usr.sbin/pfctl/pfctl.c

   1 /*      $OpenBSD: pfctl.c,v 1.277 2008/07/24 10:52:43 henning Exp $ */
   2
   3 /*
   4  * Copyright (c) 2001 Daniel Hartmeier
   5  * Copyright (c) 2002,2003 Henning Brauer
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  *    - Redistributions of source code must retain the above copyright
  13  *      notice, this list of conditions and the following disclaimer.
  14  *    - Redistributions in binary form must reproduce the above
  15  *      copyright notice, this list of conditions and the following
  16  *      disclaimer in the documentation and/or other materials provided
  17  *      with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  30  * POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  */
  33
  34 #include <sys/types.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/socket.h>
  37 #include <sys/stat.h>
  38 #include <sys/endian.h>
  39
  40 #include <net/if.h>
  41 #include <netinet/in.h>
  42 #include <net/pf/pfvar.h>
  43 #include <arpa/inet.h>
  44 #include <net/altq/altq.h>
  45 #include <sys/sysctl.h>
  46
  47 #include <err.h>
  48 #include <errno.h>
  49 #include <fcntl.h>
  50 #include <inttypes.h>
  51 #include <limits.h>
  52 #include <netdb.h>
  53 #include <stdio.h>
  54 #include <stdlib.h>
  55 #include <string.h>
  56 #include <unistd.h>
  57
  58 #include "pfctl_parser.h"
  59 #include "pfctl.h"
  60
  61 void     usage(void);
  62 int      pfctl_enable(int, int);
  63 int      pfctl_disable(int, int);
  64 int      pfctl_clear_stats(int, int);
  65 int      pfctl_clear_interface_flags(int, int);
  66 int      pfctl_clear_rules(int, int, char *);
  67 int      pfctl_clear_nat(int, int, char *);
  68 int      pfctl_clear_altq(int, int);
  69 int      pfctl_clear_src_nodes(int, int);
  70 int      pfctl_clear_states(int, const char *, int);
  71 void     pfctl_addrprefix(char *, struct pf_addr *);
  72 int      pfctl_kill_src_nodes(int, const char *, int);
  73 int      pfctl_net_kill_states(int, const char *, int);
  74 int      pfctl_label_kill_states(int, const char *, int);
  75 int      pfctl_id_kill_states(int, const char *, int);
  76 void     pfctl_init_options(struct pfctl *);
  77 int      pfctl_load_options(struct pfctl *);
  78 int      pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
  79 int      pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
  80 int      pfctl_load_debug(struct pfctl *, unsigned int);
  81 int      pfctl_load_logif(struct pfctl *, char *);
  82 int      pfctl_load_hostid(struct pfctl *, unsigned int);
  83 int      pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
  84             char *);
  85 void     pfctl_print_rule_counters(struct pf_rule *, int);
  86 int      pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
  87 int      pfctl_show_nat(int, int, char *);
  88 int      pfctl_show_src_nodes(int, int);
  89 int      pfctl_show_states(int, const char *, int);
  90 int      pfctl_show_status(int, int);
  91 int      pfctl_show_timeouts(int, int);
  92 int      pfctl_show_limits(int, int);
  93 void     pfctl_debug(int, u_int32_t, int);
  94 int      pfctl_test_altqsupport(int, int);
  95 int      pfctl_show_anchors(int, int, char *);
  96 int      pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
  97 int      pfctl_load_ruleset(struct pfctl *, char *,
  98                 struct pf_ruleset *, int, int);
  99 int      pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
 100 const char      *pfctl_lookup_option(char *, const char **);
 101
 102 struct pf_anchor_global  pf_anchors;
 103 struct pf_anchor         pf_main_anchor;
 104
 105 const char      *clearopt;
 106 char            *rulesopt;
 107 const char      *showopt;
 108 const char      *debugopt;
 109 char            *anchoropt;
 110 const char      *optiopt = NULL;
 111 const char              *pf_device = "/dev/pf";
 112 char            *ifaceopt;
 113 char            *tableopt;
 114 const char      *tblcmdopt;
 115 int              src_node_killers;
 116 char            *src_node_kill[2];
 117 int              state_killers;
 118 char            *state_kill[2];
 119 int              loadopt;
 120 int              altqsupport;
 121
 122 int              dev_fd = -1;
 123 int              first_title = 1;
 124 int              labels = 0;
 125
 126 #define INDENT(d, o)    do {                                            \
 127                                 if (o) {                                \
 128                                         int i;                          \
 129                                         for (i=0; i < d; i++)           \
 130                                                 printf("  ");           \
 131                                 }                                       \
 132                         } while (0);                                    \
 133
 134
 135 static const struct {
 136         const char      *name;
 137         int             index;
 138 } pf_limits[] = {
 139         { "states",             PF_LIMIT_STATES },
 140         { "src-nodes",          PF_LIMIT_SRC_NODES },
 141         { "frags",              PF_LIMIT_FRAGS },
 142         { "tables",             PF_LIMIT_TABLES },
 143         { "table-entries",      PF_LIMIT_TABLE_ENTRIES },
 144         { NULL,                 0 }
 145 };
 146
 147 struct pf_hint {
 148         const char      *name;
 149         int             timeout;
 150 };
 151 static const struct pf_hint pf_hint_normal[] = {
 152         { "tcp.first",          2 * 60 },
 153         { "tcp.opening",        30 },
 154         { "tcp.established",    24 * 60 * 60 },
 155         { "tcp.closing",        15 * 60 },
 156         { "tcp.finwait",        45 },
 157         { "tcp.closed",         90 },
 158         { "tcp.tsdiff",         30 },
 159         { NULL,                 0 }
 160 };
 161 static const struct pf_hint pf_hint_satellite[] = {
 162         { "tcp.first",          3 * 60 },
 163         { "tcp.opening",        30 + 5 },
 164         { "tcp.established",    24 * 60 * 60 },
 165         { "tcp.closing",        15 * 60 + 5 },
 166         { "tcp.finwait",        45 + 5 },
 167         { "tcp.closed",         90 + 5 },
 168         { "tcp.tsdiff",         60 },
 169         { NULL,                 0 }
 170 };
 171 static const struct pf_hint pf_hint_conservative[] = {
 172         { "tcp.first",          60 * 60 },
 173         { "tcp.opening",        15 * 60 },
 174         { "tcp.established",    5 * 24 * 60 * 60 },
 175         { "tcp.closing",        60 * 60 },
 176         { "tcp.finwait",        10 * 60 },
 177         { "tcp.closed",         3 * 60 },
 178         { "tcp.tsdiff",         60 },
 179         { NULL,                 0 }
 180 };
 181 static const struct pf_hint pf_hint_aggressive[] = {
 182         { "tcp.first",          30 },
 183         { "tcp.opening",        5 },
 184         { "tcp.established",    5 * 60 * 60 },
 185         { "tcp.closing",        60 },
 186         { "tcp.finwait",        30 },
 187         { "tcp.closed",         30 },
 188         { "tcp.tsdiff",         10 },
 189         { NULL,                 0 }
 190 };
 191
 192 static const struct {
 193         const char *name;
 194         const struct pf_hint *hint;
 195 } pf_hints[] = {
 196         { "normal",             pf_hint_normal },
 197         { "satellite",          pf_hint_satellite },
 198         { "high-latency",       pf_hint_satellite },
 199         { "conservative",       pf_hint_conservative },
 200         { "aggressive",         pf_hint_aggressive },
 201         { NULL,                 NULL }
 202 };
 203
 204 static const char *clearopt_list[] = {
 205         "nat", "queue", "rules", "Sources",
 206         "states", "info", "Tables", "osfp", "all", NULL
 207 };
 208
 209 static const char *showopt_list[] = {
 210         "nat", "queue", "rules", "Anchors", "Sources", "states", "info",
 211         "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
 212         "all", NULL
 213 };
 214
 215 static const char *tblcmdopt_list[] = {
 216         "kill", "flush", "add", "delete", "load", "replace", "show",
 217         "test", "zero", "expire", NULL
 218 };
 219
 220 static const char *debugopt_list[] = {
 221         "none", "urgent", "misc", "loud", NULL
 222 };
 223
 224 static const char *optiopt_list[] = {
 225         "none", "basic", "profile", NULL
 226 };
 227
 228 void
 229 usage(void)
 230 {
 231         fprintf(stderr, "usage: %s [-AdeghmNnOqRrvz] ", getprogname());
 232         fprintf(stderr, "[-a anchor] [-D macro=value] [-F modifier]\n");
 233         fprintf(stderr, "\t[-f file] [-i interface] [-K host | network] ");
 234         fprintf(stderr, "[-k host | network | label | id]\n");
 235         fprintf(stderr, "\t[-o level] [-p device] [-s modifier]\n");
 236         fprintf(stderr, "\t[-t table -T command [address ...]] [-x level]\n");
 237         exit(1);
 238 }
 239
 240 int
 241 pfctl_enable(int dev, int opts)
 242 {
 243         if (ioctl(dev, DIOCSTART)) {
 244                 if (errno == EEXIST)
 245                         errx(1, "pf already enabled");
 246                 else
 247                         err(1, "DIOCSTART");
 248         }
 249         if ((opts & PF_OPT_QUIET) == 0)
 250                 fprintf(stderr, "pf enabled\n");
 251
 252         if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
 253                 if (errno != EEXIST)
 254                         err(1, "DIOCSTARTALTQ");
 255
 256         return (0);
 257 }
 258
 259 int
 260 pfctl_disable(int dev, int opts)
 261 {
 262         if (ioctl(dev, DIOCSTOP)) {
 263                 if (errno == ENOENT)
 264                         errx(1, "pf not enabled");
 265                 else
 266                         err(1, "DIOCSTOP");
 267         }
 268         if ((opts & PF_OPT_QUIET) == 0)
 269                 fprintf(stderr, "pf disabled\n");
 270
 271         if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
 272                         if (errno != ENOENT)
 273                                 err(1, "DIOCSTOPALTQ");
 274
 275         return (0);
 276 }
 277
 278 int
 279 pfctl_clear_stats(int dev, int opts)
 280 {
 281         if (ioctl(dev, DIOCCLRSTATUS))
 282                 err(1, "DIOCCLRSTATUS");
 283         if ((opts & PF_OPT_QUIET) == 0)
 284                 fprintf(stderr, "pf: statistics cleared\n");
 285         return (0);
 286 }
 287
 288 int
 289 pfctl_clear_interface_flags(int dev, int opts)
 290 {
 291         struct pfioc_iface      pi;
 292
 293         if ((opts & PF_OPT_NOACTION) == 0) {
 294                 bzero(&pi, sizeof(pi));
 295                 pi.pfiio_flags = PFI_IFLAG_SKIP;
 296
 297                 if (ioctl(dev, DIOCCLRIFFLAG, &pi))
 298                         err(1, "DIOCCLRIFFLAG");
 299                 if ((opts & PF_OPT_QUIET) == 0)
 300                         fprintf(stderr, "pf: interface flags reset\n");
 301         }
 302         return (0);
 303 }
 304
 305 int
 306 pfctl_clear_rules(int dev, int opts, char *anchorname)
 307 {
 308         struct pfr_buffer t;
 309
 310         memset(&t, 0, sizeof(t));
 311         t.pfrb_type = PFRB_TRANS;
 312         if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
 313             pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
 314             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 315             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 316                 err(1, "pfctl_clear_rules");
 317         if ((opts & PF_OPT_QUIET) == 0)
 318                 fprintf(stderr, "rules cleared\n");
 319         return (0);
 320 }
 321
 322 int
 323 pfctl_clear_nat(int dev, int opts, char *anchorname)
 324 {
 325         struct pfr_buffer t;
 326
 327         memset(&t, 0, sizeof(t));
 328         t.pfrb_type = PFRB_TRANS;
 329         if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
