xref: /freebsd/sbin/pfctl/pfctl.c (revision eec4f5c034f649e873396125ec8d39826eb65135)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #define PFIOC_USE_LATEST
40 
41 #include <sys/types.h>
42 #include <sys/ioctl.h>
43 #include <sys/nv.h>
44 #include <sys/socket.h>
45 #include <sys/stat.h>
46 #include <sys/endian.h>
47 
48 #include <net/if.h>
49 #include <netinet/in.h>
50 #include <net/pfvar.h>
51 #include <arpa/inet.h>
52 #include <net/altq/altq.h>
53 #include <sys/sysctl.h>
54 
55 #include <err.h>
56 #include <errno.h>
57 #include <fcntl.h>
58 #include <libpfctl.h>
59 #include <limits.h>
60 #include <netdb.h>
61 #include <stdint.h>
62 #include <stdio.h>
63 #include <stdlib.h>
64 #include <string.h>
65 #include <unistd.h>
66 
67 #include "pfctl_parser.h"
68 #include "pfctl.h"
69 
70 void	 usage(void);
71 int	 pfctl_enable(int, int);
72 int	 pfctl_disable(int, int);
73 int	 pfctl_clear_stats(int, int);
74 int	 pfctl_get_skip_ifaces(void);
75 int	 pfctl_check_skip_ifaces(char *);
76 int	 pfctl_adjust_skip_ifaces(struct pfctl *);
77 int	 pfctl_clear_interface_flags(int, int);
78 int	 pfctl_flush_eth_rules(int, int, char *);
79 int	 pfctl_flush_rules(int, int, char *);
80 int	 pfctl_flush_nat(int, int, char *);
81 int	 pfctl_clear_altq(int, int);
82 int	 pfctl_clear_src_nodes(int, int);
83 int	 pfctl_clear_iface_states(int, const char *, int);
84 void	 pfctl_addrprefix(char *, struct pf_addr *);
85 int	 pfctl_kill_src_nodes(int, const char *, int);
86 int	 pfctl_net_kill_states(int, const char *, int);
87 int	 pfctl_gateway_kill_states(int, const char *, int);
88 int	 pfctl_label_kill_states(int, const char *, int);
89 int	 pfctl_id_kill_states(int, const char *, int);
90 void	 pfctl_init_options(struct pfctl *);
91 int	 pfctl_load_options(struct pfctl *);
92 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
93 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
94 int	 pfctl_load_debug(struct pfctl *, unsigned int);
95 int	 pfctl_load_logif(struct pfctl *, char *);
96 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
97 int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
98 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
99 	    char *);
100 void	 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *, int);
101 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
102 int	 pfctl_show_eth_rules(int, char *, int, enum pfctl_show, char *, int);
103 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
104 int	 pfctl_show_nat(int, char *, int, char *, int);
105 int	 pfctl_show_src_nodes(int, int);
106 int	 pfctl_show_states(int, const char *, int);
107 int	 pfctl_show_status(int, int);
108 int	 pfctl_show_running(int);
109 int	 pfctl_show_timeouts(int, int);
110 int	 pfctl_show_limits(int, int);
111 void	 pfctl_debug(int, u_int32_t, int);
112 int	 pfctl_test_altqsupport(int, int);
113 int	 pfctl_show_anchors(int, int, char *);
114 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *, bool);
115 int	 pfctl_eth_ruleset_trans(struct pfctl *, char *,
116 	    struct pfctl_eth_anchor *);
117 int	 pfctl_load_eth_ruleset(struct pfctl *, char *,
118 	    struct pfctl_eth_ruleset *, int);
119 int	 pfctl_load_eth_rule(struct pfctl *, char *, struct pfctl_eth_rule *,
120 	    int);
121 int	 pfctl_load_ruleset(struct pfctl *, char *,
122 		struct pfctl_ruleset *, int, int);
123 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
124 const char	*pfctl_lookup_option(char *, const char * const *);
125 
126 static struct pfctl_anchor_global	 pf_anchors;
127 struct pfctl_anchor	 pf_main_anchor;
128 struct pfctl_eth_anchor	 pf_eth_main_anchor;
129 static struct pfr_buffer skip_b;
130 
131 static const char	*clearopt;
132 static char		*rulesopt;
133 static const char	*showopt;
134 static const char	*debugopt;
135 static char		*anchoropt;
136 static const char	*optiopt = NULL;
137 static const char	*pf_device = "/dev/pf";
138 static char		*ifaceopt;
139 static char		*tableopt;
140 static const char	*tblcmdopt;
141 static int		 src_node_killers;
142 static char		*src_node_kill[2];
143 static int		 state_killers;
144 static char		*state_kill[2];
145 int			 loadopt;
146 int			 altqsupport;
147 
148 int			 dev = -1;
149 static int		 first_title = 1;
150 static int		 labels = 0;
151 
152 #define INDENT(d, o)	do {						\
153 				if (o) {				\
154 					int i;				\
155 					for (i=0; i < d; i++)		\
156 						printf("  ");		\
157 				}					\
158 			} while (0);					\
159 
160 
161 static const struct {
162 	const char	*name;
163 	int		index;
164 } pf_limits[] = {
165 	{ "states",		PF_LIMIT_STATES },
166 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
167 	{ "frags",		PF_LIMIT_FRAGS },
168 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
169 	{ NULL,			0 }
170 };
171 
172 struct pf_hint {
173 	const char	*name;
174 	int		timeout;
175 };
176 static const struct pf_hint pf_hint_normal[] = {
177 	{ "tcp.first",		2 * 60 },
178 	{ "tcp.opening",	30 },
179 	{ "tcp.established",	24 * 60 * 60 },
180 	{ "tcp.closing",	15 * 60 },
181 	{ "tcp.finwait",	45 },
182 	{ "tcp.closed",		90 },
183 	{ "tcp.tsdiff",		30 },
184 	{ NULL,			0 }
185 };
186 static const struct pf_hint pf_hint_satellite[] = {
187 	{ "tcp.first",		3 * 60 },
188 	{ "tcp.opening",	30 + 5 },
189 	{ "tcp.established",	24 * 60 * 60 },
190 	{ "tcp.closing",	15 * 60 + 5 },
191 	{ "tcp.finwait",	45 + 5 },
192 	{ "tcp.closed",		90 + 5 },
193 	{ "tcp.tsdiff",		60 },
194 	{ NULL,			0 }
195 };
196 static const struct pf_hint pf_hint_conservative[] = {
197 	{ "tcp.first",		60 * 60 },
198 	{ "tcp.opening",	15 * 60 },
199 	{ "tcp.established",	5 * 24 * 60 * 60 },
200 	{ "tcp.closing",	60 * 60 },
201 	{ "tcp.finwait",	10 * 60 },
202 	{ "tcp.closed",		3 * 60 },
203 	{ "tcp.tsdiff",		60 },
204 	{ NULL,			0 }
205 };
206 static const struct pf_hint pf_hint_aggressive[] = {
207 	{ "tcp.first",		30 },
208 	{ "tcp.opening",	5 },
209 	{ "tcp.established",	5 * 60 * 60 },
210 	{ "tcp.closing",	60 },
211 	{ "tcp.finwait",	30 },
212 	{ "tcp.closed",		30 },
213 	{ "tcp.tsdiff",		10 },
214 	{ NULL,			0 }
215 };
216 
217 static const struct {
218 	const char *name;
219 	const struct pf_hint *hint;
220 } pf_hints[] = {
221 	{ "normal",		pf_hint_normal },
222 	{ "satellite",		pf_hint_satellite },
223 	{ "high-latency",	pf_hint_satellite },
224 	{ "conservative",	pf_hint_conservative },
225 	{ "aggressive",		pf_hint_aggressive },
226 	{ NULL,			NULL }
227 };
228 
229 static const char * const clearopt_list[] = {
230 	"nat", "queue", "rules", "Sources",
231 	"states", "info", "Tables", "osfp", "all",
232 	"ethernet", NULL
233 };
234 
235 static const char * const showopt_list[] = {
236 	"ether", "nat", "queue", "rules", "Anchors", "Sources", "states",
237 	"info", "Interfaces", "labels", "timeouts", "memory", "Tables",
238 	"osfp", "Running", "all", NULL
239 };
240 
241 static const char * const tblcmdopt_list[] = {
242 	"kill", "flush", "add", "delete", "load", "replace", "show",
243 	"test", "zero", "expire", NULL
244 };
245 
246 static const char * const debugopt_list[] = {
247 	"none", "urgent", "misc", "loud", NULL
248 };
249 
250 static const char * const optiopt_list[] = {
251 	"none", "basic", "profile", NULL
252 };
253 
254 void
255 usage(void)
256 {
257 	extern char *__progname;
258 
259 	fprintf(stderr,
260 "usage: %s [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
261 	"\t[-f file] [-i interface] [-K host | network]\n"
262 	"\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
263 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
264 	    __progname);
265 
266 	exit(1);
267 }
268 
269 /*
270  * Cache protocol number to name translations.
271  *
272  * Translation is performed a lot e.g., when dumping states and
273  * getprotobynumber is incredibly expensive.
274  *
275  * Note from the getprotobynumber(3) manpage:
276  * <quote>
277  * These functions use a thread-specific data space; if the data is needed
278  * for future use, it should be copied before any subsequent calls overwrite
279  * it.  Only the Internet protocols are currently understood.
280  * </quote>
281  *
282  * Consequently we only cache the name and strdup it for safety.
