sbin/pfctl/pfctl.c

   1 /*      $OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-2-Clause
   5  *
   6  * Copyright (c) 2001 Daniel Hartmeier
   7  * Copyright (c) 2002,2003 Henning Brauer
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  *    - Redistributions of source code must retain the above copyright
  15  *      notice, this list of conditions and the following disclaimer.
  16  *    - Redistributions in binary form must reproduce the above
  17  *      copyright notice, this list of conditions and the following
  18  *      disclaimer in the documentation and/or other materials provided
  19  *      with the distribution.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  32  * POSSIBILITY OF SUCH DAMAGE.
  33  *
  34  */
  35
  36 #include <sys/cdefs.h>
  37 __FBSDID("$FreeBSD$");
  38
  39 #include <sys/types.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/socket.h>
  42 #include <sys/stat.h>
  43 #include <sys/endian.h>
  44
  45 #include <net/if.h>
  46 #include <netinet/in.h>
  47 #include <net/pfvar.h>
  48 #include <arpa/inet.h>
  49 #include <net/altq/altq.h>
  50 #include <sys/sysctl.h>
  51
  52 #include <err.h>
  53 #include <errno.h>
  54 #include <fcntl.h>
  55 #include <limits.h>
  56 #include <netdb.h>
  57 #include <stdint.h>
  58 #include <stdio.h>
  59 #include <stdlib.h>
  60 #include <string.h>
  61 #include <unistd.h>
  62
  63 #include "pfctl_parser.h"
  64 #include "pfctl.h"
  65
  66 void     usage(void);
  67 int      pfctl_enable(int, int);
  68 int      pfctl_disable(int, int);
  69 int      pfctl_clear_stats(int, int);
  70 int      pfctl_clear_interface_flags(int, int);
  71 int      pfctl_clear_rules(int, int, char *);
  72 int      pfctl_clear_nat(int, int, char *);
  73 int      pfctl_clear_altq(int, int);
  74 int      pfctl_clear_src_nodes(int, int);
  75 int      pfctl_clear_states(int, const char *, int);
  76 void     pfctl_addrprefix(char *, struct pf_addr *);
  77 int      pfctl_kill_src_nodes(int, const char *, int);
  78 int      pfctl_net_kill_states(int, const char *, int);
  79 int      pfctl_label_kill_states(int, const char *, int);
  80 int      pfctl_id_kill_states(int, const char *, int);
  81 void     pfctl_init_options(struct pfctl *);
  82 int      pfctl_load_options(struct pfctl *);
  83 int      pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
  84 int      pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
  85 int      pfctl_load_debug(struct pfctl *, unsigned int);
  86 int      pfctl_load_logif(struct pfctl *, char *);
  87 int      pfctl_load_hostid(struct pfctl *, u_int32_t);
  88 int      pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
  89             char *);
  90 void     pfctl_print_rule_counters(struct pf_rule *, int);
  91 int      pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
  92 int      pfctl_show_nat(int, int, char *);
  93 int      pfctl_show_src_nodes(int, int);
  94 int      pfctl_show_states(int, const char *, int);
  95 int      pfctl_show_status(int, int);
  96 int      pfctl_show_timeouts(int, int);
  97 int      pfctl_show_limits(int, int);
  98 void     pfctl_debug(int, u_int32_t, int);
  99 int      pfctl_test_altqsupport(int, int);
 100 int      pfctl_show_anchors(int, int, char *);
 101 int      pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
 102 int      pfctl_load_ruleset(struct pfctl *, char *,
 103                 struct pf_ruleset *, int, int);
 104 int      pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
 105 const char      *pfctl_lookup_option(char *, const char * const *);
 106
 107 static struct pf_anchor_global   pf_anchors;
 108 static struct pf_anchor  pf_main_anchor;
 109
 110 static const char       *clearopt;
 111 static char             *rulesopt;
 112 static const char       *showopt;
 113 static const char       *debugopt;
 114 static char             *anchoropt;
 115 static const char       *optiopt = NULL;
 116 static const char       *pf_device = "/dev/pf";
 117 static char             *ifaceopt;
 118 static char             *tableopt;
 119 static const char       *tblcmdopt;
 120 static int               src_node_killers;
 121 static char             *src_node_kill[2];
 122 static int               state_killers;
 123 static char             *state_kill[2];
 124 int                      loadopt;
 125 int                      altqsupport;
 126
 127 int                      dev = -1;
 128 static int               first_title = 1;
 129 static int               labels = 0;
 130
 131 #define INDENT(d, o)    do {                                            \
 132                                 if (o) {                                \
 133                                         int i;                          \
 134                                         for (i=0; i < d; i++)           \
 135                                                 printf("  ");           \
 136                                 }                                       \
 137                         } while (0);                                    \
 138
 139
 140 static const struct {
 141         const char      *name;
 142         int             index;
 143 } pf_limits[] = {
 144         { "states",             PF_LIMIT_STATES },
 145         { "src-nodes",          PF_LIMIT_SRC_NODES },
 146         { "frags",              PF_LIMIT_FRAGS },
 147         { "table-entries",      PF_LIMIT_TABLE_ENTRIES },
 148         { NULL,                 0 }
 149 };
 150
 151 struct pf_hint {
 152         const char      *name;
 153         int             timeout;
 154 };
 155 static const struct pf_hint pf_hint_normal[] = {
 156         { "tcp.first",          2 * 60 },
 157         { "tcp.opening",        30 },
 158         { "tcp.established",    24 * 60 * 60 },
 159         { "tcp.closing",        15 * 60 },
 160         { "tcp.finwait",        45 },
 161         { "tcp.closed",         90 },
 162         { "tcp.tsdiff",         30 },
 163         { NULL,                 0 }
 164 };
 165 static const struct pf_hint pf_hint_satellite[] = {
 166         { "tcp.first",          3 * 60 },
 167         { "tcp.opening",        30 + 5 },
 168         { "tcp.established",    24 * 60 * 60 },
 169         { "tcp.closing",        15 * 60 + 5 },
 170         { "tcp.finwait",        45 + 5 },
 171         { "tcp.closed",         90 + 5 },
 172         { "tcp.tsdiff",         60 },
 173         { NULL,                 0 }
 174 };
 175 static const struct pf_hint pf_hint_conservative[] = {
 176         { "tcp.first",          60 * 60 },
 177         { "tcp.opening",        15 * 60 },
 178         { "tcp.established",    5 * 24 * 60 * 60 },
 179         { "tcp.closing",        60 * 60 },
 180         { "tcp.finwait",        10 * 60 },
 181         { "tcp.closed",         3 * 60 },
 182         { "tcp.tsdiff",         60 },
 183         { NULL,                 0 }
 184 };
 185 static const struct pf_hint pf_hint_aggressive[] = {
 186         { "tcp.first",          30 },
 187         { "tcp.opening",        5 },
 188         { "tcp.established",    5 * 60 * 60 },
 189         { "tcp.closing",        60 },
 190         { "tcp.finwait",        30 },
 191         { "tcp.closed",         30 },
 192         { "tcp.tsdiff",         10 },
 193         { NULL,                 0 }
 194 };
 195
 196 static const struct {
 197         const char *name;
 198         const struct pf_hint *hint;
 199 } pf_hints[] = {
 200         { "normal",             pf_hint_normal },
 201         { "satellite",          pf_hint_satellite },
 202         { "high-latency",       pf_hint_satellite },
 203         { "conservative",       pf_hint_conservative },
 204         { "aggressive",         pf_hint_aggressive },
 205         { NULL,                 NULL }
 206 };
 207
 208 static const char * const clearopt_list[] = {
 209         "nat", "queue", "rules", "Sources",
 210         "states", "info", "Tables", "osfp", "all", NULL
 211 };
 212
 213 static const char * const showopt_list[] = {
 214         "nat", "queue", "rules", "Anchors", "Sources", "states", "info",
 215         "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
 216         "all", NULL
 217 };
 218
 219 static const char * const tblcmdopt_list[] = {
 220         "kill", "flush", "add", "delete", "load", "replace", "show",
 221         "test", "zero", "expire", NULL
 222 };
 223
 224 static const char * const debugopt_list[] = {
 225         "none", "urgent", "misc", "loud", NULL
 226 };
 227
 228 static const char * const optiopt_list[] = {
 229         "none", "basic", "profile", NULL
 230 };
 231
 232 void
 233 usage(void)
 234 {
 235         extern char *__progname;
 236
 237         fprintf(stderr,
 238 "usage: %s [-AdeghmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
 239         "\t[-f file] [-i interface] [-K host | network]\n"
 240         "\t[-k host | network | label | id] [-o level] [-p device]\n"
 241         "\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
 242             __progname);
 243
 244         exit(1);
 245 }
 246
 247 int
 248 pfctl_enable(int dev, int opts)
 249 {
 250         if (ioctl(dev, DIOCSTART)) {
 251                 if (errno == EEXIST)
 252                         errx(1, "pf already enabled");
 253                 else if (errno == ESRCH)
 254                         errx(1, "pfil registeration failed");
 255                 else
 256                         err(1, "DIOCSTART");
 257         }
 258         if ((opts & PF_OPT_QUIET) == 0)
 259                 fprintf(stderr, "pf enabled\n");
 260
 261         if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
 262                 if (errno != EEXIST)
 263                         err(1, "DIOCSTARTALTQ");
 264
 265         return (0);
 266 }
 267
 268 int
 269 pfctl_disable(int dev, int opts)
 270 {
 271         if (ioctl(dev, DIOCSTOP)) {
 272                 if (errno == ENOENT)
 273                         errx(1, "pf not enabled");
 274                 else
 275                         err(1, "DIOCSTOP");
 276         }
 277         if ((opts & PF_OPT_QUIET) == 0)
 278                 fprintf(stderr, "pf disabled\n");
 279
 280         if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
 281                         if (errno != ENOENT)
 282                                 err(1, "DIOCSTOPALTQ");
 283
 284         return (0);
 285 }
 286
 287 int
 288 pfctl_clear_stats(int dev, int opts)
 289 {
 290         if (ioctl(dev, DIOCCLRSTATUS))
 291                 err(1, "DIOCCLRSTATUS");
 292         if ((opts & PF_OPT_QUIET) == 0)
 293                 fprintf(stderr, "pf: statistics cleared\n");
 294         return (0);
 295 }
 296
 297 int
 298 pfctl_clear_interface_flags(int dev, int opts)
 299 {
 300         struct pfioc_iface      pi;
 301
 302         if ((opts & PF_OPT_NOACTION) == 0) {
 303                 bzero(&pi, sizeof(pi));
 304                 pi.pfiio_flags = PFI_IFLAG_SKIP;
 305
 306                 if (ioctl(dev, DIOCCLRIFFLAG, &pi))
 307                         err(1, "DIOCCLRIFFLAG");
 308                 if ((opts & PF_OPT_QUIET) == 0)
 309                         fprintf(stderr, "pf: interface flags reset\n");
 310         }
 311         return (0);
 312 }
 313
 314 int
 315 pfctl_clear_rules(int dev, int opts, char *anchorname)
 316 {
 317         struct pfr_buffer t;
 318
 319         memset(&t, 0, sizeof(t));
 320         t.pfrb_type = PFRB_TRANS;
 321         if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
 322             pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
 323             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 324             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 325                 err(1, "pfctl_clear_rules");
 326         if ((opts & PF_OPT_QUIET) == 0)
 327                 fprintf(stderr, "rules cleared\n");
 328         return (0);
 329 }
 330
 331 int
 332 pfctl_clear_nat(int dev, int opts, char *anchorname)
 333 {
 334         struct pfr_buffer t;
 335
