 	struct pfioc_rule pr;
827 	u_int32_t nr, mnr, header = 0;
828 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
829 	int numeric = opts & PF_OPT_NUMERIC;
830 	int len = strlen(path);
831 	int brace;
832 	char *p;
833 
834 	if (path[0])
835 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
836 	else
837 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
838 
839 	memset(&pr, 0, sizeof(pr));
840 	memcpy(pr.anchor, path, sizeof(pr.anchor));
841 	if (opts & PF_OPT_SHOWALL) {
842 		pr.rule.action = PF_PASS;
843 		if (ioctl(dev, DIOCGETRULES, &pr)) {
844 			warn("DIOCGETRULES");
845 			goto error;
846 		}
847 		header++;
848 	}
849 	pr.rule.action = PF_SCRUB;
850 	if (ioctl(dev, DIOCGETRULES, &pr)) {
851 		warn("DIOCGETRULES");
852 		goto error;
853 	}
854 	if (opts & PF_OPT_SHOWALL) {
855 		if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
856 			pfctl_print_title("FILTER RULES:");
857 		else if (format == PFCTL_SHOW_LABELS && labels)
858 			pfctl_print_title("LABEL COUNTERS:");
859 	}
860 	mnr = pr.nr;
861 	if (opts & PF_OPT_CLRRULECTRS)
862 		pr.action = PF_GET_CLR_CNTR;
863 
864 	for (nr = 0; nr < mnr; ++nr) {
865 		pr.nr = nr;
866 		if (ioctl(dev, DIOCGETRULE, &pr)) {
867 			warn("DIOCGETRULE");
868 			goto error;
869 		}
870 
871 		if (pfctl_get_pool(dev, &pr.rule.rpool,
872 		    nr, pr.ticket, PF_SCRUB, path) != 0)
873 			goto error;
874 
875 		switch (format) {
876 		case PFCTL_SHOW_LABELS:
877 			break;
878 		case PFCTL_SHOW_RULES:
879 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
880 				labels = 1;
881 			print_rule(&pr.rule, pr.anchor_call, rule_numbers, numeric);
882 			printf("\n");
883 			pfctl_print_rule_counters(&pr.rule, opts);
884 			break;
885 		case PFCTL_SHOW_NOTHING:
886 			break;
887 		}
888 		pfctl_clear_pool(&pr.rule.rpool);
889 	}
890 	pr.rule.action = PF_PASS;
891 	if (ioctl(dev, DIOCGETRULES, &pr)) {
892 		warn("DIOCGETRULES");
893 		goto error;
894 	}
895 	mnr = pr.nr;
896 	for (nr = 0; nr < mnr; ++nr) {
897 		pr.nr = nr;
898 		if (ioctl(dev, DIOCGETRULE, &pr)) {
899 			warn("DIOCGETRULE");
900 			goto error;
901 		}
902 
903 		if (pfctl_get_pool(dev, &pr.rule.rpool,
904 		    nr, pr.ticket, PF_PASS, path) != 0)
905 			goto error;
906 
907 		switch (format) {
908 		case PFCTL_SHOW_LABELS:
909 			if (pr.rule.label[0]) {
910 				printf("%s %llu %llu %llu %llu"
911 				    " %llu %llu %llu %llu\n",
912 				    pr.rule.label,
913 				    (unsigned long long)pr.rule.evaluations,
914 				    (unsigned long long)(pr.rule.packets[0] +
915 				    pr.rule.packets[1]),
916 				    (unsigned long long)(pr.rule.bytes[0] +
917 				    pr.rule.bytes[1]),
918 				    (unsigned long long)pr.rule.packets[0],
919 				    (unsigned long long)pr.rule.bytes[0],
920 				    (unsigned long long)pr.rule.packets[1],
921 				    (unsigned long long)pr.rule.bytes[1],
922 				    (unsigned long long)pr.rule.states_tot);
923 			}
924 			break;
925 		case PFCTL_SHOW_RULES:
926 			brace = 0;
927 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
928 				labels = 1;
929 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
930 			if (pr.anchor_call[0] &&
931 			   ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
932 			   ((void *)p == (void *)pr.anchor_call ||
933 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
934 				brace++;
935 				if ((p = strrchr(pr.anchor_call, '/')) !=
936 				    NULL)
937 					p++;
938 				else
939 					p = &pr.anchor_call[0];
940 			} else
941 				p = &pr.anchor_call[0];
942 
943 			print_rule(&pr.rule, p, rule_numbers, numeric);
944 			if (brace)
945 				printf(" {\n");
946 			else
947 				printf("\n");
948 			pfctl_print_rule_counters(&pr.rule, opts);
949 			if (brace) {
950 				pfctl_show_rules(dev, path, opts, format,
951 				    p, depth + 1);
952 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
953 				printf("}\n");
954 			}
955 			break;
956 		case PFCTL_SHOW_NOTHING:
957 			break;
958 		}
959 		pfctl_clear_pool(&pr.rule.rpool);
960 	}
961 	path[len] = '\0';
962 	return (0);
963 
964  error:
965 	path[len] = '\0';
966 	return (-1);
967 }
968 
969 int
970 pfctl_show_nat(int dev, int opts, char *anchorname)
971 {
972 	struct pfioc_rule pr;
973 	u_int32_t mnr, nr;
974 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
975 	int i, dotitle = opts & PF_OPT_SHOWALL;
976 
977 	memset(&pr, 0, sizeof(pr));
978 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
979 	for (i = 0; i < 3; i++) {
980 		pr.rule.action = nattype[i];
981 		if (ioctl(dev, DIOCGETRULES, &pr)) {
982 			warn("DIOCGETRULES");
983 			return (-1);
984 		}
985 		mnr = pr.nr;
986 		for (nr = 0; nr < mnr; ++nr) {
987 			pr.nr = nr;
988 			if (ioctl(dev, DIOCGETRULE, &pr)) {
989 				warn("DIOCGETRULE");
990 				return (-1);
991 			}
992 			if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
993 			    pr.ticket, nattype[i], anchorname) != 0)
994 				return (-1);
995 			if (dotitle) {
996 				pfctl_print_title("TRANSLATION RULES:");
997 				dotitle = 0;
998 			}
999 			print_rule(&pr.rule, pr.anchor_call,
1000 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1001 			printf("\n");
1002 			pfctl_print_rule_counters(&pr.rule, opts);
1003 			pfctl_clear_pool(&pr.rule.rpool);
1004 		}
1005 	}
1006 	return (0);