283  *
284  * At the time of writing this comment the last entry in /etc/protocols is:
285  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
286  */
287 const char *
288 pfctl_proto2name(int proto)
289 {
290 	static const char *pfctl_proto_cache[259];
291 	struct protoent *p;
292 
293 	if (proto >= nitems(pfctl_proto_cache)) {
294 		p = getprotobynumber(proto);
295 		if (p == NULL) {
296 			return (NULL);
297 		}
298 		return (p->p_name);
299 	}
300 
301 	if (pfctl_proto_cache[proto] == NULL) {
302 		p = getprotobynumber(proto);
303 		if (p == NULL) {
304 			return (NULL);
305 		}
306 		pfctl_proto_cache[proto] = strdup(p->p_name);
307 	}
308 
309 	return (pfctl_proto_cache[proto]);
310 }
311 
312 int
313 pfctl_enable(int dev, int opts)
314 {
315 	if (ioctl(dev, DIOCSTART)) {
316 		if (errno == EEXIST)
317 			errx(1, "pf already enabled");
318 		else if (errno == ESRCH)
319 			errx(1, "pfil registeration failed");
320 		else
321 			err(1, "DIOCSTART");
322 	}
323 	if ((opts & PF_OPT_QUIET) == 0)
324 		fprintf(stderr, "pf enabled\n");
325 
326 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
327 		if (errno != EEXIST)
328 			err(1, "DIOCSTARTALTQ");
329 
330 	return (0);
331 }
332 
333 int
334 pfctl_disable(int dev, int opts)
335 {
336 	if (ioctl(dev, DIOCSTOP)) {
337 		if (errno == ENOENT)
338 			errx(1, "pf not enabled");
339 		else
340 			err(1, "DIOCSTOP");
341 	}
342 	if ((opts & PF_OPT_QUIET) == 0)
343 		fprintf(stderr, "pf disabled\n");
344 
345 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
346 			if (errno != ENOENT)
347 				err(1, "DIOCSTOPALTQ");
348 
349 	return (0);
350 }
351 
352 int
353 pfctl_clear_stats(int dev, int opts)
354 {
355 	if (ioctl(dev, DIOCCLRSTATUS))
356 		err(1, "DIOCCLRSTATUS");
357 	if ((opts & PF_OPT_QUIET) == 0)
358 		fprintf(stderr, "pf: statistics cleared\n");
359 	return (0);
360 }
361 
362 int
363 pfctl_get_skip_ifaces(void)
364 {
365 	bzero(&skip_b, sizeof(skip_b));
366 	skip_b.pfrb_type = PFRB_IFACES;
367 	for (;;) {
368 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
369 		skip_b.pfrb_size = skip_b.pfrb_msize;
370 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
371 			err(1, "pfi_get_ifaces");
372 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
373 			break;
374 	}
375 	return (0);
376 }
377 
378 int
379 pfctl_check_skip_ifaces(char *ifname)
380 {
381 	struct pfi_kif		*p;
382 	struct node_host	*h = NULL, *n = NULL;
383 
384 	PFRB_FOREACH(p, &skip_b) {
385 		if (!strcmp(ifname, p->pfik_name) &&
386 		    (p->pfik_flags & PFI_IFLAG_SKIP))
387 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
388 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
389 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
390 				continue;
391 
392 			for (n = h; n != NULL; n = n->next) {
393 				if (p->pfik_ifp == NULL)
394 					continue;
395 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
396 					continue;
397 
398 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
399 			}
400 		}
401 	}
402 	return (0);
403 }
404 
405 int
406 pfctl_adjust_skip_ifaces(struct pfctl *pf)
407 {
408 	struct pfi_kif		*p, *pp;
409 	struct node_host	*h = NULL, *n = NULL;
410 
411 	PFRB_FOREACH(p, &skip_b) {
412 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
413 			continue;
414 
415 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
416 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
417 			continue;
418 
419 		for (n = h; n != NULL; n = n->next)
420 			PFRB_FOREACH(pp, &skip_b) {
421 				if (pp->pfik_ifp == NULL)
422 					continue;
423 
424 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
425 					continue;
426 
427 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
428 					pfctl_set_interface_flags(pf,
429 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
430 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
431 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
432 			}
433 	}
434 
435 	PFRB_FOREACH(p, &skip_b) {
436 		if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
437 			continue;
438 
439 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
440 	}
441 
442 	return (0);
443 }
444 
445 int
446 pfctl_clear_interface_flags(int dev, int opts)
447 {
448 	struct pfioc_iface	pi;
449 
450 	if ((opts & PF_OPT_NOACTION) == 0) {
451 		bzero(&pi, sizeof(pi));
452 		pi.pfiio_flags = PFI_IFLAG_SKIP;
453 
454 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
455 			err(1, "DIOCCLRIFFLAG");
456 		if ((opts & PF_OPT_QUIET) == 0)
457 			fprintf(stderr, "pf: interface flags reset\n");
458 	}
459 	return (0);
460 }
461 
462 int
463 pfctl_flush_eth_rules(int dev, int opts, char *anchorname)
464 {
465 	int ret;
466 
467 	ret = pfctl_clear_eth_rules(dev, anchorname);
468 	if (ret != 0)
469 		err(1, "pfctl_clear_eth_rules");
470 
471 	if ((opts & PF_OPT_QUIET) == 0)
472 		fprintf(stderr, "Ethernet rules cleared\n");
473 
474 	return (ret);
475 }
476 
477 int
478 pfctl_flush_rules(int dev, int opts, char *anchorname)
479 {
480 	int ret;
481 
482 	ret = pfctl_clear_rules(dev, anchorname);
483 	if (ret != 0)
484 		err(1, "pfctl_clear_rules");
485 	if ((opts & PF_OPT_QUIET) == 0)
486 		fprintf(stderr, "rules cleared\n");
487 	return (0);
488 }
489 
490 int
491 pfctl_flush_nat(int dev, int opts, char *anchorname)
492 {
493 	int ret;
494 
495 	ret = pfctl_clear_nat(dev, anchorname);
496 	if (ret != 0)
497 		err(1, "pfctl_clear_nat");
498 	if ((opts & PF_OPT_QUIET) == 0)
499 		fprintf(stderr, "nat cleared\n");
500 	return (0);
501 }
502 
503 int
504 pfctl_clear_altq(int dev, int opts)
505 {
506 	struct pfr_buffer t;
507 
508 	if (!altqsupport)
509 		return (-1);
510 	memset(&t, 0, sizeof(t));
511 	t.pfrb_type = PFRB_TRANS;
512 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
513 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
514 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
515 		err(1, "pfctl_clear_altq");
516 	if ((opts & PF_OPT_QUIET) == 0)
517 		fprintf(stderr, "altq cleared\n");
518 	return (0);
519 }
520 
521 int
522 pfctl_clear_src_nodes(int dev, int opts)
523 {
524 	if (ioctl(dev, DIOCCLRSRCNODES))
525 		err(1, "DIOCCLRSRCNODES");
526 	if ((opts & PF_OPT_QUIET) == 0)
527 		fprintf(stderr, "source tracking entries cleared\n");
528 	return (0);
529 }
530 
531 int
532 pfctl_clear_iface_states(int dev, const char *iface, int opts)
533 {
534 	struct pfctl_kill kill;
535 	unsigned int killed;
536 
537 	memset(&kill, 0, sizeof(kill));
538 	if (iface != NULL && strlcpy(kill.ifname, iface,
539 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
540 		errx(1, "invalid interface: %s", iface);
541 
542 	if (opts & PF_OPT_KILLMATCH)
543 		kill.kill_match = true;
544 
545 	if (pfctl_clear_states(dev, &kill, &killed))
546 		err(1, "DIOCCLRSTATES");
547 	if ((opts & PF_OPT_QUIET) == 0)
548 		fprintf(stderr, "%d states cleared\n", killed);
549 	return (0);
550 }
551 
552 void
553 pfctl_addrprefix(char *addr, struct pf_addr *mask)
554 {
555 	char *p;
556 	const char *errstr;
557 	int prefix, ret_ga, q, r;
558 	struct addrinfo hints, *res;
559 
560 	if ((p = strchr(addr, '/')) == NULL)
561 		return;
562 
563 	*p++ = '\0';
564 	prefix = strtonum(p, 0, 128, &errstr);
565 	if (errstr)
566 		errx(1, "prefix is %s: %s", errstr, p);
567 
568 	bzero(&hints, sizeof(hints));
569 	/* prefix only with numeric addresses */
570 	hints.ai_flags |= AI_NUMERICHOST;
571 
572 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
573 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
574 		/* NOTREACHED */
575 	}
576 
577 	if (res->ai_family == AF_INET && prefix > 32)
578 		errx(1, "prefix too long for AF_INET");
579 	else if (res->ai_family == AF_INET6 && prefix > 128)
580 		errx(1, "prefix too long for AF_INET6");
581 
582 	q = prefix >> 3;
583 	r = prefix & 7;
584 	switch (res->ai_family) {
585 	case AF_INET:
586 		bzero(&mask->v4, sizeof(mask->v4));
587 		mask->v4.s_addr = htonl((u_int32_t)
588 		    (0xffffffffffULL << (32 - prefix)));
589 		break;
590 	case AF_INET6:
591 		bzero(&mask->v6, sizeof(mask->v6));
592 		if (q > 0)
593 			memset((void *)&mask->v6, 0xff, q);
594 		if (r > 0)
595 			*((u_char *)&mask->v6 + q) =
596 			    (0xff00 >> r) & 0xff;
597 		break;
598 	}
599 	freeaddrinfo(res);
600 }
601 
602 int
603 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
604 {
605 	struct pfioc_src_node_kill psnk;
606 	struct addrinfo *res[2], *resp[2];
607 	struct sockaddr last_src, last_dst;
608 	int killed, sources, dests;
609 	int ret_ga;
610 
611 	killed = sources = dests = 0;
612 
613 	memset(&psnk, 0, sizeof(psnk));
614 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
615 	    sizeof(psnk.psnk_src.addr.v.a.mask));
616 	memset(&last_src, 0xff, sizeof(last_src));
617 	memset(&last_dst, 0xff, sizeof(last_dst));
618 
619 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
620 
621 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
622 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
623 		/* NOTREACHED */
624 	}
625 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
626 		if (resp[0]->ai_addr == NULL)
627 			continue;
628 		/* We get lots of duplicates.  Catch the easy ones */
629 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
630 			continue;
631 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
632 
633 		psnk.psnk_af = resp[0]->ai_family;
634 		sources++;
635 
636 		if (psnk.psnk_af == AF_INET)
637 			psnk.psnk_src.addr.v.a.addr.v4 =
638 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
639 		else if (psnk.psnk_af == AF_INET6)
640 			psnk.psnk_src.addr.v.a.addr.v6 =
641 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
642 			    sin6_addr;
643 		else
644 			errx(1, "Unknown address family %d", psnk.psnk_af);
645 
646 		if (src_node_killers > 1) {
647 			dests = 0;
648 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
649 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
650 			memset(&last_dst, 0xff, sizeof(last_dst));
651 			pfctl_addrprefix(src_node_kill[1],
652 			    &psnk.psnk_dst.addr.v.a.mask);
653 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
654 			    &res[1]))) {
655 				errx(1, "getaddrinfo: %s",
656 				    gai_strerror(ret_ga));
657 				/* NOTREACHED */
658 			}
659 			for (resp[1] = res[1]; resp[1];
660 			    resp[1] = resp[1]->ai_next) {
661 				if (resp[1]->ai_addr == NULL)
662 					continue;
663 				if (psnk.psnk_af != resp[1]->ai_family)
664 					continue;
665 
666 				if (memcmp(&last_dst, resp[1]->ai_addr,
667 				    sizeof(last_dst)) == 0)
668 					continue;
669 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
670 
671 				dests++;
672 
673 				if (psnk.psnk_af == AF_INET)
674 					psnk.psnk_dst.addr.v.a.addr.v4 =
675 					    ((struct sockaddr_in *)resp[1]->
676 					    ai_addr)->sin_addr;
677 				else if (psnk.psnk_af == AF_INET6)
678 					psnk.psnk_dst.addr.v.a.addr.v6 =
679 					    ((struct sockaddr_in6 *)resp[1]->
680 					    ai_addr)->sin6_addr;
681 				else
682 					errx(1, "Unknown address family %d",
683 					    psnk.psnk_af);
684 
685 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
686 					err(1, "DIOCKILLSRCNODES");
687 				killed += psnk.psnk_killed;
688 			}
689 			freeaddrinfo(res[1]);
690 		} else {
691 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
692 				err(1, "DIOCKILLSRCNODES");
693 			killed += psnk.psnk_killed;
694 		}
695 	}
696 
697 	freeaddrinfo(res[0]);
698 
699 	if ((opts & PF_OPT_QUIET) == 0)
700 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
701 		    "destinations\n", killed, sources, dests);
702 	return (0);
703 }
704 
705 int
706 pfctl_net_kill_states(int dev, const char *iface, int opts)
707 {
708 	struct pfctl_kill kill;
709 	struct addrinfo *res[2], *resp[2];
710 	struct sockaddr last_src, last_dst;
711 	unsigned int newkilled;
712 	int killed, sources, dests;
713 	int ret_ga;
714 
715 	killed = sources = dests = 0;
716 
717 	memset(&kill, 0, sizeof(kill));
718 	memset(&kill.src.addr.v.a.mask, 0xff,