 336         memset(&t, 0, sizeof(t));
 337         t.pfrb_type = PFRB_TRANS;
 338         if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
 339             pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
 340             pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
 341             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 342             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 343                 err(1, "pfctl_clear_nat");
 344         if ((opts & PF_OPT_QUIET) == 0)
 345                 fprintf(stderr, "nat cleared\n");
 346         return (0);
 347 }
 348
 349 int
 350 pfctl_clear_altq(int dev, int opts)
 351 {
 352         struct pfr_buffer t;
 353
 354         if (!altqsupport)
 355                 return (-1);
 356         memset(&t, 0, sizeof(t));
 357         t.pfrb_type = PFRB_TRANS;
 358         if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
 359             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 360             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 361                 err(1, "pfctl_clear_altq");
 362         if ((opts & PF_OPT_QUIET) == 0)
 363                 fprintf(stderr, "altq cleared\n");
 364         return (0);
 365 }
 366
 367 int
 368 pfctl_clear_src_nodes(int dev, int opts)
 369 {
 370         if (ioctl(dev, DIOCCLRSRCNODES))
 371                 err(1, "DIOCCLRSRCNODES");
 372         if ((opts & PF_OPT_QUIET) == 0)
 373                 fprintf(stderr, "source tracking entries cleared\n");
 374         return (0);
 375 }
 376
 377 int
 378 pfctl_clear_states(int dev, const char *iface, int opts)
 379 {
 380         struct pfioc_state_kill psk;
 381
 382         memset(&psk, 0, sizeof(psk));
 383         if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 384             sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 385                 errx(1, "invalid interface: %s", iface);
 386
 387         if (ioctl(dev, DIOCCLRSTATES, &psk))
 388                 err(1, "DIOCCLRSTATES");
 389         if ((opts & PF_OPT_QUIET) == 0)
 390                 fprintf(stderr, "%d states cleared\n", psk.psk_killed);
 391         return (0);
 392 }
 393
 394 void
 395 pfctl_addrprefix(char *addr, struct pf_addr *mask)
 396 {
 397         char *p;
 398         const char *errstr;
 399         int prefix, ret_ga, q, r;
 400         struct addrinfo hints, *res;
 401
 402         if ((p = strchr(addr, '/')) == NULL)
 403                 return;
 404
 405         *p++ = '\0';
 406         prefix = strtonum(p, 0, 128, &errstr);
 407         if (errstr)
 408                 errx(1, "prefix is %s: %s", errstr, p);
 409
 410         bzero(&hints, sizeof(hints));
 411         /* prefix only with numeric addresses */
 412         hints.ai_flags |= AI_NUMERICHOST;
 413
 414         if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
 415                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 416                 /* NOTREACHED */
 417         }
 418
 419         if (res->ai_family == AF_INET && prefix > 32)
 420                 errx(1, "prefix too long for AF_INET");
 421         else if (res->ai_family == AF_INET6 && prefix > 128)
 422                 errx(1, "prefix too long for AF_INET6");
 423
 424         q = prefix >> 3;
 425         r = prefix & 7;
 426         switch (res->ai_family) {
 427         case AF_INET:
 428                 bzero(&mask->v4, sizeof(mask->v4));
 429                 mask->v4.s_addr = htonl((u_int32_t)
 430                     (0xffffffffffULL << (32 - prefix)));
 431                 break;
 432         case AF_INET6:
 433                 bzero(&mask->v6, sizeof(mask->v6));
 434                 if (q > 0)
 435                         memset((void *)&mask->v6, 0xff, q);
 436                 if (r > 0)
 437                         *((u_char *)&mask->v6 + q) =
 438                             (0xff00 >> r) & 0xff;
 439                 break;
 440         }
 441         freeaddrinfo(res);
 442 }
 443
 444 int
 445 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
 446 {
 447         struct pfioc_src_node_kill psnk;
 448         struct addrinfo *res[2], *resp[2];
 449         struct sockaddr last_src, last_dst;
 450         int killed, sources, dests;
 451         int ret_ga;
 452
 453         killed = sources = dests = 0;
 454
 455         memset(&psnk, 0, sizeof(psnk));
 456         memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
 457             sizeof(psnk.psnk_src.addr.v.a.mask));
 458         memset(&last_src, 0xff, sizeof(last_src));
 459         memset(&last_dst, 0xff, sizeof(last_dst));
 460
 461         pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
 462
 463         if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
 464                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 465                 /* NOTREACHED */
 466         }
 467         for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 468                 if (resp[0]->ai_addr == NULL)
 469                         continue;
 470                 /* We get lots of duplicates.  Catch the easy ones */
 471                 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 472                         continue;
 473                 last_src = *(struct sockaddr *)resp[0]->ai_addr;
 474
 475                 psnk.psnk_af = resp[0]->ai_family;
 476                 sources++;
 477
 478                 if (psnk.psnk_af == AF_INET)
 479                         psnk.psnk_src.addr.v.a.addr.v4 =
 480                             ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 481                 else if (psnk.psnk_af == AF_INET6)
 482                         psnk.psnk_src.addr.v.a.addr.v6 =
 483                             ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 484                             sin6_addr;
 485                 else
 486                         errx(1, "Unknown address family %d", psnk.psnk_af);
 487
 488                 if (src_node_killers > 1) {
 489                         dests = 0;
 490                         memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
 491                             sizeof(psnk.psnk_dst.addr.v.a.mask));
 492                         memset(&last_dst, 0xff, sizeof(last_dst));
 493                         pfctl_addrprefix(src_node_kill[1],
 494                             &psnk.psnk_dst.addr.v.a.mask);
 495                         if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
 496                             &res[1]))) {
 497                                 errx(1, "getaddrinfo: %s",
 498                                     gai_strerror(ret_ga));
 499                                 /* NOTREACHED */
 500                         }
 501                         for (resp[1] = res[1]; resp[1];
 502                             resp[1] = resp[1]->ai_next) {
 503                                 if (resp[1]->ai_addr == NULL)
 504                                         continue;
 505                                 if (psnk.psnk_af != resp[1]->ai_family)
 506                                         continue;
 507
 508                                 if (memcmp(&last_dst, resp[1]->ai_addr,
 509                                     sizeof(last_dst)) == 0)
 510                                         continue;
 511                                 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 512
 513                                 dests++;
 514
 515                                 if (psnk.psnk_af == AF_INET)
 516                                         psnk.psnk_dst.addr.v.a.addr.v4 =
 517                                             ((struct sockaddr_in *)resp[1]->
 518                                             ai_addr)->sin_addr;
 519                                 else if (psnk.psnk_af == AF_INET6)
 520                                         psnk.psnk_dst.addr.v.a.addr.v6 =
 521                                             ((struct sockaddr_in6 *)resp[1]->
 522                                             ai_addr)->sin6_addr;
 523                                 else
 524                                         errx(1, "Unknown address family %d",
 525                                             psnk.psnk_af);
 526
 527                                 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 528                                         err(1, "DIOCKILLSRCNODES");
 529                                 killed += psnk.psnk_killed;
 530                         }
 531                         freeaddrinfo(res[1]);
 532                 } else {
 533                         if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 534                                 err(1, "DIOCKILLSRCNODES");
 535                         killed += psnk.psnk_killed;
 536                 }
 537         }
 538
 539         freeaddrinfo(res[0]);
 540
 541         if ((opts & PF_OPT_QUIET) == 0)
 542                 fprintf(stderr, "killed %d src nodes from %d sources and %d "
 543                     "destinations\n", killed, sources, dests);
 544         return (0);
 545 }
 546
 547 int
 548 pfctl_net_kill_states(int dev, const char *iface, int opts)
 549 {
 550         struct pfioc_state_kill psk;
 551         struct addrinfo *res[2], *resp[2];
 552         struct sockaddr last_src, last_dst;
 553         int killed, sources, dests;
 554         int ret_ga;
 555
 556         killed = sources = dests = 0;
 557
 558         memset(&psk, 0, sizeof(psk));
 559         memset(&psk.psk_src.addr.v.a.mask, 0xff,
 560             sizeof(psk.psk_src.addr.v.a.mask));
 561         memset(&last_src, 0xff, sizeof(last_src));
 562         memset(&last_dst, 0xff, sizeof(last_dst));
 563         if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 564             sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 565                 errx(1, "invalid interface: %s", iface);
 566
 567         pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
 568
 569         if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
 570                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 571                 /* NOTREACHED */
 572         }
 573         for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 574                 if (resp[0]->ai_addr == NULL)
 575                         continue;
 576                 /* We get lots of duplicates.  Catch the easy ones */
 577                 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 578                         continue;
 579                 last_src = *(struct sockaddr *)resp[0]->ai_addr;
 580
 581                 psk.psk_af = resp[0]->ai_family;
 582                 sources++;
 583
 584                 if (psk.psk_af == AF_INET)
 585                         psk.psk_src.addr.v.a.addr.v4 =
 586                             ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 587                 else if (psk.psk_af == AF_INET6)
 588                         psk.psk_src.addr.v.a.addr.v6 =
 589                             ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 590                             sin6_addr;
 591                 else
 592                         errx(1, "Unknown address family %d", psk.psk_af);
 593
 594                 if (state_killers > 1) {
 595                         dests = 0;
 596                         memset(&psk.psk_dst.addr.v.a.mask, 0xff,
 597                             sizeof(psk.psk_dst.addr.v.a.mask));
 598                         memset(&last_dst, 0xff, sizeof(last_dst));
 599                         pfctl_addrprefix(state_kill[1],
 600                             &psk.psk_dst.addr.v.a.mask);
 601                         if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
 602                             &res[1]))) {
 603                                 errx(1, "getaddrinfo: %s",
 604                                     gai_strerror(ret_ga));
 605                                 /* NOTREACHED */
 606                         }
