xref: /freebsd/sbin/pfctl/pfctl.c (revision d06955f9bdb1416d9196043ed781f9b36dae9adc)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/types.h>
40 #include <sys/ioctl.h>
41 #include <sys/socket.h>
42 #include <sys/stat.h>
43 #include <sys/endian.h>
44 
45 #include <net/if.h>
46 #include <netinet/in.h>
47 #include <net/pfvar.h>
48 #include <arpa/inet.h>
49 #include <net/altq/altq.h>
50 #include <sys/sysctl.h>
51 
52 #include <err.h>
53 #include <errno.h>
54 #include <fcntl.h>
55 #include <limits.h>
56 #include <netdb.h>
57 #include <stdint.h>
58 #include <stdio.h>
59 #include <stdlib.h>
60 #include <string.h>
61 #include <unistd.h>
62 
63 #include "pfctl_parser.h"
64 #include "pfctl.h"
65 
66 void	 usage(void);
67 int	 pfctl_enable(int, int);
68 int	 pfctl_disable(int, int);
69 int	 pfctl_clear_stats(int, int);
70 int	 pfctl_clear_interface_flags(int, int);
71 int	 pfctl_clear_rules(int, int, char *);
72 int	 pfctl_clear_nat(int, int, char *);
73 int	 pfctl_clear_altq(int, int);
74 int	 pfctl_clear_src_nodes(int, int);
75 int	 pfctl_clear_states(int, const char *, int);
76 void	 pfctl_addrprefix(char *, struct pf_addr *);
77 int	 pfctl_kill_src_nodes(int, const char *, int);
78 int	 pfctl_net_kill_states(int, const char *, int);
79 int	 pfctl_label_kill_states(int, const char *, int);
80 int	 pfctl_id_kill_states(int, const char *, int);
81 void	 pfctl_init_options(struct pfctl *);
82 int	 pfctl_load_options(struct pfctl *);
83 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
84 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
85 int	 pfctl_load_debug(struct pfctl *, unsigned int);
86 int	 pfctl_load_logif(struct pfctl *, char *);
87 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
88 int	 pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
89 	    char *);
90 void	 pfctl_print_rule_counters(struct pf_rule *, int);
91 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
92 int	 pfctl_show_nat(int, int, char *);
93 int	 pfctl_show_src_nodes(int, int);
94 int	 pfctl_show_states(int, const char *, int);
95 int	 pfctl_show_status(int, int);
96 int	 pfctl_show_timeouts(int, int);
97 int	 pfctl_show_limits(int, int);
98 void	 pfctl_debug(int, u_int32_t, int);
99 int	 pfctl_test_altqsupport(int, int);
100 int	 pfctl_show_anchors(int, int, char *);
101 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
102 int	 pfctl_load_ruleset(struct pfctl *, char *,
103 		struct pf_ruleset *, int, int);
104 int	 pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
105 const char	*pfctl_lookup_option(char *, const char * const *);
106 
107 static struct pf_anchor_global	 pf_anchors;
108 static struct pf_anchor	 pf_main_anchor;
109 
110 static const char	*clearopt;
111 static char		*rulesopt;
112 static const char	*showopt;
113 static const char	*debugopt;
114 static char		*anchoropt;
115 static const char	*optiopt = NULL;
116 static const char	*pf_device = "/dev/pf";
117 static char		*ifaceopt;
118 static char		*tableopt;
119 static const char	*tblcmdopt;
120 static int		 src_node_killers;
121 static char		*src_node_kill[2];
122 static int		 state_killers;
123 static char		*state_kill[2];
124 int			 loadopt;
125 int			 altqsupport;
126 
127 int			 dev = -1;
128 static int		 first_title = 1;
129 static int		 labels = 0;
130 
131 #define INDENT(d, o)	do {						\
132 				if (o) {				\
133 					int i;				\
134 					for (i=0; i < d; i++)		\
135 						printf("  ");		\
136 				}					\
137 			} while (0);					\
138 
139 
140 static const struct {
141 	const char	*name;
142 	int		index;
143 } pf_limits[] = {
144 	{ "states",		PF_LIMIT_STATES },
145 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
146 	{ "frags",		PF_LIMIT_FRAGS },
147 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
148 	{ NULL,			0 }
149 };
150 
151 struct pf_hint {
152 	const char	*name;
153 	int		timeout;
154 };
155 static const struct pf_hint pf_hint_normal[] = {
156 	{ "tcp.first",		2 * 60 },
157 	{ "tcp.opening",	30 },
158 	{ "tcp.established",	24 * 60 * 60 },
159 	{ "tcp.closing",	15 * 60 },
160 	{ "tcp.finwait",	45 },
161 	{ "tcp.closed",		90 },
162 	{ "tcp.tsdiff",		30 },
163 	{ NULL,			0 }
164 };
165 static const struct pf_hint pf_hint_satellite[] = {
166 	{ "tcp.first",		3 * 60 },
167 	{ "tcp.opening",	30 + 5 },
168 	{ "tcp.established",	24 * 60 * 60 },
169 	{ "tcp.closing",	15 * 60 + 5 },
170 	{ "tcp.finwait",	45 + 5 },
171 	{ "tcp.closed",		90 + 5 },
172 	{ "tcp.tsdiff",		60 },
173 	{ NULL,			0 }
174 };
175 static const struct pf_hint pf_hint_conservative[] = {
176 	{ "tcp.first",		60 * 60 },
177 	{ "tcp.opening",	15 * 60 },
178 	{ "tcp.established",	5 * 24 * 60 * 60 },
179 	{ "tcp.closing",	60 * 60 },
180 	{ "tcp.finwait",	10 * 60 },
181 	{ "tcp.closed",		3 * 60 },
182 	{ "tcp.tsdiff",		60 },
183 	{ NULL,			0 }
184 };
185 static const struct pf_hint pf_hint_aggressive[] = {
186 	{ "tcp.first",		30 },
187 	{ "tcp.opening",	5 },
188 	{ "tcp.established",	5 * 60 * 60 },
189 	{ "tcp.closing",	60 },
190 	{ "tcp.finwait",	30 },
191 	{ "tcp.closed",		30 },
192 	{ "tcp.tsdiff",		10 },
193 	{ NULL,			0 }
194 };
195 
196 static const struct {
197 	const char *name;
198 	const struct pf_hint *hint;
199 } pf_hints[] = {
200 	{ "normal",		pf_hint_normal },
201 	{ "satellite",		pf_hint_satellite },
202 	{ "high-latency",	pf_hint_satellite },
203 	{ "conservative",	pf_hint_conservative },
204 	{ "aggressive",		pf_hint_aggressive },
205 	{ NULL,			NULL }
206 };
207 
208 static const char * const clearopt_list[] = {
209 	"nat", "queue", "rules", "Sources",
210 	"states", "info", "Tables", "osfp", "all", NULL
211 };
212 
213 static const char * const showopt_list[] = {
214 	"nat", "queue", "rules", "Anchors", "Sources", "states", "info",
215 	"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
216 	"all", NULL
217 };
218 
219 static const char * const tblcmdopt_list[] = {
220 	"kill", "flush", "add", "delete", "load", "replace", "show",
221 	"test", "zero", "expire", NULL
222 };
223 
224 static const char * const debugopt_list[] = {
225 	"none", "urgent", "misc", "loud", NULL
226 };
227 
228 static const char * const optiopt_list[] = {
229 	"none", "basic", "profile", NULL
230 };
231 
232 void
233 usage(void)
234 {
235 	extern char *__progname;
236 
237 	fprintf(stderr,
238 "usage: %s [-AdeghmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
239 	"\t[-f file] [-i interface] [-K host | network]\n"
240 	"\t[-k host | network | label | id] [-o level] [-p device]\n"
241 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
242 	    __progname);
243 
244 	exit(1);
245 }
246 
247 int
248 pfctl_enable(int dev, int opts)
249 {
250 	if (ioctl(dev, DIOCSTART)) {
251 		if (errno == EEXIST)
252 			errx(1, "pf already enabled");
253 		else if (errno == ESRCH)
254 			errx(1, "pfil registeration failed");
255 		else
256 			err(1, "DIOCSTART");
257 	}
258 	if ((opts & PF_OPT_QUIET) == 0)
259 		fprintf(stderr, "pf enabled\n");
260 
261 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
262 		if (errno != EEXIST)
263 			err(1, "DIOCSTARTALTQ");
264 
265 	return (0);
266 }
267 
268 int
269 pfctl_disable(int dev, int opts)
270 {
271 	if (ioctl(dev, DIOCSTOP)) {
272 		if (errno == ENOENT)
273 			errx(1, "pf not enabled");
274 		else
275 			err(1, "DIOCSTOP");
276 	}
277 	if ((opts & PF_OPT_QUIET) == 0)
278 		fprintf(stderr, "pf disabled\n");
279 
280 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
281 			if (errno != ENOENT)
282 				err(1, "DIOCSTOPALTQ");
283 
284 	return (0);
285 }
286 
287 int
288 pfctl_clear_stats(int dev, int opts)
289 {
290 	if (ioctl(dev, DIOCCLRSTATUS))
291 		err(1, "DIOCCLRSTATUS");
292 	if ((opts & PF_OPT_QUIET) == 0)
293 		fprintf(stderr, "pf: statistics cleared\n");
294 	return (0);
295 }
296 
297 int
298 pfctl_clear_interface_flags(int dev, int opts)
299 {
300 	struct pfioc_iface	pi;
301 
302 	if ((opts & PF_OPT_NOACTION) == 0) {
303 		bzero(&pi, sizeof(pi));
304 		pi.pfiio_flags = PFI_IFLAG_SKIP;
305 
306 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
307 			err(1, "DIOCCLRIFFLAG");
308 		if ((opts & PF_OPT_QUIET) == 0)
309 			fprintf(stderr, "pf: interface flags reset\n");
310 	}
311 	return (0);
312 }
313 
314 int
315 pfctl_clear_rules(int dev, int opts, char *anchorname)
316 {
317 	struct pfr_buffer t;
318 
319 	memset(&t, 0, sizeof(t));
320 	t.pfrb_type = PFRB_TRANS;
321 	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
322 	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