719 	    sizeof(kill.src.addr.v.a.mask));
720 	memset(&last_src, 0xff, sizeof(last_src));
721 	memset(&last_dst, 0xff, sizeof(last_dst));
722 	if (iface != NULL && strlcpy(kill.ifname, iface,
723 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
724 		errx(1, "invalid interface: %s", iface);
725 
726 	pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask);
727 
728 	if (opts & PF_OPT_KILLMATCH)
729 		kill.kill_match = true;
730 
731 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
732 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
733 		/* NOTREACHED */
734 	}
735 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
736 		if (resp[0]->ai_addr == NULL)
737 			continue;
738 		/* We get lots of duplicates.  Catch the easy ones */
739 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
740 			continue;
741 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
742 
743 		kill.af = resp[0]->ai_family;
744 		sources++;
745 
746 		if (kill.af == AF_INET)
747 			kill.src.addr.v.a.addr.v4 =
748 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
749 		else if (kill.af == AF_INET6)
750 			kill.src.addr.v.a.addr.v6 =
751 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
752 			    sin6_addr;
753 		else
754 			errx(1, "Unknown address family %d", kill.af);
755 
756 		if (state_killers > 1) {
757 			dests = 0;
758 			memset(&kill.dst.addr.v.a.mask, 0xff,
759 			    sizeof(kill.dst.addr.v.a.mask));
760 			memset(&last_dst, 0xff, sizeof(last_dst));
761 			pfctl_addrprefix(state_kill[1],
762 			    &kill.dst.addr.v.a.mask);
763 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
764 			    &res[1]))) {
765 				errx(1, "getaddrinfo: %s",
766 				    gai_strerror(ret_ga));
767 				/* NOTREACHED */
768 			}
769 			for (resp[1] = res[1]; resp[1];
770 			    resp[1] = resp[1]->ai_next) {
771 				if (resp[1]->ai_addr == NULL)
772 					continue;
773 				if (kill.af != resp[1]->ai_family)
774 					continue;
775 
776 				if (memcmp(&last_dst, resp[1]->ai_addr,
777 				    sizeof(last_dst)) == 0)
778 					continue;
779 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
780 
781 				dests++;
782 
783 				if (kill.af == AF_INET)
784 					kill.dst.addr.v.a.addr.v4 =
785 					    ((struct sockaddr_in *)resp[1]->
786 					    ai_addr)->sin_addr;
787 				else if (kill.af == AF_INET6)
788 					kill.dst.addr.v.a.addr.v6 =
789 					    ((struct sockaddr_in6 *)resp[1]->
790 					    ai_addr)->sin6_addr;
791 				else
792 					errx(1, "Unknown address family %d",
793 					    kill.af);
794 
795 				if (pfctl_kill_states(dev, &kill, &newkilled))
796 					err(1, "DIOCKILLSTATES");
797 				killed += newkilled;
798 			}
799 			freeaddrinfo(res[1]);
800 		} else {
801 			if (pfctl_kill_states(dev, &kill, &newkilled))
802 				err(1, "DIOCKILLSTATES");
803 			killed += newkilled;
804 		}
805 	}
806 
807 	freeaddrinfo(res[0]);
808 
809 	if ((opts & PF_OPT_QUIET) == 0)
810 		fprintf(stderr, "killed %d states from %d sources and %d "
811 		    "destinations\n", killed, sources, dests);
812 	return (0);
813 }
814 
815 int
816 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
817 {
818 	struct pfctl_kill kill;
819 	struct addrinfo *res, *resp;
820 	struct sockaddr last_src;
821 	unsigned int newkilled;
822 	int killed = 0;
823 	int ret_ga;
824 
825 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
826 		warnx("no gateway specified");
827 		usage();
828 	}
829 
830 	memset(&kill, 0, sizeof(kill));
831 	memset(&kill.rt_addr.addr.v.a.mask, 0xff,
832 	    sizeof(kill.rt_addr.addr.v.a.mask));
833 	memset(&last_src, 0xff, sizeof(last_src));
834 	if (iface != NULL && strlcpy(kill.ifname, iface,
835 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
836 		errx(1, "invalid interface: %s", iface);
837 
838 	if (opts & PF_OPT_KILLMATCH)
839 		kill.kill_match = true;
840 
841 	pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask);
842 
843 	if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, &res))) {
844 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
845 		/* NOTREACHED */
846 	}
847 	for (resp = res; resp; resp = resp->ai_next) {
848 		if (resp->ai_addr == NULL)
849 			continue;
850 		/* We get lots of duplicates.  Catch the easy ones */
851 		if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
852 			continue;
853 		last_src = *(struct sockaddr *)resp->ai_addr;
854 
855 		kill.af = resp->ai_family;
856 
857 		if (kill.af == AF_INET)
858 			kill.rt_addr.addr.v.a.addr.v4 =
859 			    ((struct sockaddr_in *)resp->ai_addr)->sin_addr;
860 		else if (kill.af == AF_INET6)
861 			kill.rt_addr.addr.v.a.addr.v6 =
862 			    ((struct sockaddr_in6 *)resp->ai_addr)->
863 			    sin6_addr;
864 		else
865 			errx(1, "Unknown address family %d", kill.af);
866 
867 		if (pfctl_kill_states(dev, &kill, &newkilled))
868 			err(1, "DIOCKILLSTATES");
869 		killed += newkilled;
870 	}
871 
872 	freeaddrinfo(res);
873 
874 	if ((opts & PF_OPT_QUIET) == 0)
875 		fprintf(stderr, "killed %d states\n", killed);
876 	return (0);
877 }
878 
879 int
880 pfctl_label_kill_states(int dev, const char *iface, int opts)
881 {
882 	struct pfctl_kill kill;
883 	unsigned int killed;
884 
885 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
886 		warnx("no label specified");
887 		usage();
888 	}
889 	memset(&kill, 0, sizeof(kill));
890 	if (iface != NULL && strlcpy(kill.ifname, iface,
891 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
892 		errx(1, "invalid interface: %s", iface);
893 
894 	if (opts & PF_OPT_KILLMATCH)
895 		kill.kill_match = true;
896 
897 	if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
898 	    sizeof(kill.label))
899 		errx(1, "label too long: %s", state_kill[1]);
900 
901 	if (pfctl_kill_states(dev, &kill, &killed))
902 		err(1, "DIOCKILLSTATES");
903 
904 	if ((opts & PF_OPT_QUIET) == 0)
905 		fprintf(stderr, "killed %d states\n", killed);
906 
907 	return (0);
908 }
909 
910 int
911 pfctl_id_kill_states(int dev, const char *iface, int opts)
912 {
913 	struct pfctl_kill kill;
914 	unsigned int killed;
915 
916 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
917 		warnx("no id specified");
918 		usage();
919 	}
920 
921 	memset(&kill, 0, sizeof(kill));
922 
923 	if (opts & PF_OPT_KILLMATCH)
924 		kill.kill_match = true;
925 
926 	if ((sscanf(state_kill[1], "%jx/%x",
927 	    &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
928 	}
929 	else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
930 		kill.cmp.creatorid = 0;
931 	} else {
932 		warnx("wrong id format specified");
933 		usage();
934 	}
935 	if (kill.cmp.id == 0) {
936 		warnx("cannot kill id 0");
937 		usage();
938 	}
939 
940 	if (pfctl_kill_states(dev, &kill, &killed))
941 		err(1, "DIOCKILLSTATES");
942 
943 	if ((opts & PF_OPT_QUIET) == 0)
944 		fprintf(stderr, "killed %d states\n", killed);
945 
946 	return (0);
947 }
948 
949 int
950 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
951     u_int32_t ticket, int r_action, char *anchorname)
952 {
953 	struct pfioc_pooladdr pp;
954 	struct pf_pooladdr *pa;
955 	u_int32_t pnr, mpnr;
956 
957 	memset(&pp, 0, sizeof(pp));
958 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
959 	pp.r_action = r_action;
960 	pp.r_num = nr;
961 	pp.ticket = ticket;
962 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
963 		warn("DIOCGETADDRS");
964 		return (-1);
965 	}
966 	mpnr = pp.nr;
967 	TAILQ_INIT(&pool->list);
968 	for (pnr = 0; pnr < mpnr; ++pnr) {
969 		pp.nr = pnr;
970 		if (ioctl(dev, DIOCGETADDR, &pp)) {
971 			warn("DIOCGETADDR");
972 			return (-1);
973 		}
974 		pa = calloc(1, sizeof(struct pf_pooladdr));
975 		if (pa == NULL)
976 			err(1, "calloc");
977 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
978 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
979 	}
980 
981 	return (0);
982 }
983 
984 void
985 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
986 {
987 	struct pf_pooladdr *pa;
988 
989 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
990 		TAILQ_REMOVE(&src->list, pa, entries);
991 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
992 	}
993 }
994 
995 void
996 pfctl_clear_pool(struct pfctl_pool *pool)
997 {
998 	struct pf_pooladdr *pa;
999 
1000 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
1001 		TAILQ_REMOVE(&pool->list, pa, entries);
1002 		free(pa);
1003 	}
1004 }
1005 
1006 void
1007 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *rule, int opts)
1008 {
1009 	if (opts & PF_OPT_VERBOSE) {
1010 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1011 			    "Bytes: %-10llu]\n",
1012 			    (unsigned long long)rule->evaluations,
1013 			    (unsigned long long)(rule->packets[0] +
1014 			    rule->packets[1]),
1015 			    (unsigned long long)(rule->bytes[0] +
1016 			    rule->bytes[1]));
1017 	}
1018 }
1019 
1020 void
1021 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
1022 {
1023 	if (opts & PF_OPT_DEBUG) {
1024 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
1025 		    "p", "sa", "sp", "da", "dp" };
1026 		int i;
1027 
1028 		printf("  [ Skip steps: ");
1029 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
1030 			if (rule->skip[i].nr == rule->nr + 1)
1031 				continue;
1032 			printf("%s=", t[i]);
1033 			if (rule->skip[i].nr == -1)
1034 				printf("end ");
1035 			else
1036 				printf("%u ", rule->skip[i].nr);
1037 		}
1038 		printf("]\n");
1039 
1040 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1041 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
1042 	}
1043 	if (opts & PF_OPT_VERBOSE) {
1044 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1045 			    "Bytes: %-10llu  States: %-6ju]\n",
1046 			    (unsigned long long)rule->evaluations,
1047 			    (unsigned long long)(rule->packets[0] +
1048 			    rule->packets[1]),
1049 			    (unsigned long long)(rule->bytes[0] +
1050 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
1051 		if (!(opts & PF_OPT_DEBUG))
1052 			printf("  [ Inserted: uid %u pid %u "
1053 			    "State Creations: %-6ju]\n",
1054 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
1055 			    (uintmax_t)rule->states_tot);
1056 	}
1057 }
1058 
1059 void
1060 pfctl_print_title(char *title)
1061 {
1062 	if (!first_title)
1063 		printf("\n");
1064 	first_title = 0;
1065 	printf("%s\n", title);
1066 }
1067 
1068 int
1069 pfctl_show_eth_rules(int dev, char *path, int opts, enum pfctl_show format,
1070     char *anchorname, int depth)
1071 {
1072 	char anchor_call[MAXPATHLEN];
1073 	struct pfctl_eth_rules_info info;
1074 	struct pfctl_eth_rule rule;
1075 	int dotitle = opts & PF_OPT_SHOWALL;
1076 	int len = strlen(path);
1077 	int brace;
1078 	char *p;
1079 
1080 	if (path[0])
1081 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1082 	else
1083 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1084 
1085 	if (pfctl_get_eth_rules_info(dev, &info, path)) {
1086 		warn("DIOCGETETHRULES");
1087 		return (-1);
1088 	}
1089 	for (int nr = 0; nr < info.nr; nr++) {
1090 		brace = 0;
1091 		INDENT(depth, !(opts & PF_OPT_VERBOSE));
1092 		if (pfctl_get_eth_rule(dev, nr, info.ticket, path, &rule,
1093 		    opts & PF_OPT_CLRRULECTRS, anchor_call) != 0) {
1094 			warn("DIOCGETETHRULE");
1095 			return (-1);
1096 		}
1097 		if (anchor_call[0] &&
1098 		   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1099 		   (p == anchor_call ||
1100 		   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1101 			brace++;
1102 			if ((p = strrchr(anchor_call, '/')) !=
1103 			    NULL)
1104 				p++;
1105 			else
1106 				p = &anchor_call[0];
1107 		} else
1108 			p = &anchor_call[0];
1109 		if (dotitle) {
1110 			pfctl_print_title("ETH RULES:");
1111 			dotitle = 0;
1112 		}
1113 		print_eth_rule(&rule, anchor_call,
1114 		    opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1115 		if (brace)
1116 			printf(" {\n");
1117 		else
1118 			printf("\n");
1119 		pfctl_print_eth_rule_counters(&rule, opts);
1120 		if (brace) {
1121 			pfctl_show_eth_rules(dev, path, opts, format,
