xref: /freebsd/sbin/pfctl/pfctl.c (revision c99fb5f907eccde7b4c6d53e650e1a32a558f0d8)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*
4  * Copyright (c) 2001 Daniel Hartmeier
5  * Copyright (c) 2002,2003 Henning Brauer
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include <sys/types.h>
38 #include <sys/ioctl.h>
39 #include <sys/socket.h>
40 #include <sys/stat.h>
41 #include <sys/endian.h>
42 
43 #include <net/if.h>
44 #include <netinet/in.h>
45 #include <net/pfvar.h>
46 #include <arpa/inet.h>
47 #include <altq/altq.h>
48 #include <sys/sysctl.h>
49 
50 #include <err.h>
51 #include <errno.h>
52 #include <fcntl.h>
53 #include <inttypes.h>
54 #include <limits.h>
55 #include <netdb.h>
56 #include <stdio.h>
57 #include <stdlib.h>
58 #include <string.h>
59 #include <unistd.h>
60 
61 #include "pfctl_parser.h"
62 #include "pfctl.h"
63 
64 void	 usage(void);
65 int	 pfctl_enable(int, int);
66 int	 pfctl_disable(int, int);
67 int	 pfctl_clear_stats(int, int);
68 int	 pfctl_clear_interface_flags(int, int);
69 int	 pfctl_clear_rules(int, int, char *);
70 int	 pfctl_clear_nat(int, int, char *);
71 int	 pfctl_clear_altq(int, int);
72 int	 pfctl_clear_src_nodes(int, int);
73 int	 pfctl_clear_states(int, const char *, int);
74 void	 pfctl_addrprefix(char *, struct pf_addr *);
75 int	 pfctl_kill_src_nodes(int, const char *, int);
76 int	 pfctl_net_kill_states(int, const char *, int);
77 int	 pfctl_label_kill_states(int, const char *, int);
78 int	 pfctl_id_kill_states(int, const char *, int);
79 void	 pfctl_init_options(struct pfctl *);
80 int	 pfctl_load_options(struct pfctl *);
81 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
82 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
83 int	 pfctl_load_debug(struct pfctl *, unsigned int);
84 int	 pfctl_load_logif(struct pfctl *, char *);
85 int	 pfctl_load_hostid(struct pfctl *, unsigned int);
86 int	 pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
87 	    char *);
88 void	 pfctl_print_rule_counters(struct pf_rule *, int);
89 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
90 int	 pfctl_show_nat(int, int, char *);
91 int	 pfctl_show_src_nodes(int, int);
92 int	 pfctl_show_states(int, const char *, int);
93 int	 pfctl_show_status(int, int);
94 int	 pfctl_show_timeouts(int, int);
95 int	 pfctl_show_limits(int, int);
96 void	 pfctl_debug(int, u_int32_t, int);
97 int	 pfctl_test_altqsupport(int, int);
98 int	 pfctl_show_anchors(int, int, char *);
99 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
100 int	 pfctl_load_ruleset(struct pfctl *, char *,
101 		struct pf_ruleset *, int, int);
102 int	 pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
103 const char	*pfctl_lookup_option(char *, const char **);
104 
105 struct pf_anchor_global	 pf_anchors;
106 struct pf_anchor	 pf_main_anchor;
107 
108 const char	*clearopt;
109 char		*rulesopt;
110 const char	*showopt;
111 const char	*debugopt;
112 char		*anchoropt;
113 const char	*optiopt = NULL;
114 char		*pf_device = "/dev/pf";
115 char		*ifaceopt;
116 char		*tableopt;
117 const char	*tblcmdopt;
118 int		 src_node_killers;
119 char		*src_node_kill[2];
120 int		 state_killers;
121 char		*state_kill[2];
122 int		 loadopt;
123 int		 altqsupport;
124 
125 int		 dev = -1;
126 int		 first_title = 1;
127 int		 labels = 0;
128 
129 #define INDENT(d, o)	do {						\
130 				if (o) {				\
131 					int i;				\
132 					for (i=0; i < d; i++)		\
133 						printf("  ");		\
134 				}					\
135 			} while (0);					\
136 
137 
138 static const struct {
139 	const char	*name;
140 	int		index;
141 } pf_limits[] = {
142 	{ "states",		PF_LIMIT_STATES },
143 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
144 	{ "frags",		PF_LIMIT_FRAGS },
145 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
146 	{ NULL,			0 }
147 };
148 
149 struct pf_hint {
150 	const char	*name;
151 	int		timeout;
152 };
153 static const struct pf_hint pf_hint_normal[] = {
154 	{ "tcp.first",		2 * 60 },
155 	{ "tcp.opening",	30 },
156 	{ "tcp.established",	24 * 60 * 60 },
157 	{ "tcp.closing",	15 * 60 },
158 	{ "tcp.finwait",	45 },
159 	{ "tcp.closed",		90 },
160 	{ "tcp.tsdiff",		30 },
161 	{ NULL,			0 }
162 };
163 static const struct pf_hint pf_hint_satellite[] = {
164 	{ "tcp.first",		3 * 60 },
165 	{ "tcp.opening",	30 + 5 },
166 	{ "tcp.established",	24 * 60 * 60 },
167 	{ "tcp.closing",	15 * 60 + 5 },
168 	{ "tcp.finwait",	45 + 5 },
169 	{ "tcp.closed",		90 + 5 },
170 	{ "tcp.tsdiff",		60 },
171 	{ NULL,			0 }
172 };
173 static const struct pf_hint pf_hint_conservative[] = {
174 	{ "tcp.first",		60 * 60 },
175 	{ "tcp.opening",	15 * 60 },
176 	{ "tcp.established",	5 * 24 * 60 * 60 },
177 	{ "tcp.closing",	60 * 60 },
178 	{ "tcp.finwait",	10 * 60 },
179 	{ "tcp.closed",		3 * 60 },
180 	{ "tcp.tsdiff",		60 },
181 	{ NULL,			0 }
182 };
183 static const struct pf_hint pf_hint_aggressive[] = {
184 	{ "tcp.first",		30 },
185 	{ "tcp.opening",	5 },
186 	{ "tcp.established",	5 * 60 * 60 },
187 	{ "tcp.closing",	60 },
188 	{ "tcp.finwait",	30 },
189 	{ "tcp.closed",		30 },
190 	{ "tcp.tsdiff",		10 },
191 	{ NULL,			0 }
192 };
193 
194 static const struct {
195 	const char *name;
196 	const struct pf_hint *hint;
197 } pf_hints[] = {
198 	{ "normal",		pf_hint_normal },
199 	{ "satellite",		pf_hint_satellite },
200 	{ "high-latency",	pf_hint_satellite },
201 	{ "conservative",	pf_hint_conservative },
202 	{ "aggressive",		pf_hint_aggressive },
203 	{ NULL,			NULL }
204 };
205 
206 static const char *clearopt_list[] = {
207 	"nat", "queue", "rules", "Sources",
208 	"states", "info", "Tables", "osfp", "all", NULL
209 };
210 
211 static const char *showopt_list[] = {
212 	"nat", "queue", "rules", "Anchors", "Sources", "states", "info",
213 	"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
214 	"all", NULL
215 };
216 
217 static const char *tblcmdopt_list[] = {
218 	"kill", "flush", "add", "delete", "load", "replace", "show",
219 	"test", "zero", "expire", NULL
220 };
221 
222 static const char *debugopt_list[] = {
223 	"none", "urgent", "misc", "loud", NULL
224 };
225 
226 static const char *optiopt_list[] = {
227 	"none", "basic", "profile", NULL
228 };
229 
230 void
231 usage(void)
232 {
233 	extern char *__progname;
234 
235 	fprintf(stderr,
236 "usage: %s [-AdeghmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
237 	"\t[-f file] [-i interface] [-K host | network]\n"
238 	"\t[-k host | network | label | id] [-o level] [-p device]\n"
239 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
240 	    __progname);
241 
242 	exit(1);
243 }
244 
245 int
246 pfctl_enable(int dev, int opts)
247 {
248 	if (ioctl(dev, DIOCSTART)) {
249 		if (errno == EEXIST)
250 			errx(1, "pf already enabled");
251 		else if (errno == ESRCH)
252 			errx(1, "pfil registeration failed");
253 		else
254 			err(1, "DIOCSTART");
255 	}
256 	if ((opts & PF_OPT_QUIET) == 0)
257 		fprintf(stderr, "pf enabled\n");
258 
259 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
260 		if (errno != EEXIST)
261 			err(1, "DIOCSTARTALTQ");
262 
263 	return (0);
264 }
265 
266 int
267 pfctl_disable(int dev, int opts)
268 {
269 	if (ioctl(dev, DIOCSTOP)) {
270 		if (errno == ENOENT)
271 			errx(1, "pf not enabled");
272 		else
273 			err(1, "DIOCSTOP");
274 	}
275 	if ((opts & PF_OPT_QUIET) == 0)
276 		fprintf(stderr, "pf disabled\n");
277 
278 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
279 			if (errno != ENOENT)
280 				err(1, "DIOCSTOPALTQ");
281 
282 	return (0);
283 }
284 
285 int
286 pfctl_clear_stats(int dev, int opts)
287 {
288 	if (ioctl(dev, DIOCCLRSTATUS))
289 		err(1, "DIOCCLRSTATUS");
290 	if ((opts & PF_OPT_QUIET) == 0)
291 		fprintf(stderr, "pf: statistics cleared\n");
292 	return (0);
293 }
294 
295 int
296 pfctl_clear_interface_flags(int dev, int opts)
297 {
298 	struct pfioc_iface	pi;
299 
300 	if ((opts & PF_OPT_NOACTION) == 0) {
301 		bzero(&pi, sizeof(pi));
302 		pi.pfiio_flags = PFI_IFLAG_SKIP;
303 
304 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
305 			err(1, "DIOCCLRIFFLAG");
306 		if ((opts & PF_OPT_QUIET) == 0)
307 			fprintf(stderr, "pf: interface flags reset\n");
308 	}
309 	return (0);
310 }
311 
312 int
313 pfctl_clear_rules(int dev, int opts, char *anchorname)
314 {
315 	struct pfr_buffer t;
316 
317 	memset(&t, 0, sizeof(t));
318 	t.pfrb_type = PFRB_TRANS;
319 	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
320 	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
321 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
