xref: /freebsd/sbin/pfctl/pfctl.c (revision e0c4386e7e71d93b0edc0c8fa156263fc4a8b0b6)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 #define PFIOC_USE_LATEST
38 
39 #include <sys/types.h>
40 #include <sys/ioctl.h>
41 #include <sys/socket.h>
42 #include <sys/stat.h>
43 #include <sys/endian.h>
44 
45 #include <net/if.h>
46 #include <netinet/in.h>
47 #include <net/pfvar.h>
48 #include <arpa/inet.h>
49 #include <net/altq/altq.h>
50 
51 #include <err.h>
52 #include <errno.h>
53 #include <fcntl.h>
54 #include <libpfctl.h>
55 #include <limits.h>
56 #include <netdb.h>
57 #include <stdint.h>
58 #include <stdio.h>
59 #include <stdlib.h>
60 #include <string.h>
61 #include <unistd.h>
62 
63 #include "pfctl_parser.h"
64 #include "pfctl.h"
65 
66 void	 usage(void);
67 int	 pfctl_enable(int, int);
68 int	 pfctl_disable(int, int);
69 int	 pfctl_clear_stats(int, int);
70 int	 pfctl_get_skip_ifaces(void);
71 int	 pfctl_check_skip_ifaces(char *);
72 int	 pfctl_adjust_skip_ifaces(struct pfctl *);
73 int	 pfctl_clear_interface_flags(int, int);
74 int	 pfctl_flush_eth_rules(int, int, char *);
75 int	 pfctl_flush_rules(int, int, char *);
76 int	 pfctl_flush_nat(int, int, char *);
77 int	 pfctl_clear_altq(int, int);
78 int	 pfctl_clear_src_nodes(int, int);
79 int	 pfctl_clear_iface_states(int, const char *, int);
80 void	 pfctl_addrprefix(char *, struct pf_addr *);
81 int	 pfctl_kill_src_nodes(int, const char *, int);
82 int	 pfctl_net_kill_states(int, const char *, int);
83 int	 pfctl_gateway_kill_states(int, const char *, int);
84 int	 pfctl_label_kill_states(int, const char *, int);
85 int	 pfctl_id_kill_states(int, const char *, int);
86 void	 pfctl_init_options(struct pfctl *);
87 int	 pfctl_load_options(struct pfctl *);
88 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
89 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
90 int	 pfctl_load_debug(struct pfctl *, unsigned int);
91 int	 pfctl_load_logif(struct pfctl *, char *);
92 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
93 int	 pfctl_load_reassembly(struct pfctl *, u_int32_t);
94 int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
95 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
96 	    char *);
97 void	 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *, int);
98 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
99 int	 pfctl_show_eth_rules(int, char *, int, enum pfctl_show, char *, int, int);
100 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int, int);
101 int	 pfctl_show_nat(int, char *, int, char *, int);
102 int	 pfctl_show_src_nodes(int, int);
103 int	 pfctl_show_states(int, const char *, int);
104 int	 pfctl_show_status(int, int);
105 int	 pfctl_show_running(int);
106 int	 pfctl_show_timeouts(int, int);
107 int	 pfctl_show_limits(int, int);
108 void	 pfctl_debug(int, u_int32_t, int);
109 int	 pfctl_test_altqsupport(int, int);
110 int	 pfctl_show_anchors(int, int, char *);
111 int	 pfctl_show_eth_anchors(int, int, char *);
112 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *, bool);
113 int	 pfctl_eth_ruleset_trans(struct pfctl *, char *,
114 	    struct pfctl_eth_anchor *);
115 int	 pfctl_load_eth_ruleset(struct pfctl *, char *,
116 	    struct pfctl_eth_ruleset *, int);
117 int	 pfctl_load_eth_rule(struct pfctl *, char *, struct pfctl_eth_rule *,
118 	    int);
119 int	 pfctl_load_ruleset(struct pfctl *, char *,
120 		struct pfctl_ruleset *, int, int);
121 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
122 const char	*pfctl_lookup_option(char *, const char * const *);
123 
124 static struct pfctl_anchor_global	 pf_anchors;
125 struct pfctl_anchor	 pf_main_anchor;
126 struct pfctl_eth_anchor	 pf_eth_main_anchor;
127 static struct pfr_buffer skip_b;
128 
129 static const char	*clearopt;
130 static char		*rulesopt;
131 static const char	*showopt;
132 static const char	*debugopt;
133 static char		*anchoropt;
134 static const char	*optiopt = NULL;
135 static const char	*pf_device = PF_DEVICE;
136 static char		*ifaceopt;
137 static char		*tableopt;
138 static const char	*tblcmdopt;
139 static int		 src_node_killers;
140 static char		*src_node_kill[2];
141 static int		 state_killers;
142 static char		*state_kill[2];
143 int			 loadopt;
144 int			 altqsupport;
145 
146 int			 dev = -1;
147 struct pfctl_handle	*pfh = NULL;
148 static int		 first_title = 1;
149 static int		 labels = 0;
150 
151 #define INDENT(d, o)	do {						\
152 				if (o) {				\
153 					int i;				\
154 					for (i=0; i < d; i++)		\
155 						printf("  ");		\
156 				}					\
157 			} while (0);					\
158 
159 
160 static const struct {
161 	const char	*name;
162 	int		index;
163 } pf_limits[] = {
164 	{ "states",		PF_LIMIT_STATES },
165 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
166 	{ "frags",		PF_LIMIT_FRAGS },
167 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
168 	{ NULL,			0 }
169 };
170 
171 struct pf_hint {
172 	const char	*name;
173 	int		timeout;
174 };
175 static const struct pf_hint pf_hint_normal[] = {
176 	{ "tcp.first",		2 * 60 },
177 	{ "tcp.opening",	30 },
178 	{ "tcp.established",	24 * 60 * 60 },
179 	{ "tcp.closing",	15 * 60 },
180 	{ "tcp.finwait",	45 },
181 	{ "tcp.closed",		90 },
182 	{ "tcp.tsdiff",		30 },
183 	{ NULL,			0 }
184 };
185 static const struct pf_hint pf_hint_satellite[] = {
186 	{ "tcp.first",		3 * 60 },
187 	{ "tcp.opening",	30 + 5 },
188 	{ "tcp.established",	24 * 60 * 60 },
189 	{ "tcp.closing",	15 * 60 + 5 },
190 	{ "tcp.finwait",	45 + 5 },
191 	{ "tcp.closed",		90 + 5 },
192 	{ "tcp.tsdiff",		60 },
193 	{ NULL,			0 }
194 };
195 static const struct pf_hint pf_hint_conservative[] = {
196 	{ "tcp.first",		60 * 60 },
197 	{ "tcp.opening",	15 * 60 },
198 	{ "tcp.established",	5 * 24 * 60 * 60 },
199 	{ "tcp.closing",	60 * 60 },
200 	{ "tcp.finwait",	10 * 60 },
201 	{ "tcp.closed",		3 * 60 },
202 	{ "tcp.tsdiff",		60 },
203 	{ NULL,			0 }
204 };
205 static const struct pf_hint pf_hint_aggressive[] = {
206 	{ "tcp.first",		30 },
207 	{ "tcp.opening",	5 },
208 	{ "tcp.established",	5 * 60 * 60 },
209 	{ "tcp.closing",	60 },
210 	{ "tcp.finwait",	30 },
211 	{ "tcp.closed",		30 },
212 	{ "tcp.tsdiff",		10 },
213 	{ NULL,			0 }
214 };
215 
216 static const struct {
217 	const char *name;
218 	const struct pf_hint *hint;
219 } pf_hints[] = {
220 	{ "normal",		pf_hint_normal },
221 	{ "satellite",		pf_hint_satellite },
222 	{ "high-latency",	pf_hint_satellite },
223 	{ "conservative",	pf_hint_conservative },
224 	{ "aggressive",		pf_hint_aggressive },
225 	{ NULL,			NULL }
226 };
227 
228 static const char * const clearopt_list[] = {
229 	"nat", "queue", "rules", "Sources",
230 	"states", "info", "Tables", "osfp", "all",
231 	"ethernet", NULL
232 };
233 
234 static const char * const showopt_list[] = {
235 	"ether", "nat", "queue", "rules", "Anchors", "Sources", "states",
236 	"info", "Interfaces", "labels", "timeouts", "memory", "Tables",
237 	"osfp", "Running", "all", "creatorids", NULL
238 };
239 
240 static const char * const tblcmdopt_list[] = {
241 	"kill", "flush", "add", "delete", "load", "replace", "show",
242 	"test", "zero", "expire", NULL
243 };
244 
245 static const char * const debugopt_list[] = {
246 	"none", "urgent", "misc", "loud", NULL
247 };
248 
249 static const char * const optiopt_list[] = {
250 	"none", "basic", "profile", NULL
251 };
252 
253 void
254 usage(void)
255 {
256 	extern char *__progname;
257 
258 	fprintf(stderr,
259 "usage: %s [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
260 	"\t[-f file] [-i interface] [-K host | network]\n"
261 	"\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
262 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
263 	    __progname);
264 
265 	exit(1);
266 }
267 
268 /*
269  * Cache protocol number to name translations.
270  *
271  * Translation is performed a lot e.g., when dumping states and
272  * getprotobynumber is incredibly expensive.
273  *
274  * Note from the getprotobynumber(3) manpage:
275  * <quote>
276  * These functions use a thread-specific data space; if the data is needed
277  * for future use, it should be copied before any subsequent calls overwrite
278  * it.  Only the Internet protocols are currently understood.
279  * </quote>
280  *
281  * Consequently we only cache the name and strdup it for safety.