323 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
324 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
325 		err(1, "pfctl_clear_rules");
326 	if ((opts & PF_OPT_QUIET) == 0)
327 		fprintf(stderr, "rules cleared\n");
328 	return (0);
329 }
330 
331 int
332 pfctl_clear_nat(int dev, int opts, char *anchorname)
333 {
334 	struct pfr_buffer t;
335 
336 	memset(&t, 0, sizeof(t));
337 	t.pfrb_type = PFRB_TRANS;
338 	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
339 	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
340 	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
341 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
342 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
343 		err(1, "pfctl_clear_nat");
344 	if ((opts & PF_OPT_QUIET) == 0)
345 		fprintf(stderr, "nat cleared\n");
346 	return (0);
347 }
348 
349 int
350 pfctl_clear_altq(int dev, int opts)
351 {
352 	struct pfr_buffer t;
353 
354 	if (!altqsupport)
355 		return (-1);
356 	memset(&t, 0, sizeof(t));
357 	t.pfrb_type = PFRB_TRANS;
358 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
359 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
360 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
361 		err(1, "pfctl_clear_altq");
362 	if ((opts & PF_OPT_QUIET) == 0)
363 		fprintf(stderr, "altq cleared\n");
364 	return (0);
365 }
366 
367 int
368 pfctl_clear_src_nodes(int dev, int opts)
369 {
370 	if (ioctl(dev, DIOCCLRSRCNODES))
371 		err(1, "DIOCCLRSRCNODES");
372 	if ((opts & PF_OPT_QUIET) == 0)
373 		fprintf(stderr, "source tracking entries cleared\n");
374 	return (0);
375 }
376 
377 int
378 pfctl_clear_states(int dev, const char *iface, int opts)
379 {
380 	struct pfioc_state_kill psk;
381 
382 	memset(&psk, 0, sizeof(psk));
383 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
384 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
385 		errx(1, "invalid interface: %s", iface);
386 
387 	if (ioctl(dev, DIOCCLRSTATES, &psk))
388 		err(1, "DIOCCLRSTATES");
389 	if ((opts & PF_OPT_QUIET) == 0)
390 		fprintf(stderr, "%d states cleared\n", psk.psk_killed);
391 	return (0);
392 }
393 
394 void
395 pfctl_addrprefix(char *addr, struct pf_addr *mask)
396 {
397 	char *p;
398 	const char *errstr;
399 	int prefix, ret_ga, q, r;
400 	struct addrinfo hints, *res;
401 
402 	if ((p = strchr(addr, '/')) == NULL)
403 		return;
404 
405 	*p++ = '\0';
406 	prefix = strtonum(p, 0, 128, &errstr);
407 	if (errstr)
408 		errx(1, "prefix is %s: %s", errstr, p);
409 
410 	bzero(&hints, sizeof(hints));
411 	/* prefix only with numeric addresses */
412 	hints.ai_flags |= AI_NUMERICHOST;
413 
414 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
415 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
416 		/* NOTREACHED */
417 	}
418 
419 	if (res->ai_family == AF_INET && prefix > 32)
420 		errx(1, "prefix too long for AF_INET");
421 	else if (res->ai_family == AF_INET6 && prefix > 128)
422 		errx(1, "prefix too long for AF_INET6");
423 
424 	q = prefix >> 3;
425 	r = prefix & 7;
426 	switch (res->ai_family) {
427 	case AF_INET:
428 		bzero(&mask->v4, sizeof(mask->v4));
429 		mask->v4.s_addr = htonl((u_int32_t)
430 		    (0xffffffffffULL << (32 - prefix)));
431 		break;
432 	case AF_INET6:
433 		bzero(&mask->v6, sizeof(mask->v6));
434 		if (q > 0)
435 			memset((void *)&mask->v6, 0xff, q);
436 		if (r > 0)
437 			*((u_char *)&mask->v6 + q) =
438 			    (0xff00 >> r) & 0xff;
439 		break;
440 	}
441 	freeaddrinfo(res);
442 }
443 
444 int
445 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
446 {
447 	struct pfioc_src_node_kill psnk;
448 	struct addrinfo *res[2], *resp[2];
449 	struct sockaddr last_src, last_dst;
450 	int killed, sources, dests;
451 	int ret_ga;
452 
453 	killed = sources = dests = 0;
454 
455 	memset(&psnk, 0, sizeof(psnk));
456 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
457 	    sizeof(psnk.psnk_src.addr.v.a.mask));
458 	memset(&last_src, 0xff, sizeof(last_src));
459 	memset(&last_dst, 0xff, sizeof(last_dst));
460 
461 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
462 
463 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
464 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
465 		/* NOTREACHED */
466 	}
467 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
468 		if (resp[0]->ai_addr == NULL)
469 			continue;
470 		/* We get lots of duplicates.  Catch the easy ones */
471 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
472 			continue;
473 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
474 
475 		psnk.psnk_af = resp[0]->ai_family;
476 		sources++;
477 
478 		if (psnk.psnk_af == AF_INET)
479 			psnk.psnk_src.addr.v.a.addr.v4 =
480 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
481 		else if (psnk.psnk_af == AF_INET6)
482 			psnk.psnk_src.addr.v.a.addr.v6 =
483 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
484 			    sin6_addr;
485 		else
486 			errx(1, "Unknown address family %d", psnk.psnk_af);
487 
488 		if (src_node_killers > 1) {
489 			dests = 0;
490 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
491 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
492 			memset(&last_dst, 0xff, sizeof(last_dst));
493 			pfctl_addrprefix(src_node_kill[1],
494 			    &psnk.psnk_dst.addr.v.a.mask);
495 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
496 			    &res[1]))) {
497 				errx(1, "getaddrinfo: %s",
498 				    gai_strerror(ret_ga));
499 				/* NOTREACHED */
500 			}
501 			for (resp[1] = res[1]; resp[1];
502 			    resp[1] = resp[1]->ai_next) {
503 				if (resp[1]->ai_addr == NULL)
504 					continue;
505 				if (psnk.psnk_af != resp[1]->ai_family)
506 					continue;
507 
508 				if (memcmp(&last_dst, resp[1]->ai_addr,
509 				    sizeof(last_dst)) == 0)
510 					continue;
511 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
512 
513 				dests++;
514 
515 				if (psnk.psnk_af == AF_INET)
516 					psnk.psnk_dst.addr.v.a.addr.v4 =
517 					    ((struct sockaddr_in *)resp[1]->
518 					    ai_addr)->sin_addr;
519 				else if (psnk.psnk_af == AF_INET6)
520 					psnk.psnk_dst.addr.v.a.addr.v6 =
521 					    ((struct sockaddr_in6 *)resp[1]->
522 					    ai_addr)->sin6_addr;
523 				else
524 					errx(1, "Unknown address family %d",
525 					    psnk.psnk_af);
526 
527 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
528 					err(1, "DIOCKILLSRCNODES");
529 				killed += psnk.psnk_killed;
530 			}
531 			freeaddrinfo(res[1]);
532 		} else {
533 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
534 				err(1, "DIOCKILLSRCNODES");
535 			killed += psnk.psnk_killed;
536 		}
537 	}
538 
539 	freeaddrinfo(res[0]);
540 
541 	if ((opts & PF_OPT_QUIET) == 0)
542 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
543 		    "destinations\n", killed, sources, dests);
544 	return (0);
545 }
546 
547 int
548 pfctl_net_kill_states(int dev, const char *iface, int opts)
549 {
550 	struct pfioc_state_kill psk;
551 	struct addrinfo *res[2], *resp[2];
552 	struct sockaddr last_src, last_dst;
553 	int killed, sources, dests;
554 	int ret_ga;
555 
556 	killed = sources = dests = 0;
557 
558 	memset(&psk, 0, sizeof(psk));
559 	memset(&psk.psk_src.addr.v.a.mask, 0xff,
560 	    sizeof(psk.psk_src.addr.v.a.mask));
561 	memset(&last_src, 0xff, sizeof(last_src));
562 	memset(&last_dst, 0xff, sizeof(last_dst));
563 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
564 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
565 		errx(1, "invalid interface: %s", iface);
566 
567 	pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
568 
569 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
570 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
571 		/* NOTREACHED */
572 	}
573 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
574 		if (resp[0]->ai_addr == NULL)
575 			continue;
576 		/* We get lots of duplicates.  Catch the easy ones */
577 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
578 			continue;
579 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
580 
581 		psk.psk_af = resp[0]->ai_family;
582 		sources++;
583 
584 		if (psk.psk_af == AF_INET)
585 			psk.psk_src.addr.v.a.addr.v4 =
586 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
587 		else if (psk.psk_af == AF_INET6)
588 			psk.psk_src.addr.v.a.addr.v6 =
589 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
590 			    sin6_addr;
591 		else
592 			errx(1, "Unknown address family %d", psk.psk_af);
593 
594 		if (state_killers > 1) {
595 			dests = 0;
596 			memset(&psk.psk_dst.addr.v.a.mask, 0xff,