 607                         for (resp[1] = res[1]; resp[1];
 608                             resp[1] = resp[1]->ai_next) {
 609                                 if (resp[1]->ai_addr == NULL)
 610                                         continue;
 611                                 if (psk.psk_af != resp[1]->ai_family)
 612                                         continue;
 613
 614                                 if (memcmp(&last_dst, resp[1]->ai_addr,
 615                                     sizeof(last_dst)) == 0)
 616                                         continue;
 617                                 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 618
 619                                 dests++;
 620
 621                                 if (psk.psk_af == AF_INET)
 622                                         psk.psk_dst.addr.v.a.addr.v4 =
 623                                             ((struct sockaddr_in *)resp[1]->
 624                                             ai_addr)->sin_addr;
 625                                 else if (psk.psk_af == AF_INET6)
 626                                         psk.psk_dst.addr.v.a.addr.v6 =
 627                                             ((struct sockaddr_in6 *)resp[1]->
 628                                             ai_addr)->sin6_addr;
 629                                 else
 630                                         errx(1, "Unknown address family %d",
 631                                             psk.psk_af);
 632
 633                                 if (ioctl(dev, DIOCKILLSTATES, &psk))
 634                                         err(1, "DIOCKILLSTATES");
 635                                 killed += psk.psk_killed;
 636                         }
 637                         freeaddrinfo(res[1]);
 638                 } else {
 639                         if (ioctl(dev, DIOCKILLSTATES, &psk))
 640                                 err(1, "DIOCKILLSTATES");
 641                         killed += psk.psk_killed;
 642                 }
 643         }
 644
 645         freeaddrinfo(res[0]);
 646
 647         if ((opts & PF_OPT_QUIET) == 0)
 648                 fprintf(stderr, "killed %d states from %d sources and %d "
 649                     "destinations\n", killed, sources, dests);
 650         return (0);
 651 }
 652
 653 int
 654 pfctl_label_kill_states(int dev, const char *iface, int opts)
 655 {
 656         struct pfioc_state_kill psk;
 657
 658         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 659                 warnx("no label specified");
 660                 usage();
 661         }
 662         memset(&psk, 0, sizeof(psk));
 663         if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 664             sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 665                 errx(1, "invalid interface: %s", iface);
 666
 667         if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
 668             sizeof(psk.psk_label))
 669                 errx(1, "label too long: %s", state_kill[1]);
 670
 671         if (ioctl(dev, DIOCKILLSTATES, &psk))
 672                 err(1, "DIOCKILLSTATES");
 673
 674         if ((opts & PF_OPT_QUIET) == 0)
 675                 fprintf(stderr, "killed %d states\n", psk.psk_killed);
 676
 677         return (0);
 678 }
 679
 680 int
 681 pfctl_id_kill_states(int dev, const char *iface, int opts)
 682 {
 683         struct pfioc_state_kill psk;
 684
 685         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 686                 warnx("no id specified");
 687                 usage();
 688         }
 689
 690         memset(&psk, 0, sizeof(psk));
 691         if ((sscanf(state_kill[1], "%jx/%x",
 692             &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
 693                 HTONL(psk.psk_pfcmp.creatorid);
 694         else if ((sscanf(state_kill[1], "%jx", &psk.psk_pfcmp.id)) == 1) {
 695                 psk.psk_pfcmp.creatorid = 0;
 696         } else {
 697                 warnx("wrong id format specified");
 698                 usage();
 699         }
 700         if (psk.psk_pfcmp.id == 0) {
 701                 warnx("cannot kill id 0");
 702                 usage();
 703         }
 704
 705         psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
 706         if (ioctl(dev, DIOCKILLSTATES, &psk))
 707                 err(1, "DIOCKILLSTATES");
 708
 709         if ((opts & PF_OPT_QUIET) == 0)
 710                 fprintf(stderr, "killed %d states\n", psk.psk_killed);
 711
 712         return (0);
 713 }
 714
 715 int
 716 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
 717     u_int32_t ticket, int r_action, char *anchorname)
 718 {
 719         struct pfioc_pooladdr pp;
 720         struct pf_pooladdr *pa;
 721         u_int32_t pnr, mpnr;
 722
 723         memset(&pp, 0, sizeof(pp));
 724         memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
 725         pp.r_action = r_action;
 726         pp.r_num = nr;
 727         pp.ticket = ticket;
 728         if (ioctl(dev, DIOCGETADDRS, &pp)) {
 729                 warn("DIOCGETADDRS");
 730                 return (-1);
 731         }
 732         mpnr = pp.nr;
 733         TAILQ_INIT(&pool->list);
 734         for (pnr = 0; pnr < mpnr; ++pnr) {
 735                 pp.nr = pnr;
 736                 if (ioctl(dev, DIOCGETADDR, &pp)) {
 737                         warn("DIOCGETADDR");
 738                         return (-1);
 739                 }
 740                 pa = calloc(1, sizeof(struct pf_pooladdr));
 741                 if (pa == NULL)
 742                         err(1, "calloc");
 743                 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
 744                 TAILQ_INSERT_TAIL(&pool->list, pa, entries);
 745         }
 746
 747         return (0);
 748 }
 749
 750 void
 751 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
 752 {
 753         struct pf_pooladdr *pa;
 754
 755         while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
 756                 TAILQ_REMOVE(&src->list, pa, entries);
 757                 TAILQ_INSERT_TAIL(&dst->list, pa, entries);
 758         }
 759 }
 760
 761 void
 762 pfctl_clear_pool(struct pf_pool *pool)
 763 {
 764         struct pf_pooladdr *pa;
 765
 766         while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
 767                 TAILQ_REMOVE(&pool->list, pa, entries);
 768                 free(pa);
 769         }
 770 }
 771
 772 void
 773 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
 774 {
 775         if (opts & PF_OPT_DEBUG) {
 776                 const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
 777                     "p", "sa", "sp", "da", "dp" };
 778                 int i;
 779
 780                 printf("  [ Skip steps: ");
 781                 for (i = 0; i < PF_SKIP_COUNT; ++i) {
 782                         if (rule->skip[i].nr == rule->nr + 1)
 783                                 continue;
 784                         printf("%s=", t[i]);
 785                         if (rule->skip[i].nr == -1)
 786                                 printf("end ");
 787                         else
 788                                 printf("%u ", rule->skip[i].nr);
 789                 }
 790                 printf("]\n");
 791
 792                 printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
 793                     rule->qname, rule->qid, rule->pqname, rule->pqid);
 794         }
 795         if (opts & PF_OPT_VERBOSE) {
 796                 printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
 797                             "Bytes: %-10llu  States: %-6ju]\n",
 798                             (unsigned long long)rule->evaluations,
 799                             (unsigned long long)(rule->packets[0] +
 800                             rule->packets[1]),
 801                             (unsigned long long)(rule->bytes[0] +
 802                             rule->bytes[1]), (uintmax_t)rule->u_states_cur);
 803                 if (!(opts & PF_OPT_DEBUG))
 804                         printf("  [ Inserted: uid %u pid %u "
 805                             "State Creations: %-6ju]\n",
 806                             (unsigned)rule->cuid, (unsigned)rule->cpid,
 807                             (uintmax_t)rule->u_states_tot);
 808         }
 809 }
 810
 811 void
 812 pfctl_print_title(char *title)
 813 {
 814         if (!first_title)
 815                 printf("\n");
 816         first_title = 0;
 817         printf("%s\n", title);
 818 }
 819
 820 int
 821 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
 822     char *anchorname, int depth)
 823 {
 824         struct pfioc_rule pr;
 825         u_int32_t nr, mnr, header = 0;
 826         int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
 827         int numeric = opts & PF_OPT_NUMERIC;
 828         int len = strlen(path);
 829         int brace;
 830         char *p;
 831
 832         if (path[0])
 833                 snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
 834         else
 835                 snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
 836
 837         memset(&pr, 0, sizeof(pr));
 838         memcpy(pr.anchor, path, sizeof(pr.anchor));
 839         if (opts & PF_OPT_SHOWALL) {
 840                 pr.rule.action = PF_PASS;
 841                 if (ioctl(dev, DIOCGETRULES, &pr)) {
 842                         warn("DIOCGETRULES");
 843                         goto error;
 844                 }
 845                 header++;
 846         }
 847         pr.rule.action = PF_SCRUB;
 848         if (ioctl(dev, DIOCGETRULES, &pr)) {
 849                 warn("DIOCGETRULES");
 850                 goto error;
 851         }
 852         if (opts & PF_OPT_SHOWALL) {
 853                 if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
 854                         pfctl_print_title("FILTER RULES:");
 855                 else if (format == PFCTL_SHOW_LABELS && labels)
 856                         pfctl_print_title("LABEL COUNTERS:");
 857         }
 858         mnr = pr.nr;
 859         if (opts & PF_OPT_CLRRULECTRS)
 860                 pr.action = PF_GET_CLR_CNTR;
 861
 862         for (nr = 0; nr < mnr; ++nr) {
 863                 pr.nr = nr;
 864                 if (ioctl(dev, DIOCGETRULE, &pr)) {
 865                         warn("DIOCGETRULE");
 866                         goto error;
 867                 }
 868
 869                 if (pfctl_get_pool(dev, &pr.rule.rpool,
 870                     nr, pr.ticket, PF_SCRUB, path) != 0)
 871                         goto error;
 872
 873                 switch (format) {
 874                 case PFCTL_SHOW_LABELS:
 875                         break;
 876                 case PFCTL_SHOW_RULES:
 877                         if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 878                                 labels = 1;
 879                         print_rule(&pr.rule, pr.anchor_call, rule_numbers, numeric);
 880                         printf("\n");
 881                         pfctl_print_rule_counters(&pr.rule, opts);
 882                         break;
 883                 case PFCTL_SHOW_NOTHING:
 884                         break;
 885                 }
 886                 pfctl_clear_pool(&pr.rule.rpool);
 887         }
 888         pr.rule.action = PF_PASS;
 889         if (ioctl(dev, DIOCGETRULES, &pr)) {
 890                 warn("DIOCGETRULES");
 891                 goto error;
 892         }
 893         mnr = pr.nr;
 894         for (nr = 0; nr < mnr; ++nr) {
 895                 pr.nr = nr;
 896                 if (ioctl(dev, DIOCGETRULE, &pr)) {
 897                         warn("DIOCGETRULE");
 898                         goto error;
 899                 }
 900
 901                 if (pfctl_get_pool(dev, &pr.rule.rpool,
 902                     nr, pr.ticket, PF_PASS, path) != 0)
 903                         goto error;
 904
 905                 switch (format) {
 906                 case PFCTL_SHOW_LABELS:
 907                         if (pr.rule.label[0]) {