282  *
283  * At the time of writing this comment the last entry in /etc/protocols is:
284  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
285  */
286 const char *
287 pfctl_proto2name(int proto)
288 {
289 	static const char *pfctl_proto_cache[259];
290 	struct protoent *p;
291 
292 	if (proto >= nitems(pfctl_proto_cache)) {
293 		p = getprotobynumber(proto);
294 		if (p == NULL) {
295 			return (NULL);
296 		}
297 		return (p->p_name);
298 	}
299 
300 	if (pfctl_proto_cache[proto] == NULL) {
301 		p = getprotobynumber(proto);
302 		if (p == NULL) {
303 			return (NULL);
304 		}
305 		pfctl_proto_cache[proto] = strdup(p->p_name);
306 	}
307 
308 	return (pfctl_proto_cache[proto]);
309 }
310 
311 int
312 pfctl_enable(int dev, int opts)
313 {
314 	int ret;
315 
316 	if ((ret = pfctl_startstop(pfh, 1)) != 0) {
317 		if (ret == EEXIST)
318 			errx(1, "pf already enabled");
319 		else if (ret == ESRCH)
320 			errx(1, "pfil registeration failed");
321 		else
322 			err(1, "DIOCSTART");
323 	}
324 	if ((opts & PF_OPT_QUIET) == 0)
325 		fprintf(stderr, "pf enabled\n");
326 
327 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
328 		if (errno != EEXIST)
329 			err(1, "DIOCSTARTALTQ");
330 
331 	return (0);
332 }
333 
334 int
335 pfctl_disable(int dev, int opts)
336 {
337 	int ret;
338 
339 	if ((ret = pfctl_startstop(pfh, 0)) != 0) {
340 		if (ret == ENOENT)
341 			errx(1, "pf not enabled");
342 		else
343 			err(1, "DIOCSTOP");
344 	}
345 	if ((opts & PF_OPT_QUIET) == 0)
346 		fprintf(stderr, "pf disabled\n");
347 
348 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
349 			if (errno != ENOENT)
350 				err(1, "DIOCSTOPALTQ");
351 
352 	return (0);
353 }
354 
355 int
356 pfctl_clear_stats(int dev, int opts)
357 {
358 	if (ioctl(dev, DIOCCLRSTATUS))
359 		err(1, "DIOCCLRSTATUS");
360 	if ((opts & PF_OPT_QUIET) == 0)
361 		fprintf(stderr, "pf: statistics cleared\n");
362 	return (0);
363 }
364 
365 int
366 pfctl_get_skip_ifaces(void)
367 {
368 	bzero(&skip_b, sizeof(skip_b));
369 	skip_b.pfrb_type = PFRB_IFACES;
370 	for (;;) {
371 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
372 		skip_b.pfrb_size = skip_b.pfrb_msize;
373 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
374 			err(1, "pfi_get_ifaces");
375 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
376 			break;
377 	}
378 	return (0);
379 }
380 
381 int
382 pfctl_check_skip_ifaces(char *ifname)
383 {
384 	struct pfi_kif		*p;
385 	struct node_host	*h = NULL, *n = NULL;
386 
387 	PFRB_FOREACH(p, &skip_b) {
388 		if (!strcmp(ifname, p->pfik_name) &&
389 		    (p->pfik_flags & PFI_IFLAG_SKIP))
390 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
391 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
392 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
393 				continue;
394 
395 			for (n = h; n != NULL; n = n->next) {
396 				if (p->pfik_ifp == NULL)
397 					continue;
398 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
399 					continue;
400 
401 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
402 			}
403 		}
404 	}
405 	return (0);
406 }
407 
408 int
409 pfctl_adjust_skip_ifaces(struct pfctl *pf)
410 {
411 	struct pfi_kif		*p, *pp;
412 	struct node_host	*h = NULL, *n = NULL;
413 
414 	PFRB_FOREACH(p, &skip_b) {
415 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
416 			continue;
417 
418 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
419 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
420 			continue;
421 
422 		for (n = h; n != NULL; n = n->next)
423 			PFRB_FOREACH(pp, &skip_b) {
424 				if (pp->pfik_ifp == NULL)
425 					continue;
426 
427 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
428 					continue;
429 
430 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
431 					pfctl_set_interface_flags(pf,
432 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
433 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
434 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
435 			}
436 	}
437 
438 	PFRB_FOREACH(p, &skip_b) {
439 		if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
440 			continue;
441 
442 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
443 	}
444 
445 	return (0);
446 }
447 
448 int
449 pfctl_clear_interface_flags(int dev, int opts)
450 {
451 	struct pfioc_iface	pi;
452 
453 	if ((opts & PF_OPT_NOACTION) == 0) {
454 		bzero(&pi, sizeof(pi));
455 		pi.pfiio_flags = PFI_IFLAG_SKIP;
456 
457 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
458 			err(1, "DIOCCLRIFFLAG");
459 		if ((opts & PF_OPT_QUIET) == 0)
460 			fprintf(stderr, "pf: interface flags reset\n");
461 	}
462 	return (0);
463 }
464 
465 int
466 pfctl_flush_eth_rules(int dev, int opts, char *anchorname)
467 {
468 	int ret;
469 
470 	ret = pfctl_clear_eth_rules(dev, anchorname);
471 	if (ret != 0)
472 		err(1, "pfctl_clear_eth_rules");
473 
474 	if ((opts & PF_OPT_QUIET) == 0)
475 		fprintf(stderr, "Ethernet rules cleared\n");
476 
477 	return (ret);
478 }
479 
480 int
481 pfctl_flush_rules(int dev, int opts, char *anchorname)
482 {
483 	int ret;
484 
485 	ret = pfctl_clear_rules(dev, anchorname);
486 	if (ret != 0)
487 		err(1, "pfctl_clear_rules");
488 	if ((opts & PF_OPT_QUIET) == 0)
489 		fprintf(stderr, "rules cleared\n");
490 	return (0);
491 }
492 
493 int
494 pfctl_flush_nat(int dev, int opts, char *anchorname)
495 {
496 	int ret;
497 
498 	ret = pfctl_clear_nat(dev, anchorname);
499 	if (ret != 0)
500 		err(1, "pfctl_clear_nat");
501 	if ((opts & PF_OPT_QUIET) == 0)
502 		fprintf(stderr, "nat cleared\n");
503 	return (0);
504 }
505 
506 int
507 pfctl_clear_altq(int dev, int opts)
508 {
509 	struct pfr_buffer t;
510 
511 	if (!altqsupport)
512 		return (-1);
513 	memset(&t, 0, sizeof(t));
514 	t.pfrb_type = PFRB_TRANS;
515 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
516 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
517 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
518 		err(1, "pfctl_clear_altq");
519 	if ((opts & PF_OPT_QUIET) == 0)
520 		fprintf(stderr, "altq cleared\n");
521 	return (0);
522 }
523 
524 int
525 pfctl_clear_src_nodes(int dev, int opts)
526 {
527 	if (ioctl(dev, DIOCCLRSRCNODES))
528 		err(1, "DIOCCLRSRCNODES");
529 	if ((opts & PF_OPT_QUIET) == 0)
530 		fprintf(stderr, "source tracking entries cleared\n");
531 	return (0);
532 }
533 
534 int
535 pfctl_clear_iface_states(int dev, const char *iface, int opts)
536 {
537 	struct pfctl_kill kill;
538 	unsigned int killed;
539 
540 	memset(&kill, 0, sizeof(kill));
541 	if (iface != NULL && strlcpy(kill.ifname, iface,
542 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
543 		errx(1, "invalid interface: %s", iface);
544 
545 	if (opts & PF_OPT_KILLMATCH)
546 		kill.kill_match = true;
547 
548 	if (pfctl_clear_states(dev, &kill, &killed))
549 		err(1, "DIOCCLRSTATES");
550 	if ((opts & PF_OPT_QUIET) == 0)
551 		fprintf(stderr, "%d states cleared\n", killed);
552 	return (0);
553 }
554 
555 void
556 pfctl_addrprefix(char *addr, struct pf_addr *mask)
557 {
558 	char *p;
559 	const char *errstr;
560 	int prefix, ret_ga, q, r;
561 	struct addrinfo hints, *res;
562 
563 	if ((p = strchr(addr, '/')) == NULL)
564 		return;
565 
566 	*p++ = '\0';
567 	prefix = strtonum(p, 0, 128, &errstr);
568 	if (errstr)
569 		errx(1, "prefix is %s: %s", errstr, p);
570 
571 	bzero(&hints, sizeof(hints));
572 	/* prefix only with numeric addresses */
573 	hints.ai_flags |= AI_NUMERICHOST;
574 
575 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
576 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
577 		/* NOTREACHED */
578 	}
579 
580 	if (res->ai_family == AF_INET && prefix > 32)
581 		errx(1, "prefix too long for AF_INET");
582 	else if (res->ai_family == AF_INET6 && prefix > 128)
583 		errx(1, "prefix too long for AF_INET6");
584 
585 	q = prefix >> 3;
586 	r = prefix & 7;
587 	switch (res->ai_family) {
588 	case AF_INET:
589 		bzero(&mask->v4, sizeof(mask->v4));
590 		mask->v4.s_addr = htonl((u_int32_t)
591 		    (0xffffffffffULL << (32 - prefix)));
592 		break;
593 	case AF_INET6:
594 		bzero(&mask->v6, sizeof(mask->v6));
595 		if (q > 0)
596 			memset((void *)&mask->v6, 0xff, q);
597 		if (r > 0)
598 			*((u_char *)&mask->v6 + q) =
599 			    (0xff00 >> r) & 0xff;
600 		break;
601 	}
602 	freeaddrinfo(res);
603 }
604 
605 int
606 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
607 {
608 	struct pfioc_src_node_kill psnk;
609 	struct addrinfo *res[2], *resp[2];
610 	struct sockaddr last_src, last_dst;
611 	int killed, sources, dests;
612 	int ret_ga;
613 
614 	killed = sources = dests = 0;
615 
616 	memset(&psnk, 0, sizeof(psnk));
617 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
618 	    sizeof(psnk.psnk_src.addr.v.a.mask));
619 	memset(&last_src, 0xff, sizeof(last_src));
620 	memset(&last_dst, 0xff, sizeof(last_dst));
621 
622 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
623 
624 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
625 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
626 		/* NOTREACHED */
627 	}
628 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
629 		if (resp[0]->ai_addr == NULL)
630 			continue;
631 		/* We get lots of duplicates.  Catch the easy ones */
632 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
633 			continue;
634 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
635 
636 		psnk.psnk_af = resp[0]->ai_family;
637 		sources++;
638 
639 		if (psnk.psnk_af == AF_INET)
640 			psnk.psnk_src.addr.v.a.addr.v4 =
641 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
642 		else if (psnk.psnk_af == AF_INET6)
643 			psnk.psnk_src.addr.v.a.addr.v6 =
644 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
645 			    sin6_addr;
646 		else
647 			errx(1, "Unknown address family %d", psnk.psnk_af);
648 
649 		if (src_node_killers > 1) {
650 			dests = 0;
651 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
652 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
653 			memset(&last_dst, 0xff, sizeof(last_dst));
654 			pfctl_addrprefix(src_node_kill[1],
655 			    &psnk.psnk_dst.addr.v.a.mask);
656 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
657 			    &res[1]))) {
658 				errx(1, "getaddrinfo: %s",
659 				    gai_strerror(ret_ga));
660 				/* NOTREACHED */
661 			}
662 			for (resp[1] = res[1]; resp[1];
663 			    resp[1] = resp[1]->ai_next) {
664 				if (resp[1]->ai_addr == NULL)
665 					continue;
666 				if (psnk.psnk_af != resp[1]->ai_family)
667 					continue;
668 
669 				if (memcmp(&last_dst, resp[1]->ai_addr,
670 				    sizeof(last_dst)) == 0)
671 					continue;
672 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
673 
674 				dests++;
675 
676 				if (psnk.psnk_af == AF_INET)
677 					psnk.psnk_dst.addr.v.a.addr.v4 =
678 					    ((struct sockaddr_in *)resp[1]->
679 					    ai_addr)->sin_addr;
680 				else if (psnk.psnk_af == AF_INET6)
681 					psnk.psnk_dst.addr.v.a.addr.v6 =
682 					    ((struct sockaddr_in6 *)resp[1]->
683 					    ai_addr)->sin6_addr;
684 				else
685 					errx(1, "Unknown address family %d",
686 					    psnk.psnk_af);
687 
688 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
689 					err(1, "DIOCKILLSRCNODES");
690 				killed += psnk.psnk_killed;
691 			}
692 			freeaddrinfo(res[1]);
693 		} else {
694 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
695 				err(1, "DIOCKILLSRCNODES");
696 			killed += psnk.psnk_killed;
697 		}
698 	}
699 
700 	freeaddrinfo(res[0]);
701 
702 	if ((opts & PF_OPT_QUIET) == 0)
703 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
704 		    "destinations\n", killed, sources, dests);
705 	return (0);
706 }
707 
708 int
709 pfctl_net_kill_states(int dev, const char *iface, int opts)
710 {
711 	struct pfctl_kill kill;
712 	struct addrinfo *res[2], *resp[2];
713 	struct sockaddr last_src, last_dst;
714 	unsigned int newkilled;
715 	int killed, sources, dests;
716 	int ret_ga;
717 
718 	killed = sources = dests = 0;
719 
720 	memset(&kill, 0, sizeof(kill));
721 	memset(&kill.src.addr.v.a.mask, 0xff,
722 	    sizeof(kill.src.addr.v.a.mask));
723 	memset(&last_src, 0xff, sizeof(last_src));
724 	memset(&last_dst, 0xff, sizeof(last_dst));
725 	if (iface != NULL && strlcpy(kill.ifname, iface,
726 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
727 		errx(1, "invalid interface: %s", iface);
728 
729 	if (state_killers == 2 && (strcmp(state_kill[0], "nat") == 0)) {
730 		kill.nat = true;
731 		state_kill[0] = state_kill[1];
732 		state_killers = 1;
733 	}
734 
735 	pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask);
736 
737 	if (opts & PF_OPT_KILLMATCH)
738 		kill.kill_match = true;
739 
740 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
741 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
742 		/* NOTREACHED */
743 	}
744 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
745 		if (resp[0]->ai_addr == NULL)
746 			continue;
747 		/* We get lots of duplicates.  Catch the easy ones */
748 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
749 			continue;
750 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
751 
752 		kill.af = resp[0]->ai_family;
753 		sources++;
754 
755 		if (kill.af == AF_INET)
756 			kill.src.addr.v.a.addr.v4 =
757 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
758 		else if (kill.af == AF_INET6)
759 			kill.src.addr.v.a.addr.v6 =
760 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
761 			    sin6_addr;
762 		else
763 			errx(1, "Unknown address family %d", kill.af);
764 
765 		if (state_killers > 1) {
766 			dests = 0;
767 			memset(&kill.dst.addr.v.a.mask, 0xff,
768 			    sizeof(kill.dst.addr.v.a.mask));
769 			memset(&last_dst, 0xff, sizeof(last_dst));
770 			pfctl_addrprefix(state_kill[1],
