sbin/pfctl/pfctl.c

   1 /*      $OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-2-Clause
   5  *
   6  * Copyright (c) 2001 Daniel Hartmeier
   7  * Copyright (c) 2002,2003 Henning Brauer
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  *    - Redistributions of source code must retain the above copyright
  15  *      notice, this list of conditions and the following disclaimer.
  16  *    - Redistributions in binary form must reproduce the above
  17  *      copyright notice, this list of conditions and the following
  18  *      disclaimer in the documentation and/or other materials provided
  19  *      with the distribution.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  32  * POSSIBILITY OF SUCH DAMAGE.
  33  *
  34  */
  35
  36 #include <sys/cdefs.h>
  37 __FBSDID("$FreeBSD$");
  38
  39 #define PFIOC_USE_LATEST
  40
  41 #include <sys/types.h>
  42 #include <sys/ioctl.h>
  43 #include <sys/nv.h>
  44 #include <sys/socket.h>
  45 #include <sys/stat.h>
  46 #include <sys/endian.h>
  47
  48 #include <net/if.h>
  49 #include <netinet/in.h>
  50 #include <net/pfvar.h>
  51 #include <arpa/inet.h>
  52 #include <net/altq/altq.h>
  53 #include <sys/sysctl.h>
  54
  55 #include <err.h>
  56 #include <errno.h>
  57 #include <fcntl.h>
  58 #include <libpfctl.h>
  59 #include <limits.h>
  60 #include <netdb.h>
  61 #include <stdint.h>
  62 #include <stdio.h>
  63 #include <stdlib.h>
  64 #include <string.h>
  65 #include <unistd.h>
  66
  67 #include "pfctl_parser.h"
  68 #include "pfctl.h"
  69
  70 void     usage(void);
  71 int      pfctl_enable(int, int);
  72 int      pfctl_disable(int, int);
  73 int      pfctl_clear_stats(int, int);
  74 int      pfctl_get_skip_ifaces(void);
  75 int      pfctl_check_skip_ifaces(char *);
  76 int      pfctl_adjust_skip_ifaces(struct pfctl *);
  77 int      pfctl_clear_interface_flags(int, int);
  78 int      pfctl_clear_rules(int, int, char *);
  79 int      pfctl_clear_nat(int, int, char *);
  80 int      pfctl_clear_altq(int, int);
  81 int      pfctl_clear_src_nodes(int, int);
  82 int      pfctl_clear_iface_states(int, const char *, int);
  83 void     pfctl_addrprefix(char *, struct pf_addr *);
  84 int      pfctl_kill_src_nodes(int, const char *, int);
  85 int      pfctl_net_kill_states(int, const char *, int);
  86 int      pfctl_gateway_kill_states(int, const char *, int);
  87 int      pfctl_label_kill_states(int, const char *, int);
  88 int      pfctl_id_kill_states(int, const char *, int);
  89 void     pfctl_init_options(struct pfctl *);
  90 int      pfctl_load_options(struct pfctl *);
  91 int      pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
  92 int      pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
  93 int      pfctl_load_debug(struct pfctl *, unsigned int);
  94 int      pfctl_load_logif(struct pfctl *, char *);
  95 int      pfctl_load_hostid(struct pfctl *, u_int32_t);
  96 int      pfctl_load_syncookies(struct pfctl *, u_int8_t);
  97 int      pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
  98             char *);
  99 void     pfctl_print_rule_counters(struct pfctl_rule *, int);
 100 int      pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
 101 int      pfctl_show_nat(int, int, char *);
 102 int      pfctl_show_src_nodes(int, int);
 103 int      pfctl_show_states(int, const char *, int);
 104 int      pfctl_show_status(int, int);
 105 int      pfctl_show_running(int);
 106 int      pfctl_show_timeouts(int, int);
 107 int      pfctl_show_limits(int, int);
 108 void     pfctl_debug(int, u_int32_t, int);
 109 int      pfctl_test_altqsupport(int, int);
 110 int      pfctl_show_anchors(int, int, char *);
 111 int      pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *);
 112 int      pfctl_load_ruleset(struct pfctl *, char *,
 113                 struct pfctl_ruleset *, int, int);
 114 int      pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
 115 const char      *pfctl_lookup_option(char *, const char * const *);
 116
 117 static struct pfctl_anchor_global        pf_anchors;
 118 static struct pfctl_anchor       pf_main_anchor;
 119 static struct pfr_buffer skip_b;
 120
 121 static const char       *clearopt;
 122 static char             *rulesopt;
 123 static const char       *showopt;
 124 static const char       *debugopt;
 125 static char             *anchoropt;
 126 static const char       *optiopt = NULL;
 127 static const char       *pf_device = "/dev/pf";
 128 static char             *ifaceopt;
 129 static char             *tableopt;
 130 static const char       *tblcmdopt;
 131 static int               src_node_killers;
 132 static char             *src_node_kill[2];
 133 static int               state_killers;
 134 static char             *state_kill[2];
 135 int                      loadopt;
 136 int                      altqsupport;
 137
 138 int                      dev = -1;
 139 static int               first_title = 1;
 140 static int               labels = 0;
 141
 142 #define INDENT(d, o)    do {                                            \
 143                                 if (o) {                                \
 144                                         int i;                          \
 145                                         for (i=0; i < d; i++)           \
 146                                                 printf("  ");           \
 147                                 }                                       \
 148                         } while (0);                                    \
 149
 150
 151 static const struct {
 152         const char      *name;
 153         int             index;
 154 } pf_limits[] = {
 155         { "states",             PF_LIMIT_STATES },
 156         { "src-nodes",          PF_LIMIT_SRC_NODES },
 157         { "frags",              PF_LIMIT_FRAGS },
 158         { "table-entries",      PF_LIMIT_TABLE_ENTRIES },
 159         { NULL,                 0 }
 160 };
 161
 162 struct pf_hint {
 163         const char      *name;
 164         int             timeout;
 165 };
 166 static const struct pf_hint pf_hint_normal[] = {
 167         { "tcp.first",          2 * 60 },
 168         { "tcp.opening",        30 },
 169         { "tcp.established",    24 * 60 * 60 },
 170         { "tcp.closing",        15 * 60 },
 171         { "tcp.finwait",        45 },
 172         { "tcp.closed",         90 },
 173         { "tcp.tsdiff",         30 },
 174         { NULL,                 0 }
 175 };
 176 static const struct pf_hint pf_hint_satellite[] = {
 177         { "tcp.first",          3 * 60 },
 178         { "tcp.opening",        30 + 5 },
 179         { "tcp.established",    24 * 60 * 60 },
 180         { "tcp.closing",        15 * 60 + 5 },
 181         { "tcp.finwait",        45 + 5 },
 182         { "tcp.closed",         90 + 5 },
 183         { "tcp.tsdiff",         60 },
 184         { NULL,                 0 }
 185 };
 186 static const struct pf_hint pf_hint_conservative[] = {
 187         { "tcp.first",          60 * 60 },
 188         { "tcp.opening",        15 * 60 },
 189         { "tcp.established",    5 * 24 * 60 * 60 },
 190         { "tcp.closing",        60 * 60 },
 191         { "tcp.finwait",        10 * 60 },
 192         { "tcp.closed",         3 * 60 },
 193         { "tcp.tsdiff",         60 },
 194         { NULL,                 0 }
 195 };
 196 static const struct pf_hint pf_hint_aggressive[] = {
 197         { "tcp.first",          30 },
 198         { "tcp.opening",        5 },
 199         { "tcp.established",    5 * 60 * 60 },
 200         { "tcp.closing",        60 },
 201         { "tcp.finwait",        30 },
 202         { "tcp.closed",         30 },
 203         { "tcp.tsdiff",         10 },
 204         { NULL,                 0 }
 205 };
 206
 207 static const struct {
 208         const char *name;
 209         const struct pf_hint *hint;
 210 } pf_hints[] = {
 211         { "normal",             pf_hint_normal },
 212         { "satellite",          pf_hint_satellite },
 213         { "high-latency",       pf_hint_satellite },
 214         { "conservative",       pf_hint_conservative },
 215         { "aggressive",         pf_hint_aggressive },
 216         { NULL,                 NULL }
 217 };
 218
 219 static const char * const clearopt_list[] = {
 220         "nat", "queue", "rules", "Sources",
 221         "states", "info", "Tables", "osfp", "all", NULL
 222 };
 223
 224 static const char * const showopt_list[] = {
 225         "nat", "queue", "rules", "Anchors", "Sources", "states", "info",
 226         "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
 227         "Running", "all", NULL
 228 };
 229
 230 static const char * const tblcmdopt_list[] = {
 231         "kill", "flush", "add", "delete", "load", "replace", "show",
 232         "test", "zero", "expire", NULL
 233 };
 234
 235 static const char * const debugopt_list[] = {
 236         "none", "urgent", "misc", "loud", NULL
 237 };
 238
 239 static const char * const optiopt_list[] = {
 240         "none", "basic", "profile", NULL
 241 };
 242
 243 void
 244 usage(void)
 245 {
 246         extern char *__progname;
 247
 248         fprintf(stderr,
 249 "usage: %s [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
 250         "\t[-f file] [-i interface] [-K host | network]\n"
 251         "\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
 252         "\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
 253             __progname);
 254
 255         exit(1);
 256 }
 257
 258 /*
 259  * Cache protocol number to name translations.
 260  *
 261  * Translation is performed a lot e.g., when dumping states and
 262  * getprotobynumber is incredibly expensive.
 263  *
 264  * Note from the getprotobynumber(3) manpage:
 265  * <quote>
 266  * These functions use a thread-specific data space; if the data is needed
 267  * for future use, it should be copied before any subsequent calls overwrite
 268  * it.  Only the Internet protocols are currently understood.
 269  * </quote>
 270  *
 271  * Consequently we only cache the name and strdup it for safety.