322 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
323 		err(1, "pfctl_clear_rules");
324 	if ((opts & PF_OPT_QUIET) == 0)
325 		fprintf(stderr, "rules cleared\n");
326 	return (0);
327 }
328 
329 int
330 pfctl_clear_nat(int dev, int opts, char *anchorname)
331 {
332 	struct pfr_buffer t;
333 
334 	memset(&t, 0, sizeof(t));
335 	t.pfrb_type = PFRB_TRANS;
336 	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
337 	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
338 	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
339 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
340 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
341 		err(1, "pfctl_clear_nat");
342 	if ((opts & PF_OPT_QUIET) == 0)
343 		fprintf(stderr, "nat cleared\n");
344 	return (0);
345 }
346 
347 int
348 pfctl_clear_altq(int dev, int opts)
349 {
350 	struct pfr_buffer t;
351 
352 	if (!altqsupport)
353 		return (-1);
354 	memset(&t, 0, sizeof(t));
355 	t.pfrb_type = PFRB_TRANS;
356 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
357 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
358 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
359 		err(1, "pfctl_clear_altq");
360 	if ((opts & PF_OPT_QUIET) == 0)
361 		fprintf(stderr, "altq cleared\n");
362 	return (0);
363 }
364 
365 int
366 pfctl_clear_src_nodes(int dev, int opts)
367 {
368 	if (ioctl(dev, DIOCCLRSRCNODES))
369 		err(1, "DIOCCLRSRCNODES");
370 	if ((opts & PF_OPT_QUIET) == 0)
371 		fprintf(stderr, "source tracking entries cleared\n");
372 	return (0);
373 }
374 
375 int
376 pfctl_clear_states(int dev, const char *iface, int opts)
377 {
378 	struct pfioc_state_kill psk;
379 
380 	memset(&psk, 0, sizeof(psk));
381 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
382 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
383 		errx(1, "invalid interface: %s", iface);
384 
385 	if (ioctl(dev, DIOCCLRSTATES, &psk))
386 		err(1, "DIOCCLRSTATES");
387 	if ((opts & PF_OPT_QUIET) == 0)
388 		fprintf(stderr, "%d states cleared\n", psk.psk_killed);
389 	return (0);
390 }
391 
392 void
393 pfctl_addrprefix(char *addr, struct pf_addr *mask)
394 {
395 	char *p;
396 	const char *errstr;
397 	int prefix, ret_ga, q, r;
398 	struct addrinfo hints, *res;
399 
400 	if ((p = strchr(addr, '/')) == NULL)
401 		return;
402 
403 	*p++ = '\0';
404 	prefix = strtonum(p, 0, 128, &errstr);
405 	if (errstr)
406 		errx(1, "prefix is %s: %s", errstr, p);
407 
408 	bzero(&hints, sizeof(hints));
409 	/* prefix only with numeric addresses */
410 	hints.ai_flags |= AI_NUMERICHOST;
411 
412 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
413 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
414 		/* NOTREACHED */
415 	}
416 
417 	if (res->ai_family == AF_INET && prefix > 32)
418 		errx(1, "prefix too long for AF_INET");
419 	else if (res->ai_family == AF_INET6 && prefix > 128)
420 		errx(1, "prefix too long for AF_INET6");
421 
422 	q = prefix >> 3;
423 	r = prefix & 7;
424 	switch (res->ai_family) {
425 	case AF_INET:
426 		bzero(&mask->v4, sizeof(mask->v4));
427 		mask->v4.s_addr = htonl((u_int32_t)
428 		    (0xffffffffffULL << (32 - prefix)));
429 		break;
430 	case AF_INET6:
431 		bzero(&mask->v6, sizeof(mask->v6));
432 		if (q > 0)
433 			memset((void *)&mask->v6, 0xff, q);
434 		if (r > 0)
435 			*((u_char *)&mask->v6 + q) =
436 			    (0xff00 >> r) & 0xff;
437 		break;
438 	}
439 	freeaddrinfo(res);
440 }
441 
442 int
443 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
444 {
445 	struct pfioc_src_node_kill psnk;
446 	struct addrinfo *res[2], *resp[2];
447 	struct sockaddr last_src, last_dst;
448 	int killed, sources, dests;
449 	int ret_ga;
450 
451 	killed = sources = dests = 0;
452 
453 	memset(&psnk, 0, sizeof(psnk));
454 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
455 	    sizeof(psnk.psnk_src.addr.v.a.mask));
456 	memset(&last_src, 0xff, sizeof(last_src));
457 	memset(&last_dst, 0xff, sizeof(last_dst));
458 
459 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
460 
461 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
462 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
463 		/* NOTREACHED */
464 	}
465 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
466 		if (resp[0]->ai_addr == NULL)
467 			continue;
468 		/* We get lots of duplicates.  Catch the easy ones */
469 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
470 			continue;
471 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
472 
473 		psnk.psnk_af = resp[0]->ai_family;
474 		sources++;
475 
476 		if (psnk.psnk_af == AF_INET)
477 			psnk.psnk_src.addr.v.a.addr.v4 =
478 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
479 		else if (psnk.psnk_af == AF_INET6)
480 			psnk.psnk_src.addr.v.a.addr.v6 =
481 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
482 			    sin6_addr;
483 		else
484 			errx(1, "Unknown address family %d", psnk.psnk_af);
485 
486 		if (src_node_killers > 1) {
487 			dests = 0;
488 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
489 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
490 			memset(&last_dst, 0xff, sizeof(last_dst));
491 			pfctl_addrprefix(src_node_kill[1],
492 			    &psnk.psnk_dst.addr.v.a.mask);
493 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
494 			    &res[1]))) {
495 				errx(1, "getaddrinfo: %s",
496 				    gai_strerror(ret_ga));
497 				/* NOTREACHED */
498 			}
499 			for (resp[1] = res[1]; resp[1];
500 			    resp[1] = resp[1]->ai_next) {
501 				if (resp[1]->ai_addr == NULL)
502 					continue;
503 				if (psnk.psnk_af != resp[1]->ai_family)
504 					continue;
505 
506 				if (memcmp(&last_dst, resp[1]->ai_addr,
507 				    sizeof(last_dst)) == 0)
508 					continue;
509 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
510 
511 				dests++;
512 
513 				if (psnk.psnk_af == AF_INET)
514 					psnk.psnk_dst.addr.v.a.addr.v4 =
515 					    ((struct sockaddr_in *)resp[1]->
516 					    ai_addr)->sin_addr;
517 				else if (psnk.psnk_af == AF_INET6)
518 					psnk.psnk_dst.addr.v.a.addr.v6 =
519 					    ((struct sockaddr_in6 *)resp[1]->
520 					    ai_addr)->sin6_addr;
521 				else
522 					errx(1, "Unknown address family %d",
523 					    psnk.psnk_af);
524 
525 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
526 					err(1, "DIOCKILLSRCNODES");
527 				killed += psnk.psnk_killed;
528 			}
529 			freeaddrinfo(res[1]);
530 		} else {
531 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
532 				err(1, "DIOCKILLSRCNODES");
533 			killed += psnk.psnk_killed;
534 		}
535 	}
536 
537 	freeaddrinfo(res[0]);
538 
539 	if ((opts & PF_OPT_QUIET) == 0)
540 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
541 		    "destinations\n", killed, sources, dests);
542 	return (0);
543 }
544 
545 int
546 pfctl_net_kill_states(int dev, const char *iface, int opts)
547 {
548 	struct pfioc_state_kill psk;
549 	struct addrinfo *res[2], *resp[2];
550 	struct sockaddr last_src, last_dst;
551 	int killed, sources, dests;
552 	int ret_ga;
553 
554 	killed = sources = dests = 0;
555 
556 	memset(&psk, 0, sizeof(psk));
557 	memset(&psk.psk_src.addr.v.a.mask, 0xff,
558 	    sizeof(psk.psk_src.addr.v.a.mask));
559 	memset(&last_src, 0xff, sizeof(last_src));
560 	memset(&last_dst, 0xff, sizeof(last_dst));
561 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
562 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
563 		errx(1, "invalid interface: %s", iface);
564 
565 	pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
566 
567 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
568 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
569 		/* NOTREACHED */
570 	}
571 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
572 		if (resp[0]->ai_addr == NULL)
573 			continue;
574 		/* We get lots of duplicates.  Catch the easy ones */
575 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
576 			continue;
577 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
578 
579 		psk.psk_af = resp[0]->ai_family;
580 		sources++;
581 
582 		if (psk.psk_af == AF_INET)
583 			psk.psk_src.addr.v.a.addr.v4 =
584 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
585 		else if (psk.psk_af == AF_INET6)
586 			psk.psk_src.addr.v.a.addr.v6 =
587 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
588 			    sin6_addr;
589 		else
590 			errx(1, "Unknown address family %d", psk.psk_af);
591 
592 		if (state_killers > 1) {
593 			dests = 0;
594 			memset(&psk.psk_dst.addr.v.a.mask, 0xff,