 330             pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
 331             pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
 332             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 333             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 334                 err(1, "pfctl_clear_nat");
 335         if ((opts & PF_OPT_QUIET) == 0)
 336                 fprintf(stderr, "nat cleared\n");
 337         return (0);
 338 }
 339
 340 int
 341 pfctl_clear_altq(int dev, int opts)
 342 {
 343         struct pfr_buffer t;
 344
 345         if (!altqsupport)
 346                 return (-1);
 347         memset(&t, 0, sizeof(t));
 348         t.pfrb_type = PFRB_TRANS;
 349         if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
 350             pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 351             pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 352                 err(1, "pfctl_clear_altq");
 353         if ((opts & PF_OPT_QUIET) == 0)
 354                 fprintf(stderr, "altq cleared\n");
 355         return (0);
 356 }
 357
 358 int
 359 pfctl_clear_src_nodes(int dev, int opts)
 360 {
 361         if (ioctl(dev, DIOCCLRSRCNODES))
 362                 err(1, "DIOCCLRSRCNODES");
 363         if ((opts & PF_OPT_QUIET) == 0)
 364                 fprintf(stderr, "source tracking entries cleared\n");
 365         return (0);
 366 }
 367
 368 int
 369 pfctl_clear_states(int dev, const char *iface, int opts)
 370 {
 371         struct pfioc_state_kill psk;
 372
 373         memset(&psk, 0, sizeof(psk));
 374         if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 375             sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 376                 errx(1, "invalid interface: %s", iface);
 377
 378         if (ioctl(dev, DIOCCLRSTATES, &psk))
 379                 err(1, "DIOCCLRSTATES");
 380         if ((opts & PF_OPT_QUIET) == 0)
 381                 fprintf(stderr, "%d states cleared\n", psk.psk_killed);
 382         return (0);
 383 }
 384
 385 void
 386 pfctl_addrprefix(char *addr, struct pf_addr *mask)
 387 {
 388         char *p;
 389         const char *errstr;
 390         int prefix, ret_ga, q, r;
 391         struct addrinfo hints, *res;
 392
 393         if ((p = strchr(addr, '/')) == NULL)
 394                 return;
 395
 396         *p++ = '\0';
 397         prefix = strtonum(p, 0, 128, &errstr);
 398         if (errstr)
 399                 errx(1, "prefix is %s: %s", errstr, p);
 400
 401         bzero(&hints, sizeof(hints));
 402         /* prefix only with numeric addresses */
 403         hints.ai_flags |= AI_NUMERICHOST;
 404
 405         if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
 406                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 407                 /* NOTREACHED */
 408         }
 409
 410         if (res->ai_family == AF_INET && prefix > 32)
 411                 errx(1, "prefix too long for AF_INET");
 412         else if (res->ai_family == AF_INET6 && prefix > 128)
 413                 errx(1, "prefix too long for AF_INET6");
 414
 415         q = prefix >> 3;
 416         r = prefix & 7;
 417         switch (res->ai_family) {
 418         case AF_INET:
 419                 bzero(&mask->v4, sizeof(mask->v4));
 420                 mask->v4.s_addr = htonl((u_int32_t)
 421                     (0xffffffffffULL << (32 - prefix)));
 422                 break;
 423         case AF_INET6:
 424                 bzero(&mask->v6, sizeof(mask->v6));
 425                 if (q > 0)
 426                         memset((void *)&mask->v6, 0xff, q);
 427                 if (r > 0)
 428                         *((u_char *)&mask->v6 + q) =
 429                             (0xff00 >> r) & 0xff;
 430                 break;
 431         }
 432         freeaddrinfo(res);
 433 }
 434
 435 int
 436 pfctl_kill_src_nodes(int dev, const char *iface __unused, int opts)
 437 {
 438         struct pfioc_src_node_kill psnk;
 439         struct addrinfo *res[2], *resp[2];
 440         struct sockaddr last_src, last_dst;
 441         int killed, sources, dests;
 442         int ret_ga;
 443
 444         killed = sources = dests = 0;
 445
 446         memset(&psnk, 0, sizeof(psnk));
 447         memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
 448             sizeof(psnk.psnk_src.addr.v.a.mask));
 449         memset(&last_src, 0xff, sizeof(last_src));
 450         memset(&last_dst, 0xff, sizeof(last_dst));
 451
 452         pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
 453
 454         if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
 455                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 456                 /* NOTREACHED */
 457         }
 458         for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 459                 if (resp[0]->ai_addr == NULL)
 460                         continue;
 461                 /* We get lots of duplicates.  Catch the easy ones */
 462                 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 463                         continue;
 464                 last_src = *(struct sockaddr *)resp[0]->ai_addr;
 465
 466                 psnk.psnk_af = resp[0]->ai_family;
 467                 sources++;
 468
 469                 if (psnk.psnk_af == AF_INET)
 470                         psnk.psnk_src.addr.v.a.addr.v4 =
 471                             ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 472                 else if (psnk.psnk_af == AF_INET6)
 473                         psnk.psnk_src.addr.v.a.addr.v6 =
 474                             ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 475                             sin6_addr;
 476                 else
 477                         errx(1, "Unknown address family %d", psnk.psnk_af);
 478
 479                 if (src_node_killers > 1) {
 480                         dests = 0;
 481                         memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
 482                             sizeof(psnk.psnk_dst.addr.v.a.mask));
 483                         memset(&last_dst, 0xff, sizeof(last_dst));
 484                         pfctl_addrprefix(src_node_kill[1],
 485                             &psnk.psnk_dst.addr.v.a.mask);
 486                         if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
 487                             &res[1]))) {
 488                                 errx(1, "getaddrinfo: %s",
 489                                     gai_strerror(ret_ga));
 490                                 /* NOTREACHED */
 491                         }
 492                         for (resp[1] = res[1]; resp[1];
 493                             resp[1] = resp[1]->ai_next) {
 494                                 if (resp[1]->ai_addr == NULL)
 495                                         continue;
 496                                 if (psnk.psnk_af != resp[1]->ai_family)
 497                                         continue;
 498
 499                                 if (memcmp(&last_dst, resp[1]->ai_addr,
 500                                     sizeof(last_dst)) == 0)
 501                                         continue;
 502                                 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 503
 504                                 dests++;
 505
 506                                 if (psnk.psnk_af == AF_INET)
 507                                         psnk.psnk_dst.addr.v.a.addr.v4 =
 508                                             ((struct sockaddr_in *)resp[1]->
 509                                             ai_addr)->sin_addr;
 510                                 else if (psnk.psnk_af == AF_INET6)
 511                                         psnk.psnk_dst.addr.v.a.addr.v6 =
 512                                             ((struct sockaddr_in6 *)resp[1]->
 513                                             ai_addr)->sin6_addr;
 514                                 else
 515                                         errx(1, "Unknown address family %d",
 516                                             psnk.psnk_af);
 517
 518                                 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 519                                         err(1, "DIOCKILLSRCNODES");
 520                                 killed += psnk.psnk_killed;
 521                         }
 522                         freeaddrinfo(res[1]);
 523                 } else {
 524                         if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 525                                 err(1, "DIOCKILLSRCNODES");
 526                         killed += psnk.psnk_killed;
 527                 }
 528         }
 529
 530         freeaddrinfo(res[0]);
 531
 532         if ((opts & PF_OPT_QUIET) == 0)
 533                 fprintf(stderr, "killed %d src nodes from %d sources and %d "
 534                     "destinations\n", killed, sources, dests);
 535         return (0);
 536 }
 537
 538 int
 539 pfctl_net_kill_states(int dev, const char *iface, int opts)
 540 {
 541         struct pfioc_state_kill psk;
 542         struct addrinfo *res[2], *resp[2];
 543         struct sockaddr last_src, last_dst;
 544         int killed, sources, dests;
 545         int ret_ga;
 546
 547         killed = sources = dests = 0;
 548
 549         memset(&psk, 0, sizeof(psk));
 550         memset(&psk.psk_src.addr.v.a.mask, 0xff,
 551             sizeof(psk.psk_src.addr.v.a.mask));
 552         memset(&last_src, 0xff, sizeof(last_src));
 553         memset(&last_dst, 0xff, sizeof(last_dst));
 554         if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 555             sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 556                 errx(1, "invalid interface: %s", iface);
 557
 558         pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
 559
 560         if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
 561                 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 562                 /* NOTREACHED */
 563         }
 564         for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 565                 if (resp[0]->ai_addr == NULL)
 566                         continue;
 567                 /* We get lots of duplicates.  Catch the easy ones */
 568                 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 569                         continue;
 570                 last_src = *(struct sockaddr *)resp[0]->ai_addr;
 571
 572                 psk.psk_af = resp[0]->ai_family;
 573                 sources++;
 574
 575                 if (psk.psk_af == AF_INET)
 576                         psk.psk_src.addr.v.a.addr.v4 =
 577                             ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 578                 else if (psk.psk_af == AF_INET6)
 579                         psk.psk_src.addr.v.a.addr.v6 =
 580                             ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 581                             sin6_addr;
 582                 else
 583                         errx(1, "Unknown address family %d", psk.psk_af);
 584
 585                 if (state_killers > 1) {
 586                         dests = 0;
 587                         memset(&psk.psk_dst.addr.v.a.mask, 0xff,
 588                             sizeof(psk.psk_dst.addr.v.a.mask));
 589                         memset(&last_dst, 0xff, sizeof(last_dst));
 590                         pfctl_addrprefix(state_kill[1],
 591                             &psk.psk_dst.addr.v.a.mask);
 592                         if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
 593                             &res[1]))) {
 594                                 errx(1, "getaddrinfo: %s",
 595                                     gai_strerror(ret_ga));
 596                                 /* NOTREACHED */
 597                         }
 598                         for (resp[1] = res[1]; resp[1];