 272  *
 273  * At the time of writing this comment the last entry in /etc/protocols is:
 274  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
 275  */
 276 const char *
 277 pfctl_proto2name(int proto)
 278 {
 279         static const char *pfctl_proto_cache[259];
 280         struct protoent *p;
 281
 282         if (proto >= nitems(pfctl_proto_cache)) {
 283                 p = getprotobynumber(proto);
 284                 if (p == NULL) {
 285                         return (NULL);
 286                 }
 287                 return (p->p_name);
 288         }
 289
 290         if (pfctl_proto_cache[proto] == NULL) {
 291                 p = getprotobynumber(proto);
 292                 if (p == NULL) {
 293                         return (NULL);
 294                 }
 295                 pfctl_proto_cache[proto] = strdup(p->p_name);
 296         }
 297
 298         return (pfctl_proto_cache[proto]);
 299 }
 300
 301 int
 302 pfctl_enable(int dev, int opts)
 303 {
 304         if (ioctl(dev, DIOCSTART)) {
 305                 if (errno == EEXIST)
 306                         errx(1, "pf already enabled");
 307                 else if (errno == ESRCH)
 308                         errx(1, "pfil registeration failed");
 309                 else
 310                         err(1, "DIOCSTART");
 311         }
 312         if ((opts & PF_OPT_QUIET) == 0)
 313                 fprintf(stderr, "pf enabled\n");
 314
 315         if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
 316                 if (errno != EEXIST)
 317                         err(1, "DIOCSTARTALTQ");
 318
 319         return (0);
 320 }
 321
 322 int
 323 pfctl_disable(int dev, int opts)
 324 {
 325         if (ioctl(dev, DIOCSTOP)) {
 326                 if (errno == ENOENT)
 327                         errx(1, "pf not enabled");
 328                 else
 329                         err(1, "DIOCSTOP");
 330         }
 331         if ((opts & PF_OPT_QUIET) == 0)
 332                 fprintf(stderr, "pf disabled\n");
 333
 334         if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
 335                         if (errno != ENOENT)
 336                                 err(1, "DIOCSTOPALTQ");
 337
 338         return (0);
 339 }
 340
 341 int
 342 pfctl_clear_stats(int dev, int opts)
 343 {
 344         if (ioctl(dev, DIOCCLRSTATUS))
 345                 err(1, "DIOCCLRSTATUS");
 346         if ((opts & PF_OPT_QUIET) == 0)
 347                 fprintf(stderr, "pf: statistics cleared\n");
 348         return (0);
 349 }
 350
 351 int
 352 pfctl_get_skip_ifaces(void)
 353 {
 354         bzero(&skip_b, sizeof(skip_b));
 355         skip_b.pfrb_type = PFRB_IFACES;
 356         for (;;) {
 357                 pfr_buf_grow(&skip_b, skip_b.pfrb_size);
 358                 skip_b.pfrb_size = skip_b.pfrb_msize;
 359                 if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
 360                         err(1, "pfi_get_ifaces");
 361                 if (skip_b.pfrb_size <= skip_b.pfrb_msize)
 362                         break;
 363         }
 364         return (0);
 365 }
 366
 367 int
 368 pfctl_check_skip_ifaces(char *ifname)
 369 {
 370         struct pfi_kif          *p;
 371         struct node_host        *h = NULL, *n = NULL;
 372
 373         PFRB_FOREACH(p, &skip_b) {
 374                 if (!strcmp(ifname, p->pfik_name) &&
 375                     (p->pfik_flags & PFI_IFLAG_SKIP))
 376                         p->pfik_flags &= ~PFI_IFLAG_SKIP;
 377                 if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
 378                         if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
 379                                 continue;
 380
 381                         for (n = h; n != NULL; n = n->next) {
 382                                 if (p->pfik_ifp == NULL)
 383                                         continue;
 384                                 if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
 385                                         continue;
 386
 387                                 p->pfik_flags &= ~PFI_IFLAG_SKIP;
 388                         }
 389                 }
 390         }
 391         return (0);
 392 }
 393
 394 int
 395 pfctl_adjust_skip_ifaces(struct pfctl *pf)
 396 {
 397         struct pfi_kif          *p, *pp;
 398         struct node_host        *h = NULL, *n = NULL;
 399
 400         PFRB_FOREACH(p, &skip_b) {
 401                 if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
 402                         continue;
 403
 404                 pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
 405                 if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
 406                         continue;
 407
 408                 for (n = h; n != NULL; n = n->next)
 409                         PFRB_FOREACH(pp, &skip_b) {
 410                                 if (pp->pfik_ifp == NULL)
 411                                         continue;
 412
 413                                 if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
 414                                         continue;
 415
 416                                 if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
 417                                         pfctl_set_interface_flags(pf,
 418                                             pp->pfik_name, PFI_IFLAG_SKIP, 1);
 419                                 if (pp->pfik_flags & PFI_IFLAG_SKIP)
 420                                         pp->pfik_flags &= ~PFI_IFLAG_SKIP;
 421                         }
 422         }
 423
 424         PFRB_FOREACH(p, &skip_b) {
 425                 if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
 426                         continue;
 427
 428                 pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
 429         }
 430
 431         return (0);
 432 }
 433
 434 int
 435 pfctl_clear_interface_flags(int dev, int opts)
 436 {
 437         struct pfioc_iface      pi;
 438
 439         if ((opts & PF_OPT_NOACTION) == 0) {
 440                 bzero(&pi, sizeof(pi));
 441                 pi.pfiio_flags = PFI_IFLAG_SKIP;
 442
 443                 if (ioctl(dev, DIOCCLRIFFLAG, &pi))
 444                         err(1, "DIOCCLRIFFLAG");
 445                 if ((opts & PF_OPT_QUIET) == 0)
 446                         fprintf(stderr, "pf: interface flags reset\n");
 447         }
 448         return (0);
 449 }
 450
 451 int
 452 pfctl_clear_rules(int dev, int opts, char *anchorname)
 453 {
 454         struct pfr_buffer t;
 455
 456         memset(&t, 0, sizeof(t));
 457         t.pfrb_type = PFRB_TRANS;
 458         if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
 459             pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
 460             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 461             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 462                 err(1, "pfctl_clear_rules");
 463         if ((opts & PF_OPT_QUIET) == 0)
 464                 fprintf(stderr, "rules cleared\n");
 465         return (0);
 466 }
 467
 468 int
 469 pfctl_clear_nat(int dev, int opts, char *anchorname)
 470 {
 471         struct pfr_buffer t;
 472
 473         memset(&t, 0, sizeof(t));
 474         t.pfrb_type = PFRB_TRANS;
 475         if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
 476             pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
 477             pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
 478             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 479             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 480                 err(1, "pfctl_clear_nat");
 481         if ((opts & PF_OPT_QUIET) == 0)
 482                 fprintf(stderr, "nat cleared\n");
 483         return (0);
 484 }
 485
 486 int
 487 pfctl_clear_altq(int dev, int opts)
 488 {
 489         struct pfr_buffer t;
 490
 491         if (!altqsupport)
 492                 return (-1);
 493         memset(&t, 0, sizeof(t));
 494         t.pfrb_type = PFRB_TRANS;
 495         if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
 496             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 497             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 498                 err(1, "pfctl_clear_altq");
 499         if ((opts & PF_OPT_QUIET) == 0)
 500                 fprintf(stderr, "altq cleared\n");
 501         return (0);
 502 }
 503
 504 int
 505 pfctl_clear_src_nodes(int dev, int opts)
 506 {
 507         if (ioctl(dev, DIOCCLRSRCNODES))
 508                 err(1, "DIOCCLRSRCNODES");
 509         if ((opts & PF_OPT_QUIET) == 0)
 510                 fprintf(stderr, "source tracking entries cleared\n");
 511         return (0);
 512 }
 513
 514 int
 515 pfctl_clear_iface_states(int dev, const char *iface, int opts)
 516 {
 517         struct pfctl_kill kill;
 518         unsigned int killed;
 519
 520         memset(&kill, 0, sizeof(kill));
 521         if (iface != NULL && strlcpy(kill.ifname, iface,
 522             sizeof(kill.ifname)) >= sizeof(kill.ifname))
 523                 errx(1, "invalid interface: %s", iface);
 524
 525         if (opts & PF_OPT_KILLMATCH)
 526                 kill.kill_match = true;
 527
 528         if (pfctl_clear_states(dev, &kill, &killed))
 529                 err(1, "DIOCCLRSTATES");
 530         if ((opts & PF_OPT_QUIET) == 0)
 531                 fprintf(stderr, "%d states cleared\n", killed);
 532         return (0);
 533 }
 534
 535 void
 536 pfctl_addrprefix(char *addr, struct pf_addr *mask)
 537 {
 538         char *p;
 539         const char *errstr;
 540         int prefix, ret_ga, q, r;
 541         struct addrinfo hints, *res;
 542
 543         if ((p = strchr(addr, '/')) == NULL)
 544                 return;
 545
 546         *p++ = '\0';
 547         prefix = strtonum(p, 0, 128, &errstr);
 548         if (errstr)
 549                 errx(1, "prefix is %s: %s", errstr, p);
 550
 551         bzero(&hints, sizeof(hints));
 552         /* prefix only with numeric addresses */
 553         hints.ai_flags |= AI_NUMERICHOST;
 554
 555         if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
 556                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 557                 /* NOTREACHED */
 558         }
 559
 560         if (res->ai_family == AF_INET && prefix > 32)
 561                 errx(1, "prefix too long for AF_INET");
 562         else if (res->ai_family == AF_INET6 && prefix > 128)
 563                 errx(1, "prefix too long for AF_INET6");
 564
 565         q = prefix >> 3;
 566         r = prefix & 7;
 567         switch (res->ai_family) {
 568         case AF_INET:
 569                 bzero(&mask->v4, sizeof(mask->v4));
 570                 mask->v4.s_addr = htonl((u_int32_t)
 571                     (0xffffffffffULL << (32 - prefix)));
 572                 break;
 573         case AF_INET6:
 574                 bzero(&mask->v6, sizeof(mask->v6));
 575                 if (q > 0)
 576                         memset((void *)&mask->v6, 0xff, q);
 577                 if (r > 0)
 578                         *((u_char *)&mask->v6 + q) =
 579                             (0xff00 >> r) & 0xff;
 580                 break;
 581         }
 582         freeaddrinfo(res);
 583 }
 584
 585 int
 586 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
 587 {
 588         struct pfioc_src_node_kill psnk;
 589         struct addrinfo *res[2], *resp[2];
 590         struct sockaddr last_src, last_dst;
 591         int killed, sources, dests;
 592         int ret_ga;
 593
 594         killed = sources = dests = 0;
 595
 596         memset(&psnk, 0, sizeof(psnk));
 597         memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
 598             sizeof(psnk.psnk_src.addr.v.a.mask));
 599         memset(&last_src, 0xff, sizeof(last_src));
 600         memset(&last_dst, 0xff, sizeof(last_dst));
 601
 602         pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
 603
 604         if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
 605                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 606                 /* NOTREACHED */
 607         }
 608         for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 609                 if (resp[0]->ai_addr == NULL)
 610                         continue;
 611                 /* We get lots of duplicates.  Catch the easy ones */
 612                 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 613                         continue;
 614                 last_src = *(struct sockaddr *)resp[0]->ai_addr;
 615
 616                 psnk.psnk_af = resp[0]->ai_family;
 617                 sources++;
 618
 619                 if (psnk.psnk_af == AF_INET)
 620                         psnk.psnk_src.addr.v.a.addr.v4 =
 621                             ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 622                 else if (psnk.psnk_af == AF_INET6)
 623                         psnk.psnk_src.addr.v.a.addr.v6 =
 624                             ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 625                             sin6_addr;
 626                 else
 627                         errx(1, "Unknown address family %d", psnk.psnk_af);
 628
 629                 if (src_node_killers > 1) {
 630                         dests = 0;
 631                         memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
 632                             sizeof(psnk.psnk_dst.addr.v.a.mask));
 633                         memset(&last_dst, 0xff, sizeof(last_dst));
 634                         pfctl_addrprefix(src_node_kill[1],
 635                             &psnk.psnk_dst.addr.v.a.mask);
 636                         if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
 637                             &res[1]))) {
 638                                 errx(1, "getaddrinfo: %s",
 639                                     gai_strerror(ret_ga));
 640                                 /* NOTREACHED */
 641                         }
 642                         for (resp[1] = res[1]; resp[1];
 643                             resp[1] = resp[1]->ai_next) {
 644                                 if (resp[1]->ai_addr == NULL)
 645                                         continue;
 646                                 if (psnk.psnk_af != resp[1]->ai_family)
 647                                         continue;