597 			    sizeof(psk.psk_dst.addr.v.a.mask));
598 			memset(&last_dst, 0xff, sizeof(last_dst));
599 			pfctl_addrprefix(state_kill[1],
600 			    &psk.psk_dst.addr.v.a.mask);
601 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
602 			    &res[1]))) {
603 				errx(1, "getaddrinfo: %s",
604 				    gai_strerror(ret_ga));
605 				/* NOTREACHED */
606 			}
607 			for (resp[1] = res[1]; resp[1];
608 			    resp[1] = resp[1]->ai_next) {
609 				if (resp[1]->ai_addr == NULL)
610 					continue;
611 				if (psk.psk_af != resp[1]->ai_family)
612 					continue;
613 
614 				if (memcmp(&last_dst, resp[1]->ai_addr,
615 				    sizeof(last_dst)) == 0)
616 					continue;
617 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
618 
619 				dests++;
620 
621 				if (psk.psk_af == AF_INET)
622 					psk.psk_dst.addr.v.a.addr.v4 =
623 					    ((struct sockaddr_in *)resp[1]->
624 					    ai_addr)->sin_addr;
625 				else if (psk.psk_af == AF_INET6)
626 					psk.psk_dst.addr.v.a.addr.v6 =
627 					    ((struct sockaddr_in6 *)resp[1]->
628 					    ai_addr)->sin6_addr;
629 				else
630 					errx(1, "Unknown address family %d",
631 					    psk.psk_af);
632 
633 				if (ioctl(dev, DIOCKILLSTATES, &psk))
634 					err(1, "DIOCKILLSTATES");
635 				killed += psk.psk_killed;
636 			}
637 			freeaddrinfo(res[1]);
638 		} else {
639 			if (ioctl(dev, DIOCKILLSTATES, &psk))
640 				err(1, "DIOCKILLSTATES");
641 			killed += psk.psk_killed;
642 		}
643 	}
644 
645 	freeaddrinfo(res[0]);
646 
647 	if ((opts & PF_OPT_QUIET) == 0)
648 		fprintf(stderr, "killed %d states from %d sources and %d "
649 		    "destinations\n", killed, sources, dests);
650 	return (0);
651 }
652 
653 int
654 pfctl_label_kill_states(int dev, const char *iface, int opts)
655 {
656 	struct pfioc_state_kill psk;
657 
658 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
659 		warnx("no label specified");
660 		usage();
661 	}
662 	memset(&psk, 0, sizeof(psk));
663 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
664 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
665 		errx(1, "invalid interface: %s", iface);
666 
667 	if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
668 	    sizeof(psk.psk_label))
669 		errx(1, "label too long: %s", state_kill[1]);
670 
671 	if (ioctl(dev, DIOCKILLSTATES, &psk))
672 		err(1, "DIOCKILLSTATES");
673 
674 	if ((opts & PF_OPT_QUIET) == 0)
675 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
676 
677 	return (0);
678 }
679 
680 int
681 pfctl_id_kill_states(int dev, const char *iface, int opts)
682 {
683 	struct pfioc_state_kill psk;
684 
685 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
686 		warnx("no id specified");
687 		usage();
688 	}
689 
690 	memset(&psk, 0, sizeof(psk));
691 	if ((sscanf(state_kill[1], "%jx/%x",
692 	    &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
693 		HTONL(psk.psk_pfcmp.creatorid);
694 	else if ((sscanf(state_kill[1], "%jx", &psk.psk_pfcmp.id)) == 1) {
695 		psk.psk_pfcmp.creatorid = 0;
696 	} else {
697 		warnx("wrong id format specified");
698 		usage();
699 	}
700 	if (psk.psk_pfcmp.id == 0) {
701 		warnx("cannot kill id 0");
702 		usage();
703 	}
704 
705 	psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
706 	if (ioctl(dev, DIOCKILLSTATES, &psk))
707 		err(1, "DIOCKILLSTATES");
708 
709 	if ((opts & PF_OPT_QUIET) == 0)
710 		fprintf(stderr, "killed %d states\n", psk.psk_killed);
711 
712 	return (0);
713 }
714 
715 int
716 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
717     u_int32_t ticket, int r_action, char *anchorname)
718 {
719 	struct pfioc_pooladdr pp;
720 	struct pf_pooladdr *pa;
721 	u_int32_t pnr, mpnr;
722 
723 	memset(&pp, 0, sizeof(pp));
724 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
725 	pp.r_action = r_action;
726 	pp.r_num = nr;
727 	pp.ticket = ticket;
728 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
729 		warn("DIOCGETADDRS");
730 		return (-1);
731 	}
732 	mpnr = pp.nr;
733 	TAILQ_INIT(&pool->list);
734 	for (pnr = 0; pnr < mpnr; ++pnr) {
735 		pp.nr = pnr;
736 		if (ioctl(dev, DIOCGETADDR, &pp)) {
737 			warn("DIOCGETADDR");
738 			return (-1);
739 		}
740 		pa = calloc(1, sizeof(struct pf_pooladdr));
741 		if (pa == NULL)
742 			err(1, "calloc");
743 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
744 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
745 	}
746 
747 	return (0);
748 }
749 
750 void
751 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
752 {
753 	struct pf_pooladdr *pa;
754 
755 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
756 		TAILQ_REMOVE(&src->list, pa, entries);
757 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
758 	}
759 }
760 
761 void
762 pfctl_clear_pool(struct pf_pool *pool)
763 {
764 	struct pf_pooladdr *pa;
765 
766 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
767 		TAILQ_REMOVE(&pool->list, pa, entries);
768 		free(pa);
769 	}
770 }
771 
772 void
773 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
774 {
775 	if (opts & PF_OPT_DEBUG) {
776 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
777 		    "p", "sa", "sp", "da", "dp" };
778 		int i;
779 
780 		printf("  [ Skip steps: ");
781 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
782 			if (rule->skip[i].nr == rule->nr + 1)
783 				continue;
784 			printf("%s=", t[i]);
785 			if (rule->skip[i].nr == -1)
786 				printf("end ");
787 			else
788 				printf("%u ", rule->skip[i].nr);
789 		}
790 		printf("]\n");
791 
792 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
793 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
794 	}
795 	if (opts & PF_OPT_VERBOSE) {
796 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
797 			    "Bytes: %-10llu  States: %-6ju]\n",
798 			    (unsigned long long)rule->evaluations,
799 			    (unsigned long long)(rule->packets[0] +
800 			    rule->packets[1]),
801 			    (unsigned long long)(rule->bytes[0] +
802 			    rule->bytes[1]), (uintmax_t)rule->u_states_cur);
803 		if (!(opts & PF_OPT_DEBUG))
804 			printf("  [ Inserted: uid %u pid %u "
805 			    "State Creations: %-6ju]\n",
806 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
807 			    (uintmax_t)rule->u_states_tot);
808 	}
809 }
810 
811 void
812 pfctl_print_title(char *title)
813 {
814 	if (!first_title)
815 		printf("\n");
816 	first_title = 0;
817 	printf("%s\n", title);
818 }
819 
820 int
821 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
822     char *anchorname, int depth)
823 {
824 	struct pfioc_rule pr;
825 	u_int32_t nr, mnr, header = 0;
826 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
827 	int numeric = opts & PF_OPT_NUMERIC;
828 	int len = strlen(path);
829 	int brace;
830 	char *p;
831 
832 	if (path[0])
833 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
834 	else
835 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
836 
837 	memset(&pr, 0, sizeof(pr));
838 	memcpy(pr.anchor, path, sizeof(pr.anchor));
839 	if (opts & PF_OPT_SHOWALL) {
840 		pr.rule.action = PF_PASS;
841 		if (ioctl(dev, DIOCGETRULES, &pr)) {
842 			warn("DIOCGETRULES");
843 			goto error;
844 		}
845 		header++;
846 	}
847 	pr.rule.action = PF_SCRUB;
848 	if (ioctl(dev, DIOCGETRULES, &pr)) {
849 		warn("DIOCGETRULES");
850 		goto error;
851 	}
852 	if (opts & PF_OPT_SHOWALL) {
853 		if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
854 			pfctl_print_title("FILTER RULES:");
855 		else if (format == PFCTL_SHOW_LABELS && labels)
856 			pfctl_print_title("LABEL COUNTERS:");
857 	}
858 	mnr = pr.nr;
859 	if (opts & PF_OPT_CLRRULECTRS)
860 		pr.action = PF_GET_CLR_CNTR;
861 
862 	for (nr = 0; nr < mnr; ++nr) {
863 		pr.nr = nr;
864 		if (ioctl(dev, DIOCGETRULE, &pr)) {
865 			warn("DIOCGETRULE");
866 			goto error;
867 		}
868 
869 		if (pfctl_get_pool(dev, &pr.rule.rpool,
870 		    nr, pr.ticket, PF_SCRUB, path) != 0)
871 			goto error;
872 
873 		switch (format) {
874 		case PFCTL_SHOW_LABELS:
875 			break;
876 		case PFCTL_SHOW_RULES:
877 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
878 				labels = 1;
879 			print_rule(&pr.rule, pr.anchor_call, rule_numbers, numeric);
880 			printf("\n");
881 			pfctl_print_rule_counters(&pr.rule, opts);
882 			break;
883 		case PFCTL_SHOW_NOTHING:
884 			break;
885 		}
886 		pfctl_clear_pool(&pr.rule.rpool);
887 	}
888 	pr.rule.action = PF_PASS;
889 	if (ioctl(dev, DIOCGETRULES, &pr)) {
890 		warn("DIOCGETRULES");
891 		goto error;
892 	}
893 	mnr = pr.nr;
894 	for (nr = 0; nr < mnr; ++nr) {