 599                             resp[1] = resp[1]->ai_next) {
 600                                 if (resp[1]->ai_addr == NULL)
 601                                         continue;
 602                                 if (psk.psk_af != resp[1]->ai_family)
 603                                         continue;
 604
 605                                 if (memcmp(&last_dst, resp[1]->ai_addr,
 606                                     sizeof(last_dst)) == 0)
 607                                         continue;
 608                                 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 609
 610                                 dests++;
 611
 612                                 if (psk.psk_af == AF_INET)
 613                                         psk.psk_dst.addr.v.a.addr.v4 =
 614                                             ((struct sockaddr_in *)resp[1]->
 615                                             ai_addr)->sin_addr;
 616                                 else if (psk.psk_af == AF_INET6)
 617                                         psk.psk_dst.addr.v.a.addr.v6 =
 618                                             ((struct sockaddr_in6 *)resp[1]->
 619                                             ai_addr)->sin6_addr;
 620                                 else
 621                                         errx(1, "Unknown address family %d",
 622                                             psk.psk_af);
 623
 624                                 if (ioctl(dev, DIOCKILLSTATES, &psk))
 625                                         err(1, "DIOCKILLSTATES");
 626                                 killed += psk.psk_killed;
 627                         }
 628                         freeaddrinfo(res[1]);
 629                 } else {
 630                         if (ioctl(dev, DIOCKILLSTATES, &psk))
 631                                 err(1, "DIOCKILLSTATES");
 632                         killed += psk.psk_killed;
 633                 }
 634         }
 635
 636         freeaddrinfo(res[0]);
 637
 638         if ((opts & PF_OPT_QUIET) == 0)
 639                 fprintf(stderr, "killed %d states from %d sources and %d "
 640                     "destinations\n", killed, sources, dests);
 641         return (0);
 642 }
 643
 644 int
 645 pfctl_label_kill_states(int dev, const char *iface, int opts)
 646 {
 647         struct pfioc_state_kill psk;
 648
 649         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 650                 warnx("no label specified");
 651                 usage();
 652         }
 653         memset(&psk, 0, sizeof(psk));
 654         if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 655             sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 656                 errx(1, "invalid interface: %s", iface);
 657
 658         if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
 659             sizeof(psk.psk_label))
 660                 errx(1, "label too long: %s", state_kill[1]);
 661
 662         if (ioctl(dev, DIOCKILLSTATES, &psk))
 663                 err(1, "DIOCKILLSTATES");
 664
 665         if ((opts & PF_OPT_QUIET) == 0)
 666                 fprintf(stderr, "killed %d states\n", psk.psk_killed);
 667
 668         return (0);
 669 }
 670
 671 int
 672 pfctl_id_kill_states(int dev, const char *iface, int opts)
 673 {
 674         struct pfioc_state_kill psk;
 675
 676         if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
 677                 warnx("no id specified");
 678                 usage();
 679         }
 680
 681         memset(&psk, 0, sizeof(psk));
 682         if ((sscanf(state_kill[1], "%" SCNx64 "/%x",
 683             &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
 684                 psk.psk_pfcmp.creatorid=htonl(psk.psk_pfcmp.creatorid);
 685         else if ((sscanf(state_kill[1], "%" SCNx64, &psk.psk_pfcmp.id)) == 1) {
 686                 psk.psk_pfcmp.creatorid = 0;
 687         } else {
 688                 warnx("wrong id format specified");
 689                 usage();
 690         }
 691         if (psk.psk_pfcmp.id == 0) {
 692                 warnx("cannot kill id 0");
 693                 usage();
 694         }
 695
 696         psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
 697         if (ioctl(dev, DIOCKILLSTATES, &psk))
 698                 err(1, "DIOCKILLSTATES");
 699
 700         if ((opts & PF_OPT_QUIET) == 0)
 701                 fprintf(stderr, "killed %d states\n", psk.psk_killed);
 702
 703         return (0);
 704 }
 705
 706 int
 707 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
 708     u_int32_t ticket, int r_action, char *anchorname)
 709 {
 710         struct pfioc_pooladdr pp;
 711         struct pf_pooladdr *pa;
 712         u_int32_t pnr, mpnr;
 713
 714         memset(&pp, 0, sizeof(pp));
 715         memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
 716         pp.r_action = r_action;
 717         pp.r_num = nr;
 718         pp.ticket = ticket;
 719         if (ioctl(dev, DIOCGETADDRS, &pp)) {
 720                 warn("DIOCGETADDRS");
 721                 return (-1);
 722         }
 723         mpnr = pp.nr;
 724         TAILQ_INIT(&pool->list);
 725         for (pnr = 0; pnr < mpnr; ++pnr) {
 726                 pp.nr = pnr;
 727                 if (ioctl(dev, DIOCGETADDR, &pp)) {
 728                         warn("DIOCGETADDR");
 729                         return (-1);
 730                 }
 731                 pa = calloc(1, sizeof(struct pf_pooladdr));
 732                 if (pa == NULL)
 733                         err(1, "calloc");
 734                 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
 735                 TAILQ_INSERT_TAIL(&pool->list, pa, entries);
 736         }
 737
 738         return (0);
 739 }
 740
 741 void
 742 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
 743 {
 744         struct pf_pooladdr *pa;
 745
 746         while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
 747                 TAILQ_REMOVE(&src->list, pa, entries);
 748                 TAILQ_INSERT_TAIL(&dst->list, pa, entries);
 749         }
 750 }
 751
 752 void
 753 pfctl_clear_pool(struct pf_pool *pool)
 754 {
 755         struct pf_pooladdr *pa;
 756
 757         while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
 758                 TAILQ_REMOVE(&pool->list, pa, entries);
 759                 free(pa);
 760         }
 761 }
 762
 763 void
 764 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
 765 {
 766         if (opts & PF_OPT_DEBUG) {
 767                 const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
 768                     "p", "sa", "sp", "da", "dp" };
 769                 int i;
 770
 771                 printf("  [ Skip steps: ");
 772                 for (i = 0; i < PF_SKIP_COUNT; ++i) {
 773                         if (rule->skip[i].nr == rule->nr + 1)
 774                                 continue;
 775                         printf("%s=", t[i]);
 776                         if (rule->skip[i].nr == (uint32_t)(-1))
 777                                 printf("end ");
 778                         else
 779                                 printf("%u ", rule->skip[i].nr);
 780                 }
 781                 printf("]\n");
 782
 783                 printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
 784                     rule->qname, rule->qid, rule->pqname, rule->pqid);
 785         }
 786         if (opts & PF_OPT_VERBOSE) {
 787                 printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
 788                             "Bytes: %-10llu  States: %-6u]\n",
 789                             (unsigned long long)rule->evaluations,
 790                             (unsigned long long)(rule->packets[0] +
 791                             rule->packets[1]),
 792                             (unsigned long long)(rule->bytes[0] +
 793                             rule->bytes[1]), rule->states_cur);
 794                 if (!(opts & PF_OPT_DEBUG))
 795                         printf("  [ Inserted: uid %u pid %u "
 796                             "State Creations: %-6u]\n",
 797                             (unsigned)rule->cuid, (unsigned)rule->cpid,
 798                             rule->states_tot);
 799         }
 800 }
 801
 802 void
 803 pfctl_print_title(const char *title)
 804 {
 805         if (!first_title)
 806                 printf("\n");
 807         first_title = 0;
 808         printf("%s\n", title);
 809 }
 810
 811 int
 812 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
 813     char *anchorname, int depth)
 814 {
 815         struct pfioc_rule pr;
 816         u_int32_t nr, mnr, header = 0;
 817         int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
 818         int len = strlen(path);
 819         int brace;
 820         char *p;
 821
 822         if (path[0])
 823                 snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
 824         else
 825                 snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
 826
 827         memset(&pr, 0, sizeof(pr));
 828         memcpy(pr.anchor, path, sizeof(pr.anchor));
 829         if (opts & PF_OPT_SHOWALL) {
 830                 pr.rule.action = PF_PASS;
 831                 if (ioctl(dev, DIOCGETRULES, &pr)) {
 832                         warn("DIOCGETRULES");
 833                         goto error;
 834                 }
 835                 header++;
 836         }
 837         pr.rule.action = PF_SCRUB;
 838         if (ioctl(dev, DIOCGETRULES, &pr)) {
 839                 warn("DIOCGETRULES");
 840                 goto error;
 841         }
 842         if (opts & PF_OPT_SHOWALL) {
 843                 if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
 844                         pfctl_print_title("FILTER RULES:");
 845                 else if (format == PFCTL_SHOW_LABELS && labels)
 846                         pfctl_print_title("LABEL COUNTERS:");
 847         }
 848         mnr = pr.nr;
 849         if (opts & PF_OPT_CLRRULECTRS)
 850                 pr.action = PF_GET_CLR_CNTR;
 851
 852         for (nr = 0; nr < mnr; ++nr) {
 853                 pr.nr = nr;
 854                 if (ioctl(dev, DIOCGETRULE, &pr)) {
 855                         warn("DIOCGETRULE");
 856                         goto error;
 857                 }
 858
 859                 if (pfctl_get_pool(dev, &pr.rule.rpool,
 860                     nr, pr.ticket, PF_SCRUB, path) != 0)
 861                         goto error;
 862
 863                 switch (format) {
 864                 case PFCTL_SHOW_LABELS:
 865                         break;
 866                 case PFCTL_SHOW_RULES:
 867                         if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 868                                 labels = 1;
 869                         print_rule(&pr.rule, pr.anchor_call, rule_numbers);
 870                         printf("\n");
 871                         pfctl_print_rule_counters(&pr.rule, opts);
 872                         break;
 873                 case PFCTL_SHOW_NOTHING:
 874                         break;
 875                 }
 876                 pfctl_clear_pool(&pr.rule.rpool);
 877         }
 878         pr.rule.action = PF_PASS;
 879         if (ioctl(dev, DIOCGETRULES, &pr)) {
 880                 warn("DIOCGETRULES");
 881                 goto error;
 882         }
 883         mnr = pr.nr;
 884         for (nr = 0; nr < mnr; ++nr) {
 885                 pr.nr = nr;
 886                 if (ioctl(dev, DIOCGETRULE, &pr)) {
 887                         warn("DIOCGETRULE");
 888                         goto error;
 889                 }
 890
 891                 if (pfctl_get_pool(dev, &pr.rule.rpool,
 892                     nr, pr.ticket, PF_PASS, path) != 0)
 893                         goto error;
 894
 895                 switch (format) {
 896                 case PFCTL_SHOW_LABELS:
 897                         if (pr.rule.label[0]) {