1122 			    p, depth + 1);
1123 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1124 			printf("}\n");
1125 		}
1126 	}
1127 
1128 	path[len] = '\0';
1129 	return (0);
1130 }
1131 
1132 int
1133 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1134     char *anchorname, int depth)
1135 {
1136 	struct pfctl_rules_info ri;
1137 	struct pfctl_rule rule;
1138 	char anchor_call[MAXPATHLEN];
1139 	u_int32_t nr, header = 0;
1140 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1141 	int numeric = opts & PF_OPT_NUMERIC;
1142 	int len = strlen(path);
1143 	int brace;
1144 	int ret;
1145 	char *p;
1146 
1147 	if (path[0])
1148 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1149 	else
1150 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1151 
1152 	if (opts & PF_OPT_SHOWALL) {
1153 		ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1154 		if (ret != 0) {
1155 			warn("DIOCGETRULES");
1156 			goto error;
1157 		}
1158 		header++;
1159 	}
1160 	ret = pfctl_get_rules_info(dev, &ri, PF_SCRUB, path);
1161 	if (ret != 0) {
1162 		warn("DIOCGETRULES");
1163 		goto error;
1164 	}
1165 	if (opts & PF_OPT_SHOWALL) {
1166 		if (format == PFCTL_SHOW_RULES && (ri.nr > 0 || header))
1167 			pfctl_print_title("FILTER RULES:");
1168 		else if (format == PFCTL_SHOW_LABELS && labels)
1169 			pfctl_print_title("LABEL COUNTERS:");
1170 	}
1171 
1172 	for (nr = 0; nr < ri.nr; ++nr) {
1173 		if (pfctl_get_clear_rule(dev, nr, ri.ticket, path, PF_SCRUB,
1174 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1175 			warn("DIOCGETRULENV");
1176 			goto error;
1177 		}
1178 
1179 		if (pfctl_get_pool(dev, &rule.rpool,
1180 		    nr, ri.ticket, PF_SCRUB, path) != 0)
1181 			goto error;
1182 
1183 		switch (format) {
1184 		case PFCTL_SHOW_LABELS:
1185 			break;
1186 		case PFCTL_SHOW_RULES:
1187 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1188 				labels = 1;
1189 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1190 			printf("\n");
1191 			pfctl_print_rule_counters(&rule, opts);
1192 			break;
1193 		case PFCTL_SHOW_NOTHING:
1194 			break;
1195 		}
1196 		pfctl_clear_pool(&rule.rpool);
1197 	}
1198 	ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1199 	if (ret != 0) {
1200 		warn("DIOCGETRULES");
1201 		goto error;
1202 	}
1203 	for (nr = 0; nr < ri.nr; ++nr) {
1204 		if (pfctl_get_clear_rule(dev, nr, ri.ticket, path, PF_PASS,
1205 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1206 			warn("DIOCGETRULE");
1207 			goto error;
1208 		}
1209 
1210 		if (pfctl_get_pool(dev, &rule.rpool,
1211 		    nr, ri.ticket, PF_PASS, path) != 0)
1212 			goto error;
1213 
1214 		switch (format) {
1215 		case PFCTL_SHOW_LABELS: {
1216 			bool show = false;
1217 			int i = 0;
1218 
1219 			while (rule.label[i][0]) {
1220 				printf("%s ", rule.label[i++]);
1221 				show = true;
1222 			}
1223 
1224 			if (show) {
1225 				printf("%llu %llu %llu %llu"
1226 				    " %llu %llu %llu %ju\n",
1227 				    (unsigned long long)rule.evaluations,
1228 				    (unsigned long long)(rule.packets[0] +
1229 				    rule.packets[1]),
1230 				    (unsigned long long)(rule.bytes[0] +
1231 				    rule.bytes[1]),
1232 				    (unsigned long long)rule.packets[0],
1233 				    (unsigned long long)rule.bytes[0],
1234 				    (unsigned long long)rule.packets[1],
1235 				    (unsigned long long)rule.bytes[1],
1236 				    (uintmax_t)rule.states_tot);
1237 			}
1238 			break;
1239 		}
1240 		case PFCTL_SHOW_RULES:
1241 			brace = 0;
1242 			if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1243 				labels = 1;
1244 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1245 			if (anchor_call[0] &&
1246 			   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1247 			   ((void *)p == (void *)anchor_call ||
1248 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1249 				brace++;
1250 				if ((p = strrchr(anchor_call, '/')) !=
1251 				    NULL)
1252 					p++;
1253 				else
1254 					p = &anchor_call[0];
1255 			} else
1256 				p = &anchor_call[0];
1257 
1258 			print_rule(&rule, p, rule_numbers, numeric);
1259 			if (brace)
1260 				printf(" {\n");
1261 			else
1262 				printf("\n");
1263 			pfctl_print_rule_counters(&rule, opts);
1264 			if (brace) {
1265 				pfctl_show_rules(dev, path, opts, format,
1266 				    p, depth + 1);
1267 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1268 				printf("}\n");
1269 			}
1270 			break;
1271 		case PFCTL_SHOW_NOTHING:
1272 			break;
1273 		}
1274 		pfctl_clear_pool(&rule.rpool);
1275 	}
1276 	path[len] = '\0';
1277 	return (0);
1278 
1279  error:
1280 	path[len] = '\0';
1281 	return (-1);
1282 }
1283 
1284 int
1285 pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth)
1286 {
1287 	struct pfctl_rules_info ri;
1288 	struct pfctl_rule rule;
1289 	char anchor_call[MAXPATHLEN];
1290 	u_int32_t nr;
1291 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1292 	int i, dotitle = opts & PF_OPT_SHOWALL;
1293 	int brace, ret;
1294 	int len = strlen(path);
1295 	char *p;
1296 
1297 	if (path[0])
1298 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1299 	else
1300 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1301 
1302 	for (i = 0; i < 3; i++) {
1303 		ret = pfctl_get_rules_info(dev, &ri, nattype[i], path);
1304 		if (ret != 0) {
1305 			warn("DIOCGETRULES");
1306 			return (-1);
1307 		}
1308 		for (nr = 0; nr < ri.nr; ++nr) {
1309 			brace = 0;
1310 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1311 
1312 			if (pfctl_get_rule(dev, nr, ri.ticket, path,
1313 			    nattype[i], &rule, anchor_call)) {
1314 				warn("DIOCGETRULE");
1315 				return (-1);
1316 			}
1317 			if (pfctl_get_pool(dev, &rule.rpool, nr,
1318 			    ri.ticket, nattype[i], path) != 0)
1319 				return (-1);
1320 
1321 			if (anchor_call[0] &&
1322 			   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1323 			   (p == anchor_call ||
1324 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1325 				brace++;
1326 				if ((p = strrchr(anchor_call, '/')) !=
1327 				    NULL)
1328 					p++;
1329 				else
1330 					p = &anchor_call[0];
1331 			} else
1332 				p = &anchor_call[0];
1333 
1334 			if (dotitle) {
1335 				pfctl_print_title("TRANSLATION RULES:");
1336 				dotitle = 0;
1337 			}
1338 			print_rule(&rule, anchor_call,
1339 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1340 			if (brace)
1341 				printf(" {\n");
1342 			else
1343 				printf("\n");
1344 			pfctl_print_rule_counters(&rule, opts);
1345 			pfctl_clear_pool(&rule.rpool);
1346 			if (brace) {
1347 				pfctl_show_nat(dev, path, opts, p, depth + 1);
1348 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1349 				printf("}\n");
1350 			}
1351 		}
1352 	}
1353 	return (0);
1354 }
1355 
1356 int
1357 pfctl_show_src_nodes(int dev, int opts)
1358 {
1359 	struct pfioc_src_nodes psn;
1360 	struct pf_src_node *p;
1361 	char *inbuf = NULL, *newinbuf = NULL;
1362 	unsigned int len = 0;
1363 	int i;
1364 
1365 	memset(&psn, 0, sizeof(psn));
1366 	for (;;) {
1367 		psn.psn_len = len;
1368 		if (len) {
1369 			newinbuf = realloc(inbuf, len);
1370 			if (newinbuf == NULL)
1371 				err(1, "realloc");
1372 			psn.psn_buf = inbuf = newinbuf;
1373 		}
1374 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1375 			warn("DIOCGETSRCNODES");
1376 			free(inbuf);
1377 			return (-1);
1378 		}
1379 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1380 			break;
1381 		if (len == 0 && psn.psn_len == 0)
1382 			goto done;
1383 		if (len == 0 && psn.psn_len != 0)
1384 			len = psn.psn_len;
1385 		if (psn.psn_len == 0)
1386 			goto done;	/* no src_nodes */
1387 		len *= 2;
1388 	}
1389 	p = psn.psn_src_nodes;
1390 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1391 		pfctl_print_title("SOURCE TRACKING NODES:");
1392 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1393 		print_src_node(p, opts);
1394 		p++;
1395 	}
1396 done:
1397 	free(inbuf);
1398 	return (0);
1399 }
1400 
1401 int
1402 pfctl_show_states(int dev, const char *iface, int opts)
1403 {
1404 	struct pfctl_states states;
1405 	struct pfctl_state *s;
1406 	int dotitle = (opts & PF_OPT_SHOWALL);
1407 
1408 	memset(&states, 0, sizeof(states));
1409 
1410 	if (pfctl_get_states(dev, &states))
1411 		return (-1);
1412 
1413 	TAILQ_FOREACH(s, &states.states, entry) {
1414 		if (iface != NULL && strcmp(s->ifname, iface))
1415 			continue;
1416 		if (dotitle) {
1417 			pfctl_print_title("STATES:");
1418 			dotitle = 0;
1419 		}
1420 		print_state(s, opts);
1421 	}
1422 
1423 	pfctl_free_states(&states);
1424 
1425 	return (0);
1426 }
1427 
1428 int
1429 pfctl_show_status(int dev, int opts)
1430 {
1431 	struct pfctl_status	*status;
1432 	struct pfctl_syncookies	cookies;
1433 
1434 	if ((status = pfctl_get_status(dev)) == NULL) {
1435 		warn("DIOCGETSTATUS");
1436 		return (-1);
1437 	}
1438 	if (pfctl_get_syncookies(dev, &cookies)) {
1439 		pfctl_free_status(status);
1440 		warn("DIOCGETSYNCOOKIES");
1441 		return (-1);
1442 	}
1443 	if (opts & PF_OPT_SHOWALL)
1444 		pfctl_print_title("INFO:");
1445 	print_status(status, &cookies, opts);
1446 	pfctl_free_status(status);
1447 	return (0);
1448 }
1449 
1450 int
1451 pfctl_show_running(int dev)
1452 {
1453 	struct pfctl_status *status;
1454 	int running;
1455 
1456 	if ((status = pfctl_get_status(dev)) == NULL) {
1457 		warn("DIOCGETSTATUS");
1458 		return (-1);
1459 	}
1460 
1461 	running = status->running;
1462 
1463 	print_running(status);
1464 	pfctl_free_status(status);
1465 	return (!running);
1466 }
1467 
1468 int
1469 pfctl_show_timeouts(int dev, int opts)
1470 {
1471 	struct pfioc_tm pt;
1472 	int i;
1473 
1474 	if (opts & PF_OPT_SHOWALL)
1475 		pfctl_print_title("TIMEOUTS:");
1476 	memset(&pt, 0, sizeof(pt));
1477 	for (i = 0; pf_timeouts[i].name; i++) {
1478 		pt.timeout = pf_timeouts[i].timeout;
1479 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1480 			err(1, "DIOCGETTIMEOUT");
1481 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1482 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1483 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1484 			printf(" states");
1485 		else
1486 			printf("s");
1487 		printf("\n");
1488 	}
1489 	return (0);
1490 
1491 }
1492 
1493 int
1494 pfctl_show_limits(int dev, int opts)
1495 {
1496 	struct pfioc_limit pl;
1497 	int i;
1498 
1499 	if (opts & PF_OPT_SHOWALL)
1500 		pfctl_print_title("LIMITS:");
1501 	memset(&pl, 0, sizeof(pl));
1502 	for (i = 0; pf_limits[i].name; i++) {
1503 		pl.index = pf_limits[i].index;
1504 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1505 			err(1, "DIOCGETLIMIT");
1506 		printf("%-13s ", pf_limits[i].name);
1507 		if (pl.limit == UINT_MAX)
1508 			printf("unlimited\n");
1509 		else
1510 			printf("hard limit %8u\n", pl.limit);
1511 	}
1512 	return (0);
1513 }
1514 
1515 /* callbacks for rule/nat/rdr/addr */
1516 int
1517 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1518 {
1519 	struct pf_pooladdr *pa;
1520 
1521 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1522 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1523 			err(1, "DIOCBEGINADDRS");
1524 	}
1525 
1526 	pf->paddr.af = af;
1527 	TAILQ_FOREACH(pa, &p->list, entries) {
1528 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1529 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1530 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1531 				err(1, "DIOCADDADDR");
1532 		}
1533 	}
1534 	return (0);
1535 }
1536 
1537 int
1538 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1539     const char *anchor_call)
1540 {
1541 	u_int8_t		rs_num;
1542 	struct pfctl_rule	*rule;
1543 	struct pfctl_ruleset	*rs;
1544 	char 			*p;
1545 
1546 	rs_num = pf_get_ruleset_number(r->action);
1547 	if (rs_num == PF_RULESET_MAX)
1548 		errx(1, "Invalid rule type %d", r->action);
1549 
1550 	rs = &pf->anchor->ruleset;
1551 
1552 	if (anchor_call[0] && r->anchor == NULL) {
1553 		/*
1554 		 * Don't make non-brace anchors part of the main anchor pool.