1007 }
1008 
1009 int
1010 pfctl_show_src_nodes(int dev, int opts)
1011 {
1012 	struct pfioc_src_nodes psn;
1013 	struct pf_src_node *p;
1014 	char *inbuf = NULL, *newinbuf = NULL;
1015 	unsigned int len = 0;
1016 	int i;
1017 
1018 	memset(&psn, 0, sizeof(psn));
1019 	for (;;) {
1020 		psn.psn_len = len;
1021 		if (len) {
1022 			newinbuf = realloc(inbuf, len);
1023 			if (newinbuf == NULL)
1024 				err(1, "realloc");
1025 			psn.psn_buf = inbuf = newinbuf;
1026 		}
1027 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1028 			warn("DIOCGETSRCNODES");
1029 			free(inbuf);
1030 			return (-1);
1031 		}
1032 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1033 			break;
1034 		if (len == 0 && psn.psn_len == 0)
1035 			goto done;
1036 		if (len == 0 && psn.psn_len != 0)
1037 			len = psn.psn_len;
1038 		if (psn.psn_len == 0)
1039 			goto done;	/* no src_nodes */
1040 		len *= 2;
1041 	}
1042 	p = psn.psn_src_nodes;
1043 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1044 		pfctl_print_title("SOURCE TRACKING NODES:");
1045 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1046 		print_src_node(p, opts);
1047 		p++;
1048 	}
1049 done:
1050 	free(inbuf);
1051 	return (0);
1052 }
1053 
1054 int
1055 pfctl_show_states(int dev, const char *iface, int opts)
1056 {
1057 	struct pfioc_states ps;
1058 	struct pfsync_state *p;
1059 	char *inbuf = NULL, *newinbuf = NULL;
1060 	unsigned int len = 0;
1061 	int i, dotitle = (opts & PF_OPT_SHOWALL);
1062 
1063 	memset(&ps, 0, sizeof(ps));
1064 	for (;;) {
1065 		ps.ps_len = len;
1066 		if (len) {
1067 			newinbuf = realloc(inbuf, len);
1068 			if (newinbuf == NULL)
1069 				err(1, "realloc");
1070 			ps.ps_buf = inbuf = newinbuf;
1071 		}
1072 		if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1073 			warn("DIOCGETSTATES");
1074 			free(inbuf);
1075 			return (-1);
1076 		}
1077 		if (ps.ps_len + sizeof(struct pfioc_states) < len)
1078 			break;
1079 		if (len == 0 && ps.ps_len == 0)
1080 			goto done;
1081 		if (len == 0 && ps.ps_len != 0)
1082 			len = ps.ps_len;
1083 		if (ps.ps_len == 0)
1084 			goto done;	/* no states */
1085 		len *= 2;
1086 	}
1087 	p = ps.ps_states;
1088 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1089 		if (iface != NULL && strcmp(p->ifname, iface))
1090 			continue;
1091 		if (dotitle) {
1092 			pfctl_print_title("STATES:");
1093 			dotitle = 0;
1094 		}
1095 		print_state(p, opts);
1096 	}
1097 done:
1098 	free(inbuf);
1099 	return (0);
1100 }
1101 
1102 int
1103 pfctl_show_status(int dev, int opts)
1104 {
1105 	struct pf_status status;
1106 
1107 	if (ioctl(dev, DIOCGETSTATUS, &status)) {
1108 		warn("DIOCGETSTATUS");
1109 		return (-1);
1110 	}
1111 	if (opts & PF_OPT_SHOWALL)
1112 		pfctl_print_title("INFO:");
1113 	print_status(&status, opts);
1114 	return (0);
1115 }
1116 
1117 int
1118 pfctl_show_timeouts(int dev, int opts)
1119 {
1120 	struct pfioc_tm pt;
1121 	int i;
1122 
1123 	if (opts & PF_OPT_SHOWALL)
1124 		pfctl_print_title("TIMEOUTS:");
1125 	memset(&pt, 0, sizeof(pt));
1126 	for (i = 0; pf_timeouts[i].name; i++) {
1127 		pt.timeout = pf_timeouts[i].timeout;
1128 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1129 			err(1, "DIOCGETTIMEOUT");
1130 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1131 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1132 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1133 			printf(" states");
1134 		else
1135 			printf("s");
1136 		printf("\n");
1137 	}
1138 	return (0);
1139 
1140 }
1141 
1142 int
1143 pfctl_show_limits(int dev, int opts)
1144 {
1145 	struct pfioc_limit pl;
1146 	int i;
1147 
1148 	if (opts & PF_OPT_SHOWALL)
1149 		pfctl_print_title("LIMITS:");
1150 	memset(&pl, 0, sizeof(pl));
1151 	for (i = 0; pf_limits[i].name; i++) {
1152 		pl.index = pf_limits[i].index;
1153 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1154 			err(1, "DIOCGETLIMIT");
1155 		printf("%-13s ", pf_limits[i].name);
1156 		if (pl.limit == UINT_MAX)
1157 			printf("unlimited\n");
1158 		else
1159 			printf("hard limit %8u\n", pl.limit);
1160 	}
1161 	return (0);
1162 }
1163 
1164 /* callbacks for rule/nat/rdr/addr */
1165 int
1166 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1167 {
1168 	struct pf_pooladdr *pa;
1169 
1170 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1171 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1172 			err(1, "DIOCBEGINADDRS");
1173 	}
1174 
1175 	pf->paddr.af = af;
1176 	TAILQ_FOREACH(pa, &p->list, entries) {
1177 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1178 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1179 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1180 				err(1, "DIOCADDADDR");
1181 		}
1182 	}
1183 	return (0);
1184 }
1185 
1186 int
1187 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1188 {
1189 	u_int8_t		rs_num;
1190 	struct pf_rule		*rule;
1191 	struct pf_ruleset	*rs;
1192 	char 			*p;
1193 
1194 	rs_num = pf_get_ruleset_number(r->action);
1195 	if (rs_num == PF_RULESET_MAX)
1196 		errx(1, "Invalid rule type %d", r->action);
1197 
1198 	rs = &pf->anchor->ruleset;
1199 
1200 	if (anchor_call[0] && r->anchor == NULL) {
1201 		/*
1202 		 * Don't make non-brace anchors part of the main anchor pool.