771 			    &kill.dst.addr.v.a.mask);
772 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
773 			    &res[1]))) {
774 				errx(1, "getaddrinfo: %s",
775 				    gai_strerror(ret_ga));
776 				/* NOTREACHED */
777 			}
778 			for (resp[1] = res[1]; resp[1];
779 			    resp[1] = resp[1]->ai_next) {
780 				if (resp[1]->ai_addr == NULL)
781 					continue;
782 				if (kill.af != resp[1]->ai_family)
783 					continue;
784 
785 				if (memcmp(&last_dst, resp[1]->ai_addr,
786 				    sizeof(last_dst)) == 0)
787 					continue;
788 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
789 
790 				dests++;
791 
792 				if (kill.af == AF_INET)
793 					kill.dst.addr.v.a.addr.v4 =
794 					    ((struct sockaddr_in *)resp[1]->
795 					    ai_addr)->sin_addr;
796 				else if (kill.af == AF_INET6)
797 					kill.dst.addr.v.a.addr.v6 =
798 					    ((struct sockaddr_in6 *)resp[1]->
799 					    ai_addr)->sin6_addr;
800 				else
801 					errx(1, "Unknown address family %d",
802 					    kill.af);
803 
804 				if (pfctl_kill_states(dev, &kill, &newkilled))
805 					err(1, "DIOCKILLSTATES");
806 				killed += newkilled;
807 			}
808 			freeaddrinfo(res[1]);
809 		} else {
810 			if (pfctl_kill_states(dev, &kill, &newkilled))
811 				err(1, "DIOCKILLSTATES");
812 			killed += newkilled;
813 		}
814 	}
815 
816 	freeaddrinfo(res[0]);
817 
818 	if ((opts & PF_OPT_QUIET) == 0)
819 		fprintf(stderr, "killed %d states from %d sources and %d "
820 		    "destinations\n", killed, sources, dests);
821 	return (0);
822 }
823 
824 int
825 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
826 {
827 	struct pfctl_kill kill;
828 	struct addrinfo *res, *resp;
829 	struct sockaddr last_src;
830 	unsigned int newkilled;
831 	int killed = 0;
832 	int ret_ga;
833 
834 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
835 		warnx("no gateway specified");
836 		usage();
837 	}
838 
839 	memset(&kill, 0, sizeof(kill));
840 	memset(&kill.rt_addr.addr.v.a.mask, 0xff,
841 	    sizeof(kill.rt_addr.addr.v.a.mask));
842 	memset(&last_src, 0xff, sizeof(last_src));
843 	if (iface != NULL && strlcpy(kill.ifname, iface,
844 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
845 		errx(1, "invalid interface: %s", iface);
846 
847 	if (opts & PF_OPT_KILLMATCH)
848 		kill.kill_match = true;
849 
850 	pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask);
851 
852 	if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, &res))) {
853 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
854 		/* NOTREACHED */
855 	}
856 	for (resp = res; resp; resp = resp->ai_next) {
857 		if (resp->ai_addr == NULL)
858 			continue;
859 		/* We get lots of duplicates.  Catch the easy ones */
860 		if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
861 			continue;
862 		last_src = *(struct sockaddr *)resp->ai_addr;
863 
864 		kill.af = resp->ai_family;
865 
866 		if (kill.af == AF_INET)
867 			kill.rt_addr.addr.v.a.addr.v4 =
868 			    ((struct sockaddr_in *)resp->ai_addr)->sin_addr;
869 		else if (kill.af == AF_INET6)
870 			kill.rt_addr.addr.v.a.addr.v6 =
871 			    ((struct sockaddr_in6 *)resp->ai_addr)->
872 			    sin6_addr;
873 		else
874 			errx(1, "Unknown address family %d", kill.af);
875 
876 		if (pfctl_kill_states(dev, &kill, &newkilled))
877 			err(1, "DIOCKILLSTATES");
878 		killed += newkilled;
879 	}
880 
881 	freeaddrinfo(res);
882 
883 	if ((opts & PF_OPT_QUIET) == 0)
884 		fprintf(stderr, "killed %d states\n", killed);
885 	return (0);
886 }
887 
888 int
889 pfctl_label_kill_states(int dev, const char *iface, int opts)
890 {
891 	struct pfctl_kill kill;
892 	unsigned int killed;
893 
894 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
895 		warnx("no label specified");
896 		usage();
897 	}
898 	memset(&kill, 0, sizeof(kill));
899 	if (iface != NULL && strlcpy(kill.ifname, iface,
900 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
901 		errx(1, "invalid interface: %s", iface);
902 
903 	if (opts & PF_OPT_KILLMATCH)
904 		kill.kill_match = true;
905 
906 	if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
907 	    sizeof(kill.label))
908 		errx(1, "label too long: %s", state_kill[1]);
909 
910 	if (pfctl_kill_states(dev, &kill, &killed))
911 		err(1, "DIOCKILLSTATES");
912 
913 	if ((opts & PF_OPT_QUIET) == 0)
914 		fprintf(stderr, "killed %d states\n", killed);
915 
916 	return (0);
917 }
918 
919 int
920 pfctl_id_kill_states(int dev, const char *iface, int opts)
921 {
922 	struct pfctl_kill kill;
923 	unsigned int killed;
924 
925 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
926 		warnx("no id specified");
927 		usage();
928 	}
929 
930 	memset(&kill, 0, sizeof(kill));
931 
932 	if (opts & PF_OPT_KILLMATCH)
933 		kill.kill_match = true;
934 
935 	if ((sscanf(state_kill[1], "%jx/%x",
936 	    &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
937 	}
938 	else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
939 		kill.cmp.creatorid = 0;
940 	} else {
941 		warnx("wrong id format specified");
942 		usage();
943 	}
944 	if (kill.cmp.id == 0) {
945 		warnx("cannot kill id 0");
946 		usage();
947 	}
948 
949 	if (pfctl_kill_states(dev, &kill, &killed))
950 		err(1, "DIOCKILLSTATES");
951 
952 	if ((opts & PF_OPT_QUIET) == 0)
953 		fprintf(stderr, "killed %d states\n", killed);
954 
955 	return (0);
956 }
957 
958 int
959 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
960     u_int32_t ticket, int r_action, char *anchorname)
961 {
962 	struct pfioc_pooladdr pp;
963 	struct pf_pooladdr *pa;
964 	u_int32_t pnr, mpnr;
965 
966 	memset(&pp, 0, sizeof(pp));
967 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
968 	pp.r_action = r_action;
969 	pp.r_num = nr;
970 	pp.ticket = ticket;
971 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
972 		warn("DIOCGETADDRS");
973 		return (-1);
974 	}
975 	mpnr = pp.nr;
976 	TAILQ_INIT(&pool->list);
977 	for (pnr = 0; pnr < mpnr; ++pnr) {
978 		pp.nr = pnr;
979 		if (ioctl(dev, DIOCGETADDR, &pp)) {
980 			warn("DIOCGETADDR");
981 			return (-1);
982 		}
983 		pa = calloc(1, sizeof(struct pf_pooladdr));
984 		if (pa == NULL)
985 			err(1, "calloc");
986 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
987 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
988 	}
989 
990 	return (0);
991 }
992 
993 void
994 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
995 {
996 	struct pf_pooladdr *pa;
997 
998 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
999 		TAILQ_REMOVE(&src->list, pa, entries);
1000 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
1001 	}
1002 }
1003 
1004 void
1005 pfctl_clear_pool(struct pfctl_pool *pool)
1006 {
1007 	struct pf_pooladdr *pa;
1008 
1009 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
1010 		TAILQ_REMOVE(&pool->list, pa, entries);
1011 		free(pa);
1012 	}
1013 }
1014 
1015 void
1016 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *rule, int opts)
1017 {
1018 	if (opts & PF_OPT_VERBOSE) {
1019 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1020 			    "Bytes: %-10llu]\n",
1021 			    (unsigned long long)rule->evaluations,
1022 			    (unsigned long long)(rule->packets[0] +
1023 			    rule->packets[1]),
1024 			    (unsigned long long)(rule->bytes[0] +
1025 			    rule->bytes[1]));
1026 	}
1027 	if (opts & PF_OPT_VERBOSE2) {
1028 		char timestr[30];
1029 
1030 		if (rule->last_active_timestamp != 0) {
1031 			bcopy(ctime(&rule->last_active_timestamp), timestr,
1032 			    sizeof(timestr));
1033 			*strchr(timestr, '\n') = '\0';
1034 		} else {
1035 			snprintf(timestr, sizeof(timestr), "N/A");
1036 		}
1037 		printf("  [ Last Active Time: %s ]\n", timestr);
1038 	}
1039 }
1040 
1041 void
1042 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
1043 {
1044 	if (opts & PF_OPT_DEBUG) {
1045 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
1046 		    "p", "sa", "sp", "da", "dp" };
1047 		int i;
1048 
1049 		printf("  [ Skip steps: ");
1050 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
1051 			if (rule->skip[i].nr == rule->nr + 1)
1052 				continue;
1053 			printf("%s=", t[i]);
1054 			if (rule->skip[i].nr == -1)
1055 				printf("end ");
1056 			else
1057 				printf("%u ", rule->skip[i].nr);
1058 		}
1059 		printf("]\n");
1060 
1061 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1062 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
1063 	}
1064 	if (opts & PF_OPT_VERBOSE) {
1065 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1066 			    "Bytes: %-10llu  States: %-6ju]\n",
1067 			    (unsigned long long)rule->evaluations,
1068 			    (unsigned long long)(rule->packets[0] +
1069 			    rule->packets[1]),
1070 			    (unsigned long long)(rule->bytes[0] +
1071 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
1072 		if (!(opts & PF_OPT_DEBUG))
1073 			printf("  [ Inserted: uid %u pid %u "
1074 			    "State Creations: %-6ju]\n",
1075 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
1076 			    (uintmax_t)rule->states_tot);
1077 	}
1078 	if (opts & PF_OPT_VERBOSE2) {
1079 		char timestr[30];
1080 		if (rule->last_active_timestamp != 0) {
1081 			bcopy(ctime(&rule->last_active_timestamp), timestr,
1082 			    sizeof(timestr));
1083 			*strchr(timestr, '\n') = '\0';
1084 		} else {
1085 			snprintf(timestr, sizeof(timestr), "N/A");
1086 		}
1087 		printf("  [ Last Active Time: %s ]\n", timestr);
1088 	}
1089 }
1090 
1091 void
1092 pfctl_print_title(char *title)
1093 {
1094 	if (!first_title)
1095 		printf("\n");
1096 	first_title = 0;
1097 	printf("%s\n", title);
1098 }
1099 
1100 int
1101 pfctl_show_eth_rules(int dev, char *path, int opts, enum pfctl_show format,
1102     char *anchorname, int depth, int wildcard)
1103 {
1104 	char anchor_call[MAXPATHLEN];
1105 	struct pfctl_eth_rules_info info;
1106 	struct pfctl_eth_rule rule;
1107 	int brace;
1108 	int dotitle = opts & PF_OPT_SHOWALL;
1109 	int len = strlen(path);
1110 	char *npath, *p;
1111 
1112 	/*
1113 	 * Truncate a trailing / and * on an anchorname before searching for
1114 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1115 	 * to the kernel.
1116 	 */
1117 	if ((p = strrchr(anchorname, '/')) != NULL &&
1118 			p[1] == '*' && p[2] == '\0') {
1119 		p[0] = '\0';
1120 	}
1121 
1122 	if (anchorname[0] == '/') {
1123 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1124 			errx(1, "pfctl_rules: calloc");
1125 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1126 	} else {
1127 		if (path[0])
1128 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1129 		else
1130 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1131 		npath = path;
1132 	}
1133 
1134 	/*
1135 	 * If this anchor was called with a wildcard path, go through
1136 	 * the rulesets in the anchor rather than the rules.
1137 	 */
1138 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1139 		struct pfctl_eth_rulesets_info	ri;
1140 		u_int32_t                mnr, nr;
1141 
1142 		if (pfctl_get_eth_rulesets_info(dev, &ri, npath)) {
1143 			if (errno == EINVAL) {
1144 				fprintf(stderr, "Anchor '%s' "
1145 						"not found.\n", anchorname);
1146 			} else {
1147 				warn("DIOCGETETHRULESETS");
1148 				return (-1);
1149 			}
1150 		}
1151 		mnr = ri.nr;
1152 
1153 		pfctl_print_eth_rule_counters(&rule, opts);
1154 		for (nr = 0; nr < mnr; ++nr) {
1155 			struct pfctl_eth_ruleset_info	rs;
1156 
1157 			if (pfctl_get_eth_ruleset(dev, npath, nr, &rs))
1158 				err(1, "DIOCGETETHRULESET");
1159 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1160 			printf("anchor \"%s\" all {\n", rs.name);
1161 			pfctl_show_eth_rules(dev, npath, opts,
1162 					format, rs.name, depth + 1, 0);
1163 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1164 			printf("}\n");
1165 		}
1166 		path[len] = '\0';
1167 		return (0);
1168 	}
1169 
1170 	if (pfctl_get_eth_rules_info(dev, &info, path)) {
1171 		warn("DIOCGETETHRULES");
1172 		return (-1);
1173 	}
1174 	for (int nr = 0; nr < info.nr; nr++) {
1175 		brace = 0;
1176 		INDENT(depth, !(opts & PF_OPT_VERBOSE));
1177 		if (pfctl_get_eth_rule(dev, nr, info.ticket, path, &rule,
1178 		    opts & PF_OPT_CLRRULECTRS, anchor_call) != 0) {
1179 			warn("DIOCGETETHRULE");
1180 			return (-1);
1181 		}
1182 		if (anchor_call[0] &&
1183 		   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1184 		   (p == anchor_call ||
1185 		   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1186 			brace++;
1187 			int aclen = strlen(anchor_call);
1188 			if (anchor_call[aclen - 1] == '*')
1189 				anchor_call[aclen - 2] = '\0';
1190 		}
1191 		p = &anchor_call[0];
1192 		if (dotitle) {
1193 			pfctl_print_title("ETH RULES:");
1194 			dotitle = 0;
1195 		}
1196 		print_eth_rule(&rule, anchor_call,
1197 		    opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1198 		if (brace)
1199 			printf(" {\n");
1200 		else
1201 			printf("\n");
1202 		pfctl_print_eth_rule_counters(&rule, opts);
1203 		if (brace) {
1204 			pfctl_show_eth_rules(dev, path, opts, format,
1205 			    p, depth + 1, rule.anchor_wildcard);
1206 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1207 			printf("}\n");
1208 		}
1209 	}
1210 
1211 	path[len] = '\0';
1212 	return (0);
1213 }
1214 
1215 int
1216 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1217     char *anchorname, int depth, int wildcard)
1218 {
1219 	struct pfctl_rules_info ri;
1220 	struct pfctl_rule rule;
1221 	char anchor_call[MAXPATHLEN];
1222 	u_int32_t nr, header = 0;
1223 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1224 	int numeric = opts & PF_OPT_NUMERIC;
1225 	int len = strlen(path), ret = 0;
1226 	char *npath, *p;
1227 
1228 	/*
1229 	 * Truncate a trailing / and * on an anchorname before searching for
1230 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1231 	 * to the kernel.
