1 /* $OpenBSD: pfctl.c,v 1.277 2008/07/24 10:52:43 henning Exp $ */
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002,2003 Henning Brauer
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
34 #include <sys/types.h>
35 #include <sys/ioctl.h>
36 #include <sys/socket.h>
38 #include <sys/endian.h>
41 #include <netinet/in.h>
42 #include <net/pf/pfvar.h>
43 #include <arpa/inet.h>
44 #include <net/altq/altq.h>
45 #include <sys/sysctl.h>
58 #include "pfctl_parser.h"
62 int pfctl_enable(int, int);
63 int pfctl_disable(int, int);
64 int pfctl_clear_stats(int, int);
65 int pfctl_clear_interface_flags(int, int);
66 int pfctl_clear_rules(int, int, char *);
67 int pfctl_clear_nat(int, int, char *);
68 int pfctl_clear_altq(int, int);
69 int pfctl_clear_src_nodes(int, int);
70 int pfctl_clear_states(int, const char *, int);
71 void pfctl_addrprefix(char *, struct pf_addr *);
72 int pfctl_kill_src_nodes(int, const char *, int);
73 int pfctl_net_kill_states(int, const char *, int);
74 int pfctl_label_kill_states(int, const char *, int);
75 int pfctl_id_kill_states(int, const char *, int);
76 void pfctl_init_options(struct pfctl *);
77 int pfctl_load_options(struct pfctl *);
78 int pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
79 int pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
80 int pfctl_load_debug(struct pfctl *, unsigned int);
81 int pfctl_load_logif(struct pfctl *, char *);
82 int pfctl_load_hostid(struct pfctl *, unsigned int);
83 int pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
85 void pfctl_print_rule_counters(struct pf_rule *, int);
86 int pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
87 int pfctl_show_nat(int, int, char *);
88 int pfctl_show_src_nodes(int, int);
89 int pfctl_show_states(int, const char *, int);
90 int pfctl_show_status(int, int);
91 int pfctl_show_timeouts(int, int);
92 int pfctl_show_limits(int, int);
93 void pfctl_debug(int, u_int32_t, int);
94 int pfctl_test_altqsupport(int, int);
95 int pfctl_show_anchors(int, int, char *);
96 int pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
97 int pfctl_load_ruleset(struct pfctl *, char *,
98 struct pf_ruleset *, int, int);
99 int pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
100 const char *pfctl_lookup_option(char *, const char **);
102 struct pf_anchor_global pf_anchors;
103 struct pf_anchor pf_main_anchor;
105 const char *clearopt;
108 const char *debugopt;
110 const char *optiopt = NULL;
111 const char *pf_device = "/dev/pf";
114 const char *tblcmdopt;
115 int src_node_killers;
116 char *src_node_kill[2];
126 #define INDENT(d, o) do { \
129 for (i=0; i < d; i++) \
135 static const struct {
139 { "states", PF_LIMIT_STATES },
140 { "src-nodes", PF_LIMIT_SRC_NODES },
141 { "frags", PF_LIMIT_FRAGS },
142 { "tables", PF_LIMIT_TABLES },
143 { "table-entries", PF_LIMIT_TABLE_ENTRIES },
151 static const struct pf_hint pf_hint_normal[] = {
152 { "tcp.first", 2 * 60 },
153 { "tcp.opening", 30 },
154 { "tcp.established", 24 * 60 * 60 },
155 { "tcp.closing", 15 * 60 },
156 { "tcp.finwait", 45 },
157 { "tcp.closed", 90 },
158 { "tcp.tsdiff", 30 },
161 static const struct pf_hint pf_hint_satellite[] = {
162 { "tcp.first", 3 * 60 },
163 { "tcp.opening", 30 + 5 },
164 { "tcp.established", 24 * 60 * 60 },
165 { "tcp.closing", 15 * 60 + 5 },
166 { "tcp.finwait", 45 + 5 },
167 { "tcp.closed", 90 + 5 },
168 { "tcp.tsdiff", 60 },
171 static const struct pf_hint pf_hint_conservative[] = {
172 { "tcp.first", 60 * 60 },
173 { "tcp.opening", 15 * 60 },
174 { "tcp.established", 5 * 24 * 60 * 60 },
175 { "tcp.closing", 60 * 60 },
176 { "tcp.finwait", 10 * 60 },
177 { "tcp.closed", 3 * 60 },
178 { "tcp.tsdiff", 60 },
181 static const struct pf_hint pf_hint_aggressive[] = {
183 { "tcp.opening", 5 },
184 { "tcp.established", 5 * 60 * 60 },
185 { "tcp.closing", 60 },
186 { "tcp.finwait", 30 },
187 { "tcp.closed", 30 },
188 { "tcp.tsdiff", 10 },
192 static const struct {
194 const struct pf_hint *hint;
196 { "normal", pf_hint_normal },
197 { "satellite", pf_hint_satellite },
198 { "high-latency", pf_hint_satellite },
199 { "conservative", pf_hint_conservative },
200 { "aggressive", pf_hint_aggressive },
204 static const char *clearopt_list[] = {
205 "nat", "queue", "rules", "Sources",
206 "states", "info", "Tables", "osfp", "all", NULL
209 static const char *showopt_list[] = {
210 "nat", "queue", "rules", "Anchors", "Sources", "states", "info",
211 "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
215 static const char *tblcmdopt_list[] = {
216 "kill", "flush", "add", "delete", "load", "replace", "show",
217 "test", "zero", "expire", NULL
220 static const char *debugopt_list[] = {
221 "none", "urgent", "misc", "loud", NULL
224 static const char *optiopt_list[] = {
225 "none", "basic", "profile", NULL
231 fprintf(stderr, "usage: %s [-AdeghmNnOqRrvz] ", getprogname());
232 fprintf(stderr, "[-a anchor] [-D macro=value] [-F modifier]\n");
233 fprintf(stderr, "\t[-f file] [-i interface] [-K host | network] ");
234 fprintf(stderr, "[-k host | network | label | id]\n");
235 fprintf(stderr, "\t[-o level] [-p device] [-s modifier]\n");
236 fprintf(stderr, "\t[-t table -T command [address ...]] [-x level]\n");
241 pfctl_enable(int dev, int opts)
243 if (ioctl(dev, DIOCSTART)) {
245 errx(1, "pf already enabled");
249 if ((opts & PF_OPT_QUIET) == 0)
250 fprintf(stderr, "pf enabled\n");
252 if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
254 err(1, "DIOCSTARTALTQ");
260 pfctl_disable(int dev, int opts)
262 if (ioctl(dev, DIOCSTOP)) {
264 errx(1, "pf not enabled");
268 if ((opts & PF_OPT_QUIET) == 0)
269 fprintf(stderr, "pf disabled\n");
271 if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
273 err(1, "DIOCSTOPALTQ");
279 pfctl_clear_stats(int dev, int opts)
281 if (ioctl(dev, DIOCCLRSTATUS))
282 err(1, "DIOCCLRSTATUS");
283 if ((opts & PF_OPT_QUIET) == 0)
284 fprintf(stderr, "pf: statistics cleared\n");
289 pfctl_clear_interface_flags(int dev, int opts)
291 struct pfioc_iface pi;
293 if ((opts & PF_OPT_NOACTION) == 0) {
294 bzero(&pi, sizeof(pi));
295 pi.pfiio_flags = PFI_IFLAG_SKIP;
297 if (ioctl(dev, DIOCCLRIFFLAG, &pi))
298 err(1, "DIOCCLRIFFLAG");
299 if ((opts & PF_OPT_QUIET) == 0)
300 fprintf(stderr, "pf: interface flags reset\n");
306 pfctl_clear_rules(int dev, int opts, char *anchorname)
310 memset(&t, 0, sizeof(t));
311 t.pfrb_type = PFRB_TRANS;