 648
 649                                 if (memcmp(&last_dst, resp[1]->ai_addr,
 650                                     sizeof(last_dst)) == 0)
 651                                         continue;
 652                                 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 653
 654                                 dests++;
 655
 656                                 if (psnk.psnk_af == AF_INET)
 657                                         psnk.psnk_dst.addr.v.a.addr.v4 =
 658                                             ((struct sockaddr_in *)resp[1]->
 659                                             ai_addr)->sin_addr;
 660                                 else if (psnk.psnk_af == AF_INET6)
 661                                         psnk.psnk_dst.addr.v.a.addr.v6 =
 662                                             ((struct sockaddr_in6 *)resp[1]->
 663                                             ai_addr)->sin6_addr;
 664                                 else
 665                                         errx(1, "Unknown address family %d",
 666                                             psnk.psnk_af);
 667
 668                                 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 669                                         err(1, "DIOCKILLSRCNODES");
 670                                 killed += psnk.psnk_killed;
 671                         }
 672                         freeaddrinfo(res[1]);
 673                 } else {
 674                         if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 675                                 err(1, "DIOCKILLSRCNODES");
 676                         killed += psnk.psnk_killed;
 677                 }
 678         }
 679
 680         freeaddrinfo(res[0]);
 681
 682         if ((opts & PF_OPT_QUIET) == 0)
 683                 fprintf(stderr, "killed %d src nodes from %d sources and %d "
 684                     "destinations\n", killed, sources, dests);
 685         return (0);
 686 }
 687
 688 int
 689 pfctl_net_kill_states(int dev, const char *iface, int opts)
 690 {
 691         struct pfctl_kill kill;
 692         struct addrinfo *res[2], *resp[2];
 693         struct sockaddr last_src, last_dst;
 694         unsigned int newkilled;
 695         int killed, sources, dests;
 696         int ret_ga;
 697
 698         killed = sources = dests = 0;
 699
 700         memset(&kill, 0, sizeof(kill));
 701         memset(&kill.src.addr.v.a.mask, 0xff,
 702             sizeof(kill.src.addr.v.a.mask));
 703         memset(&last_src, 0xff, sizeof(last_src));
 704         memset(&last_dst, 0xff, sizeof(last_dst));
 705         if (iface != NULL && strlcpy(kill.ifname, iface,
 706             sizeof(kill.ifname)) >= sizeof(kill.ifname))
 707                 errx(1, "invalid interface: %s", iface);
 708
 709         pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask);
 710
 711         if (opts & PF_OPT_KILLMATCH)
 712                 kill.kill_match = true;
 713
 714         if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
 715                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 716                 /* NOTREACHED */
 717         }
 718         for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 719                 if (resp[0]->ai_addr == NULL)
 720                         continue;
 721                 /* We get lots of duplicates.  Catch the easy ones */
 722                 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 723                         continue;
 724                 last_src = *(struct sockaddr *)resp[0]->ai_addr;
 725
 726                 kill.af = resp[0]->ai_family;
 727                 sources++;
 728
 729                 if (kill.af == AF_INET)
 730                         kill.src.addr.v.a.addr.v4 =
 731                             ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 732                 else if (kill.af == AF_INET6)
 733                         kill.src.addr.v.a.addr.v6 =
 734                             ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 735                             sin6_addr;
 736                 else
 737                         errx(1, "Unknown address family %d", kill.af);
 738
 739                 if (state_killers > 1) {
 740                         dests = 0;
 741                         memset(&kill.dst.addr.v.a.mask, 0xff,
 742                             sizeof(kill.dst.addr.v.a.mask));
 743                         memset(&last_dst, 0xff, sizeof(last_dst));
 744                         pfctl_addrprefix(state_kill[1],
 745                             &kill.dst.addr.v.a.mask);
 746                         if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
 747                             &res[1]))) {
 748                                 errx(1, "getaddrinfo: %s",
 749                                     gai_strerror(ret_ga));
 750                                 /* NOTREACHED */
 751                         }
 752                         for (resp[1] = res[1]; resp[1];
 753                             resp[1] = resp[1]->ai_next) {
 754                                 if (resp[1]->ai_addr == NULL)
 755                                         continue;
 756                                 if (kill.af != resp[1]->ai_family)
 757                                         continue;
 758
 759                                 if (memcmp(&last_dst, resp[1]->ai_addr,
 760                                     sizeof(last_dst)) == 0)
 761                                         continue;
 762                                 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 763
 764                                 dests++;
 765
 766                                 if (kill.af == AF_INET)
 767                                         kill.dst.addr.v.a.addr.v4 =
 768                                             ((struct sockaddr_in *)resp[1]->
 769                                             ai_addr)->sin_addr;
 770                                 else if (kill.af == AF_INET6)
 771                                         kill.dst.addr.v.a.addr.v6 =
 772                                             ((struct sockaddr_in6 *)resp[1]->
 773                                             ai_addr)->sin6_addr;
 774                                 else
 775                                         errx(1, "Unknown address family %d",
 776                                             kill.af);
 777
 778                                 if (pfctl_kill_states(dev, &kill, &newkilled))
 779                                         err(1, "DIOCKILLSTATES");
 780                                 killed += newkilled;
 781                         }
 782                         freeaddrinfo(res[1]);
 783                 } else {
 784                         if (pfctl_kill_states(dev, &kill, &newkilled))
 785                                 err(1, "DIOCKILLSTATES");
 786                         killed += newkilled;
 787                 }
 788         }
 789
 790         freeaddrinfo(res[0]);
 791
 792         if ((opts & PF_OPT_QUIET) == 0)
 793                 fprintf(stderr, "killed %d states from %d sources and %d "
 794                     "destinations\n", killed, sources, dests);
 795         return (0);
 796 }
 797
 798 int
 799 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
 800 {
 801         struct pfctl_kill kill;
 802         struct addrinfo *res, *resp;
 803         struct sockaddr last_src;
 804         unsigned int newkilled;
 805         int killed = 0;
 806         int ret_ga;
 807
 808         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 809                 warnx("no gateway specified");
 810                 usage();
 811         }
 812
 813         memset(&kill, 0, sizeof(kill));
 814         memset(&kill.rt_addr.addr.v.a.mask, 0xff,
 815             sizeof(kill.rt_addr.addr.v.a.mask));
 816         memset(&last_src, 0xff, sizeof(last_src));
 817         if (iface != NULL && strlcpy(kill.ifname, iface,
 818             sizeof(kill.ifname)) >= sizeof(kill.ifname))
 819                 errx(1, "invalid interface: %s", iface);
 820
 821         if (opts & PF_OPT_KILLMATCH)
 822                 kill.kill_match = true;
 823
 824         pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask);
 825
 826         if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, &res))) {
 827                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 828                 /* NOTREACHED */
 829         }
 830         for (resp = res; resp; resp = resp->ai_next) {
 831                 if (resp->ai_addr == NULL)
 832                         continue;
 833                 /* We get lots of duplicates.  Catch the easy ones */
 834                 if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
 835                         continue;
 836                 last_src = *(struct sockaddr *)resp->ai_addr;
 837
 838                 kill.af = resp->ai_family;
 839
 840                 if (kill.af == AF_INET)
 841                         kill.rt_addr.addr.v.a.addr.v4 =
 842                             ((struct sockaddr_in *)resp->ai_addr)->sin_addr;
 843                 else if (kill.af == AF_INET6)
 844                         kill.rt_addr.addr.v.a.addr.v6 =
 845                             ((struct sockaddr_in6 *)resp->ai_addr)->
 846                             sin6_addr;
 847                 else
 848                         errx(1, "Unknown address family %d", kill.af);
 849
 850                 if (pfctl_kill_states(dev, &kill, &newkilled))
 851                         err(1, "DIOCKILLSTATES");
 852                 killed += newkilled;
 853         }
 854
 855         freeaddrinfo(res);
 856
 857         if ((opts & PF_OPT_QUIET) == 0)
 858                 fprintf(stderr, "killed %d states\n", killed);
 859         return (0);
 860 }
 861
 862 int
 863 pfctl_label_kill_states(int dev, const char *iface, int opts)
 864 {
 865         struct pfctl_kill kill;
 866         unsigned int killed;
 867
 868         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 869                 warnx("no label specified");
 870                 usage();
 871         }
 872         memset(&kill, 0, sizeof(kill));
 873         if (iface != NULL && strlcpy(kill.ifname, iface,
 874             sizeof(kill.ifname)) >= sizeof(kill.ifname))
 875                 errx(1, "invalid interface: %s", iface);
 876
 877         if (opts & PF_OPT_KILLMATCH)
 878                 kill.kill_match = true;
 879
 880         if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
 881             sizeof(kill.label))
 882                 errx(1, "label too long: %s", state_kill[1]);
 883
 884         if (pfctl_kill_states(dev, &kill, &killed))
 885                 err(1, "DIOCKILLSTATES");
 886
 887         if ((opts & PF_OPT_QUIET) == 0)
 888                 fprintf(stderr, "killed %d states\n", killed);
 889
 890         return (0);
 891 }
 892
 893 int
 894 pfctl_id_kill_states(int dev, const char *iface, int opts)
 895 {
 896         struct pfctl_kill kill;
 897         unsigned int killed;
 898
 899         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 900                 warnx("no id specified");
 901                 usage();
 902         }
 903
 904         memset(&kill, 0, sizeof(kill));
 905
 906         if (opts & PF_OPT_KILLMATCH)
 907                 kill.kill_match = true;
 908
 909         if ((sscanf(state_kill[1], "%jx/%x",
 910             &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
 911         }
 912         else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
 913                 kill.cmp.creatorid = 0;
 914         } else {
 915                 warnx("wrong id format specified");
 916                 usage();
 917         }
 918         if (kill.cmp.id == 0) {
 919                 warnx("cannot kill id 0");
 920                 usage();
 921         }
 922
 923         if (pfctl_kill_states(dev, &kill, &killed))
 924                 err(1, "DIOCKILLSTATES");
 925
 926         if ((opts & PF_OPT_QUIET) == 0)
 927                 fprintf(stderr, "killed %d states\n", killed);
 928
 929         return (0);
 930 }
 931
 932 int
 933 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
 934     u_int32_t ticket, int r_action, char *anchorname)
 935 {
 936         struct pfioc_pooladdr pp;
 937         struct pf_pooladdr *pa;
 938         u_int32_t pnr, mpnr;
 939
 940         memset(&pp, 0, sizeof(pp));
 941         memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
 942         pp.r_action = r_action;
 943         pp.r_num = nr;
 944         pp.ticket = ticket;
 945         if (ioctl(dev, DIOCGETADDRS, &pp)) {
 946                 warn("DIOCGETADDRS");
 947                 return (-1);
 948         }
 949         mpnr = pp.nr;
 950         TAILQ_INIT(&pool->list);
 951         for (pnr = 0; pnr < mpnr; ++pnr) {
 952                 pp.nr = pnr;
 953                 if (ioctl(dev, DIOCGETADDR, &pp)) {
 954                         warn("DIOCGETADDR");
 955                         return (-1);
 956                 }
 957                 pa = calloc(1, sizeof(struct pf_pooladdr));
 958                 if (pa == NULL)
 959                         err(1, "calloc");
 960                 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
 961                 TAILQ_INSERT_TAIL(&pool->list, pa, entries);
 962         }
 963
 964         return (0);
 965 }
 966
 967 void
 968 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
 969 {
 970         struct pf_pooladdr *pa;
 971
 972         while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
 973                 TAILQ_REMOVE(&src->list, pa, entries);
 974                 TAILQ_INSERT_TAIL(&dst->list, pa, entries);
 975         }
 976 }
 977
 978 void
 979 pfctl_clear_pool(struct pfctl_pool *pool)
 980 {
 981         struct pf_pooladdr *pa;
 982
 983         while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
 984                 TAILQ_REMOVE(&pool->list, pa, entries);
 985                 free(pa);
 986         }
 987 }
 988
 989 void
 990 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
 991 {
 992         if (opts & PF_OPT_DEBUG) {
 993                 const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
 994                     "p", "sa", "sp", "da", "dp" };
 995                 int i;
 996
 997                 printf("  [ Skip steps: ");
 998                 for (i = 0; i < PF_SKIP_COUNT; ++i) {