 908                                 printf("%s %llu %llu %llu %llu"
 909                                     " %llu %llu %llu %ju\n",
 910                                     pr.rule.label,
 911                                     (unsigned long long)pr.rule.evaluations,
 912                                     (unsigned long long)(pr.rule.packets[0] +
 913                                     pr.rule.packets[1]),
 914                                     (unsigned long long)(pr.rule.bytes[0] +
 915                                     pr.rule.bytes[1]),
 916                                     (unsigned long long)pr.rule.packets[0],
 917                                     (unsigned long long)pr.rule.bytes[0],
 918                                     (unsigned long long)pr.rule.packets[1],
 919                                     (unsigned long long)pr.rule.bytes[1],
 920                                     (uintmax_t)pr.rule.u_states_tot);
 921                         }
 922                         break;
 923                 case PFCTL_SHOW_RULES:
 924                         brace = 0;
 925                         if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 926                                 labels = 1;
 927                         INDENT(depth, !(opts & PF_OPT_VERBOSE));
 928                         if (pr.anchor_call[0] &&
 929                            ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
 930                            ((void *)p == (void *)pr.anchor_call ||
 931                            *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
 932                                 brace++;
 933                                 if ((p = strrchr(pr.anchor_call, '/')) !=
 934                                     NULL)
 935                                         p++;
 936                                 else
 937                                         p = &pr.anchor_call[0];
 938                         } else
 939                                 p = &pr.anchor_call[0];
 940
 941                         print_rule(&pr.rule, p, rule_numbers, numeric);
 942                         if (brace)
 943                                 printf(" {\n");
 944                         else
 945                                 printf("\n");
 946                         pfctl_print_rule_counters(&pr.rule, opts);
 947                         if (brace) {
 948                                 pfctl_show_rules(dev, path, opts, format,
 949                                     p, depth + 1);
 950                                 INDENT(depth, !(opts & PF_OPT_VERBOSE));
 951                                 printf("}\n");
 952                         }
 953                         break;
 954                 case PFCTL_SHOW_NOTHING:
 955                         break;
 956                 }
 957                 pfctl_clear_pool(&pr.rule.rpool);
 958         }
 959         path[len] = '\0';
 960         return (0);
 961
 962  error:
 963         path[len] = '\0';
 964         return (-1);
 965 }
 966
 967 int
 968 pfctl_show_nat(int dev, int opts, char *anchorname)
 969 {
 970         struct pfioc_rule pr;
 971         u_int32_t mnr, nr;
 972         static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
 973         int i, dotitle = opts & PF_OPT_SHOWALL;
 974
 975         memset(&pr, 0, sizeof(pr));
 976         memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
 977         for (i = 0; i < 3; i++) {
 978                 pr.rule.action = nattype[i];
 979                 if (ioctl(dev, DIOCGETRULES, &pr)) {
 980                         warn("DIOCGETRULES");
 981                         return (-1);
 982                 }
 983                 mnr = pr.nr;
 984                 for (nr = 0; nr < mnr; ++nr) {
 985                         pr.nr = nr;
 986                         if (ioctl(dev, DIOCGETRULE, &pr)) {
 987                                 warn("DIOCGETRULE");
 988                                 return (-1);
 989                         }
 990                         if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
 991                             pr.ticket, nattype[i], anchorname) != 0)
 992                                 return (-1);
 993                         if (dotitle) {
 994                                 pfctl_print_title("TRANSLATION RULES:");
 995                                 dotitle = 0;
 996                         }
 997                         print_rule(&pr.rule, pr.anchor_call,
 998                             opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
 999                         printf("\n");
1000                         pfctl_print_rule_counters(&pr.rule, opts);
1001                         pfctl_clear_pool(&pr.rule.rpool);
1002                 }
1003         }
1004         return (0);
1005 }
1006
1007 int
1008 pfctl_show_src_nodes(int dev, int opts)
1009 {
1010         struct pfioc_src_nodes psn;
1011         struct pf_src_node *p;
1012         char *inbuf = NULL, *newinbuf = NULL;
1013         unsigned int len = 0;
1014         int i;
1015
1016         memset(&psn, 0, sizeof(psn));
1017         for (;;) {
1018                 psn.psn_len = len;
1019                 if (len) {
1020                         newinbuf = realloc(inbuf, len);
1021                         if (newinbuf == NULL)
1022                                 err(1, "realloc");
1023                         psn.psn_buf = inbuf = newinbuf;
1024                 }
1025                 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1026                         warn("DIOCGETSRCNODES");
1027                         free(inbuf);
1028                         return (-1);
1029                 }
1030                 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1031                         break;
1032                 if (len == 0 && psn.psn_len == 0)
1033                         goto done;
1034                 if (len == 0 && psn.psn_len != 0)
1035                         len = psn.psn_len;
1036                 if (psn.psn_len == 0)
1037                         goto done;      /* no src_nodes */
1038                 len *= 2;
1039         }
1040         p = psn.psn_src_nodes;
1041         if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1042                 pfctl_print_title("SOURCE TRACKING NODES:");
1043         for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1044                 print_src_node(p, opts);
1045                 p++;
1046         }
1047 done:
1048         free(inbuf);
1049         return (0);
1050 }
1051
1052 int
1053 pfctl_show_states(int dev, const char *iface, int opts)
1054 {
1055         struct pfioc_states ps;
1056         struct pfsync_state *p;
1057         char *inbuf = NULL, *newinbuf = NULL;
1058         unsigned int len = 0;
1059         int i, dotitle = (opts & PF_OPT_SHOWALL);
1060
1061         memset(&ps, 0, sizeof(ps));
1062         for (;;) {
1063                 ps.ps_len = len;
1064                 if (len) {
1065                         newinbuf = realloc(inbuf, len);
1066                         if (newinbuf == NULL)
1067                                 err(1, "realloc");
1068                         ps.ps_buf = inbuf = newinbuf;
1069                 }
1070                 if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1071                         warn("DIOCGETSTATES");
1072                         free(inbuf);
1073                         return (-1);
1074                 }
1075                 if (ps.ps_len + sizeof(struct pfioc_states) < len)
1076                         break;
1077                 if (len == 0 && ps.ps_len == 0)
1078                         goto done;
1079                 if (len == 0 && ps.ps_len != 0)
1080                         len = ps.ps_len;
1081                 if (ps.ps_len == 0)
1082                         goto done;      /* no states */
1083                 len *= 2;
1084         }
1085         p = ps.ps_states;
1086         for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1087                 if (iface != NULL && strcmp(p->ifname, iface))
1088                         continue;
1089                 if (dotitle) {
1090                         pfctl_print_title("STATES:");
1091                         dotitle = 0;
1092                 }
1093                 print_state(p, opts);
1094         }
1095 done:
1096         free(inbuf);
1097         return (0);
1098 }
1099
1100 int
1101 pfctl_show_status(int dev, int opts)
1102 {
1103         struct pf_status status;
1104
1105         if (ioctl(dev, DIOCGETSTATUS, &status)) {
1106                 warn("DIOCGETSTATUS");
1107                 return (-1);
1108         }
1109         if (opts & PF_OPT_SHOWALL)
1110                 pfctl_print_title("INFO:");
1111         print_status(&status, opts);
1112         return (0);
1113 }
1114
1115 int
1116 pfctl_show_timeouts(int dev, int opts)
1117 {
1118         struct pfioc_tm pt;
1119         int i;
1120
1121         if (opts & PF_OPT_SHOWALL)
1122                 pfctl_print_title("TIMEOUTS:");
1123         memset(&pt, 0, sizeof(pt));
1124         for (i = 0; pf_timeouts[i].name; i++) {
1125                 pt.timeout = pf_timeouts[i].timeout;
1126                 if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1127                         err(1, "DIOCGETTIMEOUT");
1128                 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1129                 if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1130                     pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1131                         printf(" states");
1132                 else
1133                         printf("s");
1134                 printf("\n");
1135         }
1136         return (0);
1137
1138 }
1139
1140 int
1141 pfctl_show_limits(int dev, int opts)
1142 {
1143         struct pfioc_limit pl;
1144         int i;
1145
1146         if (opts & PF_OPT_SHOWALL)
1147                 pfctl_print_title("LIMITS:");
1148         memset(&pl, 0, sizeof(pl));
1149         for (i = 0; pf_limits[i].name; i++) {
1150                 pl.index = pf_limits[i].index;
1151                 if (ioctl(dev, DIOCGETLIMIT, &pl))
1152                         err(1, "DIOCGETLIMIT");
1153                 printf("%-13s ", pf_limits[i].name);
1154                 if (pl.limit == UINT_MAX)
1155                         printf("unlimited\n");
1156                 else
1157                         printf("hard limit %8u\n", pl.limit);
1158         }
1159         return (0);
1160 }
1161
1162 /* callbacks for rule/nat/rdr/addr */
1163 int
1164 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1165 {
1166         struct pf_pooladdr *pa;
1167
1168         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1169                 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1170                         err(1, "DIOCBEGINADDRS");
1171         }
1172
1173         pf->paddr.af = af;
1174         TAILQ_FOREACH(pa, &p->list, entries) {
1175                 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1176                 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1177                         if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1178                                 err(1, "DIOCADDADDR");
1179                 }
1180         }
1181         return (0);
1182 }
1183
1184 int
1185 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1186 {
1187         u_int8_t                rs_num;
1188         struct pf_rule          *rule;
1189         struct pf_ruleset       *rs;
1190         char                    *p;
1191
1192         rs_num = pf_get_ruleset_number(r->action);
1193         if (rs_num == PF_RULESET_MAX)
1194                 errx(1, "Invalid rule type %d", r->action);
1195
1196         rs = &pf->anchor->ruleset;
1197
1198         if (anchor_call[0] && r->anchor == NULL) {
1199                 /*
1200                  * Don't make non-brace anchors part of the main anchor pool.