1203 		 */
1204 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1205 			err(1, "pfctl_add_rule: calloc");
1206 
1207 		pf_init_ruleset(&r->anchor->ruleset);
1208 		r->anchor->ruleset.anchor = r->anchor;
1209 		if (strlcpy(r->anchor->path, anchor_call,
1210 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1211 			errx(1, "pfctl_add_rule: strlcpy");
1212 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1213 			if (!strlen(p))
1214 				err(1, "pfctl_add_rule: bad anchor name %s",
1215 				    anchor_call);
1216 		} else
1217 			p = (char *)anchor_call;
1218 		if (strlcpy(r->anchor->name, p,
1219 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1220 			errx(1, "pfctl_add_rule: strlcpy");
1221 	}
1222 
1223 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1224 		err(1, "calloc");
1225 	bcopy(r, rule, sizeof(*rule));
1226 	TAILQ_INIT(&rule->rpool.list);
1227 	pfctl_move_pool(&r->rpool, &rule->rpool);
1228 
1229 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1230 	return (0);
1231 }
1232 
1233 int
1234 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1235 {
1236 	int osize = pf->trans->pfrb_size;
1237 
1238 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1239 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1240 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1241 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1242 			return (1);
1243 	}
1244 	if (a == pf->astack[0] && ((altqsupport &&
1245 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1246 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1247 			return (2);
1248 	}
1249 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1250 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1251 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1252 			return (3);
1253 	}
1254 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1255 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1256 			return (4);
1257 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1258 		return (5);
1259 
1260 	return (0);
1261 }
1262 
1263 int
1264 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1265     int rs_num, int depth)
1266 {
1267 	struct pf_rule *r;
1268 	int		error, len = strlen(path);
1269 	int		brace = 0;
1270 
1271 	pf->anchor = rs->anchor;
1272 
1273 	if (path[0])
1274 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1275 	else
1276 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1277 
1278 	if (depth) {
1279 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1280 			brace++;
1281 			if (pf->opts & PF_OPT_VERBOSE)
1282 				printf(" {\n");
1283 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1284 			    (error = pfctl_ruleset_trans(pf,
1285 			    path, rs->anchor))) {
1286 				printf("pfctl_load_rulesets: "
1287 				    "pfctl_ruleset_trans %d\n", error);
1288 				goto error;
1289 			}
1290 		} else if (pf->opts & PF_OPT_VERBOSE)
1291 			printf("\n");
1292 
1293 	}
1294 
1295 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1296 		pfctl_optimize_ruleset(pf, rs);
1297 
1298 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1299 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1300 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1301 			goto error;
1302 		if (r->anchor) {
1303 			if ((error = pfctl_load_ruleset(pf, path,
1304 			    &r->anchor->ruleset, rs_num, depth + 1)))
1305 				goto error;
1306 		} else if (pf->opts & PF_OPT_VERBOSE)
1307 			printf("\n");
1308 		free(r);
1309 	}
1310 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1311 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1312 		printf("}\n");
1313 	}
1314 	path[len] = '\0';
1315 	return (0);
1316 
1317  error:
1318 	path[len] = '\0';
1319 	return (error);
1320 
1321 }
1322 
1323 int
1324 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1325 {
1326 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1327 	char			*name;
1328 	struct pfioc_rule	pr;
1329 	int			len = strlen(path);
1330 
1331 	bzero(&pr, sizeof(pr));
1332 	/* set up anchor before adding to path for anchor_call */
1333 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1334 		pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1335 	if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1336 		errx(1, "pfctl_load_rule: strlcpy");
1337 
1338 	if (r->anchor) {
1339 		if (r->anchor->match) {
1340 			if (path[0])
1341 				snprintf(&path[len], MAXPATHLEN - len,
1342 				    "/%s", r->anchor->name);
1343 			else
1344 				snprintf(&path[len], MAXPATHLEN - len,
1345 				    "%s", r->anchor->name);
1346 			name = path;
1347 		} else
1348 			name = r->anchor->path;
1349 	} else
1350 		name = "";
1351 
1352 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1353 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1354 			return (1);
1355 		pr.pool_ticket = pf->paddr.ticket;
1356 		memcpy(&pr.rule, r, sizeof(pr.rule));
1357 		if (r->anchor && strlcpy(pr.anchor_call, name,
1358 		    sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1359 			errx(1, "pfctl_load_rule: strlcpy");
1360 		if (ioctl(pf->dev, DIOCADDRULE, &pr))
1361 			err(1, "DIOCADDRULE");
1362 	}
1363 
1364 	if (pf->opts & PF_OPT_VERBOSE) {
1365 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1366 		print_rule(r, r->anchor ? r->anchor->name : "",
1367 		    pf->opts & PF_OPT_VERBOSE2,
1368 		    pf->opts & PF_OPT_NUMERIC);
1369 	}
1370 	path[len] = '\0';
1371 	pfctl_clear_pool(&r->rpool);
1372 	return (0);
1373 }
1374 
1375 int
1376 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1377 {
1378 	if (altqsupport &&
1379 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1380 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1381 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1382 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1383 				if (errno == ENXIO)
1384 					errx(1, "qtype not configured");
1385 				else if (errno == ENODEV)
1386 					errx(1, "%s: driver does not support "
1387 					    "altq", a->ifname);
1388 				else
1389 					err(1, "DIOCADDALTQ");
1390 			}
1391 		}
1392 		pfaltq_store(&pf->paltq->altq);
1393 	}
1394 	return (0);
1395 }
1396 
1397 int
1398 pfctl_rules(int dev, char *filename, int opts, int optimize,
1399     char *anchorname, struct pfr_buffer *trans)
1400 {
1401 #define ERR(x) do { warn(x); goto _error; } while(0)
1402 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1403 
1404 	struct pfr_buffer	*t, buf;
1405 	struct pfioc_altq	 pa;
1406 	struct pfctl		 pf;