 898                                 printf("%s %llu %llu %llu %llu"
 899                                     " %llu %llu %llu %llu\n",
 900                                     pr.rule.label,
 901                                     (unsigned long long)pr.rule.evaluations,
 902                                     (unsigned long long)(pr.rule.packets[0] +
 903                                     pr.rule.packets[1]),
 904                                     (unsigned long long)(pr.rule.bytes[0] +
 905                                     pr.rule.bytes[1]),
 906                                     (unsigned long long)pr.rule.packets[0],
 907                                     (unsigned long long)pr.rule.bytes[0],
 908                                     (unsigned long long)pr.rule.packets[1],
 909                                     (unsigned long long)pr.rule.bytes[1],
 910                                     (unsigned long long)pr.rule.states_tot);
 911                         }
 912                         break;
 913                 case PFCTL_SHOW_RULES:
 914                         brace = 0;
 915                         if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 916                                 labels = 1;
 917                         INDENT(depth, !(opts & PF_OPT_VERBOSE));
 918                         if (pr.anchor_call[0] &&
 919                            ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
 920                            ((void *)p == (void *)pr.anchor_call ||
 921                            *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
 922                                 brace++;
 923                                 if ((p = strrchr(pr.anchor_call, '/')) !=
 924                                     NULL)
 925                                         p++;
 926                                 else
 927                                         p = &pr.anchor_call[0];
 928                         } else
 929                                 p = &pr.anchor_call[0];
 930
 931                         print_rule(&pr.rule, p, rule_numbers);
 932                         if (brace)
 933                                 printf(" {\n");
 934                         else
 935                                 printf("\n");
 936                         pfctl_print_rule_counters(&pr.rule, opts);
 937                         if (brace) {
 938                                 pfctl_show_rules(dev, path, opts, format,
 939                                     p, depth + 1);
 940                                 INDENT(depth, !(opts & PF_OPT_VERBOSE));
 941                                 printf("}\n");
 942                         }
 943                         break;
 944                 case PFCTL_SHOW_NOTHING:
 945                         break;
 946                 }
 947                 pfctl_clear_pool(&pr.rule.rpool);
 948         }
 949         path[len] = '\0';
 950         return (0);
 951
 952  error:
 953         path[len] = '\0';
 954         return (-1);
 955 }
 956
 957 int
 958 pfctl_show_nat(int dev, int opts, char *anchorname)
 959 {
 960         struct pfioc_rule pr;
 961         u_int32_t mnr, nr;
 962         static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
 963         int i, dotitle = opts & PF_OPT_SHOWALL;
 964
 965         memset(&pr, 0, sizeof(pr));
 966         memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
 967         for (i = 0; i < 3; i++) {
 968                 pr.rule.action = nattype[i];
 969                 if (ioctl(dev, DIOCGETRULES, &pr)) {
 970                         warn("DIOCGETRULES");
 971                         return (-1);
 972                 }
 973                 mnr = pr.nr;
 974                 for (nr = 0; nr < mnr; ++nr) {
 975                         pr.nr = nr;
 976                         if (ioctl(dev, DIOCGETRULE, &pr)) {
 977                                 warn("DIOCGETRULE");
 978                                 return (-1);
 979                         }
 980                         if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
 981                             pr.ticket, nattype[i], anchorname) != 0)
 982                                 return (-1);
 983                         if (dotitle) {
 984                                 pfctl_print_title("TRANSLATION RULES:");
 985                                 dotitle = 0;
 986                         }
 987                         print_rule(&pr.rule, pr.anchor_call,
 988                             opts & PF_OPT_VERBOSE2);
 989                         printf("\n");
 990                         pfctl_print_rule_counters(&pr.rule, opts);
 991                         pfctl_clear_pool(&pr.rule.rpool);
 992                 }
 993         }
 994         return (0);
 995 }
 996
 997 int
 998 pfctl_show_src_nodes(int dev, int opts)
 999 {
1000         struct pfioc_src_nodes psn;
1001         struct pf_src_node *p;
1002         char *inbuf = NULL, *newinbuf = NULL;
1003         unsigned int len = 0;
1004         int i;
1005
1006         memset(&psn, 0, sizeof(psn));
1007         for (;;) {
1008                 psn.psn_len = len;
1009                 if (len) {
1010                         newinbuf = realloc(inbuf, len);
1011                         if (newinbuf == NULL)
1012                                 err(1, "realloc");
1013                         psn.psn_buf = inbuf = newinbuf;
1014                 }
1015                 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1016                         warn("DIOCGETSRCNODES");
1017                         free(inbuf);
1018                         return (-1);
1019                 }
1020                 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1021                         break;
1022                 if (len == 0 && psn.psn_len == 0)
1023                         goto done;
1024                 if (len == 0 && psn.psn_len != 0)
1025                         len = psn.psn_len;
1026                 if (psn.psn_len == 0)
1027                         goto done;      /* no src_nodes */
1028                 len *= 2;
1029         }
1030         p = psn.psn_src_nodes;
1031         if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1032                 pfctl_print_title("SOURCE TRACKING NODES:");
1033         for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1034                 print_src_node(p, opts);
1035                 p++;
1036         }
1037 done:
1038         free(inbuf);
1039         return (0);
1040 }
1041
1042 int
1043 pfctl_show_states(int dev, const char *iface, int opts)
1044 {
1045         struct pfioc_states ps;
1046         struct pfsync_state *p;
1047         char *inbuf = NULL, *newinbuf = NULL;
1048         unsigned int len = 0;
1049         int i, dotitle = (opts & PF_OPT_SHOWALL);
1050
1051         memset(&ps, 0, sizeof(ps));
1052         for (;;) {
1053                 ps.ps_len = len;
1054                 if (len) {
1055                         newinbuf = realloc(inbuf, len);
1056                         if (newinbuf == NULL)
1057                                 err(1, "realloc");
1058                         ps.ps_buf = inbuf = newinbuf;
1059                 }
1060                 if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1061                         warn("DIOCGETSTATES");
1062                         free(inbuf);
1063                         return (-1);
1064                 }
1065                 if (ps.ps_len + sizeof(struct pfioc_states) < len)
1066                         break;
1067                 if (len == 0 && ps.ps_len == 0)
1068                         goto done;
1069                 if (len == 0 && ps.ps_len != 0)
1070                         len = ps.ps_len;
1071                 if (ps.ps_len == 0)
1072                         goto done;      /* no states */
1073                 len *= 2;
1074         }
1075         p = ps.ps_states;
1076         for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1077                 if (iface != NULL && strcmp(p->ifname, iface))
1078                         continue;
1079                 if (dotitle) {
1080                         pfctl_print_title("STATES:");
1081                         dotitle = 0;
1082                 }
1083                 print_state(p, opts);
1084         }
1085 done:
1086         free(inbuf);
1087         return (0);
1088 }
1089
1090 int
1091 pfctl_show_status(int dev, int opts)
1092 {
1093         struct pf_status status;
1094
1095         if (ioctl(dev, DIOCGETSTATUS, &status)) {
1096                 warn("DIOCGETSTATUS");
1097                 return (-1);
1098         }
1099         if (opts & PF_OPT_SHOWALL)
1100                 pfctl_print_title("INFO:");
1101         print_status(&status, opts);
1102         return (0);
1103 }
1104
1105 int
1106 pfctl_show_timeouts(int dev, int opts)
1107 {
1108         struct pfioc_tm pt;
1109         int i;
1110
1111         if (opts & PF_OPT_SHOWALL)
1112                 pfctl_print_title("TIMEOUTS:");
1113         memset(&pt, 0, sizeof(pt));
1114         for (i = 0; pf_timeouts[i].name; i++) {
1115                 pt.timeout = pf_timeouts[i].timeout;
1116                 if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1117                         err(1, "DIOCGETTIMEOUT");
1118                 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1119                 if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1120                     pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1121                         printf(" states");
1122                 else
1123                         printf("s");
1124                 printf("\n");
1125         }
1126         return (0);
1127
1128 }
1129
1130 int
1131 pfctl_show_limits(int dev, int opts)
1132 {
1133         struct pfioc_limit pl;
1134         int i;
1135
1136         if (opts & PF_OPT_SHOWALL)
1137                 pfctl_print_title("LIMITS:");
1138         memset(&pl, 0, sizeof(pl));
1139         for (i = 0; pf_limits[i].name; i++) {
1140                 pl.index = pf_limits[i].index;
1141                 if (ioctl(dev, DIOCGETLIMIT, &pl))
1142                         err(1, "DIOCGETLIMIT");
1143                 printf("%-13s ", pf_limits[i].name);
1144                 if (pl.limit == UINT_MAX)
1145                         printf("unlimited\n");
1146                 else
1147                         printf("hard limit %8u\n", pl.limit);
1148         }
1149         return (0);
1150 }
1151
1152 /* callbacks for rule/nat/rdr/addr */
1153 int
1154 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1155 {
1156         struct pf_pooladdr *pa;
1157
1158         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1159                 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1160                         err(1, "DIOCBEGINADDRS");
1161         }
1162
1163         pf->paddr.af = af;
1164         TAILQ_FOREACH(pa, &p->list, entries) {
1165                 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1166                 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1167                         if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1168                                 err(1, "DIOCADDADDR");
1169                 }
1170         }
1171         return (0);
1172 }
1173
1174 int
1175 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1176 {
1177         u_int8_t                rs_num;
1178         struct pf_rule          *rule;
1179         struct pf_ruleset       *rs;
1180         char                    *p;
1181
1182         rs_num = pf_get_ruleset_number(r->action);
1183         if (rs_num == PF_RULESET_MAX)
1184                 errx(1, "Invalid rule type %d", r->action);
1185
1186         rs = &pf->anchor->ruleset;
1187
1188         if (anchor_call[0] && r->anchor == NULL) {
1189                 /*
1190                  * Don't make non-brace anchors part of the main anchor pool.