312 if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
313 pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
314 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
315 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
316 err(1, "pfctl_clear_rules");
317 if ((opts & PF_OPT_QUIET) == 0)
318 fprintf(stderr, "rules cleared\n");
323 pfctl_clear_nat(int dev, int opts, char *anchorname)
327 memset(&t, 0, sizeof(t));
328 t.pfrb_type = PFRB_TRANS;
329 if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
330 pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
331 pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
332 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
333 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
334 err(1, "pfctl_clear_nat");
335 if ((opts & PF_OPT_QUIET) == 0)
336 fprintf(stderr, "nat cleared\n");
341 pfctl_clear_altq(int dev, int opts)
347 memset(&t, 0, sizeof(t));
348 t.pfrb_type = PFRB_TRANS;
349 if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
350 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
351 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
352 err(1, "pfctl_clear_altq");
353 if ((opts & PF_OPT_QUIET) == 0)
354 fprintf(stderr, "altq cleared\n");
359 pfctl_clear_src_nodes(int dev, int opts)
361 if (ioctl(dev, DIOCCLRSRCNODES))
362 err(1, "DIOCCLRSRCNODES");
363 if ((opts & PF_OPT_QUIET) == 0)
364 fprintf(stderr, "source tracking entries cleared\n");
369 pfctl_clear_states(int dev, const char *iface, int opts)
371 struct pfioc_state_kill psk;
373 memset(&psk, 0, sizeof(psk));
374 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
375 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
376 errx(1, "invalid interface: %s", iface);
378 if (ioctl(dev, DIOCCLRSTATES, &psk))
379 err(1, "DIOCCLRSTATES");
380 if ((opts & PF_OPT_QUIET) == 0)
381 fprintf(stderr, "%d states cleared\n", psk.psk_killed);
386 pfctl_addrprefix(char *addr, struct pf_addr *mask)
390 int prefix, ret_ga, q, r;
391 struct addrinfo hints, *res;
393 if ((p = strchr(addr, '/')) == NULL)
397 prefix = strtonum(p, 0, 128, &errstr);
399 errx(1, "prefix is %s: %s", errstr, p);
401 bzero(&hints, sizeof(hints));
402 /* prefix only with numeric addresses */
403 hints.ai_flags |= AI_NUMERICHOST;
405 if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
406 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
410 if (res->ai_family == AF_INET && prefix > 32)
411 errx(1, "prefix too long for AF_INET");
412 else if (res->ai_family == AF_INET6 && prefix > 128)
413 errx(1, "prefix too long for AF_INET6");
417 switch (res->ai_family) {
419 bzero(&mask->v4, sizeof(mask->v4));
420 mask->v4.s_addr = htonl((u_int32_t)
421 (0xffffffffffULL << (32 - prefix)));
424 bzero(&mask->v6, sizeof(mask->v6));
426 memset((void *)&mask->v6, 0xff, q);
428 *((u_char *)&mask->v6 + q) =
429 (0xff00 >> r) & 0xff;
436 pfctl_kill_src_nodes(int dev, const char *iface __unused, int opts)
438 struct pfioc_src_node_kill psnk;
439 struct addrinfo *res[2], *resp[2];
440 struct sockaddr last_src, last_dst;
441 int killed, sources, dests;
444 killed = sources = dests = 0;
446 memset(&psnk, 0, sizeof(psnk));
447 memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
448 sizeof(psnk.psnk_src.addr.v.a.mask));
449 memset(&last_src, 0xff, sizeof(last_src));
450 memset(&last_dst, 0xff, sizeof(last_dst));
452 pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
454 if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
455 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
458 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
459 if (resp[0]->ai_addr == NULL)
461 /* We get lots of duplicates. Catch the easy ones */
462 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
464 last_src = *(struct sockaddr *)resp[0]->ai_addr;
466 psnk.psnk_af = resp[0]->ai_family;
469 if (psnk.psnk_af == AF_INET)
470 psnk.psnk_src.addr.v.a.addr.v4 =
471 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
472 else if (psnk.psnk_af == AF_INET6)
473 psnk.psnk_src.addr.v.a.addr.v6 =
474 ((struct sockaddr_in6 *)resp[0]->ai_addr)->
477 errx(1, "Unknown address family %d", psnk.psnk_af);
479 if (src_node_killers > 1) {
481 memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
482 sizeof(psnk.psnk_dst.addr.v.a.mask));
483 memset(&last_dst, 0xff, sizeof(last_dst));
484 pfctl_addrprefix(src_node_kill[1],
485 &psnk.psnk_dst.addr.v.a.mask);
486 if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
488 errx(1, "getaddrinfo: %s",
489 gai_strerror(ret_ga));
492 for (resp[1] = res[1]; resp[1];
493 resp[1] = resp[1]->ai_next) {
494 if (resp[1]->ai_addr == NULL)
496 if (psnk.psnk_af != resp[1]->ai_family)
499 if (memcmp(&last_dst, resp[1]->ai_addr,
500 sizeof(last_dst)) == 0)
502 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
506 if (psnk.psnk_af == AF_INET)
507 psnk.psnk_dst.addr.v.a.addr.v4 =
508 ((struct sockaddr_in *)resp[1]->
510 else if (psnk.psnk_af == AF_INET6)
511 psnk.psnk_dst.addr.v.a.addr.v6 =
512 ((struct sockaddr_in6 *)resp[1]->
515 errx(1, "Unknown address family %d",
518 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
519 err(1, "DIOCKILLSRCNODES");
520 killed += psnk.psnk_killed;
522 freeaddrinfo(res[1]);
524 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
525 err(1, "DIOCKILLSRCNODES");
526 killed += psnk.psnk_killed;
530 freeaddrinfo(res[0]);
532 if ((opts & PF_OPT_QUIET) == 0)
533 fprintf(stderr, "killed %d src nodes from %d sources and %d "
534 "destinations\n", killed, sources, dests);
539 pfctl_net_kill_states(int dev, const char *iface, int opts)
541 struct pfioc_state_kill psk;
542 struct addrinfo *res[2], *resp[2];
543 struct sockaddr last_src, last_dst;
544 int killed, sources, dests;
547 killed = sources = dests = 0;
549 memset(&psk, 0, sizeof(psk));
550 memset(&psk.psk_src.addr.v.a.mask, 0xff,
551 sizeof(psk.psk_src.addr.v.a.mask));
552 memset(&last_src, 0xff, sizeof(last_src));
553 memset(&last_dst, 0xff, sizeof(last_dst));
554 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
555 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
556 errx(1, "invalid interface: %s", iface);
558 pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
560 if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
561 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
564 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