1232 	 */
1233 	if ((p = strrchr(anchorname, '/')) != NULL &&
1234 	    p[1] == '*' && p[2] == '\0') {
1235 		p[0] = '\0';
1236 	}
1237 
1238 	if (anchorname[0] == '/') {
1239 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1240 			errx(1, "pfctl_rules: calloc");
1241 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1242 	} else {
1243 		if (path[0])
1244 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1245 		else
1246 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1247 		npath = path;
1248 	}
1249 
1250 	/*
1251 	 * If this anchor was called with a wildcard path, go through
1252 	 * the rulesets in the anchor rather than the rules.
1253 	 */
1254 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1255 		struct pfioc_ruleset     prs;
1256 		u_int32_t                mnr, nr;
1257 
1258 		memset(&prs, 0, sizeof(prs));
1259 		memcpy(prs.path, npath, sizeof(prs.path));
1260 		if (ioctl(dev, DIOCGETRULESETS, &prs)) {
1261 			if (errno == EINVAL)
1262 				fprintf(stderr, "Anchor '%s' "
1263 				    "not found.\n", anchorname);
1264 			else
1265 				err(1, "DIOCGETRULESETS");
1266 		}
1267 		mnr = prs.nr;
1268 
1269 		pfctl_print_rule_counters(&rule, opts);
1270 		for (nr = 0; nr < mnr; ++nr) {
1271 			prs.nr = nr;
1272 			if (ioctl(dev, DIOCGETRULESET, &prs))
1273 				err(1, "DIOCGETRULESET");
1274 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1275 			printf("anchor \"%s\" all {\n", prs.name);
1276 			pfctl_show_rules(dev, npath, opts,
1277 			    format, prs.name, depth + 1, 0);
1278 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1279 			printf("}\n");
1280 		}
1281 		path[len] = '\0';
1282 		return (0);
1283 	}
1284 
1285 	if (opts & PF_OPT_SHOWALL) {
1286 		ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1287 		if (ret != 0) {
1288 			warn("DIOCGETRULES");
1289 			goto error;
1290 		}
1291 		header++;
1292 	}
1293 	ret = pfctl_get_rules_info(dev, &ri, PF_SCRUB, path);
1294 	if (ret != 0) {
1295 		warn("DIOCGETRULES");
1296 		goto error;
1297 	}
1298 	if (opts & PF_OPT_SHOWALL) {
1299 		if (format == PFCTL_SHOW_RULES && (ri.nr > 0 || header))
1300 			pfctl_print_title("FILTER RULES:");
1301 		else if (format == PFCTL_SHOW_LABELS && labels)
1302 			pfctl_print_title("LABEL COUNTERS:");
1303 	}
1304 
1305 	for (nr = 0; nr < ri.nr; ++nr) {
1306 		if (pfctl_get_clear_rule_h(pfh, nr, ri.ticket, path, PF_SCRUB,
1307 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1308 			warn("DIOCGETRULENV");
1309 			goto error;
1310 		}
1311 
1312 		if (pfctl_get_pool(dev, &rule.rpool,
1313 		    nr, ri.ticket, PF_SCRUB, path) != 0)
1314 			goto error;
1315 
1316 		switch (format) {
1317 		case PFCTL_SHOW_LABELS:
1318 			break;
1319 		case PFCTL_SHOW_RULES:
1320 			if (rule.label[0][0] && (opts & PF_OPT_SHOWALL))
1321 				labels = 1;
1322 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1323 			printf("\n");
1324 			pfctl_print_rule_counters(&rule, opts);
1325 			break;
1326 		case PFCTL_SHOW_NOTHING:
1327 			break;
1328 		}
1329 		pfctl_clear_pool(&rule.rpool);
1330 	}
1331 	ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1332 	if (ret != 0) {
1333 		warn("DIOCGETRULES");
1334 		goto error;
1335 	}
1336 	for (nr = 0; nr < ri.nr; ++nr) {
1337 		if (pfctl_get_clear_rule_h(pfh, nr, ri.ticket, path, PF_PASS,
1338 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1339 			warn("DIOCGETRULE");
1340 			goto error;
1341 		}
1342 
1343 		if (pfctl_get_pool(dev, &rule.rpool,
1344 		    nr, ri.ticket, PF_PASS, path) != 0)
1345 			goto error;
1346 
1347 		switch (format) {
1348 		case PFCTL_SHOW_LABELS: {
1349 			bool show = false;
1350 			int i = 0;
1351 
1352 			while (rule.label[i][0]) {
1353 				printf("%s ", rule.label[i++]);
1354 				show = true;
1355 			}
1356 
1357 			if (show) {
1358 				printf("%llu %llu %llu %llu"
1359 				    " %llu %llu %llu %ju\n",
1360 				    (unsigned long long)rule.evaluations,
1361 				    (unsigned long long)(rule.packets[0] +
1362 				    rule.packets[1]),
1363 				    (unsigned long long)(rule.bytes[0] +
1364 				    rule.bytes[1]),
1365 				    (unsigned long long)rule.packets[0],
1366 				    (unsigned long long)rule.bytes[0],
1367 				    (unsigned long long)rule.packets[1],
1368 				    (unsigned long long)rule.bytes[1],
1369 				    (uintmax_t)rule.states_tot);
1370 			}
1371 
1372 			if (anchor_call[0] &&
1373 			    (((p = strrchr(anchor_call, '/')) ?
1374 			      p[1] == '_' : anchor_call[0] == '_') ||
1375 			     opts & PF_OPT_RECURSE)) {
1376 				pfctl_show_rules(dev, npath, opts, format,
1377 				    anchor_call, depth, rule.anchor_wildcard);
1378 			}
1379 			break;
1380 		}
1381 		case PFCTL_SHOW_RULES:
1382 			if (rule.label[0][0] && (opts & PF_OPT_SHOWALL))
1383 				labels = 1;
1384 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1385 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1386 
1387 			/*
1388 			 * If this is a 'unnamed' brace notation
1389 			 * anchor, OR the user has explicitly requested
1390 			 * recursion, print it recursively.
1391 			 */
1392 			if (anchor_call[0] &&
1393 			    (((p = strrchr(anchor_call, '/')) ?
1394 			      p[1] == '_' : anchor_call[0] == '_') ||
1395 			     opts & PF_OPT_RECURSE)) {
1396 				printf(" {\n");
1397 				pfctl_print_rule_counters(&rule, opts);
1398 				pfctl_show_rules(dev, npath, opts, format,
1399 				    anchor_call, depth + 1,
1400 				    rule.anchor_wildcard);
1401 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1402 				printf("}\n");
1403 			} else {
1404 				printf("\n");
1405 				pfctl_print_rule_counters(&rule, opts);
1406 			}
1407 			break;
1408 		case PFCTL_SHOW_NOTHING:
1409 			break;
1410 		}
1411 		pfctl_clear_pool(&rule.rpool);
1412 	}
1413 
1414  error:
1415 	path[len] = '\0';
1416 	return (ret);
1417 }
1418 
1419 int
1420 pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth)
1421 {
1422 	struct pfctl_rules_info ri;
1423 	struct pfctl_rule rule;
1424 	char anchor_call[MAXPATHLEN];
1425 	u_int32_t nr;
1426 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1427 	int i, dotitle = opts & PF_OPT_SHOWALL;
1428 	int brace, ret;
1429 	int len = strlen(path);
1430 	char *p;
1431 
1432 	if (path[0])
1433 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1434 	else
1435 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1436 
1437 	for (i = 0; i < 3; i++) {
1438 		ret = pfctl_get_rules_info(dev, &ri, nattype[i], path);
1439 		if (ret != 0) {
1440 			warn("DIOCGETRULES");
1441 			return (-1);
1442 		}
1443 		for (nr = 0; nr < ri.nr; ++nr) {
1444 			brace = 0;
1445 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1446 
1447 			if (pfctl_get_rule(dev, nr, ri.ticket, path,
1448 			    nattype[i], &rule, anchor_call)) {
1449 				warn("DIOCGETRULE");
1450 				return (-1);
1451 			}
1452 			if (pfctl_get_pool(dev, &rule.rpool, nr,
1453 			    ri.ticket, nattype[i], path) != 0)
1454 				return (-1);
1455 
1456 			if (anchor_call[0] &&
1457 			   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1458 			   (p == anchor_call ||
1459 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1460 				brace++;
1461 				if ((p = strrchr(anchor_call, '/')) !=
1462 				    NULL)
1463 					p++;
1464 				else
1465 					p = &anchor_call[0];
1466 			} else
1467 				p = &anchor_call[0];
1468 
1469 			if (dotitle) {
1470 				pfctl_print_title("TRANSLATION RULES:");
1471 				dotitle = 0;
1472 			}
1473 			print_rule(&rule, anchor_call,
1474 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1475 			if (brace)
1476 				printf(" {\n");
1477 			else
1478 				printf("\n");
1479 			pfctl_print_rule_counters(&rule, opts);
1480 			pfctl_clear_pool(&rule.rpool);
1481 			if (brace) {
1482 				pfctl_show_nat(dev, path, opts, p, depth + 1);
1483 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1484 				printf("}\n");
1485 			}
1486 		}
1487 	}
1488 	return (0);
1489 }
1490 
1491 int
1492 pfctl_show_src_nodes(int dev, int opts)
1493 {
1494 	struct pfioc_src_nodes psn;
1495 	struct pf_src_node *p;
1496 	char *inbuf = NULL, *newinbuf = NULL;
1497 	unsigned int len = 0;
1498 	int i;
1499 
1500 	memset(&psn, 0, sizeof(psn));
1501 	for (;;) {
1502 		psn.psn_len = len;
1503 		if (len) {
1504 			newinbuf = realloc(inbuf, len);
1505 			if (newinbuf == NULL)
1506 				err(1, "realloc");
1507 			psn.psn_buf = inbuf = newinbuf;
1508 		}
1509 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1510 			warn("DIOCGETSRCNODES");
1511 			free(inbuf);
1512 			return (-1);
1513 		}
1514 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1515 			break;
1516 		if (len == 0 && psn.psn_len == 0)
1517 			goto done;
1518 		if (len == 0 && psn.psn_len != 0)
1519 			len = psn.psn_len;
1520 		if (psn.psn_len == 0)
1521 			goto done;	/* no src_nodes */
1522 		len *= 2;
1523 	}
1524 	p = psn.psn_src_nodes;
1525 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1526 		pfctl_print_title("SOURCE TRACKING NODES:");
1527 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1528 		print_src_node(p, opts);
1529 		p++;
1530 	}
1531 done:
1532 	free(inbuf);
1533 	return (0);
1534 }
1535 
1536 struct pfctl_show_state_arg {
1537 	int opts;
1538 	int dotitle;
1539 	const char *iface;
1540 };
1541 
1542 static int
1543 pfctl_show_state(struct pfctl_state *s, void *arg)
1544 {
1545 	struct pfctl_show_state_arg *a = (struct pfctl_show_state_arg *)arg;
1546 
1547 	if (a->dotitle) {
1548 		pfctl_print_title("STATES:");
1549 		a->dotitle = 0;
1550 	}
1551 	print_state(s, a->opts);
1552 
1553 	return (0);
1554 }
1555 
1556 int
1557 pfctl_show_states(int dev, const char *iface, int opts)
1558 {
1559 	struct pfctl_show_state_arg arg;
1560 	struct pfctl_state_filter filter = {};
1561 
1562 	if (iface != NULL)
1563 		strncpy(filter.ifname, iface, IFNAMSIZ);
1564 
1565 	arg.opts = opts;
1566 	arg.dotitle = opts & PF_OPT_SHOWALL;
1567 	arg.iface = iface;
1568 
1569 	if (pfctl_get_filtered_states_iter(&filter, pfctl_show_state, &arg))
1570 		return (-1);
1571 
1572 	return (0);
1573 }
1574 
1575 int
1576 pfctl_show_status(int dev, int opts)
1577 {
1578 	struct pfctl_status	*status;
1579 	struct pfctl_syncookies	cookies;
1580 
1581 	if ((status = pfctl_get_status(dev)) == NULL) {
1582 		warn("DIOCGETSTATUS");
1583 		return (-1);
1584 	}
1585 	if (pfctl_get_syncookies(dev, &cookies)) {
1586 		pfctl_free_status(status);
1587 		warn("DIOCGETSYNCOOKIES");
1588 		return (-1);
1589 	}
1590 	if (opts & PF_OPT_SHOWALL)
1591 		pfctl_print_title("INFO:");
1592 	print_status(status, &cookies, opts);
1593 	pfctl_free_status(status);
1594 	return (0);
1595 }
1596 
1597 int
1598 pfctl_show_running(int dev)
1599 {
1600 	struct pfctl_status *status;
1601 	int running;
1602 
1603 	if ((status = pfctl_get_status(dev)) == NULL) {
1604 		warn("DIOCGETSTATUS");
1605 		return (-1);
1606 	}
1607 
1608 	running = status->running;
1609 
1610 	print_running(status);
1611 	pfctl_free_status(status);
1612 	return (!running);
1613 }
1614 
1615 int
1616 pfctl_show_timeouts(int dev, int opts)
1617 {
1618 	struct pfioc_tm pt;
1619 	int i;
1620 
1621 	if (opts & PF_OPT_SHOWALL)
1622 		pfctl_print_title("TIMEOUTS:");
1623 	memset(&pt, 0, sizeof(pt));
1624 	for (i = 0; pf_timeouts[i].name; i++) {
1625 		pt.timeout = pf_timeouts[i].timeout;
1626 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1627 			err(1, "DIOCGETTIMEOUT");
1628 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1629 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1630 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1631 			printf(" states");
1632 		else
1633 			printf("s");
1634 		printf("\n");
1635 	}
1636 	return (0);
1637 
1638 }
1639 
1640 int
1641 pfctl_show_limits(int dev, int opts)
1642 {
1643 	struct pfioc_limit pl;
1644 	int i;
1645 
1646 	if (opts & PF_OPT_SHOWALL)
1647 		pfctl_print_title("LIMITS:");
1648 	memset(&pl, 0, sizeof(pl));
1649 	for (i = 0; pf_limits[i].name; i++) {
1650 		pl.index = pf_limits[i].index;
1651 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1652 			err(1, "DIOCGETLIMIT");
1653 		printf("%-13s ", pf_limits[i].name);
1654 		if (pl.limit == UINT_MAX)
1655 			printf("unlimited\n");
1656 		else
1657 			printf("hard limit %8u\n", pl.limit);
1658 	}
1659 	return (0);
1660 }
1661 
1662 void
1663 pfctl_show_creators(int opts)
1664 {
1665 	int ret;
1666 	uint32_t creators[16];
1667 	size_t count = nitems(creators);
1668 
1669 	ret = pfctl_get_creatorids(pfh, creators, &count);
1670 	if (ret != 0)
1671 		errx(ret, "Failed to retrieve creators");
1672 
1673 	printf("Creator IDs:\n");
1674 	for (size_t i = 0; i < count; i++)
1675 		printf("%08x\n", creators[i]);
1676 }
1677 
1678 /* callbacks for rule/nat/rdr/addr */
1679 int
1680 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1681 {
1682 	struct pf_pooladdr *pa;
1683 
1684 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1685 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1686 			err(1, "DIOCBEGINADDRS");
1687 	}
1688 
1689 	pf->paddr.af = af;
1690 	TAILQ_FOREACH(pa, &p->list, entries) {
1691 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1692 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1693 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1694 				err(1, "DIOCADDADDR");
1695 		}
1696 	}
1697 	return (0);
1698 }
1699 
1700 int
1701 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1702     const char *anchor_call)
1703 {
1704 	u_int8_t		rs_num;
1705 	struct pfctl_rule	*rule;
1706 	struct pfctl_ruleset	*rs;
1707 	char 			*p;
1708 
1709 	rs_num = pf_get_ruleset_number(r->action);
1710 	if (rs_num == PF_RULESET_MAX)
1711 		errx(1, "Invalid rule type %d", r->action);
1712 
1713 	rs = &pf->anchor->ruleset;
1714 
1715 	if (anchor_call[0] && r->anchor == NULL) {
1716 		/*
1717 		 * Don't make non-brace anchors part of the main anchor pool.