1555 		 */
1556 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1557 			err(1, "pfctl_append_rule: calloc");
1558 
1559 		pf_init_ruleset(&r->anchor->ruleset);
1560 		r->anchor->ruleset.anchor = r->anchor;
1561 		if (strlcpy(r->anchor->path, anchor_call,
1562 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1563 			errx(1, "pfctl_append_rule: strlcpy");
1564 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1565 			if (!strlen(p))
1566 				err(1, "pfctl_append_rule: bad anchor name %s",
1567 				    anchor_call);
1568 		} else
1569 			p = (char *)anchor_call;
1570 		if (strlcpy(r->anchor->name, p,
1571 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1572 			errx(1, "pfctl_append_rule: strlcpy");
1573 	}
1574 
1575 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1576 		err(1, "calloc");
1577 	bcopy(r, rule, sizeof(*rule));
1578 	TAILQ_INIT(&rule->rpool.list);
1579 	pfctl_move_pool(&r->rpool, &rule->rpool);
1580 
1581 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1582 	return (0);
1583 }
1584 
1585 int
1586 pfctl_append_eth_rule(struct pfctl *pf, struct pfctl_eth_rule *r,
1587     const char *anchor_call)
1588 {
1589 	struct pfctl_eth_rule		*rule;
1590 	struct pfctl_eth_ruleset	*rs;
1591 	char 				*p;
1592 
1593 	rs = &pf->eanchor->ruleset;
1594 
1595 	if (anchor_call[0] && r->anchor == NULL) {
1596 		/*
1597 		 * Don't make non-brace anchors part of the main anchor pool.
1598 		 */
1599 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1600 			err(1, "pfctl_append_rule: calloc");
1601 
1602 		pf_init_eth_ruleset(&r->anchor->ruleset);
1603 		r->anchor->ruleset.anchor = r->anchor;
1604 		if (strlcpy(r->anchor->path, anchor_call,
1605 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1606 			errx(1, "pfctl_append_rule: strlcpy");
1607 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1608 			if (!strlen(p))
1609 				err(1, "pfctl_append_eth_rule: bad anchor name %s",
1610 				    anchor_call);
1611 		} else
1612 			p = (char *)anchor_call;
1613 		if (strlcpy(r->anchor->name, p,
1614 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1615 			errx(1, "pfctl_append_eth_rule: strlcpy");
1616 	}
1617 
1618 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1619 		err(1, "calloc");
1620 	bcopy(r, rule, sizeof(*rule));
1621 
1622 	TAILQ_INSERT_TAIL(&rs->rules, rule, entries);
1623 	return (0);
1624 }
1625 
1626 int
1627 pfctl_eth_ruleset_trans(struct pfctl *pf, char *path,
1628     struct pfctl_eth_anchor *a)
1629 {
1630 	int osize = pf->trans->pfrb_size;
1631 
1632 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0) {
1633 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1634 			return (1);
1635 	}
1636 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1637 		return (5);
1638 
1639 	return (0);
1640 }
1641 
1642 int
1643 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a, bool do_eth)
1644 {
1645 	int osize = pf->trans->pfrb_size;
1646 
1647 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0 && do_eth) {
1648 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1649 			return (1);
1650 	}
1651 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1652 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1653 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1654 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1655 			return (1);
1656 	}
1657 	if (a == pf->astack[0] && ((altqsupport &&
1658 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1659 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1660 			return (2);
1661 	}
1662 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1663 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1664 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1665 			return (3);
1666 	}
1667 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1668 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1669 			return (4);
1670 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1671 		return (5);
1672 
1673 	return (0);
1674 }
1675 
1676 int
1677 pfctl_load_eth_ruleset(struct pfctl *pf, char *path,
1678     struct pfctl_eth_ruleset *rs, int depth)
1679 {
1680 	struct pfctl_eth_rule	*r;
1681 	int	error, len = strlen(path);
1682 	int	brace = 0;
1683 
1684 	pf->eanchor = rs->anchor;
1685 	if (path[0])
1686 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->eanchor->name);
1687 	else
1688 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->eanchor->name);
1689 
1690 	if (depth) {
1691 		if (TAILQ_FIRST(&rs->rules) != NULL) {
1692 			brace++;
1693 			if (pf->opts & PF_OPT_VERBOSE)
1694 				printf(" {\n");
1695 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1696 			    (error = pfctl_eth_ruleset_trans(pf,
1697 			    path, rs->anchor))) {
1698 				printf("pfctl_load_eth_rulesets: "
1699 				    "pfctl_eth_ruleset_trans %d\n", error);
1700 				goto error;
1701 			}
1702 		} else if (pf->opts & PF_OPT_VERBOSE)
1703 			printf("\n");
1704 	}
1705 
1706 	while ((r = TAILQ_FIRST(&rs->rules)) != NULL) {
1707 		TAILQ_REMOVE(&rs->rules, r, entries);
1708 
1709 		error = pfctl_load_eth_rule(pf, path, r, depth);
1710 		if (error)
1711 			return (error);
1712 
1713 		if (r->anchor) {
1714 			if ((error = pfctl_load_eth_ruleset(pf, path,
1715 			    &r->anchor->ruleset, depth + 1)))
1716 				return (error);
1717 		} else if (pf->opts & PF_OPT_VERBOSE)
1718 			printf("\n");
1719 		free(r);
1720 	}
1721 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1722 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1723 		printf("}\n");
1724 	}
1725 	path[len] = '\0';
1726 
1727 	return (0);
1728 error:
1729 	path[len] = '\0';
1730 	return (error);
1731 }
1732 
1733 int
1734 pfctl_load_eth_rule(struct pfctl *pf, char *path, struct pfctl_eth_rule *r,
1735     int depth)
1736 {
1737 	char			*name;
1738 	char			anchor[PF_ANCHOR_NAME_SIZE];
1739 	int			len = strlen(path);
1740 
1741 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1742 		errx(1, "pfctl_load_eth_rule: strlcpy");
1743 
1744 	if (r->anchor) {
1745 		if (r->anchor->match) {
1746 			if (path[0])
1747 				snprintf(&path[len], MAXPATHLEN - len,
1748 				    "/%s", r->anchor->name);
1749 			else
1750 				snprintf(&path[len], MAXPATHLEN - len,
1751 				    "%s", r->anchor->name);
1752 			name = r->anchor->name;
1753 		} else
1754 			name = r->anchor->path;
1755 	} else
1756 		name = "";
1757 
1758 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1759 		if (pfctl_add_eth_rule(pf->dev, r, anchor, name,
1760 		    pf->eth_ticket))
1761 			err(1, "DIOCADDETHRULENV");
1762 
1763 	if (pf->opts & PF_OPT_VERBOSE) {
1764 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1765 		print_eth_rule(r, r->anchor ? r->anchor->name : "",
1766 		    pf->opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1767 	}
1768 
1769 	path[len] = '\0';
1770 
1771 	return (0);
1772 }
1773 
1774 int
1775 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1776     int rs_num, int depth)
1777 {
1778 	struct pfctl_rule *r;
1779 	int		error, len = strlen(path);
1780 	int		brace = 0;
1781 
1782 	pf->anchor = rs->anchor;
1783 
1784 	if (path[0])
1785 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1786 	else
1787 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1788 
1789 	if (depth) {
1790 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1791 			brace++;
1792 			if (pf->opts & PF_OPT_VERBOSE)
1793 				printf(" {\n");
1794 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1795 			    (error = pfctl_ruleset_trans(pf,
1796 			    path, rs->anchor, false))) {
1797 				printf("pfctl_load_rulesets: "
1798 				    "pfctl_ruleset_trans %d\n", error);
1799 				goto error;
1800 			}
1801 		} else if (pf->opts & PF_OPT_VERBOSE)
1802 			printf("\n");
1803 
1804 	}
1805 
1806 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1807 		pfctl_optimize_ruleset(pf, rs);
1808 
1809 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1810 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1811 
1812 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1813 			expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
1814 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
1815 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
1816 
1817 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1818 			goto error;
1819 		if (r->anchor) {
1820 			if ((error = pfctl_load_ruleset(pf, path,
1821 			    &r->anchor->ruleset, rs_num, depth + 1)))
1822 				goto error;
1823 		} else if (pf->opts & PF_OPT_VERBOSE)
1824 			printf("\n");
1825 		free(r);
1826 	}
1827 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1828 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1829 		printf("}\n");
1830 	}
1831 	path[len] = '\0';
1832 	return (0);
1833 
1834  error:
1835 	path[len] = '\0';
1836 	return (error);
1837 
1838 }
1839 
1840 int
1841 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
1842 {
1843 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
1844 	char			*name;
1845 	u_int32_t		ticket;
1846 	char			anchor[PF_ANCHOR_NAME_SIZE];
1847 	int			len = strlen(path);
1848 
1849 	/* set up anchor before adding to path for anchor_call */
1850 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1851 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1852 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1853 		errx(1, "pfctl_load_rule: strlcpy");
1854 
1855 	if (r->anchor) {
1856 		if (r->anchor->match) {
1857 			if (path[0])
1858 				snprintf(&path[len], MAXPATHLEN - len,
1859 				    "/%s", r->anchor->name);
1860 			else
1861 				snprintf(&path[len], MAXPATHLEN - len,
1862 				    "%s", r->anchor->name);
1863 			name = r->anchor->name;
1864 		} else
1865 			name = r->anchor->path;
1866 	} else
1867 		name = "";
1868 
1869 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1870 		if (pfctl_add_pool(pf, &r->rpool, r->af))
1871 			return (1);
1872 		if (pfctl_add_rule(pf->dev, r, anchor, name, ticket,
1873 		    pf->paddr.ticket))
1874 			err(1, "DIOCADDRULENV");
1875 	}
1876 
1877 	if (pf->opts & PF_OPT_VERBOSE) {
1878 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1879 		print_rule(r, r->anchor ? r->anchor->name : "",
1880 		    pf->opts & PF_OPT_VERBOSE2,
1881 		    pf->opts & PF_OPT_NUMERIC);
1882 	}
1883 	path[len] = '\0';
1884 	pfctl_clear_pool(&r->rpool);
1885 	return (0);
1886 }
1887 
1888 int
1889 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1890 {
1891 	if (altqsupport &&
1892 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1893 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1894 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1895 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1896 				if (errno == ENXIO)
1897 					errx(1, "qtype not configured");
1898 				else if (errno == ENODEV)
1899 					errx(1, "%s: driver does not support "
1900 					    "altq", a->ifname);