565 if (resp[0]->ai_addr == NULL)
567 /* We get lots of duplicates. Catch the easy ones */
568 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
570 last_src = *(struct sockaddr *)resp[0]->ai_addr;
572 psk.psk_af = resp[0]->ai_family;
575 if (psk.psk_af == AF_INET)
576 psk.psk_src.addr.v.a.addr.v4 =
577 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
578 else if (psk.psk_af == AF_INET6)
579 psk.psk_src.addr.v.a.addr.v6 =
580 ((struct sockaddr_in6 *)resp[0]->ai_addr)->
583 errx(1, "Unknown address family %d", psk.psk_af);
585 if (state_killers > 1) {
587 memset(&psk.psk_dst.addr.v.a.mask, 0xff,
588 sizeof(psk.psk_dst.addr.v.a.mask));
589 memset(&last_dst, 0xff, sizeof(last_dst));
590 pfctl_addrprefix(state_kill[1],
591 &psk.psk_dst.addr.v.a.mask);
592 if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
594 errx(1, "getaddrinfo: %s",
595 gai_strerror(ret_ga));
598 for (resp[1] = res[1]; resp[1];
599 resp[1] = resp[1]->ai_next) {
600 if (resp[1]->ai_addr == NULL)
602 if (psk.psk_af != resp[1]->ai_family)
605 if (memcmp(&last_dst, resp[1]->ai_addr,
606 sizeof(last_dst)) == 0)
608 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
612 if (psk.psk_af == AF_INET)
613 psk.psk_dst.addr.v.a.addr.v4 =
614 ((struct sockaddr_in *)resp[1]->
616 else if (psk.psk_af == AF_INET6)
617 psk.psk_dst.addr.v.a.addr.v6 =
618 ((struct sockaddr_in6 *)resp[1]->
621 errx(1, "Unknown address family %d",
624 if (ioctl(dev, DIOCKILLSTATES, &psk))
625 err(1, "DIOCKILLSTATES");
626 killed += psk.psk_killed;
628 freeaddrinfo(res[1]);
630 if (ioctl(dev, DIOCKILLSTATES, &psk))
631 err(1, "DIOCKILLSTATES");
632 killed += psk.psk_killed;
636 freeaddrinfo(res[0]);
638 if ((opts & PF_OPT_QUIET) == 0)
639 fprintf(stderr, "killed %d states from %d sources and %d "
640 "destinations\n", killed, sources, dests);
645 pfctl_label_kill_states(int dev, const char *iface, int opts)
647 struct pfioc_state_kill psk;
649 if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
650 warnx("no label specified");
653 memset(&psk, 0, sizeof(psk));
654 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
655 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
656 errx(1, "invalid interface: %s", iface);
658 if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
659 sizeof(psk.psk_label))
660 errx(1, "label too long: %s", state_kill[1]);
662 if (ioctl(dev, DIOCKILLSTATES, &psk))
663 err(1, "DIOCKILLSTATES");
665 if ((opts & PF_OPT_QUIET) == 0)
666 fprintf(stderr, "killed %d states\n", psk.psk_killed);
672 pfctl_id_kill_states(int dev, const char *iface, int opts)
674 struct pfioc_state_kill psk;
676 if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
677 warnx("no id specified");
681 memset(&psk, 0, sizeof(psk));
682 if ((sscanf(state_kill[1], "%" SCNx64 "/%x",
683 &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
684 psk.psk_pfcmp.creatorid=htonl(psk.psk_pfcmp.creatorid);
685 else if ((sscanf(state_kill[1], "%" SCNx64, &psk.psk_pfcmp.id)) == 1) {
686 psk.psk_pfcmp.creatorid = 0;
688 warnx("wrong id format specified");
691 if (psk.psk_pfcmp.id == 0) {
692 warnx("cannot kill id 0");
696 psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
697 if (ioctl(dev, DIOCKILLSTATES, &psk))
698 err(1, "DIOCKILLSTATES");
700 if ((opts & PF_OPT_QUIET) == 0)
701 fprintf(stderr, "killed %d states\n", psk.psk_killed);
707 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
708 u_int32_t ticket, int r_action, char *anchorname)
710 struct pfioc_pooladdr pp;
711 struct pf_pooladdr *pa;
714 memset(&pp, 0, sizeof(pp));
715 memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
716 pp.r_action = r_action;
719 if (ioctl(dev, DIOCGETADDRS, &pp)) {
720 warn("DIOCGETADDRS");
724 TAILQ_INIT(&pool->list);
725 for (pnr = 0; pnr < mpnr; ++pnr) {
727 if (ioctl(dev, DIOCGETADDR, &pp)) {
731 pa = calloc(1, sizeof(struct pf_pooladdr));
734 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
735 TAILQ_INSERT_TAIL(&pool->list, pa, entries);
742 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
744 struct pf_pooladdr *pa;
746 while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
747 TAILQ_REMOVE(&src->list, pa, entries);
748 TAILQ_INSERT_TAIL(&dst->list, pa, entries);
753 pfctl_clear_pool(struct pf_pool *pool)
755 struct pf_pooladdr *pa;
757 while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
758 TAILQ_REMOVE(&pool->list, pa, entries);
764 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
766 if (opts & PF_OPT_DEBUG) {
767 const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
768 "p", "sa", "sp", "da", "dp" };
771 printf(" [ Skip steps: ");
772 for (i = 0; i < PF_SKIP_COUNT; ++i) {
773 if (rule->skip[i].nr == rule->nr + 1)
776 if (rule->skip[i].nr == (uint32_t)(-1))
779 printf("%u ", rule->skip[i].nr);
783 printf(" [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
784 rule->qname, rule->qid, rule->pqname, rule->pqid);
786 if (opts & PF_OPT_VERBOSE) {
787 printf(" [ Evaluations: %-8llu Packets: %-8llu "
788 "Bytes: %-10llu States: %-6u]\n",
789 (unsigned long long)rule->evaluations,
790 (unsigned long long)(rule->packets[0] +
792 (unsigned long long)(rule->bytes[0] +
793 rule->bytes[1]), rule->states_cur);
794 if (!(opts & PF_OPT_DEBUG))
795 printf(" [ Inserted: uid %u pid %u "
796 "State Creations: %-6u]\n",
797 (unsigned)rule->cuid, (unsigned)rule->cpid,
803 pfctl_print_title(const char *title)
808 printf("%s\n", title);
812 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
813 char *anchorname, int depth)
815 struct pfioc_rule pr;
816 u_int32_t nr, mnr, header = 0;
817 int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
818 int len = strlen(path);
823 snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
825 snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
827 memset(&pr, 0, sizeof(pr));
828 memcpy(pr.anchor, path, sizeof(pr.anchor));
829 if (opts & PF_OPT_SHOWALL) {
830 pr.rule.action = PF_PASS;
831 if (ioctl(dev, DIOCGETRULES, &pr)) {
832 warn("DIOCGETRULES");
837 pr.rule.action = PF_SCRUB;
838 if (ioctl(dev, DIOCGETRULES, &pr)) {
839 warn("DIOCGETRULES");
842 if (opts & PF_OPT_SHOWALL) {
843 if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
844 pfctl_print_title("FILTER RULES:");
845 else if (format == PFCTL_SHOW_LABELS && labels)
846 pfctl_print_title("LABEL COUNTERS:");
849 if (opts & PF_OPT_CLRRULECTRS)
850 pr.action = PF_GET_CLR_CNTR;