1201                  */
1202                 if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1203                         err(1, "pfctl_add_rule: calloc");
1204
1205                 pf_init_ruleset(&r->anchor->ruleset);
1206                 r->anchor->ruleset.anchor = r->anchor;
1207                 if (strlcpy(r->anchor->path, anchor_call,
1208                     sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1209                         errx(1, "pfctl_add_rule: strlcpy");
1210                 if ((p = strrchr(anchor_call, '/')) != NULL) {
1211                         if (!strlen(p))
1212                                 err(1, "pfctl_add_rule: bad anchor name %s",
1213                                     anchor_call);
1214                 } else
1215                         p = (char *)anchor_call;
1216                 if (strlcpy(r->anchor->name, p,
1217                     sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1218                         errx(1, "pfctl_add_rule: strlcpy");
1219         }
1220
1221         if ((rule = calloc(1, sizeof(*rule))) == NULL)
1222                 err(1, "calloc");
1223         bcopy(r, rule, sizeof(*rule));
1224         TAILQ_INIT(&rule->rpool.list);
1225         pfctl_move_pool(&r->rpool, &rule->rpool);
1226
1227         TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1228         return (0);
1229 }
1230
1231 int
1232 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1233 {
1234         int osize = pf->trans->pfrb_size;
1235
1236         if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1237                 if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1238                     pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1239                     pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1240                         return (1);
1241         }
1242         if (a == pf->astack[0] && ((altqsupport &&
1243             (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1244                 if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1245                         return (2);
1246         }
1247         if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1248                 if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1249                     pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1250                         return (3);
1251         }
1252         if (pf->loadopt & PFCTL_FLAG_TABLE)
1253                 if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1254                         return (4);
1255         if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1256                 return (5);
1257
1258         return (0);
1259 }
1260
1261 int
1262 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1263     int rs_num, int depth)
1264 {
1265         struct pf_rule *r;
1266         int             error, len = strlen(path);
1267         int             brace = 0;
1268
1269         pf->anchor = rs->anchor;
1270
1271         if (path[0])
1272                 snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1273         else
1274                 snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1275
1276         if (depth) {
1277                 if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1278                         brace++;
1279                         if (pf->opts & PF_OPT_VERBOSE)
1280                                 printf(" {\n");
1281                         if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1282                             (error = pfctl_ruleset_trans(pf,
1283                             path, rs->anchor))) {
1284                                 printf("pfctl_load_rulesets: "
1285                                     "pfctl_ruleset_trans %d\n", error);
1286                                 goto error;
1287                         }
1288                 } else if (pf->opts & PF_OPT_VERBOSE)
1289                         printf("\n");
1290
1291         }
1292
1293         if (pf->optimize && rs_num == PF_RULESET_FILTER)
1294                 pfctl_optimize_ruleset(pf, rs);
1295
1296         while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1297                 TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1298                 if ((error = pfctl_load_rule(pf, path, r, depth)))
1299                         goto error;
1300                 if (r->anchor) {
1301                         if ((error = pfctl_load_ruleset(pf, path,
1302                             &r->anchor->ruleset, rs_num, depth + 1)))
1303                                 goto error;
1304                 } else if (pf->opts & PF_OPT_VERBOSE)
1305                         printf("\n");
1306                 free(r);
1307         }
1308         if (brace && pf->opts & PF_OPT_VERBOSE) {
1309                 INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1310                 printf("}\n");
1311         }
1312         path[len] = '\0';
1313         return (0);
1314
1315  error:
1316         path[len] = '\0';
1317         return (error);
1318
1319 }
1320
1321 int
1322 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1323 {
1324         u_int8_t                rs_num = pf_get_ruleset_number(r->action);
1325         char                    *name;
1326         struct pfioc_rule       pr;
1327         int                     len = strlen(path);
1328
1329         bzero(&pr, sizeof(pr));
1330         /* set up anchor before adding to path for anchor_call */
1331         if ((pf->opts & PF_OPT_NOACTION) == 0)
1332                 pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1333         if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1334                 errx(1, "pfctl_load_rule: strlcpy");
1335
1336         if (r->anchor) {
1337                 if (r->anchor->match) {
1338                         if (path[0])
1339                                 snprintf(&path[len], MAXPATHLEN - len,
1340                                     "/%s", r->anchor->name);
1341                         else
1342                                 snprintf(&path[len], MAXPATHLEN - len,
1343                                     "%s", r->anchor->name);
1344                         name = r->anchor->name;
1345                 } else
1346                         name = r->anchor->path;
1347         } else
1348                 name = "";
1349
1350         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1351                 if (pfctl_add_pool(pf, &r->rpool, r->af))
1352                         return (1);
1353                 pr.pool_ticket = pf->paddr.ticket;
1354                 memcpy(&pr.rule, r, sizeof(pr.rule));
1355                 if (r->anchor && strlcpy(pr.anchor_call, name,
1356                     sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1357                         errx(1, "pfctl_load_rule: strlcpy");
1358                 if (ioctl(pf->dev, DIOCADDRULE, &pr))
1359                         err(1, "DIOCADDRULE");
1360         }
1361
1362         if (pf->opts & PF_OPT_VERBOSE) {
1363                 INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1364                 print_rule(r, r->anchor ? r->anchor->name : "",
1365                     pf->opts & PF_OPT_VERBOSE2,
1366                     pf->opts & PF_OPT_NUMERIC);
1367         }
1368         path[len] = '\0';
1369         pfctl_clear_pool(&r->rpool);
1370         return (0);
1371 }
1372
1373 int
1374 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1375 {
1376         if (altqsupport &&
1377             (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1378                 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1379                 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1380                         if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1381                                 if (errno == ENXIO)
1382                                         errx(1, "qtype not configured");
1383                                 else if (errno == ENODEV)
1384                                         errx(1, "%s: driver does not support "
1385                                             "altq", a->ifname);
1386                                 else
1387                                         err(1, "DIOCADDALTQ");
1388                         }
1389                 }
1390                 pfaltq_store(&pf->paltq->altq);
1391         }
1392         return (0);
1393 }
1394
1395 int
1396 pfctl_rules(int dev, char *filename, int opts, int optimize,
1397     char *anchorname, struct pfr_buffer *trans)
1398 {
1399 #define ERR(x) do { warn(x); goto _error; } while(0)
1400 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1401
1402         struct pfr_buffer       *t, buf;
1403         struct pfioc_altq        pa;
1404         struct pfctl             pf;
1405         struct pf_ruleset       *rs;
1406         struct pfr_table         trs;
1407         char                    *path;
1408         int                      osize;
1409
1410         RB_INIT(&pf_anchors);
1411         memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1412         pf_init_ruleset(&pf_main_anchor.ruleset);
1413         pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1414         if (trans == NULL) {
1415                 bzero(&buf, sizeof(buf));
1416                 buf.pfrb_type = PFRB_TRANS;
1417                 t = &buf;
1418                 osize = 0;
1419         } else {
1420                 t = trans;
1421                 osize = t->pfrb_size;
1422         }
1423
1424         memset(&pa, 0, sizeof(pa));
1425         memset(&pf, 0, sizeof(pf));
1426         memset(&trs, 0, sizeof(trs));
1427         if ((path = calloc(1, MAXPATHLEN)) == NULL)
1428                 ERRX("pfctl_rules: calloc");
1429         if (strlcpy(trs.pfrt_anchor, anchorname,
1430             sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1431                 ERRX("pfctl_rules: strlcpy");
1432         pf.dev = dev;
1433         pf.opts = opts;
1434         pf.optimize = optimize;
1435         pf.loadopt = loadopt;
1436
1437         /* non-brace anchor, create without resolving the path */
1438         if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1439                 ERRX("pfctl_rules: calloc");
1440         rs = &pf.anchor->ruleset;
1441         pf_init_ruleset(rs);
1442         rs->anchor = pf.anchor;
1443         if (strlcpy(pf.anchor->path, anchorname,
1444             sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1445                 errx(1, "pfctl_add_rule: strlcpy");
1446         if (strlcpy(pf.anchor->name, anchorname,
1447             sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1448                 errx(1, "pfctl_add_rule: strlcpy");
1449
1450
1451         pf.astack[0] = pf.anchor;
1452         pf.asd = 0;
1453         if (anchorname[0])
1454                 pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1455         pf.paltq = &pa;
1456         pf.trans = t;
1457         pfctl_init_options(&pf);
1458
1459         if ((opts & PF_OPT_NOACTION) == 0) {
1460                 /*
1461                  * XXX For the time being we need to open transactions for
1462                  * the main ruleset before parsing, because tables are still
1463                  * loaded at parse time.
