xref: /freebsd-14.2/sbin/pfctl/pfctl.c (revision c71487df)
1 /*	$OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2002,2003 Henning Brauer
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 #define PFIOC_USE_LATEST
38 
39 #include <sys/types.h>
40 #include <sys/ioctl.h>
41 #include <sys/socket.h>
42 #include <sys/stat.h>
43 #include <sys/endian.h>
44 
45 #include <net/if.h>
46 #include <netinet/in.h>
47 #include <net/pfvar.h>
48 #include <arpa/inet.h>
49 #include <net/altq/altq.h>
50 
51 #include <err.h>
52 #include <errno.h>
53 #include <fcntl.h>
54 #include <libpfctl.h>
55 #include <limits.h>
56 #include <netdb.h>
57 #include <stdint.h>
58 #include <stdio.h>
59 #include <stdlib.h>
60 #include <string.h>
61 #include <unistd.h>
62 
63 #include "pfctl_parser.h"
64 #include "pfctl.h"
65 
66 void	 usage(void);
67 int	 pfctl_enable(int, int);
68 int	 pfctl_disable(int, int);
69 int	 pfctl_clear_stats(int, int);
70 int	 pfctl_get_skip_ifaces(void);
71 int	 pfctl_check_skip_ifaces(char *);
72 int	 pfctl_adjust_skip_ifaces(struct pfctl *);
73 int	 pfctl_clear_interface_flags(int, int);
74 int	 pfctl_flush_eth_rules(int, int, char *);
75 int	 pfctl_flush_rules(int, int, char *);
76 int	 pfctl_flush_nat(int, int, char *);
77 int	 pfctl_clear_altq(int, int);
78 int	 pfctl_clear_src_nodes(int, int);
79 int	 pfctl_clear_iface_states(int, const char *, int);
80 void	 pfctl_addrprefix(char *, struct pf_addr *);
81 int	 pfctl_kill_src_nodes(int, const char *, int);
82 int	 pfctl_net_kill_states(int, const char *, int);
83 int	 pfctl_gateway_kill_states(int, const char *, int);
84 int	 pfctl_label_kill_states(int, const char *, int);
85 int	 pfctl_id_kill_states(int, const char *, int);
86 void	 pfctl_init_options(struct pfctl *);
87 int	 pfctl_load_options(struct pfctl *);
88 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
89 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
90 int	 pfctl_load_debug(struct pfctl *, unsigned int);
91 int	 pfctl_load_logif(struct pfctl *, char *);
92 int	 pfctl_load_hostid(struct pfctl *, u_int32_t);
93 int	 pfctl_load_reassembly(struct pfctl *, u_int32_t);
94 int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
95 int	 pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int,
96 	    char *);
97 void	 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *, int);
98 void	 pfctl_print_rule_counters(struct pfctl_rule *, int);
99 int	 pfctl_show_eth_rules(int, char *, int, enum pfctl_show, char *, int, int);
100 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int, int);
101 int	 pfctl_show_nat(int, char *, int, char *, int, int);
102 int	 pfctl_show_src_nodes(int, int);
103 int	 pfctl_show_states(int, const char *, int);
104 int	 pfctl_show_status(int, int);
105 int	 pfctl_show_running(int);
106 int	 pfctl_show_timeouts(int, int);
107 int	 pfctl_show_limits(int, int);
108 void	 pfctl_debug(int, u_int32_t, int);
109 int	 pfctl_test_altqsupport(int, int);
110 int	 pfctl_show_anchors(int, int, char *);
111 int	 pfctl_show_eth_anchors(int, int, char *);
112 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pfctl_anchor *, bool);
113 int	 pfctl_eth_ruleset_trans(struct pfctl *, char *,
114 	    struct pfctl_eth_anchor *);
115 int	 pfctl_load_eth_ruleset(struct pfctl *, char *,
116 	    struct pfctl_eth_ruleset *, int);
117 int	 pfctl_load_eth_rule(struct pfctl *, char *, struct pfctl_eth_rule *,
118 	    int);
119 int	 pfctl_load_ruleset(struct pfctl *, char *,
120 		struct pfctl_ruleset *, int, int);
121 int	 pfctl_load_rule(struct pfctl *, char *, struct pfctl_rule *, int);
122 const char	*pfctl_lookup_option(char *, const char * const *);
123 
124 static struct pfctl_anchor_global	 pf_anchors;
125 struct pfctl_anchor	 pf_main_anchor;
126 struct pfctl_eth_anchor	 pf_eth_main_anchor;
127 static struct pfr_buffer skip_b;
128 
129 static const char	*clearopt;
130 static char		*rulesopt;
131 static const char	*showopt;
132 static const char	*debugopt;
133 static char		*anchoropt;
134 static const char	*optiopt = NULL;
135 static const char	*pf_device = "/dev/pf";
136 static char		*ifaceopt;
137 static char		*tableopt;
138 static const char	*tblcmdopt;
139 static int		 src_node_killers;
140 static char		*src_node_kill[2];
141 static int		 state_killers;
142 static char		*state_kill[2];
143 int			 loadopt;
144 int			 altqsupport;
145 
146 int			 dev = -1;
147 static int		 first_title = 1;
148 static int		 labels = 0;
149 
150 #define INDENT(d, o)	do {						\
151 				if (o) {				\
152 					int i;				\
153 					for (i=0; i < d; i++)		\
154 						printf("  ");		\
155 				}					\
156 			} while (0);					\
157 
158 
159 static const struct {
160 	const char	*name;
161 	int		index;
162 } pf_limits[] = {
163 	{ "states",		PF_LIMIT_STATES },
164 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
165 	{ "frags",		PF_LIMIT_FRAGS },
166 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
167 	{ NULL,			0 }
168 };
169 
170 struct pf_hint {
171 	const char	*name;
172 	int		timeout;
173 };
174 static const struct pf_hint pf_hint_normal[] = {
175 	{ "tcp.first",		2 * 60 },
176 	{ "tcp.opening",	30 },
177 	{ "tcp.established",	24 * 60 * 60 },
178 	{ "tcp.closing",	15 * 60 },
179 	{ "tcp.finwait",	45 },
180 	{ "tcp.closed",		90 },
181 	{ "tcp.tsdiff",		30 },
182 	{ NULL,			0 }
183 };
184 static const struct pf_hint pf_hint_satellite[] = {
185 	{ "tcp.first",		3 * 60 },
186 	{ "tcp.opening",	30 + 5 },
187 	{ "tcp.established",	24 * 60 * 60 },
188 	{ "tcp.closing",	15 * 60 + 5 },
189 	{ "tcp.finwait",	45 + 5 },
190 	{ "tcp.closed",		90 + 5 },
191 	{ "tcp.tsdiff",		60 },
192 	{ NULL,			0 }
193 };
194 static const struct pf_hint pf_hint_conservative[] = {
195 	{ "tcp.first",		60 * 60 },
196 	{ "tcp.opening",	15 * 60 },
197 	{ "tcp.established",	5 * 24 * 60 * 60 },
198 	{ "tcp.closing",	60 * 60 },
199 	{ "tcp.finwait",	10 * 60 },
200 	{ "tcp.closed",		3 * 60 },
201 	{ "tcp.tsdiff",		60 },
202 	{ NULL,			0 }
203 };
204 static const struct pf_hint pf_hint_aggressive[] = {
205 	{ "tcp.first",		30 },
206 	{ "tcp.opening",	5 },
207 	{ "tcp.established",	5 * 60 * 60 },
208 	{ "tcp.closing",	60 },
209 	{ "tcp.finwait",	30 },
210 	{ "tcp.closed",		30 },
211 	{ "tcp.tsdiff",		10 },
212 	{ NULL,			0 }
213 };
214 
215 static const struct {
216 	const char *name;
217 	const struct pf_hint *hint;
218 } pf_hints[] = {
219 	{ "normal",		pf_hint_normal },
220 	{ "satellite",		pf_hint_satellite },
221 	{ "high-latency",	pf_hint_satellite },
222 	{ "conservative",	pf_hint_conservative },
223 	{ "aggressive",		pf_hint_aggressive },
224 	{ NULL,			NULL }
225 };
226 
227 static const char * const clearopt_list[] = {
228 	"nat", "queue", "rules", "Sources",
229 	"states", "info", "Tables", "osfp", "all",
230 	"ethernet", NULL
231 };
232 
233 static const char * const showopt_list[] = {
234 	"ether", "nat", "queue", "rules", "Anchors", "Sources", "states",
235 	"info", "Interfaces", "labels", "timeouts", "memory", "Tables",
236 	"osfp", "Running", "all", NULL
237 };
238 
239 static const char * const tblcmdopt_list[] = {
240 	"kill", "flush", "add", "delete", "load", "replace", "show",
241 	"test", "zero", "expire", NULL
242 };
243 
244 static const char * const debugopt_list[] = {
245 	"none", "urgent", "misc", "loud", NULL
246 };
247 
248 static const char * const optiopt_list[] = {
249 	"none", "basic", "profile", NULL
250 };
251 
252 void
usage(void)253 usage(void)
254 {
255 	extern char *__progname;
256 
257 	fprintf(stderr,
258 "usage: %s [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n"
259 	"\t[-f file] [-i interface] [-K host | network]\n"
260 	"\t[-k host | network | gateway | label | id] [-o level] [-p device]\n"
261 	"\t[-s modifier] [-t table -T command [address ...]] [-x level]\n",
262 	    __progname);
263 
264 	exit(1);
265 }
266 
267 /*
268  * Cache protocol number to name translations.
269  *
270  * Translation is performed a lot e.g., when dumping states and
271  * getprotobynumber is incredibly expensive.
272  *
273  * Note from the getprotobynumber(3) manpage:
274  * <quote>
275  * These functions use a thread-specific data space; if the data is needed
276  * for future use, it should be copied before any subsequent calls overwrite
277  * it.  Only the Internet protocols are currently understood.
278  * </quote>
279  *
280  * Consequently we only cache the name and strdup it for safety.