852 for (nr = 0; nr < mnr; ++nr) {
854 if (ioctl(dev, DIOCGETRULE, &pr)) {
859 if (pfctl_get_pool(dev, &pr.rule.rpool,
860 nr, pr.ticket, PF_SCRUB, path) != 0)
864 case PFCTL_SHOW_LABELS:
866 case PFCTL_SHOW_RULES:
867 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
869 print_rule(&pr.rule, pr.anchor_call, rule_numbers);
871 pfctl_print_rule_counters(&pr.rule, opts);
873 case PFCTL_SHOW_NOTHING:
876 pfctl_clear_pool(&pr.rule.rpool);
878 pr.rule.action = PF_PASS;
879 if (ioctl(dev, DIOCGETRULES, &pr)) {
880 warn("DIOCGETRULES");
884 for (nr = 0; nr < mnr; ++nr) {
886 if (ioctl(dev, DIOCGETRULE, &pr)) {
891 if (pfctl_get_pool(dev, &pr.rule.rpool,
892 nr, pr.ticket, PF_PASS, path) != 0)
896 case PFCTL_SHOW_LABELS:
897 if (pr.rule.label[0]) {
898 printf("%s %llu %llu %llu %llu"
899 " %llu %llu %llu %llu\n",
901 (unsigned long long)pr.rule.evaluations,
902 (unsigned long long)(pr.rule.packets[0] +
904 (unsigned long long)(pr.rule.bytes[0] +
906 (unsigned long long)pr.rule.packets[0],
907 (unsigned long long)pr.rule.bytes[0],
908 (unsigned long long)pr.rule.packets[1],
909 (unsigned long long)pr.rule.bytes[1],
910 (unsigned long long)pr.rule.states_tot);
913 case PFCTL_SHOW_RULES:
915 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
917 INDENT(depth, !(opts & PF_OPT_VERBOSE));
918 if (pr.anchor_call[0] &&
919 ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
920 ((void *)p == (void *)pr.anchor_call ||
921 *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
923 if ((p = strrchr(pr.anchor_call, '/')) !=
927 p = &pr.anchor_call[0];
929 p = &pr.anchor_call[0];
931 print_rule(&pr.rule, p, rule_numbers);
936 pfctl_print_rule_counters(&pr.rule, opts);
938 pfctl_show_rules(dev, path, opts, format,
940 INDENT(depth, !(opts & PF_OPT_VERBOSE));
944 case PFCTL_SHOW_NOTHING:
947 pfctl_clear_pool(&pr.rule.rpool);
958 pfctl_show_nat(int dev, int opts, char *anchorname)
960 struct pfioc_rule pr;
962 static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
963 int i, dotitle = opts & PF_OPT_SHOWALL;
965 memset(&pr, 0, sizeof(pr));
966 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
967 for (i = 0; i < 3; i++) {
968 pr.rule.action = nattype[i];
969 if (ioctl(dev, DIOCGETRULES, &pr)) {
970 warn("DIOCGETRULES");
974 for (nr = 0; nr < mnr; ++nr) {
976 if (ioctl(dev, DIOCGETRULE, &pr)) {
980 if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
981 pr.ticket, nattype[i], anchorname) != 0)
984 pfctl_print_title("TRANSLATION RULES:");
987 print_rule(&pr.rule, pr.anchor_call,
988 opts & PF_OPT_VERBOSE2);
990 pfctl_print_rule_counters(&pr.rule, opts);
991 pfctl_clear_pool(&pr.rule.rpool);
998 pfctl_show_src_nodes(int dev, int opts)
1000 struct pfioc_src_nodes psn;
1001 struct pf_src_node *p;
1002 char *inbuf = NULL, *newinbuf = NULL;
1003 unsigned int len = 0;
1006 memset(&psn, 0, sizeof(psn));
1010 newinbuf = realloc(inbuf, len);
1011 if (newinbuf == NULL)
1013 psn.psn_buf = inbuf = newinbuf;
1015 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1016 warn("DIOCGETSRCNODES");
1020 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1022 if (len == 0 && psn.psn_len == 0)
1024 if (len == 0 && psn.psn_len != 0)
1026 if (psn.psn_len == 0)
1027 goto done; /* no src_nodes */
1030 p = psn.psn_src_nodes;
1031 if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1032 pfctl_print_title("SOURCE TRACKING NODES:");
1033 for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1034 print_src_node(p, opts);
1043 pfctl_show_states(int dev, const char *iface, int opts)
1045 struct pfioc_states ps;
1046 struct pfsync_state *p;
1047 char *inbuf = NULL, *newinbuf = NULL;
1048 unsigned int len = 0;
1049 int i, dotitle = (opts & PF_OPT_SHOWALL);
1051 memset(&ps, 0, sizeof(ps));
1055 newinbuf = realloc(inbuf, len);
1056 if (newinbuf == NULL)
1058 ps.ps_buf = inbuf = newinbuf;
1060 if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1061 warn("DIOCGETSTATES");
1065 if (ps.ps_len + sizeof(struct pfioc_states) < len)
1067 if (len == 0 && ps.ps_len == 0)
1069 if (len == 0 && ps.ps_len != 0)
1072 goto done; /* no states */
1076 for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1077 if (iface != NULL && strcmp(p->ifname, iface))
1080 pfctl_print_title("STATES:");
1083 print_state(p, opts);
1091 pfctl_show_status(int dev, int opts)
1093 struct pf_status status;
1095 if (ioctl(dev, DIOCGETSTATUS, &status)) {
1096 warn("DIOCGETSTATUS");
1099 if (opts & PF_OPT_SHOWALL)
1100 pfctl_print_title("INFO:");
1101 print_status(&status, opts);
1106 pfctl_show_timeouts(int dev, int opts)
1111 if (opts & PF_OPT_SHOWALL)
1112 pfctl_print_title("TIMEOUTS:");
1113 memset(&pt, 0, sizeof(pt));
1114 for (i = 0; pf_timeouts[i].name; i++) {
1115 pt.timeout = pf_timeouts[i].timeout;
1116 if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1117 err(1, "DIOCGETTIMEOUT");
1118 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1119 if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1120 pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1131 pfctl_show_limits(int dev, int opts)
1133 struct pfioc_limit pl;
1136 if (opts & PF_OPT_SHOWALL)
1137 pfctl_print_title("LIMITS:");
1138 memset(&pl, 0, sizeof(pl));
1139 for (i = 0; pf_limits[i].name; i++) {
1140 pl.index = pf_limits[i].index;
1141 if (ioctl(dev, DIOCGETLIMIT, &pl))
1142 err(1, "DIOCGETLIMIT");
1143 printf("%-13s ", pf_limits[i].name);
1144 if (pl.limit == UINT_MAX)
1145 printf("unlimited\n");
1147 printf("hard limit %8u\n", pl.limit);
1152 /* callbacks for rule/nat/rdr/addr */
1154 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1156 struct pf_pooladdr *pa;
1158 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1159 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1160 err(1, "DIOCBEGINADDRS");
1164 TAILQ_FOREACH(pa, &p->list, entries) {
1165 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1166 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1167 if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1168 err(1, "DIOCADDADDR");
1175 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1178 struct pf_rule *rule;
1179 struct pf_ruleset *rs;
1182 rs_num = pf_get_ruleset_number(r->action);
1183 if (rs_num == PF_RULESET_MAX)
1184 errx(1, "Invalid rule type %d", r->action);
1186 rs = &pf->anchor->ruleset;
1188 if (anchor_call[0] && r->anchor == NULL) {
1190 * Don't make non-brace anchors part of the main anchor pool.