895 		pr.nr = nr;
896 		if (ioctl(dev, DIOCGETRULE, &pr)) {
897 			warn("DIOCGETRULE");
898 			goto error;
899 		}
900 
901 		if (pfctl_get_pool(dev, &pr.rule.rpool,
902 		    nr, pr.ticket, PF_PASS, path) != 0)
903 			goto error;
904 
905 		switch (format) {
906 		case PFCTL_SHOW_LABELS:
907 			if (pr.rule.label[0]) {
908 				printf("%s %llu %llu %llu %llu"
909 				    " %llu %llu %llu %ju\n",
910 				    pr.rule.label,
911 				    (unsigned long long)pr.rule.evaluations,
912 				    (unsigned long long)(pr.rule.packets[0] +
913 				    pr.rule.packets[1]),
914 				    (unsigned long long)(pr.rule.bytes[0] +
915 				    pr.rule.bytes[1]),
916 				    (unsigned long long)pr.rule.packets[0],
917 				    (unsigned long long)pr.rule.bytes[0],
918 				    (unsigned long long)pr.rule.packets[1],
919 				    (unsigned long long)pr.rule.bytes[1],
920 				    (uintmax_t)pr.rule.u_states_tot);
921 			}
922 			break;
923 		case PFCTL_SHOW_RULES:
924 			brace = 0;
925 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
926 				labels = 1;
927 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
928 			if (pr.anchor_call[0] &&
929 			   ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
930 			   ((void *)p == (void *)pr.anchor_call ||
931 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
932 				brace++;
933 				if ((p = strrchr(pr.anchor_call, '/')) !=
934 				    NULL)
935 					p++;
936 				else
937 					p = &pr.anchor_call[0];
938 			} else
939 				p = &pr.anchor_call[0];
940 
941 			print_rule(&pr.rule, p, rule_numbers, numeric);
942 			if (brace)
943 				printf(" {\n");
944 			else
945 				printf("\n");
946 			pfctl_print_rule_counters(&pr.rule, opts);
947 			if (brace) {
948 				pfctl_show_rules(dev, path, opts, format,
949 				    p, depth + 1);
950 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
951 				printf("}\n");
952 			}
953 			break;
954 		case PFCTL_SHOW_NOTHING:
955 			break;
956 		}
957 		pfctl_clear_pool(&pr.rule.rpool);
958 	}
959 	path[len] = '\0';
960 	return (0);
961 
962  error:
963 	path[len] = '\0';
964 	return (-1);
965 }
966 
967 int
968 pfctl_show_nat(int dev, int opts, char *anchorname)
969 {
970 	struct pfioc_rule pr;
971 	u_int32_t mnr, nr;
972 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
973 	int i, dotitle = opts & PF_OPT_SHOWALL;
974 
975 	memset(&pr, 0, sizeof(pr));
976 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
977 	for (i = 0; i < 3; i++) {
978 		pr.rule.action = nattype[i];
979 		if (ioctl(dev, DIOCGETRULES, &pr)) {
980 			warn("DIOCGETRULES");
981 			return (-1);
982 		}
983 		mnr = pr.nr;
984 		for (nr = 0; nr < mnr; ++nr) {
985 			pr.nr = nr;
986 			if (ioctl(dev, DIOCGETRULE, &pr)) {
987 				warn("DIOCGETRULE");
988 				return (-1);
989 			}
990 			if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
991 			    pr.ticket, nattype[i], anchorname) != 0)
992 				return (-1);
993 			if (dotitle) {
994 				pfctl_print_title("TRANSLATION RULES:");
995 				dotitle = 0;
996 			}
997 			print_rule(&pr.rule, pr.anchor_call,
998 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
999 			printf("\n");
1000 			pfctl_print_rule_counters(&pr.rule, opts);
1001 			pfctl_clear_pool(&pr.rule.rpool);
1002 		}
1003 	}
1004 	return (0);
1005 }
1006 
1007 int
1008 pfctl_show_src_nodes(int dev, int opts)
1009 {
1010 	struct pfioc_src_nodes psn;
1011 	struct pf_src_node *p;
1012 	char *inbuf = NULL, *newinbuf = NULL;
1013 	unsigned int len = 0;
1014 	int i;
1015 
1016 	memset(&psn, 0, sizeof(psn));
1017 	for (;;) {
1018 		psn.psn_len = len;
1019 		if (len) {
1020 			newinbuf = realloc(inbuf, len);
1021 			if (newinbuf == NULL)
1022 				err(1, "realloc");
1023 			psn.psn_buf = inbuf = newinbuf;
1024 		}
1025 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1026 			warn("DIOCGETSRCNODES");
1027 			free(inbuf);
1028 			return (-1);
1029 		}
1030 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1031 			break;
1032 		if (len == 0 && psn.psn_len == 0)
1033 			goto done;
1034 		if (len == 0 && psn.psn_len != 0)
1035 			len = psn.psn_len;
1036 		if (psn.psn_len == 0)
1037 			goto done;	/* no src_nodes */
1038 		len *= 2;
1039 	}
1040 	p = psn.psn_src_nodes;
1041 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1042 		pfctl_print_title("SOURCE TRACKING NODES:");
1043 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1044 		print_src_node(p, opts);
1045 		p++;
1046 	}
1047 done:
1048 	free(inbuf);
1049 	return (0);
1050 }
1051 
1052 int
1053 pfctl_show_states(int dev, const char *iface, int opts)
1054 {
1055 	struct pfioc_states ps;
1056 	struct pfsync_state *p;
1057 	char *inbuf = NULL, *newinbuf = NULL;
1058 	unsigned int len = 0;
1059 	int i, dotitle = (opts & PF_OPT_SHOWALL);
1060 
1061 	memset(&ps, 0, sizeof(ps));
1062 	for (;;) {
1063 		ps.ps_len = len;
1064 		if (len) {
1065 			newinbuf = realloc(inbuf, len);
1066 			if (newinbuf == NULL)
1067 				err(1, "realloc");
1068 			ps.ps_buf = inbuf = newinbuf;
1069 		}
1070 		if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1071 			warn("DIOCGETSTATES");
1072 			free(inbuf);
1073 			return (-1);
1074 		}
1075 		if (ps.ps_len + sizeof(struct pfioc_states) < len)
1076 			break;
1077 		if (len == 0 && ps.ps_len == 0)
1078 			goto done;
1079 		if (len == 0 && ps.ps_len != 0)
1080 			len = ps.ps_len;
1081 		if (ps.ps_len == 0)
1082 			goto done;	/* no states */
1083 		len *= 2;
1084 	}
1085 	p = ps.ps_states;
1086 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1087 		if (iface != NULL && strcmp(p->ifname, iface))
1088 			continue;
1089 		if (dotitle) {
1090 			pfctl_print_title("STATES:");
1091 			dotitle = 0;
1092 		}
1093 		print_state(p, opts);
1094 	}
1095 done:
1096 	free(inbuf);
1097 	return (0);
1098 }
1099 
1100 int
1101 pfctl_show_status(int dev, int opts)
1102 {
1103 	struct pf_status status;
1104 
1105 	if (ioctl(dev, DIOCGETSTATUS, &status)) {
1106 		warn("DIOCGETSTATUS");
1107 		return (-1);
1108 	}
1109 	if (opts & PF_OPT_SHOWALL)
1110 		pfctl_print_title("INFO:");
1111 	print_status(&status, opts);
1112 	return (0);
1113 }
1114 
1115 int
1116 pfctl_show_timeouts(int dev, int opts)
1117 {
1118 	struct pfioc_tm pt;
1119 	int i;
1120 
1121 	if (opts & PF_OPT_SHOWALL)
1122 		pfctl_print_title("TIMEOUTS:");
1123 	memset(&pt, 0, sizeof(pt));
1124 	for (i = 0; pf_timeouts[i].name; i++) {
1125 		pt.timeout = pf_timeouts[i].timeout;
1126 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1127 			err(1, "DIOCGETTIMEOUT");
1128 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1129 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1130 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1131 			printf(" states");
1132 		else
1133 			printf("s");
1134 		printf("\n");
1135 	}
1136 	return (0);
1137 
1138 }
1139 
1140 int
1141 pfctl_show_limits(int dev, int opts)
1142 {
1143 	struct pfioc_limit pl;
1144 	int i;
1145 
1146 	if (opts & PF_OPT_SHOWALL)
1147 		pfctl_print_title("LIMITS:");
1148 	memset(&pl, 0, sizeof(pl));
1149 	for (i = 0; pf_limits[i].name; i++) {
1150 		pl.index = pf_limits[i].index;
1151 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1152 			err(1, "DIOCGETLIMIT");
1153 		printf("%-13s ", pf_limits[i].name);
1154 		if (pl.limit == UINT_MAX)
1155 			printf("unlimited\n");
1156 		else
1157 			printf("hard limit %8u\n", pl.limit);
1158 	}
1159 	return (0);
1160 }
1161 
1162 /* callbacks for rule/nat/rdr/addr */
1163 int
1164 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1165 {
1166 	struct pf_pooladdr *pa;
1167 
1168 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1169 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1170 			err(1, "DIOCBEGINADDRS");
1171 	}
1172 
1173 	pf->paddr.af = af;
1174 	TAILQ_FOREACH(pa, &p->list, entries) {
1175 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1176 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1177 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1178 				err(1, "DIOCADDADDR");
1179 		}
1180 	}
1181 	return (0);
1182 }
1183 
1184 int
1185 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1186 {
1187 	u_int8_t		rs_num;
1188 	struct pf_rule		*rule;
1189 	struct pf_ruleset	*rs;
1190 	char 			*p;
1191 
1192 	rs_num = pf_get_ruleset_number(r->action);
1193 	if (rs_num == PF_RULESET_MAX)
1194 		errx(1, "Invalid rule type %d", r->action);
1195 
1196 	rs = &pf->anchor->ruleset;
1197 
1198 	if (anchor_call[0] && r->anchor == NULL) {
1199 		/*
1200 		 * Don't make non-brace anchors part of the main anchor pool.