281  *
282  * At the time of writing this comment the last entry in /etc/protocols is:
283  * divert  258     DIVERT          # Divert pseudo-protocol [non IANA]
284  */
285 const char *
pfctl_proto2name(int proto)286 pfctl_proto2name(int proto)
287 {
288 	static const char *pfctl_proto_cache[259];
289 	struct protoent *p;
290 
291 	if (proto >= nitems(pfctl_proto_cache)) {
292 		p = getprotobynumber(proto);
293 		if (p == NULL) {
294 			return (NULL);
295 		}
296 		return (p->p_name);
297 	}
298 
299 	if (pfctl_proto_cache[proto] == NULL) {
300 		p = getprotobynumber(proto);
301 		if (p == NULL) {
302 			return (NULL);
303 		}
304 		pfctl_proto_cache[proto] = strdup(p->p_name);
305 	}
306 
307 	return (pfctl_proto_cache[proto]);
308 }
309 
310 int
pfctl_enable(int dev,int opts)311 pfctl_enable(int dev, int opts)
312 {
313 	if (ioctl(dev, DIOCSTART)) {
314 		if (errno == EEXIST)
315 			errx(1, "pf already enabled");
316 		else if (errno == ESRCH)
317 			errx(1, "pfil registeration failed");
318 		else
319 			err(1, "DIOCSTART");
320 	}
321 	if ((opts & PF_OPT_QUIET) == 0)
322 		fprintf(stderr, "pf enabled\n");
323 
324 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
325 		if (errno != EEXIST)
326 			err(1, "DIOCSTARTALTQ");
327 
328 	return (0);
329 }
330 
331 int
pfctl_disable(int dev,int opts)332 pfctl_disable(int dev, int opts)
333 {
334 	if (ioctl(dev, DIOCSTOP)) {
335 		if (errno == ENOENT)
336 			errx(1, "pf not enabled");
337 		else
338 			err(1, "DIOCSTOP");
339 	}
340 	if ((opts & PF_OPT_QUIET) == 0)
341 		fprintf(stderr, "pf disabled\n");
342 
343 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
344 			if (errno != ENOENT)
345 				err(1, "DIOCSTOPALTQ");
346 
347 	return (0);
348 }
349 
350 int
pfctl_clear_stats(int dev,int opts)351 pfctl_clear_stats(int dev, int opts)
352 {
353 	if (ioctl(dev, DIOCCLRSTATUS))
354 		err(1, "DIOCCLRSTATUS");
355 	if ((opts & PF_OPT_QUIET) == 0)
356 		fprintf(stderr, "pf: statistics cleared\n");
357 	return (0);
358 }
359 
360 int
pfctl_get_skip_ifaces(void)361 pfctl_get_skip_ifaces(void)
362 {
363 	bzero(&skip_b, sizeof(skip_b));
364 	skip_b.pfrb_type = PFRB_IFACES;
365 	for (;;) {
366 		pfr_buf_grow(&skip_b, skip_b.pfrb_size);
367 		skip_b.pfrb_size = skip_b.pfrb_msize;
368 		if (pfi_get_ifaces(NULL, skip_b.pfrb_caddr, &skip_b.pfrb_size))
369 			err(1, "pfi_get_ifaces");
370 		if (skip_b.pfrb_size <= skip_b.pfrb_msize)
371 			break;
372 	}
373 	return (0);
374 }
375 
376 int
pfctl_check_skip_ifaces(char * ifname)377 pfctl_check_skip_ifaces(char *ifname)
378 {
379 	struct pfi_kif		*p;
380 	struct node_host	*h = NULL, *n = NULL;
381 
382 	PFRB_FOREACH(p, &skip_b) {
383 		if (!strcmp(ifname, p->pfik_name) &&
384 		    (p->pfik_flags & PFI_IFLAG_SKIP))
385 			p->pfik_flags &= ~PFI_IFLAG_SKIP;
386 		if (!strcmp(ifname, p->pfik_name) && p->pfik_group != NULL) {
387 			if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
388 				continue;
389 
390 			for (n = h; n != NULL; n = n->next) {
391 				if (p->pfik_ifp == NULL)
392 					continue;
393 				if (strncmp(p->pfik_name, ifname, IFNAMSIZ))
394 					continue;
395 
396 				p->pfik_flags &= ~PFI_IFLAG_SKIP;
397 			}
398 		}
399 	}
400 	return (0);
401 }
402 
403 int
pfctl_adjust_skip_ifaces(struct pfctl * pf)404 pfctl_adjust_skip_ifaces(struct pfctl *pf)
405 {
406 	struct pfi_kif		*p, *pp;
407 	struct node_host	*h = NULL, *n = NULL;
408 
409 	PFRB_FOREACH(p, &skip_b) {
410 		if (p->pfik_group == NULL || !(p->pfik_flags & PFI_IFLAG_SKIP))
411 			continue;
412 
413 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
414 		if ((h = ifa_grouplookup(p->pfik_name, 0)) == NULL)
415 			continue;
416 
417 		for (n = h; n != NULL; n = n->next)
418 			PFRB_FOREACH(pp, &skip_b) {
419 				if (pp->pfik_ifp == NULL)
420 					continue;
421 
422 				if (strncmp(pp->pfik_name, n->ifname, IFNAMSIZ))
423 					continue;
424 
425 				if (!(pp->pfik_flags & PFI_IFLAG_SKIP))
426 					pfctl_set_interface_flags(pf,
427 					    pp->pfik_name, PFI_IFLAG_SKIP, 1);
428 				if (pp->pfik_flags & PFI_IFLAG_SKIP)
429 					pp->pfik_flags &= ~PFI_IFLAG_SKIP;
430 			}
431 	}
432 
433 	PFRB_FOREACH(p, &skip_b) {
434 		if (p->pfik_ifp == NULL || ! (p->pfik_flags & PFI_IFLAG_SKIP))
435 			continue;
436 
437 		pfctl_set_interface_flags(pf, p->pfik_name, PFI_IFLAG_SKIP, 0);
438 	}
439 
440 	return (0);
441 }
442 
443 int
pfctl_clear_interface_flags(int dev,int opts)444 pfctl_clear_interface_flags(int dev, int opts)
445 {
446 	struct pfioc_iface	pi;
447 
448 	if ((opts & PF_OPT_NOACTION) == 0) {
449 		bzero(&pi, sizeof(pi));
450 		pi.pfiio_flags = PFI_IFLAG_SKIP;
451 
452 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
453 			err(1, "DIOCCLRIFFLAG");
454 		if ((opts & PF_OPT_QUIET) == 0)
455 			fprintf(stderr, "pf: interface flags reset\n");
456 	}
457 	return (0);
458 }
459 
460 int
pfctl_flush_eth_rules(int dev,int opts,char * anchorname)461 pfctl_flush_eth_rules(int dev, int opts, char *anchorname)
462 {
463 	int ret;
464 
465 	ret = pfctl_clear_eth_rules(dev, anchorname);
466 	if (ret != 0)
467 		err(1, "pfctl_clear_eth_rules");
468 
469 	if ((opts & PF_OPT_QUIET) == 0)
470 		fprintf(stderr, "Ethernet rules cleared\n");
471 
472 	return (ret);
473 }
474 
475 int
pfctl_flush_rules(int dev,int opts,char * anchorname)476 pfctl_flush_rules(int dev, int opts, char *anchorname)
477 {
478 	int ret;
479 
480 	ret = pfctl_clear_rules(dev, anchorname);
481 	if (ret != 0)
482 		err(1, "pfctl_clear_rules");
483 	if ((opts & PF_OPT_QUIET) == 0)
484 		fprintf(stderr, "rules cleared\n");
485 	return (0);
486 }
487 
488 int
pfctl_flush_nat(int dev,int opts,char * anchorname)489 pfctl_flush_nat(int dev, int opts, char *anchorname)
490 {
491 	int ret;
492 
493 	ret = pfctl_clear_nat(dev, anchorname);
494 	if (ret != 0)
495 		err(1, "pfctl_clear_nat");
496 	if ((opts & PF_OPT_QUIET) == 0)
497 		fprintf(stderr, "nat cleared\n");
498 	return (0);
499 }
500 
501 int
pfctl_clear_altq(int dev,int opts)502 pfctl_clear_altq(int dev, int opts)
503 {
504 	struct pfr_buffer t;
505 
506 	if (!altqsupport)
507 		return (-1);
508 	memset(&t, 0, sizeof(t));
509 	t.pfrb_type = PFRB_TRANS;
510 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
511 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
512 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
513 		err(1, "pfctl_clear_altq");
514 	if ((opts & PF_OPT_QUIET) == 0)
515 		fprintf(stderr, "altq cleared\n");
516 	return (0);
517 }
518 
519 int
pfctl_clear_src_nodes(int dev,int opts)520 pfctl_clear_src_nodes(int dev, int opts)
521 {
522 	if (ioctl(dev, DIOCCLRSRCNODES))
523 		err(1, "DIOCCLRSRCNODES");
524 	if ((opts & PF_OPT_QUIET) == 0)
525 		fprintf(stderr, "source tracking entries cleared\n");
526 	return (0);
527 }
528 
529 int
pfctl_clear_iface_states(int dev,const char * iface,int opts)530 pfctl_clear_iface_states(int dev, const char *iface, int opts)
531 {
532 	struct pfctl_kill kill;
533 	unsigned int killed;
534 
535 	memset(&kill, 0, sizeof(kill));
536 	if (iface != NULL && strlcpy(kill.ifname, iface,
537 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
538 		errx(1, "invalid interface: %s", iface);
539 
540 	if (opts & PF_OPT_KILLMATCH)
541 		kill.kill_match = true;
542 
543 	if (pfctl_clear_states(dev, &kill, &killed))
544 		err(1, "DIOCCLRSTATES");
545 	if ((opts & PF_OPT_QUIET) == 0)
546 		fprintf(stderr, "%d states cleared\n", killed);
547 	return (0);
548 }
549 
550 void
pfctl_addrprefix(char * addr,struct pf_addr * mask)551 pfctl_addrprefix(char *addr, struct pf_addr *mask)
552 {
553 	char *p;
554 	const char *errstr;
555 	int prefix, ret_ga, q, r;
556 	struct addrinfo hints, *res;
557 
558 	if ((p = strchr(addr, '/')) == NULL)
559 		return;
560 
561 	*p++ = '\0';
562 	prefix = strtonum(p, 0, 128, &errstr);
563 	if (errstr)
564 		errx(1, "prefix is %s: %s", errstr, p);
565 
566 	bzero(&hints, sizeof(hints));
567 	/* prefix only with numeric addresses */
568 	hints.ai_flags |= AI_NUMERICHOST;
569 
570 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
571 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
572 		/* NOTREACHED */
573 	}
574 
575 	if (res->ai_family == AF_INET && prefix > 32)
576 		errx(1, "prefix too long for AF_INET");
577 	else if (res->ai_family == AF_INET6 && prefix > 128)
578 		errx(1, "prefix too long for AF_INET6");
579 
580 	q = prefix >> 3;
581 	r = prefix & 7;
582 	switch (res->ai_family) {
583 	case AF_INET:
584 		bzero(&mask->v4, sizeof(mask->v4));
585 		mask->v4.s_addr = htonl((u_int32_t)
586 		    (0xffffffffffULL << (32 - prefix)));
587 		break;
588 	case AF_INET6:
589 		bzero(&mask->v6, sizeof(mask->v6));
590 		if (q > 0)
591 			memset((void *)&mask->v6, 0xff, q);
592 		if (r > 0)
593 			*((u_char *)&mask->v6 + q) =
594 			    (0xff00 >> r) & 0xff;
595 		break;
596 	}
597 	freeaddrinfo(res);
598 }
599 
600 int
pfctl_kill_src_nodes(int dev,const char * iface,int opts)601 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
602 {
603 	struct pfioc_src_node_kill psnk;
604 	struct addrinfo *res[2], *resp[2];
605 	struct sockaddr last_src, last_dst;
606 	int killed, sources, dests;
607 	int ret_ga;
608 
609 	killed = sources = dests = 0;
610 
611 	memset(&psnk, 0, sizeof(psnk));
612 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
613 	    sizeof(psnk.psnk_src.addr.v.a.mask));
614 	memset(&last_src, 0xff, sizeof(last_src));
615 	memset(&last_dst, 0xff, sizeof(last_dst));
616 
617 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
618 
619 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
620 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
621 		/* NOTREACHED */
622 	}
623 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
624 		if (resp[0]->ai_addr == NULL)
625 			continue;
626 		/* We get lots of duplicates.  Catch the easy ones */
627 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
628 			continue;
629 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
630 
631 		psnk.psnk_af = resp[0]->ai_family;
632 		sources++;
633 
634 		if (psnk.psnk_af == AF_INET)
635 			psnk.psnk_src.addr.v.a.addr.v4 =
636 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
637 		else if (psnk.psnk_af == AF_INET6)
638 			psnk.psnk_src.addr.v.a.addr.v6 =
639 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
640 			    sin6_addr;
641 		else
642 			errx(1, "Unknown address family %d", psnk.psnk_af);
643 
644 		if (src_node_killers > 1) {
645 			dests = 0;
646 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
647 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
648 			memset(&last_dst, 0xff, sizeof(last_dst));
649 			pfctl_addrprefix(src_node_kill[1],
650 			    &psnk.psnk_dst.addr.v.a.mask);
651 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
652 			    &res[1]))) {
653 				errx(1, "getaddrinfo: %s",
654 				    gai_strerror(ret_ga));
655 				/* NOTREACHED */
656 			}
657 			for (resp[1] = res[1]; resp[1];
658 			    resp[1] = resp[1]->ai_next) {
659 				if (resp[1]->ai_addr == NULL)
660 					continue;
661 				if (psnk.psnk_af != resp[1]->ai_family)
662 					continue;
663 
664 				if (memcmp(&last_dst, resp[1]->ai_addr,
665 				    sizeof(last_dst)) == 0)
666 					continue;
667 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
668 
669 				dests++;
670 
671 				if (psnk.psnk_af == AF_INET)
672 					psnk.psnk_dst.addr.v.a.addr.v4 =
673 					    ((struct sockaddr_in *)resp[1]->
674 					    ai_addr)->sin_addr;
675 				else if (psnk.psnk_af == AF_INET6)
676 					psnk.psnk_dst.addr.v.a.addr.v6 =
677 					    ((struct sockaddr_in6 *)resp[1]->
678 					    ai_addr)->sin6_addr;
679 				else
680 					errx(1, "Unknown address family %d",
681 					    psnk.psnk_af);
682 
683 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
684 					err(1, "DIOCKILLSRCNODES");
685 				killed += psnk.psnk_killed;
686 			}
687 			freeaddrinfo(res[1]);
688 		} else {
689 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
690 				err(1, "DIOCKILLSRCNODES");
691 			killed += psnk.psnk_killed;
692 		}
693 	}
694 
695 	freeaddrinfo(res[0]);
696 
697 	if ((opts & PF_OPT_QUIET) == 0)
698 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
699 		    "destinations\n", killed, sources, dests);
700 	return (0);
701 }
702 
703 int
pfctl_net_kill_states(int dev,const char * iface,int opts)704 pfctl_net_kill_states(int dev, const char *iface, int opts)
705 {
706 	struct pfctl_kill kill;
707 	struct addrinfo *res[2], *resp[2];
708 	struct sockaddr last_src, last_dst;