1191                  */
1192                 if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1193                         err(1, "pfctl_add_rule: calloc");
1194
1195                 pf_init_ruleset(&r->anchor->ruleset);
1196                 r->anchor->ruleset.anchor = r->anchor;
1197                 if (strlcpy(r->anchor->path, anchor_call,
1198                     sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1199                         errx(1, "pfctl_add_rule: strlcpy");
1200                 if ((p = strrchr(anchor_call, '/')) != NULL) {
1201                         if (!strlen(p))
1202                                 err(1, "pfctl_add_rule: bad anchor name %s",
1203                                     anchor_call);
1204                 } else
1205                         p = __DECONST(char *, anchor_call);
1206                 if (strlcpy(r->anchor->name, p,
1207                     sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1208                         errx(1, "pfctl_add_rule: strlcpy");
1209         }
1210
1211         if ((rule = calloc(1, sizeof(*rule))) == NULL)
1212                 err(1, "calloc");
1213         bcopy(r, rule, sizeof(*rule));
1214         TAILQ_INIT(&rule->rpool.list);
1215         pfctl_move_pool(&r->rpool, &rule->rpool);
1216
1217         TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1218         return (0);
1219 }
1220
1221 int
1222 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1223 {
1224         int osize = pf->trans->pfrb_size;
1225
1226         if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1227                 if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1228                     pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1229                     pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1230                         return (1);
1231         }
1232         if (a == pf->astack[0] && ((altqsupport &&
1233              (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1234                 if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1235                         return (2);
1236         }
1237         if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1238                 if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1239                     pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1240                         return (3);
1241         }
1242         if (pf->loadopt & PFCTL_FLAG_TABLE)
1243                 if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1244                         return (4);
1245         if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1246                 return (5);
1247
1248         return (0);
1249 }
1250
1251 int
1252 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1253     int rs_num, int depth)
1254 {
1255         struct pf_rule *r;
1256         int             error, len = strlen(path);
1257         int             brace = 0;
1258
1259         pf->anchor = rs->anchor;
1260
1261         if (path[0])
1262                 snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1263         else
1264                 snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1265
1266         if (depth) {
1267                 if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1268                         brace++;
1269                         if (pf->opts & PF_OPT_VERBOSE)
1270                                 printf(" {\n");
1271                         if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1272                             (error = pfctl_ruleset_trans(pf,
1273                             path, rs->anchor))) {
1274                                 printf("pfctl_load_rulesets: "
1275                                     "pfctl_ruleset_trans %d\n", error);
1276                                 goto error;
1277                         }
1278                 } else if (pf->opts & PF_OPT_VERBOSE)
1279                         printf("\n");
1280
1281         }
1282
1283         if (pf->optimize && rs_num == PF_RULESET_FILTER)
1284                 pfctl_optimize_ruleset(pf, rs);
1285
1286         while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1287                 TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1288                 if ((error = pfctl_load_rule(pf, path, r, depth)))
1289                         goto error;
1290                 if (r->anchor) {
1291                         if ((error = pfctl_load_ruleset(pf, path,
1292                             &r->anchor->ruleset, rs_num, depth + 1)))
1293                                 goto error;
1294                 } else if (pf->opts & PF_OPT_VERBOSE)
1295                         printf("\n");
1296                 free(r);
1297         }
1298         if (brace && pf->opts & PF_OPT_VERBOSE) {
1299                 INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1300                 printf("}\n");
1301         }
1302         path[len] = '\0';
1303         return (0);
1304
1305  error:
1306         path[len] = '\0';
1307         return (error);
1308
1309 }
1310
1311 int
1312 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1313 {
1314         u_int8_t                rs_num = pf_get_ruleset_number(r->action);
1315         char                    *name;
1316         struct pfioc_rule       pr;
1317         int                     len = strlen(path);
1318
1319         bzero(&pr, sizeof(pr));
1320         /* set up anchor before adding to path for anchor_call */
1321         if ((pf->opts & PF_OPT_NOACTION) == 0)
1322                 pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1323         if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1324                 errx(1, "pfctl_load_rule: strlcpy");
1325
1326         if (r->anchor) {
1327                 if (r->anchor->match) {
1328                         if (path[0])
1329                                 snprintf(&path[len], MAXPATHLEN - len,
1330                                     "/%s", r->anchor->name);
1331                         else
1332                                 snprintf(&path[len], MAXPATHLEN - len,
1333                                     "%s", r->anchor->name);
1334                         name = path;
1335                 } else
1336                         name = r->anchor->path;
1337         } else
1338                 name = __DECONST(char *, "");
1339
1340         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1341                 if (pfctl_add_pool(pf, &r->rpool, r->af))
1342                         return (1);
1343                 pr.pool_ticket = pf->paddr.ticket;
1344                 memcpy(&pr.rule, r, sizeof(pr.rule));
1345                 if (r->anchor && strlcpy(pr.anchor_call, name,
1346                     sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1347                         errx(1, "pfctl_load_rule: strlcpy");
1348                 if (ioctl(pf->dev, DIOCADDRULE, &pr))
1349                         err(1, "DIOCADDRULE");
1350         }
1351
1352         if (pf->opts & PF_OPT_VERBOSE) {
1353                 INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1354                 print_rule(r, r->anchor ? r->anchor->name : "",
1355                     pf->opts & PF_OPT_VERBOSE2);
1356         }
1357         path[len] = '\0';
1358         pfctl_clear_pool(&r->rpool);
1359         return (0);
1360 }
1361
1362 int
1363 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1364 {
1365         if (altqsupport &&
1366             (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1367                 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1368                 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1369                         if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1370                                 if (errno == ENXIO)
1371                                         errx(1, "qtype not configured");
1372                                 else if (errno == ENODEV)
1373                                         errx(1, "%s: driver does not support "
1374                                             "altq", a->ifname);
1375                                 else
1376                                         err(1, "DIOCADDALTQ");
1377                         }
1378                 }
1379                 pfaltq_store(&pf->paltq->altq);
1380         }
1381         return (0);
1382 }
1383
1384 int
1385 pfctl_rules(int dev, char *filename, int opts, int optimize,
1386     char *anchorname, struct pfr_buffer *trans)
1387 {
1388 #define ERR(x) do { warn(x); goto _error; } while(0)
1389 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1390
1391         struct pfr_buffer       *t, buf;
1392         struct pfioc_altq        pa;
1393         struct pfctl             pf;
1394         struct pf_ruleset       *rs;
1395         struct pfr_table         trs;
1396         char                    *path;
1397         int                      osize;
1398
1399         RB_INIT(&pf_anchors);
1400         memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1401         pf_init_ruleset(&pf_main_anchor.ruleset);
1402         pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1403         if (trans == NULL) {
1404                 bzero(&buf, sizeof(buf));
1405                 buf.pfrb_type = PFRB_TRANS;
1406                 t = &buf;
1407                 osize = 0;
1408         } else {
1409                 t = trans;
1410                 osize = t->pfrb_size;
1411         }
1412
1413         memset(&pa, 0, sizeof(pa));
1414         memset(&pf, 0, sizeof(pf));
1415         memset(&trs, 0, sizeof(trs));
1416         if ((path = calloc(1, MAXPATHLEN)) == NULL)
1417                 ERRX("pfctl_rules: calloc");
1418         if (strlcpy(trs.pfrt_anchor, anchorname,
1419             sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1420                 ERRX("pfctl_rules: strlcpy");
1421         pf.dev = dev;
1422         pf.opts = opts;
1423         pf.optimize = optimize;
1424         pf.loadopt = loadopt;
1425
1426         /* non-brace anchor, create without resolving the path */
1427         if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1428                 ERRX("pfctl_rules: calloc");
1429         rs = &pf.anchor->ruleset;
1430         pf_init_ruleset(rs);
1431         rs->anchor = pf.anchor;
1432         if (strlcpy(pf.anchor->path, anchorname,
1433             sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1434                 errx(1, "pfctl_add_rule: strlcpy");
1435         if (strlcpy(pf.anchor->name, anchorname,
1436             sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1437                 errx(1, "pfctl_add_rule: strlcpy");
1438
1439
1440         pf.astack[0] = pf.anchor;
1441         pf.asd = 0;
1442         if (anchorname[0])
1443                 pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1444         pf.paltq = &pa;
1445         pf.trans = t;
1446         pfctl_init_options(&pf);
1447
1448         if ((opts & PF_OPT_NOACTION) == 0) {
1449                 /*
1450                  * XXX For the time being we need to open transactions for
1451                  * the main ruleset before parsing, because tables are still
1452                  * loaded at parse time.