1901 				else
1902 					err(1, "DIOCADDALTQ");
1903 			}
1904 		}
1905 		pfaltq_store(&pf->paltq->altq);
1906 	}
1907 	return (0);
1908 }
1909 
1910 int
1911 pfctl_rules(int dev, char *filename, int opts, int optimize,
1912     char *anchorname, struct pfr_buffer *trans)
1913 {
1914 #define ERR(x) do { warn(x); goto _error; } while(0)
1915 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1916 
1917 	struct pfr_buffer	*t, buf;
1918 	struct pfioc_altq	 pa;
1919 	struct pfctl		 pf;
1920 	struct pfctl_ruleset	*rs;
1921 	struct pfctl_eth_ruleset	*ethrs;
1922 	struct pfr_table	 trs;
1923 	char			*path;
1924 	int			 osize;
1925 
1926 	RB_INIT(&pf_anchors);
1927 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1928 	pf_init_ruleset(&pf_main_anchor.ruleset);
1929 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1930 
1931 	memset(&pf_eth_main_anchor, 0, sizeof(pf_eth_main_anchor));
1932 	pf_init_eth_ruleset(&pf_eth_main_anchor.ruleset);
1933 	pf_eth_main_anchor.ruleset.anchor = &pf_eth_main_anchor;
1934 
1935 	if (trans == NULL) {
1936 		bzero(&buf, sizeof(buf));
1937 		buf.pfrb_type = PFRB_TRANS;
1938 		t = &buf;
1939 		osize = 0;
1940 	} else {
1941 		t = trans;
1942 		osize = t->pfrb_size;
1943 	}
1944 
1945 	memset(&pa, 0, sizeof(pa));
1946 	pa.version = PFIOC_ALTQ_VERSION;
1947 	memset(&pf, 0, sizeof(pf));
1948 	memset(&trs, 0, sizeof(trs));
1949 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
1950 		ERRX("pfctl_rules: calloc");
1951 	if (strlcpy(trs.pfrt_anchor, anchorname,
1952 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1953 		ERRX("pfctl_rules: strlcpy");
1954 	pf.dev = dev;
1955 	pf.opts = opts;
1956 	pf.optimize = optimize;
1957 	pf.loadopt = loadopt;
1958 
1959 	/* non-brace anchor, create without resolving the path */
1960 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1961 		ERRX("pfctl_rules: calloc");
1962 	rs = &pf.anchor->ruleset;
1963 	pf_init_ruleset(rs);
1964 	rs->anchor = pf.anchor;
1965 	if (strlcpy(pf.anchor->path, anchorname,
1966 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1967 		errx(1, "pfctl_rules: strlcpy");
1968 	if (strlcpy(pf.anchor->name, anchorname,
1969 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1970 		errx(1, "pfctl_rules: strlcpy");
1971 
1972 
1973 	pf.astack[0] = pf.anchor;
1974 	pf.asd = 0;
1975 	if (anchorname[0])
1976 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1977 	pf.paltq = &pa;
1978 	pf.trans = t;
1979 	pfctl_init_options(&pf);
1980 
1981 	/* Set up ethernet anchor */
1982 	if ((pf.eanchor = calloc(1, sizeof(*pf.eanchor))) == NULL)
1983 		ERRX("pfctl_rules: calloc");
1984 
1985 	if (strlcpy(pf.eanchor->path, anchorname,
1986 	    sizeof(pf.eanchor->path)) >= sizeof(pf.eanchor->path))
1987 		errx(1, "pfctl_rules: strlcpy");
1988 	if (strlcpy(pf.eanchor->name, anchorname,
1989 	    sizeof(pf.eanchor->name)) >= sizeof(pf.eanchor->name))
1990 		errx(1, "pfctl_rules: strlcpy");
1991 
1992 	ethrs = &pf.eanchor->ruleset;
1993 	pf_init_eth_ruleset(ethrs);
1994 	ethrs->anchor = pf.eanchor;
1995 	pf.eastack[0] = pf.eanchor;
1996 
1997 	if ((opts & PF_OPT_NOACTION) == 0) {
1998 		/*
1999 		 * XXX For the time being we need to open transactions for
2000 		 * the main ruleset before parsing, because tables are still
2001 		 * loaded at parse time.
2002 		 */
2003 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor, true))
2004 			ERRX("pfctl_rules");
2005 		if (pf.loadopt & PFCTL_FLAG_ETH)
2006 			pf.eth_ticket = pfctl_get_ticket(t, PF_RULESET_ETH, anchorname);
2007 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
2008 			pa.ticket =
2009 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
2010 		if (pf.loadopt & PFCTL_FLAG_TABLE)
2011 			pf.astack[0]->ruleset.tticket =
2012 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
2013 	}
2014 
2015 	if (parse_config(filename, &pf) < 0) {
2016 		if ((opts & PF_OPT_NOACTION) == 0)
2017 			ERRX("Syntax error in config file: "
2018 			    "pf rules not loaded");
2019 		else
2020 			goto _error;
2021 	}
2022 	if (loadopt & PFCTL_FLAG_OPTION)
2023 		pfctl_adjust_skip_ifaces(&pf);
2024 
2025 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
2026 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
2027 	    (pf.loadopt & PFCTL_FLAG_ETH &&
2028 	    (pfctl_load_eth_ruleset(&pf, path, ethrs, 0))) ||
2029 	    (pf.loadopt & PFCTL_FLAG_NAT &&
2030 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
2031 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
2032 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
2033 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
2034 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
2035 		if ((opts & PF_OPT_NOACTION) == 0)
2036 			ERRX("Unable to load rules into kernel");
2037 		else
2038 			goto _error;
2039 	}
2040 
2041 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
2042 		if (check_commit_altq(dev, opts) != 0)
2043 			ERRX("errors in altq config");
2044 
2045 	/* process "load anchor" directives */
2046 	if (!anchorname[0])
2047 		if (pfctl_load_anchors(dev, &pf, t) == -1)
2048 			ERRX("load anchors");
2049 
2050 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
2051 		if (!anchorname[0])
2052 			if (pfctl_load_options(&pf))
2053 				goto _error;
2054 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
2055 			ERR("DIOCXCOMMIT");
2056 	}
2057 	free(path);
2058 	return (0);
2059 
2060 _error:
2061 	if (trans == NULL) {	/* main ruleset */
2062 		if ((opts & PF_OPT_NOACTION) == 0)
2063 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
2064 				err(1, "DIOCXROLLBACK");
2065 		exit(1);
2066 	} else {		/* sub ruleset */
2067 		free(path);
2068 		return (-1);
2069 	}
2070 
2071 #undef ERR
2072 #undef ERRX
2073 }
2074 
2075 FILE *
2076 pfctl_fopen(const char *name, const char *mode)
2077 {
2078 	struct stat	 st;
2079 	FILE		*fp;
2080 
2081 	fp = fopen(name, mode);
2082 	if (fp == NULL)
2083 		return (NULL);
2084 	if (fstat(fileno(fp), &st)) {
2085 		fclose(fp);
2086 		return (NULL);
2087 	}
2088 	if (S_ISDIR(st.st_mode)) {
2089 		fclose(fp);
2090 		errno = EISDIR;
2091 		return (NULL);
2092 	}
2093 	return (fp);
2094 }
2095 
2096 void
2097 pfctl_init_options(struct pfctl *pf)
2098 {
2099 
2100 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2101 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
2102 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2103 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2104 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
2105 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2106 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
2107 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
2108 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
2109 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
2110 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
2111 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
2112 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
2113 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
2114 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
2115 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
2116 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
2117 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
2118 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
2119 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
2120 
2121 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
2122 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
2123 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
2124 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
2125 
2126 	pf->debug = PF_DEBUG_URGENT;
2127 
2128 	pf->syncookies = false;
2129 	pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
2130 	pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
2131 }
2132 
2133 int
2134 pfctl_load_options(struct pfctl *pf)
2135 {
2136 	int i, error = 0;
2137 
2138 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2139 		return (0);
2140 
2141 	/* load limits */
2142 	for (i = 0; i < PF_LIMIT_MAX; i++) {
2143 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
2144 			continue;
2145 		if (pfctl_load_limit(pf, i, pf->limit[i]))
2146 			error = 1;
2147 	}
2148 
2149 	/*
2150 	 * If we've set the limit, but haven't explicitly set adaptive
2151 	 * timeouts, do it now with a start of 60% and end of 120%.
2152 	 */
2153 	if (pf->limit_set[PF_LIMIT_STATES] &&
2154 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
2155 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
2156 		pf->timeout[PFTM_ADAPTIVE_START] =
2157 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
2158 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
2159 		pf->timeout[PFTM_ADAPTIVE_END] =
2160 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
2161 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
2162 	}
2163 
2164 	/* load timeouts */
2165 	for (i = 0; i < PFTM_MAX; i++) {
2166 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
2167 			continue;
2168 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
2169 			error = 1;
2170 	}
2171 
2172 	/* load debug */
2173 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
2174 		if (pfctl_load_debug(pf, pf->debug))
2175 			error = 1;
2176 
2177 	/* load logif */
2178 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
2179 		if (pfctl_load_logif(pf, pf->ifname))
2180 			error = 1;
2181 
2182 	/* load hostid */
2183 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
2184 		if (pfctl_load_hostid(pf, pf->hostid))
2185 			error = 1;
2186 
2187 	/* load keepcounters */
2188 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
2189 		error = 1;
2190 
2191 	/* load syncookies settings */
2192 	if (pfctl_load_syncookies(pf, pf->syncookies))
2193 		error = 1;
2194 
2195 	return (error);
2196 }
2197 
2198 int
2199 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
2200 {
2201 	int i;
2202 
2203 
2204 	for (i = 0; pf_limits[i].name; i++) {
2205 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
2206 			pf->limit[pf_limits[i].index] = limit;
2207 			pf->limit_set[pf_limits[i].index] = 1;
2208 			break;
2209 		}
2210 	}
2211 	if (pf_limits[i].name == NULL) {
2212 		warnx("Bad pool name.");
2213 		return (1);
2214 	}
2215 
2216 	if (pf->opts & PF_OPT_VERBOSE)
2217 		printf("set limit %s %d\n", opt, limit);
2218 
2219 	return (0);
2220 }
2221 
2222 int
2223 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
2224 {
2225 	struct pfioc_limit pl;
2226 
2227 	memset(&pl, 0, sizeof(pl));
2228 	pl.index = index;
2229 	pl.limit = limit;
2230 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
2231 		if (errno == EBUSY)
2232 			warnx("Current pool size exceeds requested hard limit");
2233 		else
2234 			warnx("DIOCSETLIMIT");
2235 		return (1);
2236 	}
2237 	return (0);