1192 if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1193 err(1, "pfctl_add_rule: calloc");
1195 pf_init_ruleset(&r->anchor->ruleset);
1196 r->anchor->ruleset.anchor = r->anchor;
1197 if (strlcpy(r->anchor->path, anchor_call,
1198 sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1199 errx(1, "pfctl_add_rule: strlcpy");
1200 if ((p = strrchr(anchor_call, '/')) != NULL) {
1202 err(1, "pfctl_add_rule: bad anchor name %s",
1205 p = __DECONST(char *, anchor_call);
1206 if (strlcpy(r->anchor->name, p,
1207 sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1208 errx(1, "pfctl_add_rule: strlcpy");
1211 if ((rule = calloc(1, sizeof(*rule))) == NULL)
1213 bcopy(r, rule, sizeof(*rule));
1214 TAILQ_INIT(&rule->rpool.list);
1215 pfctl_move_pool(&r->rpool, &rule->rpool);
1217 TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1222 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1224 int osize = pf->trans->pfrb_size;
1226 if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1227 if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1228 pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1229 pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1232 if (a == pf->astack[0] && ((altqsupport &&
1233 (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1234 if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1237 if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1238 if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1239 pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1242 if (pf->loadopt & PFCTL_FLAG_TABLE)
1243 if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1245 if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1252 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1253 int rs_num, int depth)
1256 int error, len = strlen(path);
1259 pf->anchor = rs->anchor;
1262 snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1264 snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1267 if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1269 if (pf->opts & PF_OPT_VERBOSE)
1271 if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1272 (error = pfctl_ruleset_trans(pf,
1273 path, rs->anchor))) {
1274 printf("pfctl_load_rulesets: "
1275 "pfctl_ruleset_trans %d\n", error);
1278 } else if (pf->opts & PF_OPT_VERBOSE)
1283 if (pf->optimize && rs_num == PF_RULESET_FILTER)
1284 pfctl_optimize_ruleset(pf, rs);
1286 while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1287 TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1288 if ((error = pfctl_load_rule(pf, path, r, depth)))
1291 if ((error = pfctl_load_ruleset(pf, path,
1292 &r->anchor->ruleset, rs_num, depth + 1)))
1294 } else if (pf->opts & PF_OPT_VERBOSE)
1298 if (brace && pf->opts & PF_OPT_VERBOSE) {
1299 INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1312 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1314 u_int8_t rs_num = pf_get_ruleset_number(r->action);
1316 struct pfioc_rule pr;
1317 int len = strlen(path);
1319 bzero(&pr, sizeof(pr));
1320 /* set up anchor before adding to path for anchor_call */
1321 if ((pf->opts & PF_OPT_NOACTION) == 0)
1322 pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1323 if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1324 errx(1, "pfctl_load_rule: strlcpy");
1327 if (r->anchor->match) {
1329 snprintf(&path[len], MAXPATHLEN - len,
1330 "/%s", r->anchor->name);
1332 snprintf(&path[len], MAXPATHLEN - len,
1333 "%s", r->anchor->name);
1336 name = r->anchor->path;
1338 name = __DECONST(char *, "");
1340 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1341 if (pfctl_add_pool(pf, &r->rpool, r->af))
1343 pr.pool_ticket = pf->paddr.ticket;
1344 memcpy(&pr.rule, r, sizeof(pr.rule));
1345 if (r->anchor && strlcpy(pr.anchor_call, name,
1346 sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1347 errx(1, "pfctl_load_rule: strlcpy");
1348 if (ioctl(pf->dev, DIOCADDRULE, &pr))
1349 err(1, "DIOCADDRULE");
1352 if (pf->opts & PF_OPT_VERBOSE) {
1353 INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1354 print_rule(r, r->anchor ? r->anchor->name : "",
1355 pf->opts & PF_OPT_VERBOSE2);
1358 pfctl_clear_pool(&r->rpool);
1363 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1366 (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1367 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1368 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1369 if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1371 errx(1, "qtype not configured");
1372 else if (errno == ENODEV)
1373 errx(1, "%s: driver does not support "
1376 err(1, "DIOCADDALTQ");
1379 pfaltq_store(&pf->paltq->altq);
1385 pfctl_rules(int dev, char *filename, int opts, int optimize,
1386 char *anchorname, struct pfr_buffer *trans)
1388 #define ERR(x) do { warn(x); goto _error; } while(0)
1389 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1391 struct pfr_buffer *t, buf;
1392 struct pfioc_altq pa;
1394 struct pf_ruleset *rs;
1395 struct pfr_table trs;
1399 RB_INIT(&pf_anchors);
1400 memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1401 pf_init_ruleset(&pf_main_anchor.ruleset);
1402 pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1403 if (trans == NULL) {
1404 bzero(&buf, sizeof(buf));
1405 buf.pfrb_type = PFRB_TRANS;
1410 osize = t->pfrb_size;
1413 memset(&pa, 0, sizeof(pa));
1414 memset(&pf, 0, sizeof(pf));
1415 memset(&trs, 0, sizeof(trs));
1416 if ((path = calloc(1, MAXPATHLEN)) == NULL)
1417 ERRX("pfctl_rules: calloc");
1418 if (strlcpy(trs.pfrt_anchor, anchorname,
1419 sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1420 ERRX("pfctl_rules: strlcpy");
1423 pf.optimize = optimize;
1424 pf.loadopt = loadopt;
1426 /* non-brace anchor, create without resolving the path */
1427 if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1428 ERRX("pfctl_rules: calloc");
1429 rs = &pf.anchor->ruleset;
1430 pf_init_ruleset(rs);
1431 rs->anchor = pf.anchor;
1432 if (strlcpy(pf.anchor->path, anchorname,
1433 sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1434 errx(1, "pfctl_add_rule: strlcpy");
1435 if (strlcpy(pf.anchor->name, anchorname,
1436 sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1437 errx(1, "pfctl_add_rule: strlcpy");
1440 pf.astack[0] = pf.anchor;
1443 pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1446 pfctl_init_options(&pf);
1448 if ((opts & PF_OPT_NOACTION) == 0) {
1450 * XXX For the time being we need to open transactions for
1451 * the main ruleset before parsing, because tables are still
1452 * loaded at parse time.