 999                         if (rule->skip[i].nr == rule->nr + 1)
1000                                 continue;
1001                         printf("%s=", t[i]);
1002                         if (rule->skip[i].nr == -1)
1003                                 printf("end ");
1004                         else
1005                                 printf("%u ", rule->skip[i].nr);
1006                 }
1007                 printf("]\n");
1008
1009                 printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1010                     rule->qname, rule->qid, rule->pqname, rule->pqid);
1011         }
1012         if (opts & PF_OPT_VERBOSE) {
1013                 printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1014                             "Bytes: %-10llu  States: %-6ju]\n",
1015                             (unsigned long long)rule->evaluations,
1016                             (unsigned long long)(rule->packets[0] +
1017                             rule->packets[1]),
1018                             (unsigned long long)(rule->bytes[0] +
1019                             rule->bytes[1]), (uintmax_t)rule->states_cur);
1020                 if (!(opts & PF_OPT_DEBUG))
1021                         printf("  [ Inserted: uid %u pid %u "
1022                             "State Creations: %-6ju]\n",
1023                             (unsigned)rule->cuid, (unsigned)rule->cpid,
1024                             (uintmax_t)rule->states_tot);
1025         }
1026 }
1027
1028 void
1029 pfctl_print_title(char *title)
1030 {
1031         if (!first_title)
1032                 printf("\n");
1033         first_title = 0;
1034         printf("%s\n", title);
1035 }
1036
1037 int
1038 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1039     char *anchorname, int depth)
1040 {
1041         struct pfioc_rule pr;
1042         struct pfctl_rule rule;
1043         u_int32_t nr, mnr, header = 0;
1044         int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1045         int numeric = opts & PF_OPT_NUMERIC;
1046         int len = strlen(path);
1047         int brace;
1048         char *p;
1049
1050         if (path[0])
1051                 snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1052         else
1053                 snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1054
1055         memset(&pr, 0, sizeof(pr));
1056         memcpy(pr.anchor, path, sizeof(pr.anchor));
1057         if (opts & PF_OPT_SHOWALL) {
1058                 pr.rule.action = PF_PASS;
1059                 if (ioctl(dev, DIOCGETRULES, &pr)) {
1060                         warn("DIOCGETRULES");
1061                         goto error;
1062                 }
1063                 header++;
1064         }
1065         pr.rule.action = PF_SCRUB;
1066         if (ioctl(dev, DIOCGETRULES, &pr)) {
1067                 warn("DIOCGETRULES");
1068                 goto error;
1069         }
1070         if (opts & PF_OPT_SHOWALL) {
1071                 if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
1072                         pfctl_print_title("FILTER RULES:");
1073                 else if (format == PFCTL_SHOW_LABELS && labels)
1074                         pfctl_print_title("LABEL COUNTERS:");
1075         }
1076         mnr = pr.nr;
1077
1078         for (nr = 0; nr < mnr; ++nr) {
1079                 pr.nr = nr;
1080                 if (pfctl_get_clear_rule(dev, nr, pr.ticket, path, PF_SCRUB,
1081                     &rule, pr.anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1082                         warn("DIOCGETRULENV");
1083                         goto error;
1084                 }
1085
1086                 if (pfctl_get_pool(dev, &rule.rpool,
1087                     nr, pr.ticket, PF_SCRUB, path) != 0)
1088                         goto error;
1089
1090                 switch (format) {
1091                 case PFCTL_SHOW_LABELS:
1092                         break;
1093                 case PFCTL_SHOW_RULES:
1094                         if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1095                                 labels = 1;
1096                         print_rule(&rule, pr.anchor_call, rule_numbers, numeric);
1097                         printf("\n");
1098                         pfctl_print_rule_counters(&rule, opts);
1099                         break;
1100                 case PFCTL_SHOW_NOTHING:
1101                         break;
1102                 }
1103                 pfctl_clear_pool(&rule.rpool);
1104         }
1105         pr.rule.action = PF_PASS;
1106         if (ioctl(dev, DIOCGETRULES, &pr)) {
1107                 warn("DIOCGETRULES");
1108                 goto error;
1109         }
1110         mnr = pr.nr;
1111         for (nr = 0; nr < mnr; ++nr) {
1112                 pr.nr = nr;
1113                 if (pfctl_get_clear_rule(dev, nr, pr.ticket, path, PF_PASS,
1114                     &rule, pr.anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1115                         warn("DIOCGETRULE");
1116                         goto error;
1117                 }
1118
1119                 if (pfctl_get_pool(dev, &rule.rpool,
1120                     nr, pr.ticket, PF_PASS, path) != 0)
1121                         goto error;
1122
1123                 switch (format) {
1124                 case PFCTL_SHOW_LABELS: {
1125                         bool show = false;
1126                         int i = 0;
1127
1128                         while (rule.label[i][0]) {
1129                                 printf("%s ", rule.label[i++]);
1130                                 show = true;
1131                         }
1132
1133                         if (show) {
1134                                 printf("%llu %llu %llu %llu"
1135                                     " %llu %llu %llu %ju\n",
1136                                     (unsigned long long)rule.evaluations,
1137                                     (unsigned long long)(rule.packets[0] +
1138                                     rule.packets[1]),
1139                                     (unsigned long long)(rule.bytes[0] +
1140                                     rule.bytes[1]),
1141                                     (unsigned long long)rule.packets[0],
1142                                     (unsigned long long)rule.bytes[0],
1143                                     (unsigned long long)rule.packets[1],
1144                                     (unsigned long long)rule.bytes[1],
1145                                     (uintmax_t)rule.states_tot);
1146                         }
1147                         break;
1148                 }
1149                 case PFCTL_SHOW_RULES:
1150                         brace = 0;
1151                         if (rule.label[0] && (opts & PF_OPT_SHOWALL))
1152                                 labels = 1;
1153                         INDENT(depth, !(opts & PF_OPT_VERBOSE));
1154                         if (pr.anchor_call[0] &&
1155                            ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
1156                            ((void *)p == (void *)pr.anchor_call ||
1157                            *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1158                                 brace++;
1159                                 if ((p = strrchr(pr.anchor_call, '/')) !=
1160                                     NULL)
1161                                         p++;
1162                                 else
1163                                         p = &pr.anchor_call[0];
1164                         } else
1165                                 p = &pr.anchor_call[0];
1166
1167                         print_rule(&rule, p, rule_numbers, numeric);
1168                         if (brace)
1169                                 printf(" {\n");
1170                         else
1171                                 printf("\n");
1172                         pfctl_print_rule_counters(&rule, opts);
1173                         if (brace) {
1174                                 pfctl_show_rules(dev, path, opts, format,
1175                                     p, depth + 1);
1176                                 INDENT(depth, !(opts & PF_OPT_VERBOSE));
1177                                 printf("}\n");
1178                         }
1179                         break;
1180                 case PFCTL_SHOW_NOTHING:
1181                         break;
1182                 }
1183                 pfctl_clear_pool(&rule.rpool);
1184         }
1185         path[len] = '\0';
1186         return (0);
1187
1188  error:
1189         path[len] = '\0';
1190         return (-1);
1191 }
1192
1193 int
1194 pfctl_show_nat(int dev, int opts, char *anchorname)
1195 {
1196         struct pfioc_rule pr;
1197         struct pfctl_rule rule;
1198         u_int32_t mnr, nr;
1199         static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1200         int i, dotitle = opts & PF_OPT_SHOWALL;
1201
1202         memset(&pr, 0, sizeof(pr));
1203         memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
1204         for (i = 0; i < 3; i++) {
1205                 pr.rule.action = nattype[i];
1206                 if (ioctl(dev, DIOCGETRULES, &pr)) {
1207                         warn("DIOCGETRULES");
1208                         return (-1);
1209                 }
1210                 mnr = pr.nr;
1211                 for (nr = 0; nr < mnr; ++nr) {
1212                         pr.nr = nr;
1213                         if (pfctl_get_rule(dev, nr, pr.ticket, anchorname,
1214                             nattype[i], &rule, pr.anchor_call)) {
1215                                 warn("DIOCGETRULE");
1216                                 return (-1);
1217                         }
1218                         if (pfctl_get_pool(dev, &rule.rpool, nr,
1219                             pr.ticket, nattype[i], anchorname) != 0)
1220                                 return (-1);
1221                         if (dotitle) {
1222                                 pfctl_print_title("TRANSLATION RULES:");
1223                                 dotitle = 0;
1224                         }
1225                         print_rule(&rule, pr.anchor_call,
1226                             opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1227                         printf("\n");
1228                         pfctl_print_rule_counters(&rule, opts);
1229                         pfctl_clear_pool(&rule.rpool);
1230                 }
1231         }
1232         return (0);
1233 }
1234
1235 int
1236 pfctl_show_src_nodes(int dev, int opts)
1237 {
1238         struct pfioc_src_nodes psn;
1239         struct pf_src_node *p;
1240         char *inbuf = NULL, *newinbuf = NULL;
1241         unsigned int len = 0;
1242         int i;
1243
1244         memset(&psn, 0, sizeof(psn));
1245         for (;;) {
1246                 psn.psn_len = len;
1247                 if (len) {
1248                         newinbuf = realloc(inbuf, len);
1249                         if (newinbuf == NULL)
1250                                 err(1, "realloc");
1251                         psn.psn_buf = inbuf = newinbuf;
1252                 }
1253                 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1254                         warn("DIOCGETSRCNODES");
1255                         free(inbuf);
1256                         return (-1);
1257                 }
1258                 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1259                         break;
1260                 if (len == 0 && psn.psn_len == 0)
1261                         goto done;
1262                 if (len == 0 && psn.psn_len != 0)
1263                         len = psn.psn_len;
1264                 if (psn.psn_len == 0)
1265                         goto done;      /* no src_nodes */
1266                 len *= 2;
1267         }
1268         p = psn.psn_src_nodes;
1269         if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1270                 pfctl_print_title("SOURCE TRACKING NODES:");
1271         for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1272                 print_src_node(p, opts);
1273                 p++;
1274         }
1275 done:
1276         free(inbuf);
1277         return (0);
1278 }
1279
1280 int
1281 pfctl_show_states(int dev, const char *iface, int opts)
1282 {
1283         struct pfctl_states states;
1284         struct pfctl_state *s;
1285         int dotitle = (opts & PF_OPT_SHOWALL);
1286
1287         memset(&states, 0, sizeof(states));
1288
1289         if (pfctl_get_states(dev, &states))
1290                 return (-1);
1291
1292         TAILQ_FOREACH(s, &states.states, entry) {
1293                 if (iface != NULL && strcmp(s->ifname, iface))
1294                         continue;
1295                 if (dotitle) {
1296                         pfctl_print_title("STATES:");
1297                         dotitle = 0;
1298                 }
1299                 print_state(s, opts);
1300         }
1301
1302         pfctl_free_states(&states);
1303
1304         return (0);
1305 }
1306
1307 int
1308 pfctl_show_status(int dev, int opts)
1309 {
1310         struct pfctl_status     *status;
1311         struct pfctl_syncookies cookies;
1312
1313         if ((status = pfctl_get_status(dev)) == NULL) {
1314                 warn("DIOCGETSTATUS");
1315                 return (-1);
1316         }
1317         if (pfctl_get_syncookies(dev, &cookies)) {
1318                 pfctl_free_status(status);
1319                 warn("DIOCGETSYNCOOKIES");
1320                 return (-1);
1321         }
1322         if (opts & PF_OPT_SHOWALL)
1323                 pfctl_print_title("INFO:");
1324         print_status(status, &cookies, opts);
1325         pfctl_free_status(status);
1326         return (0);
1327 }
1328
1329 int
1330 pfctl_show_running(int dev)
1331 {
1332         struct pfctl_status *status;
1333         int running;
1334
1335         if ((status = pfctl_get_status(dev)) == NULL) {
1336                 warn("DIOCGETSTATUS");
1337                 return (-1);
1338         }
1339
1340         running = status->running;
1341
1342         print_running(status);
1343         pfctl_free_status(status);
1344         return (!running);
1345 }
1346
1347 int
1348 pfctl_show_timeouts(int dev, int opts)
1349 {
1350         struct pfioc_tm pt;
1351         int i;
1352
1353         if (opts & PF_OPT_SHOWALL)
1354                 pfctl_print_title("TIMEOUTS:");