709 	unsigned int newkilled;
710 	int killed, sources, dests;
711 	int ret_ga;
712 
713 	killed = sources = dests = 0;
714 
715 	memset(&kill, 0, sizeof(kill));
716 	memset(&kill.src.addr.v.a.mask, 0xff,
717 	    sizeof(kill.src.addr.v.a.mask));
718 	memset(&last_src, 0xff, sizeof(last_src));
719 	memset(&last_dst, 0xff, sizeof(last_dst));
720 	if (iface != NULL && strlcpy(kill.ifname, iface,
721 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
722 		errx(1, "invalid interface: %s", iface);
723 
724 	pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask);
725 
726 	if (opts & PF_OPT_KILLMATCH)
727 		kill.kill_match = true;
728 
729 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
730 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
731 		/* NOTREACHED */
732 	}
733 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
734 		if (resp[0]->ai_addr == NULL)
735 			continue;
736 		/* We get lots of duplicates.  Catch the easy ones */
737 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
738 			continue;
739 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
740 
741 		kill.af = resp[0]->ai_family;
742 		sources++;
743 
744 		if (kill.af == AF_INET)
745 			kill.src.addr.v.a.addr.v4 =
746 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
747 		else if (kill.af == AF_INET6)
748 			kill.src.addr.v.a.addr.v6 =
749 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
750 			    sin6_addr;
751 		else
752 			errx(1, "Unknown address family %d", kill.af);
753 
754 		if (state_killers > 1) {
755 			dests = 0;
756 			memset(&kill.dst.addr.v.a.mask, 0xff,
757 			    sizeof(kill.dst.addr.v.a.mask));
758 			memset(&last_dst, 0xff, sizeof(last_dst));
759 			pfctl_addrprefix(state_kill[1],
760 			    &kill.dst.addr.v.a.mask);
761 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
762 			    &res[1]))) {
763 				errx(1, "getaddrinfo: %s",
764 				    gai_strerror(ret_ga));
765 				/* NOTREACHED */
766 			}
767 			for (resp[1] = res[1]; resp[1];
768 			    resp[1] = resp[1]->ai_next) {
769 				if (resp[1]->ai_addr == NULL)
770 					continue;
771 				if (kill.af != resp[1]->ai_family)
772 					continue;
773 
774 				if (memcmp(&last_dst, resp[1]->ai_addr,
775 				    sizeof(last_dst)) == 0)
776 					continue;
777 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
778 
779 				dests++;
780 
781 				if (kill.af == AF_INET)
782 					kill.dst.addr.v.a.addr.v4 =
783 					    ((struct sockaddr_in *)resp[1]->
784 					    ai_addr)->sin_addr;
785 				else if (kill.af == AF_INET6)
786 					kill.dst.addr.v.a.addr.v6 =
787 					    ((struct sockaddr_in6 *)resp[1]->
788 					    ai_addr)->sin6_addr;
789 				else
790 					errx(1, "Unknown address family %d",
791 					    kill.af);
792 
793 				if (pfctl_kill_states(dev, &kill, &newkilled))
794 					err(1, "DIOCKILLSTATES");
795 				killed += newkilled;
796 			}
797 			freeaddrinfo(res[1]);
798 		} else {
799 			if (pfctl_kill_states(dev, &kill, &newkilled))
800 				err(1, "DIOCKILLSTATES");
801 			killed += newkilled;
802 		}
803 	}
804 
805 	freeaddrinfo(res[0]);
806 
807 	if ((opts & PF_OPT_QUIET) == 0)
808 		fprintf(stderr, "killed %d states from %d sources and %d "
809 		    "destinations\n", killed, sources, dests);
810 	return (0);
811 }
812 
813 int
pfctl_gateway_kill_states(int dev,const char * iface,int opts)814 pfctl_gateway_kill_states(int dev, const char *iface, int opts)
815 {
816 	struct pfctl_kill kill;
817 	struct addrinfo *res, *resp;
818 	struct sockaddr last_src;
819 	unsigned int newkilled;
820 	int killed = 0;
821 	int ret_ga;
822 
823 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
824 		warnx("no gateway specified");
825 		usage();
826 	}
827 
828 	memset(&kill, 0, sizeof(kill));
829 	memset(&kill.rt_addr.addr.v.a.mask, 0xff,
830 	    sizeof(kill.rt_addr.addr.v.a.mask));
831 	memset(&last_src, 0xff, sizeof(last_src));
832 	if (iface != NULL && strlcpy(kill.ifname, iface,
833 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
834 		errx(1, "invalid interface: %s", iface);
835 
836 	if (opts & PF_OPT_KILLMATCH)
837 		kill.kill_match = true;
838 
839 	pfctl_addrprefix(state_kill[1], &kill.rt_addr.addr.v.a.mask);
840 
841 	if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, &res))) {
842 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
843 		/* NOTREACHED */
844 	}
845 	for (resp = res; resp; resp = resp->ai_next) {
846 		if (resp->ai_addr == NULL)
847 			continue;
848 		/* We get lots of duplicates.  Catch the easy ones */
849 		if (memcmp(&last_src, resp->ai_addr, sizeof(last_src)) == 0)
850 			continue;
851 		last_src = *(struct sockaddr *)resp->ai_addr;
852 
853 		kill.af = resp->ai_family;
854 
855 		if (kill.af == AF_INET)
856 			kill.rt_addr.addr.v.a.addr.v4 =
857 			    ((struct sockaddr_in *)resp->ai_addr)->sin_addr;
858 		else if (kill.af == AF_INET6)
859 			kill.rt_addr.addr.v.a.addr.v6 =
860 			    ((struct sockaddr_in6 *)resp->ai_addr)->
861 			    sin6_addr;
862 		else
863 			errx(1, "Unknown address family %d", kill.af);
864 
865 		if (pfctl_kill_states(dev, &kill, &newkilled))
866 			err(1, "DIOCKILLSTATES");
867 		killed += newkilled;
868 	}
869 
870 	freeaddrinfo(res);
871 
872 	if ((opts & PF_OPT_QUIET) == 0)
873 		fprintf(stderr, "killed %d states\n", killed);
874 	return (0);
875 }
876 
877 int
pfctl_label_kill_states(int dev,const char * iface,int opts)878 pfctl_label_kill_states(int dev, const char *iface, int opts)
879 {
880 	struct pfctl_kill kill;
881 	unsigned int killed;
882 
883 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
884 		warnx("no label specified");
885 		usage();
886 	}
887 	memset(&kill, 0, sizeof(kill));
888 	if (iface != NULL && strlcpy(kill.ifname, iface,
889 	    sizeof(kill.ifname)) >= sizeof(kill.ifname))
890 		errx(1, "invalid interface: %s", iface);
891 
892 	if (opts & PF_OPT_KILLMATCH)
893 		kill.kill_match = true;
894 
895 	if (strlcpy(kill.label, state_kill[1], sizeof(kill.label)) >=
896 	    sizeof(kill.label))
897 		errx(1, "label too long: %s", state_kill[1]);
898 
899 	if (pfctl_kill_states(dev, &kill, &killed))
900 		err(1, "DIOCKILLSTATES");
901 
902 	if ((opts & PF_OPT_QUIET) == 0)
903 		fprintf(stderr, "killed %d states\n", killed);
904 
905 	return (0);
906 }
907 
908 int
pfctl_id_kill_states(int dev,const char * iface,int opts)909 pfctl_id_kill_states(int dev, const char *iface, int opts)
910 {
911 	struct pfctl_kill kill;
912 	unsigned int killed;
913 
914 	if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
915 		warnx("no id specified");
916 		usage();
917 	}
918 
919 	memset(&kill, 0, sizeof(kill));
920 
921 	if (opts & PF_OPT_KILLMATCH)
922 		kill.kill_match = true;
923 
924 	if ((sscanf(state_kill[1], "%jx/%x",
925 	    &kill.cmp.id, &kill.cmp.creatorid)) == 2) {
926 	}
927 	else if ((sscanf(state_kill[1], "%jx", &kill.cmp.id)) == 1) {
928 		kill.cmp.creatorid = 0;
929 	} else {
930 		warnx("wrong id format specified");
931 		usage();
932 	}
933 	if (kill.cmp.id == 0) {
934 		warnx("cannot kill id 0");
935 		usage();
936 	}
937 
938 	if (pfctl_kill_states(dev, &kill, &killed))
939 		err(1, "DIOCKILLSTATES");
940 
941 	if ((opts & PF_OPT_QUIET) == 0)
942 		fprintf(stderr, "killed %d states\n", killed);
943 
944 	return (0);
945 }
946 
947 int
pfctl_get_pool(int dev,struct pfctl_pool * pool,u_int32_t nr,u_int32_t ticket,int r_action,char * anchorname)948 pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
949     u_int32_t ticket, int r_action, char *anchorname)
950 {
951 	struct pfioc_pooladdr pp;
952 	struct pf_pooladdr *pa;
953 	u_int32_t pnr, mpnr;
954 
955 	memset(&pp, 0, sizeof(pp));
956 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
957 	pp.r_action = r_action;
958 	pp.r_num = nr;
959 	pp.ticket = ticket;
960 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
961 		warn("DIOCGETADDRS");
962 		return (-1);
963 	}
964 	mpnr = pp.nr;
965 	TAILQ_INIT(&pool->list);
966 	for (pnr = 0; pnr < mpnr; ++pnr) {
967 		pp.nr = pnr;
968 		if (ioctl(dev, DIOCGETADDR, &pp)) {
969 			warn("DIOCGETADDR");
970 			return (-1);
971 		}
972 		pa = calloc(1, sizeof(struct pf_pooladdr));
973 		if (pa == NULL)
974 			err(1, "calloc");
975 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
976 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
977 	}
978 
979 	return (0);
980 }
981 
982 void
pfctl_move_pool(struct pfctl_pool * src,struct pfctl_pool * dst)983 pfctl_move_pool(struct pfctl_pool *src, struct pfctl_pool *dst)
984 {
985 	struct pf_pooladdr *pa;
986 
987 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
988 		TAILQ_REMOVE(&src->list, pa, entries);
989 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
990 	}
991 }
992 
993 void
pfctl_clear_pool(struct pfctl_pool * pool)994 pfctl_clear_pool(struct pfctl_pool *pool)
995 {
996 	struct pf_pooladdr *pa;
997 
998 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
999 		TAILQ_REMOVE(&pool->list, pa, entries);
1000 		free(pa);
1001 	}
1002 }
1003 
1004 void
pfctl_print_eth_rule_counters(struct pfctl_eth_rule * rule,int opts)1005 pfctl_print_eth_rule_counters(struct pfctl_eth_rule *rule, int opts)
1006 {
1007 	if (opts & PF_OPT_VERBOSE) {
1008 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1009 			    "Bytes: %-10llu]\n",
1010 			    (unsigned long long)rule->evaluations,
1011 			    (unsigned long long)(rule->packets[0] +
1012 			    rule->packets[1]),
1013 			    (unsigned long long)(rule->bytes[0] +
1014 			    rule->bytes[1]));
1015 	}
1016 	if (opts & PF_OPT_VERBOSE2) {
1017 		char timestr[30];
1018 
1019 		if (rule->last_active_timestamp != 0) {
1020 			bcopy(ctime(&rule->last_active_timestamp), timestr,
1021 			    sizeof(timestr));
1022 			*strchr(timestr, '\n') = '\0';
1023 		} else {
1024 			snprintf(timestr, sizeof(timestr), "N/A");
1025 		}
1026 		printf("  [ Last Active Time: %s ]\n", timestr);
1027 	}
1028 }
1029 
1030 void
pfctl_print_rule_counters(struct pfctl_rule * rule,int opts)1031 pfctl_print_rule_counters(struct pfctl_rule *rule, int opts)
1032 {
1033 	if (opts & PF_OPT_DEBUG) {
1034 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
1035 		    "p", "sa", "sp", "da", "dp" };
1036 		int i;
1037 
1038 		printf("  [ Skip steps: ");
1039 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
1040 			if (rule->skip[i].nr == rule->nr + 1)
1041 				continue;
1042 			printf("%s=", t[i]);
1043 			if (rule->skip[i].nr == -1)
1044 				printf("end ");
1045 			else
1046 				printf("%u ", rule->skip[i].nr);
1047 		}
1048 		printf("]\n");
1049 
1050 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
1051 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
1052 	}
1053 	if (opts & PF_OPT_VERBOSE) {
1054 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
1055 			    "Bytes: %-10llu  States: %-6ju]\n",
1056 			    (unsigned long long)rule->evaluations,
1057 			    (unsigned long long)(rule->packets[0] +
1058 			    rule->packets[1]),
1059 			    (unsigned long long)(rule->bytes[0] +
1060 			    rule->bytes[1]), (uintmax_t)rule->states_cur);
1061 		if (!(opts & PF_OPT_DEBUG))
1062 			printf("  [ Inserted: uid %u pid %u "
1063 			    "State Creations: %-6ju]\n",
1064 			    (unsigned)rule->cuid, (unsigned)rule->cpid,
1065 			    (uintmax_t)rule->states_tot);
1066 	}
1067 	if (opts & PF_OPT_VERBOSE2) {
1068 		char timestr[30];
1069 		if (rule->last_active_timestamp != 0) {
1070 			bcopy(ctime(&rule->last_active_timestamp), timestr,
1071 			    sizeof(timestr));
1072 			*strchr(timestr, '\n') = '\0';
1073 		} else {
1074 			snprintf(timestr, sizeof(timestr), "N/A");
1075 		}
1076 		printf("  [ Last Active Time: %s ]\n", timestr);
1077 	}
1078 }
1079 
1080 void
pfctl_print_title(char * title)1081 pfctl_print_title(char *title)
1082 {
1083 	if (!first_title)
1084 		printf("\n");
1085 	first_title = 0;
1086 	printf("%s\n", title);
1087 }
1088 
1089 int
pfctl_show_eth_rules(int dev,char * path,int opts,enum pfctl_show format,char * anchorname,int depth,int wildcard)1090 pfctl_show_eth_rules(int dev, char *path, int opts, enum pfctl_show format,
1091     char *anchorname, int depth, int wildcard)
1092 {
1093 	char anchor_call[MAXPATHLEN];
1094 	struct pfctl_eth_rules_info info;
1095 	struct pfctl_eth_rule rule;
1096 	int brace;
1097 	int dotitle = opts & PF_OPT_SHOWALL;
1098 	int len = strlen(path);
1099 	char *npath, *p;
1100 
1101 	/*
1102 	 * Truncate a trailing / and * on an anchorname before searching for
1103 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1104 	 * to the kernel.