1201 		 */
1202 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1203 			err(1, "pfctl_add_rule: calloc");
1204 
1205 		pf_init_ruleset(&r->anchor->ruleset);
1206 		r->anchor->ruleset.anchor = r->anchor;
1207 		if (strlcpy(r->anchor->path, anchor_call,
1208 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1209 			errx(1, "pfctl_add_rule: strlcpy");
1210 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1211 			if (!strlen(p))
1212 				err(1, "pfctl_add_rule: bad anchor name %s",
1213 				    anchor_call);
1214 		} else
1215 			p = (char *)anchor_call;
1216 		if (strlcpy(r->anchor->name, p,
1217 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1218 			errx(1, "pfctl_add_rule: strlcpy");
1219 	}
1220 
1221 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1222 		err(1, "calloc");
1223 	bcopy(r, rule, sizeof(*rule));
1224 	TAILQ_INIT(&rule->rpool.list);
1225 	pfctl_move_pool(&r->rpool, &rule->rpool);
1226 
1227 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1228 	return (0);
1229 }
1230 
1231 int
1232 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1233 {
1234 	int osize = pf->trans->pfrb_size;
1235 
1236 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1237 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1238 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1239 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1240 			return (1);
1241 	}
1242 	if (a == pf->astack[0] && ((altqsupport &&
1243 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1244 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1245 			return (2);
1246 	}
1247 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1248 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1249 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1250 			return (3);
1251 	}
1252 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1253 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1254 			return (4);
1255 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1256 		return (5);
1257 
1258 	return (0);
1259 }
1260 
1261 int
1262 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1263     int rs_num, int depth)
1264 {
1265 	struct pf_rule *r;
1266 	int		error, len = strlen(path);
1267 	int		brace = 0;
1268 
1269 	pf->anchor = rs->anchor;
1270 
1271 	if (path[0])
1272 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1273 	else
1274 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1275 
1276 	if (depth) {
1277 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1278 			brace++;
1279 			if (pf->opts & PF_OPT_VERBOSE)
1280 				printf(" {\n");
1281 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1282 			    (error = pfctl_ruleset_trans(pf,
1283 			    path, rs->anchor))) {
1284 				printf("pfctl_load_rulesets: "
1285 				    "pfctl_ruleset_trans %d\n", error);
1286 				goto error;
1287 			}
1288 		} else if (pf->opts & PF_OPT_VERBOSE)
1289 			printf("\n");
1290 
1291 	}
1292 
1293 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1294 		pfctl_optimize_ruleset(pf, rs);
1295 
1296 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1297 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1298 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1299 			goto error;
1300 		if (r->anchor) {
1301 			if ((error = pfctl_load_ruleset(pf, path,
1302 			    &r->anchor->ruleset, rs_num, depth + 1)))
1303 				goto error;
1304 		} else if (pf->opts & PF_OPT_VERBOSE)
1305 			printf("\n");
1306 		free(r);
1307 	}
1308 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1309 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1310 		printf("}\n");
1311 	}
1312 	path[len] = '\0';
1313 	return (0);
1314 
1315  error:
1316 	path[len] = '\0';
1317 	return (error);
1318 
1319 }
1320 
1321 int
1322 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1323 {
1324 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1325 	char			*name;
1326 	struct pfioc_rule	pr;
1327 	int			len = strlen(path);
1328 
1329 	bzero(&pr, sizeof(pr));
1330 	/* set up anchor before adding to path for anchor_call */
1331 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1332 		pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1333 	if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1334 		errx(1, "pfctl_load_rule: strlcpy");
1335 
1336 	if (r->anchor) {
1337 		if (r->anchor->match) {
1338 			if (path[0])
1339 				snprintf(&path[len], MAXPATHLEN - len,
1340 				    "/%s", r->anchor->name);
1341 			else
1342 				snprintf(&path[len], MAXPATHLEN - len,
1343 				    "%s", r->anchor->name);
1344 			name = r->anchor->name;
1345 		} else
1346 			name = r->anchor->path;
1347 	} else
1348 		name = "";
1349 
1350 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1351 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1352 			return (1);
1353 		pr.pool_ticket = pf->paddr.ticket;
1354 		memcpy(&pr.rule, r, sizeof(pr.rule));
1355 		if (r->anchor && strlcpy(pr.anchor_call, name,
1356 		    sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1357 			errx(1, "pfctl_load_rule: strlcpy");
1358 		if (ioctl(pf->dev, DIOCADDRULE, &pr))
1359 			err(1, "DIOCADDRULE");
1360 	}
1361 
1362 	if (pf->opts & PF_OPT_VERBOSE) {
1363 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1364 		print_rule(r, r->anchor ? r->anchor->name : "",
1365 		    pf->opts & PF_OPT_VERBOSE2,
1366 		    pf->opts & PF_OPT_NUMERIC);
1367 	}
1368 	path[len] = '\0';
1369 	pfctl_clear_pool(&r->rpool);
1370 	return (0);
1371 }
1372 
1373 int
1374 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1375 {
1376 	if (altqsupport &&
1377 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1378 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1379 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1380 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1381 				if (errno == ENXIO)
1382 					errx(1, "qtype not configured");
1383 				else if (errno == ENODEV)
1384 					errx(1, "%s: driver does not support "
1385 					    "altq", a->ifname);
1386 				else
1387 					err(1, "DIOCADDALTQ");
1388 			}
1389 		}
1390 		pfaltq_store(&pf->paltq->altq);
1391 	}
1392 	return (0);
1393 }
1394 
1395 int
1396 pfctl_rules(int dev, char *filename, int opts, int optimize,
1397     char *anchorname, struct pfr_buffer *trans)
1398 {
1399 #define ERR(x) do { warn(x); goto _error; } while(0)
1400 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1401 
1402 	struct pfr_buffer	*t, buf;
1403 	struct pfioc_altq	 pa;
1404 	struct pfctl		 pf;
1405 	struct pf_ruleset	*rs;
1406 	struct pfr_table	 trs;
1407 	char			*path;
1408 	int			 osize;
1409 
1410 	RB_INIT(&pf_anchors);
1411 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1412 	pf_init_ruleset(&pf_main_anchor.ruleset);
1413 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1414 	if (trans == NULL) {
1415 		bzero(&buf, sizeof(buf));
1416 		buf.pfrb_type = PFRB_TRANS;
1417 		t = &buf;
1418 		osize = 0;
1419 	} else {
1420 		t = trans;
1421 		osize = t->pfrb_size;
1422 	}
1423 
1424 	memset(&pa, 0, sizeof(pa));
1425 	memset(&pf, 0, sizeof(pf));
1426 	memset(&trs, 0, sizeof(trs));
1427 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1428 		ERRX("pfctl_rules: calloc");
1429 	if (strlcpy(trs.pfrt_anchor, anchorname,
1430 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1431 		ERRX("pfctl_rules: strlcpy");
1432 	pf.dev = dev;
1433 	pf.opts = opts;
1434 	pf.optimize = optimize;
1435 	pf.loadopt = loadopt;
1436 
1437 	/* non-brace anchor, create without resolving the path */
1438 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1439 		ERRX("pfctl_rules: calloc");
1440 	rs = &pf.anchor->ruleset;
1441 	pf_init_ruleset(rs);
1442 	rs->anchor = pf.anchor;
1443 	if (strlcpy(pf.anchor->path, anchorname,
1444 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1445 		errx(1, "pfctl_add_rule: strlcpy");
1446 	if (strlcpy(pf.anchor->name, anchorname,
1447 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1448 		errx(1, "pfctl_add_rule: strlcpy");
1449 
1450 
1451 	pf.astack[0] = pf.anchor;
1452 	pf.asd = 0;
1453 	if (anchorname[0])
1454 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1455 	pf.paltq = &pa;
1456 	pf.trans = t;
1457 	pfctl_init_options(&pf);
1458 
1459 	if ((opts & PF_OPT_NOACTION) == 0) {
1460 		/*
1461 		 * XXX For the time being we need to open transactions for
1462 		 * the main ruleset before parsing, because tables are still
1463 		 * loaded at parse time.