1453                  */
1454                 if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1455                         ERRX("pfctl_rules");
1456                 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1457                         pa.ticket =
1458                             pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1459                 if (pf.loadopt & PFCTL_FLAG_TABLE)
1460                         pf.astack[0]->ruleset.tticket =
1461                             pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1462         }
1463
1464         if (parse_config(filename, &pf) < 0) {
1465                 if ((opts & PF_OPT_NOACTION) == 0)
1466                         ERRX("Syntax error in config file: "
1467                             "pf rules not loaded");
1468                 else
1469                         goto _error;
1470         }
1471
1472         if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1473             (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1474             (pf.loadopt & PFCTL_FLAG_NAT &&
1475             (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1476             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1477             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1478             (pf.loadopt & PFCTL_FLAG_FILTER &&
1479             pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1480                 if ((opts & PF_OPT_NOACTION) == 0)
1481                         ERRX("Unable to load rules into kernel");
1482                 else
1483                         goto _error;
1484         }
1485
1486         if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1487                 if (check_commit_altq(dev, opts) != 0)
1488                         ERRX("errors in altq config");
1489
1490         /* process "load anchor" directives */
1491         if (!anchorname[0])
1492                 if (pfctl_load_anchors(dev, &pf, t) == -1)
1493                         ERRX("load anchors");
1494
1495         if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1496                 if (!anchorname[0])
1497                         if (pfctl_load_options(&pf))
1498                                 goto _error;
1499                 if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1500                         ERR("DIOCXCOMMIT");
1501         }
1502         return (0);
1503
1504 _error:
1505         if (trans == NULL) {    /* main ruleset */
1506                 if ((opts & PF_OPT_NOACTION) == 0)
1507                         if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1508                                 err(1, "DIOCXROLLBACK");
1509                 exit(1);
1510         } else {                /* sub ruleset */
1511                 return (-1);
1512         }
1513
1514 #undef ERR
1515 #undef ERRX
1516 }
1517
1518 FILE *
1519 pfctl_fopen(const char *name, const char *mode)
1520 {
1521         struct stat      st;
1522         FILE            *fp;
1523
1524         fp = fopen(name, mode);
1525         if (fp == NULL)
1526                 return (NULL);
1527         if (fstat(fileno(fp), &st)) {
1528                 fclose(fp);
1529                 return (NULL);
1530         }
1531         if (S_ISDIR(st.st_mode)) {
1532                 fclose(fp);
1533                 errno = EISDIR;
1534                 return (NULL);
1535         }
1536         return (fp);
1537 }
1538
1539 void
1540 pfctl_init_options(struct pfctl *pf)
1541 {
1542         int64_t mem;
1543         int mib[2];
1544         size_t size;
1545
1546         pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1547         pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1548         pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1549         pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1550         pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1551         pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1552         pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1553         pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1554         pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1555         pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1556         pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1557         pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1558         pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1559         pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1560         pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1561         pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1562         pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1563         pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1564         pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1565         pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1566
1567         pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1568         pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1569         pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1570         pf->limit[PF_LIMIT_TABLES] = PFR_KTABLE_HIWAT;
1571         pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1572
1573         mib[0] = CTL_HW;
1574         mib[1] = HW_PHYSMEM;
1575         size = sizeof(mem);
1576         if (sysctl(mib, 2, &mem, &size, NULL, 0) == -1)
1577                 err(1, "sysctl");
1578         if (mem <= 100*1024*1024)
1579                 pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT_SMALL;
1580
1581         pf->debug = PF_DEBUG_URGENT;
1582 }
1583
1584 int
1585 pfctl_load_options(struct pfctl *pf)
1586 {
1587         int i, error = 0;
1588
1589         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1590                 return (0);
1591
1592         /* load limits */
1593         for (i = 0; i < PF_LIMIT_MAX; i++) {
1594                 if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1595                         continue;
1596                 if (pfctl_load_limit(pf, i, pf->limit[i]))
1597                         error = 1;
1598         }
1599
1600         /*
1601          * If we've set the limit, but haven't explicitly set adaptive
1602          * timeouts, do it now with a start of 60% and end of 120%.
1603          */
1604         if (pf->limit_set[PF_LIMIT_STATES] &&
1605             !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1606             !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1607                 pf->timeout[PFTM_ADAPTIVE_START] =
1608                         (pf->limit[PF_LIMIT_STATES] / 10) * 6;
1609                 pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1610                 pf->timeout[PFTM_ADAPTIVE_END] =
1611                         (pf->limit[PF_LIMIT_STATES] / 10) * 12;
1612                 pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1613         }
1614
1615         /* load timeouts */
1616         for (i = 0; i < PFTM_MAX; i++) {
1617                 if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1618                         continue;
1619                 if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1620                         error = 1;
1621         }
1622
1623         /* load debug */
1624         if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1625                 if (pfctl_load_debug(pf, pf->debug))
1626                         error = 1;
1627
1628         /* load logif */
1629         if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1630                 if (pfctl_load_logif(pf, pf->ifname))
1631                         error = 1;
1632
1633         /* load hostid */
1634         if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1635                 if (pfctl_load_hostid(pf, pf->hostid))
1636                         error = 1;
1637
1638         return (error);
1639 }
1640
1641 int
1642 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1643 {
1644         int i;
1645
1646
1647         for (i = 0; pf_limits[i].name; i++) {
1648                 if (strcasecmp(opt, pf_limits[i].name) == 0) {
1649                         pf->limit[pf_limits[i].index] = limit;
1650                         pf->limit_set[pf_limits[i].index] = 1;
1651                         break;
1652                 }
1653         }
1654         if (pf_limits[i].name == NULL) {
1655                 warnx("Bad pool name.");
1656                 return (1);
1657         }
1658
1659         if (pf->opts & PF_OPT_VERBOSE)
1660                 printf("set limit %s %d\n", opt, limit);
1661
1662         return (0);
1663 }
1664
1665 int
1666 pfctl_load_limit(struct pfctl *pf, unsigned int his_index, unsigned int limit)
1667 {
1668         struct pfioc_limit pl;
1669
1670         memset(&pl, 0, sizeof(pl));
1671         pl.index = his_index;
1672         pl.limit = limit;
1673         if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1674                 if (errno == EBUSY)
1675                         warnx("Current pool size exceeds requested hard limit");
1676                 else
1677                         warnx("DIOCSETLIMIT");
1678                 return (1);
1679         }
1680         return (0);
1681 }
1682
1683 int
1684 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1685 {
1686         int i;
1687
1688         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1689                 return (0);
1690
1691         for (i = 0; pf_timeouts[i].name; i++) {
1692                 if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1693                         pf->timeout[pf_timeouts[i].timeout] = seconds;
1694                         pf->timeout_set[pf_timeouts[i].timeout] = 1;
1695                         break;
1696                 }
1697         }
1698
1699         if (pf_timeouts[i].name == NULL) {
1700                 warnx("Bad timeout name.");
1701                 return (1);
1702         }
1703
1704
1705         if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1706                 printf("set timeout %s %d\n", opt, seconds);
1707
1708         return (0);
1709 }
1710
1711 int
1712 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1713 {
1714         struct pfioc_tm pt;
1715
1716         memset(&pt, 0, sizeof(pt));
1717         pt.timeout = timeout;
1718         pt.seconds = seconds;
1719         if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1720                 warnx("DIOCSETTIMEOUT");
1721                 return (1);
1722         }
1723         return (0);
1724 }
1725
1726 int
1727 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1728 {
1729         const struct pf_hint *hint;
1730         int i, r;
1731
1732         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1733                 return (0);
1734
1735         for (i = 0; pf_hints[i].name; i++)
1736                 if (strcasecmp(opt, pf_hints[i].name) == 0)
1737                         break;
1738
1739         hint = pf_hints[i].hint;
1740         if (hint == NULL) {
1741                 warnx("invalid state timeouts optimization");
1742                 return (1);
1743         }
1744
1745         for (i = 0; hint[i].name; i++)
1746                 if ((r = pfctl_set_timeout(pf, hint[i].name,
1747                     hint[i].timeout, 1)))
1748                         return (r);
1749
1750         if (pf->opts & PF_OPT_VERBOSE)
1751                 printf("set optimization %s\n", opt);
1752
1753         return (0);
1754 }
1755
1756 int
1757 pfctl_set_logif(struct pfctl *pf, char *ifname)
1758 {
1759
1760         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1761                 return (0);
1762
1763         if (!strcmp(ifname, "none")) {
1764                 free(pf->ifname);
1765                 pf->ifname = NULL;
1766         } else {
1767                 pf->ifname = strdup(ifname);
1768                 if (!pf->ifname)
1769                         errx(1, "pfctl_set_logif: strdup");
1770         }
1771         pf->ifname_set = 1;
1772
1773         if (pf->opts & PF_OPT_VERBOSE)
1774                 printf("set loginterface %s\n", ifname);
1775
1776         return (0);
1777 }
1778
1779 int
1780 pfctl_load_logif(struct pfctl *pf, char *ifname)
1781 {
1782         struct pfioc_if pi;
1783
1784         memset(&pi, 0, sizeof(pi));