1718 		 */
1719 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1720 			err(1, "pfctl_append_rule: calloc");
1721 
1722 		pf_init_ruleset(&r->anchor->ruleset);
1723 		r->anchor->ruleset.anchor = r->anchor;
1724 		if (strlcpy(r->anchor->path, anchor_call,
1725 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1726 			errx(1, "pfctl_append_rule: strlcpy");
1727 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1728 			if (!strlen(p))
1729 				err(1, "pfctl_append_rule: bad anchor name %s",
1730 				    anchor_call);
1731 		} else
1732 			p = (char *)anchor_call;
1733 		if (strlcpy(r->anchor->name, p,
1734 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1735 			errx(1, "pfctl_append_rule: strlcpy");
1736 	}
1737 
1738 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1739 		err(1, "calloc");
1740 	bcopy(r, rule, sizeof(*rule));
1741 	TAILQ_INIT(&rule->rpool.list);
1742 	pfctl_move_pool(&r->rpool, &rule->rpool);
1743 
1744 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1745 	return (0);
1746 }
1747 
1748 int
1749 pfctl_append_eth_rule(struct pfctl *pf, struct pfctl_eth_rule *r,
1750     const char *anchor_call)
1751 {
1752 	struct pfctl_eth_rule		*rule;
1753 	struct pfctl_eth_ruleset	*rs;
1754 	char 				*p;
1755 
1756 	rs = &pf->eanchor->ruleset;
1757 
1758 	if (anchor_call[0] && r->anchor == NULL) {
1759 		/*
1760 		 * Don't make non-brace anchors part of the main anchor pool.
1761 		 */
1762 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1763 			err(1, "pfctl_append_rule: calloc");
1764 
1765 		pf_init_eth_ruleset(&r->anchor->ruleset);
1766 		r->anchor->ruleset.anchor = r->anchor;
1767 		if (strlcpy(r->anchor->path, anchor_call,
1768 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1769 			errx(1, "pfctl_append_rule: strlcpy");
1770 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1771 			if (!strlen(p))
1772 				err(1, "pfctl_append_eth_rule: bad anchor name %s",
1773 				    anchor_call);
1774 		} else
1775 			p = (char *)anchor_call;
1776 		if (strlcpy(r->anchor->name, p,
1777 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1778 			errx(1, "pfctl_append_eth_rule: strlcpy");
1779 	}
1780 
1781 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1782 		err(1, "calloc");
1783 	bcopy(r, rule, sizeof(*rule));
1784 
1785 	TAILQ_INSERT_TAIL(&rs->rules, rule, entries);
1786 	return (0);
1787 }
1788 
1789 int
1790 pfctl_eth_ruleset_trans(struct pfctl *pf, char *path,
1791     struct pfctl_eth_anchor *a)
1792 {
1793 	int osize = pf->trans->pfrb_size;
1794 
1795 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0) {
1796 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1797 			return (1);
1798 	}
1799 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1800 		return (5);
1801 
1802 	return (0);
1803 }
1804 
1805 int
1806 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a, bool do_eth)
1807 {
1808 	int osize = pf->trans->pfrb_size;
1809 
1810 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0 && do_eth) {
1811 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1812 			return (1);
1813 	}
1814 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1815 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1816 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1817 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1818 			return (1);
1819 	}
1820 	if (a == pf->astack[0] && ((altqsupport &&
1821 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1822 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1823 			return (2);
1824 	}
1825 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1826 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1827 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1828 			return (3);
1829 	}
1830 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1831 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1832 			return (4);
1833 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1834 		return (5);
1835 
1836 	return (0);
1837 }
1838 
1839 int
1840 pfctl_load_eth_ruleset(struct pfctl *pf, char *path,
1841     struct pfctl_eth_ruleset *rs, int depth)
1842 {
1843 	struct pfctl_eth_rule	*r;
1844 	int	error, len = strlen(path);
1845 	int	brace = 0;
1846 
1847 	pf->eanchor = rs->anchor;
1848 	if (path[0])
1849 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->eanchor->name);
1850 	else
1851 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->eanchor->name);
1852 
1853 	if (depth) {
1854 		if (TAILQ_FIRST(&rs->rules) != NULL) {
1855 			brace++;
1856 			if (pf->opts & PF_OPT_VERBOSE)
1857 				printf(" {\n");
1858 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1859 			    (error = pfctl_eth_ruleset_trans(pf,
1860 			    path, rs->anchor))) {
1861 				printf("pfctl_load_eth_rulesets: "
1862 				    "pfctl_eth_ruleset_trans %d\n", error);
1863 				goto error;
1864 			}
1865 		} else if (pf->opts & PF_OPT_VERBOSE)
1866 			printf("\n");
1867 	}
1868 
1869 	while ((r = TAILQ_FIRST(&rs->rules)) != NULL) {
1870 		TAILQ_REMOVE(&rs->rules, r, entries);
1871 
1872 		error = pfctl_load_eth_rule(pf, path, r, depth);
1873 		if (error)
1874 			return (error);
1875 
1876 		if (r->anchor) {
1877 			if ((error = pfctl_load_eth_ruleset(pf, path,
1878 			    &r->anchor->ruleset, depth + 1)))
1879 				return (error);
1880 		} else if (pf->opts & PF_OPT_VERBOSE)
1881 			printf("\n");
1882 		free(r);
1883 	}
1884 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1885 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1886 		printf("}\n");
1887 	}
1888 	path[len] = '\0';
1889 
1890 	return (0);
1891 error:
1892 	path[len] = '\0';
1893 	return (error);
1894 }
1895 
1896 int
1897 pfctl_load_eth_rule(struct pfctl *pf, char *path, struct pfctl_eth_rule *r,
1898     int depth)
1899 {
1900 	char			*name;
1901 	char			anchor[PF_ANCHOR_NAME_SIZE];
1902 	int			len = strlen(path);
1903 
1904 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1905 		errx(1, "pfctl_load_eth_rule: strlcpy");
1906 
1907 	if (r->anchor) {
1908 		if (r->anchor->match) {
1909 			if (path[0])
1910 				snprintf(&path[len], MAXPATHLEN - len,
1911 				    "/%s", r->anchor->name);
1912 			else
1913 				snprintf(&path[len], MAXPATHLEN - len,
1914 				    "%s", r->anchor->name);
1915 			name = r->anchor->name;
1916 		} else
1917 			name = r->anchor->path;
1918 	} else
1919 		name = "";
1920 
1921 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1922 		if (pfctl_add_eth_rule(pf->dev, r, anchor, name,
1923 		    pf->eth_ticket))
1924 			err(1, "DIOCADDETHRULENV");
1925 
1926 	if (pf->opts & PF_OPT_VERBOSE) {
1927 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1928 		print_eth_rule(r, r->anchor ? r->anchor->name : "",
1929 		    pf->opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1930 	}
1931 
1932 	path[len] = '\0';
1933 
1934 	return (0);
1935 }
1936 
1937 int
1938 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1939     int rs_num, int depth)
1940 {
1941 	struct pfctl_rule *r;
1942 	int		error, len = strlen(path);
1943 	int		brace = 0;
1944 
1945 	pf->anchor = rs->anchor;
1946 
1947 	if (path[0])
1948 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1949 	else
1950 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1951 
1952 	if (depth) {
1953 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1954 			brace++;
1955 			if (pf->opts & PF_OPT_VERBOSE)
1956 				printf(" {\n");
1957 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1958 			    (error = pfctl_ruleset_trans(pf,
1959 			    path, rs->anchor, false))) {
1960 				printf("pfctl_load_rulesets: "
1961 				    "pfctl_ruleset_trans %d\n", error);
1962 				goto error;
1963 			}
1964 		} else if (pf->opts & PF_OPT_VERBOSE)
1965 			printf("\n");
1966 
1967 	}
1968 
1969 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1970 		pfctl_optimize_ruleset(pf, rs);
1971 
1972 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1973 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1974 
1975 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1976 			expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
1977 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
1978 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
1979 
1980 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1981 			goto error;
1982 		if (r->anchor) {
1983 			if ((error = pfctl_load_ruleset(pf, path,
1984 			    &r->anchor->ruleset, rs_num, depth + 1)))
1985 				goto error;
1986 		} else if (pf->opts & PF_OPT_VERBOSE)
1987 			printf("\n");
1988 		free(r);
1989 	}
1990 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1991 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1992 		printf("}\n");
1993 	}
1994 	path[len] = '\0';
1995 	return (0);
1996 
1997  error:
1998 	path[len] = '\0';
1999 	return (error);
2000 
2001 }
2002 
2003 int
2004 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
2005 {
2006 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
2007 	char			*name;
2008 	u_int32_t		ticket;
2009 	char			anchor[PF_ANCHOR_NAME_SIZE];
2010 	int			len = strlen(path);
2011 	int			error;
2012 	bool			was_present;
2013 
2014 	/* set up anchor before adding to path for anchor_call */
2015 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2016 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
2017 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
2018 		errx(1, "pfctl_load_rule: strlcpy");
2019 
2020 	if (r->anchor) {
2021 		if (r->anchor->match) {
2022 			if (path[0])
2023 				snprintf(&path[len], MAXPATHLEN - len,
2024 				    "/%s", r->anchor->name);
2025 			else
2026 				snprintf(&path[len], MAXPATHLEN - len,
2027 				    "%s", r->anchor->name);
2028 			name = r->anchor->name;
2029 		} else
2030 			name = r->anchor->path;
2031 	} else
2032 		name = "";
2033 
2034 	was_present = false;
2035 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2036 		if (pfctl_add_pool(pf, &r->rpool, r->af))
2037 			return (1);
2038 		error = pfctl_add_rule(pf->dev, r, anchor, name, ticket,
2039 		    pf->paddr.ticket);
2040 		switch (error) {
2041 		case 0:
2042 			/* things worked, do nothing */
2043 			break;
2044 		case EEXIST:
2045 			/* an identical rule is already present */
2046 			was_present = true;
2047 			break;
2048 		default:
2049 			err(1, "DIOCADDRULENV");
2050 		}
2051 	}
2052 
2053 	if (pf->opts & PF_OPT_VERBOSE) {
2054 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
2055 		print_rule(r, name,
2056 		    pf->opts & PF_OPT_VERBOSE2,
2057 		    pf->opts & PF_OPT_NUMERIC);
2058 		if (was_present)
2059 			printf(" -- rule was already present");
2060 	}
2061 	path[len] = '\0';
2062 	pfctl_clear_pool(&r->rpool);
2063 	return (0);
2064 }
2065 
2066 int
2067 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
2068 {
2069 	if (altqsupport &&
2070 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
2071 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
2072 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
2073 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
2074 				if (errno == ENXIO)
2075 					errx(1, "qtype not configured");
2076 				else if (errno == ENODEV)
2077 					errx(1, "%s: driver does not support "
2078 					    "altq", a->ifname);
2079 				else
2080 					err(1, "DIOCADDALTQ");
2081 			}
2082 		}
2083 		pfaltq_store(&pf->paltq->altq);
2084 	}
2085 	return (0);
2086 }
2087 
2088 int
2089 pfctl_rules(int dev, char *filename, int opts, int optimize,
2090     char *anchorname, struct pfr_buffer *trans)
2091 {
2092 #define ERR(x) do { warn(x); goto _error; } while(0)
2093 #define ERRX(x) do { warnx(x); goto _error; } while(0)
2094 
2095 	struct pfr_buffer	*t, buf;