595 			    sizeof(psk.psk_dst.addr.v.a.mask));
596 			memset(&last_dst, 0xff, sizeof(last_dst));
597 			pfctl_addrprefix(state_kill[1],
598 			    &psk.psk_dst.addr.v.a.mask);
599 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
600 			    &res[1]))) {
601 				errx(1, "getaddrinfo: %s",
602 				    gai_strerror(ret_ga));
603 				/* NOTREACHED */
604 			}
605 			for (resp[1] = res[1]; resp[1];
606 			    resp[1] = resp[1]->ai_next) {
607 				if (resp[1]->ai_addr == NULL)
608 					continue;
609 				if (psk.psk_af != resp[1]->ai_family)
610 					continue;
611 
612 				if (memcmp(&last_dst, resp[1]->ai_addr,
613 				    sizeof(last_dst)) == 0)
614 					continue;
615 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
616 
617 				dests++;
618 
619 				if (psk.psk_af == AF_INET)
620 					psk.psk_dst.addr.v.a.addr.v4 =
621 					    ((struct sockaddr_in *)resp[1]->
622 					    ai_addr)->sin_addr;
623 				else if (psk.psk_af == AF_INET6)
624 					psk.psk_dst.addr.v.a.addr.v6 =
625 					    ((struct sockaddr_in6 *)resp[1]->
626 					    ai_addr)->sin6_addr;
627 				else
628 					errx(1, "Unknown address family %d",
629 					    psk.psk_af);
630 
631 				if (ioctl(dev, DIOCKILLSTATES, &psk))
632 					err(1, "DIOCKILLSTATES");
633 				killed += psk.psk_killed;
634 			}
635 			freeaddrinfo(res[1]);
636 		} else {
637 			if (ioctl(dev, DIOCKILLSTATES, &psk))
638 				err(1, "DIOCKILLSTATES");
639 			killed += psk.psk_killed;
640 		}
641 	}
642 
643 	freeaddrinfo(res[0]);
644 
645 	if ((opts & PF_OPT_QUIET) == 0)
646 		fprintf(stderr, "killed %d states from %d sources and %d "
647 		    "destinations\n", killed, sources, dests);
648 	return (0);
649 }
650 
651 int
652 pfctl_label_kill_states(int dev, const char *iface, int opts)
653 {
654 	struct pfioc_state_kill psk;
655 
656 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
657 		warnx("no label specified");
658 		usage();
659 	}
660 	memset(&psk, 0, sizeof(psk));
661 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
662 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
663 		errx(1, "invalid interface: %s", iface);
664 
665 	if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
666 	    sizeof(psk.psk_label))
667 		errx(1, "label too long: %s", state_kill[1]);
668 
669 	if (ioctl(dev, DIOCKILLSTATES, &psk))
670 		err(1, "DIOCKILLSTATES");
671 
672 	if ((opts & PF_OPT_QUIET) == 0)
673 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
674 
675 	return (0);
676 }
677 
678 int
679 pfctl_id_kill_states(int dev, const char *iface, int opts)
680 {
681 	struct pfioc_state_kill psk;
682 
683 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
684 		warnx("no id specified");
685 		usage();
686 	}
687 
688 	memset(&psk, 0, sizeof(psk));
689 	if ((sscanf(state_kill[1], "%jx/%x",
690 	    &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
691 		HTONL(psk.psk_pfcmp.creatorid);
692 	else if ((sscanf(state_kill[1], "%jx", &psk.psk_pfcmp.id)) == 1) {
693 		psk.psk_pfcmp.creatorid = 0;
694 	} else {
695 		warnx("wrong id format specified");
696 		usage();
697 	}
698 	if (psk.psk_pfcmp.id == 0) {
699 		warnx("cannot kill id 0");
700 		usage();
701 	}
702 
703 	psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
704 	if (ioctl(dev, DIOCKILLSTATES, &psk))
705 		err(1, "DIOCKILLSTATES");
706 
707 	if ((opts & PF_OPT_QUIET) == 0)
708 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
709 
710 	return (0);
711 }
712 
713 int
714 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
715     u_int32_t ticket, int r_action, char *anchorname)
716 {
717 	struct pfioc_pooladdr pp;
718 	struct pf_pooladdr *pa;
719 	u_int32_t pnr, mpnr;
720 
721 	memset(&pp, 0, sizeof(pp));
722 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
723 	pp.r_action = r_action;
724 	pp.r_num = nr;
725 	pp.ticket = ticket;
726 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
727 		warn("DIOCGETADDRS");
728 		return (-1);
729 	}
730 	mpnr = pp.nr;
731 	TAILQ_INIT(&pool->list);
732 	for (pnr = 0; pnr < mpnr; ++pnr) {
733 		pp.nr = pnr;
734 		if (ioctl(dev, DIOCGETADDR, &pp)) {
735 			warn("DIOCGETADDR");
736 			return (-1);
737 		}
738 		pa = calloc(1, sizeof(struct pf_pooladdr));
739 		if (pa == NULL)
740 			err(1, "calloc");
741 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
742 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
743 	}
744 
745 	return (0);
746 }
747 
748 void
749 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
750 {
751 	struct pf_pooladdr *pa;
752 
753 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
754 		TAILQ_REMOVE(&src->list, pa, entries);
755 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
756 	}
757 }
758 
759 void
760 pfctl_clear_pool(struct pf_pool *pool)
761 {
762 	struct pf_pooladdr *pa;
763 
764 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
765 		TAILQ_REMOVE(&pool->list, pa, entries);
766 		free(pa);
767 	}
768 }
769 
770 void
771 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
772 {
773 	if (opts & PF_OPT_DEBUG) {
774 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
775 		    "p", "sa", "sp", "da", "dp" };
776 		int i;
777 
778 		printf("  [ Skip steps: ");
779 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
780 			if (rule->skip[i].nr == rule->nr + 1)
781 				continue;
782 			printf("%s=", t[i]);
783 			if (rule->skip[i].nr == -1)
784 				printf("end ");
785 			else
786 				printf("%u ", rule->skip[i].nr);
787 		}
788 		printf("]\n");
789 
790 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
791 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
792 	}
793 	if (opts & PF_OPT_VERBOSE) {
794 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
795 			    "Bytes: %-10llu  States: %-6"PRIuPTR"]\n",
796 			    (unsigned long long)rule->evaluations,
797 			    (unsigned long long)(rule->packets[0] +
798 			    rule->packets[1]),
799 			    (unsigned long long)(rule->bytes[0] +
800 			    rule->bytes[1]),
801 			    (uintptr_t)rule->states_cur);
802 		if (!(opts & PF_OPT_DEBUG))
803 			printf("  [ Inserted: uid %u pid %u "
804 			    "State Creations: %-6"PRIuPTR"]\n",
805 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
806 			    (uintptr_t)rule->states_tot);
807 	}
808 }
809 
810 void
811 pfctl_print_title(char *title)
812 {
813 	if (!first_title)
814 		printf("\n");
815 	first_title = 0;
816 	printf("%s\n", title);
817 }
818 
819 int
820 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
821     char *anchorname, int depth)
822 {
823 	struct pfioc_rule pr;
824 	u_int32_t nr, mnr, header = 0;
825 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
826 	int numeric = opts & PF_OPT_NUMERIC;
827 	int len = strlen(path);
828 	int brace;
829 	char *p;
830 
831 	if (path[0])
832 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
833 	else
834 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
835 
836 	memset(&pr, 0, sizeof(pr));
837 	memcpy(pr.anchor, path, sizeof(pr.anchor));
838 	if (opts & PF_OPT_SHOWALL) {
839 		pr.rule.action = PF_PASS;
840 		if (ioctl(dev, DIOCGETRULES, &pr)) {
841 			warn("DIOCGETRULES");
842 			goto error;
843 		}
844 		header++;
845 	}
846 	pr.rule.action = PF_SCRUB;
847 	if (ioctl(dev, DIOCGETRULES, &pr)) {
848 		warn("DIOCGETRULES");
849 		goto error;
850 	}
851 	if (opts & PF_OPT_SHOWALL) {
852 		if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
853 			pfctl_print_title("FILTER RULES:");
854 		else if (format == PFCTL_SHOW_LABELS && labels)
855 			pfctl_print_title("LABEL COUNTERS:");
856 	}
857 	mnr = pr.nr;
858 	if (opts & PF_OPT_CLRRULECTRS)
859 		pr.action = PF_GET_CLR_CNTR;
860 
861 	for (nr = 0; nr < mnr; ++nr) {
862 		pr.nr = nr;
863 		if (ioctl(dev, DIOCGETRULE, &pr)) {
864 			warn("DIOCGETRULE");
865 			goto error;
866 		}
867 
868 		if (pfctl_get_pool(dev, &pr.rule.rpool,
869 		    nr, pr.ticket, PF_SCRUB, path) != 0)
870 			goto error;
871 
872 		switch (format) {
873 		case PFCTL_SHOW_LABELS:
874 			break;
875 		case PFCTL_SHOW_RULES:
876 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
877 				labels = 1;
878 			print_rule(&pr.rule, pr.anchor_call, rule_numbers, numeric);
879 			printf("\n");
880 			pfctl_print_rule_counters(&pr.rule, opts);
881 			break;
882 		case PFCTL_SHOW_NOTHING:
883 			break;
884 		}
885 		pfctl_clear_pool(&pr.rule.rpool);
886 	}
887 	pr.rule.action = PF_PASS;
888 	if (ioctl(dev, DIOCGETRULES, &pr)) {
889 		warn("DIOCGETRULES");
890 		goto error;
891 	}
892 	mnr = pr.nr;
893 	for (nr = 0; nr < mnr; ++nr) {