1407 	struct pf_ruleset	*rs;
1408 	struct pfr_table	 trs;
1409 	char			*path;
1410 	int			 osize;
1411 
1412 	RB_INIT(&pf_anchors);
1413 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1414 	pf_init_ruleset(&pf_main_anchor.ruleset);
1415 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1416 	if (trans == NULL) {
1417 		bzero(&buf, sizeof(buf));
1418 		buf.pfrb_type = PFRB_TRANS;
1419 		t = &buf;
1420 		osize = 0;
1421 	} else {
1422 		t = trans;
1423 		osize = t->pfrb_size;
1424 	}
1425 
1426 	memset(&pa, 0, sizeof(pa));
1427 	memset(&pf, 0, sizeof(pf));
1428 	memset(&trs, 0, sizeof(trs));
1429 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1430 		ERRX("pfctl_rules: calloc");
1431 	if (strlcpy(trs.pfrt_anchor, anchorname,
1432 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1433 		ERRX("pfctl_rules: strlcpy");
1434 	pf.dev = dev;
1435 	pf.opts = opts;
1436 	pf.optimize = optimize;
1437 	pf.loadopt = loadopt;
1438 
1439 	/* non-brace anchor, create without resolving the path */
1440 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1441 		ERRX("pfctl_rules: calloc");
1442 	rs = &pf.anchor->ruleset;
1443 	pf_init_ruleset(rs);
1444 	rs->anchor = pf.anchor;
1445 	if (strlcpy(pf.anchor->path, anchorname,
1446 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1447 		errx(1, "pfctl_add_rule: strlcpy");
1448 	if (strlcpy(pf.anchor->name, anchorname,
1449 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1450 		errx(1, "pfctl_add_rule: strlcpy");
1451 
1452 
1453 	pf.astack[0] = pf.anchor;
1454 	pf.asd = 0;
1455 	if (anchorname[0])
1456 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1457 	pf.paltq = &pa;
1458 	pf.trans = t;
1459 	pfctl_init_options(&pf);
1460 
1461 	if ((opts & PF_OPT_NOACTION) == 0) {
1462 		/*
1463 		 * XXX For the time being we need to open transactions for
1464 		 * the main ruleset before parsing, because tables are still
1465 		 * loaded at parse time.
1466 		 */
1467 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1468 			ERRX("pfctl_rules");
1469 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1470 			pa.ticket =
1471 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1472 		if (pf.loadopt & PFCTL_FLAG_TABLE)
1473 			pf.astack[0]->ruleset.tticket =
1474 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1475 	}
1476 
1477 	if (parse_config(filename, &pf) < 0) {
1478 		if ((opts & PF_OPT_NOACTION) == 0)
1479 			ERRX("Syntax error in config file: "
1480 			    "pf rules not loaded");
1481 		else
1482 			goto _error;
1483 	}
1484 
1485 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1486 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1487 	    (pf.loadopt & PFCTL_FLAG_NAT &&
1488 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1489 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1490 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1491 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
1492 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1493 		if ((opts & PF_OPT_NOACTION) == 0)
1494 			ERRX("Unable to load rules into kernel");
1495 		else
1496 			goto _error;
1497 	}
1498 
1499 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1500 		if (check_commit_altq(dev, opts) != 0)
1501 			ERRX("errors in altq config");
1502 
1503 	/* process "load anchor" directives */
1504 	if (!anchorname[0])
1505 		if (pfctl_load_anchors(dev, &pf, t) == -1)
1506 			ERRX("load anchors");
1507 
1508 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1509 		if (!anchorname[0])
1510 			if (pfctl_load_options(&pf))
1511 				goto _error;
1512 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1513 			ERR("DIOCXCOMMIT");
1514 	}
1515 	return (0);
1516 
1517 _error:
1518 	if (trans == NULL) {	/* main ruleset */
1519 		if ((opts & PF_OPT_NOACTION) == 0)
1520 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1521 				err(1, "DIOCXROLLBACK");
1522 		exit(1);
1523 	} else {		/* sub ruleset */
1524 		return (-1);
1525 	}
1526 
1527 #undef ERR
1528 #undef ERRX
1529 }
1530 
1531 FILE *
1532 pfctl_fopen(const char *name, const char *mode)
1533 {
1534 	struct stat	 st;
1535 	FILE		*fp;
1536 
1537 	fp = fopen(name, mode);
1538 	if (fp == NULL)
1539 		return (NULL);
1540 	if (fstat(fileno(fp), &st)) {
1541 		fclose(fp);
1542 		return (NULL);
1543 	}
1544 	if (S_ISDIR(st.st_mode)) {
1545 		fclose(fp);
1546 		errno = EISDIR;
1547 		return (NULL);
1548 	}
1549 	return (fp);
1550 }
1551 
1552 void
1553 pfctl_init_options(struct pfctl *pf)
1554 {
1555 
1556 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1557 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1558 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1559 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1560 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1561 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1562 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1563 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1564 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1565 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1566 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1567 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1568 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1569 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1570 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1571 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1572 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1573 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1574 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1575 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1576 
1577 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1578 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1579 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1580 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1581 
1582 	pf->debug = PF_DEBUG_URGENT;
1583 }
1584 
1585 int
1586 pfctl_load_options(struct pfctl *pf)
1587 {
1588 	int i, error = 0;
1589 
1590 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1591 		return (0);
1592 
1593 	/* load limits */
1594 	for (i = 0; i < PF_LIMIT_MAX; i++) {
1595 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1596 			continue;
1597 		if (pfctl_load_limit(pf, i, pf->limit[i]))
1598 			error = 1;
1599 	}
1600 
1601 	/*
1602 	 * If we've set the limit, but haven't explicitly set adaptive
1603 	 * timeouts, do it now with a start of 60% and end of 120%.