2096 	struct pfioc_altq	 pa;
2097 	struct pfctl		 pf;
2098 	struct pfctl_ruleset	*rs;
2099 	struct pfctl_eth_ruleset	*ethrs;
2100 	struct pfr_table	 trs;
2101 	char			*path;
2102 	int			 osize;
2103 
2104 	RB_INIT(&pf_anchors);
2105 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
2106 	pf_init_ruleset(&pf_main_anchor.ruleset);
2107 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
2108 
2109 	memset(&pf_eth_main_anchor, 0, sizeof(pf_eth_main_anchor));
2110 	pf_init_eth_ruleset(&pf_eth_main_anchor.ruleset);
2111 	pf_eth_main_anchor.ruleset.anchor = &pf_eth_main_anchor;
2112 
2113 	if (trans == NULL) {
2114 		bzero(&buf, sizeof(buf));
2115 		buf.pfrb_type = PFRB_TRANS;
2116 		t = &buf;
2117 		osize = 0;
2118 	} else {
2119 		t = trans;
2120 		osize = t->pfrb_size;
2121 	}
2122 
2123 	memset(&pa, 0, sizeof(pa));
2124 	pa.version = PFIOC_ALTQ_VERSION;
2125 	memset(&pf, 0, sizeof(pf));
2126 	memset(&trs, 0, sizeof(trs));
2127 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2128 		ERRX("pfctl_rules: calloc");
2129 	if (strlcpy(trs.pfrt_anchor, anchorname,
2130 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
2131 		ERRX("pfctl_rules: strlcpy");
2132 	pf.dev = dev;
2133 	pf.opts = opts;
2134 	pf.optimize = optimize;
2135 	pf.loadopt = loadopt;
2136 
2137 	/* non-brace anchor, create without resolving the path */
2138 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
2139 		ERRX("pfctl_rules: calloc");
2140 	rs = &pf.anchor->ruleset;
2141 	pf_init_ruleset(rs);
2142 	rs->anchor = pf.anchor;
2143 	if (strlcpy(pf.anchor->path, anchorname,
2144 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
2145 		errx(1, "pfctl_rules: strlcpy");
2146 	if (strlcpy(pf.anchor->name, anchorname,
2147 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
2148 		errx(1, "pfctl_rules: strlcpy");
2149 
2150 
2151 	pf.astack[0] = pf.anchor;
2152 	pf.asd = 0;
2153 	if (anchorname[0])
2154 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
2155 	pf.paltq = &pa;
2156 	pf.trans = t;
2157 	pfctl_init_options(&pf);
2158 
2159 	/* Set up ethernet anchor */
2160 	if ((pf.eanchor = calloc(1, sizeof(*pf.eanchor))) == NULL)
2161 		ERRX("pfctl_rules: calloc");
2162 
2163 	if (strlcpy(pf.eanchor->path, anchorname,
2164 	    sizeof(pf.eanchor->path)) >= sizeof(pf.eanchor->path))
2165 		errx(1, "pfctl_rules: strlcpy");
2166 	if (strlcpy(pf.eanchor->name, anchorname,
2167 	    sizeof(pf.eanchor->name)) >= sizeof(pf.eanchor->name))
2168 		errx(1, "pfctl_rules: strlcpy");
2169 
2170 	ethrs = &pf.eanchor->ruleset;
2171 	pf_init_eth_ruleset(ethrs);
2172 	ethrs->anchor = pf.eanchor;
2173 	pf.eastack[0] = pf.eanchor;
2174 
2175 	if ((opts & PF_OPT_NOACTION) == 0) {
2176 		/*
2177 		 * XXX For the time being we need to open transactions for
2178 		 * the main ruleset before parsing, because tables are still
2179 		 * loaded at parse time.
2180 		 */
2181 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor, true))
2182 			ERRX("pfctl_rules");
2183 		if (pf.loadopt & PFCTL_FLAG_ETH)
2184 			pf.eth_ticket = pfctl_get_ticket(t, PF_RULESET_ETH, anchorname);
2185 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
2186 			pa.ticket =
2187 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
2188 		if (pf.loadopt & PFCTL_FLAG_TABLE)
2189 			pf.astack[0]->ruleset.tticket =
2190 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
2191 	}
2192 
2193 	if (parse_config(filename, &pf) < 0) {
2194 		if ((opts & PF_OPT_NOACTION) == 0)
2195 			ERRX("Syntax error in config file: "
2196 			    "pf rules not loaded");
2197 		else
2198 			goto _error;
2199 	}
2200 	if (loadopt & PFCTL_FLAG_OPTION)
2201 		pfctl_adjust_skip_ifaces(&pf);
2202 
2203 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
2204 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
2205 	    (pf.loadopt & PFCTL_FLAG_ETH &&
2206 	    (pfctl_load_eth_ruleset(&pf, path, ethrs, 0))) ||
2207 	    (pf.loadopt & PFCTL_FLAG_NAT &&
2208 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
2209 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
2210 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
2211 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
2212 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
2213 		if ((opts & PF_OPT_NOACTION) == 0)
2214 			ERRX("Unable to load rules into kernel");
2215 		else
2216 			goto _error;
2217 	}
2218 
2219 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
2220 		if (check_commit_altq(dev, opts) != 0)
2221 			ERRX("errors in altq config");
2222 
2223 	/* process "load anchor" directives */
2224 	if (!anchorname[0])
2225 		if (pfctl_load_anchors(dev, &pf, t) == -1)
2226 			ERRX("load anchors");
2227 
2228 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
2229 		if (!anchorname[0])
2230 			if (pfctl_load_options(&pf))
2231 				goto _error;
2232 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
2233 			ERR("DIOCXCOMMIT");
2234 	}
2235 	free(path);
2236 	return (0);
2237 
2238 _error:
2239 	if (trans == NULL) {	/* main ruleset */
2240 		if ((opts & PF_OPT_NOACTION) == 0)
2241 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
2242 				err(1, "DIOCXROLLBACK");
2243 		exit(1);
2244 	} else {		/* sub ruleset */
2245 		free(path);
2246 		return (-1);
2247 	}
2248 
2249 #undef ERR
2250 #undef ERRX
2251 }
2252 
2253 FILE *
2254 pfctl_fopen(const char *name, const char *mode)
2255 {
2256 	struct stat	 st;
2257 	FILE		*fp;
2258 
2259 	fp = fopen(name, mode);
2260 	if (fp == NULL)
2261 		return (NULL);
2262 	if (fstat(fileno(fp), &st)) {
2263 		fclose(fp);
2264 		return (NULL);
2265 	}
2266 	if (S_ISDIR(st.st_mode)) {
2267 		fclose(fp);
2268 		errno = EISDIR;
2269 		return (NULL);
2270 	}
2271 	return (fp);
2272 }
2273 
2274 void
2275 pfctl_init_options(struct pfctl *pf)
2276 {
2277 
2278 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2279 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
2280 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2281 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2282 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
2283 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2284 	pf->timeout[PFTM_SCTP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2285 	pf->timeout[PFTM_SCTP_OPENING] = PFTM_TCP_OPENING_VAL;
2286 	pf->timeout[PFTM_SCTP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2287 	pf->timeout[PFTM_SCTP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2288 	pf->timeout[PFTM_SCTP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2289 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
2290 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
2291 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
2292 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
2293 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
2294 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
2295 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
2296 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
2297 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
2298 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
2299 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
2300 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
2301 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
2302 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
2303 
2304 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
2305 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
2306 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
2307 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
2308 
2309 	pf->debug = PF_DEBUG_URGENT;
2310 	pf->reassemble = 0;
2311 
2312 	pf->syncookies = false;
2313 	pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
2314 	pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
2315 }
2316 
2317 int
2318 pfctl_load_options(struct pfctl *pf)
2319 {
2320 	int i, error = 0;
2321 
2322 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2323 		return (0);
2324 
2325 	/* load limits */
2326 	for (i = 0; i < PF_LIMIT_MAX; i++) {
2327 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
2328 			continue;
2329 		if (pfctl_load_limit(pf, i, pf->limit[i]))
2330 			error = 1;
2331 	}
2332 
2333 	/*
2334 	 * If we've set the limit, but haven't explicitly set adaptive
2335 	 * timeouts, do it now with a start of 60% and end of 120%.
2336 	 */
2337 	if (pf->limit_set[PF_LIMIT_STATES] &&
2338 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
2339 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
2340 		pf->timeout[PFTM_ADAPTIVE_START] =
2341 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
2342 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
2343 		pf->timeout[PFTM_ADAPTIVE_END] =
2344 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
2345 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
2346 	}
2347 
2348 	/* load timeouts */
2349 	for (i = 0; i < PFTM_MAX; i++) {
2350 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
2351 			continue;
2352 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
2353 			error = 1;
2354 	}
2355 
2356 	/* load debug */
2357 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
2358 		if (pfctl_load_debug(pf, pf->debug))
2359 			error = 1;
2360 
2361 	/* load logif */
2362 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
2363 		if (pfctl_load_logif(pf, pf->ifname))
2364 			error = 1;
2365 
2366 	/* load hostid */
2367 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
2368 		if (pfctl_load_hostid(pf, pf->hostid))
2369 			error = 1;
2370 
2371 	/* load reassembly settings */
2372 	if (!(pf->opts & PF_OPT_MERGE) || pf->reass_set)
2373 		if (pfctl_load_reassembly(pf, pf->reassemble))
2374 			error = 1;
2375 
2376 	/* load keepcounters */
2377 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
2378 		error = 1;
2379 
2380 	/* load syncookies settings */
2381 	if (pfctl_load_syncookies(pf, pf->syncookies))
2382 		error = 1;
2383 
2384 	return (error);
2385 }
2386 
2387 int
2388 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
2389 {
2390 	int i;
2391 
2392 
2393 	for (i = 0; pf_limits[i].name; i++) {
2394 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
2395 			pf->limit[pf_limits[i].index] = limit;
2396 			pf->limit_set[pf_limits[i].index] = 1;
2397 			break;
2398 		}
2399 	}
2400 	if (pf_limits[i].name == NULL) {
2401 		warnx("Bad pool name.");
2402 		return (1);
2403 	}
2404 
2405 	if (pf->opts & PF_OPT_VERBOSE)
2406 		printf("set limit %s %d\n", opt, limit);
2407 
2408 	return (0);
2409 }
2410 
2411 int
2412 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
2413 {
2414 	struct pfioc_limit pl;
2415 
2416 	memset(&pl, 0, sizeof(pl));
2417 	pl.index = index;
2418 	pl.limit = limit;
2419 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
2420 		if (errno == EBUSY)
2421 			warnx("Current pool size exceeds requested hard limit");
2422 		else
2423 			warnx("DIOCSETLIMIT");
2424 		return (1);
2425 	}
2426 	return (0);
2427 }
2428 
2429 int
2430 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
2431 {
2432 	int i;
2433 
2434 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2435 		return (0);
2436 
2437 	for (i = 0; pf_timeouts[i].name; i++) {
2438 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
2439 			pf->timeout[pf_timeouts[i].timeout] = seconds;
2440 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
2441 			break;
2442 		}
2443 	}
2444 
2445 	if (pf_timeouts[i].name == NULL) {
2446 		warnx("Bad timeout name.");
2447 		return (1);
2448 	}
2449 
2450 
2451 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