1355         memset(&pt, 0, sizeof(pt));
1356         for (i = 0; pf_timeouts[i].name; i++) {
1357                 pt.timeout = pf_timeouts[i].timeout;
1358                 if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1359                         err(1, "DIOCGETTIMEOUT");
1360                 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1361                 if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1362                     pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1363                         printf(" states");
1364                 else
1365                         printf("s");
1366                 printf("\n");
1367         }
1368         return (0);
1369
1370 }
1371
1372 int
1373 pfctl_show_limits(int dev, int opts)
1374 {
1375         struct pfioc_limit pl;
1376         int i;
1377
1378         if (opts & PF_OPT_SHOWALL)
1379                 pfctl_print_title("LIMITS:");
1380         memset(&pl, 0, sizeof(pl));
1381         for (i = 0; pf_limits[i].name; i++) {
1382                 pl.index = pf_limits[i].index;
1383                 if (ioctl(dev, DIOCGETLIMIT, &pl))
1384                         err(1, "DIOCGETLIMIT");
1385                 printf("%-13s ", pf_limits[i].name);
1386                 if (pl.limit == UINT_MAX)
1387                         printf("unlimited\n");
1388                 else
1389                         printf("hard limit %8u\n", pl.limit);
1390         }
1391         return (0);
1392 }
1393
1394 /* callbacks for rule/nat/rdr/addr */
1395 int
1396 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1397 {
1398         struct pf_pooladdr *pa;
1399
1400         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1401                 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1402                         err(1, "DIOCBEGINADDRS");
1403         }
1404
1405         pf->paddr.af = af;
1406         TAILQ_FOREACH(pa, &p->list, entries) {
1407                 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1408                 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1409                         if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1410                                 err(1, "DIOCADDADDR");
1411                 }
1412         }
1413         return (0);
1414 }
1415
1416 int
1417 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1418     const char *anchor_call)
1419 {
1420         u_int8_t                rs_num;
1421         struct pfctl_rule       *rule;
1422         struct pfctl_ruleset    *rs;
1423         char                    *p;
1424
1425         rs_num = pf_get_ruleset_number(r->action);
1426         if (rs_num == PF_RULESET_MAX)
1427                 errx(1, "Invalid rule type %d", r->action);
1428
1429         rs = &pf->anchor->ruleset;
1430
1431         if (anchor_call[0] && r->anchor == NULL) {
1432                 /*
1433                  * Don't make non-brace anchors part of the main anchor pool.
1434                  */
1435                 if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1436                         err(1, "pfctl_append_rule: calloc");
1437
1438                 pf_init_ruleset(&r->anchor->ruleset);
1439                 r->anchor->ruleset.anchor = r->anchor;
1440                 if (strlcpy(r->anchor->path, anchor_call,
1441                     sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1442                         errx(1, "pfctl_append_rule: strlcpy");
1443                 if ((p = strrchr(anchor_call, '/')) != NULL) {
1444                         if (!strlen(p))
1445                                 err(1, "pfctl_append_rule: bad anchor name %s",
1446                                     anchor_call);
1447                 } else
1448                         p = (char *)anchor_call;
1449                 if (strlcpy(r->anchor->name, p,
1450                     sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1451                         errx(1, "pfctl_append_rule: strlcpy");
1452         }
1453
1454         if ((rule = calloc(1, sizeof(*rule))) == NULL)
1455                 err(1, "calloc");
1456         bcopy(r, rule, sizeof(*rule));
1457         TAILQ_INIT(&rule->rpool.list);
1458         pfctl_move_pool(&r->rpool, &rule->rpool);
1459
1460         TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1461         return (0);
1462 }
1463
1464 int
1465 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a)
1466 {
1467         int osize = pf->trans->pfrb_size;
1468
1469         if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1470                 if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1471                     pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1472                     pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1473                         return (1);
1474         }
1475         if (a == pf->astack[0] && ((altqsupport &&
1476             (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1477                 if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1478                         return (2);
1479         }
1480         if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1481                 if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1482                     pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1483                         return (3);
1484         }
1485         if (pf->loadopt & PFCTL_FLAG_TABLE)
1486                 if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1487                         return (4);
1488         if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1489                 return (5);
1490
1491         return (0);
1492 }
1493
1494 int
1495 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1496     int rs_num, int depth)
1497 {
1498         struct pfctl_rule *r;
1499         int             error, len = strlen(path);
1500         int             brace = 0;
1501
1502         pf->anchor = rs->anchor;
1503
1504         if (path[0])
1505                 snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1506         else
1507                 snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1508
1509         if (depth) {
1510                 if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1511                         brace++;
1512                         if (pf->opts & PF_OPT_VERBOSE)
1513                                 printf(" {\n");
1514                         if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1515                             (error = pfctl_ruleset_trans(pf,
1516                             path, rs->anchor))) {
1517                                 printf("pfctl_load_rulesets: "
1518                                     "pfctl_ruleset_trans %d\n", error);
1519                                 goto error;
1520                         }
1521                 } else if (pf->opts & PF_OPT_VERBOSE)
1522                         printf("\n");
1523
1524         }
1525
1526         if (pf->optimize && rs_num == PF_RULESET_FILTER)
1527                 pfctl_optimize_ruleset(pf, rs);
1528
1529         while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1530                 TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1531
1532                 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1533                         expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
1534                 expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
1535                 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
1536
1537                 if ((error = pfctl_load_rule(pf, path, r, depth)))
1538                         goto error;
1539                 if (r->anchor) {
1540                         if ((error = pfctl_load_ruleset(pf, path,
1541                             &r->anchor->ruleset, rs_num, depth + 1)))
1542                                 goto error;
1543                 } else if (pf->opts & PF_OPT_VERBOSE)
1544                         printf("\n");
1545                 free(r);
1546         }
1547         if (brace && pf->opts & PF_OPT_VERBOSE) {
1548                 INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1549                 printf("}\n");
1550         }
1551         path[len] = '\0';
1552         return (0);
1553
1554  error:
1555         path[len] = '\0';
1556         return (error);
1557
1558 }
1559
1560 int
1561 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
1562 {
1563         u_int8_t                rs_num = pf_get_ruleset_number(r->action);
1564         char                    *name;
1565         u_int32_t               ticket;
1566         char                    anchor[PF_ANCHOR_NAME_SIZE];
1567         int                     len = strlen(path);
1568
1569         /* set up anchor before adding to path for anchor_call */
1570         if ((pf->opts & PF_OPT_NOACTION) == 0)
1571                 ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1572         if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1573                 errx(1, "pfctl_load_rule: strlcpy");
1574
1575         if (r->anchor) {
1576                 if (r->anchor->match) {
1577                         if (path[0])
1578                                 snprintf(&path[len], MAXPATHLEN - len,
1579                                     "/%s", r->anchor->name);
1580                         else
1581                                 snprintf(&path[len], MAXPATHLEN - len,
1582                                     "%s", r->anchor->name);
1583                         name = r->anchor->name;
1584                 } else
1585                         name = r->anchor->path;
1586         } else
1587                 name = "";
1588
1589         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1590                 if (pfctl_add_pool(pf, &r->rpool, r->af))
1591                         return (1);
1592                 if (pfctl_add_rule(pf->dev, r, anchor, name, ticket,
1593                     pf->paddr.ticket))
1594                         err(1, "DIOCADDRULENV");
1595         }
1596
1597         if (pf->opts & PF_OPT_VERBOSE) {
1598                 INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1599                 print_rule(r, r->anchor ? r->anchor->name : "",
1600                     pf->opts & PF_OPT_VERBOSE2,
1601                     pf->opts & PF_OPT_NUMERIC);
1602         }
1603         path[len] = '\0';
1604         pfctl_clear_pool(&r->rpool);
1605         return (0);
1606 }
1607
1608 int
1609 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1610 {
1611         if (altqsupport &&
1612             (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1613                 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1614                 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1615                         if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1616                                 if (errno == ENXIO)
1617                                         errx(1, "qtype not configured");
1618                                 else if (errno == ENODEV)
1619                                         errx(1, "%s: driver does not support "
1620                                             "altq", a->ifname);
1621                                 else
1622                                         err(1, "DIOCADDALTQ");
1623                         }
1624                 }
1625                 pfaltq_store(&pf->paltq->altq);
1626         }
1627         return (0);
1628 }
1629
1630 int
1631 pfctl_rules(int dev, char *filename, int opts, int optimize,
1632     char *anchorname, struct pfr_buffer *trans)
1633 {
1634 #define ERR(x) do { warn(x); goto _error; } while(0)
1635 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1636
1637         struct pfr_buffer       *t, buf;
1638         struct pfioc_altq        pa;
1639         struct pfctl             pf;
1640         struct pfctl_ruleset    *rs;
1641         struct pfr_table         trs;
1642         char                    *path;
1643         int                      osize;
1644
1645         RB_INIT(&pf_anchors);
1646         memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1647         pf_init_ruleset(&pf_main_anchor.ruleset);
1648         pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1649         if (trans == NULL) {
1650                 bzero(&buf, sizeof(buf));
1651                 buf.pfrb_type = PFRB_TRANS;
1652                 t = &buf;
1653                 osize = 0;
1654         } else {
1655                 t = trans;
1656                 osize = t->pfrb_size;
1657         }
1658
1659         memset(&pa, 0, sizeof(pa));
1660         pa.version = PFIOC_ALTQ_VERSION;
1661         memset(&pf, 0, sizeof(pf));
1662         memset(&trs, 0, sizeof(trs));
1663         if ((path = calloc(1, MAXPATHLEN)) == NULL)
1664                 ERRX("pfctl_rules: calloc");
1665         if (strlcpy(trs.pfrt_anchor, anchorname,
1666             sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1667                 ERRX("pfctl_rules: strlcpy");
1668         pf.dev = dev;
1669         pf.opts = opts;
1670         pf.optimize = optimize;
1671         pf.loadopt = loadopt;
1672
1673         /* non-brace anchor, create without resolving the path */
1674         if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1675                 ERRX("pfctl_rules: calloc");
1676         rs = &pf.anchor->ruleset;
1677         pf_init_ruleset(rs);
1678         rs->anchor = pf.anchor;
1679         if (strlcpy(pf.anchor->path, anchorname,
1680             sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1681                 errx(1, "pfctl_add_rule: strlcpy");
1682         if (strlcpy(pf.anchor->name, anchorname,
1683             sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1684                 errx(1, "pfctl_add_rule: strlcpy");
1685
1686
1687         pf.astack[0] = pf.anchor;
1688         pf.asd = 0;
1689         if (anchorname[0])
1690                 pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1691         pf.paltq = &pa;
1692         pf.trans = t;
1693         pfctl_init_options(&pf);
1694
1695         if ((opts & PF_OPT_NOACTION) == 0) {
1696                 /*
1697                  * XXX For the time being we need to open transactions for
1698                  * the main ruleset before parsing, because tables are still
1699                  * loaded at parse time.