1604 	 */
1605 	if (pf->limit_set[PF_LIMIT_STATES] &&
1606 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1607 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1608 		pf->timeout[PFTM_ADAPTIVE_START] =
1609 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
1610 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1611 		pf->timeout[PFTM_ADAPTIVE_END] =
1612 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
1613 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1614 	}
1615 
1616 	/* load timeouts */
1617 	for (i = 0; i < PFTM_MAX; i++) {
1618 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1619 			continue;
1620 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1621 			error = 1;
1622 	}
1623 
1624 	/* load debug */
1625 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1626 		if (pfctl_load_debug(pf, pf->debug))
1627 			error = 1;
1628 
1629 	/* load logif */
1630 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1631 		if (pfctl_load_logif(pf, pf->ifname))
1632 			error = 1;
1633 
1634 	/* load hostid */
1635 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1636 		if (pfctl_load_hostid(pf, pf->hostid))
1637 			error = 1;
1638 
1639 	return (error);
1640 }
1641 
1642 int
1643 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1644 {
1645 	int i;
1646 
1647 
1648 	for (i = 0; pf_limits[i].name; i++) {
1649 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
1650 			pf->limit[pf_limits[i].index] = limit;
1651 			pf->limit_set[pf_limits[i].index] = 1;
1652 			break;
1653 		}
1654 	}
1655 	if (pf_limits[i].name == NULL) {
1656 		warnx("Bad pool name.");
1657 		return (1);
1658 	}
1659 
1660 	if (pf->opts & PF_OPT_VERBOSE)
1661 		printf("set limit %s %d\n", opt, limit);
1662 
1663 	return (0);
1664 }
1665 
1666 int
1667 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1668 {
1669 	struct pfioc_limit pl;
1670 
1671 	memset(&pl, 0, sizeof(pl));
1672 	pl.index = index;
1673 	pl.limit = limit;
1674 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1675 		if (errno == EBUSY)
1676 			warnx("Current pool size exceeds requested hard limit");
1677 		else
1678 			warnx("DIOCSETLIMIT");
1679 		return (1);
1680 	}
1681 	return (0);
1682 }
1683 
1684 int
1685 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1686 {
1687 	int i;
1688 
1689 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1690 		return (0);
1691 
1692 	for (i = 0; pf_timeouts[i].name; i++) {
1693 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1694 			pf->timeout[pf_timeouts[i].timeout] = seconds;
1695 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
1696 			break;
1697 		}
1698 	}
1699 
1700 	if (pf_timeouts[i].name == NULL) {
1701 		warnx("Bad timeout name.");
1702 		return (1);
1703 	}
1704 
1705 
1706 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1707 		printf("set timeout %s %d\n", opt, seconds);
1708 
1709 	return (0);
1710 }
1711 
1712 int
1713 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1714 {
1715 	struct pfioc_tm pt;
1716 
1717 	memset(&pt, 0, sizeof(pt));
1718 	pt.timeout = timeout;
1719 	pt.seconds = seconds;
1720 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1721 		warnx("DIOCSETTIMEOUT");
1722 		return (1);
1723 	}
1724 	return (0);
1725 }
1726 
1727 int
1728 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1729 {
1730 	const struct pf_hint *hint;
1731 	int i, r;
1732 
1733 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1734 		return (0);
1735 
1736 	for (i = 0; pf_hints[i].name; i++)
1737 		if (strcasecmp(opt, pf_hints[i].name) == 0)
1738 			break;
1739 
1740 	hint = pf_hints[i].hint;
1741 	if (hint == NULL) {
1742 		warnx("invalid state timeouts optimization");
1743 		return (1);
1744 	}
1745 
1746 	for (i = 0; hint[i].name; i++)
1747 		if ((r = pfctl_set_timeout(pf, hint[i].name,
1748 		    hint[i].timeout, 1)))
1749 			return (r);
1750 
1751 	if (pf->opts & PF_OPT_VERBOSE)
1752 		printf("set optimization %s\n", opt);
1753 
1754 	return (0);
1755 }
1756 
1757 int
1758 pfctl_set_logif(struct pfctl *pf, char *ifname)
1759 {
1760 
1761 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1762 		return (0);
1763 
1764 	if (!strcmp(ifname, "none")) {
1765 		free(pf->ifname);
1766 		pf->ifname = NULL;
1767 	} else {
1768 		pf->ifname = strdup(ifname);
1769 		if (!pf->ifname)
1770 			errx(1, "pfctl_set_logif: strdup");
1771 	}
1772 	pf->ifname_set = 1;
1773 
1774 	if (pf->opts & PF_OPT_VERBOSE)
1775 		printf("set loginterface %s\n", ifname);
1776 
1777 	return (0);
1778 }
1779 
1780 int
1781 pfctl_load_logif(struct pfctl *pf, char *ifname)
1782 {
1783 	struct pfioc_if pi;
1784 
1785 	memset(&pi, 0, sizeof(pi));
1786 	if (ifname && strlcpy(pi.ifname, ifname,
1787 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1788 		warnx("pfctl_load_logif: strlcpy");
1789 		return (1);
1790 	}
1791 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1792 		warnx("DIOCSETSTATUSIF");
1793 		return (1);
1794 	}
1795 	return (0);
1796 }
1797 
1798 int
1799 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1800 {
1801 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1802 		return (0);
1803 
1804 	HTONL(hostid);
1805 
1806 	pf->hostid = hostid;
1807 	pf->hostid_set = 1;
1808 
1809 	if (pf->opts & PF_OPT_VERBOSE)