2452 		printf("set timeout %s %d\n", opt, seconds);
2453 
2454 	return (0);
2455 }
2456 
2457 int
2458 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
2459 {
2460 	struct pfioc_tm pt;
2461 
2462 	memset(&pt, 0, sizeof(pt));
2463 	pt.timeout = timeout;
2464 	pt.seconds = seconds;
2465 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
2466 		warnx("DIOCSETTIMEOUT");
2467 		return (1);
2468 	}
2469 	return (0);
2470 }
2471 
2472 int
2473 pfctl_set_reassembly(struct pfctl *pf, int on, int nodf)
2474 {
2475 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2476 		return (0);
2477 
2478 	pf->reass_set = 1;
2479 	if (on) {
2480 		pf->reassemble = PF_REASS_ENABLED;
2481 		if (nodf)
2482 			pf->reassemble |= PF_REASS_NODF;
2483 	} else {
2484 		pf->reassemble = 0;
2485 	}
2486 
2487 	if (pf->opts & PF_OPT_VERBOSE)
2488 		printf("set reassemble %s %s\n", on ? "yes" : "no",
2489 		    nodf ? "no-df" : "");
2490 
2491 	return (0);
2492 }
2493 
2494 int
2495 pfctl_set_optimization(struct pfctl *pf, const char *opt)
2496 {
2497 	const struct pf_hint *hint;
2498 	int i, r;
2499 
2500 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2501 		return (0);
2502 
2503 	for (i = 0; pf_hints[i].name; i++)
2504 		if (strcasecmp(opt, pf_hints[i].name) == 0)
2505 			break;
2506 
2507 	hint = pf_hints[i].hint;
2508 	if (hint == NULL) {
2509 		warnx("invalid state timeouts optimization");
2510 		return (1);
2511 	}
2512 
2513 	for (i = 0; hint[i].name; i++)
2514 		if ((r = pfctl_set_timeout(pf, hint[i].name,
2515 		    hint[i].timeout, 1)))
2516 			return (r);
2517 
2518 	if (pf->opts & PF_OPT_VERBOSE)
2519 		printf("set optimization %s\n", opt);
2520 
2521 	return (0);
2522 }
2523 
2524 int
2525 pfctl_set_logif(struct pfctl *pf, char *ifname)
2526 {
2527 
2528 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2529 		return (0);
2530 
2531 	if (!strcmp(ifname, "none")) {
2532 		free(pf->ifname);
2533 		pf->ifname = NULL;
2534 	} else {
2535 		pf->ifname = strdup(ifname);
2536 		if (!pf->ifname)
2537 			errx(1, "pfctl_set_logif: strdup");
2538 	}
2539 	pf->ifname_set = 1;
2540 
2541 	if (pf->opts & PF_OPT_VERBOSE)
2542 		printf("set loginterface %s\n", ifname);
2543 
2544 	return (0);
2545 }
2546 
2547 int
2548 pfctl_load_logif(struct pfctl *pf, char *ifname)
2549 {
2550 	struct pfioc_if pi;
2551 
2552 	memset(&pi, 0, sizeof(pi));
2553 	if (ifname && strlcpy(pi.ifname, ifname,
2554 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
2555 		warnx("pfctl_load_logif: strlcpy");
2556 		return (1);
2557 	}
2558 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
2559 		warnx("DIOCSETSTATUSIF");
2560 		return (1);
2561 	}
2562 	return (0);
2563 }
2564 
2565 int
2566 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2567 {
2568 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2569 		return (0);
2570 
2571 	HTONL(hostid);
2572 
2573 	pf->hostid = hostid;
2574 	pf->hostid_set = 1;
2575 
2576 	if (pf->opts & PF_OPT_VERBOSE)
2577 		printf("set hostid 0x%08x\n", ntohl(hostid));
2578 
2579 	return (0);
2580 }
2581 
2582 int
2583 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2584 {
2585 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2586 		warnx("DIOCSETHOSTID");
2587 		return (1);
2588 	}
2589 	return (0);
2590 }
2591 
2592 int
2593 pfctl_load_reassembly(struct pfctl *pf, u_int32_t reassembly)
2594 {
2595 	if (ioctl(dev, DIOCSETREASS, &reassembly)) {
2596 		warnx("DIOCSETREASS");
2597 		return (1);
2598 	}
2599 	return (0);
2600 }
2601 
2602 int
2603 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2604 {
2605 	struct pfctl_syncookies	cookies;
2606 
2607 	bzero(&cookies, sizeof(cookies));
2608 
2609 	cookies.mode = val;
2610 	cookies.lowwater = pf->syncookieswat[0];
2611 	cookies.highwater = pf->syncookieswat[1];
2612 
2613 	if (pfctl_set_syncookies(dev, &cookies)) {
2614 		warnx("DIOCSETSYNCOOKIES");
2615 		return (1);
2616 	}
2617 	return (0);
2618 }
2619 
2620 int
2621 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2622 {
2623 	if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2624 		warnx("syncookies start/end only apply to adaptive");
2625 		return (1);
2626 	}
2627 	if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2628 		if (!w->hi)
2629 			w->hi = PF_SYNCOOKIES_HIWATPCT;
2630 		if (!w->lo)
2631 			w->lo = w->hi / 2;
2632 		if (w->lo >= w->hi) {
2633 			warnx("start must be higher than end");
2634 			return (1);
2635 		}
2636 		pf->syncookieswat[0] = w->lo;
2637 		pf->syncookieswat[1] = w->hi;
2638 		pf->syncookieswat_set = 1;
2639 	}
2640 
2641 	if (pf->opts & PF_OPT_VERBOSE) {
2642 		if (val == PF_SYNCOOKIES_NEVER)
2643 			printf("set syncookies never\n");
2644 		else if (val == PF_SYNCOOKIES_ALWAYS)
2645 			printf("set syncookies always\n");
2646 		else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2647 			if (pf->syncookieswat_set)
2648 				printf("set syncookies adaptive (start %u%%, "
2649 				    "end %u%%)\n", pf->syncookieswat[1],
2650 				    pf->syncookieswat[0]);
2651 			else
2652 				printf("set syncookies adaptive\n");
2653 		} else {        /* cannot happen */
2654 			warnx("king bula ate all syncookies");
2655 			return (1);
2656 		}
2657 	}
2658 
2659 	pf->syncookies = val;
2660 	return (0);
2661 }
2662 
2663 int
2664 pfctl_set_debug(struct pfctl *pf, char *d)
2665 {
2666 	u_int32_t	level;
2667 
2668 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2669 		return (0);
2670 
2671 	if (!strcmp(d, "none"))
2672 		pf->debug = PF_DEBUG_NONE;
2673 	else if (!strcmp(d, "urgent"))
2674 		pf->debug = PF_DEBUG_URGENT;
2675 	else if (!strcmp(d, "misc"))
2676 		pf->debug = PF_DEBUG_MISC;
2677 	else if (!strcmp(d, "loud"))
2678 		pf->debug = PF_DEBUG_NOISY;
2679 	else {
2680 		warnx("unknown debug level \"%s\"", d);
2681 		return (-1);
2682 	}
2683 
2684 	pf->debug_set = 1;
2685 	level = pf->debug;
2686 
2687 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2688 		if (ioctl(dev, DIOCSETDEBUG, &level))
2689 			err(1, "DIOCSETDEBUG");
2690 
2691 	if (pf->opts & PF_OPT_VERBOSE)
2692 		printf("set debug %s\n", d);
2693 
2694 	return (0);
2695 }
2696 
2697 int
2698 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2699 {
2700 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
2701 		warnx("DIOCSETDEBUG");
2702 		return (1);
2703 	}
2704 	return (0);
2705 }
2706 
2707 int
2708 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2709 {
2710 	struct pfioc_iface	pi;
2711 	struct node_host	*h = NULL, *n = NULL;
2712 
2713 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2714 		return (0);
2715 
2716 	bzero(&pi, sizeof(pi));
2717 
2718 	pi.pfiio_flags = flags;
2719 
2720 	/* Make sure our cache matches the kernel. If we set or clear the flag
2721 	 * for a group this applies to all members. */
2722 	h = ifa_grouplookup(ifname, 0);
2723 	for (n = h; n != NULL; n = n->next)
2724 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2725 
2726 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2727 	    sizeof(pi.pfiio_name))
2728 		errx(1, "pfctl_set_interface_flags: strlcpy");
2729 
2730 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2731 		if (how == 0) {
2732 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2733 				err(1, "DIOCCLRIFFLAG");
2734 		} else {
2735 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2736 				err(1, "DIOCSETIFFLAG");
2737 			pfctl_check_skip_ifaces(ifname);
2738 		}
2739 	}
2740 	return (0);
2741 }
2742 
2743 void
2744 pfctl_debug(int dev, u_int32_t level, int opts)
2745 {
2746 	if (ioctl(dev, DIOCSETDEBUG, &level))
2747 		err(1, "DIOCSETDEBUG");
2748 	if ((opts & PF_OPT_QUIET) == 0) {
2749 		fprintf(stderr, "debug level set to '");
2750 		switch (level) {
2751 		case PF_DEBUG_NONE:
2752 			fprintf(stderr, "none");
2753 			break;
2754 		case PF_DEBUG_URGENT:
2755 			fprintf(stderr, "urgent");
2756 			break;
2757 		case PF_DEBUG_MISC:
2758 			fprintf(stderr, "misc");
2759 			break;
2760 		case PF_DEBUG_NOISY:
2761 			fprintf(stderr, "loud");
2762 			break;
2763 		default:
2764 			fprintf(stderr, "<invalid>");
2765 			break;
2766 		}
2767 		fprintf(stderr, "'\n");
2768 	}
2769 }
2770 
2771 int
2772 pfctl_test_altqsupport(int dev, int opts)
2773 {
2774 	struct pfioc_altq pa;
2775 
2776 	pa.version = PFIOC_ALTQ_VERSION;
2777 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2778 		if (errno == ENODEV) {
2779 			if (opts & PF_OPT_VERBOSE)
2780 				fprintf(stderr, "No ALTQ support in kernel\n"
2781 				    "ALTQ related functions disabled\n");
2782 			return (0);
2783 		} else
2784 			err(1, "DIOCGETALTQS");
2785 	}
2786 	return (1);
2787 }
2788 
2789 int
2790 pfctl_show_anchors(int dev, int opts, char *anchorname)
2791 {
2792 	struct pfioc_ruleset	 pr;
2793 	u_int32_t		 mnr, nr;
2794 
2795 	memset(&pr, 0, sizeof(pr));
2796 	memcpy(pr.path, anchorname, sizeof(pr.path));
2797 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2798 		if (errno == EINVAL)
2799 			fprintf(stderr, "Anchor '%s' not found.\n",
2800 			    anchorname);
2801 		else
2802 			err(1, "DIOCGETRULESETS");
2803 		return (-1);
2804 	}
2805 	mnr = pr.nr;
2806 	for (nr = 0; nr < mnr; ++nr) {
2807 		char sub[MAXPATHLEN];
2808 
2809 		pr.nr = nr;
2810 		if (ioctl(dev, DIOCGETRULESET, &pr))
2811 			err(1, "DIOCGETRULESET");
2812 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2813 			continue;
2814 		sub[0] = 0;
2815 		if (pr.path[0]) {
2816 			strlcat(sub, pr.path, sizeof(sub));
2817 			strlcat(sub, "/", sizeof(sub));
2818 		}
2819 		strlcat(sub, pr.name, sizeof(sub));
2820 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2821 			printf("  %s\n", sub);
2822 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2823 			return (-1);
2824 	}
2825 	return (0);
2826 }
2827 
2828 int
2829 pfctl_show_eth_anchors(int dev, int opts, char *anchorname)
2830 {
2831 	struct pfctl_eth_rulesets_info ri;
2832 	struct pfctl_eth_ruleset_info rs;
2833 	int ret;
2834 
2835 	if ((ret = pfctl_get_eth_rulesets_info(dev, &ri, anchorname)) != 0) {
2836 		if (ret == ENOENT)
2837 			fprintf(stderr, "Anchor '%s' not found.\n",
2838 			    anchorname);
2839 		else
2840 			err(1, "DIOCGETETHRULESETS");
2841 		return (-1);
2842 	}
2843 
2844 	for (int nr = 0; nr < ri.nr; nr++) {
2845 		char sub[MAXPATHLEN];
2846 
2847 		if (pfctl_get_eth_ruleset(dev, anchorname, nr, &rs) != 0)
2848 			err(1, "DIOCGETETHRULESET");
2849 
2850 		if (!strcmp(rs.name, PF_RESERVED_ANCHOR))
2851 			continue;
2852 		sub[0] = 0;
2853 		if (rs.path[0]) {
2854 			strlcat(sub, rs.path, sizeof(sub));
2855 			strlcat(sub, "/", sizeof(sub));
2856 		}
2857 		strlcat(sub, rs.name, sizeof(sub));
2858 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2859 			printf("  %s\n", sub);
2860 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_eth_anchors(dev, opts, sub))
2861 			return (-1);
2862 	}
2863 	return (0);
2864 }
2865 
2866 const char *
2867 pfctl_lookup_option(char *cmd, const char * const *list)
2868 {
2869 	if (cmd != NULL && *cmd)
2870 		for (; *list; list++)
2871 			if (!strncmp(cmd, *list, strlen(cmd)))
2872 				return (*list);
2873 	return (NULL);
2874 }
2875 
2876 int
2877 main(int argc, char *argv[])
2878 {
2879 	int	 error = 0;
2880 	int	 ch;
2881 	int	 mode = O_RDONLY;
2882 	int	 opts = 0;
2883 	int	 optimize = PF_OPTIMIZE_BASIC;
2884 	char	 anchorname[MAXPATHLEN];
2885 	char	*path;
2886 
2887 	if (argc < 2)
2888 		usage();
2889 
2890 	while ((ch = getopt(argc, argv,
2891 	    "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2892 		switch (ch) {
2893 		case 'a':
2894 			anchoropt = optarg;
2895 			break;
2896 		case 'd':
2897 			opts |= PF_OPT_DISABLE;
2898 			mode = O_RDWR;
2899 			break;
2900 		case 'D':