894 		pr.nr = nr;
895 		if (ioctl(dev, DIOCGETRULE, &pr)) {
896 			warn("DIOCGETRULE");
897 			goto error;
898 		}
899 
900 		if (pfctl_get_pool(dev, &pr.rule.rpool,
901 		    nr, pr.ticket, PF_PASS, path) != 0)
902 			goto error;
903 
904 		switch (format) {
905 		case PFCTL_SHOW_LABELS:
906 			if (pr.rule.label[0]) {
907 				printf("%s %llu %llu %llu %llu"
908 				    " %llu %llu %llu %"PRIuPTR"\n",
909 				    pr.rule.label,
910 				    (unsigned long long)pr.rule.evaluations,
911 				    (unsigned long long)(pr.rule.packets[0] +
912 				    pr.rule.packets[1]),
913 				    (unsigned long long)(pr.rule.bytes[0] +
914 				    pr.rule.bytes[1]),
915 				    (unsigned long long)pr.rule.packets[0],
916 				    (unsigned long long)pr.rule.bytes[0],
917 				    (unsigned long long)pr.rule.packets[1],
918 				    (unsigned long long)pr.rule.bytes[1],
919 				    (uintptr_t)pr.rule.states_tot);
920 			}
921 			break;
922 		case PFCTL_SHOW_RULES:
923 			brace = 0;
924 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
925 				labels = 1;
926 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
927 			if (pr.anchor_call[0] &&
928 			   ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
929 			   ((void *)p == (void *)pr.anchor_call ||
930 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
931 				brace++;
932 				if ((p = strrchr(pr.anchor_call, '/')) !=
933 				    NULL)
934 					p++;
935 				else
936 					p = &pr.anchor_call[0];
937 			} else
938 				p = &pr.anchor_call[0];
939 
940 			print_rule(&pr.rule, p, rule_numbers, numeric);
941 			if (brace)
942 				printf(" {\n");
943 			else
944 				printf("\n");
945 			pfctl_print_rule_counters(&pr.rule, opts);
946 			if (brace) {
947 				pfctl_show_rules(dev, path, opts, format,
948 				    p, depth + 1);
949 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
950 				printf("}\n");
951 			}
952 			break;
953 		case PFCTL_SHOW_NOTHING:
954 			break;
955 		}
956 		pfctl_clear_pool(&pr.rule.rpool);
957 	}
958 	path[len] = '\0';
959 	return (0);
960 
961  error:
962 	path[len] = '\0';
963 	return (-1);
964 }
965 
966 int
967 pfctl_show_nat(int dev, int opts, char *anchorname)
968 {
969 	struct pfioc_rule pr;
970 	u_int32_t mnr, nr;
971 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
972 	int i, dotitle = opts & PF_OPT_SHOWALL;
973 
974 	memset(&pr, 0, sizeof(pr));
975 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
976 	for (i = 0; i < 3; i++) {
977 		pr.rule.action = nattype[i];
978 		if (ioctl(dev, DIOCGETRULES, &pr)) {
979 			warn("DIOCGETRULES");
980 			return (-1);
981 		}
982 		mnr = pr.nr;
983 		for (nr = 0; nr < mnr; ++nr) {
984 			pr.nr = nr;
985 			if (ioctl(dev, DIOCGETRULE, &pr)) {
986 				warn("DIOCGETRULE");
987 				return (-1);
988 			}
989 			if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
990 			    pr.ticket, nattype[i], anchorname) != 0)
991 				return (-1);
992 			if (dotitle) {
993 				pfctl_print_title("TRANSLATION RULES:");
994 				dotitle = 0;
995 			}
996 			print_rule(&pr.rule, pr.anchor_call,
997 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
998 			printf("\n");
999 			pfctl_print_rule_counters(&pr.rule, opts);
1000 			pfctl_clear_pool(&pr.rule.rpool);
1001 		}
1002 	}
1003 	return (0);
1004 }
1005 
1006 int
1007 pfctl_show_src_nodes(int dev, int opts)
1008 {
1009 	struct pfioc_src_nodes psn;
1010 	struct pf_src_node *p;
1011 	char *inbuf = NULL, *newinbuf = NULL;
1012 	unsigned int len = 0;
1013 	int i;
1014 
1015 	memset(&psn, 0, sizeof(psn));
1016 	for (;;) {
1017 		psn.psn_len = len;
1018 		if (len) {
1019 			newinbuf = realloc(inbuf, len);
1020 			if (newinbuf == NULL)
1021 				err(1, "realloc");
1022 			psn.psn_buf = inbuf = newinbuf;
1023 		}
1024 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1025 			warn("DIOCGETSRCNODES");
1026 			free(inbuf);
1027 			return (-1);
1028 		}
1029 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1030 			break;
1031 		if (len == 0 && psn.psn_len == 0)
1032 			goto done;
1033 		if (len == 0 && psn.psn_len != 0)
1034 			len = psn.psn_len;
1035 		if (psn.psn_len == 0)
1036 			goto done;	/* no src_nodes */
1037 		len *= 2;
1038 	}
1039 	p = psn.psn_src_nodes;
1040 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1041 		pfctl_print_title("SOURCE TRACKING NODES:");
1042 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1043 		print_src_node(p, opts);
1044 		p++;
1045 	}
1046 done:
1047 	free(inbuf);
1048 	return (0);
1049 }
1050 
1051 int
1052 pfctl_show_states(int dev, const char *iface, int opts)
1053 {
1054 	struct pfioc_states ps;
1055 	struct pfsync_state *p;
1056 	char *inbuf = NULL, *newinbuf = NULL;
1057 	unsigned int len = 0;
1058 	int i, dotitle = (opts & PF_OPT_SHOWALL);
1059 
1060 	memset(&ps, 0, sizeof(ps));
1061 	for (;;) {
1062 		ps.ps_len = len;
1063 		if (len) {
1064 			newinbuf = realloc(inbuf, len);
1065 			if (newinbuf == NULL)
1066 				err(1, "realloc");
1067 			ps.ps_buf = inbuf = newinbuf;
1068 		}
1069 		if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1070 			warn("DIOCGETSTATES");
1071 			free(inbuf);
1072 			return (-1);
1073 		}
1074 		if (ps.ps_len + sizeof(struct pfioc_states) < len)
1075 			break;
1076 		if (len == 0 && ps.ps_len == 0)
1077 			goto done;
1078 		if (len == 0 && ps.ps_len != 0)
1079 			len = ps.ps_len;
1080 		if (ps.ps_len == 0)
1081 			goto done;	/* no states */
1082 		len *= 2;
1083 	}
1084 	p = ps.ps_states;
1085 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1086 		if (iface != NULL && strcmp(p->ifname, iface))
1087 			continue;
1088 		if (dotitle) {
1089 			pfctl_print_title("STATES:");
1090 			dotitle = 0;
1091 		}
1092 		print_state(p, opts);
1093 	}
1094 done:
1095 	free(inbuf);
1096 	return (0);
1097 }
1098 
1099 int
1100 pfctl_show_status(int dev, int opts)
1101 {
1102 	struct pf_status status;
1103 
1104 	if (ioctl(dev, DIOCGETSTATUS, &status)) {
1105 		warn("DIOCGETSTATUS");
1106 		return (-1);
1107 	}
1108 	if (opts & PF_OPT_SHOWALL)
1109 		pfctl_print_title("INFO:");
1110 	print_status(&status, opts);
1111 	return (0);
1112 }
1113 
1114 int
1115 pfctl_show_timeouts(int dev, int opts)
1116 {
1117 	struct pfioc_tm pt;
1118 	int i;
1119 
1120 	if (opts & PF_OPT_SHOWALL)
1121 		pfctl_print_title("TIMEOUTS:");
1122 	memset(&pt, 0, sizeof(pt));
1123 	for (i = 0; pf_timeouts[i].name; i++) {
1124 		pt.timeout = pf_timeouts[i].timeout;
1125 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1126 			err(1, "DIOCGETTIMEOUT");
1127 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1128 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1129 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1130 			printf(" states");
1131 		else
1132 			printf("s");
1133 		printf("\n");
1134 	}
1135 	return (0);
1136 
1137 }
1138 
1139 int
1140 pfctl_show_limits(int dev, int opts)
1141 {
1142 	struct pfioc_limit pl;
1143 	int i;
1144 
1145 	if (opts & PF_OPT_SHOWALL)
1146 		pfctl_print_title("LIMITS:");
1147 	memset(&pl, 0, sizeof(pl));
1148 	for (i = 0; pf_limits[i].name; i++) {
1149 		pl.index = pf_limits[i].index;
1150 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1151 			err(1, "DIOCGETLIMIT");
1152 		printf("%-13s ", pf_limits[i].name);
1153 		if (pl.limit == UINT_MAX)
1154 			printf("unlimited\n");
1155 		else
1156 			printf("hard limit %8u\n", pl.limit);
1157 	}
1158 	return (0);
1159 }
1160 
1161 /* callbacks for rule/nat/rdr/addr */
1162 int
1163 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1164 {
1165 	struct pf_pooladdr *pa;
1166 
1167 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1168 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1169 			err(1, "DIOCBEGINADDRS");
1170 	}
1171 
1172 	pf->paddr.af = af;
1173 	TAILQ_FOREACH(pa, &p->list, entries) {
1174 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1175 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1176 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1177 				err(1, "DIOCADDADDR");
1178 		}
1179 	}
1180 	return (0);
1181 }
1182 
1183 int
1184 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1185 {
1186 	u_int8_t		rs_num;
1187 	struct pf_rule		*rule;
1188 	struct pf_ruleset	*rs;
1189 	char 			*p;
1190 
1191 	rs_num = pf_get_ruleset_number(r->action);
1192 	if (rs_num == PF_RULESET_MAX)
1193 		errx(1, "Invalid rule type %d", r->action);
1194 
1195 	rs = &pf->anchor->ruleset;
1196 
1197 	if (anchor_call[0] && r->anchor == NULL) {
1198 		/*
1199 		 * Don't make non-brace anchors part of the main anchor pool.