1810 		printf("set hostid 0x%08x\n", ntohl(hostid));
1811 
1812 	return (0);
1813 }
1814 
1815 int
1816 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
1817 {
1818 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
1819 		warnx("DIOCSETHOSTID");
1820 		return (1);
1821 	}
1822 	return (0);
1823 }
1824 
1825 int
1826 pfctl_set_debug(struct pfctl *pf, char *d)
1827 {
1828 	u_int32_t	level;
1829 
1830 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1831 		return (0);
1832 
1833 	if (!strcmp(d, "none"))
1834 		pf->debug = PF_DEBUG_NONE;
1835 	else if (!strcmp(d, "urgent"))
1836 		pf->debug = PF_DEBUG_URGENT;
1837 	else if (!strcmp(d, "misc"))
1838 		pf->debug = PF_DEBUG_MISC;
1839 	else if (!strcmp(d, "loud"))
1840 		pf->debug = PF_DEBUG_NOISY;
1841 	else {
1842 		warnx("unknown debug level \"%s\"", d);
1843 		return (-1);
1844 	}
1845 
1846 	pf->debug_set = 1;
1847 
1848 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1849 		if (ioctl(dev, DIOCSETDEBUG, &level))
1850 			err(1, "DIOCSETDEBUG");
1851 
1852 	if (pf->opts & PF_OPT_VERBOSE)
1853 		printf("set debug %s\n", d);
1854 
1855 	return (0);
1856 }
1857 
1858 int
1859 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1860 {
1861 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1862 		warnx("DIOCSETDEBUG");
1863 		return (1);
1864 	}
1865 	return (0);
1866 }
1867 
1868 int
1869 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1870 {
1871 	struct pfioc_iface	pi;
1872 
1873 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1874 		return (0);
1875 
1876 	bzero(&pi, sizeof(pi));
1877 
1878 	pi.pfiio_flags = flags;
1879 
1880 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1881 	    sizeof(pi.pfiio_name))
1882 		errx(1, "pfctl_set_interface_flags: strlcpy");
1883 
1884 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1885 		if (how == 0) {
1886 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1887 				err(1, "DIOCCLRIFFLAG");
1888 		} else {
1889 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1890 				err(1, "DIOCSETIFFLAG");
1891 		}
1892 	}
1893 	return (0);
1894 }
1895 
1896 void
1897 pfctl_debug(int dev, u_int32_t level, int opts)
1898 {
1899 	if (ioctl(dev, DIOCSETDEBUG, &level))
1900 		err(1, "DIOCSETDEBUG");
1901 	if ((opts & PF_OPT_QUIET) == 0) {
1902 		fprintf(stderr, "debug level set to '");
1903 		switch (level) {
1904 		case PF_DEBUG_NONE:
1905 			fprintf(stderr, "none");
1906 			break;
1907 		case PF_DEBUG_URGENT:
1908 			fprintf(stderr, "urgent");
1909 			break;
1910 		case PF_DEBUG_MISC:
1911 			fprintf(stderr, "misc");
1912 			break;
1913 		case PF_DEBUG_NOISY:
1914 			fprintf(stderr, "loud");
1915 			break;
1916 		default:
1917 			fprintf(stderr, "<invalid>");
1918 			break;
1919 		}
1920 		fprintf(stderr, "'\n");
1921 	}
1922 }
1923 
1924 int
1925 pfctl_test_altqsupport(int dev, int opts)
1926 {
1927 	struct pfioc_altq pa;
1928 
1929 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
1930 		if (errno == ENODEV) {
1931 			if (!(opts & PF_OPT_QUIET))
1932 				fprintf(stderr, "No ALTQ support in kernel\n"
1933 				    "ALTQ related functions disabled\n");
1934 			return (0);
1935 		} else
1936 			err(1, "DIOCGETALTQS");
1937 	}
1938 	return (1);
1939 }
1940 
1941 int
1942 pfctl_show_anchors(int dev, int opts, char *anchorname)
1943 {
1944 	struct pfioc_ruleset	 pr;
1945 	u_int32_t		 mnr, nr;
1946 
1947 	memset(&pr, 0, sizeof(pr));
1948 	memcpy(pr.path, anchorname, sizeof(pr.path));
1949 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1950 		if (errno == EINVAL)
1951 			fprintf(stderr, "Anchor '%s' not found.\n",
1952 			    anchorname);
1953 		else
1954 			err(1, "DIOCGETRULESETS");
1955 		return (-1);
1956 	}
1957 	mnr = pr.nr;
1958 	for (nr = 0; nr < mnr; ++nr) {
1959 		char sub[MAXPATHLEN];
1960 
1961 		pr.nr = nr;
1962 		if (ioctl(dev, DIOCGETRULESET, &pr))
1963 			err(1, "DIOCGETRULESET");
1964 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1965 			continue;
1966 		sub[0] = 0;
1967 		if (pr.path[0]) {
1968 			strlcat(sub, pr.path, sizeof(sub));
1969 			strlcat(sub, "/", sizeof(sub));
1970 		}
1971 		strlcat(sub, pr.name, sizeof(sub));
1972 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1973 			printf("  %s\n", sub);
1974 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1975 			return (-1);
1976 	}
1977 	return (0);
1978 }
1979 
1980 const char *
1981 pfctl_lookup_option(char *cmd, const char **list)
1982 {
1983 	if (cmd != NULL && *cmd)
1984 		for (; *list; list++)
1985 			if (!strncmp(cmd, *list, strlen(cmd)))
1986 				return (*list);
1987 	return (NULL);
1988 }
1989 
1990 int
1991 main(int argc, char *argv[])
1992 {
1993 	int	 error = 0;
1994 	int	 ch;
1995 	int	 mode = O_RDONLY;
1996 	int	 opts = 0;
1997 	int	 optimize = PF_OPTIMIZE_BASIC;
1998 	char	 anchorname[MAXPATHLEN];
1999 	char	*path;
2000 
2001 	if (argc < 2)
2002 		usage();
2003 
2004 	while ((ch = getopt(argc, argv,
2005 	    "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2006 		switch (ch) {
2007 		case 'a':
2008 			anchoropt = optarg;
2009 			break;
2010 		case 'd':
2011 			opts |= PF_OPT_DISABLE;
2012 			mode = O_RDWR;
2013 			break;
2014 		case 'D':
2015 			if (pfctl_cmdline_symset(optarg) < 0)
2016 				warnx("could not parse macro definition %s",