1464                  */
1465                 if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1466                         ERRX("pfctl_rules");
1467                 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1468                         pa.ticket =
1469                             pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1470                 if (pf.loadopt & PFCTL_FLAG_TABLE)
1471                         pf.astack[0]->ruleset.tticket =
1472                             pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1473         }
1474
1475         if (parse_config(filename, &pf) < 0) {
1476                 if ((opts & PF_OPT_NOACTION) == 0)
1477                         ERRX("Syntax error in config file: "
1478                             "pf rules not loaded");
1479                 else
1480                         goto _error;
1481         }
1482
1483         if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1484             (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1485             (pf.loadopt & PFCTL_FLAG_NAT &&
1486             (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1487             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1488             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1489             (pf.loadopt & PFCTL_FLAG_FILTER &&
1490             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1491                 if ((opts & PF_OPT_NOACTION) == 0)
1492                         ERRX("Unable to load rules into kernel");
1493                 else
1494                         goto _error;
1495         }
1496
1497         if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1498                 if (check_commit_altq(dev, opts) != 0)
1499                         ERRX("errors in altq config");
1500
1501         /* process "load anchor" directives */
1502         if (!anchorname[0])
1503                 if (pfctl_load_anchors(dev, &pf, t) == -1)
1504                         ERRX("load anchors");
1505
1506         if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1507                 if (!anchorname[0])
1508                         if (pfctl_load_options(&pf))
1509                                 goto _error;
1510                 if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1511                         ERR("DIOCXCOMMIT");
1512         }
1513         return (0);
1514
1515 _error:
1516         if (trans == NULL) {    /* main ruleset */
1517                 if ((opts & PF_OPT_NOACTION) == 0)
1518                         if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1519                                 err(1, "DIOCXROLLBACK");
1520                 exit(1);
1521         } else {                /* sub ruleset */
1522                 return (-1);
1523         }
1524
1525 #undef ERR
1526 #undef ERRX
1527 }
1528
1529 FILE *
1530 pfctl_fopen(const char *name, const char *mode)
1531 {
1532         struct stat      st;
1533         FILE            *fp;
1534
1535         fp = fopen(name, mode);
1536         if (fp == NULL)
1537                 return (NULL);
1538         if (fstat(fileno(fp), &st)) {
1539                 fclose(fp);
1540                 return (NULL);
1541         }
1542         if (S_ISDIR(st.st_mode)) {
1543                 fclose(fp);
1544                 errno = EISDIR;
1545                 return (NULL);
1546         }
1547         return (fp);
1548 }
1549
1550 void
1551 pfctl_init_options(struct pfctl *pf)
1552 {
1553
1554         pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1555         pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1556         pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1557         pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1558         pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1559         pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1560         pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1561         pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1562         pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1563         pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1564         pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1565         pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1566         pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1567         pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1568         pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1569         pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1570         pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1571         pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1572         pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1573         pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1574
1575         pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1576         pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1577         pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1578         pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1579
1580         pf->debug = PF_DEBUG_URGENT;
1581 }
1582
1583 int
1584 pfctl_load_options(struct pfctl *pf)
1585 {
1586         int i, error = 0;
1587
1588         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1589                 return (0);
1590
1591         /* load limits */
1592         for (i = 0; i < PF_LIMIT_MAX; i++) {
1593                 if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1594                         continue;
1595                 if (pfctl_load_limit(pf, i, pf->limit[i]))
1596                         error = 1;
1597         }
1598
1599         /*
1600          * If we've set the limit, but haven't explicitly set adaptive
1601          * timeouts, do it now with a start of 60% and end of 120%.
1602          */
1603         if (pf->limit_set[PF_LIMIT_STATES] &&
1604             !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1605             !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1606                 pf->timeout[PFTM_ADAPTIVE_START] =
1607                         (pf->limit[PF_LIMIT_STATES] / 10) * 6;
1608                 pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1609                 pf->timeout[PFTM_ADAPTIVE_END] =
1610                         (pf->limit[PF_LIMIT_STATES] / 10) * 12;
1611                 pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1612         }
1613
1614         /* load timeouts */
1615         for (i = 0; i < PFTM_MAX; i++) {
1616                 if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1617                         continue;
1618                 if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1619                         error = 1;
1620         }
1621
1622         /* load debug */
1623         if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1624                 if (pfctl_load_debug(pf, pf->debug))
1625                         error = 1;
1626
1627         /* load logif */
1628         if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1629                 if (pfctl_load_logif(pf, pf->ifname))
1630                         error = 1;
1631
1632         /* load hostid */
1633         if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1634                 if (pfctl_load_hostid(pf, pf->hostid))
1635                         error = 1;
1636
1637         return (error);
1638 }
1639
1640 int
1641 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1642 {
1643         int i;
1644
1645
1646         for (i = 0; pf_limits[i].name; i++) {
1647                 if (strcasecmp(opt, pf_limits[i].name) == 0) {
1648                         pf->limit[pf_limits[i].index] = limit;
1649                         pf->limit_set[pf_limits[i].index] = 1;
1650                         break;
1651                 }
1652         }
1653         if (pf_limits[i].name == NULL) {
1654                 warnx("Bad pool name.");
1655                 return (1);
1656         }
1657
1658         if (pf->opts & PF_OPT_VERBOSE)
1659                 printf("set limit %s %d\n", opt, limit);
1660
1661         return (0);
1662 }
1663
1664 int
1665 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1666 {
1667         struct pfioc_limit pl;
1668
1669         memset(&pl, 0, sizeof(pl));
1670         pl.index = index;
1671         pl.limit = limit;
1672         if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1673                 if (errno == EBUSY)
1674                         warnx("Current pool size exceeds requested hard limit");
1675                 else
1676                         warnx("DIOCSETLIMIT");
1677                 return (1);
1678         }
1679         return (0);
1680 }
1681
1682 int
1683 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1684 {
1685         int i;
1686
1687         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1688                 return (0);
1689
1690         for (i = 0; pf_timeouts[i].name; i++) {
1691                 if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1692                         pf->timeout[pf_timeouts[i].timeout] = seconds;
1693                         pf->timeout_set[pf_timeouts[i].timeout] = 1;
1694                         break;
1695                 }
1696         }
1697
1698         if (pf_timeouts[i].name == NULL) {
1699                 warnx("Bad timeout name.");
1700                 return (1);
1701         }
1702
1703
1704         if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1705                 printf("set timeout %s %d\n", opt, seconds);
1706
1707         return (0);
1708 }
1709
1710 int
1711 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1712 {
1713         struct pfioc_tm pt;
1714
1715         memset(&pt, 0, sizeof(pt));
1716         pt.timeout = timeout;
1717         pt.seconds = seconds;
1718         if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1719                 warnx("DIOCSETTIMEOUT");
1720                 return (1);
1721         }
1722         return (0);
1723 }
1724
1725 int
1726 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1727 {
1728         const struct pf_hint *hint;
1729         int i, r;
1730
1731         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1732                 return (0);
1733
1734         for (i = 0; pf_hints[i].name; i++)
1735                 if (strcasecmp(opt, pf_hints[i].name) == 0)
1736                         break;
1737
1738         hint = pf_hints[i].hint;
1739         if (hint == NULL) {
1740                 warnx("invalid state timeouts optimization");
1741                 return (1);
1742         }
1743
1744         for (i = 0; hint[i].name; i++)
1745                 if ((r = pfctl_set_timeout(pf, hint[i].name,
1746                     hint[i].timeout, 1)))
1747                         return (r);
1748
1749         if (pf->opts & PF_OPT_VERBOSE)
1750                 printf("set optimization %s\n", opt);
1751
1752         return (0);
1753 }
1754
1755 int
1756 pfctl_set_logif(struct pfctl *pf, char *ifname)
1757 {
1758
1759         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1760                 return (0);
1761
1762         if (!strcmp(ifname, "none")) {
1763                 free(pf->ifname);
1764                 pf->ifname = NULL;
1765         } else {
1766                 pf->ifname = strdup(ifname);
1767                 if (!pf->ifname)
1768                         errx(1, "pfctl_set_logif: strdup");
1769         }
1770         pf->ifname_set = 1;
1771
1772         if (pf->opts & PF_OPT_VERBOSE)
1773                 printf("set loginterface %s\n", ifname);
1774
1775         return (0);
1776 }
1777
1778 int
1779 pfctl_load_logif(struct pfctl *pf, char *ifname)
1780 {
1781         struct pfioc_if pi;
1782
1783         memset(&pi, 0, sizeof(pi));
1784         if (ifname && strlcpy(pi.ifname, ifname,
1785             sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1786                 warnx("pfctl_load_logif: strlcpy");
1787                 return (1);
1788         }
1789         if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1790                 warnx("DIOCSETSTATUSIF");