1700                  */
1701                 if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1702                         ERRX("pfctl_rules");
1703                 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1704                         pa.ticket =
1705                             pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1706                 if (pf.loadopt & PFCTL_FLAG_TABLE)
1707                         pf.astack[0]->ruleset.tticket =
1708                             pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1709         }
1710
1711         if (parse_config(filename, &pf) < 0) {
1712                 if ((opts & PF_OPT_NOACTION) == 0)
1713                         ERRX("Syntax error in config file: "
1714                             "pf rules not loaded");
1715                 else
1716                         goto _error;
1717         }
1718         if (loadopt & PFCTL_FLAG_OPTION)
1719                 pfctl_adjust_skip_ifaces(&pf);
1720
1721         if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1722             (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1723             (pf.loadopt & PFCTL_FLAG_NAT &&
1724             (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1725             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1726             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1727             (pf.loadopt & PFCTL_FLAG_FILTER &&
1728             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1729                 if ((opts & PF_OPT_NOACTION) == 0)
1730                         ERRX("Unable to load rules into kernel");
1731                 else
1732                         goto _error;
1733         }
1734
1735         if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1736                 if (check_commit_altq(dev, opts) != 0)
1737                         ERRX("errors in altq config");
1738
1739         /* process "load anchor" directives */
1740         if (!anchorname[0])
1741                 if (pfctl_load_anchors(dev, &pf, t) == -1)
1742                         ERRX("load anchors");
1743
1744         if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1745                 if (!anchorname[0])
1746                         if (pfctl_load_options(&pf))
1747                                 goto _error;
1748                 if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1749                         ERR("DIOCXCOMMIT");
1750         }
1751         free(path);
1752         return (0);
1753
1754 _error:
1755         if (trans == NULL) {    /* main ruleset */
1756                 if ((opts & PF_OPT_NOACTION) == 0)
1757                         if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1758                                 err(1, "DIOCXROLLBACK");
1759                 exit(1);
1760         } else {                /* sub ruleset */
1761                 free(path);
1762                 return (-1);
1763         }
1764
1765 #undef ERR
1766 #undef ERRX
1767 }
1768
1769 FILE *
1770 pfctl_fopen(const char *name, const char *mode)
1771 {
1772         struct stat      st;
1773         FILE            *fp;
1774
1775         fp = fopen(name, mode);
1776         if (fp == NULL)
1777                 return (NULL);
1778         if (fstat(fileno(fp), &st)) {
1779                 fclose(fp);
1780                 return (NULL);
1781         }
1782         if (S_ISDIR(st.st_mode)) {
1783                 fclose(fp);
1784                 errno = EISDIR;
1785                 return (NULL);
1786         }
1787         return (fp);
1788 }
1789
1790 void
1791 pfctl_init_options(struct pfctl *pf)
1792 {
1793
1794         pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1795         pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1796         pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1797         pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1798         pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1799         pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1800         pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1801         pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1802         pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1803         pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1804         pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1805         pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1806         pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1807         pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1808         pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1809         pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1810         pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1811         pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1812         pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1813         pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1814
1815         pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1816         pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1817         pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1818         pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1819
1820         pf->debug = PF_DEBUG_URGENT;
1821
1822         pf->syncookies = false;
1823         pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
1824         pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
1825 }
1826
1827 int
1828 pfctl_load_options(struct pfctl *pf)
1829 {
1830         int i, error = 0;
1831
1832         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1833                 return (0);
1834
1835         /* load limits */
1836         for (i = 0; i < PF_LIMIT_MAX; i++) {
1837                 if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1838                         continue;
1839                 if (pfctl_load_limit(pf, i, pf->limit[i]))
1840                         error = 1;
1841         }
1842
1843         /*
1844          * If we've set the limit, but haven't explicitly set adaptive
1845          * timeouts, do it now with a start of 60% and end of 120%.
1846          */
1847         if (pf->limit_set[PF_LIMIT_STATES] &&
1848             !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1849             !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1850                 pf->timeout[PFTM_ADAPTIVE_START] =
1851                         (pf->limit[PF_LIMIT_STATES] / 10) * 6;
1852                 pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1853                 pf->timeout[PFTM_ADAPTIVE_END] =
1854                         (pf->limit[PF_LIMIT_STATES] / 10) * 12;
1855                 pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1856         }
1857
1858         /* load timeouts */
1859         for (i = 0; i < PFTM_MAX; i++) {
1860                 if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1861                         continue;
1862                 if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1863                         error = 1;
1864         }
1865
1866         /* load debug */
1867         if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1868                 if (pfctl_load_debug(pf, pf->debug))
1869                         error = 1;
1870
1871         /* load logif */
1872         if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1873                 if (pfctl_load_logif(pf, pf->ifname))
1874                         error = 1;
1875
1876         /* load hostid */
1877         if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1878                 if (pfctl_load_hostid(pf, pf->hostid))
1879                         error = 1;
1880
1881         /* load keepcounters */
1882         if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
1883                 error = 1;
1884
1885         /* load syncookies settings */
1886         if (pfctl_load_syncookies(pf, pf->syncookies))
1887                 error = 1;
1888
1889         return (error);
1890 }
1891
1892 int
1893 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1894 {
1895         int i;
1896
1897
1898         for (i = 0; pf_limits[i].name; i++) {
1899                 if (strcasecmp(opt, pf_limits[i].name) == 0) {
1900                         pf->limit[pf_limits[i].index] = limit;
1901                         pf->limit_set[pf_limits[i].index] = 1;
1902                         break;
1903                 }
1904         }
1905         if (pf_limits[i].name == NULL) {
1906                 warnx("Bad pool name.");
1907                 return (1);
1908         }
1909
1910         if (pf->opts & PF_OPT_VERBOSE)
1911                 printf("set limit %s %d\n", opt, limit);
1912
1913         return (0);
1914 }
1915
1916 int
1917 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1918 {
1919         struct pfioc_limit pl;
1920
1921         memset(&pl, 0, sizeof(pl));
1922         pl.index = index;
1923         pl.limit = limit;
1924         if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1925                 if (errno == EBUSY)
1926                         warnx("Current pool size exceeds requested hard limit");
1927                 else
1928                         warnx("DIOCSETLIMIT");
1929                 return (1);
1930         }
1931         return (0);
1932 }
1933
1934 int
1935 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1936 {
1937         int i;
1938
1939         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1940                 return (0);
1941
1942         for (i = 0; pf_timeouts[i].name; i++) {
1943                 if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1944                         pf->timeout[pf_timeouts[i].timeout] = seconds;
1945                         pf->timeout_set[pf_timeouts[i].timeout] = 1;
1946                         break;
1947                 }
1948         }
1949
1950         if (pf_timeouts[i].name == NULL) {
1951                 warnx("Bad timeout name.");
1952                 return (1);
1953         }
1954
1955
1956         if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1957                 printf("set timeout %s %d\n", opt, seconds);
1958
1959         return (0);
1960 }
1961
1962 int
1963 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1964 {
1965         struct pfioc_tm pt;
1966
1967         memset(&pt, 0, sizeof(pt));
1968         pt.timeout = timeout;
1969         pt.seconds = seconds;
1970         if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1971                 warnx("DIOCSETTIMEOUT");
1972                 return (1);
1973         }
1974         return (0);
1975 }
1976
1977 int
1978 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1979 {
1980         const struct pf_hint *hint;
1981         int i, r;
1982
1983         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1984                 return (0);
1985
1986         for (i = 0; pf_hints[i].name; i++)
1987                 if (strcasecmp(opt, pf_hints[i].name) == 0)
1988                         break;
1989
1990         hint = pf_hints[i].hint;
1991         if (hint == NULL) {
1992                 warnx("invalid state timeouts optimization");
1993                 return (1);
1994         }
1995
1996         for (i = 0; hint[i].name; i++)
1997                 if ((r = pfctl_set_timeout(pf, hint[i].name,
1998                     hint[i].timeout, 1)))
1999                         return (r);
2000
2001         if (pf->opts & PF_OPT_VERBOSE)
2002                 printf("set optimization %s\n", opt);
2003
2004         return (0);
2005 }
2006
2007 int
2008 pfctl_set_logif(struct pfctl *pf, char *ifname)
2009 {
2010
2011         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2012                 return (0);
2013
2014         if (!strcmp(ifname, "none")) {
2015                 free(pf->ifname);
2016                 pf->ifname = NULL;
2017         } else {
2018                 pf->ifname = strdup(ifname);
2019                 if (!pf->ifname)
2020                         errx(1, "pfctl_set_logif: strdup");
2021         }
2022         pf->ifname_set = 1;
2023
2024         if (pf->opts & PF_OPT_VERBOSE)
2025                 printf("set loginterface %s\n", ifname);
2026
2027         return (0);
2028 }
2029
2030 int
2031 pfctl_load_logif(struct pfctl *pf, char *ifname)
2032 {
2033         struct pfioc_if pi;
2034
2035         memset(&pi, 0, sizeof(pi));
2036         if (ifname && strlcpy(pi.ifname, ifname,
2037             sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
2038                 warnx("pfctl_load_logif: strlcpy");
2039                 return (1);
2040         }
2041         if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
2042                 warnx("DIOCSETSTATUSIF");
2043                 return (1);
2044         }
2045         return (0);
2046 }
2047
2048 int
2049 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2050 {
2051         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2052                 return (0);
2053
2054         HTONL(hostid);
2055
2056         pf->hostid = hostid;
2057         pf->hostid_set = 1;
2058
2059         if (pf->opts & PF_OPT_VERBOSE)
2060                 printf("set hostid 0x%08x\n", ntohl(hostid));
2061
2062         return (0);
2063 }
2064
2065 int
2066 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2067 {
2068         if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2069                 warnx("DIOCSETHOSTID");