1105 	 */
1106 	if ((p = strrchr(anchorname, '/')) != NULL &&
1107 			p[1] == '*' && p[2] == '\0') {
1108 		p[0] = '\0';
1109 	}
1110 
1111 	if (anchorname[0] == '/') {
1112 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1113 			errx(1, "pfctl_rules: calloc");
1114 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1115 	} else {
1116 		if (path[0])
1117 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1118 		else
1119 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1120 		npath = path;
1121 	}
1122 
1123 	/*
1124 	 * If this anchor was called with a wildcard path, go through
1125 	 * the rulesets in the anchor rather than the rules.
1126 	 */
1127 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1128 		struct pfctl_eth_rulesets_info	ri;
1129 		u_int32_t                mnr, nr;
1130 
1131 		if (pfctl_get_eth_rulesets_info(dev, &ri, npath)) {
1132 			if (errno == EINVAL) {
1133 				fprintf(stderr, "Anchor '%s' "
1134 						"not found.\n", anchorname);
1135 			} else {
1136 				warn("DIOCGETETHRULESETS");
1137 				return (-1);
1138 			}
1139 		}
1140 		mnr = ri.nr;
1141 
1142 		pfctl_print_eth_rule_counters(&rule, opts);
1143 		for (nr = 0; nr < mnr; ++nr) {
1144 			struct pfctl_eth_ruleset_info	rs;
1145 
1146 			if (pfctl_get_eth_ruleset(dev, npath, nr, &rs))
1147 				err(1, "DIOCGETETHRULESET");
1148 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1149 			printf("anchor \"%s\" all {\n", rs.name);
1150 			pfctl_show_eth_rules(dev, npath, opts,
1151 					format, rs.name, depth + 1, 0);
1152 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1153 			printf("}\n");
1154 		}
1155 		path[len] = '\0';
1156 		return (0);
1157 	}
1158 
1159 	if (pfctl_get_eth_rules_info(dev, &info, path)) {
1160 		warn("DIOCGETETHRULES");
1161 		return (-1);
1162 	}
1163 	for (int nr = 0; nr < info.nr; nr++) {
1164 		brace = 0;
1165 		INDENT(depth, !(opts & PF_OPT_VERBOSE));
1166 		if (pfctl_get_eth_rule(dev, nr, info.ticket, path, &rule,
1167 		    opts & PF_OPT_CLRRULECTRS, anchor_call) != 0) {
1168 			warn("DIOCGETETHRULE");
1169 			return (-1);
1170 		}
1171 		if (anchor_call[0] &&
1172 		   ((((p = strrchr(anchor_call, '_')) != NULL) &&
1173 		   (p == anchor_call ||
1174 		   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
1175 			brace++;
1176 			int aclen = strlen(anchor_call);
1177 			if (anchor_call[aclen - 1] == '*')
1178 				anchor_call[aclen - 2] = '\0';
1179 		}
1180 		p = &anchor_call[0];
1181 		if (dotitle) {
1182 			pfctl_print_title("ETH RULES:");
1183 			dotitle = 0;
1184 		}
1185 		print_eth_rule(&rule, anchor_call,
1186 		    opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1187 		if (brace)
1188 			printf(" {\n");
1189 		else
1190 			printf("\n");
1191 		pfctl_print_eth_rule_counters(&rule, opts);
1192 		if (brace) {
1193 			pfctl_show_eth_rules(dev, path, opts, format,
1194 			    p, depth + 1, rule.anchor_wildcard);
1195 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1196 			printf("}\n");
1197 		}
1198 	}
1199 
1200 	path[len] = '\0';
1201 	return (0);
1202 }
1203 
1204 int
pfctl_show_rules(int dev,char * path,int opts,enum pfctl_show format,char * anchorname,int depth,int wildcard)1205 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
1206     char *anchorname, int depth, int wildcard)
1207 {
1208 	struct pfctl_rules_info ri;
1209 	struct pfctl_rule rule;
1210 	char anchor_call[MAXPATHLEN];
1211 	u_int32_t nr, header = 0;
1212 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
1213 	int numeric = opts & PF_OPT_NUMERIC;
1214 	int len = strlen(path), ret = 0;
1215 	char *npath, *p;
1216 
1217 	/*
1218 	 * Truncate a trailing / and * on an anchorname before searching for
1219 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1220 	 * to the kernel.
1221 	 */
1222 	if ((p = strrchr(anchorname, '/')) != NULL &&
1223 	    p[1] == '*' && p[2] == '\0') {
1224 		p[0] = '\0';
1225 	}
1226 
1227 	if (anchorname[0] == '/') {
1228 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1229 			errx(1, "pfctl_rules: calloc");
1230 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1231 	} else {
1232 		if (path[0])
1233 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1234 		else
1235 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1236 		npath = path;
1237 	}
1238 
1239 	/*
1240 	 * If this anchor was called with a wildcard path, go through
1241 	 * the rulesets in the anchor rather than the rules.
1242 	 */
1243 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1244 		struct pfioc_ruleset     prs;
1245 		u_int32_t                mnr, nr;
1246 
1247 		memset(&prs, 0, sizeof(prs));
1248 		memcpy(prs.path, npath, sizeof(prs.path));
1249 		if (ioctl(dev, DIOCGETRULESETS, &prs)) {
1250 			if (errno == EINVAL)
1251 				fprintf(stderr, "Anchor '%s' "
1252 				    "not found.\n", anchorname);
1253 			else
1254 				err(1, "DIOCGETRULESETS");
1255 		}
1256 		mnr = prs.nr;
1257 
1258 		pfctl_print_rule_counters(&rule, opts);
1259 		for (nr = 0; nr < mnr; ++nr) {
1260 			prs.nr = nr;
1261 			if (ioctl(dev, DIOCGETRULESET, &prs))
1262 				err(1, "DIOCGETRULESET");
1263 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1264 			printf("anchor \"%s\" all {\n", prs.name);
1265 			pfctl_show_rules(dev, npath, opts,
1266 			    format, prs.name, depth + 1, 0);
1267 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1268 			printf("}\n");
1269 		}
1270 		path[len] = '\0';
1271 		return (0);
1272 	}
1273 
1274 	if (opts & PF_OPT_SHOWALL) {
1275 		ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1276 		if (ret != 0) {
1277 			warn("DIOCGETRULES");
1278 			goto error;
1279 		}
1280 		header++;
1281 	}
1282 	ret = pfctl_get_rules_info(dev, &ri, PF_SCRUB, path);
1283 	if (ret != 0) {
1284 		warn("DIOCGETRULES");
1285 		goto error;
1286 	}
1287 	if (opts & PF_OPT_SHOWALL) {
1288 		if (format == PFCTL_SHOW_RULES && (ri.nr > 0 || header))
1289 			pfctl_print_title("FILTER RULES:");
1290 		else if (format == PFCTL_SHOW_LABELS && labels)
1291 			pfctl_print_title("LABEL COUNTERS:");
1292 	}
1293 
1294 	for (nr = 0; nr < ri.nr; ++nr) {
1295 		if (pfctl_get_clear_rule(dev, nr, ri.ticket, path, PF_SCRUB,
1296 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1297 			warn("DIOCGETRULENV");
1298 			goto error;
1299 		}
1300 
1301 		if (pfctl_get_pool(dev, &rule.rpool,
1302 		    nr, ri.ticket, PF_SCRUB, path) != 0)
1303 			goto error;
1304 
1305 		switch (format) {
1306 		case PFCTL_SHOW_LABELS:
1307 			break;
1308 		case PFCTL_SHOW_RULES:
1309 			if (rule.label[0][0] && (opts & PF_OPT_SHOWALL))
1310 				labels = 1;
1311 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1312 			printf("\n");
1313 			pfctl_print_rule_counters(&rule, opts);
1314 			break;
1315 		case PFCTL_SHOW_NOTHING:
1316 			break;
1317 		}
1318 		pfctl_clear_pool(&rule.rpool);
1319 	}
1320 	ret = pfctl_get_rules_info(dev, &ri, PF_PASS, path);
1321 	if (ret != 0) {
1322 		warn("DIOCGETRULES");
1323 		goto error;
1324 	}
1325 	for (nr = 0; nr < ri.nr; ++nr) {
1326 		if (pfctl_get_clear_rule(dev, nr, ri.ticket, path, PF_PASS,
1327 		    &rule, anchor_call, opts & PF_OPT_CLRRULECTRS)) {
1328 			warn("DIOCGETRULE");
1329 			goto error;
1330 		}
1331 
1332 		if (pfctl_get_pool(dev, &rule.rpool,
1333 		    nr, ri.ticket, PF_PASS, path) != 0)
1334 			goto error;
1335 
1336 		switch (format) {
1337 		case PFCTL_SHOW_LABELS: {
1338 			bool show = false;
1339 			int i = 0;
1340 
1341 			while (rule.label[i][0]) {
1342 				printf("%s ", rule.label[i++]);
1343 				show = true;
1344 			}
1345 
1346 			if (show) {
1347 				printf("%llu %llu %llu %llu"
1348 				    " %llu %llu %llu %ju\n",
1349 				    (unsigned long long)rule.evaluations,
1350 				    (unsigned long long)(rule.packets[0] +
1351 				    rule.packets[1]),
1352 				    (unsigned long long)(rule.bytes[0] +
1353 				    rule.bytes[1]),
1354 				    (unsigned long long)rule.packets[0],
1355 				    (unsigned long long)rule.bytes[0],
1356 				    (unsigned long long)rule.packets[1],
1357 				    (unsigned long long)rule.bytes[1],
1358 				    (uintmax_t)rule.states_tot);
1359 			}
1360 			break;
1361 		}
1362 		case PFCTL_SHOW_RULES:
1363 			if (rule.label[0][0] && (opts & PF_OPT_SHOWALL))
1364 				labels = 1;
1365 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1366 			print_rule(&rule, anchor_call, rule_numbers, numeric);
1367 
1368 			/*
1369 			 * If this is a 'unnamed' brace notation
1370 			 * anchor, OR the user has explicitly requested
1371 			 * recursion, print it recursively.
1372 			 */
1373 			if (anchor_call[0] &&
1374 			    (((p = strrchr(anchor_call, '/')) ?