2017 				    optarg);
2018 			break;
2019 		case 'e':
2020 			opts |= PF_OPT_ENABLE;
2021 			mode = O_RDWR;
2022 			break;
2023 		case 'q':
2024 			opts |= PF_OPT_QUIET;
2025 			break;
2026 		case 'F':
2027 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2028 			if (clearopt == NULL) {
2029 				warnx("Unknown flush modifier '%s'", optarg);
2030 				usage();
2031 			}
2032 			mode = O_RDWR;
2033 			break;
2034 		case 'i':
2035 			ifaceopt = optarg;
2036 			break;
2037 		case 'k':
2038 			if (state_killers >= 2) {
2039 				warnx("can only specify -k twice");
2040 				usage();
2041 				/* NOTREACHED */
2042 			}
2043 			state_kill[state_killers++] = optarg;
2044 			mode = O_RDWR;
2045 			break;
2046 		case 'K':
2047 			if (src_node_killers >= 2) {
2048 				warnx("can only specify -K twice");
2049 				usage();
2050 				/* NOTREACHED */
2051 			}
2052 			src_node_kill[src_node_killers++] = optarg;
2053 			mode = O_RDWR;
2054 			break;
2055 		case 'm':
2056 			opts |= PF_OPT_MERGE;
2057 			break;
2058 		case 'n':
2059 			opts |= PF_OPT_NOACTION;
2060 			break;
2061 		case 'N':
2062 			loadopt |= PFCTL_FLAG_NAT;
2063 			break;
2064 		case 'r':
2065 			opts |= PF_OPT_USEDNS;
2066 			break;
2067 		case 'f':
2068 			rulesopt = optarg;
2069 			mode = O_RDWR;
2070 			break;
2071 		case 'g':
2072 			opts |= PF_OPT_DEBUG;
2073 			break;
2074 		case 'A':
2075 			loadopt |= PFCTL_FLAG_ALTQ;
2076 			break;
2077 		case 'R':
2078 			loadopt |= PFCTL_FLAG_FILTER;
2079 			break;
2080 		case 'o':
2081 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2082 			if (optiopt == NULL) {
2083 				warnx("Unknown optimization '%s'", optarg);
2084 				usage();
2085 			}
2086 			opts |= PF_OPT_OPTIMIZE;
2087 			break;
2088 		case 'O':
2089 			loadopt |= PFCTL_FLAG_OPTION;
2090 			break;
2091 		case 'p':
2092 			pf_device = optarg;
2093 			break;
2094 		case 'P':
2095 			opts |= PF_OPT_NUMERIC;
2096 			break;
2097 		case 's':
2098 			showopt = pfctl_lookup_option(optarg, showopt_list);
2099 			if (showopt == NULL) {
2100 				warnx("Unknown show modifier '%s'", optarg);
2101 				usage();
2102 			}
2103 			break;
2104 		case 't':
2105 			tableopt = optarg;
2106 			break;
2107 		case 'T':
2108 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2109 			if (tblcmdopt == NULL) {
2110 				warnx("Unknown table command '%s'", optarg);
2111 				usage();
2112 			}
2113 			break;
2114 		case 'v':
2115 			if (opts & PF_OPT_VERBOSE)
2116 				opts |= PF_OPT_VERBOSE2;
2117 			opts |= PF_OPT_VERBOSE;
2118 			break;
2119 		case 'x':
2120 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2121 			if (debugopt == NULL) {
2122 				warnx("Unknown debug level '%s'", optarg);
2123 				usage();
2124 			}
2125 			mode = O_RDWR;
2126 			break;
2127 		case 'z':
2128 			opts |= PF_OPT_CLRRULECTRS;
2129 			mode = O_RDWR;
2130 			break;
2131 		case 'h':
2132 			/* FALLTHROUGH */
2133 		default:
2134 			usage();
2135 			/* NOTREACHED */
2136 		}
2137 	}
2138 
2139 	if (tblcmdopt != NULL) {
2140 		argc -= optind;
2141 		argv += optind;
2142 		ch = *tblcmdopt;
2143 		if (ch == 'l') {
2144 			loadopt |= PFCTL_FLAG_TABLE;
2145 			tblcmdopt = NULL;
2146 		} else
2147 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2148 	} else if (argc != optind) {
2149 		warnx("unknown command line argument: %s ...", argv[optind]);
2150 		usage();
2151 		/* NOTREACHED */
2152 	}
2153 	if (loadopt == 0)
2154 		loadopt = ~0;
2155 
2156 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2157 		errx(1, "pfctl: calloc");
2158 	memset(anchorname, 0, sizeof(anchorname));
2159 	if (anchoropt != NULL) {
2160 		int len = strlen(anchoropt);
2161 
2162 		if (anchoropt[len - 1] == '*') {
2163 			if (len >= 2 && anchoropt[len - 2] == '/')
2164 				anchoropt[len - 2] = '\0';
2165 			else
2166 				anchoropt[len - 1] = '\0';
2167 			opts |= PF_OPT_RECURSE;
2168 		}
2169 		if (strlcpy(anchorname, anchoropt,
2170 		    sizeof(anchorname)) >= sizeof(anchorname))
2171 			errx(1, "anchor name '%s' too long",
2172 			    anchoropt);
2173 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2174 	}
2175 
2176 	if ((opts & PF_OPT_NOACTION) == 0) {
2177 		dev = open(pf_device, mode);
2178 		if (dev == -1)
2179 			err(1, "%s", pf_device);
2180 		altqsupport = pfctl_test_altqsupport(dev, opts);
2181 	} else {
2182 		dev = open(pf_device, O_RDONLY);
2183 		if (dev >= 0)
2184 			opts |= PF_OPT_DUMMYACTION;
2185 		/* turn off options */
2186 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2187 		clearopt = showopt = debugopt = NULL;
2188 #if defined(__FreeBSD__) && !defined(ENABLE_ALTQ)
2189 		altqsupport = 0;
2190 #else
2191 		altqsupport = 1;
2192 #endif
2193 	}
2194 
2195 	if (opts & PF_OPT_DISABLE)
2196 		if (pfctl_disable(dev, opts))
2197 			error = 1;
2198 
2199 	if (showopt != NULL) {
2200 		switch (*showopt) {
2201 		case 'A':
2202 			pfctl_show_anchors(dev, opts, anchorname);
2203 			break;
2204 		case 'r':
2205 			pfctl_load_fingerprints(dev, opts);
2206 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2207 			    anchorname, 0);
2208 			break;
2209 		case 'l':
2210 			pfctl_load_fingerprints(dev, opts);
2211 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2212 			    anchorname, 0);
2213 			break;