2070                 return (1);
2071         }
2072         return (0);
2073 }
2074
2075 int
2076 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2077 {
2078         struct pfctl_syncookies cookies;
2079
2080         bzero(&cookies, sizeof(cookies));
2081
2082         cookies.mode = val;
2083         cookies.lowwater = pf->syncookieswat[0];
2084         cookies.highwater = pf->syncookieswat[1];
2085
2086         if (pfctl_set_syncookies(dev, &cookies)) {
2087                 warnx("DIOCSETSYNCOOKIES");
2088                 return (1);
2089         }
2090         return (0);
2091 }
2092
2093 int
2094 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2095 {
2096         if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2097                 warnx("syncookies start/end only apply to adaptive");
2098                 return (1);
2099         }
2100         if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2101                 if (!w->hi)
2102                         w->hi = PF_SYNCOOKIES_HIWATPCT;
2103                 if (!w->lo)
2104                         w->lo = w->hi / 2;
2105                 if (w->lo >= w->hi) {
2106                         warnx("start must be higher than end");
2107                         return (1);
2108                 }
2109                 pf->syncookieswat[0] = w->lo;
2110                 pf->syncookieswat[1] = w->hi;
2111                 pf->syncookieswat_set = 1;
2112         }
2113
2114         if (pf->opts & PF_OPT_VERBOSE) {
2115                 if (val == PF_SYNCOOKIES_NEVER)
2116                         printf("set syncookies never\n");
2117                 else if (val == PF_SYNCOOKIES_ALWAYS)
2118                         printf("set syncookies always\n");
2119                 else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2120                         if (pf->syncookieswat_set)
2121                                 printf("set syncookies adaptive (start %u%%, "
2122                                     "end %u%%)\n", pf->syncookieswat[1],
2123                                     pf->syncookieswat[0]);
2124                         else
2125                                 printf("set syncookies adaptive\n");
2126                 } else {        /* cannot happen */
2127                         warnx("king bula ate all syncookies");
2128                         return (1);
2129                 }
2130         }
2131
2132         pf->syncookies = val;
2133         return (0);
2134 }
2135
2136 int
2137 pfctl_set_debug(struct pfctl *pf, char *d)
2138 {
2139         u_int32_t       level;
2140
2141         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2142                 return (0);
2143
2144         if (!strcmp(d, "none"))
2145                 pf->debug = PF_DEBUG_NONE;
2146         else if (!strcmp(d, "urgent"))
2147                 pf->debug = PF_DEBUG_URGENT;
2148         else if (!strcmp(d, "misc"))
2149                 pf->debug = PF_DEBUG_MISC;
2150         else if (!strcmp(d, "loud"))
2151                 pf->debug = PF_DEBUG_NOISY;
2152         else {
2153                 warnx("unknown debug level \"%s\"", d);
2154                 return (-1);
2155         }
2156
2157         pf->debug_set = 1;
2158         level = pf->debug;
2159
2160         if ((pf->opts & PF_OPT_NOACTION) == 0)
2161                 if (ioctl(dev, DIOCSETDEBUG, &level))
2162                         err(1, "DIOCSETDEBUG");
2163
2164         if (pf->opts & PF_OPT_VERBOSE)
2165                 printf("set debug %s\n", d);
2166
2167         return (0);
2168 }
2169
2170 int
2171 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2172 {
2173         if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
2174                 warnx("DIOCSETDEBUG");
2175                 return (1);
2176         }
2177         return (0);
2178 }
2179
2180 int
2181 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2182 {
2183         struct pfioc_iface      pi;
2184         struct node_host        *h = NULL, *n = NULL;
2185
2186         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2187                 return (0);
2188
2189         bzero(&pi, sizeof(pi));
2190
2191         pi.pfiio_flags = flags;
2192
2193         /* Make sure our cache matches the kernel. If we set or clear the flag
2194          * for a group this applies to all members. */
2195         h = ifa_grouplookup(ifname, 0);
2196         for (n = h; n != NULL; n = n->next)
2197                 pfctl_set_interface_flags(pf, n->ifname, flags, how);
2198
2199         if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2200             sizeof(pi.pfiio_name))
2201                 errx(1, "pfctl_set_interface_flags: strlcpy");
2202
2203         if ((pf->opts & PF_OPT_NOACTION) == 0) {
2204                 if (how == 0) {
2205                         if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2206                                 err(1, "DIOCCLRIFFLAG");
2207                 } else {
2208                         if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2209                                 err(1, "DIOCSETIFFLAG");
2210                         pfctl_check_skip_ifaces(ifname);
2211                 }
2212         }
2213         return (0);
2214 }
2215
2216 void
2217 pfctl_debug(int dev, u_int32_t level, int opts)
2218 {
2219         if (ioctl(dev, DIOCSETDEBUG, &level))
2220                 err(1, "DIOCSETDEBUG");
2221         if ((opts & PF_OPT_QUIET) == 0) {
2222                 fprintf(stderr, "debug level set to '");
2223                 switch (level) {
2224                 case PF_DEBUG_NONE:
2225                         fprintf(stderr, "none");
2226                         break;
2227                 case PF_DEBUG_URGENT:
2228                         fprintf(stderr, "urgent");
2229                         break;
2230                 case PF_DEBUG_MISC:
2231                         fprintf(stderr, "misc");
2232                         break;
2233                 case PF_DEBUG_NOISY:
2234                         fprintf(stderr, "loud");
2235                         break;
2236                 default:
2237                         fprintf(stderr, "<invalid>");
2238                         break;
2239                 }
2240                 fprintf(stderr, "'\n");
2241         }
2242 }
2243
2244 int
2245 pfctl_test_altqsupport(int dev, int opts)
2246 {
2247         struct pfioc_altq pa;
2248
2249         pa.version = PFIOC_ALTQ_VERSION;
2250         if (ioctl(dev, DIOCGETALTQS, &pa)) {
2251                 if (errno == ENODEV) {
2252                         if (opts & PF_OPT_VERBOSE)
2253                                 fprintf(stderr, "No ALTQ support in kernel\n"
2254                                     "ALTQ related functions disabled\n");
2255                         return (0);
2256                 } else
2257                         err(1, "DIOCGETALTQS");
2258         }
2259         return (1);
2260 }
2261
2262 int
2263 pfctl_show_anchors(int dev, int opts, char *anchorname)
2264 {
2265         struct pfioc_ruleset     pr;
2266         u_int32_t                mnr, nr;
2267
2268         memset(&pr, 0, sizeof(pr));
2269         memcpy(pr.path, anchorname, sizeof(pr.path));
2270         if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2271                 if (errno == EINVAL)
2272                         fprintf(stderr, "Anchor '%s' not found.\n",
2273                             anchorname);
2274                 else
2275                         err(1, "DIOCGETRULESETS");
2276                 return (-1);
2277         }
2278         mnr = pr.nr;
2279         for (nr = 0; nr < mnr; ++nr) {
2280                 char sub[MAXPATHLEN];
2281
2282                 pr.nr = nr;
2283                 if (ioctl(dev, DIOCGETRULESET, &pr))
2284                         err(1, "DIOCGETRULESET");
2285                 if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2286                         continue;
2287                 sub[0] = 0;
2288                 if (pr.path[0]) {
2289                         strlcat(sub, pr.path, sizeof(sub));
2290                         strlcat(sub, "/", sizeof(sub));
2291                 }
2292                 strlcat(sub, pr.name, sizeof(sub));
2293                 if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2294                         printf("  %s\n", sub);
2295                 if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2296                         return (-1);
2297         }
2298         return (0);
2299 }
2300
2301 const char *
2302 pfctl_lookup_option(char *cmd, const char * const *list)
2303 {
2304         if (cmd != NULL && *cmd)
2305                 for (; *list; list++)
2306                         if (!strncmp(cmd, *list, strlen(cmd)))
2307                                 return (*list);
2308         return (NULL);
2309 }
2310
2311 int
2312 main(int argc, char *argv[])
2313 {
2314         int      error = 0;
2315         int      ch;
2316         int      mode = O_RDONLY;
2317         int      opts = 0;
2318         int      optimize = PF_OPTIMIZE_BASIC;
2319         char     anchorname[MAXPATHLEN];
2320         char    *path;
2321
2322         if (argc < 2)
2323                 usage();
2324
2325         while ((ch = getopt(argc, argv,
2326             "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2327                 switch (ch) {
2328                 case 'a':
2329                         anchoropt = optarg;
2330                         break;
2331                 case 'd':
2332                         opts |= PF_OPT_DISABLE;
2333                         mode = O_RDWR;
2334                         break;
2335                 case 'D':
2336                         if (pfctl_cmdline_symset(optarg) < 0)
2337                                 warnx("could not parse macro definition %s",
2338                                     optarg);
2339                         break;
2340                 case 'e':
2341                         opts |= PF_OPT_ENABLE;
2342                         mode = O_RDWR;
2343                         break;
2344                 case 'q':
2345                         opts |= PF_OPT_QUIET;
2346                         break;
2347                 case 'F':
2348                         clearopt = pfctl_lookup_option(optarg, clearopt_list);
2349                         if (clearopt == NULL) {
2350                                 warnx("Unknown flush modifier '%s'", optarg);
2351                                 usage();
2352                         }
2353                         mode = O_RDWR;
2354                         break;
2355                 case 'i':
2356                         ifaceopt = optarg;
2357                         break;
2358                 case 'k':
2359                         if (state_killers >= 2) {
2360                                 warnx("can only specify -k twice");
2361                                 usage();
2362                                 /* NOTREACHED */
2363                         }
2364                         state_kill[state_killers++] = optarg;
2365                         mode = O_RDWR;
2366                         break;
2367                 case 'K':
2368                         if (src_node_killers >= 2) {
2369                                 warnx("can only specify -K twice");
2370                                 usage();
2371                                 /* NOTREACHED */
2372                         }
2373                         src_node_kill[src_node_killers++] = optarg;
2374                         mode = O_RDWR;
2375                         break;
2376                 case 'm':
2377                         opts |= PF_OPT_MERGE;
2378                         break;
2379                 case 'M':
2380                         opts |= PF_OPT_KILLMATCH;
2381                         break;
2382                 case 'n':
2383                         opts |= PF_OPT_NOACTION;
2384                         break;
2385                 case 'N':
2386                         loadopt |= PFCTL_FLAG_NAT;
2387                         break;
2388                 case 'r':
2389                         opts |= PF_OPT_USEDNS;
2390                         break;
2391                 case 'f':
2392                         rulesopt = optarg;
2393                         mode = O_RDWR;
2394                         break;
2395                 case 'g':
2396                         opts |= PF_OPT_DEBUG;
2397                         break;
2398                 case 'A':
2399                         loadopt |= PFCTL_FLAG_ALTQ;
2400                         break;
2401                 case 'R':
2402                         loadopt |= PFCTL_FLAG_FILTER;
2403                         break;
2404                 case 'o':
2405                         optiopt = pfctl_lookup_option(optarg, optiopt_list);
2406                         if (optiopt == NULL) {
2407                                 warnx("Unknown optimization '%s'", optarg);
2408                                 usage();
2409                         }
2410                         opts |= PF_OPT_OPTIMIZE;
2411                         break;
2412                 case 'O':
2413                         loadopt |= PFCTL_FLAG_OPTION;
2414                         break;
2415                 case 'p':
2416                         pf_device = optarg;
2417                         break;
2418                 case 'P':
2419                         opts |= PF_OPT_NUMERIC;