1200 		 */
1201 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1202 			err(1, "pfctl_add_rule: calloc");
1203 
1204 		pf_init_ruleset(&r->anchor->ruleset);
1205 		r->anchor->ruleset.anchor = r->anchor;
1206 		if (strlcpy(r->anchor->path, anchor_call,
1207 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1208 			errx(1, "pfctl_add_rule: strlcpy");
1209 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1210 			if (!strlen(p))
1211 				err(1, "pfctl_add_rule: bad anchor name %s",
1212 				    anchor_call);
1213 		} else
1214 			p = (char *)anchor_call;
1215 		if (strlcpy(r->anchor->name, p,
1216 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1217 			errx(1, "pfctl_add_rule: strlcpy");
1218 	}
1219 
1220 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1221 		err(1, "calloc");
1222 	bcopy(r, rule, sizeof(*rule));
1223 	TAILQ_INIT(&rule->rpool.list);
1224 	pfctl_move_pool(&r->rpool, &rule->rpool);
1225 
1226 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1227 	return (0);
1228 }
1229 
1230 int
1231 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1232 {
1233 	int osize = pf->trans->pfrb_size;
1234 
1235 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1236 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1237 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1238 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1239 			return (1);
1240 	}
1241 	if (a == pf->astack[0] && ((altqsupport &&
1242 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1243 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1244 			return (2);
1245 	}
1246 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1247 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1248 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1249 			return (3);
1250 	}
1251 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1252 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1253 			return (4);
1254 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1255 		return (5);
1256 
1257 	return (0);
1258 }
1259 
1260 int
1261 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1262     int rs_num, int depth)
1263 {
1264 	struct pf_rule *r;
1265 	int		error, len = strlen(path);
1266 	int		brace = 0;
1267 
1268 	pf->anchor = rs->anchor;
1269 
1270 	if (path[0])
1271 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1272 	else
1273 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1274 
1275 	if (depth) {
1276 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1277 			brace++;
1278 			if (pf->opts & PF_OPT_VERBOSE)
1279 				printf(" {\n");
1280 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1281 			    (error = pfctl_ruleset_trans(pf,
1282 			    path, rs->anchor))) {
1283 				printf("pfctl_load_rulesets: "
1284 				    "pfctl_ruleset_trans %d\n", error);
1285 				goto error;
1286 			}
1287 		} else if (pf->opts & PF_OPT_VERBOSE)
1288 			printf("\n");
1289 
1290 	}
1291 
1292 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1293 		pfctl_optimize_ruleset(pf, rs);
1294 
1295 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1296 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1297 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1298 			goto error;
1299 		if (r->anchor) {
1300 			if ((error = pfctl_load_ruleset(pf, path,
1301 			    &r->anchor->ruleset, rs_num, depth + 1)))
1302 				goto error;
1303 		} else if (pf->opts & PF_OPT_VERBOSE)
1304 			printf("\n");
1305 		free(r);
1306 	}
1307 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1308 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1309 		printf("}\n");
1310 	}
1311 	path[len] = '\0';
1312 	return (0);
1313 
1314  error:
1315 	path[len] = '\0';
1316 	return (error);
1317 
1318 }
1319 
1320 int
1321 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1322 {
1323 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1324 	char			*name;
1325 	struct pfioc_rule	pr;
1326 	int			len = strlen(path);
1327 
1328 	bzero(&pr, sizeof(pr));
1329 	/* set up anchor before adding to path for anchor_call */
1330 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1331 		pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1332 	if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1333 		errx(1, "pfctl_load_rule: strlcpy");
1334 
1335 	if (r->anchor) {
1336 		if (r->anchor->match) {
1337 			if (path[0])
1338 				snprintf(&path[len], MAXPATHLEN - len,
1339 				    "/%s", r->anchor->name);
1340 			else
1341 				snprintf(&path[len], MAXPATHLEN - len,
1342 				    "%s", r->anchor->name);
1343 			name = path;
1344 		} else
1345 			name = r->anchor->path;
1346 	} else
1347 		name = "";
1348 
1349 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1350 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1351 			return (1);
1352 		pr.pool_ticket = pf->paddr.ticket;
1353 		memcpy(&pr.rule, r, sizeof(pr.rule));
1354 		if (r->anchor && strlcpy(pr.anchor_call, name,
1355 		    sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1356 			errx(1, "pfctl_load_rule: strlcpy");
1357 		if (ioctl(pf->dev, DIOCADDRULE, &pr))
1358 			err(1, "DIOCADDRULE");
1359 	}
1360 
1361 	if (pf->opts & PF_OPT_VERBOSE) {
1362 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1363 		print_rule(r, r->anchor ? r->anchor->name : "",
1364 		    pf->opts & PF_OPT_VERBOSE2,
1365 		    pf->opts & PF_OPT_NUMERIC);
1366 	}
1367 	path[len] = '\0';
1368 	pfctl_clear_pool(&r->rpool);
1369 	return (0);
1370 }
1371 
1372 int
1373 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1374 {
1375 	if (altqsupport &&
1376 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1377 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1378 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1379 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1380 				if (errno == ENXIO)
1381 					errx(1, "qtype not configured");
1382 				else if (errno == ENODEV)
1383 					errx(1, "%s: driver does not support "
1384 					    "altq", a->ifname);
1385 				else
1386 					err(1, "DIOCADDALTQ");
1387 			}
1388 		}
1389 		pfaltq_store(&pf->paltq->altq);
1390 	}
1391 	return (0);
1392 }
1393 
1394 int
1395 pfctl_rules(int dev, char *filename, int opts, int optimize,
1396     char *anchorname, struct pfr_buffer *trans)
1397 {
1398 #define ERR(x) do { warn(x); goto _error; } while(0)
1399 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1400 
1401 	struct pfr_buffer	*t, buf;
1402 	struct pfioc_altq	 pa;
1403 	struct pfctl		 pf;
1404 	struct pf_ruleset	*rs;
1405 	struct pfr_table	 trs;
1406 	char			*path;
1407 	int			 osize;
1408 
1409 	RB_INIT(&pf_anchors);
1410 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1411 	pf_init_ruleset(&pf_main_anchor.ruleset);
1412 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1413 	if (trans == NULL) {
1414 		bzero(&buf, sizeof(buf));
1415 		buf.pfrb_type = PFRB_TRANS;
1416 		t = &buf;
1417 		osize = 0;
1418 	} else {
1419 		t = trans;
1420 		osize = t->pfrb_size;
1421 	}
1422 
1423 	memset(&pa, 0, sizeof(pa));
1424 	memset(&pf, 0, sizeof(pf));
1425 	memset(&trs, 0, sizeof(trs));
1426 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1427 		ERRX("pfctl_rules: calloc");
1428 	if (strlcpy(trs.pfrt_anchor, anchorname,
1429 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1430 		ERRX("pfctl_rules: strlcpy");
1431 	pf.dev = dev;
1432 	pf.opts = opts;
1433 	pf.optimize = optimize;
1434 	pf.loadopt = loadopt;
1435 
1436 	/* non-brace anchor, create without resolving the path */
1437 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1438 		ERRX("pfctl_rules: calloc");
1439 	rs = &pf.anchor->ruleset;
1440 	pf_init_ruleset(rs);
1441 	rs->anchor = pf.anchor;
1442 	if (strlcpy(pf.anchor->path, anchorname,
1443 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1444 		errx(1, "pfctl_add_rule: strlcpy");
1445 	if (strlcpy(pf.anchor->name, anchorname,
1446 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1447 		errx(1, "pfctl_add_rule: strlcpy");
1448 
1449 
1450 	pf.astack[0] = pf.anchor;
1451 	pf.asd = 0;
1452 	if (anchorname[0])
1453 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1454 	pf.paltq = &pa;
1455 	pf.trans = t;
1456 	pfctl_init_options(&pf);
1457 
1458 	if ((opts & PF_OPT_NOACTION) == 0) {
1459 		/*
1460 		 * XXX For the time being we need to open transactions for
1461 		 * the main ruleset before parsing, because tables are still
1462 		 * loaded at parse time.