2214 		case 'n':
2215 			pfctl_load_fingerprints(dev, opts);
2216 			pfctl_show_nat(dev, opts, anchorname);
2217 			break;
2218 		case 'q':
2219 			pfctl_show_altq(dev, ifaceopt, opts,
2220 			    opts & PF_OPT_VERBOSE2);
2221 			break;
2222 		case 's':
2223 			pfctl_show_states(dev, ifaceopt, opts);
2224 			break;
2225 		case 'S':
2226 			pfctl_show_src_nodes(dev, opts);
2227 			break;
2228 		case 'i':
2229 			pfctl_show_status(dev, opts);
2230 			break;
2231 		case 't':
2232 			pfctl_show_timeouts(dev, opts);
2233 			break;
2234 		case 'm':
2235 			pfctl_show_limits(dev, opts);
2236 			break;
2237 		case 'a':
2238 			opts |= PF_OPT_SHOWALL;
2239 			pfctl_load_fingerprints(dev, opts);
2240 
2241 			pfctl_show_nat(dev, opts, anchorname);
2242 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2243 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2244 			pfctl_show_states(dev, ifaceopt, opts);
2245 			pfctl_show_src_nodes(dev, opts);
2246 			pfctl_show_status(dev, opts);
2247 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2248 			pfctl_show_timeouts(dev, opts);
2249 			pfctl_show_limits(dev, opts);
2250 			pfctl_show_tables(anchorname, opts);
2251 			pfctl_show_fingerprints(opts);
2252 			break;
2253 		case 'T':
2254 			pfctl_show_tables(anchorname, opts);
2255 			break;
2256 		case 'o':
2257 			pfctl_load_fingerprints(dev, opts);
2258 			pfctl_show_fingerprints(opts);
2259 			break;
2260 		case 'I':
2261 			pfctl_show_ifaces(ifaceopt, opts);
2262 			break;
2263 		}
2264 	}
2265 
2266 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2267 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2268 		    anchorname, 0);
2269 
2270 	if (clearopt != NULL) {
2271 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2272 			errx(1, "anchor names beginning with '_' cannot "
2273 			    "be modified from the command line");
2274 
2275 		switch (*clearopt) {
2276 		case 'r':
2277 			pfctl_clear_rules(dev, opts, anchorname);
2278 			break;
2279 		case 'n':
2280 			pfctl_clear_nat(dev, opts, anchorname);
2281 			break;
2282 		case 'q':
2283 			pfctl_clear_altq(dev, opts);
2284 			break;
2285 		case 's':
2286 			pfctl_clear_states(dev, ifaceopt, opts);
2287 			break;
2288 		case 'S':
2289 			pfctl_clear_src_nodes(dev, opts);
2290 			break;
2291 		case 'i':
2292 			pfctl_clear_stats(dev, opts);
2293 			break;
2294 		case 'a':
2295 			pfctl_clear_rules(dev, opts, anchorname);
2296 			pfctl_clear_nat(dev, opts, anchorname);
2297 			pfctl_clear_tables(anchorname, opts);
2298 			if (!*anchorname) {
2299 				pfctl_clear_altq(dev, opts);
2300 				pfctl_clear_states(dev, ifaceopt, opts);
2301 				pfctl_clear_src_nodes(dev, opts);
2302 				pfctl_clear_stats(dev, opts);
2303 				pfctl_clear_fingerprints(dev, opts);
2304 				pfctl_clear_interface_flags(dev, opts);
2305 			}
2306 			break;
2307 		case 'o':
2308 			pfctl_clear_fingerprints(dev, opts);
2309 			break;
2310 		case 'T':
2311 			pfctl_clear_tables(anchorname, opts);
2312 			break;
2313 		}
2314 	}
2315 	if (state_killers) {
2316 		if (!strcmp(state_kill[0], "label"))
2317 			pfctl_label_kill_states(dev, ifaceopt, opts);
2318 		else if (!strcmp(state_kill[0], "id"))
2319 			pfctl_id_kill_states(dev, ifaceopt, opts);
2320 		else
2321 			pfctl_net_kill_states(dev, ifaceopt, opts);
2322 	}
2323 
2324 	if (src_node_killers)
2325 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
2326 
2327 	if (tblcmdopt != NULL) {
2328 		error = pfctl_command_tables(argc, argv, tableopt,
2329 		    tblcmdopt, rulesopt, anchorname, opts);
2330 		rulesopt = NULL;
2331 	}
2332 	if (optiopt != NULL) {
2333 		switch (*optiopt) {
2334 		case 'n':
2335 			optimize = 0;
2336 			break;
2337 		case 'b':
2338 			optimize |= PF_OPTIMIZE_BASIC;
2339 			break;
2340 		case 'o':
2341 		case 'p':
2342 			optimize |= PF_OPTIMIZE_PROFILE;
2343 			break;
2344 		}
2345 	}
2346 
2347 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2348 	    !anchorname[0])
2349 		if (pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET))
2350 			error = 1;
2351 
2352 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2353 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2354 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2355 			error = 1;
2356 
2357 	if (rulesopt != NULL) {
2358 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2359 			errx(1, "anchor names beginning with '_' cannot "
2360 			    "be modified from the command line");
2361 		if (pfctl_rules(dev, rulesopt, opts, optimize,
2362 		    anchorname, NULL))
2363 			error = 1;
2364 		else if (!(opts & PF_OPT_NOACTION) &&
2365 		    (loadopt & PFCTL_FLAG_TABLE))
2366 			warn_namespace_collision(NULL);
2367 	}
2368 
2369 	if (opts & PF_OPT_ENABLE)
2370 		if (pfctl_enable(dev, opts))
2371 			error = 1;
2372 
2373 	if (debugopt != NULL) {
2374 		switch (*debugopt) {
2375 		case 'n':
2376 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
2377 			break;
2378 		case 'u':
2379 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2380 			break;
2381 		case 'm':
2382 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
2383 			break;
2384 		case 'l':
2385 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2386 			break;
2387 		}
2388 	}
2389 
2390 	exit(error);
2391 }
2392