2901 			if (pfctl_cmdline_symset(optarg) < 0)
2902 				warnx("could not parse macro definition %s",
2903 				    optarg);
2904 			break;
2905 		case 'e':
2906 			opts |= PF_OPT_ENABLE;
2907 			mode = O_RDWR;
2908 			break;
2909 		case 'q':
2910 			opts |= PF_OPT_QUIET;
2911 			break;
2912 		case 'F':
2913 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2914 			if (clearopt == NULL) {
2915 				warnx("Unknown flush modifier '%s'", optarg);
2916 				usage();
2917 			}
2918 			mode = O_RDWR;
2919 			break;
2920 		case 'i':
2921 			ifaceopt = optarg;
2922 			break;
2923 		case 'k':
2924 			if (state_killers >= 2) {
2925 				warnx("can only specify -k twice");
2926 				usage();
2927 				/* NOTREACHED */
2928 			}
2929 			state_kill[state_killers++] = optarg;
2930 			mode = O_RDWR;
2931 			break;
2932 		case 'K':
2933 			if (src_node_killers >= 2) {
2934 				warnx("can only specify -K twice");
2935 				usage();
2936 				/* NOTREACHED */
2937 			}
2938 			src_node_kill[src_node_killers++] = optarg;
2939 			mode = O_RDWR;
2940 			break;
2941 		case 'm':
2942 			opts |= PF_OPT_MERGE;
2943 			break;
2944 		case 'M':
2945 			opts |= PF_OPT_KILLMATCH;
2946 			break;
2947 		case 'n':
2948 			opts |= PF_OPT_NOACTION;
2949 			break;
2950 		case 'N':
2951 			loadopt |= PFCTL_FLAG_NAT;
2952 			break;
2953 		case 'r':
2954 			opts |= PF_OPT_USEDNS;
2955 			break;
2956 		case 'f':
2957 			rulesopt = optarg;
2958 			mode = O_RDWR;
2959 			break;
2960 		case 'g':
2961 			opts |= PF_OPT_DEBUG;
2962 			break;
2963 		case 'A':
2964 			loadopt |= PFCTL_FLAG_ALTQ;
2965 			break;
2966 		case 'R':
2967 			loadopt |= PFCTL_FLAG_FILTER;
2968 			break;
2969 		case 'o':
2970 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2971 			if (optiopt == NULL) {
2972 				warnx("Unknown optimization '%s'", optarg);
2973 				usage();
2974 			}
2975 			opts |= PF_OPT_OPTIMIZE;
2976 			break;
2977 		case 'O':
2978 			loadopt |= PFCTL_FLAG_OPTION;
2979 			break;
2980 		case 'p':
2981 			pf_device = optarg;
2982 			break;
2983 		case 'P':
2984 			opts |= PF_OPT_NUMERIC;
2985 			break;
2986 		case 's':
2987 			showopt = pfctl_lookup_option(optarg, showopt_list);
2988 			if (showopt == NULL) {
2989 				warnx("Unknown show modifier '%s'", optarg);
2990 				usage();
2991 			}
2992 			break;
2993 		case 't':
2994 			tableopt = optarg;
2995 			break;
2996 		case 'T':
2997 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2998 			if (tblcmdopt == NULL) {
2999 				warnx("Unknown table command '%s'", optarg);
3000 				usage();
3001 			}
3002 			break;
3003 		case 'v':
3004 			if (opts & PF_OPT_VERBOSE)
3005 				opts |= PF_OPT_VERBOSE2;
3006 			opts |= PF_OPT_VERBOSE;
3007 			break;
3008 		case 'x':
3009 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
3010 			if (debugopt == NULL) {
3011 				warnx("Unknown debug level '%s'", optarg);
3012 				usage();
3013 			}
3014 			mode = O_RDWR;
3015 			break;
3016 		case 'z':
3017 			opts |= PF_OPT_CLRRULECTRS;
3018 			mode = O_RDWR;
3019 			break;
3020 		case 'h':
3021 			/* FALLTHROUGH */
3022 		default:
3023 			usage();
3024 			/* NOTREACHED */
3025 		}
3026 	}
3027 
3028 	if (tblcmdopt != NULL) {
3029 		argc -= optind;
3030 		argv += optind;
3031 		ch = *tblcmdopt;
3032 		if (ch == 'l') {
3033 			loadopt |= PFCTL_FLAG_TABLE;
3034 			tblcmdopt = NULL;
3035 		} else
3036 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
3037 	} else if (argc != optind) {
3038 		warnx("unknown command line argument: %s ...", argv[optind]);
3039 		usage();
3040 		/* NOTREACHED */
3041 	}
3042 	if (loadopt == 0)
3043 		loadopt = ~0;
3044 
3045 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
3046 		errx(1, "pfctl: calloc");
3047 	memset(anchorname, 0, sizeof(anchorname));
3048 	if (anchoropt != NULL) {
3049 		int len = strlen(anchoropt);
3050 
3051 		if (len >= 1 && anchoropt[len - 1] == '*') {
3052 			if (len >= 2 && anchoropt[len - 2] == '/')
3053 				anchoropt[len - 2] = '\0';
3054 			else
3055 				anchoropt[len - 1] = '\0';
3056 			opts |= PF_OPT_RECURSE;
3057 		}
3058 		if (strlcpy(anchorname, anchoropt,
3059 		    sizeof(anchorname)) >= sizeof(anchorname))
3060 			errx(1, "anchor name '%s' too long",
3061 			    anchoropt);
3062 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE|PFCTL_FLAG_ETH;
3063 	}
3064 
3065 	if ((opts & PF_OPT_NOACTION) == 0) {
3066 		dev = open(pf_device, mode);
3067 		if (dev == -1)
3068 			err(1, "%s", pf_device);
3069 		altqsupport = pfctl_test_altqsupport(dev, opts);
3070 	} else {
3071 		dev = open(pf_device, O_RDONLY);
3072 		if (dev >= 0)
3073 			opts |= PF_OPT_DUMMYACTION;
3074 		/* turn off options */
3075 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
3076 		clearopt = showopt = debugopt = NULL;
3077 #if !defined(ENABLE_ALTQ)
3078 		altqsupport = 0;
3079 #else
3080 		altqsupport = 1;
3081 #endif
3082 	}
3083 	pfh = pfctl_open(pf_device);
3084 	if (pfh == NULL)
3085 		err(1, "Failed to open netlink");
3086 
3087 	if (opts & PF_OPT_DISABLE)
3088 		if (pfctl_disable(dev, opts))
3089 			error = 1;
3090 
3091 	if (showopt != NULL) {
3092 		switch (*showopt) {
3093 		case 'A':
3094 			pfctl_show_anchors(dev, opts, anchorname);
3095 			if (opts & PF_OPT_VERBOSE2)
3096 				printf("Ethernet:\n");
3097 			pfctl_show_eth_anchors(dev, opts, anchorname);
3098 			break;
3099 		case 'r':
3100 			pfctl_load_fingerprints(dev, opts);
3101 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
3102 			    anchorname, 0, 0);
3103 			break;
3104 		case 'l':
3105 			pfctl_load_fingerprints(dev, opts);
3106 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
3107 			    anchorname, 0, 0);
3108 			break;
3109 		case 'n':
3110 			pfctl_load_fingerprints(dev, opts);
3111 			pfctl_show_nat(dev, path, opts, anchorname, 0);
3112 			break;
3113 		case 'q':
3114 			pfctl_show_altq(dev, ifaceopt, opts,
3115 			    opts & PF_OPT_VERBOSE2);
3116 			break;
3117 		case 's':
3118 			pfctl_show_states(dev, ifaceopt, opts);
3119 			break;
3120 		case 'S':
3121 			pfctl_show_src_nodes(dev, opts);
3122 			break;
3123 		case 'i':
3124 			pfctl_show_status(dev, opts);
3125 			break;
3126 		case 'R':
3127 			error = pfctl_show_running(dev);
3128 			break;
3129 		case 't':
3130 			pfctl_show_timeouts(dev, opts);
3131 			break;
3132 		case 'm':
3133 			pfctl_show_limits(dev, opts);
3134 			break;
3135 		case 'e':
3136 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0,
3137 			    0);
3138 			break;
3139 		case 'a':
3140 			opts |= PF_OPT_SHOWALL;
3141 			pfctl_load_fingerprints(dev, opts);
3142 
3143 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0,
3144 			    0);
3145 
3146 			pfctl_show_nat(dev, path, opts, anchorname, 0);
3147 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0, 0);
3148 			pfctl_show_altq(dev, ifaceopt, opts, 0);
3149 			pfctl_show_states(dev, ifaceopt, opts);
3150 			pfctl_show_src_nodes(dev, opts);
3151 			pfctl_show_status(dev, opts);
3152 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0, 0);
3153 			pfctl_show_timeouts(dev, opts);
3154 			pfctl_show_limits(dev, opts);
3155 			pfctl_show_tables(anchorname, opts);
3156 			pfctl_show_fingerprints(opts);
3157 			break;
3158 		case 'T':
3159 			pfctl_show_tables(anchorname, opts);
3160 			break;
3161 		case 'o':
3162 			pfctl_load_fingerprints(dev, opts);
3163 			pfctl_show_fingerprints(opts);
3164 			break;
3165 		case 'I':
3166 			pfctl_show_ifaces(ifaceopt, opts);
3167 			break;
3168 		case 'c':
3169 			pfctl_show_creators(opts);
3170 			break;
3171 		}
3172 	}
3173 
3174 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL) {
3175 		pfctl_show_eth_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
3176 		    anchorname, 0, 0);
3177 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
3178 		    anchorname, 0, 0);
3179 	}
3180 
3181 	if (clearopt != NULL) {
3182 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
3183 			errx(1, "anchor names beginning with '_' cannot "
3184 			    "be modified from the command line");
3185 
3186 		switch (*clearopt) {
3187 		case 'e':
3188 			pfctl_flush_eth_rules(dev, opts, anchorname);
3189 			break;
3190 		case 'r':
3191 			pfctl_flush_rules(dev, opts, anchorname);
3192 			break;
3193 		case 'n':
3194 			pfctl_flush_nat(dev, opts, anchorname);
3195 			break;
3196 		case 'q':
3197 			pfctl_clear_altq(dev, opts);
3198 			break;
3199 		case 's':
3200 			pfctl_clear_iface_states(dev, ifaceopt, opts);
3201 			break;
3202 		case 'S':
3203 			pfctl_clear_src_nodes(dev, opts);
3204 			break;
3205 		case 'i':
3206 			pfctl_clear_stats(dev, opts);
3207 			break;
3208 		case 'a':
3209 			pfctl_flush_eth_rules(dev, opts, anchorname);
3210 			pfctl_flush_rules(dev, opts, anchorname);
3211 			pfctl_flush_nat(dev, opts, anchorname);
3212 			pfctl_clear_tables(anchorname, opts);
3213 			if (!*anchorname) {
3214 				pfctl_clear_altq(dev, opts);
3215 				pfctl_clear_iface_states(dev, ifaceopt, opts);
3216 				pfctl_clear_src_nodes(dev, opts);
3217 				pfctl_clear_stats(dev, opts);
3218 				pfctl_clear_fingerprints(dev, opts);
3219 				pfctl_clear_interface_flags(dev, opts);
3220 			}
3221 			break;
3222 		case 'o':
3223 			pfctl_clear_fingerprints(dev, opts);
3224 			break;
3225 		case 'T':
3226 			pfctl_clear_tables(anchorname, opts);
3227 			break;
3228 		}
3229 	}
3230 	if (state_killers) {
3231 		if (!strcmp(state_kill[0], "label"))
3232 			pfctl_label_kill_states(dev, ifaceopt, opts);
3233 		else if (!strcmp(state_kill[0], "id"))
3234 			pfctl_id_kill_states(dev, ifaceopt, opts);
3235 		else if (!strcmp(state_kill[0], "gateway"))
3236 			pfctl_gateway_kill_states(dev, ifaceopt, opts);
3237 		else
3238 			pfctl_net_kill_states(dev, ifaceopt, opts);
3239 	}
3240 
3241 	if (src_node_killers)
3242 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
3243 
3244 	if (tblcmdopt != NULL) {
3245 		error = pfctl_command_tables(argc, argv, tableopt,
3246 		    tblcmdopt, rulesopt, anchorname, opts);
3247 		rulesopt = NULL;
3248 	}
3249 	if (optiopt != NULL) {
3250 		switch (*optiopt) {
3251 		case 'n':
3252 			optimize = 0;
3253 			break;
3254 		case 'b':
3255 			optimize |= PF_OPTIMIZE_BASIC;
3256 			break;
3257 		case 'o':
3258 		case 'p':
3259 			optimize |= PF_OPTIMIZE_PROFILE;
3260 			break;
3261 		}
3262 	}
3263 
3264 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
3265 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
3266 		if (pfctl_get_skip_ifaces())
3267 			error = 1;
3268 
3269 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
3270 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
3271 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
3272 			error = 1;
3273 
3274 	if (rulesopt != NULL) {
3275 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
3276 			errx(1, "anchor names beginning with '_' cannot "
3277 			    "be modified from the command line");
3278 		if (pfctl_rules(dev, rulesopt, opts, optimize,
3279 		    anchorname, NULL))
3280 			error = 1;
3281 		else if (!(opts & PF_OPT_NOACTION) &&
3282 		    (loadopt & PFCTL_FLAG_TABLE))
3283 			warn_namespace_collision(NULL);
3284 	}
3285 
3286 	if (opts & PF_OPT_ENABLE)
3287 		if (pfctl_enable(dev, opts))
3288 			error = 1;
3289 
3290 	if (debugopt != NULL) {
3291 		switch (*debugopt) {
3292 		case 'n':
3293 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
3294 			break;
3295 		case 'u':
3296 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
3297 			break;
3298 		case 'm':
3299 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
3300 			break;
3301 		case 'l':
3302 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
3303 			break;
3304 		}
3305 	}
3306 
3307 	exit(error);
3308 }
3309