1464 		 */
1465 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1466 			ERRX("pfctl_rules");
1467 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1468 			pa.ticket =
1469 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1470 		if (pf.loadopt & PFCTL_FLAG_TABLE)
1471 			pf.astack[0]->ruleset.tticket =
1472 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1473 	}
1474 
1475 	if (parse_config(filename, &pf) < 0) {
1476 		if ((opts & PF_OPT_NOACTION) == 0)
1477 			ERRX("Syntax error in config file: "
1478 			    "pf rules not loaded");
1479 		else
1480 			goto _error;
1481 	}
1482 
1483 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1484 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1485 	    (pf.loadopt & PFCTL_FLAG_NAT &&
1486 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1487 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1488 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1489 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
1490 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1491 		if ((opts & PF_OPT_NOACTION) == 0)
1492 			ERRX("Unable to load rules into kernel");
1493 		else
1494 			goto _error;
1495 	}
1496 
1497 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1498 		if (check_commit_altq(dev, opts) != 0)
1499 			ERRX("errors in altq config");
1500 
1501 	/* process "load anchor" directives */
1502 	if (!anchorname[0])
1503 		if (pfctl_load_anchors(dev, &pf, t) == -1)
1504 			ERRX("load anchors");
1505 
1506 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1507 		if (!anchorname[0])
1508 			if (pfctl_load_options(&pf))
1509 				goto _error;
1510 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1511 			ERR("DIOCXCOMMIT");
1512 	}
1513 	return (0);
1514 
1515 _error:
1516 	if (trans == NULL) {	/* main ruleset */
1517 		if ((opts & PF_OPT_NOACTION) == 0)
1518 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1519 				err(1, "DIOCXROLLBACK");
1520 		exit(1);
1521 	} else {		/* sub ruleset */
1522 		return (-1);
1523 	}
1524 
1525 #undef ERR
1526 #undef ERRX
1527 }
1528 
1529 FILE *
1530 pfctl_fopen(const char *name, const char *mode)
1531 {
1532 	struct stat	 st;
1533 	FILE		*fp;
1534 
1535 	fp = fopen(name, mode);
1536 	if (fp == NULL)
1537 		return (NULL);
1538 	if (fstat(fileno(fp), &st)) {
1539 		fclose(fp);
1540 		return (NULL);
1541 	}
1542 	if (S_ISDIR(st.st_mode)) {
1543 		fclose(fp);
1544 		errno = EISDIR;
1545 		return (NULL);
1546 	}
1547 	return (fp);
1548 }
1549 
1550 void
1551 pfctl_init_options(struct pfctl *pf)
1552 {
1553 
1554 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1555 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1556 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1557 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1558 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1559 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1560 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1561 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1562 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1563 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1564 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1565 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1566 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1567 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1568 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1569 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1570 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1571 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1572 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1573 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1574 
1575 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1576 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1577 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1578 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1579 
1580 	pf->debug = PF_DEBUG_URGENT;
1581 }
1582 
1583 int
1584 pfctl_load_options(struct pfctl *pf)
1585 {
1586 	int i, error = 0;
1587 
1588 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1589 		return (0);
1590 
1591 	/* load limits */
1592 	for (i = 0; i < PF_LIMIT_MAX; i++) {
1593 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1594 			continue;
1595 		if (pfctl_load_limit(pf, i, pf->limit[i]))
1596 			error = 1;
1597 	}
1598 
1599 	/*
1600 	 * If we've set the limit, but haven't explicitly set adaptive
1601 	 * timeouts, do it now with a start of 60% and end of 120%.
1602 	 */
1603 	if (pf->limit_set[PF_LIMIT_STATES] &&
1604 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1605 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1606 		pf->timeout[PFTM_ADAPTIVE_START] =
1607 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
1608 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1609 		pf->timeout[PFTM_ADAPTIVE_END] =
1610 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
1611 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1612 	}
1613 
1614 	/* load timeouts */
1615 	for (i = 0; i < PFTM_MAX; i++) {
1616 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1617 			continue;
1618 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1619 			error = 1;
1620 	}
1621 
1622 	/* load debug */
1623 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1624 		if (pfctl_load_debug(pf, pf->debug))
1625 			error = 1;
1626 
1627 	/* load logif */
1628 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1629 		if (pfctl_load_logif(pf, pf->ifname))
1630 			error = 1;
1631 
1632 	/* load hostid */
1633 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1634 		if (pfctl_load_hostid(pf, pf->hostid))
1635 			error = 1;
1636 
1637 	return (error);
1638 }
1639 
1640 int
1641 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1642 {
1643 	int i;
1644 
1645 
1646 	for (i = 0; pf_limits[i].name; i++) {
1647 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
1648 			pf->limit[pf_limits[i].index] = limit;
1649 			pf->limit_set[pf_limits[i].index] = 1;
1650 			break;
1651 		}
1652 	}
1653 	if (pf_limits[i].name == NULL) {
1654 		warnx("Bad pool name.");
1655 		return (1);
1656 	}
1657 
1658 	if (pf->opts & PF_OPT_VERBOSE)
1659 		printf("set limit %s %d\n", opt, limit);
1660 
1661 	return (0);
1662 }
1663 
1664 int
1665 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1666 {
1667 	struct pfioc_limit pl;
1668 
1669 	memset(&pl, 0, sizeof(pl));
1670 	pl.index = index;
1671 	pl.limit = limit;
1672 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1673 		if (errno == EBUSY)
1674 			warnx("Current pool size exceeds requested hard limit");
1675 		else
1676 			warnx("DIOCSETLIMIT");
1677 		return (1);
1678 	}
1679 	return (0);
1680 }
1681 
1682 int
1683 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1684 {
1685 	int i;
1686 
1687 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1688 		return (0);
1689 
1690 	for (i = 0; pf_timeouts[i].name; i++) {
1691 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1692 			pf->timeout[pf_timeouts[i].timeout] = seconds;
1693 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
1694 			break;
1695 		}
1696 	}
1697 
1698 	if (pf_timeouts[i].name == NULL) {
1699 		warnx("Bad timeout name.");
1700 		return (1);
1701 	}
1702 
1703 
1704 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1705 		printf("set timeout %s %d\n", opt, seconds);
1706 
1707 	return (0);
1708 }
1709 
1710 int
1711 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1712 {
1713 	struct pfioc_tm pt;
1714 
1715 	memset(&pt, 0, sizeof(pt));
1716 	pt.timeout = timeout;
1717 	pt.seconds = seconds;
1718 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1719 		warnx("DIOCSETTIMEOUT");
1720 		return (1);
1721 	}
1722 	return (0);
1723 }
1724 
1725 int
1726 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1727 {
1728 	const struct pf_hint *hint;
1729 	int i, r;
1730 
1731 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1732 		return (0);
1733 
1734 	for (i = 0; pf_hints[i].name; i++)
1735 		if (strcasecmp(opt, pf_hints[i].name) == 0)
1736 			break;
1737 
1738 	hint = pf_hints[i].hint;
1739 	if (hint == NULL) {
1740 		warnx("invalid state timeouts optimization");
1741 		return (1);
1742 	}
1743 
1744 	for (i = 0; hint[i].name; i++)
1745 		if ((r = pfctl_set_timeout(pf, hint[i].name,
1746 		    hint[i].timeout, 1)))
1747 			return (r);
1748 
1749 	if (pf->opts & PF_OPT_VERBOSE)
1750 		printf("set optimization %s\n", opt);
1751 