1454 if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1455 ERRX("pfctl_rules");
1456 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1458 pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1459 if (pf.loadopt & PFCTL_FLAG_TABLE)
1460 pf.astack[0]->ruleset.tticket =
1461 pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1464 if (parse_config(filename, &pf) < 0) {
1465 if ((opts & PF_OPT_NOACTION) == 0)
1466 ERRX("Syntax error in config file: "
1467 "pf rules not loaded");
1472 if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1473 (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1474 (pf.loadopt & PFCTL_FLAG_NAT &&
1475 (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1476 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1477 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1478 (pf.loadopt & PFCTL_FLAG_FILTER &&
1479 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1480 if ((opts & PF_OPT_NOACTION) == 0)
1481 ERRX("Unable to load rules into kernel");
1486 if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1487 if (check_commit_altq(dev, opts) != 0)
1488 ERRX("errors in altq config");
1490 /* process "load anchor" directives */
1492 if (pfctl_load_anchors(dev, &pf, t) == -1)
1493 ERRX("load anchors");
1495 if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1497 if (pfctl_load_options(&pf))
1499 if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1505 if (trans == NULL) { /* main ruleset */
1506 if ((opts & PF_OPT_NOACTION) == 0)
1507 if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1508 err(1, "DIOCXROLLBACK");
1510 } else { /* sub ruleset */
1519 pfctl_fopen(const char *name, const char *mode)
1524 fp = fopen(name, mode);
1527 if (fstat(fileno(fp), &st)) {
1531 if (S_ISDIR(st.st_mode)) {
1540 pfctl_init_options(struct pfctl *pf)
1546 pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1547 pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1548 pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1549 pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1550 pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1551 pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1552 pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1553 pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1554 pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1555 pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1556 pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1557 pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1558 pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1559 pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1560 pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1561 pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1562 pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1563 pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1564 pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1565 pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1567 pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1568 pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1569 pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1570 pf->limit[PF_LIMIT_TABLES] = PFR_KTABLE_HIWAT;
1571 pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1574 mib[1] = HW_PHYSMEM;
1576 if (sysctl(mib, 2, &mem, &size, NULL, 0) == -1)
1578 if (mem <= 100*1024*1024)
1579 pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT_SMALL;
1581 pf->debug = PF_DEBUG_URGENT;
1585 pfctl_load_options(struct pfctl *pf)
1589 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1593 for (i = 0; i < PF_LIMIT_MAX; i++) {
1594 if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1596 if (pfctl_load_limit(pf, i, pf->limit[i]))
1601 * If we've set the limit, but haven't explicitly set adaptive
1602 * timeouts, do it now with a start of 60% and end of 120%.
1604 if (pf->limit_set[PF_LIMIT_STATES] &&
1605 !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1606 !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1607 pf->timeout[PFTM_ADAPTIVE_START] =
1608 (pf->limit[PF_LIMIT_STATES] / 10) * 6;
1609 pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1610 pf->timeout[PFTM_ADAPTIVE_END] =
1611 (pf->limit[PF_LIMIT_STATES] / 10) * 12;
1612 pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1616 for (i = 0; i < PFTM_MAX; i++) {
1617 if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1619 if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1624 if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1625 if (pfctl_load_debug(pf, pf->debug))
1629 if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1630 if (pfctl_load_logif(pf, pf->ifname))
1634 if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1635 if (pfctl_load_hostid(pf, pf->hostid))
1642 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1647 for (i = 0; pf_limits[i].name; i++) {
1648 if (strcasecmp(opt, pf_limits[i].name) == 0) {
1649 pf->limit[pf_limits[i].index] = limit;
1650 pf->limit_set[pf_limits[i].index] = 1;
1654 if (pf_limits[i].name == NULL) {
1655 warnx("Bad pool name.");
1659 if (pf->opts & PF_OPT_VERBOSE)
1660 printf("set limit %s %d\n", opt, limit);
1666 pfctl_load_limit(struct pfctl *pf, unsigned int his_index, unsigned int limit)
1668 struct pfioc_limit pl;
1670 memset(&pl, 0, sizeof(pl));
1671 pl.index = his_index;
1673 if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1675 warnx("Current pool size exceeds requested hard limit");
1677 warnx("DIOCSETLIMIT");
1684 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1688 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1691 for (i = 0; pf_timeouts[i].name; i++) {
1692 if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1693 pf->timeout[pf_timeouts[i].timeout] = seconds;
1694 pf->timeout_set[pf_timeouts[i].timeout] = 1;
1699 if (pf_timeouts[i].name == NULL) {
1700 warnx("Bad timeout name.");