1463 		 */
1464 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1465 			ERRX("pfctl_rules");
1466 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1467 			pa.ticket =
1468 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1469 		if (pf.loadopt & PFCTL_FLAG_TABLE)
1470 			pf.astack[0]->ruleset.tticket =
1471 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1472 	}
1473 
1474 	if (parse_config(filename, &pf) < 0) {
1475 		if ((opts & PF_OPT_NOACTION) == 0)
1476 			ERRX("Syntax error in config file: "
1477 			    "pf rules not loaded");
1478 		else
1479 			goto _error;
1480 	}
1481 
1482 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1483 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1484 	    (pf.loadopt & PFCTL_FLAG_NAT &&
1485 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1486 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1487 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1488 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
1489 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1490 		if ((opts & PF_OPT_NOACTION) == 0)
1491 			ERRX("Unable to load rules into kernel");
1492 		else
1493 			goto _error;
1494 	}
1495 
1496 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1497 		if (check_commit_altq(dev, opts) != 0)
1498 			ERRX("errors in altq config");
1499 
1500 	/* process "load anchor" directives */
1501 	if (!anchorname[0])
1502 		if (pfctl_load_anchors(dev, &pf, t) == -1)
1503 			ERRX("load anchors");
1504 
1505 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1506 		if (!anchorname[0])
1507 			if (pfctl_load_options(&pf))
1508 				goto _error;
1509 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1510 			ERR("DIOCXCOMMIT");
1511 	}
1512 	return (0);
1513 
1514 _error:
1515 	if (trans == NULL) {	/* main ruleset */
1516 		if ((opts & PF_OPT_NOACTION) == 0)
1517 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1518 				err(1, "DIOCXROLLBACK");
1519 		exit(1);
1520 	} else {		/* sub ruleset */
1521 		return (-1);
1522 	}
1523 
1524 #undef ERR
1525 #undef ERRX
1526 }
1527 
1528 FILE *
1529 pfctl_fopen(const char *name, const char *mode)
1530 {
1531 	struct stat	 st;
1532 	FILE		*fp;
1533 
1534 	fp = fopen(name, mode);
1535 	if (fp == NULL)
1536 		return (NULL);
1537 	if (fstat(fileno(fp), &st)) {
1538 		fclose(fp);
1539 		return (NULL);
1540 	}
1541 	if (S_ISDIR(st.st_mode)) {
1542 		fclose(fp);
1543 		errno = EISDIR;
1544 		return (NULL);
1545 	}
1546 	return (fp);
1547 }
1548 
1549 void
1550 pfctl_init_options(struct pfctl *pf)
1551 {
1552 
1553 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1554 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1555 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1556 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1557 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1558 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1559 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1560 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1561 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1562 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1563 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1564 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1565 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1566 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1567 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1568 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1569 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1570 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1571 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1572 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1573 
1574 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1575 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1576 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1577 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1578 
1579 	pf->debug = PF_DEBUG_URGENT;
1580 }
1581 
1582 int
1583 pfctl_load_options(struct pfctl *pf)
1584 {
1585 	int i, error = 0;
1586 
1587 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1588 		return (0);
1589 
1590 	/* load limits */
1591 	for (i = 0; i < PF_LIMIT_MAX; i++) {
1592 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1593 			continue;
1594 		if (pfctl_load_limit(pf, i, pf->limit[i]))
1595 			error = 1;
1596 	}
1597 
1598 	/*
1599 	 * If we've set the limit, but haven't explicitly set adaptive
1600 	 * timeouts, do it now with a start of 60% and end of 120%.
1601 	 */
1602 	if (pf->limit_set[PF_LIMIT_STATES] &&
1603 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1604 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1605 		pf->timeout[PFTM_ADAPTIVE_START] =
1606 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
1607 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1608 		pf->timeout[PFTM_ADAPTIVE_END] =
1609 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
1610 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1611 	}
1612 
1613 	/* load timeouts */
1614 	for (i = 0; i < PFTM_MAX; i++) {
1615 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1616 			continue;
1617 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1618 			error = 1;
1619 	}
1620 
1621 	/* load debug */
1622 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1623 		if (pfctl_load_debug(pf, pf->debug))
1624 			error = 1;
1625 
1626 	/* load logif */
1627 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1628 		if (pfctl_load_logif(pf, pf->ifname))
1629 			error = 1;
1630 
1631 	/* load hostid */
1632 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1633 		if (pfctl_load_hostid(pf, pf->hostid))
1634 			error = 1;
1635 
1636 	return (error);
1637 }
1638 
1639 int
1640 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1641 {
1642 	int i;
1643 
1644 
1645 	for (i = 0; pf_limits[i].name; i++) {
1646 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
1647 			pf->limit[pf_limits[i].index] = limit;
1648 			pf->limit_set[pf_limits[i].index] = 1;
1649 			break;
1650 		}
1651 	}
1652 	if (pf_limits[i].name == NULL) {
1653 		warnx("Bad pool name.");
1654 		return (1);
1655 	}
1656 
1657 	if (pf->opts & PF_OPT_VERBOSE)
1658 		printf("set limit %s %d\n", opt, limit);
1659 
1660 	return (0);
1661 }
1662 
1663 int
1664 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1665 {
1666 	struct pfioc_limit pl;
1667 
1668 	memset(&pl, 0, sizeof(pl));
1669 	pl.index = index;
1670 	pl.limit = limit;
1671 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1672 		if (errno == EBUSY)
1673 			warnx("Current pool size exceeds requested hard limit");
1674 		else
1675 			warnx("DIOCSETLIMIT");
1676 		return (1);
1677 	}
1678 	return (0);
1679 }
1680 
1681 int
1682 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1683 {
1684 	int i;
1685 
1686 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1687 		return (0);
1688 
1689 	for (i = 0; pf_timeouts[i].name; i++) {
1690 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1691 			pf->timeout[pf_timeouts[i].timeout] = seconds;
1692 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
1693 			break;
1694 		}
1695 	}
1696 
1697 	if (pf_timeouts[i].name == NULL) {
1698 		warnx("Bad timeout name.");
1699 		return (1);
1700 	}
1701 
1702 
1703 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1704 		printf("set timeout %s %d\n", opt, seconds);
1705 
1706 	return (0);
1707 }
1708 
1709 int
1710 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1711 {
1712 	struct pfioc_tm pt;
1713 
1714 	memset(&pt, 0, sizeof(pt));
1715 	pt.timeout = timeout;
1716 	pt.seconds = seconds;
1717 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1718 		warnx("DIOCSETTIMEOUT");
1719 		return (1);
1720 	}
1721 	return (0);
1722 }
1723 
1724 int
1725 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1726 {
1727 	const struct pf_hint *hint;
1728 	int i, r;
1729 
1730 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1731 		return (0);
1732 
1733 	for (i = 0; pf_hints[i].name; i++)
1734 		if (strcasecmp(opt, pf_hints[i].name) == 0)
1735 			break;
1736 
1737 	hint = pf_hints[i].hint;
1738 	if (hint == NULL) {
1739 		warnx("invalid state timeouts optimization");
1740 		return (1);
1741 	}
1742 
1743 	for (i = 0; hint[i].name; i++)
1744 		if ((r = pfctl_set_timeout(pf, hint[i].name,
1745 		    hint[i].timeout, 1)))
1746 			return (r);
1747 
1748 	if (pf->opts & PF_OPT_VERBOSE)
1749 		printf("set optimization %s\n", opt);