2420                         break;
2421                 case 's':
2422                         showopt = pfctl_lookup_option(optarg, showopt_list);
2423                         if (showopt == NULL) {
2424                                 warnx("Unknown show modifier '%s'", optarg);
2425                                 usage();
2426                         }
2427                         break;
2428                 case 't':
2429                         tableopt = optarg;
2430                         break;
2431                 case 'T':
2432                         tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2433                         if (tblcmdopt == NULL) {
2434                                 warnx("Unknown table command '%s'", optarg);
2435                                 usage();
2436                         }
2437                         break;
2438                 case 'v':
2439                         if (opts & PF_OPT_VERBOSE)
2440                                 opts |= PF_OPT_VERBOSE2;
2441                         opts |= PF_OPT_VERBOSE;
2442                         break;
2443                 case 'x':
2444                         debugopt = pfctl_lookup_option(optarg, debugopt_list);
2445                         if (debugopt == NULL) {
2446                                 warnx("Unknown debug level '%s'", optarg);
2447                                 usage();
2448                         }
2449                         mode = O_RDWR;
2450                         break;
2451                 case 'z':
2452                         opts |= PF_OPT_CLRRULECTRS;
2453                         mode = O_RDWR;
2454                         break;
2455                 case 'h':
2456                         /* FALLTHROUGH */
2457                 default:
2458                         usage();
2459                         /* NOTREACHED */
2460                 }
2461         }
2462
2463         if (tblcmdopt != NULL) {
2464                 argc -= optind;
2465                 argv += optind;
2466                 ch = *tblcmdopt;
2467                 if (ch == 'l') {
2468                         loadopt |= PFCTL_FLAG_TABLE;
2469                         tblcmdopt = NULL;
2470                 } else
2471                         mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2472         } else if (argc != optind) {
2473                 warnx("unknown command line argument: %s ...", argv[optind]);
2474                 usage();
2475                 /* NOTREACHED */
2476         }
2477         if (loadopt == 0)
2478                 loadopt = ~0;
2479
2480         if ((path = calloc(1, MAXPATHLEN)) == NULL)
2481                 errx(1, "pfctl: calloc");
2482         memset(anchorname, 0, sizeof(anchorname));
2483         if (anchoropt != NULL) {
2484                 int len = strlen(anchoropt);
2485
2486                 if (anchoropt[len - 1] == '*') {
2487                         if (len >= 2 && anchoropt[len - 2] == '/')
2488                                 anchoropt[len - 2] = '\0';
2489                         else
2490                                 anchoropt[len - 1] = '\0';
2491                         opts |= PF_OPT_RECURSE;
2492                 }
2493                 if (strlcpy(anchorname, anchoropt,
2494                     sizeof(anchorname)) >= sizeof(anchorname))
2495                         errx(1, "anchor name '%s' too long",
2496                             anchoropt);
2497                 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2498         }
2499
2500         if ((opts & PF_OPT_NOACTION) == 0) {
2501                 dev = open(pf_device, mode);
2502                 if (dev == -1)
2503                         err(1, "%s", pf_device);
2504                 altqsupport = pfctl_test_altqsupport(dev, opts);
2505         } else {
2506                 dev = open(pf_device, O_RDONLY);
2507                 if (dev >= 0)
2508                         opts |= PF_OPT_DUMMYACTION;
2509                 /* turn off options */
2510                 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2511                 clearopt = showopt = debugopt = NULL;
2512 #if !defined(ENABLE_ALTQ)
2513                 altqsupport = 0;
2514 #else
2515                 altqsupport = 1;
2516 #endif
2517         }
2518
2519         if (opts & PF_OPT_DISABLE)
2520                 if (pfctl_disable(dev, opts))
2521                         error = 1;
2522
2523         if (showopt != NULL) {
2524                 switch (*showopt) {
2525                 case 'A':
2526                         pfctl_show_anchors(dev, opts, anchorname);
2527                         break;
2528                 case 'r':
2529                         pfctl_load_fingerprints(dev, opts);
2530                         pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2531                             anchorname, 0);
2532                         break;
2533                 case 'l':
2534                         pfctl_load_fingerprints(dev, opts);
2535                         pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2536                             anchorname, 0);
2537                         break;
2538                 case 'n':
2539                         pfctl_load_fingerprints(dev, opts);
2540                         pfctl_show_nat(dev, opts, anchorname);
2541                         break;
2542                 case 'q':
2543                         pfctl_show_altq(dev, ifaceopt, opts,
2544                             opts & PF_OPT_VERBOSE2);
2545                         break;
2546                 case 's':
2547                         pfctl_show_states(dev, ifaceopt, opts);
2548                         break;
2549                 case 'S':
2550                         pfctl_show_src_nodes(dev, opts);
2551                         break;
2552                 case 'i':
2553                         pfctl_show_status(dev, opts);
2554                         break;
2555                 case 'R':
2556                         error = pfctl_show_running(dev);
2557                         break;
2558                 case 't':
2559                         pfctl_show_timeouts(dev, opts);
2560                         break;
2561                 case 'm':
2562                         pfctl_show_limits(dev, opts);
2563                         break;
2564                 case 'a':
2565                         opts |= PF_OPT_SHOWALL;
2566                         pfctl_load_fingerprints(dev, opts);
2567
2568                         pfctl_show_nat(dev, opts, anchorname);
2569                         pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2570                         pfctl_show_altq(dev, ifaceopt, opts, 0);
2571                         pfctl_show_states(dev, ifaceopt, opts);
2572                         pfctl_show_src_nodes(dev, opts);
2573                         pfctl_show_status(dev, opts);
2574                         pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2575                         pfctl_show_timeouts(dev, opts);
2576                         pfctl_show_limits(dev, opts);
2577                         pfctl_show_tables(anchorname, opts);
2578                         pfctl_show_fingerprints(opts);
2579                         break;
2580                 case 'T':
2581                         pfctl_show_tables(anchorname, opts);
2582                         break;
2583                 case 'o':
2584                         pfctl_load_fingerprints(dev, opts);
2585                         pfctl_show_fingerprints(opts);
2586                         break;
2587                 case 'I':
2588                         pfctl_show_ifaces(ifaceopt, opts);
2589                         break;
2590                 }
2591         }
2592
2593         if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2594                 pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2595                     anchorname, 0);
2596
2597         if (clearopt != NULL) {
2598                 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2599                         errx(1, "anchor names beginning with '_' cannot "
2600                             "be modified from the command line");
2601
2602                 switch (*clearopt) {
2603                 case 'r':
2604                         pfctl_clear_rules(dev, opts, anchorname);
2605                         break;
2606                 case 'n':
2607                         pfctl_clear_nat(dev, opts, anchorname);
2608                         break;
2609                 case 'q':
2610                         pfctl_clear_altq(dev, opts);
2611                         break;
2612                 case 's':
2613                         pfctl_clear_iface_states(dev, ifaceopt, opts);
2614                         break;
2615                 case 'S':
2616                         pfctl_clear_src_nodes(dev, opts);
2617                         break;
2618                 case 'i':
2619                         pfctl_clear_stats(dev, opts);
2620                         break;
2621                 case 'a':
2622                         pfctl_clear_rules(dev, opts, anchorname);
2623                         pfctl_clear_nat(dev, opts, anchorname);
2624                         pfctl_clear_tables(anchorname, opts);
2625                         if (!*anchorname) {
2626                                 pfctl_clear_altq(dev, opts);
2627                                 pfctl_clear_iface_states(dev, ifaceopt, opts);
2628                                 pfctl_clear_src_nodes(dev, opts);
2629                                 pfctl_clear_stats(dev, opts);
2630                                 pfctl_clear_fingerprints(dev, opts);
2631                                 pfctl_clear_interface_flags(dev, opts);
2632                         }
2633                         break;
2634                 case 'o':
2635                         pfctl_clear_fingerprints(dev, opts);
2636                         break;
2637                 case 'T':
2638                         pfctl_clear_tables(anchorname, opts);
2639                         break;
2640                 }
2641         }
2642         if (state_killers) {
2643                 if (!strcmp(state_kill[0], "label"))
2644                         pfctl_label_kill_states(dev, ifaceopt, opts);
2645                 else if (!strcmp(state_kill[0], "id"))
2646                         pfctl_id_kill_states(dev, ifaceopt, opts);
2647                 else if (!strcmp(state_kill[0], "gateway"))
2648                         pfctl_gateway_kill_states(dev, ifaceopt, opts);
2649                 else
2650                         pfctl_net_kill_states(dev, ifaceopt, opts);
2651         }
2652
2653         if (src_node_killers)
2654                 pfctl_kill_src_nodes(dev, ifaceopt, opts);
2655
2656         if (tblcmdopt != NULL) {
2657                 error = pfctl_command_tables(argc, argv, tableopt,
2658                     tblcmdopt, rulesopt, anchorname, opts);
2659                 rulesopt = NULL;
2660         }
2661         if (optiopt != NULL) {
2662                 switch (*optiopt) {
2663                 case 'n':
2664                         optimize = 0;
2665                         break;
2666                 case 'b':
2667                         optimize |= PF_OPTIMIZE_BASIC;
2668                         break;
2669                 case 'o':
2670                 case 'p':
2671                         optimize |= PF_OPTIMIZE_PROFILE;
2672                         break;
2673                 }
2674         }
2675
2676         if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2677             !anchorname[0] && !(opts & PF_OPT_NOACTION))
2678                 if (pfctl_get_skip_ifaces())
2679                         error = 1;
2680
2681         if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2682             !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2683                 if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2684                         error = 1;
2685
2686         if (rulesopt != NULL) {
2687                 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2688                         errx(1, "anchor names beginning with '_' cannot "
2689                             "be modified from the command line");
2690                 if (pfctl_rules(dev, rulesopt, opts, optimize,
2691                     anchorname, NULL))
2692                         error = 1;
2693                 else if (!(opts & PF_OPT_NOACTION) &&
2694                     (loadopt & PFCTL_FLAG_TABLE))
2695                         warn_namespace_collision(NULL);
2696         }
2697
2698         if (opts & PF_OPT_ENABLE)
2699                 if (pfctl_enable(dev, opts))
2700                         error = 1;
2701
2702         if (debugopt != NULL) {
2703                 switch (*debugopt) {
2704                 case 'n':
2705                         pfctl_debug(dev, PF_DEBUG_NONE, opts);
2706                         break;
2707                 case 'u':
2708                         pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2709                         break;
2710                 case 'm':
2711                         pfctl_debug(dev, PF_DEBUG_MISC, opts);
2712                         break;
2713                 case 'l':
2714                         pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2715                         break;
2716                 }
2717         }
2718
2719         exit(error);
2720 }