1791                 return (1);
1792         }
1793         return (0);
1794 }
1795
1796 int
1797 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1798 {
1799         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1800                 return (0);
1801
1802         HTONL(hostid);
1803
1804         pf->hostid = hostid;
1805         pf->hostid_set = 1;
1806
1807         if (pf->opts & PF_OPT_VERBOSE)
1808                 printf("set hostid 0x%08x\n", ntohl(hostid));
1809
1810         return (0);
1811 }
1812
1813 int
1814 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
1815 {
1816         if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
1817                 warnx("DIOCSETHOSTID");
1818                 return (1);
1819         }
1820         return (0);
1821 }
1822
1823 int
1824 pfctl_set_debug(struct pfctl *pf, char *d)
1825 {
1826         u_int32_t       level;
1827
1828         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1829                 return (0);
1830
1831         if (!strcmp(d, "none"))
1832                 pf->debug = PF_DEBUG_NONE;
1833         else if (!strcmp(d, "urgent"))
1834                 pf->debug = PF_DEBUG_URGENT;
1835         else if (!strcmp(d, "misc"))
1836                 pf->debug = PF_DEBUG_MISC;
1837         else if (!strcmp(d, "loud"))
1838                 pf->debug = PF_DEBUG_NOISY;
1839         else {
1840                 warnx("unknown debug level \"%s\"", d);
1841                 return (-1);
1842         }
1843
1844         pf->debug_set = 1;
1845         level = pf->debug;
1846
1847         if ((pf->opts & PF_OPT_NOACTION) == 0)
1848                 if (ioctl(dev, DIOCSETDEBUG, &level))
1849                         err(1, "DIOCSETDEBUG");
1850
1851         if (pf->opts & PF_OPT_VERBOSE)
1852                 printf("set debug %s\n", d);
1853
1854         return (0);
1855 }
1856
1857 int
1858 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1859 {
1860         if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1861                 warnx("DIOCSETDEBUG");
1862                 return (1);
1863         }
1864         return (0);
1865 }
1866
1867 int
1868 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1869 {
1870         struct pfioc_iface      pi;
1871
1872         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1873                 return (0);
1874
1875         bzero(&pi, sizeof(pi));
1876
1877         pi.pfiio_flags = flags;
1878
1879         if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1880             sizeof(pi.pfiio_name))
1881                 errx(1, "pfctl_set_interface_flags: strlcpy");
1882
1883         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1884                 if (how == 0) {
1885                         if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1886                                 err(1, "DIOCCLRIFFLAG");
1887                 } else {
1888                         if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1889                                 err(1, "DIOCSETIFFLAG");
1890                 }
1891         }
1892         return (0);
1893 }
1894
1895 void
1896 pfctl_debug(int dev, u_int32_t level, int opts)
1897 {
1898         if (ioctl(dev, DIOCSETDEBUG, &level))
1899                 err(1, "DIOCSETDEBUG");
1900         if ((opts & PF_OPT_QUIET) == 0) {
1901                 fprintf(stderr, "debug level set to '");
1902                 switch (level) {
1903                 case PF_DEBUG_NONE:
1904                         fprintf(stderr, "none");
1905                         break;
1906                 case PF_DEBUG_URGENT:
1907                         fprintf(stderr, "urgent");
1908                         break;
1909                 case PF_DEBUG_MISC:
1910                         fprintf(stderr, "misc");
1911                         break;
1912                 case PF_DEBUG_NOISY:
1913                         fprintf(stderr, "loud");
1914                         break;
1915                 default:
1916                         fprintf(stderr, "<invalid>");
1917                         break;
1918                 }
1919                 fprintf(stderr, "'\n");
1920         }
1921 }
1922
1923 int
1924 pfctl_test_altqsupport(int dev, int opts)
1925 {
1926         struct pfioc_altq pa;
1927
1928         if (ioctl(dev, DIOCGETALTQS, &pa)) {
1929                 if (errno == ENODEV) {
1930                         if (opts & PF_OPT_VERBOSE)
1931                                 fprintf(stderr, "No ALTQ support in kernel\n"
1932                                     "ALTQ related functions disabled\n");
1933                         return (0);
1934                 } else
1935                         err(1, "DIOCGETALTQS");
1936         }
1937         return (1);
1938 }
1939
1940 int
1941 pfctl_show_anchors(int dev, int opts, char *anchorname)
1942 {
1943         struct pfioc_ruleset     pr;
1944         u_int32_t                mnr, nr;
1945
1946         memset(&pr, 0, sizeof(pr));
1947         memcpy(pr.path, anchorname, sizeof(pr.path));
1948         if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1949                 if (errno == EINVAL)
1950                         fprintf(stderr, "Anchor '%s' not found.\n",
1951                             anchorname);
1952                 else
1953                         err(1, "DIOCGETRULESETS");
1954                 return (-1);
1955         }
1956         mnr = pr.nr;
1957         for (nr = 0; nr < mnr; ++nr) {
1958                 char sub[MAXPATHLEN];
1959
1960                 pr.nr = nr;
1961                 if (ioctl(dev, DIOCGETRULESET, &pr))
1962                         err(1, "DIOCGETRULESET");
1963                 if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1964                         continue;
1965                 sub[0] = 0;
1966                 if (pr.path[0]) {
1967                         strlcat(sub, pr.path, sizeof(sub));
1968                         strlcat(sub, "/", sizeof(sub));
1969                 }
1970                 strlcat(sub, pr.name, sizeof(sub));
1971                 if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1972                         printf("  %s\n", sub);
1973                 if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1974                         return (-1);
1975         }
1976         return (0);
1977 }
1978
1979 const char *
1980 pfctl_lookup_option(char *cmd, const char * const *list)
1981 {
1982         if (cmd != NULL && *cmd)
1983                 for (; *list; list++)
1984                         if (!strncmp(cmd, *list, strlen(cmd)))
1985                                 return (*list);
1986         return (NULL);
1987 }
1988
1989 int
1990 main(int argc, char *argv[])
1991 {
1992         int      error = 0;
1993         int      ch;
1994         int      mode = O_RDONLY;
1995         int      opts = 0;
1996         int      optimize = PF_OPTIMIZE_BASIC;
1997         char     anchorname[MAXPATHLEN];
1998         char    *path;
1999
2000         if (argc < 2)
2001                 usage();
2002
2003         while ((ch = getopt(argc, argv,
2004             "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2005                 switch (ch) {
2006                 case 'a':
2007                         anchoropt = optarg;
2008                         break;
2009                 case 'd':
2010                         opts |= PF_OPT_DISABLE;
2011                         mode = O_RDWR;
2012                         break;
2013                 case 'D':
2014                         if (pfctl_cmdline_symset(optarg) < 0)
2015                                 warnx("could not parse macro definition %s",
2016                                     optarg);
2017                         break;
2018                 case 'e':
2019                         opts |= PF_OPT_ENABLE;
2020                         mode = O_RDWR;
2021                         break;
2022                 case 'q':
2023                         opts |= PF_OPT_QUIET;
2024                         break;
2025                 case 'F':
2026                         clearopt = pfctl_lookup_option(optarg, clearopt_list);
2027                         if (clearopt == NULL) {
2028                                 warnx("Unknown flush modifier '%s'", optarg);
2029                                 usage();
2030                         }
2031                         mode = O_RDWR;
2032                         break;
2033                 case 'i':
2034                         ifaceopt = optarg;
2035                         break;
2036                 case 'k':
2037                         if (state_killers >= 2) {
2038                                 warnx("can only specify -k twice");
2039                                 usage();
2040                                 /* NOTREACHED */
2041                         }
2042                         state_kill[state_killers++] = optarg;
2043                         mode = O_RDWR;
2044                         break;
2045                 case 'K':
2046                         if (src_node_killers >= 2) {
2047                                 warnx("can only specify -K twice");
2048                                 usage();
2049                                 /* NOTREACHED */
2050                         }
2051                         src_node_kill[src_node_killers++] = optarg;
2052                         mode = O_RDWR;
2053                         break;
2054                 case 'm':
2055                         opts |= PF_OPT_MERGE;
2056                         break;
2057                 case 'n':
2058                         opts |= PF_OPT_NOACTION;
2059                         break;
2060                 case 'N':
2061                         loadopt |= PFCTL_FLAG_NAT;
2062                         break;
2063                 case 'r':
2064                         opts |= PF_OPT_USEDNS;
2065                         break;
2066                 case 'f':
2067                         rulesopt = optarg;
2068                         mode = O_RDWR;
2069                         break;
2070                 case 'g':
2071                         opts |= PF_OPT_DEBUG;
2072                         break;
2073                 case 'A':
2074                         loadopt |= PFCTL_FLAG_ALTQ;
2075                         break;
2076                 case 'R':
2077                         loadopt |= PFCTL_FLAG_FILTER;
2078                         break;
2079                 case 'o':
2080                         optiopt = pfctl_lookup_option(optarg, optiopt_list);
2081                         if (optiopt == NULL) {
2082                                 warnx("Unknown optimization '%s'", optarg);
2083                                 usage();
2084                         }
2085                         opts |= PF_OPT_OPTIMIZE;
2086                         break;
2087                 case 'O':
2088                         loadopt |= PFCTL_FLAG_OPTION;
2089                         break;
2090                 case 'p':
2091                         pf_device = optarg;
2092                         break;
2093                 case 'P':
2094                         opts |= PF_OPT_NUMERIC;
2095                         break;
2096                 case 's':
2097                         showopt = pfctl_lookup_option(optarg, showopt_list);
2098                         if (showopt == NULL) {
2099                                 warnx("Unknown show modifier '%s'", optarg);
2100                                 usage();
2101                         }
2102                         break;
2103                 case 't':
2104                         tableopt = optarg;
2105                         break;
2106                 case 'T':
2107                         tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2108                         if (tblcmdopt == NULL) {
2109                                 warnx("Unknown table command '%s'", optarg);
2110                                 usage();
2111                         }
2112                         break;
2113                 case 'v':
2114                         if (opts & PF_OPT_VERBOSE)
2115                                 opts |= PF_OPT_VERBOSE2;