2238 }
2239 
2240 int
2241 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
2242 {
2243 	int i;
2244 
2245 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2246 		return (0);
2247 
2248 	for (i = 0; pf_timeouts[i].name; i++) {
2249 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
2250 			pf->timeout[pf_timeouts[i].timeout] = seconds;
2251 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
2252 			break;
2253 		}
2254 	}
2255 
2256 	if (pf_timeouts[i].name == NULL) {
2257 		warnx("Bad timeout name.");
2258 		return (1);
2259 	}
2260 
2261 
2262 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
2263 		printf("set timeout %s %d\n", opt, seconds);
2264 
2265 	return (0);
2266 }
2267 
2268 int
2269 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
2270 {
2271 	struct pfioc_tm pt;
2272 
2273 	memset(&pt, 0, sizeof(pt));
2274 	pt.timeout = timeout;
2275 	pt.seconds = seconds;
2276 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
2277 		warnx("DIOCSETTIMEOUT");
2278 		return (1);
2279 	}
2280 	return (0);
2281 }
2282 
2283 int
2284 pfctl_set_optimization(struct pfctl *pf, const char *opt)
2285 {
2286 	const struct pf_hint *hint;
2287 	int i, r;
2288 
2289 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2290 		return (0);
2291 
2292 	for (i = 0; pf_hints[i].name; i++)
2293 		if (strcasecmp(opt, pf_hints[i].name) == 0)
2294 			break;
2295 
2296 	hint = pf_hints[i].hint;
2297 	if (hint == NULL) {
2298 		warnx("invalid state timeouts optimization");
2299 		return (1);
2300 	}
2301 
2302 	for (i = 0; hint[i].name; i++)
2303 		if ((r = pfctl_set_timeout(pf, hint[i].name,
2304 		    hint[i].timeout, 1)))
2305 			return (r);
2306 
2307 	if (pf->opts & PF_OPT_VERBOSE)
2308 		printf("set optimization %s\n", opt);
2309 
2310 	return (0);
2311 }
2312 
2313 int
2314 pfctl_set_logif(struct pfctl *pf, char *ifname)
2315 {
2316 
2317 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2318 		return (0);
2319 
2320 	if (!strcmp(ifname, "none")) {
2321 		free(pf->ifname);
2322 		pf->ifname = NULL;
2323 	} else {
2324 		pf->ifname = strdup(ifname);
2325 		if (!pf->ifname)
2326 			errx(1, "pfctl_set_logif: strdup");
2327 	}
2328 	pf->ifname_set = 1;
2329 
2330 	if (pf->opts & PF_OPT_VERBOSE)
2331 		printf("set loginterface %s\n", ifname);
2332 
2333 	return (0);
2334 }
2335 
2336 int
2337 pfctl_load_logif(struct pfctl *pf, char *ifname)
2338 {
2339 	struct pfioc_if pi;
2340 
2341 	memset(&pi, 0, sizeof(pi));
2342 	if (ifname && strlcpy(pi.ifname, ifname,
2343 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
2344 		warnx("pfctl_load_logif: strlcpy");
2345 		return (1);
2346 	}
2347 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
2348 		warnx("DIOCSETSTATUSIF");
2349 		return (1);
2350 	}
2351 	return (0);
2352 }
2353 
2354 int
2355 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2356 {
2357 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2358 		return (0);
2359 
2360 	HTONL(hostid);
2361 
2362 	pf->hostid = hostid;
2363 	pf->hostid_set = 1;
2364 
2365 	if (pf->opts & PF_OPT_VERBOSE)
2366 		printf("set hostid 0x%08x\n", ntohl(hostid));
2367 
2368 	return (0);
2369 }
2370 
2371 int
2372 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2373 {
2374 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2375 		warnx("DIOCSETHOSTID");
2376 		return (1);
2377 	}
2378 	return (0);
2379 }
2380 
2381 int
2382 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2383 {
2384 	struct pfctl_syncookies	cookies;
2385 
2386 	bzero(&cookies, sizeof(cookies));
2387 
2388 	cookies.mode = val;
2389 	cookies.lowwater = pf->syncookieswat[0];
2390 	cookies.highwater = pf->syncookieswat[1];
2391 
2392 	if (pfctl_set_syncookies(dev, &cookies)) {
2393 		warnx("DIOCSETSYNCOOKIES");
2394 		return (1);
2395 	}
2396 	return (0);
2397 }
2398 
2399 int
2400 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2401 {
2402 	if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2403 		warnx("syncookies start/end only apply to adaptive");
2404 		return (1);
2405 	}
2406 	if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2407 		if (!w->hi)
2408 			w->hi = PF_SYNCOOKIES_HIWATPCT;
2409 		if (!w->lo)
2410 			w->lo = w->hi / 2;
2411 		if (w->lo >= w->hi) {
2412 			warnx("start must be higher than end");
2413 			return (1);
2414 		}
2415 		pf->syncookieswat[0] = w->lo;
2416 		pf->syncookieswat[1] = w->hi;
2417 		pf->syncookieswat_set = 1;
2418 	}
2419 
2420 	if (pf->opts & PF_OPT_VERBOSE) {
2421 		if (val == PF_SYNCOOKIES_NEVER)
2422 			printf("set syncookies never\n");
2423 		else if (val == PF_SYNCOOKIES_ALWAYS)
2424 			printf("set syncookies always\n");
2425 		else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2426 			if (pf->syncookieswat_set)
2427 				printf("set syncookies adaptive (start %u%%, "
2428 				    "end %u%%)\n", pf->syncookieswat[1],
2429 				    pf->syncookieswat[0]);
2430 			else
2431 				printf("set syncookies adaptive\n");
2432 		} else {        /* cannot happen */
2433 			warnx("king bula ate all syncookies");
2434 			return (1);
2435 		}
2436 	}
2437 
2438 	pf->syncookies = val;
2439 	return (0);
2440 }
2441 
2442 int
2443 pfctl_set_debug(struct pfctl *pf, char *d)
2444 {
2445 	u_int32_t	level;
2446 
2447 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2448 		return (0);
2449 
2450 	if (!strcmp(d, "none"))
2451 		pf->debug = PF_DEBUG_NONE;
2452 	else if (!strcmp(d, "urgent"))
2453 		pf->debug = PF_DEBUG_URGENT;
2454 	else if (!strcmp(d, "misc"))
2455 		pf->debug = PF_DEBUG_MISC;
2456 	else if (!strcmp(d, "loud"))
2457 		pf->debug = PF_DEBUG_NOISY;
2458 	else {
2459 		warnx("unknown debug level \"%s\"", d);
2460 		return (-1);
2461 	}
2462 
2463 	pf->debug_set = 1;
2464 	level = pf->debug;
2465 
2466 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2467 		if (ioctl(dev, DIOCSETDEBUG, &level))
2468 			err(1, "DIOCSETDEBUG");
2469 
2470 	if (pf->opts & PF_OPT_VERBOSE)
2471 		printf("set debug %s\n", d);
2472 
2473 	return (0);
2474 }
2475 
2476 int
2477 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2478 {
2479 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
2480 		warnx("DIOCSETDEBUG");
2481 		return (1);
2482 	}
2483 	return (0);
2484 }
2485 
2486 int
2487 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2488 {
2489 	struct pfioc_iface	pi;
2490 	struct node_host	*h = NULL, *n = NULL;
2491 
2492 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2493 		return (0);
2494 
2495 	bzero(&pi, sizeof(pi));
2496 
2497 	pi.pfiio_flags = flags;
2498 
2499 	/* Make sure our cache matches the kernel. If we set or clear the flag
2500 	 * for a group this applies to all members. */
2501 	h = ifa_grouplookup(ifname, 0);
2502 	for (n = h; n != NULL; n = n->next)
2503 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2504 
2505 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2506 	    sizeof(pi.pfiio_name))
2507 		errx(1, "pfctl_set_interface_flags: strlcpy");
2508 
2509 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2510 		if (how == 0) {
2511 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2512 				err(1, "DIOCCLRIFFLAG");
2513 		} else {
2514 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2515 				err(1, "DIOCSETIFFLAG");
2516 			pfctl_check_skip_ifaces(ifname);
2517 		}
2518 	}
2519 	return (0);
2520 }
2521 
2522 void
2523 pfctl_debug(int dev, u_int32_t level, int opts)
2524 {
2525 	if (ioctl(dev, DIOCSETDEBUG, &level))
2526 		err(1, "DIOCSETDEBUG");
2527 	if ((opts & PF_OPT_QUIET) == 0) {
2528 		fprintf(stderr, "debug level set to '");
2529 		switch (level) {
2530 		case PF_DEBUG_NONE:
2531 			fprintf(stderr, "none");
2532 			break;
2533 		case PF_DEBUG_URGENT:
2534 			fprintf(stderr, "urgent");
2535 			break;
2536 		case PF_DEBUG_MISC:
2537 			fprintf(stderr, "misc");
2538 			break;
2539 		case PF_DEBUG_NOISY:
2540 			fprintf(stderr, "loud");
2541 			break;
2542 		default:
2543 			fprintf(stderr, "<invalid>");
2544 			break;
2545 		}
2546 		fprintf(stderr, "'\n");
2547 	}
2548 }
2549 
2550 int
2551 pfctl_test_altqsupport(int dev, int opts)
2552 {
2553 	struct pfioc_altq pa;
2554 
2555 	pa.version = PFIOC_ALTQ_VERSION;
2556 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2557 		if (errno == ENODEV) {
2558 			if (opts & PF_OPT_VERBOSE)
2559 				fprintf(stderr, "No ALTQ support in kernel\n"
2560 				    "ALTQ related functions disabled\n");
2561 			return (0);
2562 		} else
2563 			err(1, "DIOCGETALTQS");
2564 	}
2565 	return (1);
2566 }
2567 
2568 int
2569 pfctl_show_anchors(int dev, int opts, char *anchorname)
2570 {
2571 	struct pfioc_ruleset	 pr;
2572 	u_int32_t		 mnr, nr;
2573 
2574 	memset(&pr, 0, sizeof(pr));
2575 	memcpy(pr.path, anchorname, sizeof(pr.path));
2576 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2577 		if (errno == EINVAL)
2578 			fprintf(stderr, "Anchor '%s' not found.\n",
2579 			    anchorname);
2580 		else
2581 			err(1, "DIOCGETRULESETS");
2582 		return (-1);
2583 	}
2584 	mnr = pr.nr;
2585 	for (nr = 0; nr < mnr; ++nr) {
2586 		char sub[MAXPATHLEN];
2587 
2588 		pr.nr = nr;
2589 		if (ioctl(dev, DIOCGETRULESET, &pr))
2590 			err(1, "DIOCGETRULESET");
2591 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2592 			continue;
2593 		sub[0] = 0;
2594 		if (pr.path[0]) {
2595 			strlcat(sub, pr.path, sizeof(sub));
2596 			strlcat(sub, "/", sizeof(sub));
2597 		}
2598 		strlcat(sub, pr.name, sizeof(sub));
2599 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2600 			printf("  %s\n", sub);
2601 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2602 			return (-1);
2603 	}
2604 	return (0);
2605 }
2606 
2607 const char *
2608 pfctl_lookup_option(char *cmd, const char * const *list)
2609 {
2610 	if (cmd != NULL && *cmd)
2611 		for (; *list; list++)
2612 			if (!strncmp(cmd, *list, strlen(cmd)))
2613 				return (*list);
2614 	return (NULL);
2615 }
2616 
2617 int
2618 main(int argc, char *argv[])
2619 {
2620 	int	 error = 0;
2621 	int	 ch;
2622 	int	 mode = O_RDONLY;
2623 	int	 opts = 0;
2624 	int	 optimize = PF_OPTIMIZE_BASIC;
2625 	char	 anchorname[MAXPATHLEN];
2626 	char	*path;
2627 
2628 	if (argc < 2)
2629 		usage();
2630 
2631 	while ((ch = getopt(argc, argv,
2632 	    "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2633 		switch (ch) {
2634 		case 'a':
2635 			anchoropt = optarg;
2636 			break;
2637 		case 'd':
2638 			opts |= PF_OPT_DISABLE;
2639 			mode = O_RDWR;
2640 			break;
2641 		case 'D':
2642 			if (pfctl_cmdline_symset(optarg) < 0)
2643 				warnx("could not parse macro definition %s",
2644 				    optarg);
2645 			break;
2646 		case 'e':
2647 			opts |= PF_OPT_ENABLE;
2648 			mode = O_RDWR;
2649 			break;
2650 		case 'q':
2651 			opts |= PF_OPT_QUIET;
2652 			break;
2653 		case 'F':
2654 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2655 			if (clearopt == NULL) {
2656 				warnx("Unknown flush modifier '%s'", optarg);