1375 			      p[1] == '_' : anchor_call[0] == '_') ||
1376 			     opts & PF_OPT_RECURSE)) {
1377 				printf(" {\n");
1378 				pfctl_print_rule_counters(&rule, opts);
1379 				pfctl_show_rules(dev, npath, opts, format,
1380 				    anchor_call, depth + 1,
1381 				    rule.anchor_wildcard);
1382 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1383 				printf("}\n");
1384 			} else {
1385 				printf("\n");
1386 				pfctl_print_rule_counters(&rule, opts);
1387 			}
1388 			break;
1389 		case PFCTL_SHOW_NOTHING:
1390 			break;
1391 		}
1392 		pfctl_clear_pool(&rule.rpool);
1393 	}
1394 
1395  error:
1396 	path[len] = '\0';
1397 	return (ret);
1398 }
1399 
1400 int
pfctl_show_nat(int dev,char * path,int opts,char * anchorname,int depth,int wildcard)1401 pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth,
1402     int wildcard)
1403 {
1404 	struct pfctl_rules_info ri;
1405 	struct pfctl_rule rule;
1406 	char anchor_call[MAXPATHLEN];
1407 	u_int32_t nr;
1408 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
1409 	int i, dotitle = opts & PF_OPT_SHOWALL;
1410 	int ret;
1411 	int len = strlen(path);
1412 	char *npath, *p;
1413 
1414 	/*
1415 	 * Truncate a trailing / and * on an anchorname before searching for
1416 	 * the ruleset, this is syntactic sugar that doesn't actually make it
1417 	 * to the kernel.
1418 	 */
1419 	if ((p = strrchr(anchorname, '/')) != NULL &&
1420 	    p[1] == '*' && p[2] == '\0') {
1421 		p[0] = '\0';
1422 	}
1423 
1424 	if (anchorname[0] == '/') {
1425 		if ((npath = calloc(1, MAXPATHLEN)) == NULL)
1426 			errx(1, "pfctl_rules: calloc");
1427 		snprintf(npath, MAXPATHLEN, "%s", anchorname);
1428 	} else {
1429 		if (path[0])
1430 			snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
1431 		else
1432 			snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
1433 		npath = path;
1434 	}
1435 
1436 	/*
1437 	 * If this anchor was called with a wildcard path, go through
1438 	 * the rulesets in the anchor rather than the rules.
1439 	 */
1440 	if (wildcard && (opts & PF_OPT_RECURSE)) {
1441 		struct pfioc_ruleset     prs;
1442 		u_int32_t                mnr, nr;
1443 		memset(&prs, 0, sizeof(prs));
1444 		memcpy(prs.path, npath, sizeof(prs.path));
1445 		if (ioctl(dev, DIOCGETRULESETS, &prs)) {
1446 			if (errno == EINVAL)
1447 				fprintf(stderr, "NAT anchor '%s' "
1448 				    "not found.\n", anchorname);
1449 			else
1450 				err(1, "DIOCGETRULESETS");
1451 		}
1452 		mnr = prs.nr;
1453 
1454 		pfctl_print_rule_counters(&rule, opts);
1455 		for (nr = 0; nr < mnr; ++nr) {
1456 			prs.nr = nr;
1457 			if (ioctl(dev, DIOCGETRULESET, &prs))
1458 				err(1, "DIOCGETRULESET");
1459 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1460 			printf("nat-anchor \"%s\" all {\n", prs.name);
1461 			pfctl_show_nat(dev, npath, opts,
1462 			    prs.name, depth + 1, 0);
1463 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1464 			printf("}\n");
1465 		}
1466 		path[len] = '\0';
1467 		return (0);
1468 	}
1469 
1470 	for (i = 0; i < 3; i++) {
1471 		ret = pfctl_get_rules_info(dev, &ri, nattype[i], path);
1472 		if (ret != 0) {
1473 			warn("DIOCGETRULES");
1474 			return (-1);
1475 		}
1476 		for (nr = 0; nr < ri.nr; ++nr) {
1477 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
1478 
1479 			if (pfctl_get_rule(dev, nr, ri.ticket, path,
1480 			    nattype[i], &rule, anchor_call)) {
1481 				warn("DIOCGETRULE");
1482 				return (-1);
1483 			}
1484 			if (pfctl_get_pool(dev, &rule.rpool, nr,
1485 			    ri.ticket, nattype[i], path) != 0)
1486 				return (-1);
1487 
1488 			if (dotitle) {
1489 				pfctl_print_title("TRANSLATION RULES:");
1490 				dotitle = 0;
1491 			}
1492 			print_rule(&rule, anchor_call,
1493 			    opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC);
1494 			if (anchor_call[0] &&
1495 			    (((p = strrchr(anchor_call, '/')) ?
1496 			      p[1] == '_' : anchor_call[0] == '_') ||
1497 			     opts & PF_OPT_RECURSE)) {
1498 				printf(" {\n");
1499 				pfctl_print_rule_counters(&rule, opts);
1500 				pfctl_show_nat(dev, npath, opts, anchor_call,
1501 				    depth + 1, rule.anchor_wildcard);
1502 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
1503 				printf("}\n");
1504 			} else {
1505 				printf("\n");
1506 				pfctl_print_rule_counters(&rule, opts);
1507 			}
1508 		}
1509 	}
1510 	return (0);
1511 }
1512 
1513 int
pfctl_show_src_nodes(int dev,int opts)1514 pfctl_show_src_nodes(int dev, int opts)
1515 {
1516 	struct pfioc_src_nodes psn;
1517 	struct pf_src_node *p;
1518 	char *inbuf = NULL, *newinbuf = NULL;
1519 	unsigned int len = 0;
1520 	int i;
1521 
1522 	memset(&psn, 0, sizeof(psn));
1523 	for (;;) {
1524 		psn.psn_len = len;
1525 		if (len) {
1526 			newinbuf = realloc(inbuf, len);
1527 			if (newinbuf == NULL)
1528 				err(1, "realloc");
1529 			psn.psn_buf = inbuf = newinbuf;
1530 		}
1531 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1532 			warn("DIOCGETSRCNODES");
1533 			free(inbuf);
1534 			return (-1);
1535 		}
1536 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1537 			break;
1538 		if (len == 0 && psn.psn_len == 0)
1539 			goto done;
1540 		if (len == 0 && psn.psn_len != 0)
1541 			len = psn.psn_len;
1542 		if (psn.psn_len == 0)
1543 			goto done;	/* no src_nodes */
1544 		len *= 2;
1545 	}
1546 	p = psn.psn_src_nodes;
1547 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1548 		pfctl_print_title("SOURCE TRACKING NODES:");
1549 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1550 		print_src_node(p, opts);
1551 		p++;
1552 	}
1553 done:
1554 	free(inbuf);
1555 	return (0);
1556 }
1557 
1558 int
pfctl_show_states(int dev,const char * iface,int opts)1559 pfctl_show_states(int dev, const char *iface, int opts)
1560 {
1561 	struct pfctl_states states;
1562 	struct pfctl_state *s;
1563 	int dotitle = (opts & PF_OPT_SHOWALL);
1564 
1565 	memset(&states, 0, sizeof(states));
1566 
1567 	if (pfctl_get_states(dev, &states))
1568 		return (-1);
1569 
1570 	TAILQ_FOREACH(s, &states.states, entry) {
1571 		if (iface != NULL && strcmp(s->ifname, iface))
1572 			continue;
1573 		if (dotitle) {
1574 			pfctl_print_title("STATES:");
1575 			dotitle = 0;
1576 		}
1577 		print_state(s, opts);
1578 	}
1579 
1580 	pfctl_free_states(&states);
1581 
1582 	return (0);
1583 }
1584 
1585 int
pfctl_show_status(int dev,int opts)1586 pfctl_show_status(int dev, int opts)
1587 {
1588 	struct pfctl_status	*status;
1589 	struct pfctl_syncookies	cookies;
1590 
1591 	if ((status = pfctl_get_status(dev)) == NULL) {
1592 		warn("DIOCGETSTATUS");
1593 		return (-1);
1594 	}
1595 	if (pfctl_get_syncookies(dev, &cookies)) {
1596 		pfctl_free_status(status);
1597 		warn("DIOCGETSYNCOOKIES");
1598 		return (-1);
1599 	}
1600 	if (opts & PF_OPT_SHOWALL)
1601 		pfctl_print_title("INFO:");
1602 	print_status(status, &cookies, opts);
1603 	pfctl_free_status(status);
1604 	return (0);
1605 }
1606 
1607 int
pfctl_show_running(int dev)1608 pfctl_show_running(int dev)
1609 {
1610 	struct pfctl_status *status;
1611 	int running;
1612 
1613 	if ((status = pfctl_get_status(dev)) == NULL) {
1614 		warn("DIOCGETSTATUS");
1615 		return (-1);
1616 	}
1617 
1618 	running = status->running;
1619 
1620 	print_running(status);
1621 	pfctl_free_status(status);
1622 	return (!running);
1623 }
1624 
1625 int
pfctl_show_timeouts(int dev,int opts)1626 pfctl_show_timeouts(int dev, int opts)
1627 {
1628 	struct pfioc_tm pt;
1629 	int i;
1630 
1631 	if (opts & PF_OPT_SHOWALL)
1632 		pfctl_print_title("TIMEOUTS:");
1633 	memset(&pt, 0, sizeof(pt));
1634 	for (i = 0; pf_timeouts[i].name; i++) {
1635 		pt.timeout = pf_timeouts[i].timeout;
1636 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1637 			err(1, "DIOCGETTIMEOUT");
1638 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1639 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1640 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1641 			printf(" states");
1642 		else
1643 			printf("s");
1644 		printf("\n");
1645 	}
1646 	return (0);
1647 
1648 }
1649 
1650 int
pfctl_show_limits(int dev,int opts)1651 pfctl_show_limits(int dev, int opts)
1652 {
1653 	struct pfioc_limit pl;
1654 	int i;
1655 
1656 	if (opts & PF_OPT_SHOWALL)
1657 		pfctl_print_title("LIMITS:");
1658 	memset(&pl, 0, sizeof(pl));
1659 	for (i = 0; pf_limits[i].name; i++) {
1660 		pl.index = pf_limits[i].index;
1661 		if (ioctl(dev, DIOCGETLIMIT, &pl))
1662 			err(1, "DIOCGETLIMIT");
1663 		printf("%-13s ", pf_limits[i].name);
1664 		if (pl.limit == UINT_MAX)
1665 			printf("unlimited\n");
1666 		else
1667 			printf("hard limit %8u\n", pl.limit);
1668 	}
1669 	return (0);
1670 }
1671 
1672 /* callbacks for rule/nat/rdr/addr */
1673 int
pfctl_add_pool(struct pfctl * pf,struct pfctl_pool * p,sa_family_t af)1674 pfctl_add_pool(struct pfctl *pf, struct pfctl_pool *p, sa_family_t af)
1675 {
1676 	struct pf_pooladdr *pa;
1677 
1678 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
1679 		if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1680 			err(1, "DIOCBEGINADDRS");
1681 	}
1682 
1683 	pf->paddr.af = af;
1684 	TAILQ_FOREACH(pa, &p->list, entries) {
1685 		memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1686 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
1687 			if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1688 				err(1, "DIOCADDADDR");
1689 		}
1690 	}
1691 	return (0);
1692 }
1693 
1694 int
pfctl_append_rule(struct pfctl * pf,struct pfctl_rule * r,const char * anchor_call)1695 pfctl_append_rule(struct pfctl *pf, struct pfctl_rule *r,
1696     const char *anchor_call)
1697 {
1698 	u_int8_t		rs_num;
1699 	struct pfctl_rule	*rule;
1700 	struct pfctl_ruleset	*rs;
1701 	char 			*p;
1702 
1703 	rs_num = pf_get_ruleset_number(r->action);
1704 	if (rs_num == PF_RULESET_MAX)
1705 		errx(1, "Invalid rule type %d", r->action);
1706 
1707 	rs = &pf->anchor->ruleset;
1708 
1709 	if (anchor_call[0] && r->anchor == NULL) {
1710 		/*
1711 		 * Don't make non-brace anchors part of the main anchor pool.
1712 		 */
1713 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1714 			err(1, "pfctl_append_rule: calloc");
1715 
1716 		pf_init_ruleset(&r->anchor->ruleset);
1717 		r->anchor->ruleset.anchor = r->anchor;
1718 		if (strlcpy(r->anchor->path, anchor_call,
1719 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1720 			errx(1, "pfctl_append_rule: strlcpy");
1721 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1722 			if (!strlen(p))
1723 				err(1, "pfctl_append_rule: bad anchor name %s",
1724 				    anchor_call);
1725 		} else
1726 			p = (char *)anchor_call;
1727 		if (strlcpy(r->anchor->name, p,
1728 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1729 			errx(1, "pfctl_append_rule: strlcpy");
1730 	}
1731 
1732 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1733 		err(1, "calloc");
1734 	bcopy(r, rule, sizeof(*rule));
1735 	TAILQ_INIT(&rule->rpool.list);
1736 	pfctl_move_pool(&r->rpool, &rule->rpool);
1737 
1738 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1739 	return (0);
1740 }
1741 
1742 int
pfctl_append_eth_rule(struct pfctl * pf,struct pfctl_eth_rule * r,const char * anchor_call)1743 pfctl_append_eth_rule(struct pfctl *pf, struct pfctl_eth_rule *r,
1744     const char *anchor_call)
1745 {
1746 	struct pfctl_eth_rule		*rule;
1747 	struct pfctl_eth_ruleset	*rs;
1748 	char 				*p;
1749 
1750 	rs = &pf->eanchor->ruleset;
1751 
1752 	if (anchor_call[0] && r->anchor == NULL) {
1753 		/*
1754 		 * Don't make non-brace anchors part of the main anchor pool.