1785         if (ifname && strlcpy(pi.ifname, ifname,
1786             sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1787                 warnx("pfctl_load_logif: strlcpy");
1788                 return (1);
1789         }
1790         if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1791                 warnx("DIOCSETSTATUSIF");
1792                 return (1);
1793         }
1794         return (0);
1795 }
1796
1797 int
1798 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1799 {
1800         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1801                 return (0);
1802
1803         hostid = htonl(hostid);
1804
1805         pf->hostid = hostid;
1806         pf->hostid_set = 1;
1807
1808         if (pf->opts & PF_OPT_VERBOSE)
1809                 printf("set hostid 0x%08x\n", ntohl(hostid));
1810
1811         return (0);
1812 }
1813
1814 int
1815 pfctl_load_hostid(struct pfctl *pf __unused, u_int32_t hostid)
1816 {
1817         if (ioctl(dev_fd, DIOCSETHOSTID, &hostid)) {
1818                 warnx("DIOCSETHOSTID");
1819                 return (1);
1820         }
1821         return (0);
1822 }
1823
1824 int
1825 pfctl_set_debug(struct pfctl *pf, char *d)
1826 {
1827         u_int32_t       level;
1828
1829         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1830                 return (0);
1831
1832         if (!strcmp(d, "none"))
1833                 pf->debug = PF_DEBUG_NONE;
1834         else if (!strcmp(d, "urgent"))
1835                 pf->debug = PF_DEBUG_URGENT;
1836         else if (!strcmp(d, "misc"))
1837                 pf->debug = PF_DEBUG_MISC;
1838         else if (!strcmp(d, "loud"))
1839                 pf->debug = PF_DEBUG_NOISY;
1840         else {
1841                 warnx("unknown debug level \"%s\"", d);
1842                 return (-1);
1843         }
1844
1845         pf->debug_set = 1;
1846
1847         if ((pf->opts & PF_OPT_NOACTION) == 0)
1848                 if (ioctl(dev_fd, DIOCSETDEBUG, &level))
1849                         err(1, "DIOCSETDEBUG");
1850
1851         if (pf->opts & PF_OPT_VERBOSE)
1852                 printf("set debug %s\n", d);
1853
1854         return (0);
1855 }
1856
1857 int
1858 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1859 {
1860         if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1861                 warnx("DIOCSETDEBUG");
1862                 return (1);
1863         }
1864         return (0);
1865 }
1866
1867 int
1868 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1869 {
1870         struct pfioc_iface      pi;
1871
1872         if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1873                 return (0);
1874
1875         bzero(&pi, sizeof(pi));
1876
1877         pi.pfiio_flags = flags;
1878
1879         if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1880             sizeof(pi.pfiio_name))
1881                 errx(1, "pfctl_set_interface_flags: strlcpy");
1882
1883         if ((pf->opts & PF_OPT_NOACTION) == 0) {
1884                 if (how == 0) {
1885                         if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1886                                 err(1, "DIOCCLRIFFLAG");
1887                 } else {
1888                         if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1889                                 err(1, "DIOCSETIFFLAG");
1890                 }
1891         }
1892         return (0);
1893 }
1894
1895 void
1896 pfctl_debug(int dev, u_int32_t level, int opts)
1897 {
1898         if (ioctl(dev, DIOCSETDEBUG, &level))
1899                 err(1, "DIOCSETDEBUG");
1900         if ((opts & PF_OPT_QUIET) == 0) {
1901                 fprintf(stderr, "debug level set to '");
1902                 switch (level) {
1903                 case PF_DEBUG_NONE:
1904                         fprintf(stderr, "none");
1905                         break;
1906                 case PF_DEBUG_URGENT:
1907                         fprintf(stderr, "urgent");
1908                         break;
1909                 case PF_DEBUG_MISC:
1910                         fprintf(stderr, "misc");
1911                         break;
1912                 case PF_DEBUG_NOISY:
1913                         fprintf(stderr, "loud");
1914                         break;
1915                 default:
1916                         fprintf(stderr, "<invalid>");
1917                         break;
1918                 }
1919                 fprintf(stderr, "'\n");
1920         }
1921 }
1922
1923 int
1924 pfctl_test_altqsupport(int dev, int opts)
1925 {
1926         struct pfioc_altq pa;
1927
1928         if (ioctl(dev, DIOCGETALTQS, &pa)) {
1929                 if (errno == ENODEV) {
1930                         if (!(opts & PF_OPT_QUIET))
1931                                 fprintf(stderr, "No ALTQ support in kernel\n"
1932                                     "ALTQ related functions disabled\n");
1933                         return (0);
1934                 } else
1935                         err(1, "DIOCGETALTQS");
1936         }
1937         return (1);
1938 }
1939
1940 int
1941 pfctl_show_anchors(int dev, int opts, char *anchorname)
1942 {
1943         struct pfioc_ruleset     pr;
1944         u_int32_t                mnr, nr;
1945
1946         memset(&pr, 0, sizeof(pr));
1947         memcpy(pr.path, anchorname, sizeof(pr.path));
1948         if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1949                 if (errno == EINVAL)
1950                         fprintf(stderr, "Anchor '%s' not found.\n",
1951                             anchorname);
1952                 else
1953                         err(1, "DIOCGETRULESETS");
1954                 return (-1);
1955         }
1956         mnr = pr.nr;
1957         for (nr = 0; nr < mnr; ++nr) {
1958                 char sub[MAXPATHLEN];
1959
1960                 pr.nr = nr;
1961                 if (ioctl(dev, DIOCGETRULESET, &pr))
1962                         err(1, "DIOCGETRULESET");
1963                 if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1964                         continue;
1965                 sub[0] = 0;
1966                 if (pr.path[0]) {
1967                         strlcat(sub, pr.path, sizeof(sub));
1968                         strlcat(sub, "/", sizeof(sub));
1969                 }
1970                 strlcat(sub, pr.name, sizeof(sub));
1971                 if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1972                         printf("  %s\n", sub);
1973                 if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1974                         return (-1);
1975         }
1976         return (0);
1977 }
1978
1979 const char *
1980 pfctl_lookup_option(char *cmd, const char **list)
1981 {
1982         if (cmd != NULL && *cmd)
1983                 for (; *list; list++)
1984                         if (!strncmp(cmd, *list, strlen(cmd)))
1985                                 return (*list);
1986         return (NULL);
1987 }
1988
1989 int
1990 main(int argc, char *argv[])
1991 {
1992         int      error = 0;
1993         int      ch;
1994         int      mode = O_RDONLY;
1995         int      opts = 0;
1996         int      optimize = PF_OPTIMIZE_BASIC;
1997         char     anchorname[MAXPATHLEN];
1998         char    *path;
1999
2000         if (argc < 2)
2001                 usage();
2002
2003         while ((ch = getopt(argc, argv,
2004             "a:AdD:eqf:F:ghi:k:K:mnNOo:p:rRs:t:T:vx:z")) != -1) {
2005                 switch (ch) {
2006                 case 'a':
2007                         anchoropt = optarg;
2008                         break;
2009                 case 'd':
2010                         opts |= PF_OPT_DISABLE;
2011                         mode = O_RDWR;
2012                         break;
2013                 case 'D':
2014                         if (pfctl_cmdline_symset(optarg) < 0)
2015                                 warnx("could not parse macro definition %s",
2016                                     optarg);
2017                         break;
2018                 case 'e':
2019                         opts |= PF_OPT_ENABLE;
2020                         mode = O_RDWR;
2021                         break;
2022                 case 'q':
2023                         opts |= PF_OPT_QUIET;
2024                         break;
2025                 case 'F':
2026                         clearopt = pfctl_lookup_option(optarg, clearopt_list);
2027                         if (clearopt == NULL) {
2028                                 warnx("Unknown flush modifier '%s'", optarg);
2029                                 usage();
2030                         }
2031                         mode = O_RDWR;
2032                         break;
2033                 case 'i':
2034                         ifaceopt = optarg;
2035                         break;
2036                 case 'k':
2037                         if (state_killers >= 2) {
2038                                 warnx("can only specify -k twice");
2039                                 usage();
2040                                 /* NOTREACHED */
2041                         }
2042                         state_kill[state_killers++] = optarg;
2043                         mode = O_RDWR;
2044                         break;
2045                 case 'K':
2046                         if (src_node_killers >= 2) {
2047                                 warnx("can only specify -K twice");
2048                                 usage();
2049                                 /* NOTREACHED */
2050                         }
2051                         src_node_kill[src_node_killers++] = optarg;
2052                         mode = O_RDWR;
2053                         break;
2054                 case 'm':
2055                         opts |= PF_OPT_MERGE;
2056                         break;
2057                 case 'n':
2058                         opts |= PF_OPT_NOACTION;
2059                         break;
2060                 case 'N':
2061                         loadopt |= PFCTL_FLAG_NAT;
2062                         break;
2063                 case 'r':
2064                         opts |= PF_OPT_USEDNS;
2065                         break;
2066                 case 'f':
2067                         rulesopt = optarg;
2068                         mode = O_RDWR;
2069                         break;
2070                 case 'g':
2071                         opts |= PF_OPT_DEBUG;
2072                         break;
2073                 case 'A':
2074                         loadopt |= PFCTL_FLAG_ALTQ;
2075                         break;
2076                 case 'R':
2077                         loadopt |= PFCTL_FLAG_FILTER;
2078                         break;
2079                 case 'o':
2080                         optiopt = pfctl_lookup_option(optarg, optiopt_list);
2081                         if (optiopt == NULL) {
2082                                 warnx("Unknown optimization '%s'", optarg);
2083                                 usage();
2084                         }
2085                         opts |= PF_OPT_OPTIMIZE;
2086                         break;
2087                 case 'O':
2088                         loadopt |= PFCTL_FLAG_OPTION;
2089                         break;
2090                 case 'p':
2091                         pf_device = optarg;
2092                         break;
2093                 case 's':
2094                         showopt = pfctl_lookup_option(optarg, showopt_list);
2095                         if (showopt == NULL) {
2096                                 warnx("Unknown show modifier '%s'", optarg);
2097                                 usage();
2098                         }
2099                         break;
2100                 case 't':
2101                         tableopt = optarg;
2102                         break;
2103                 case 'T':
2104                         tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2105                         if (tblcmdopt == NULL) {
2106                                 warnx("Unknown table command '%s'", optarg);
2107                                 usage();
2108                         }
2109                         break;
2110                 case 'v':
2111                         if (opts & PF_OPT_VERBOSE)