2657 				usage();
2658 			}
2659 			mode = O_RDWR;
2660 			break;
2661 		case 'i':
2662 			ifaceopt = optarg;
2663 			break;
2664 		case 'k':
2665 			if (state_killers >= 2) {
2666 				warnx("can only specify -k twice");
2667 				usage();
2668 				/* NOTREACHED */
2669 			}
2670 			state_kill[state_killers++] = optarg;
2671 			mode = O_RDWR;
2672 			break;
2673 		case 'K':
2674 			if (src_node_killers >= 2) {
2675 				warnx("can only specify -K twice");
2676 				usage();
2677 				/* NOTREACHED */
2678 			}
2679 			src_node_kill[src_node_killers++] = optarg;
2680 			mode = O_RDWR;
2681 			break;
2682 		case 'm':
2683 			opts |= PF_OPT_MERGE;
2684 			break;
2685 		case 'M':
2686 			opts |= PF_OPT_KILLMATCH;
2687 			break;
2688 		case 'n':
2689 			opts |= PF_OPT_NOACTION;
2690 			break;
2691 		case 'N':
2692 			loadopt |= PFCTL_FLAG_NAT;
2693 			break;
2694 		case 'r':
2695 			opts |= PF_OPT_USEDNS;
2696 			break;
2697 		case 'f':
2698 			rulesopt = optarg;
2699 			mode = O_RDWR;
2700 			break;
2701 		case 'g':
2702 			opts |= PF_OPT_DEBUG;
2703 			break;
2704 		case 'A':
2705 			loadopt |= PFCTL_FLAG_ALTQ;
2706 			break;
2707 		case 'R':
2708 			loadopt |= PFCTL_FLAG_FILTER;
2709 			break;
2710 		case 'o':
2711 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2712 			if (optiopt == NULL) {
2713 				warnx("Unknown optimization '%s'", optarg);
2714 				usage();
2715 			}
2716 			opts |= PF_OPT_OPTIMIZE;
2717 			break;
2718 		case 'O':
2719 			loadopt |= PFCTL_FLAG_OPTION;
2720 			break;
2721 		case 'p':
2722 			pf_device = optarg;
2723 			break;
2724 		case 'P':
2725 			opts |= PF_OPT_NUMERIC;
2726 			break;
2727 		case 's':
2728 			showopt = pfctl_lookup_option(optarg, showopt_list);
2729 			if (showopt == NULL) {
2730 				warnx("Unknown show modifier '%s'", optarg);
2731 				usage();
2732 			}
2733 			break;
2734 		case 't':
2735 			tableopt = optarg;
2736 			break;
2737 		case 'T':
2738 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2739 			if (tblcmdopt == NULL) {
2740 				warnx("Unknown table command '%s'", optarg);
2741 				usage();
2742 			}
2743 			break;
2744 		case 'v':
2745 			if (opts & PF_OPT_VERBOSE)
2746 				opts |= PF_OPT_VERBOSE2;
2747 			opts |= PF_OPT_VERBOSE;
2748 			break;
2749 		case 'x':
2750 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
2751 			if (debugopt == NULL) {
2752 				warnx("Unknown debug level '%s'", optarg);
2753 				usage();
2754 			}
2755 			mode = O_RDWR;
2756 			break;
2757 		case 'z':
2758 			opts |= PF_OPT_CLRRULECTRS;
2759 			mode = O_RDWR;
2760 			break;
2761 		case 'h':
2762 			/* FALLTHROUGH */
2763 		default:
2764 			usage();
2765 			/* NOTREACHED */
2766 		}
2767 	}
2768 
2769 	if (tblcmdopt != NULL) {
2770 		argc -= optind;
2771 		argv += optind;
2772 		ch = *tblcmdopt;
2773 		if (ch == 'l') {
2774 			loadopt |= PFCTL_FLAG_TABLE;
2775 			tblcmdopt = NULL;
2776 		} else
2777 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2778 	} else if (argc != optind) {
2779 		warnx("unknown command line argument: %s ...", argv[optind]);
2780 		usage();
2781 		/* NOTREACHED */
2782 	}
2783 	if (loadopt == 0)
2784 		loadopt = ~0;
2785 
2786 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2787 		errx(1, "pfctl: calloc");
2788 	memset(anchorname, 0, sizeof(anchorname));
2789 	if (anchoropt != NULL) {
2790 		int len = strlen(anchoropt);
2791 
2792 		if (anchoropt[len - 1] == '*') {
2793 			if (len >= 2 && anchoropt[len - 2] == '/')
2794 				anchoropt[len - 2] = '\0';
2795 			else
2796 				anchoropt[len - 1] = '\0';
2797 			opts |= PF_OPT_RECURSE;
2798 		}
2799 		if (strlcpy(anchorname, anchoropt,
2800 		    sizeof(anchorname)) >= sizeof(anchorname))
2801 			errx(1, "anchor name '%s' too long",
2802 			    anchoropt);
2803 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE|PFCTL_FLAG_ETH;
2804 	}
2805 
2806 	if ((opts & PF_OPT_NOACTION) == 0) {
2807 		dev = open(pf_device, mode);
2808 		if (dev == -1)
2809 			err(1, "%s", pf_device);
2810 		altqsupport = pfctl_test_altqsupport(dev, opts);
2811 	} else {
2812 		dev = open(pf_device, O_RDONLY);
2813 		if (dev >= 0)
2814 			opts |= PF_OPT_DUMMYACTION;
2815 		/* turn off options */
2816 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2817 		clearopt = showopt = debugopt = NULL;
2818 #if !defined(ENABLE_ALTQ)
2819 		altqsupport = 0;
2820 #else
2821 		altqsupport = 1;
2822 #endif
2823 	}
2824 
2825 	if (opts & PF_OPT_DISABLE)
2826 		if (pfctl_disable(dev, opts))
2827 			error = 1;
2828 
2829 	if (showopt != NULL) {
2830 		switch (*showopt) {
2831 		case 'A':
2832 			pfctl_show_anchors(dev, opts, anchorname);
2833 			break;
2834 		case 'r':
2835 			pfctl_load_fingerprints(dev, opts);
2836 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2837 			    anchorname, 0);
2838 			break;
2839 		case 'l':
2840 			pfctl_load_fingerprints(dev, opts);
2841 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2842 			    anchorname, 0);
2843 			break;
2844 		case 'n':
2845 			pfctl_load_fingerprints(dev, opts);
2846 			pfctl_show_nat(dev, path, opts, anchorname, 0);
2847 			break;
2848 		case 'q':
2849 			pfctl_show_altq(dev, ifaceopt, opts,
2850 			    opts & PF_OPT_VERBOSE2);
2851 			break;
2852 		case 's':
2853 			pfctl_show_states(dev, ifaceopt, opts);
2854 			break;
2855 		case 'S':
2856 			pfctl_show_src_nodes(dev, opts);
2857 			break;
2858 		case 'i':
2859 			pfctl_show_status(dev, opts);
2860 			break;
2861 		case 'R':
2862 			error = pfctl_show_running(dev);
2863 			break;
2864 		case 't':
2865 			pfctl_show_timeouts(dev, opts);
2866 			break;
2867 		case 'm':
2868 			pfctl_show_limits(dev, opts);
2869 			break;
2870 		case 'e':
2871 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0);
2872 			break;
2873 		case 'a':
2874 			opts |= PF_OPT_SHOWALL;
2875 			pfctl_load_fingerprints(dev, opts);
2876 
2877 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0);
2878 
2879 			pfctl_show_nat(dev, path, opts, anchorname, 0);
2880 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2881 			pfctl_show_altq(dev, ifaceopt, opts, 0);
2882 			pfctl_show_states(dev, ifaceopt, opts);
2883 			pfctl_show_src_nodes(dev, opts);
2884 			pfctl_show_status(dev, opts);
2885 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2886 			pfctl_show_timeouts(dev, opts);
2887 			pfctl_show_limits(dev, opts);
2888 			pfctl_show_tables(anchorname, opts);
2889 			pfctl_show_fingerprints(opts);
2890 			break;
2891 		case 'T':
2892 			pfctl_show_tables(anchorname, opts);
2893 			break;
2894 		case 'o':
2895 			pfctl_load_fingerprints(dev, opts);
2896 			pfctl_show_fingerprints(opts);
2897 			break;
2898 		case 'I':
2899 			pfctl_show_ifaces(ifaceopt, opts);
2900 			break;
2901 		}
2902 	}
2903 
2904 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL) {
2905 		pfctl_show_eth_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2906 		    anchorname, 0);
2907 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2908 		    anchorname, 0);
2909 	}
2910 
2911 	if (clearopt != NULL) {
2912 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2913 			errx(1, "anchor names beginning with '_' cannot "
2914 			    "be modified from the command line");
2915 
2916 		switch (*clearopt) {
2917 		case 'e':
2918 			pfctl_flush_eth_rules(dev, opts, anchorname);
2919 			break;
2920 		case 'r':
2921 			pfctl_flush_rules(dev, opts, anchorname);
2922 			break;
2923 		case 'n':
2924 			pfctl_flush_nat(dev, opts, anchorname);
2925 			break;
2926 		case 'q':
2927 			pfctl_clear_altq(dev, opts);
2928 			break;
2929 		case 's':
2930 			pfctl_clear_iface_states(dev, ifaceopt, opts);
2931 			break;
2932 		case 'S':
2933 			pfctl_clear_src_nodes(dev, opts);
2934 			break;
2935 		case 'i':
2936 			pfctl_clear_stats(dev, opts);
2937 			break;
2938 		case 'a':
2939 			pfctl_flush_eth_rules(dev, opts, anchorname);
2940 			pfctl_flush_rules(dev, opts, anchorname);
2941 			pfctl_flush_nat(dev, opts, anchorname);
2942 			pfctl_clear_tables(anchorname, opts);
2943 			if (!*anchorname) {
2944 				pfctl_clear_altq(dev, opts);
2945 				pfctl_clear_iface_states(dev, ifaceopt, opts);
2946 				pfctl_clear_src_nodes(dev, opts);
2947 				pfctl_clear_stats(dev, opts);
2948 				pfctl_clear_fingerprints(dev, opts);
2949 				pfctl_clear_interface_flags(dev, opts);
2950 			}
2951 			break;
2952 		case 'o':
2953 			pfctl_clear_fingerprints(dev, opts);
2954 			break;
2955 		case 'T':
2956 			pfctl_clear_tables(anchorname, opts);
2957 			break;
2958 		}
2959 	}
2960 	if (state_killers) {
2961 		if (!strcmp(state_kill[0], "label"))
2962 			pfctl_label_kill_states(dev, ifaceopt, opts);
2963 		else if (!strcmp(state_kill[0], "id"))
2964 			pfctl_id_kill_states(dev, ifaceopt, opts);
2965 		else if (!strcmp(state_kill[0], "gateway"))
2966 			pfctl_gateway_kill_states(dev, ifaceopt, opts);
2967 		else
2968 			pfctl_net_kill_states(dev, ifaceopt, opts);
2969 	}
2970 
2971 	if (src_node_killers)
2972 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
2973 
2974 	if (tblcmdopt != NULL) {
2975 		error = pfctl_command_tables(argc, argv, tableopt,
2976 		    tblcmdopt, rulesopt, anchorname, opts);
2977 		rulesopt = NULL;
2978 	}
2979 	if (optiopt != NULL) {
2980 		switch (*optiopt) {
2981 		case 'n':
2982 			optimize = 0;
2983 			break;
2984 		case 'b':
2985 			optimize |= PF_OPTIMIZE_BASIC;
2986 			break;
2987 		case 'o':
2988 		case 'p':
2989 			optimize |= PF_OPTIMIZE_PROFILE;
2990 			break;
2991 		}
2992 	}
2993 
2994 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2995 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
2996 		if (pfctl_get_skip_ifaces())
2997 			error = 1;
2998 
2999 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
3000 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
3001 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
3002 			error = 1;
3003 
3004 	if (rulesopt != NULL) {
3005 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
3006 			errx(1, "anchor names beginning with '_' cannot "
3007 			    "be modified from the command line");
3008 		if (pfctl_rules(dev, rulesopt, opts, optimize,
3009 		    anchorname, NULL))
3010 			error = 1;
3011 		else if (!(opts & PF_OPT_NOACTION) &&
3012 		    (loadopt & PFCTL_FLAG_TABLE))
3013 			warn_namespace_collision(NULL);
3014 	}
3015 
3016 	if (opts & PF_OPT_ENABLE)
3017 		if (pfctl_enable(dev, opts))
3018 			error = 1;
3019 
3020 	if (debugopt != NULL) {
3021 		switch (*debugopt) {
3022 		case 'n':
3023 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
3024 			break;
3025 		case 'u':
3026 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
3027 			break;
3028 		case 'm':
3029 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
3030 			break;
3031 		case 'l':
3032 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
3033 			break;
3034 		}
3035 	}
3036 
3037 	exit(error);
3038 }
3039