1755 		 */
1756 		if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1757 			err(1, "pfctl_append_rule: calloc");
1758 
1759 		pf_init_eth_ruleset(&r->anchor->ruleset);
1760 		r->anchor->ruleset.anchor = r->anchor;
1761 		if (strlcpy(r->anchor->path, anchor_call,
1762 		    sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1763 			errx(1, "pfctl_append_rule: strlcpy");
1764 		if ((p = strrchr(anchor_call, '/')) != NULL) {
1765 			if (!strlen(p))
1766 				err(1, "pfctl_append_eth_rule: bad anchor name %s",
1767 				    anchor_call);
1768 		} else
1769 			p = (char *)anchor_call;
1770 		if (strlcpy(r->anchor->name, p,
1771 		    sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1772 			errx(1, "pfctl_append_eth_rule: strlcpy");
1773 	}
1774 
1775 	if ((rule = calloc(1, sizeof(*rule))) == NULL)
1776 		err(1, "calloc");
1777 	bcopy(r, rule, sizeof(*rule));
1778 
1779 	TAILQ_INSERT_TAIL(&rs->rules, rule, entries);
1780 	return (0);
1781 }
1782 
1783 int
pfctl_eth_ruleset_trans(struct pfctl * pf,char * path,struct pfctl_eth_anchor * a)1784 pfctl_eth_ruleset_trans(struct pfctl *pf, char *path,
1785     struct pfctl_eth_anchor *a)
1786 {
1787 	int osize = pf->trans->pfrb_size;
1788 
1789 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0) {
1790 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1791 			return (1);
1792 	}
1793 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1794 		return (5);
1795 
1796 	return (0);
1797 }
1798 
1799 int
pfctl_ruleset_trans(struct pfctl * pf,char * path,struct pfctl_anchor * a,bool do_eth)1800 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pfctl_anchor *a, bool do_eth)
1801 {
1802 	int osize = pf->trans->pfrb_size;
1803 
1804 	if ((pf->loadopt & PFCTL_FLAG_ETH) != 0 && do_eth) {
1805 		if (pfctl_add_trans(pf->trans, PF_RULESET_ETH, path))
1806 			return (1);
1807 	}
1808 	if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1809 		if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1810 		    pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1811 		    pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1812 			return (1);
1813 	}
1814 	if (a == pf->astack[0] && ((altqsupport &&
1815 	    (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1816 		if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1817 			return (2);
1818 	}
1819 	if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1820 		if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1821 		    pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1822 			return (3);
1823 	}
1824 	if (pf->loadopt & PFCTL_FLAG_TABLE)
1825 		if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1826 			return (4);
1827 	if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1828 		return (5);
1829 
1830 	return (0);
1831 }
1832 
1833 int
pfctl_load_eth_ruleset(struct pfctl * pf,char * path,struct pfctl_eth_ruleset * rs,int depth)1834 pfctl_load_eth_ruleset(struct pfctl *pf, char *path,
1835     struct pfctl_eth_ruleset *rs, int depth)
1836 {
1837 	struct pfctl_eth_rule	*r;
1838 	int	error, len = strlen(path);
1839 	int	brace = 0;
1840 
1841 	pf->eanchor = rs->anchor;
1842 	if (path[0])
1843 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->eanchor->name);
1844 	else
1845 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->eanchor->name);
1846 
1847 	if (depth) {
1848 		if (TAILQ_FIRST(&rs->rules) != NULL) {
1849 			brace++;
1850 			if (pf->opts & PF_OPT_VERBOSE)
1851 				printf(" {\n");
1852 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1853 			    (error = pfctl_eth_ruleset_trans(pf,
1854 			    path, rs->anchor))) {
1855 				printf("pfctl_load_eth_rulesets: "
1856 				    "pfctl_eth_ruleset_trans %d\n", error);
1857 				goto error;
1858 			}
1859 		} else if (pf->opts & PF_OPT_VERBOSE)
1860 			printf("\n");
1861 	}
1862 
1863 	while ((r = TAILQ_FIRST(&rs->rules)) != NULL) {
1864 		TAILQ_REMOVE(&rs->rules, r, entries);
1865 
1866 		error = pfctl_load_eth_rule(pf, path, r, depth);
1867 		if (error)
1868 			return (error);
1869 
1870 		if (r->anchor) {
1871 			if ((error = pfctl_load_eth_ruleset(pf, path,
1872 			    &r->anchor->ruleset, depth + 1)))
1873 				return (error);
1874 		} else if (pf->opts & PF_OPT_VERBOSE)
1875 			printf("\n");
1876 		free(r);
1877 	}
1878 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1879 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1880 		printf("}\n");
1881 	}
1882 	path[len] = '\0';
1883 
1884 	return (0);
1885 error:
1886 	path[len] = '\0';
1887 	return (error);
1888 }
1889 
1890 int
pfctl_load_eth_rule(struct pfctl * pf,char * path,struct pfctl_eth_rule * r,int depth)1891 pfctl_load_eth_rule(struct pfctl *pf, char *path, struct pfctl_eth_rule *r,
1892     int depth)
1893 {
1894 	char			*name;
1895 	char			anchor[PF_ANCHOR_NAME_SIZE];
1896 	int			len = strlen(path);
1897 
1898 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
1899 		errx(1, "pfctl_load_eth_rule: strlcpy");
1900 
1901 	if (r->anchor) {
1902 		if (r->anchor->match) {
1903 			if (path[0])
1904 				snprintf(&path[len], MAXPATHLEN - len,
1905 				    "/%s", r->anchor->name);
1906 			else
1907 				snprintf(&path[len], MAXPATHLEN - len,
1908 				    "%s", r->anchor->name);
1909 			name = r->anchor->name;
1910 		} else
1911 			name = r->anchor->path;
1912 	} else
1913 		name = "";
1914 
1915 	if ((pf->opts & PF_OPT_NOACTION) == 0)
1916 		if (pfctl_add_eth_rule(pf->dev, r, anchor, name,
1917 		    pf->eth_ticket))
1918 			err(1, "DIOCADDETHRULENV");
1919 
1920 	if (pf->opts & PF_OPT_VERBOSE) {
1921 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1922 		print_eth_rule(r, r->anchor ? r->anchor->name : "",
1923 		    pf->opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG));
1924 	}
1925 
1926 	path[len] = '\0';
1927 
1928 	return (0);
1929 }
1930 
1931 int
pfctl_load_ruleset(struct pfctl * pf,char * path,struct pfctl_ruleset * rs,int rs_num,int depth)1932 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pfctl_ruleset *rs,
1933     int rs_num, int depth)
1934 {
1935 	struct pfctl_rule *r;
1936 	int		error, len = strlen(path);
1937 	int		brace = 0;
1938 
1939 	pf->anchor = rs->anchor;
1940 
1941 	if (path[0])
1942 		snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1943 	else
1944 		snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1945 
1946 	if (depth) {
1947 		if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1948 			brace++;
1949 			if (pf->opts & PF_OPT_VERBOSE)
1950 				printf(" {\n");
1951 			if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1952 			    (error = pfctl_ruleset_trans(pf,
1953 			    path, rs->anchor, false))) {
1954 				printf("pfctl_load_rulesets: "
1955 				    "pfctl_ruleset_trans %d\n", error);
1956 				goto error;
1957 			}
1958 		} else if (pf->opts & PF_OPT_VERBOSE)
1959 			printf("\n");
1960 
1961 	}
1962 
1963 	if (pf->optimize && rs_num == PF_RULESET_FILTER)
1964 		pfctl_optimize_ruleset(pf, rs);
1965 
1966 	while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1967 		TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1968 
1969 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1970 			expand_label(r->label[i], PF_RULE_LABEL_SIZE, r);
1971 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r);
1972 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r);
1973 
1974 		if ((error = pfctl_load_rule(pf, path, r, depth)))
1975 			goto error;
1976 		if (r->anchor) {
1977 			if ((error = pfctl_load_ruleset(pf, path,
1978 			    &r->anchor->ruleset, rs_num, depth + 1)))
1979 				goto error;
1980 		} else if (pf->opts & PF_OPT_VERBOSE)
1981 			printf("\n");
1982 		free(r);
1983 	}
1984 	if (brace && pf->opts & PF_OPT_VERBOSE) {
1985 		INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1986 		printf("}\n");
1987 	}
1988 	path[len] = '\0';
1989 	return (0);
1990 
1991  error:
1992 	path[len] = '\0';
1993 	return (error);
1994 
1995 }
1996 
1997 int
pfctl_load_rule(struct pfctl * pf,char * path,struct pfctl_rule * r,int depth)1998 pfctl_load_rule(struct pfctl *pf, char *path, struct pfctl_rule *r, int depth)
1999 {
2000 	u_int8_t		rs_num = pf_get_ruleset_number(r->action);
2001 	char			*name;
2002 	u_int32_t		ticket;
2003 	char			anchor[PF_ANCHOR_NAME_SIZE];
2004 	int			len = strlen(path);
2005 	int			error;
2006 	bool			was_present;
2007 
2008 	/* set up anchor before adding to path for anchor_call */
2009 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2010 		ticket = pfctl_get_ticket(pf->trans, rs_num, path);
2011 	if (strlcpy(anchor, path, sizeof(anchor)) >= sizeof(anchor))
2012 		errx(1, "pfctl_load_rule: strlcpy");
2013 
2014 	if (r->anchor) {
2015 		if (r->anchor->match) {
2016 			if (path[0])
2017 				snprintf(&path[len], MAXPATHLEN - len,
2018 				    "/%s", r->anchor->name);
2019 			else
2020 				snprintf(&path[len], MAXPATHLEN - len,
2021 				    "%s", r->anchor->name);
2022 			name = r->anchor->name;
2023 		} else
2024 			name = r->anchor->path;
2025 	} else
2026 		name = "";
2027 
2028 	was_present = false;
2029 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2030 		if (pfctl_add_pool(pf, &r->rpool, r->af))
2031 			return (1);
2032 		error = pfctl_add_rule(pf->dev, r, anchor, name, ticket,
2033 		    pf->paddr.ticket);
2034 		switch (error) {
2035 		case 0:
2036 			/* things worked, do nothing */
2037 			break;
2038 		case EEXIST:
2039 			/* an identical rule is already present */
2040 			was_present = true;
2041 			break;
2042 		default:
2043 			err(1, "DIOCADDRULENV");
2044 		}
2045 	}
2046 
2047 	if (pf->opts & PF_OPT_VERBOSE) {
2048 		INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
2049 		print_rule(r, name,
2050 		    pf->opts & PF_OPT_VERBOSE2,
2051 		    pf->opts & PF_OPT_NUMERIC);
2052 		if (was_present)