2112                                 opts |= PF_OPT_VERBOSE2;
2113                         opts |= PF_OPT_VERBOSE;
2114                         break;
2115                 case 'x':
2116                         debugopt = pfctl_lookup_option(optarg, debugopt_list);
2117                         if (debugopt == NULL) {
2118                                 warnx("Unknown debug level '%s'", optarg);
2119                                 usage();
2120                         }
2121                         mode = O_RDWR;
2122                         break;
2123                 case 'z':
2124                         opts |= PF_OPT_CLRRULECTRS;
2125                         mode = O_RDWR;
2126                         break;
2127                 case 'h':
2128                         /* FALLTHROUGH */
2129                 default:
2130                         usage();
2131                         /* NOTREACHED */
2132                 }
2133         }
2134
2135         if (tblcmdopt != NULL) {
2136                 argc -= optind;
2137                 argv += optind;
2138                 ch = *tblcmdopt;
2139                 if (ch == 'l') {
2140                         loadopt |= PFCTL_FLAG_TABLE;
2141                         tblcmdopt = NULL;
2142                 } else
2143                         mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2144         } else if (argc != optind) {
2145                 warnx("unknown command line argument: %s ...", argv[optind]);
2146                 usage();
2147                 /* NOTREACHED */
2148         }
2149         if (loadopt == 0)
2150                 loadopt = ~0;
2151
2152         if ((path = calloc(1, MAXPATHLEN)) == NULL)
2153                 errx(1, "pfctl: calloc");
2154         memset(anchorname, 0, sizeof(anchorname));
2155         if (anchoropt != NULL) {
2156                 int len = strlen(anchoropt);
2157
2158                 if (anchoropt[len - 1] == '*') {
2159                         if (len >= 2 && anchoropt[len - 2] == '/')
2160                                 anchoropt[len - 2] = '\0';
2161                         else
2162                                 anchoropt[len - 1] = '\0';
2163                         opts |= PF_OPT_RECURSE;
2164                 }
2165                 if (strlcpy(anchorname, anchoropt,
2166                     sizeof(anchorname)) >= sizeof(anchorname))
2167                         errx(1, "anchor name '%s' too long",
2168                             anchoropt);
2169                 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2170         }
2171
2172         if ((opts & PF_OPT_NOACTION) == 0) {
2173                 dev_fd = open(pf_device, mode);
2174                 if (dev_fd == -1)
2175                         err(1, "%s", pf_device);
2176                 altqsupport = pfctl_test_altqsupport(dev_fd, opts);
2177         } else {
2178                 dev_fd = open(pf_device, O_RDONLY);
2179                 if (dev_fd >= 0)
2180                         opts |= PF_OPT_DUMMYACTION;
2181                 /* turn off options */
2182                 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2183                 clearopt = showopt = debugopt = NULL;
2184                 altqsupport = 1;
2185         }
2186
2187         if (opts & PF_OPT_DISABLE)
2188                 if (pfctl_disable(dev_fd, opts))
2189                         error = 1;
2190
2191         if (showopt != NULL) {
2192                 switch (*showopt) {
2193                 case 'A':
2194                         pfctl_show_anchors(dev_fd, opts, anchorname);
2195                         break;
2196                 case 'r':
2197                         pfctl_load_fingerprints(dev_fd, opts);
2198                         pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_RULES,
2199                             anchorname, 0);
2200                         break;
2201                 case 'l':
2202                         pfctl_load_fingerprints(dev_fd, opts);
2203                         pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_LABELS,
2204                             anchorname, 0);
2205                         break;
2206                 case 'n':
2207                         pfctl_load_fingerprints(dev_fd, opts);
2208                         pfctl_show_nat(dev_fd, opts, anchorname);
2209                         break;
2210                 case 'q':
2211                         pfctl_show_altq(dev_fd, ifaceopt, opts,
2212                             opts & PF_OPT_VERBOSE2);
2213                         break;
2214                 case 's':
2215                         pfctl_show_states(dev_fd, ifaceopt, opts);
2216                         break;
2217                 case 'S':
2218                         pfctl_show_src_nodes(dev_fd, opts);
2219                         break;
2220                 case 'i':
2221                         pfctl_show_status(dev_fd, opts);
2222                         break;
2223                 case 't':
2224                         pfctl_show_timeouts(dev_fd, opts);
2225                         break;
2226                 case 'm':
2227                         pfctl_show_limits(dev_fd, opts);
2228                         break;
2229                 case 'a':
2230                         opts |= PF_OPT_SHOWALL;
2231                         pfctl_load_fingerprints(dev_fd, opts);
2232
2233                         pfctl_show_nat(dev_fd, opts, anchorname);
2234                         pfctl_show_rules(dev_fd, path, opts, 0, anchorname, 0);
2235                         pfctl_show_altq(dev_fd, ifaceopt, opts, 0);
2236                         pfctl_show_states(dev_fd, ifaceopt, opts);
2237                         pfctl_show_src_nodes(dev_fd, opts);
2238                         pfctl_show_status(dev_fd, opts);
2239                         pfctl_show_rules(dev_fd, path, opts, 1, anchorname, 0);
2240                         pfctl_show_timeouts(dev_fd, opts);
2241                         pfctl_show_limits(dev_fd, opts);
2242                         pfctl_show_tables(anchorname, opts);
2243                         pfctl_show_fingerprints(opts);
2244                         break;
2245                 case 'T':
2246                         pfctl_show_tables(anchorname, opts);
2247                         break;
2248                 case 'o':
2249                         pfctl_load_fingerprints(dev_fd, opts);
2250                         pfctl_show_fingerprints(opts);
2251                         break;
2252                 case 'I':
2253                         pfctl_show_ifaces(ifaceopt, opts);
2254                         break;
2255                 }
2256         }
2257
2258         if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2259                 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_NOTHING,
2260                     anchorname, 0);
2261
2262         if (clearopt != NULL) {
2263                 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2264                         errx(1, "anchor names beginning with '_' cannot "
2265                             "be modified from the command line");
2266
2267                 switch (*clearopt) {
2268                 case 'r':
2269                         pfctl_clear_rules(dev_fd, opts, anchorname);
2270                         break;
2271                 case 'n':
2272                         pfctl_clear_nat(dev_fd, opts, anchorname);
2273                         break;
2274                 case 'q':
2275                         pfctl_clear_altq(dev_fd, opts);
2276                         break;
2277                 case 's':
2278                         pfctl_clear_states(dev_fd, ifaceopt, opts);
2279                         break;
2280                 case 'S':
2281                         pfctl_clear_src_nodes(dev_fd, opts);
2282                         break;
2283                 case 'i':
2284                         pfctl_clear_stats(dev_fd, opts);
2285                         break;
2286                 case 'a':
2287                         pfctl_clear_rules(dev_fd, opts, anchorname);
2288                         pfctl_clear_nat(dev_fd, opts, anchorname);
2289                         pfctl_clear_tables(anchorname, opts);
2290                         if (!*anchorname) {
2291                                 pfctl_clear_altq(dev_fd, opts);
2292                                 pfctl_clear_states(dev_fd, ifaceopt, opts);
2293                                 pfctl_clear_src_nodes(dev_fd, opts);
2294                                 pfctl_clear_stats(dev_fd, opts);
2295                                 pfctl_clear_fingerprints(dev_fd, opts);
2296                                 pfctl_clear_interface_flags(dev_fd, opts);
2297                         }
2298                         break;
2299                 case 'o':
2300                         pfctl_clear_fingerprints(dev_fd, opts);
2301                         break;
2302                 case 'T':
2303                         pfctl_clear_tables(anchorname, opts);
2304                         break;
2305                 }
2306         }
2307         if (state_killers) {
2308                 if (!strcmp(state_kill[0], "label"))
2309                         pfctl_label_kill_states(dev_fd, ifaceopt, opts);
2310                 else if (!strcmp(state_kill[0], "id"))
2311                         pfctl_id_kill_states(dev_fd, ifaceopt, opts);
2312                 else
2313                         pfctl_net_kill_states(dev_fd, ifaceopt, opts);
2314         }
2315
2316         if (src_node_killers)
2317                 pfctl_kill_src_nodes(dev_fd, ifaceopt, opts);
2318
2319         if (tblcmdopt != NULL) {
2320                 error = pfctl_command_tables(argc, argv, tableopt,
2321                     tblcmdopt, rulesopt, anchorname, opts);
2322                 rulesopt = NULL;
2323         }
2324         if (optiopt != NULL) {
2325                 switch (*optiopt) {
2326                 case 'n':
2327                         optimize = 0;
2328                         break;
2329                 case 'b':
2330                         optimize |= PF_OPTIMIZE_BASIC;
2331                         break;
2332                 case 'o':
2333                 case 'p':
2334                         optimize |= PF_OPTIMIZE_PROFILE;
2335                         break;
2336                 }
2337         }
2338
2339         if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2340             !anchorname[0])
2341                 if (pfctl_clear_interface_flags(dev_fd, opts | PF_OPT_QUIET))
2342                         error = 1;
2343
2344         if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2345             !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2346                 if (pfctl_file_fingerprints(dev_fd, opts, PF_OSFP_FILE))
2347                         error = 1;
2348
2349         if (rulesopt != NULL) {
2350                 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2351                         errx(1, "anchor names beginning with '_' cannot "
2352                             "be modified from the command line");
2353                 if (pfctl_rules(dev_fd, rulesopt, opts, optimize,
2354                     anchorname, NULL))
2355                         error = 1;
2356                 else if (!(opts & PF_OPT_NOACTION) &&
2357                     (loadopt & PFCTL_FLAG_TABLE))
2358                         warn_namespace_collision(NULL);
2359         }
2360
2361         if (opts & PF_OPT_ENABLE)
2362                 if (pfctl_enable(dev_fd, opts))
2363                         error = 1;
2364
2365         if (debugopt != NULL) {
2366                 switch (*debugopt) {
2367                 case 'n':
2368                         pfctl_debug(dev_fd, PF_DEBUG_NONE, opts);
2369                         break;
2370                 case 'u':
2371                         pfctl_debug(dev_fd, PF_DEBUG_URGENT, opts);
2372                         break;
2373                 case 'm':
2374                         pfctl_debug(dev_fd, PF_DEBUG_MISC, opts);
2375                         break;
2376                 case 'l':
2377                         pfctl_debug(dev_fd, PF_DEBUG_NOISY, opts);
2378                         break;
2379                 }
2380         }
2381
2382         exit(error);
2383 }