2116                         opts |= PF_OPT_VERBOSE;
2117                         break;
2118                 case 'x':
2119                         debugopt = pfctl_lookup_option(optarg, debugopt_list);
2120                         if (debugopt == NULL) {
2121                                 warnx("Unknown debug level '%s'", optarg);
2122                                 usage();
2123                         }
2124                         mode = O_RDWR;
2125                         break;
2126                 case 'z':
2127                         opts |= PF_OPT_CLRRULECTRS;
2128                         mode = O_RDWR;
2129                         break;
2130                 case 'h':
2131                         /* FALLTHROUGH */
2132                 default:
2133                         usage();
2134                         /* NOTREACHED */
2135                 }
2136         }
2137
2138         if (tblcmdopt != NULL) {
2139                 argc -= optind;
2140                 argv += optind;
2141                 ch = *tblcmdopt;
2142                 if (ch == 'l') {
2143                         loadopt |= PFCTL_FLAG_TABLE;
2144                         tblcmdopt = NULL;
2145                 } else
2146                         mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2147         } else if (argc != optind) {
2148                 warnx("unknown command line argument: %s ...", argv[optind]);
2149                 usage();
2150                 /* NOTREACHED */
2151         }
2152         if (loadopt == 0)
2153                 loadopt = ~0;
2154
2155         if ((path = calloc(1, MAXPATHLEN)) == NULL)
2156                 errx(1, "pfctl: calloc");
2157         memset(anchorname, 0, sizeof(anchorname));
2158         if (anchoropt != NULL) {
2159                 int len = strlen(anchoropt);
2160
2161                 if (anchoropt[len - 1] == '*') {
2162                         if (len >= 2 && anchoropt[len - 2] == '/')
2163                                 anchoropt[len - 2] = '\0';
2164                         else
2165                                 anchoropt[len - 1] = '\0';
2166                         opts |= PF_OPT_RECURSE;
2167                 }
2168                 if (strlcpy(anchorname, anchoropt,
2169                     sizeof(anchorname)) >= sizeof(anchorname))
2170                         errx(1, "anchor name '%s' too long",
2171                             anchoropt);
2172                 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2173         }
2174
2175         if ((opts & PF_OPT_NOACTION) == 0) {
2176                 dev = open(pf_device, mode);
2177                 if (dev == -1)
2178                         err(1, "%s", pf_device);
2179                 altqsupport = pfctl_test_altqsupport(dev, opts);
2180         } else {
2181                 dev = open(pf_device, O_RDONLY);
2182                 if (dev >= 0)
2183                         opts |= PF_OPT_DUMMYACTION;
2184                 /* turn off options */
2185                 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2186                 clearopt = showopt = debugopt = NULL;
2187 #if !defined(ENABLE_ALTQ)
2188                 altqsupport = 0;
2189 #else
2190                 altqsupport = 1;
2191 #endif
2192         }
2193
2194         if (opts & PF_OPT_DISABLE)
2195                 if (pfctl_disable(dev, opts))
2196                         error = 1;
2197
2198         if (showopt != NULL) {
2199                 switch (*showopt) {
2200                 case 'A':
2201                         pfctl_show_anchors(dev, opts, anchorname);
2202                         break;
2203                 case 'r':
2204                         pfctl_load_fingerprints(dev, opts);
2205                         pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
2206                             anchorname, 0);
2207                         break;
2208                 case 'l':
2209                         pfctl_load_fingerprints(dev, opts);
2210                         pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
2211                             anchorname, 0);
2212                         break;
2213                 case 'n':
2214                         pfctl_load_fingerprints(dev, opts);
2215                         pfctl_show_nat(dev, opts, anchorname);
2216                         break;
2217                 case 'q':
2218                         pfctl_show_altq(dev, ifaceopt, opts,
2219                             opts & PF_OPT_VERBOSE2);
2220                         break;
2221                 case 's':
2222                         pfctl_show_states(dev, ifaceopt, opts);
2223                         break;
2224                 case 'S':
2225                         pfctl_show_src_nodes(dev, opts);
2226                         break;
2227                 case 'i':
2228                         pfctl_show_status(dev, opts);
2229                         break;
2230                 case 't':
2231                         pfctl_show_timeouts(dev, opts);
2232                         break;
2233                 case 'm':
2234                         pfctl_show_limits(dev, opts);
2235                         break;
2236                 case 'a':
2237                         opts |= PF_OPT_SHOWALL;
2238                         pfctl_load_fingerprints(dev, opts);
2239
2240                         pfctl_show_nat(dev, opts, anchorname);
2241                         pfctl_show_rules(dev, path, opts, 0, anchorname, 0);
2242                         pfctl_show_altq(dev, ifaceopt, opts, 0);
2243                         pfctl_show_states(dev, ifaceopt, opts);
2244                         pfctl_show_src_nodes(dev, opts);
2245                         pfctl_show_status(dev, opts);
2246                         pfctl_show_rules(dev, path, opts, 1, anchorname, 0);
2247                         pfctl_show_timeouts(dev, opts);
2248                         pfctl_show_limits(dev, opts);
2249                         pfctl_show_tables(anchorname, opts);
2250                         pfctl_show_fingerprints(opts);
2251                         break;
2252                 case 'T':
2253                         pfctl_show_tables(anchorname, opts);
2254                         break;
2255                 case 'o':
2256                         pfctl_load_fingerprints(dev, opts);
2257                         pfctl_show_fingerprints(opts);
2258                         break;
2259                 case 'I':
2260                         pfctl_show_ifaces(ifaceopt, opts);
2261                         break;
2262                 }
2263         }
2264
2265         if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2266                 pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
2267                     anchorname, 0);
2268
2269         if (clearopt != NULL) {
2270                 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2271                         errx(1, "anchor names beginning with '_' cannot "
2272                             "be modified from the command line");
2273
2274                 switch (*clearopt) {
2275                 case 'r':
2276                         pfctl_clear_rules(dev, opts, anchorname);
2277                         break;
2278                 case 'n':
2279                         pfctl_clear_nat(dev, opts, anchorname);
2280                         break;
2281                 case 'q':
2282                         pfctl_clear_altq(dev, opts);
2283                         break;
2284                 case 's':
2285                         pfctl_clear_states(dev, ifaceopt, opts);
2286                         break;
2287                 case 'S':
2288                         pfctl_clear_src_nodes(dev, opts);
2289                         break;
2290                 case 'i':
2291                         pfctl_clear_stats(dev, opts);
2292                         break;
2293                 case 'a':
2294                         pfctl_clear_rules(dev, opts, anchorname);
2295                         pfctl_clear_nat(dev, opts, anchorname);
2296                         pfctl_clear_tables(anchorname, opts);
2297                         if (!*anchorname) {
2298                                 pfctl_clear_altq(dev, opts);
2299                                 pfctl_clear_states(dev, ifaceopt, opts);
2300                                 pfctl_clear_src_nodes(dev, opts);
2301                                 pfctl_clear_stats(dev, opts);
2302                                 pfctl_clear_fingerprints(dev, opts);
2303                                 pfctl_clear_interface_flags(dev, opts);
2304                         }
2305                         break;
2306                 case 'o':
2307                         pfctl_clear_fingerprints(dev, opts);
2308                         break;
2309                 case 'T':
2310                         pfctl_clear_tables(anchorname, opts);
2311                         break;
2312                 }
2313         }
2314         if (state_killers) {
2315                 if (!strcmp(state_kill[0], "label"))
2316                         pfctl_label_kill_states(dev, ifaceopt, opts);
2317                 else if (!strcmp(state_kill[0], "id"))
2318                         pfctl_id_kill_states(dev, ifaceopt, opts);
2319                 else
2320                         pfctl_net_kill_states(dev, ifaceopt, opts);
2321         }
2322
2323         if (src_node_killers)
2324                 pfctl_kill_src_nodes(dev, ifaceopt, opts);
2325
2326         if (tblcmdopt != NULL) {
2327                 error = pfctl_command_tables(argc, argv, tableopt,
2328                     tblcmdopt, rulesopt, anchorname, opts);
2329                 rulesopt = NULL;
2330         }
2331         if (optiopt != NULL) {
2332                 switch (*optiopt) {
2333                 case 'n':
2334                         optimize = 0;
2335                         break;
2336                 case 'b':
2337                         optimize |= PF_OPTIMIZE_BASIC;
2338                         break;
2339                 case 'o':
2340                 case 'p':
2341                         optimize |= PF_OPTIMIZE_PROFILE;
2342                         break;
2343                 }
2344         }
2345
2346         if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2347             !anchorname[0])
2348                 if (pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET))
2349                         error = 1;
2350
2351         if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2352             !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2353                 if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
2354                         error = 1;
2355
2356         if (rulesopt != NULL) {
2357                 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2358                         errx(1, "anchor names beginning with '_' cannot "
2359                             "be modified from the command line");
2360                 if (pfctl_rules(dev, rulesopt, opts, optimize,
2361                     anchorname, NULL))
2362                         error = 1;
2363                 else if (!(opts & PF_OPT_NOACTION) &&
2364                     (loadopt & PFCTL_FLAG_TABLE))
2365                         warn_namespace_collision(NULL);
2366         }
2367
2368         if (opts & PF_OPT_ENABLE)
2369                 if (pfctl_enable(dev, opts))
2370                         error = 1;
2371
2372         if (debugopt != NULL) {
2373                 switch (*debugopt) {
2374                 case 'n':
2375                         pfctl_debug(dev, PF_DEBUG_NONE, opts);
2376                         break;
2377                 case 'u':
2378                         pfctl_debug(dev, PF_DEBUG_URGENT, opts);
2379                         break;
2380                 case 'm':
2381                         pfctl_debug(dev, PF_DEBUG_MISC, opts);
2382                         break;
2383                 case 'l':
2384                         pfctl_debug(dev, PF_DEBUG_NOISY, opts);
2385                         break;
2386                 }
2387         }
2388
2389         exit(error);
2390 }