2053 			printf(" -- rule was already present");
2054 	}
2055 	path[len] = '\0';
2056 	pfctl_clear_pool(&r->rpool);
2057 	return (0);
2058 }
2059 
2060 int
pfctl_add_altq(struct pfctl * pf,struct pf_altq * a)2061 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
2062 {
2063 	if (altqsupport &&
2064 	    (loadopt & PFCTL_FLAG_ALTQ) != 0) {
2065 		memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
2066 		if ((pf->opts & PF_OPT_NOACTION) == 0) {
2067 			if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
2068 				if (errno == ENXIO)
2069 					errx(1, "qtype not configured");
2070 				else if (errno == ENODEV)
2071 					errx(1, "%s: driver does not support "
2072 					    "altq", a->ifname);
2073 				else
2074 					err(1, "DIOCADDALTQ");
2075 			}
2076 		}
2077 		pfaltq_store(&pf->paltq->altq);
2078 	}
2079 	return (0);
2080 }
2081 
2082 int
pfctl_rules(int dev,char * filename,int opts,int optimize,char * anchorname,struct pfr_buffer * trans)2083 pfctl_rules(int dev, char *filename, int opts, int optimize,
2084     char *anchorname, struct pfr_buffer *trans)
2085 {
2086 #define ERR(x) do { warn(x); goto _error; } while(0)
2087 #define ERRX(x) do { warnx(x); goto _error; } while(0)
2088 
2089 	struct pfr_buffer	*t, buf;
2090 	struct pfioc_altq	 pa;
2091 	struct pfctl		 pf;
2092 	struct pfctl_ruleset	*rs;
2093 	struct pfctl_eth_ruleset	*ethrs;
2094 	struct pfr_table	 trs;
2095 	char			*path;
2096 	int			 osize;
2097 
2098 	RB_INIT(&pf_anchors);
2099 	memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
2100 	pf_init_ruleset(&pf_main_anchor.ruleset);
2101 	pf_main_anchor.ruleset.anchor = &pf_main_anchor;
2102 
2103 	memset(&pf_eth_main_anchor, 0, sizeof(pf_eth_main_anchor));
2104 	pf_init_eth_ruleset(&pf_eth_main_anchor.ruleset);
2105 	pf_eth_main_anchor.ruleset.anchor = &pf_eth_main_anchor;
2106 
2107 	if (trans == NULL) {
2108 		bzero(&buf, sizeof(buf));
2109 		buf.pfrb_type = PFRB_TRANS;
2110 		t = &buf;
2111 		osize = 0;
2112 	} else {
2113 		t = trans;
2114 		osize = t->pfrb_size;
2115 	}
2116 
2117 	memset(&pa, 0, sizeof(pa));
2118 	pa.version = PFIOC_ALTQ_VERSION;
2119 	memset(&pf, 0, sizeof(pf));
2120 	memset(&trs, 0, sizeof(trs));
2121 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
2122 		ERRX("pfctl_rules: calloc");
2123 	if (strlcpy(trs.pfrt_anchor, anchorname,
2124 	    sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
2125 		ERRX("pfctl_rules: strlcpy");
2126 	pf.dev = dev;
2127 	pf.opts = opts;
2128 	pf.optimize = optimize;
2129 	pf.loadopt = loadopt;
2130 
2131 	/* non-brace anchor, create without resolving the path */
2132 	if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
2133 		ERRX("pfctl_rules: calloc");
2134 	rs = &pf.anchor->ruleset;
2135 	pf_init_ruleset(rs);
2136 	rs->anchor = pf.anchor;
2137 	if (strlcpy(pf.anchor->path, anchorname,
2138 	    sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
2139 		errx(1, "pfctl_rules: strlcpy");
2140 	if (strlcpy(pf.anchor->name, anchorname,
2141 	    sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
2142 		errx(1, "pfctl_rules: strlcpy");
2143 
2144 
2145 	pf.astack[0] = pf.anchor;
2146 	pf.asd = 0;
2147 	if (anchorname[0])
2148 		pf.loadopt &= ~PFCTL_FLAG_ALTQ;
2149 	pf.paltq = &pa;
2150 	pf.trans = t;
2151 	pfctl_init_options(&pf);
2152 
2153 	/* Set up ethernet anchor */
2154 	if ((pf.eanchor = calloc(1, sizeof(*pf.eanchor))) == NULL)
2155 		ERRX("pfctl_rules: calloc");
2156 
2157 	if (strlcpy(pf.eanchor->path, anchorname,
2158 	    sizeof(pf.eanchor->path)) >= sizeof(pf.eanchor->path))
2159 		errx(1, "pfctl_rules: strlcpy");
2160 	if (strlcpy(pf.eanchor->name, anchorname,
2161 	    sizeof(pf.eanchor->name)) >= sizeof(pf.eanchor->name))
2162 		errx(1, "pfctl_rules: strlcpy");
2163 
2164 	ethrs = &pf.eanchor->ruleset;
2165 	pf_init_eth_ruleset(ethrs);
2166 	ethrs->anchor = pf.eanchor;
2167 	pf.eastack[0] = pf.eanchor;
2168 
2169 	if ((opts & PF_OPT_NOACTION) == 0) {
2170 		/*
2171 		 * XXX For the time being we need to open transactions for
2172 		 * the main ruleset before parsing, because tables are still
2173 		 * loaded at parse time.
2174 		 */
2175 		if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor, true))
2176 			ERRX("pfctl_rules");
2177 		if (pf.loadopt & PFCTL_FLAG_ETH)
2178 			pf.eth_ticket = pfctl_get_ticket(t, PF_RULESET_ETH, anchorname);
2179 		if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
2180 			pa.ticket =
2181 			    pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
2182 		if (pf.loadopt & PFCTL_FLAG_TABLE)
2183 			pf.astack[0]->ruleset.tticket =
2184 			    pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
2185 	}
2186 
2187 	if (parse_config(filename, &pf) < 0) {
2188 		if ((opts & PF_OPT_NOACTION) == 0)
2189 			ERRX("Syntax error in config file: "
2190 			    "pf rules not loaded");
2191 		else
2192 			goto _error;
2193 	}
2194 	if (loadopt & PFCTL_FLAG_OPTION)
2195 		pfctl_adjust_skip_ifaces(&pf);
2196 
2197 	if ((pf.loadopt & PFCTL_FLAG_FILTER &&
2198 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
2199 	    (pf.loadopt & PFCTL_FLAG_ETH &&
2200 	    (pfctl_load_eth_ruleset(&pf, path, ethrs, 0))) ||
2201 	    (pf.loadopt & PFCTL_FLAG_NAT &&
2202 	    (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
2203 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
2204 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
2205 	    (pf.loadopt & PFCTL_FLAG_FILTER &&
2206 	    pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
2207 		if ((opts & PF_OPT_NOACTION) == 0)
2208 			ERRX("Unable to load rules into kernel");
2209 		else
2210 			goto _error;
2211 	}
2212 
2213 	if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
2214 		if (check_commit_altq(dev, opts) != 0)
2215 			ERRX("errors in altq config");
2216 
2217 	/* process "load anchor" directives */
2218 	if (!anchorname[0])
2219 		if (pfctl_load_anchors(dev, &pf, t) == -1)
2220 			ERRX("load anchors");
2221 
2222 	if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
2223 		if (!anchorname[0])
2224 			if (pfctl_load_options(&pf))
2225 				goto _error;
2226 		if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
2227 			ERR("DIOCXCOMMIT");
2228 	}
2229 	free(path);
2230 	return (0);
2231 
2232 _error:
2233 	if (trans == NULL) {	/* main ruleset */
2234 		if ((opts & PF_OPT_NOACTION) == 0)
2235 			if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
2236 				err(1, "DIOCXROLLBACK");
2237 		exit(1);
2238 	} else {		/* sub ruleset */
2239 		free(path);
2240 		return (-1);
2241 	}
2242 
2243 #undef ERR
2244 #undef ERRX
2245 }
2246 
2247 FILE *
pfctl_fopen(const char * name,const char * mode)2248 pfctl_fopen(const char *name, const char *mode)
2249 {
2250 	struct stat	 st;
2251 	FILE		*fp;
2252 
2253 	fp = fopen(name, mode);
2254 	if (fp == NULL)
2255 		return (NULL);
2256 	if (fstat(fileno(fp), &st)) {
2257 		fclose(fp);
2258 		return (NULL);
2259 	}
2260 	if (S_ISDIR(st.st_mode)) {
2261 		fclose(fp);
2262 		errno = EISDIR;
2263 		return (NULL);
2264 	}
2265 	return (fp);
2266 }
2267 
2268 void
pfctl_init_options(struct pfctl * pf)2269 pfctl_init_options(struct pfctl *pf)
2270 {
2271 
2272 	pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2273 	pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
2274 	pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2275 	pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2276 	pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
2277 	pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2278 	pf->timeout[PFTM_SCTP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
2279 	pf->timeout[PFTM_SCTP_OPENING] = PFTM_TCP_OPENING_VAL;
2280 	pf->timeout[PFTM_SCTP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
2281 	pf->timeout[PFTM_SCTP_CLOSING] = PFTM_TCP_CLOSING_VAL;
2282 	pf->timeout[PFTM_SCTP_CLOSED] = PFTM_TCP_CLOSED_VAL;
2283 	pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
2284 	pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
2285 	pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
2286 	pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
2287 	pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
2288 	pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
2289 	pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
2290 	pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
2291 	pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
2292 	pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
2293 	pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
2294 	pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
2295 	pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
2296 	pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
2297 
2298 	pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
2299 	pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
2300 	pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
2301 	pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
2302 
2303 	pf->debug = PF_DEBUG_URGENT;
2304 	pf->reassemble = 0;
2305 
2306 	pf->syncookies = false;
2307 	pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT;
2308 	pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT;
2309 }
2310 
2311 int
pfctl_load_options(struct pfctl * pf)2312 pfctl_load_options(struct pfctl *pf)
2313 {
2314 	int i, error = 0;
2315 
2316 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2317 		return (0);
2318 
2319 	/* load limits */
2320 	for (i = 0; i < PF_LIMIT_MAX; i++) {
2321 		if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
2322 			continue;
2323 		if (pfctl_load_limit(pf, i, pf->limit[i]))
2324 			error = 1;
2325 	}
2326 
2327 	/*
2328 	 * If we've set the limit, but haven't explicitly set adaptive
2329 	 * timeouts, do it now with a start of 60% and end of 120%.