1705 if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1706 printf("set timeout %s %d\n", opt, seconds);
1712 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1716 memset(&pt, 0, sizeof(pt));
1717 pt.timeout = timeout;
1718 pt.seconds = seconds;
1719 if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1720 warnx("DIOCSETTIMEOUT");
1727 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1729 const struct pf_hint *hint;
1732 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1735 for (i = 0; pf_hints[i].name; i++)
1736 if (strcasecmp(opt, pf_hints[i].name) == 0)
1739 hint = pf_hints[i].hint;
1741 warnx("invalid state timeouts optimization");
1745 for (i = 0; hint[i].name; i++)
1746 if ((r = pfctl_set_timeout(pf, hint[i].name,
1747 hint[i].timeout, 1)))
1750 if (pf->opts & PF_OPT_VERBOSE)
1751 printf("set optimization %s\n", opt);
1757 pfctl_set_logif(struct pfctl *pf, char *ifname)
1760 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1763 if (!strcmp(ifname, "none")) {
1767 pf->ifname = strdup(ifname);
1769 errx(1, "pfctl_set_logif: strdup");
1773 if (pf->opts & PF_OPT_VERBOSE)
1774 printf("set loginterface %s\n", ifname);
1780 pfctl_load_logif(struct pfctl *pf, char *ifname)
1784 memset(&pi, 0, sizeof(pi));
1785 if (ifname && strlcpy(pi.ifname, ifname,
1786 sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1787 warnx("pfctl_load_logif: strlcpy");
1790 if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1791 warnx("DIOCSETSTATUSIF");
1798 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1800 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1803 hostid = htonl(hostid);
1805 pf->hostid = hostid;
1808 if (pf->opts & PF_OPT_VERBOSE)
1809 printf("set hostid 0x%08x\n", ntohl(hostid));
1815 pfctl_load_hostid(struct pfctl *pf __unused, u_int32_t hostid)
1817 if (ioctl(dev_fd, DIOCSETHOSTID, &hostid)) {
1818 warnx("DIOCSETHOSTID");
1825 pfctl_set_debug(struct pfctl *pf, char *d)
1829 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1832 if (!strcmp(d, "none"))
1833 pf->debug = PF_DEBUG_NONE;
1834 else if (!strcmp(d, "urgent"))
1835 pf->debug = PF_DEBUG_URGENT;
1836 else if (!strcmp(d, "misc"))
1837 pf->debug = PF_DEBUG_MISC;
1838 else if (!strcmp(d, "loud"))
1839 pf->debug = PF_DEBUG_NOISY;
1841 warnx("unknown debug level \"%s\"", d);
1847 if ((pf->opts & PF_OPT_NOACTION) == 0)
1848 if (ioctl(dev_fd, DIOCSETDEBUG, &level))
1849 err(1, "DIOCSETDEBUG");
1851 if (pf->opts & PF_OPT_VERBOSE)
1852 printf("set debug %s\n", d);
1858 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1860 if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1861 warnx("DIOCSETDEBUG");
1868 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1870 struct pfioc_iface pi;
1872 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1875 bzero(&pi, sizeof(pi));
1877 pi.pfiio_flags = flags;
1879 if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1880 sizeof(pi.pfiio_name))
1881 errx(1, "pfctl_set_interface_flags: strlcpy");
1883 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1885 if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1886 err(1, "DIOCCLRIFFLAG");
1888 if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1889 err(1, "DIOCSETIFFLAG");
1896 pfctl_debug(int dev, u_int32_t level, int opts)
1898 if (ioctl(dev, DIOCSETDEBUG, &level))
1899 err(1, "DIOCSETDEBUG");
1900 if ((opts & PF_OPT_QUIET) == 0) {
1901 fprintf(stderr, "debug level set to '");
1904 fprintf(stderr, "none");
1906 case PF_DEBUG_URGENT:
1907 fprintf(stderr, "urgent");
1910 fprintf(stderr, "misc");
1912 case PF_DEBUG_NOISY:
1913 fprintf(stderr, "loud");
1916 fprintf(stderr, "<invalid>");
1919 fprintf(stderr, "'\n");
1924 pfctl_test_altqsupport(int dev, int opts)
1926 struct pfioc_altq pa;
1928 if (ioctl(dev, DIOCGETALTQS, &pa)) {
1929 if (errno == ENODEV) {
1930 if (!(opts & PF_OPT_QUIET))
1931 fprintf(stderr, "No ALTQ support in kernel\n"
1932 "ALTQ related functions disabled\n");
1935 err(1, "DIOCGETALTQS");
1941 pfctl_show_anchors(int dev, int opts, char *anchorname)
1943 struct pfioc_ruleset pr;
1946 memset(&pr, 0, sizeof(pr));
1947 memcpy(pr.path, anchorname, sizeof(pr.path));
1948 if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1949 if (errno == EINVAL)
1950 fprintf(stderr, "Anchor '%s' not found.\n",
1953 err(1, "DIOCGETRULESETS");
1957 for (nr = 0; nr < mnr; ++nr) {
1958 char sub[MAXPATHLEN];
1961 if (ioctl(dev, DIOCGETRULESET, &pr))
1962 err(1, "DIOCGETRULESET");
1963 if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1967 strlcat(sub, pr.path, sizeof(sub));
1968 strlcat(sub, "/", sizeof(sub));
1970 strlcat(sub, pr.name, sizeof(sub));
1971 if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1972 printf(" %s\n", sub);
1973 if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1980 pfctl_lookup_option(char *cmd, const char **list)
1982 if (cmd != NULL && *cmd)
1983 for (; *list; list++)
1984 if (!strncmp(cmd, *list, strlen(cmd)))
1990 main(int argc, char *argv[])
1994 int mode = O_RDONLY;
1996 int optimize = PF_OPTIMIZE_BASIC;
1997 char anchorname[MAXPATHLEN];
2003 while ((ch = getopt(argc, argv,
2004 "a:AdD:eqf:F:ghi:k:K:mnNOo:p:rRs:t:T:vx:z")) != -1) {
2010 opts |= PF_OPT_DISABLE;
2014 if (pfctl_cmdline_symset(optarg) < 0)
2015 warnx("could not parse macro definition %s",
2019 opts |= PF_OPT_ENABLE;
2023 opts |= PF_OPT_QUIET;
2026 clearopt = pfctl_lookup_option(optarg, clearopt_list);
2027 if (clearopt == NULL) {
2028 warnx("Unknown flush modifier '%s'", optarg);
2037 if (state_killers >= 2) {
2038 warnx("can only specify -k twice");
2042 state_kill[state_killers++] = optarg;
2046 if (src_node_killers >= 2) {
2047 warnx("can only specify -K twice");
2051 src_node_kill[src_node_killers++] = optarg;
2055 opts |= PF_OPT_MERGE;
2058 opts |= PF_OPT_NOACTION;
2061 loadopt |= PFCTL_FLAG_NAT;
2064 opts |= PF_OPT_USEDNS;
2071 opts |= PF_OPT_DEBUG;
2074 loadopt |= PFCTL_FLAG_ALTQ;
2077 loadopt |= PFCTL_FLAG_FILTER;
2080 optiopt = pfctl_lookup_option(optarg, optiopt_list);