1752 	return (0);
1753 }
1754 
1755 int
1756 pfctl_set_logif(struct pfctl *pf, char *ifname)
1757 {
1758 
1759 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1760 		return (0);
1761 
1762 	if (!strcmp(ifname, "none")) {
1763 		free(pf->ifname);
1764 		pf->ifname = NULL;
1765 	} else {
1766 		pf->ifname = strdup(ifname);
1767 		if (!pf->ifname)
1768 			errx(1, "pfctl_set_logif: strdup");
1769 	}
1770 	pf->ifname_set = 1;
1771 
1772 	if (pf->opts & PF_OPT_VERBOSE)
1773 		printf("set loginterface %s\n", ifname);
1774 
1775 	return (0);
1776 }
1777 
1778 int
1779 pfctl_load_logif(struct pfctl *pf, char *ifname)
1780 {
1781 	struct pfioc_if pi;
1782 
1783 	memset(&pi, 0, sizeof(pi));
1784 	if (ifname && strlcpy(pi.ifname, ifname,
1785 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1786 		warnx("pfctl_load_logif: strlcpy");
1787 		return (1);
1788 	}
1789 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1790 		warnx("DIOCSETSTATUSIF");
1791 		return (1);
1792 	}
1793 	return (0);
1794 }
1795 
1796 int
1797 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1798 {
1799 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1800 		return (0);
1801 
1802 	HTONL(hostid);
1803 
1804 	pf->hostid = hostid;
1805 	pf->hostid_set = 1;
1806 
1807 	if (pf->opts & PF_OPT_VERBOSE)
1808 		printf("set hostid 0x%08x\n", ntohl(hostid));
1809 
1810 	return (0);
1811 }
1812 
1813 int
1814 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
1815 {
1816 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
1817 		warnx("DIOCSETHOSTID");
1818 		return (1);
1819 	}
1820 	return (0);
1821 }
1822 
1823 int
1824 pfctl_set_debug(struct pfctl *pf, char *d)
1825 {
1826 	u_int32_t	level;
1827 
1828 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1829 		return (0);
1830 
1831 	if (!strcmp(d, "none"))
1832 		pf->debug = PF_DEBUG_NONE;
1833 	else if (!strcmp(d, "urgent"))
1834 		pf->debug = PF_DEBUG_URGENT;
1835 	else if (!strcmp(d, "misc"))
1836 		pf->debug = PF_DEBUG_MISC;
1837 	else if (!strcmp(d, "loud"))
1838 		pf->debug = PF_DEBUG_NOISY;
1839 	else {
1840 		warnx("unknown debug level \"%s\"", d);
1841 		return (-1);
1842 	}
1843 
1844 	pf->debug_set = 1;
1845 	level = pf->debug;
1846 
1847 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1848 		if (ioctl(dev, DIOCSETDEBUG, &level))
1849 			err(1, "DIOCSETDEBUG");
1850 
1851 	if (pf->opts & PF_OPT_VERBOSE)
1852 		printf("set debug %s\n", d);
1853 
1854 	return (0);
1855 }
1856 
1857 int
1858 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1859 {
1860 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1861 		warnx("DIOCSETDEBUG");
1862 		return (1);
1863 	}
1864 	return (0);
1865 }
1866 
1867 int
1868 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1869 {
1870 	struct pfioc_iface	pi;
1871 
1872 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1873 		return (0);
1874 
1875 	bzero(&pi, sizeof(pi));
1876 
1877 	pi.pfiio_flags = flags;
1878 
1879 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1880 	    sizeof(pi.pfiio_name))
1881 		errx(1, "pfctl_set_interface_flags: strlcpy");
1882 
1883 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1884 		if (how == 0) {
1885 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1886 				err(1, "DIOCCLRIFFLAG");
1887 		} else {
1888 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1889 				err(1, "DIOCSETIFFLAG");
1890 		}
1891 	}
1892 	return (0);
1893 }
1894 
1895 void
1896 pfctl_debug(int dev, u_int32_t level, int opts)
1897 {
1898 	if (ioctl(dev, DIOCSETDEBUG, &level))
1899 		err(1, "DIOCSETDEBUG");
1900 	if ((opts & PF_OPT_QUIET) == 0) {
1901 		fprintf(stderr, "debug level set to '");
1902 		switch (level) {
1903 		case PF_DEBUG_NONE:
1904 			fprintf(stderr, "none");
1905 			break;
1906 		case PF_DEBUG_URGENT:
1907 			fprintf(stderr, "urgent");
1908 			break;
1909 		case PF_DEBUG_MISC:
1910 			fprintf(stderr, "misc");
1911 			break;
1912 		case PF_DEBUG_NOISY:
1913 			fprintf(stderr, "loud");
1914 			break;
1915 		default:
1916 			fprintf(stderr, "<invalid>");
1917 			break;
1918 		}
1919 		fprintf(stderr, "'\n");
1920 	}
1921 }
1922 
1923 int
1924 pfctl_test_altqsupport(int dev, int opts)
1925 {
1926 	struct pfioc_altq pa;
1927 
1928 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
1929 		if (errno == ENODEV) {
1930 			if (opts & PF_OPT_VERBOSE)
1931 				fprintf(stderr, "No ALTQ support in kernel\n"
1932 				    "ALTQ related functions disabled\n");
1933 			return (0);
1934 		} else
1935 			err(1, "DIOCGETALTQS");
1936 	}
1937 	return (1);
1938 }
1939 
1940 int
1941 pfctl_show_anchors(int dev, int opts, char *anchorname)
1942 {
1943 	struct pfioc_ruleset	 pr;
1944 	u_int32_t		 mnr, nr;
1945 
1946 	memset(&pr, 0, sizeof(pr));
1947 	memcpy(pr.path, anchorname, sizeof(pr.path));
1948 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1949 		if (errno == EINVAL)
1950 			fprintf(stderr, "Anchor '%s' not found.\n",
1951 			    anchorname);
1952 		else
1953 			err(1, "DIOCGETRULESETS");
1954 		return (-1);
1955 	}
1956 	mnr = pr.nr;
1957 	for (nr = 0; nr < mnr; ++nr) {
1958 		char sub[MAXPATHLEN];
1959 
1960 		pr.nr = nr;
1961 		if (ioctl(dev, DIOCGETRULESET, &pr))
1962 			err(1, "DIOCGETRULESET");
1963 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1964 			continue;
1965 		sub[0] = 0;
1966 		if (pr.path[0]) {
1967 			strlcat(sub, pr.path, sizeof(sub));
1968 			strlcat(sub, "/", sizeof(sub));
1969 		}
1970 		strlcat(sub, pr.name, sizeof(sub));
1971 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1972 			printf("  %s\n", sub);
1973 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1974 			return (-1);
1975 	}
1976 	return (0);
1977 }
1978 
1979 const char *
1980 pfctl_lookup_option(char *cmd, const char * const *list)
1981 {
1982 	if (cmd != NULL && *cmd)
1983 		for (; *list; list++)
1984 			if (!strncmp(cmd, *list, strlen(cmd)))
1985 				return (*list);
1986 	return (NULL);
1987 }
1988 
1989 int
1990 main(int argc, char *argv[])
1991 {
1992 	int	 error = 0;
1993 	int	 ch;
1994 	int	 mode = O_RDONLY;
1995 	int	 opts = 0;
1996 	int	 optimize = PF_OPTIMIZE_BASIC;
1997 	char	 anchorname[MAXPATHLEN];
1998 	char	*path;
1999 
2000 	if (argc < 2)
2001 		usage();
2002 
2003 	while ((ch = getopt(argc, argv,
2004 	    "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2005 		switch (ch) {
2006 		case 'a':
2007 			anchoropt = optarg;
2008 			break;
2009 		case 'd':
2010 			opts |= PF_OPT_DISABLE;
2011 			mode = O_RDWR;
2012 			break;
2013 		case 'D':
2014 			if (pfctl_cmdline_symset(optarg) < 0)
2015 				warnx("could not parse macro definition %s",
2016 				    optarg);
2017 			break;
2018 		case 'e':
2019 			opts |= PF_OPT_ENABLE;
2020 			mode = O_RDWR;
2021 			break;
2022 		case 'q':
2023 			opts |= PF_OPT_QUIET;
2024 			break;
2025 		case 'F':
2026 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2027 			if (clearopt == NULL) {
2028 				warnx("Unknown flush modifier '%s'", optarg);
2029 				usage();
2030 			}
2031 			mode = O_RDWR;
2032 			break;
2033 		case 'i':
2034 			ifaceopt = optarg;
2035 			break;
2036 		case 'k':
2037 			if (state_killers >= 2) {
2038 				warnx("can only specify -k twice");
2039 				usage();
2040 				/* NOTREACHED */
2041 			}
2042 			state_kill[state_killers++] = optarg;
2043 			mode = O_RDWR;
2044 			break;
2045 		case 'K':
2046 			if (src_node_killers >= 2) {
2047 				warnx("can only specify -K twice");
2048 				usage();
2049 				/* NOTREACHED */
2050 			}
2051 			src_node_kill[src_node_killers++] = optarg;
2052 			mode = O_RDWR;
2053 			break;
2054 		case 'm':
2055 			opts |= PF_OPT_MERGE;
2056 			break;
2057 		case 'n':
2058 			opts |= PF_OPT_NOACTION;
2059 			break;
2060 		case 'N':
2061 			loadopt |= PFCTL_FLAG_NAT;
2062 			break;
2063 		case 'r':
2064 			opts |= PF_OPT_USEDNS;
2065 			break;
2066 		case 'f':
2067 			rulesopt = optarg;
2068 			mode = O_RDWR;
2069 			break;
2070 		case 'g':
2071 			opts |= PF_OPT_DEBUG;
2072 			break;
2073 		case 'A':
2074 			loadopt |= PFCTL_FLAG_ALTQ;
2075 			break;
2076 		case 'R':
2077 			loadopt |= PFCTL_FLAG_FILTER;
2078 			break;
2079 		case 'o':
2080 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2081 			if (optiopt == NULL) {
2082 				warnx("Unknown optimization '%s'", optarg);
2083 				usage();
2084 			}
2085 			opts |= PF_OPT_OPTIMIZE;
2086 			break;
2087 		case 'O':
2088 			loadopt |= PFCTL_FLAG_OPTION;
2089 			break;
2090 		case 'p':
2091 			pf_device = optarg;
2092 			break;
2093 		case 'P':
2094 			opts |= PF_OPT_NUMERIC;
2095 			break;
2096 		case 's':