1750 
1751 	return (0);
1752 }
1753 
1754 int
1755 pfctl_set_logif(struct pfctl *pf, char *ifname)
1756 {
1757 
1758 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1759 		return (0);
1760 
1761 	if (!strcmp(ifname, "none")) {
1762 		free(pf->ifname);
1763 		pf->ifname = NULL;
1764 	} else {
1765 		pf->ifname = strdup(ifname);
1766 		if (!pf->ifname)
1767 			errx(1, "pfctl_set_logif: strdup");
1768 	}
1769 	pf->ifname_set = 1;
1770 
1771 	if (pf->opts & PF_OPT_VERBOSE)
1772 		printf("set loginterface %s\n", ifname);
1773 
1774 	return (0);
1775 }
1776 
1777 int
1778 pfctl_load_logif(struct pfctl *pf, char *ifname)
1779 {
1780 	struct pfioc_if pi;
1781 
1782 	memset(&pi, 0, sizeof(pi));
1783 	if (ifname && strlcpy(pi.ifname, ifname,
1784 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1785 		warnx("pfctl_load_logif: strlcpy");
1786 		return (1);
1787 	}
1788 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1789 		warnx("DIOCSETSTATUSIF");
1790 		return (1);
1791 	}
1792 	return (0);
1793 }
1794 
1795 int
1796 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1797 {
1798 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1799 		return (0);
1800 
1801 	HTONL(hostid);
1802 
1803 	pf->hostid = hostid;
1804 	pf->hostid_set = 1;
1805 
1806 	if (pf->opts & PF_OPT_VERBOSE)
1807 		printf("set hostid 0x%08x\n", ntohl(hostid));
1808 
1809 	return (0);
1810 }
1811 
1812 int
1813 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
1814 {
1815 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
1816 		warnx("DIOCSETHOSTID");
1817 		return (1);
1818 	}
1819 	return (0);
1820 }
1821 
1822 int
1823 pfctl_set_debug(struct pfctl *pf, char *d)
1824 {
1825 	u_int32_t	level;
1826 
1827 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1828 		return (0);
1829 
1830 	if (!strcmp(d, "none"))
1831 		pf->debug = PF_DEBUG_NONE;
1832 	else if (!strcmp(d, "urgent"))
1833 		pf->debug = PF_DEBUG_URGENT;
1834 	else if (!strcmp(d, "misc"))
1835 		pf->debug = PF_DEBUG_MISC;
1836 	else if (!strcmp(d, "loud"))
1837 		pf->debug = PF_DEBUG_NOISY;
1838 	else {
1839 		warnx("unknown debug level \"%s\"", d);
1840 		return (-1);
1841 	}
1842 
1843 	pf->debug_set = 1;
1844 
1845 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1846 		if (ioctl(dev, DIOCSETDEBUG, &level))
1847 			err(1, "DIOCSETDEBUG");
1848 
1849 	if (pf->opts & PF_OPT_VERBOSE)
1850 		printf("set debug %s\n", d);
1851 
1852 	return (0);
1853 }
1854 
1855 int
1856 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1857 {
1858 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1859 		warnx("DIOCSETDEBUG");
1860 		return (1);
1861 	}
1862 	return (0);
1863 }
1864 
1865 int
1866 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1867 {
1868 	struct pfioc_iface	pi;
1869 
1870 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1871 		return (0);
1872 
1873 	bzero(&pi, sizeof(pi));
1874 
1875 	pi.pfiio_flags = flags;
1876 
1877 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1878 	    sizeof(pi.pfiio_name))
1879 		errx(1, "pfctl_set_interface_flags: strlcpy");
1880 
1881 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1882 		if (how == 0) {
1883 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1884 				err(1, "DIOCCLRIFFLAG");
1885 		} else {
1886 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1887 				err(1, "DIOCSETIFFLAG");
1888 		}
1889 	}
1890 	return (0);
1891 }
1892 
1893 void
1894 pfctl_debug(int dev, u_int32_t level, int opts)
1895 {
1896 	if (ioctl(dev, DIOCSETDEBUG, &level))
1897 		err(1, "DIOCSETDEBUG");
1898 	if ((opts & PF_OPT_QUIET) == 0) {
1899 		fprintf(stderr, "debug level set to '");
1900 		switch (level) {
1901 		case PF_DEBUG_NONE:
1902 			fprintf(stderr, "none");
1903 			break;
1904 		case PF_DEBUG_URGENT:
1905 			fprintf(stderr, "urgent");
1906 			break;
1907 		case PF_DEBUG_MISC:
1908 			fprintf(stderr, "misc");
1909 			break;
1910 		case PF_DEBUG_NOISY:
1911 			fprintf(stderr, "loud");
1912 			break;
1913 		default:
1914 			fprintf(stderr, "<invalid>");
1915 			break;
1916 		}
1917 		fprintf(stderr, "'\n");
1918 	}
1919 }
1920 
1921 int
1922 pfctl_test_altqsupport(int dev, int opts)
1923 {
1924 	struct pfioc_altq pa;
1925 
1926 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
1927 		if (errno == ENODEV) {
1928 			if (!(opts & PF_OPT_QUIET))
1929 				fprintf(stderr, "No ALTQ support in kernel\n"
1930 				    "ALTQ related functions disabled\n");
1931 			return (0);
1932 		} else
1933 			err(1, "DIOCGETALTQS");
1934 	}
1935 	return (1);
1936 }
1937 
1938 int
1939 pfctl_show_anchors(int dev, int opts, char *anchorname)
1940 {
1941 	struct pfioc_ruleset	 pr;
1942 	u_int32_t		 mnr, nr;
1943 
1944 	memset(&pr, 0, sizeof(pr));
1945 	memcpy(pr.path, anchorname, sizeof(pr.path));
1946 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1947 		if (errno == EINVAL)
1948 			fprintf(stderr, "Anchor '%s' not found.\n",
1949 			    anchorname);
1950 		else
1951 			err(1, "DIOCGETRULESETS");
1952 		return (-1);
1953 	}
1954 	mnr = pr.nr;
1955 	for (nr = 0; nr < mnr; ++nr) {
1956 		char sub[MAXPATHLEN];
1957 
1958 		pr.nr = nr;
1959 		if (ioctl(dev, DIOCGETRULESET, &pr))
1960 			err(1, "DIOCGETRULESET");
1961 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1962 			continue;
1963 		sub[0] = 0;
1964 		if (pr.path[0]) {
1965 			strlcat(sub, pr.path, sizeof(sub));
1966 			strlcat(sub, "/", sizeof(sub));
1967 		}
1968 		strlcat(sub, pr.name, sizeof(sub));
1969 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1970 			printf("  %s\n", sub);
1971 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1972 			return (-1);
1973 	}
1974 	return (0);
1975 }
1976 
1977 const char *
1978 pfctl_lookup_option(char *cmd, const char **list)
1979 {
1980 	if (cmd != NULL && *cmd)
1981 		for (; *list; list++)
1982 			if (!strncmp(cmd, *list, strlen(cmd)))
1983 				return (*list);
1984 	return (NULL);
1985 }
1986 
1987 int
1988 main(int argc, char *argv[])
1989 {
1990 	int	 error = 0;
1991 	int	 ch;
1992 	int	 mode = O_RDONLY;
1993 	int	 opts = 0;
1994 	int	 optimize = PF_OPTIMIZE_BASIC;
1995 	char	 anchorname[MAXPATHLEN];
1996 	char	*path;
1997 
1998 	if (argc < 2)
1999 		usage();
2000 
2001 	while ((ch = getopt(argc, argv,
2002 	    "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2003 		switch (ch) {
2004 		case 'a':
2005 			anchoropt = optarg;
2006 			break;
2007 		case 'd':
2008 			opts |= PF_OPT_DISABLE;
2009 			mode = O_RDWR;
2010 			break;
2011 		case 'D':
2012 			if (pfctl_cmdline_symset(optarg) < 0)
2013 				warnx("could not parse macro definition %s",
2014 				    optarg);
2015 			break;
2016 		case 'e':
2017 			opts |= PF_OPT_ENABLE;
2018 			mode = O_RDWR;
2019 			break;
2020 		case 'q':
2021 			opts |= PF_OPT_QUIET;
2022 			break;
2023 		case 'F':
2024 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2025 			if (clearopt == NULL) {
2026 				warnx("Unknown flush modifier '%s'", optarg);
2027 				usage();
2028 			}
2029 			mode = O_RDWR;
2030 			break;
2031 		case 'i':
2032 			ifaceopt = optarg;
2033 			break;
2034 		case 'k':
2035 			if (state_killers >= 2) {
2036 				warnx("can only specify -k twice");
2037 				usage();
2038 				/* NOTREACHED */
2039 			}
2040 			state_kill[state_killers++] = optarg;
2041 			mode = O_RDWR;
2042 			break;
2043 		case 'K':
2044 			if (src_node_killers >= 2) {
2045 				warnx("can only specify -K twice");
2046 				usage();
2047 				/* NOTREACHED */
2048 			}
2049 			src_node_kill[src_node_killers++] = optarg;
2050 			mode = O_RDWR;
2051 			break;
2052 		case 'm':
2053 			opts |= PF_OPT_MERGE;
2054 			break;
2055 		case 'n':
2056 			opts |= PF_OPT_NOACTION;
2057 			break;
2058 		case 'N':
2059 			loadopt |= PFCTL_FLAG_NAT;
2060 			break;
2061 		case 'r':
2062 			opts |= PF_OPT_USEDNS;
2063 			break;
2064 		case 'f':
2065 			rulesopt = optarg;
2066 			mode = O_RDWR;
2067 			break;
2068 		case 'g':
2069 			opts |= PF_OPT_DEBUG;
2070 			break;
2071 		case 'A':
2072 			loadopt |= PFCTL_FLAG_ALTQ;
2073 			break;
2074 		case 'R':
2075 			loadopt |= PFCTL_FLAG_FILTER;
2076 			break;
2077 		case 'o':
2078 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2079 			if (optiopt == NULL) {
2080 				warnx("Unknown optimization '%s'", optarg);
2081 				usage();
2082 			}
2083 			opts |= PF_OPT_OPTIMIZE;
2084 			break;
2085 		case 'O':
2086 			loadopt |= PFCTL_FLAG_OPTION;
2087 			break;
2088 		case 'p':
2089 			pf_device = optarg;
2090 			break;
2091 		case 'P':
2092 			opts |= PF_OPT_NUMERIC;
2093 			break;
2094 		case 's':