2081 if (optiopt == NULL) {
2082 warnx("Unknown optimization '%s'", optarg);
2085 opts |= PF_OPT_OPTIMIZE;
2088 loadopt |= PFCTL_FLAG_OPTION;
2094 showopt = pfctl_lookup_option(optarg, showopt_list);
2095 if (showopt == NULL) {
2096 warnx("Unknown show modifier '%s'", optarg);
2104 tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2105 if (tblcmdopt == NULL) {
2106 warnx("Unknown table command '%s'", optarg);
2111 if (opts & PF_OPT_VERBOSE)
2112 opts |= PF_OPT_VERBOSE2;
2113 opts |= PF_OPT_VERBOSE;
2116 debugopt = pfctl_lookup_option(optarg, debugopt_list);
2117 if (debugopt == NULL) {
2118 warnx("Unknown debug level '%s'", optarg);
2124 opts |= PF_OPT_CLRRULECTRS;
2135 if (tblcmdopt != NULL) {
2140 loadopt |= PFCTL_FLAG_TABLE;
2143 mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2144 } else if (argc != optind) {
2145 warnx("unknown command line argument: %s ...", argv[optind]);
2152 if ((path = calloc(1, MAXPATHLEN)) == NULL)
2153 errx(1, "pfctl: calloc");
2154 memset(anchorname, 0, sizeof(anchorname));
2155 if (anchoropt != NULL) {
2156 int len = strlen(anchoropt);
2158 if (anchoropt[len - 1] == '*') {
2159 if (len >= 2 && anchoropt[len - 2] == '/')
2160 anchoropt[len - 2] = '\0';
2162 anchoropt[len - 1] = '\0';
2163 opts |= PF_OPT_RECURSE;
2165 if (strlcpy(anchorname, anchoropt,
2166 sizeof(anchorname)) >= sizeof(anchorname))
2167 errx(1, "anchor name '%s' too long",
2169 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2172 if ((opts & PF_OPT_NOACTION) == 0) {
2173 dev_fd = open(pf_device, mode);
2175 err(1, "%s", pf_device);
2176 altqsupport = pfctl_test_altqsupport(dev_fd, opts);
2178 dev_fd = open(pf_device, O_RDONLY);
2180 opts |= PF_OPT_DUMMYACTION;
2181 /* turn off options */
2182 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2183 clearopt = showopt = debugopt = NULL;
2187 if (opts & PF_OPT_DISABLE)
2188 if (pfctl_disable(dev_fd, opts))
2191 if (showopt != NULL) {
2194 pfctl_show_anchors(dev_fd, opts, anchorname);
2197 pfctl_load_fingerprints(dev_fd, opts);
2198 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_RULES,
2202 pfctl_load_fingerprints(dev_fd, opts);
2203 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_LABELS,
2207 pfctl_load_fingerprints(dev_fd, opts);
2208 pfctl_show_nat(dev_fd, opts, anchorname);
2211 pfctl_show_altq(dev_fd, ifaceopt, opts,
2212 opts & PF_OPT_VERBOSE2);
2215 pfctl_show_states(dev_fd, ifaceopt, opts);
2218 pfctl_show_src_nodes(dev_fd, opts);
2221 pfctl_show_status(dev_fd, opts);
2224 pfctl_show_timeouts(dev_fd, opts);
2227 pfctl_show_limits(dev_fd, opts);
2230 opts |= PF_OPT_SHOWALL;
2231 pfctl_load_fingerprints(dev_fd, opts);
2233 pfctl_show_nat(dev_fd, opts, anchorname);
2234 pfctl_show_rules(dev_fd, path, opts, 0, anchorname, 0);
2235 pfctl_show_altq(dev_fd, ifaceopt, opts, 0);
2236 pfctl_show_states(dev_fd, ifaceopt, opts);
2237 pfctl_show_src_nodes(dev_fd, opts);
2238 pfctl_show_status(dev_fd, opts);
2239 pfctl_show_rules(dev_fd, path, opts, 1, anchorname, 0);
2240 pfctl_show_timeouts(dev_fd, opts);
2241 pfctl_show_limits(dev_fd, opts);
2242 pfctl_show_tables(anchorname, opts);
2243 pfctl_show_fingerprints(opts);
2246 pfctl_show_tables(anchorname, opts);
2249 pfctl_load_fingerprints(dev_fd, opts);
2250 pfctl_show_fingerprints(opts);
2253 pfctl_show_ifaces(ifaceopt, opts);
2258 if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2259 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_NOTHING,
2262 if (clearopt != NULL) {
2263 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2264 errx(1, "anchor names beginning with '_' cannot "
2265 "be modified from the command line");
2267 switch (*clearopt) {
2269 pfctl_clear_rules(dev_fd, opts, anchorname);
2272 pfctl_clear_nat(dev_fd, opts, anchorname);
2275 pfctl_clear_altq(dev_fd, opts);
2278 pfctl_clear_states(dev_fd, ifaceopt, opts);
2281 pfctl_clear_src_nodes(dev_fd, opts);
2284 pfctl_clear_stats(dev_fd, opts);
2287 pfctl_clear_rules(dev_fd, opts, anchorname);
2288 pfctl_clear_nat(dev_fd, opts, anchorname);
2289 pfctl_clear_tables(anchorname, opts);
2291 pfctl_clear_altq(dev_fd, opts);
2292 pfctl_clear_states(dev_fd, ifaceopt, opts);
2293 pfctl_clear_src_nodes(dev_fd, opts);
2294 pfctl_clear_stats(dev_fd, opts);
2295 pfctl_clear_fingerprints(dev_fd, opts);
2296 pfctl_clear_interface_flags(dev_fd, opts);
2300 pfctl_clear_fingerprints(dev_fd, opts);
2303 pfctl_clear_tables(anchorname, opts);
2307 if (state_killers) {
2308 if (!strcmp(state_kill[0], "label"))
2309 pfctl_label_kill_states(dev_fd, ifaceopt, opts);
2310 else if (!strcmp(state_kill[0], "id"))
2311 pfctl_id_kill_states(dev_fd, ifaceopt, opts);
2313 pfctl_net_kill_states(dev_fd, ifaceopt, opts);
2316 if (src_node_killers)
2317 pfctl_kill_src_nodes(dev_fd, ifaceopt, opts);
2319 if (tblcmdopt != NULL) {
2320 error = pfctl_command_tables(argc, argv, tableopt,
2321 tblcmdopt, rulesopt, anchorname, opts);
2324 if (optiopt != NULL) {
2330 optimize |= PF_OPTIMIZE_BASIC;
2334 optimize |= PF_OPTIMIZE_PROFILE;
2339 if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2341 if (pfctl_clear_interface_flags(dev_fd, opts | PF_OPT_QUIET))
2344 if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2345 !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2346 if (pfctl_file_fingerprints(dev_fd, opts, PF_OSFP_FILE))
2349 if (rulesopt != NULL) {
2350 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2351 errx(1, "anchor names beginning with '_' cannot "
2352 "be modified from the command line");
2353 if (pfctl_rules(dev_fd, rulesopt, opts, optimize,
2356 else if (!(opts & PF_OPT_NOACTION) &&
2357 (loadopt & PFCTL_FLAG_TABLE))
2358 warn_namespace_collision(NULL);
2361 if (opts & PF_OPT_ENABLE)
2362 if (pfctl_enable(dev_fd, opts))
2365 if (debugopt != NULL) {
2366 switch (*debugopt) {
2368 pfctl_debug(dev_fd, PF_DEBUG_NONE, opts);
2371 pfctl_debug(dev_fd, PF_DEBUG_URGENT, opts);
2374 pfctl_debug(dev_fd, PF_DEBUG_MISC, opts);
2377 pfctl_debug(dev_fd, PF_DEBUG_NOISY, opts);