2097 			showopt = pfctl_lookup_option(optarg, showopt_list);
2098 			if (showopt == NULL) {
2099 				warnx("Unknown show modifier '%s'", optarg);
2100 				usage();
2101 			}
2102 			break;
2103 		case 't':
2104 			tableopt = optarg;
2105 			break;
2106 		case 'T':
2107 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2108 			if (tblcmdopt == NULL) {
2109 				warnx("Unknown table command '%s'", optarg);
2110 				usage();
2111 			}
2112 			break;
2113 		case 'v':
2114 			if (opts & PF_OPT_VERBOSE)
2115 				opts |= PF_OPT_VERBOSE2;
2116 			opts |= PF_OPT_VERBOSE;
2117 			break;
2118 		case 'x':
2119 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2120 			if (debugopt == NULL) {
2121 				warnx("Unknown debug level '%s'", optarg);
2122 				usage();
2123 			}
2124 			mode = O_RDWR;
2125 			break;
2126 		case 'z':
2127 			opts |= PF_OPT_CLRRULECTRS;
2128 			mode = O_RDWR;
2129 			break;
2130 		case 'h':
2131 			/* FALLTHROUGH */
2132 		default:
2133 			usage();
2134 			/* NOTREACHED */
2135 		}
2136 	}
2137 
2138 	if (tblcmdopt != NULL) {
2139 		argc -= optind;
2140 		argv += optind;
2141 		ch = *tblcmdopt;
2142 		if (ch == 'l') {
2143 			loadopt |= PFCTL_FLAG_TABLE;
2144 			tblcmdopt = NULL;
2145 		} else
2146 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2147 	} else if (argc != optind) {
2148 		warnx("unknown command line argument: %s ...", argv[optind]);
2149 		usage();
2150 		/* NOTREACHED */
2151 	}
2152 	if (loadopt == 0)
2153 		loadopt = ~0;
2154 
2155 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2156 		errx(1, "pfctl: calloc");
2157 	memset(anchorname, 0, sizeof(anchorname));
2158 	if (anchoropt != NULL) {
2159 		int len = strlen(anchoropt);
2160 
2161 		if (anchoropt[len - 1] == '*') {
2162 			if (len >= 2 && anchoropt[len - 2] == '/')
2163 				anchoropt[len - 2] = '\0';
2164 			else
2165 				anchoropt[len - 1] = '\0';
2166 			opts |= PF_OPT_RECURSE;
2167 		}
2168 		if (strlcpy(anchorname, anchoropt,
2169 		    sizeof(anchorname)) >= sizeof(anchorname))
2170 			errx(1, "anchor name '%s' too long",
2171 			    anchoropt);
2172 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2173 	}
2174 
2175 	if ((opts & PF_OPT_NOACTION) == 0) {
2176 		dev = open(pf_device, mode);
2177 		if (dev == -1)
2178 			err(1, "%s", pf_device);
2179 		altqsupport = pfctl_test_altqsupport(dev, opts);
2180 	} else {
2181 		dev = open(pf_device, O_RDONLY);
2182 		if (dev >= 0)
2183 			opts |= PF_OPT_DUMMYACTION;
2184 		/* turn off options */
2185 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2186 		clearopt = showopt = debugopt = NULL;
2187 #if !defined(ENABLE_ALTQ)
2188 		altqsupport = 0;
2189 #else
2190 		altqsupport = 1;
2191 #endif
2192 	}
2193 
2194 	if (opts & PF_OPT_DISABLE)
2195 		if (pfctl_disable(dev, opts))
2196 			error = 1;
2197 
2198 	if (showopt != NULL) {
2199 		switch (*showopt) {
2200 		case 'A':
2201 			pfctl_show_anchors(dev, opts, anchorname);
2202 			break;
2203 		case 'r':
2204 			pfctl_load_fingerprints(dev, opts);
2205 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2206 			    anchorname, 0);
2207 			break;
2208 		case 'l':
2209 			pfctl_load_fingerprints(dev, opts);
2210 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2211 			    anchorname, 0);
2212 			break;
2213 		case 'n':
2214 			pfctl_load_fingerprints(dev, opts);
2215 			pfctl_show_nat(dev, opts, anchorname);
2216 			break;
2217 		case 'q':
2218 			pfctl_show_altq(dev, ifaceopt, opts,
2219 			    opts & PF_OPT_VERBOSE2);
2220 			break;
2221 		case 's':
2222 			pfctl_show_states(dev, ifaceopt, opts);
2223 			break;
2224 		case 'S':
2225 			pfctl_show_src_nodes(dev, opts);
2226 			break;
2227 		case 'i':
2228 			pfctl_show_status(dev, opts);
2229 			break;
2230 		case 't':
2231 			pfctl_show_timeouts(dev, opts);
2232 			break;
2233 		case 'm':
2234 			pfctl_show_limits(dev, opts);
2235 			break;
2236 		case 'a':
2237 			opts |= PF_OPT_SHOWALL;
2238 			pfctl_load_fingerprints(dev, opts);
2239 
2240 			pfctl_show_nat(dev, opts, anchorname);
2241 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2242 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2243 			pfctl_show_states(dev, ifaceopt, opts);
2244 			pfctl_show_src_nodes(dev, opts);
2245 			pfctl_show_status(dev, opts);
2246 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2247 			pfctl_show_timeouts(dev, opts);
2248 			pfctl_show_limits(dev, opts);
2249 			pfctl_show_tables(anchorname, opts);
2250 			pfctl_show_fingerprints(opts);
2251 			break;
2252 		case 'T':
2253 			pfctl_show_tables(anchorname, opts);
2254 			break;
2255 		case 'o':
2256 			pfctl_load_fingerprints(dev, opts);
2257 			pfctl_show_fingerprints(opts);
2258 			break;
2259 		case 'I':
2260 			pfctl_show_ifaces(ifaceopt, opts);
2261 			break;
2262 		}
2263 	}
2264 
2265 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2266 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2267 		    anchorname, 0);
2268 
2269 	if (clearopt != NULL) {
2270 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2271 			errx(1, "anchor names beginning with '_' cannot "
2272 			    "be modified from the command line");
2273 
2274 		switch (*clearopt) {
2275 		case 'r':
2276 			pfctl_clear_rules(dev, opts, anchorname);
2277 			break;
2278 		case 'n':
2279 			pfctl_clear_nat(dev, opts, anchorname);
2280 			break;
2281 		case 'q':
2282 			pfctl_clear_altq(dev, opts);
2283 			break;
2284 		case 's':
2285 			pfctl_clear_states(dev, ifaceopt, opts);
2286 			break;
2287 		case 'S':
2288 			pfctl_clear_src_nodes(dev, opts);
2289 			break;
2290 		case 'i':
2291 			pfctl_clear_stats(dev, opts);
2292 			break;
2293 		case 'a':
2294 			pfctl_clear_rules(dev, opts, anchorname);
2295 			pfctl_clear_nat(dev, opts, anchorname);
2296 			pfctl_clear_tables(anchorname, opts);
2297 			if (!*anchorname) {
2298 				pfctl_clear_altq(dev, opts);
2299 				pfctl_clear_states(dev, ifaceopt, opts);
2300 				pfctl_clear_src_nodes(dev, opts);
2301 				pfctl_clear_stats(dev, opts);
2302 				pfctl_clear_fingerprints(dev, opts);
2303 				pfctl_clear_interface_flags(dev, opts);
2304 			}
2305 			break;
2306 		case 'o':
2307 			pfctl_clear_fingerprints(dev, opts);
2308 			break;
2309 		case 'T':
2310 			pfctl_clear_tables(anchorname, opts);
2311 			break;
2312 		}
2313 	}
2314 	if (state_killers) {
2315 		if (!strcmp(state_kill[0], "label"))
2316 			pfctl_label_kill_states(dev, ifaceopt, opts);
2317 		else if (!strcmp(state_kill[0], "id"))
2318 			pfctl_id_kill_states(dev, ifaceopt, opts);
2319 		else
2320 			pfctl_net_kill_states(dev, ifaceopt, opts);
2321 	}
2322 
2323 	if (src_node_killers)
2324 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
2325 
2326 	if (tblcmdopt != NULL) {
2327 		error = pfctl_command_tables(argc, argv, tableopt,
2328 		    tblcmdopt, rulesopt, anchorname, opts);
2329 		rulesopt = NULL;
2330 	}
2331 	if (optiopt != NULL) {
2332 		switch (*optiopt) {
2333 		case 'n':
2334 			optimize = 0;
2335 			break;
2336 		case 'b':
2337 			optimize |= PF_OPTIMIZE_BASIC;
2338 			break;
2339 		case 'o':
2340 		case 'p':
2341 			optimize |= PF_OPTIMIZE_PROFILE;
2342 			break;
2343 		}
2344 	}
2345 
2346 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2347 	    !anchorname[0])
2348 		if (pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET))
2349 			error = 1;
2350 
2351 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2352 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2353 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2354 			error = 1;
2355 
2356 	if (rulesopt != NULL) {
2357 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2358 			errx(1, "anchor names beginning with '_' cannot "
2359 			    "be modified from the command line");
2360 		if (pfctl_rules(dev, rulesopt, opts, optimize,
2361 		    anchorname, NULL))
2362 			error = 1;
2363 		else if (!(opts & PF_OPT_NOACTION) &&
2364 		    (loadopt & PFCTL_FLAG_TABLE))
2365 			warn_namespace_collision(NULL);
2366 	}
2367 
2368 	if (opts & PF_OPT_ENABLE)
2369 		if (pfctl_enable(dev, opts))
2370 			error = 1;
2371 
2372 	if (debugopt != NULL) {
2373 		switch (*debugopt) {
2374 		case 'n':
2375 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
2376 			break;
2377 		case 'u':
2378 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2379 			break;
2380 		case 'm':
2381 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
2382 			break;
2383 		case 'l':
2384 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2385 			break;
2386 		}
2387 	}
2388 
2389 	exit(error);
2390 }
2391