2095 			showopt = pfctl_lookup_option(optarg, showopt_list);
2096 			if (showopt == NULL) {
2097 				warnx("Unknown show modifier '%s'", optarg);
2098 				usage();
2099 			}
2100 			break;
2101 		case 't':
2102 			tableopt = optarg;
2103 			break;
2104 		case 'T':
2105 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2106 			if (tblcmdopt == NULL) {
2107 				warnx("Unknown table command '%s'", optarg);
2108 				usage();
2109 			}
2110 			break;
2111 		case 'v':
2112 			if (opts & PF_OPT_VERBOSE)
2113 				opts |= PF_OPT_VERBOSE2;
2114 			opts |= PF_OPT_VERBOSE;
2115 			break;
2116 		case 'x':
2117 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2118 			if (debugopt == NULL) {
2119 				warnx("Unknown debug level '%s'", optarg);
2120 				usage();
2121 			}
2122 			mode = O_RDWR;
2123 			break;
2124 		case 'z':
2125 			opts |= PF_OPT_CLRRULECTRS;
2126 			mode = O_RDWR;
2127 			break;
2128 		case 'h':
2129 			/* FALLTHROUGH */
2130 		default:
2131 			usage();
2132 			/* NOTREACHED */
2133 		}
2134 	}
2135 
2136 	if (tblcmdopt != NULL) {
2137 		argc -= optind;
2138 		argv += optind;
2139 		ch = *tblcmdopt;
2140 		if (ch == 'l') {
2141 			loadopt |= PFCTL_FLAG_TABLE;
2142 			tblcmdopt = NULL;
2143 		} else
2144 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2145 	} else if (argc != optind) {
2146 		warnx("unknown command line argument: %s ...", argv[optind]);
2147 		usage();
2148 		/* NOTREACHED */
2149 	}
2150 	if (loadopt == 0)
2151 		loadopt = ~0;
2152 
2153 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2154 		errx(1, "pfctl: calloc");
2155 	memset(anchorname, 0, sizeof(anchorname));
2156 	if (anchoropt != NULL) {
2157 		int len = strlen(anchoropt);
2158 
2159 		if (anchoropt[len - 1] == '*') {
2160 			if (len >= 2 && anchoropt[len - 2] == '/')
2161 				anchoropt[len - 2] = '\0';
2162 			else
2163 				anchoropt[len - 1] = '\0';
2164 			opts |= PF_OPT_RECURSE;
2165 		}
2166 		if (strlcpy(anchorname, anchoropt,
2167 		    sizeof(anchorname)) >= sizeof(anchorname))
2168 			errx(1, "anchor name '%s' too long",
2169 			    anchoropt);
2170 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2171 	}
2172 
2173 	if ((opts & PF_OPT_NOACTION) == 0) {
2174 		dev = open(pf_device, mode);
2175 		if (dev == -1)
2176 			err(1, "%s", pf_device);
2177 		altqsupport = pfctl_test_altqsupport(dev, opts);
2178 	} else {
2179 		dev = open(pf_device, O_RDONLY);
2180 		if (dev >= 0)
2181 			opts |= PF_OPT_DUMMYACTION;
2182 		/* turn off options */
2183 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2184 		clearopt = showopt = debugopt = NULL;
2185 #if !defined(ENABLE_ALTQ)
2186 		altqsupport = 0;
2187 #else
2188 		altqsupport = 1;
2189 #endif
2190 	}
2191 
2192 	if (opts & PF_OPT_DISABLE)
2193 		if (pfctl_disable(dev, opts))
2194 			error = 1;
2195 
2196 	if (showopt != NULL) {
2197 		switch (*showopt) {
2198 		case 'A':
2199 			pfctl_show_anchors(dev, opts, anchorname);
2200 			break;
2201 		case 'r':
2202 			pfctl_load_fingerprints(dev, opts);
2203 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2204 			    anchorname, 0);
2205 			break;
2206 		case 'l':
2207 			pfctl_load_fingerprints(dev, opts);
2208 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2209 			    anchorname, 0);
2210 			break;
2211 		case 'n':
2212 			pfctl_load_fingerprints(dev, opts);
2213 			pfctl_show_nat(dev, opts, anchorname);
2214 			break;
2215 		case 'q':
2216 			pfctl_show_altq(dev, ifaceopt, opts,
2217 			    opts & PF_OPT_VERBOSE2);
2218 			break;
2219 		case 's':
2220 			pfctl_show_states(dev, ifaceopt, opts);
2221 			break;
2222 		case 'S':
2223 			pfctl_show_src_nodes(dev, opts);
2224 			break;
2225 		case 'i':
2226 			pfctl_show_status(dev, opts);
2227 			break;
2228 		case 't':
2229 			pfctl_show_timeouts(dev, opts);
2230 			break;
2231 		case 'm':
2232 			pfctl_show_limits(dev, opts);
2233 			break;
2234 		case 'a':
2235 			opts |= PF_OPT_SHOWALL;
2236 			pfctl_load_fingerprints(dev, opts);
2237 
2238 			pfctl_show_nat(dev, opts, anchorname);
2239 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2240 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2241 			pfctl_show_states(dev, ifaceopt, opts);
2242 			pfctl_show_src_nodes(dev, opts);
2243 			pfctl_show_status(dev, opts);
2244 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2245 			pfctl_show_timeouts(dev, opts);
2246 			pfctl_show_limits(dev, opts);
2247 			pfctl_show_tables(anchorname, opts);
2248 			pfctl_show_fingerprints(opts);
2249 			break;
2250 		case 'T':
2251 			pfctl_show_tables(anchorname, opts);
2252 			break;
2253 		case 'o':
2254 			pfctl_load_fingerprints(dev, opts);
2255 			pfctl_show_fingerprints(opts);
2256 			break;
2257 		case 'I':
2258 			pfctl_show_ifaces(ifaceopt, opts);
2259 			break;
2260 		}
2261 	}
2262 
2263 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2264 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2265 		    anchorname, 0);
2266 
2267 	if (clearopt != NULL) {
2268 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2269 			errx(1, "anchor names beginning with '_' cannot "
2270 			    "be modified from the command line");
2271 
2272 		switch (*clearopt) {
2273 		case 'r':
2274 			pfctl_clear_rules(dev, opts, anchorname);
2275 			break;
2276 		case 'n':
2277 			pfctl_clear_nat(dev, opts, anchorname);
2278 			break;
2279 		case 'q':
2280 			pfctl_clear_altq(dev, opts);
2281 			break;
2282 		case 's':
2283 			pfctl_clear_states(dev, ifaceopt, opts);
2284 			break;
2285 		case 'S':
2286 			pfctl_clear_src_nodes(dev, opts);
2287 			break;
2288 		case 'i':
2289 			pfctl_clear_stats(dev, opts);
2290 			break;
2291 		case 'a':
2292 			pfctl_clear_rules(dev, opts, anchorname);
2293 			pfctl_clear_nat(dev, opts, anchorname);
2294 			pfctl_clear_tables(anchorname, opts);
2295 			if (!*anchorname) {
2296 				pfctl_clear_altq(dev, opts);
2297 				pfctl_clear_states(dev, ifaceopt, opts);
2298 				pfctl_clear_src_nodes(dev, opts);
2299 				pfctl_clear_stats(dev, opts);
2300 				pfctl_clear_fingerprints(dev, opts);
2301 				pfctl_clear_interface_flags(dev, opts);
2302 			}
2303 			break;
2304 		case 'o':
2305 			pfctl_clear_fingerprints(dev, opts);
2306 			break;
2307 		case 'T':
2308 			pfctl_clear_tables(anchorname, opts);
2309 			break;
2310 		}
2311 	}
2312 	if (state_killers) {
2313 		if (!strcmp(state_kill[0], "label"))
2314 			pfctl_label_kill_states(dev, ifaceopt, opts);
2315 		else if (!strcmp(state_kill[0], "id"))
2316 			pfctl_id_kill_states(dev, ifaceopt, opts);
2317 		else
2318 			pfctl_net_kill_states(dev, ifaceopt, opts);
2319 	}
2320 
2321 	if (src_node_killers)
2322 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
2323 
2324 	if (tblcmdopt != NULL) {
2325 		error = pfctl_command_tables(argc, argv, tableopt,
2326 		    tblcmdopt, rulesopt, anchorname, opts);
2327 		rulesopt = NULL;
2328 	}
2329 	if (optiopt != NULL) {
2330 		switch (*optiopt) {
2331 		case 'n':
2332 			optimize = 0;
2333 			break;
2334 		case 'b':
2335 			optimize |= PF_OPTIMIZE_BASIC;
2336 			break;
2337 		case 'o':
2338 		case 'p':
2339 			optimize |= PF_OPTIMIZE_PROFILE;
2340 			break;
2341 		}
2342 	}
2343 
2344 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2345 	    !anchorname[0])
2346 		if (pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET))
2347 			error = 1;
2348 
2349 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2350 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2351 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2352 			error = 1;
2353 
2354 	if (rulesopt != NULL) {
2355 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2356 			errx(1, "anchor names beginning with '_' cannot "
2357 			    "be modified from the command line");
2358 		if (pfctl_rules(dev, rulesopt, opts, optimize,
2359 		    anchorname, NULL))
2360 			error = 1;
2361 		else if (!(opts & PF_OPT_NOACTION) &&
2362 		    (loadopt & PFCTL_FLAG_TABLE))
2363 			warn_namespace_collision(NULL);
2364 	}
2365 
2366 	if (opts & PF_OPT_ENABLE)
2367 		if (pfctl_enable(dev, opts))
2368 			error = 1;
2369 
2370 	if (debugopt != NULL) {
2371 		switch (*debugopt) {
2372 		case 'n':
2373 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
2374 			break;
2375 		case 'u':
2376 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2377 			break;
2378 		case 'm':
2379 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
2380 			break;
2381 		case 'l':
2382 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2383 			break;
2384 		}
2385 	}
2386 
2387 	exit(error);
2388 }
2389