2330 	 */
2331 	if (pf->limit_set[PF_LIMIT_STATES] &&
2332 	    !pf->timeout_set[PFTM_ADAPTIVE_START] &&
2333 	    !pf->timeout_set[PFTM_ADAPTIVE_END]) {
2334 		pf->timeout[PFTM_ADAPTIVE_START] =
2335 			(pf->limit[PF_LIMIT_STATES] / 10) * 6;
2336 		pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
2337 		pf->timeout[PFTM_ADAPTIVE_END] =
2338 			(pf->limit[PF_LIMIT_STATES] / 10) * 12;
2339 		pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
2340 	}
2341 
2342 	/* load timeouts */
2343 	for (i = 0; i < PFTM_MAX; i++) {
2344 		if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
2345 			continue;
2346 		if (pfctl_load_timeout(pf, i, pf->timeout[i]))
2347 			error = 1;
2348 	}
2349 
2350 	/* load debug */
2351 	if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
2352 		if (pfctl_load_debug(pf, pf->debug))
2353 			error = 1;
2354 
2355 	/* load logif */
2356 	if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
2357 		if (pfctl_load_logif(pf, pf->ifname))
2358 			error = 1;
2359 
2360 	/* load hostid */
2361 	if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
2362 		if (pfctl_load_hostid(pf, pf->hostid))
2363 			error = 1;
2364 
2365 	/* load reassembly settings */
2366 	if (!(pf->opts & PF_OPT_MERGE) || pf->reass_set)
2367 		if (pfctl_load_reassembly(pf, pf->reassemble))
2368 			error = 1;
2369 
2370 	/* load keepcounters */
2371 	if (pfctl_set_keepcounters(pf->dev, pf->keep_counters))
2372 		error = 1;
2373 
2374 	/* load syncookies settings */
2375 	if (pfctl_load_syncookies(pf, pf->syncookies))
2376 		error = 1;
2377 
2378 	return (error);
2379 }
2380 
2381 int
pfctl_set_limit(struct pfctl * pf,const char * opt,unsigned int limit)2382 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
2383 {
2384 	int i;
2385 
2386 
2387 	for (i = 0; pf_limits[i].name; i++) {
2388 		if (strcasecmp(opt, pf_limits[i].name) == 0) {
2389 			pf->limit[pf_limits[i].index] = limit;
2390 			pf->limit_set[pf_limits[i].index] = 1;
2391 			break;
2392 		}
2393 	}
2394 	if (pf_limits[i].name == NULL) {
2395 		warnx("Bad pool name.");
2396 		return (1);
2397 	}
2398 
2399 	if (pf->opts & PF_OPT_VERBOSE)
2400 		printf("set limit %s %d\n", opt, limit);
2401 
2402 	return (0);
2403 }
2404 
2405 int
pfctl_load_limit(struct pfctl * pf,unsigned int index,unsigned int limit)2406 pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
2407 {
2408 	struct pfioc_limit pl;
2409 
2410 	memset(&pl, 0, sizeof(pl));
2411 	pl.index = index;
2412 	pl.limit = limit;
2413 	if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
2414 		if (errno == EBUSY)
2415 			warnx("Current pool size exceeds requested hard limit");
2416 		else
2417 			warnx("DIOCSETLIMIT");
2418 		return (1);
2419 	}
2420 	return (0);
2421 }
2422 
2423 int
pfctl_set_timeout(struct pfctl * pf,const char * opt,int seconds,int quiet)2424 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
2425 {
2426 	int i;
2427 
2428 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2429 		return (0);
2430 
2431 	for (i = 0; pf_timeouts[i].name; i++) {
2432 		if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
2433 			pf->timeout[pf_timeouts[i].timeout] = seconds;
2434 			pf->timeout_set[pf_timeouts[i].timeout] = 1;
2435 			break;
2436 		}
2437 	}
2438 
2439 	if (pf_timeouts[i].name == NULL) {
2440 		warnx("Bad timeout name.");
2441 		return (1);
2442 	}
2443 
2444 
2445 	if (pf->opts & PF_OPT_VERBOSE && ! quiet)
2446 		printf("set timeout %s %d\n", opt, seconds);
2447 
2448 	return (0);
2449 }
2450 
2451 int
pfctl_load_timeout(struct pfctl * pf,unsigned int timeout,unsigned int seconds)2452 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
2453 {
2454 	struct pfioc_tm pt;
2455 
2456 	memset(&pt, 0, sizeof(pt));
2457 	pt.timeout = timeout;
2458 	pt.seconds = seconds;
2459 	if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
2460 		warnx("DIOCSETTIMEOUT");
2461 		return (1);
2462 	}
2463 	return (0);
2464 }
2465 
2466 int
pfctl_set_reassembly(struct pfctl * pf,int on,int nodf)2467 pfctl_set_reassembly(struct pfctl *pf, int on, int nodf)
2468 {
2469 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2470 		return (0);
2471 
2472 	pf->reass_set = 1;
2473 	if (on) {
2474 		pf->reassemble = PF_REASS_ENABLED;
2475 		if (nodf)
2476 			pf->reassemble |= PF_REASS_NODF;
2477 	} else {
2478 		pf->reassemble = 0;
2479 	}
2480 
2481 	if (pf->opts & PF_OPT_VERBOSE)
2482 		printf("set reassemble %s %s\n", on ? "yes" : "no",
2483 		    nodf ? "no-df" : "");
2484 
2485 	return (0);
2486 }
2487 
2488 int
pfctl_set_optimization(struct pfctl * pf,const char * opt)2489 pfctl_set_optimization(struct pfctl *pf, const char *opt)
2490 {
2491 	const struct pf_hint *hint;
2492 	int i, r;
2493 
2494 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2495 		return (0);
2496 
2497 	for (i = 0; pf_hints[i].name; i++)
2498 		if (strcasecmp(opt, pf_hints[i].name) == 0)
2499 			break;
2500 
2501 	hint = pf_hints[i].hint;
2502 	if (hint == NULL) {
2503 		warnx("invalid state timeouts optimization");
2504 		return (1);
2505 	}
2506 
2507 	for (i = 0; hint[i].name; i++)
2508 		if ((r = pfctl_set_timeout(pf, hint[i].name,
2509 		    hint[i].timeout, 1)))
2510 			return (r);
2511 
2512 	if (pf->opts & PF_OPT_VERBOSE)
2513 		printf("set optimization %s\n", opt);
2514 
2515 	return (0);
2516 }
2517 
2518 int
pfctl_set_logif(struct pfctl * pf,char * ifname)2519 pfctl_set_logif(struct pfctl *pf, char *ifname)
2520 {
2521 
2522 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2523 		return (0);
2524 
2525 	if (!strcmp(ifname, "none")) {
2526 		free(pf->ifname);
2527 		pf->ifname = NULL;
2528 	} else {
2529 		pf->ifname = strdup(ifname);
2530 		if (!pf->ifname)
2531 			errx(1, "pfctl_set_logif: strdup");
2532 	}
2533 	pf->ifname_set = 1;
2534 
2535 	if (pf->opts & PF_OPT_VERBOSE)
2536 		printf("set loginterface %s\n", ifname);
2537 
2538 	return (0);
2539 }
2540 
2541 int
pfctl_load_logif(struct pfctl * pf,char * ifname)2542 pfctl_load_logif(struct pfctl *pf, char *ifname)
2543 {
2544 	struct pfioc_if pi;
2545 
2546 	memset(&pi, 0, sizeof(pi));
2547 	if (ifname && strlcpy(pi.ifname, ifname,
2548 	    sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
2549 		warnx("pfctl_load_logif: strlcpy");
2550 		return (1);
2551 	}
2552 	if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
2553 		warnx("DIOCSETSTATUSIF");
2554 		return (1);
2555 	}
2556 	return (0);
2557 }
2558 
2559 int
pfctl_set_hostid(struct pfctl * pf,u_int32_t hostid)2560 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2561 {
2562 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2563 		return (0);
2564 
2565 	HTONL(hostid);
2566 
2567 	pf->hostid = hostid;
2568 	pf->hostid_set = 1;
2569 
2570 	if (pf->opts & PF_OPT_VERBOSE)
2571 		printf("set hostid 0x%08x\n", ntohl(hostid));
2572 
2573 	return (0);
2574 }
2575 
2576 int
pfctl_load_hostid(struct pfctl * pf,u_int32_t hostid)2577 pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2578 {
2579 	if (ioctl(dev, DIOCSETHOSTID, &hostid)) {
2580 		warnx("DIOCSETHOSTID");
2581 		return (1);
2582 	}
2583 	return (0);
2584 }
2585 
2586 int
pfctl_load_reassembly(struct pfctl * pf,u_int32_t reassembly)2587 pfctl_load_reassembly(struct pfctl *pf, u_int32_t reassembly)
2588 {
2589 	if (ioctl(dev, DIOCSETREASS, &reassembly)) {
2590 		warnx("DIOCSETREASS");
2591 		return (1);
2592 	}
2593 	return (0);
2594 }
2595 
2596 int
pfctl_load_syncookies(struct pfctl * pf,u_int8_t val)2597 pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2598 {
2599 	struct pfctl_syncookies	cookies;
2600 
2601 	bzero(&cookies, sizeof(cookies));
2602 
2603 	cookies.mode = val;
2604 	cookies.lowwater = pf->syncookieswat[0];
2605 	cookies.highwater = pf->syncookieswat[1];
2606 
2607 	if (pfctl_set_syncookies(dev, &cookies)) {
2608 		warnx("DIOCSETSYNCOOKIES");
2609 		return (1);
2610 	}
2611 	return (0);
2612 }
2613 
2614 int
pfctl_cfg_syncookies(struct pfctl * pf,uint8_t val,struct pfctl_watermarks * w)2615 pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
2616 {
2617 	if (val != PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2618 		warnx("syncookies start/end only apply to adaptive");
2619 		return (1);
2620 	}
2621 	if (val == PF_SYNCOOKIES_ADAPTIVE && w != NULL) {
2622 		if (!w->hi)
2623 			w->hi = PF_SYNCOOKIES_HIWATPCT;
2624 		if (!w->lo)
2625 			w->lo = w->hi / 2;
2626 		if (w->lo >= w->hi) {
2627 			warnx("start must be higher than end");
2628 			return (1);
2629 		}
2630 		pf->syncookieswat[0] = w->lo;
2631 		pf->syncookieswat[1] = w->hi;
2632 		pf->syncookieswat_set = 1;
2633 	}
2634 
2635 	if (pf->opts & PF_OPT_VERBOSE) {
2636 		if (val == PF_SYNCOOKIES_NEVER)
2637 			printf("set syncookies never\n");
2638 		else if (val == PF_SYNCOOKIES_ALWAYS)
2639 			printf("set syncookies always\n");
2640 		else if (val == PF_SYNCOOKIES_ADAPTIVE) {
2641 			if (pf->syncookieswat_set)
2642 				printf("set syncookies adaptive (start %u%%, "
2643 				    "end %u%%)\n", pf->syncookieswat[1],
2644 				    pf->syncookieswat[0]);
2645 			else
2646 				printf("set syncookies adaptive\n");
2647 		} else {        /* cannot happen */
2648 			warnx("king bula ate all syncookies");
2649 			return (1);
2650 		}
2651 	}
2652 
2653 	pf->syncookies = val;
2654 	return (0);
2655 }
2656 
2657 int
pfctl_set_debug(struct pfctl * pf,char * d)2658 pfctl_set_debug(struct pfctl *pf, char *d)
2659 {
2660 	u_int32_t	level;
2661 
2662 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2663 		return (0);
2664 
2665 	if (!strcmp(d, "none"))
2666 		pf->debug = PF_DEBUG_NONE;
2667 	else if (!strcmp(d, "urgent"))
2668 		pf->debug = PF_DEBUG_URGENT;
2669 	else if (!strcmp(d, "misc"))
2670 		pf->debug = PF_DEBUG_MISC;
2671 	else if (!strcmp(d, "loud"))
2672 		pf->debug = PF_DEBUG_NOISY;
2673 	else {
2674 		warnx("unknown debug level \"%s\"", d);
2675 		return (-1);
2676 	}
2677 
2678 	pf->debug_set = 1;
2679 	level = pf->debug;
2680 
2681 	if ((pf->opts & PF_OPT_NOACTION) == 0)
2682 		if (ioctl(dev, DIOCSETDEBUG, &level))
2683 			err(1, "DIOCSETDEBUG");
2684 
2685 	if (pf->opts & PF_OPT_VERBOSE)
2686 		printf("set debug %s\n", d);
2687 
2688 	return (0);
2689 }
2690 
2691 int
pfctl_load_debug(struct pfctl * pf,unsigned int level)2692 pfctl_load_debug(struct pfctl *pf, unsigned int level)
2693 {
2694 	if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
2695 		warnx("DIOCSETDEBUG");
2696 		return (1);
2697 	}
2698 	return (0);
2699 }
2700 
2701 int
pfctl_set_interface_flags(struct pfctl * pf,char * ifname,int flags,int how)2702 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2703 {
2704 	struct pfioc_iface	pi;
2705 	struct node_host	*h = NULL, *n = NULL;
2706 
2707 	if ((loadopt & PFCTL_FLAG_OPTION) == 0)
2708 		return (0);
2709 
2710 	bzero(&pi, sizeof(pi));
2711 
2712 	pi.pfiio_flags = flags;
2713 
2714 	/* Make sure our cache matches the kernel. If we set or clear the flag
2715 	 * for a group this applies to all members. */
2716 	h = ifa_grouplookup(ifname, 0);
2717 	for (n = h; n != NULL; n = n->next)
2718 		pfctl_set_interface_flags(pf, n->ifname, flags, how);
2719 
2720 	if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
2721 	    sizeof(pi.pfiio_name))
2722 		errx(1, "pfctl_set_interface_flags: strlcpy");
2723 
2724 	if ((pf->opts & PF_OPT_NOACTION) == 0) {
2725 		if (how == 0) {
2726 			if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
2727 				err(1, "DIOCCLRIFFLAG");
2728 		} else {
2729 			if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
2730 				err(1, "DIOCSETIFFLAG");
2731 			pfctl_check_skip_ifaces(ifname);
2732 		}
2733 	}
2734 	return (0);
2735 }
2736 
2737 void
pfctl_debug(int dev,u_int32_t level,int opts)2738 pfctl_debug(int dev, u_int32_t level, int opts)
2739 {
2740 	if (ioctl(dev, DIOCSETDEBUG, &level))
2741 		err(1, "DIOCSETDEBUG");
2742 	if ((opts & PF_OPT_QUIET) == 0) {
2743 		fprintf(stderr, "debug level set to '");
2744 		switch (level) {
2745 		case PF_DEBUG_NONE:
2746 			fprintf(stderr, "none");
2747 			break;
2748 		case PF_DEBUG_URGENT:
2749 			fprintf(stderr, "urgent");
2750 			break;
2751 		case PF_DEBUG_MISC:
2752 			fprintf(stderr, "misc");
2753 			break;
2754 		case PF_DEBUG_NOISY:
2755 			fprintf(stderr, "loud");
2756 			break;
2757 		default:
2758 			fprintf(stderr, "<invalid>");
2759 			break;
2760 		}
2761 		fprintf(stderr, "'\n");
2762 	}
2763 }
2764 
2765 int
pfctl_test_altqsupport(int dev,int opts)2766 pfctl_test_altqsupport(int dev, int opts)
2767 {
2768 	struct pfioc_altq pa;
2769 
2770 	pa.version = PFIOC_ALTQ_VERSION;
2771 	if (ioctl(dev, DIOCGETALTQS, &pa)) {
2772 		if (errno == ENODEV) {
2773 			if (opts & PF_OPT_VERBOSE)
2774 				fprintf(stderr, "No ALTQ support in kernel\n"
2775 				    "ALTQ related functions disabled\n");
2776 			return (0);
2777 		} else
2778 			err(1, "DIOCGETALTQS");
2779 	}
2780 	return (1);
2781 }
2782 
2783 int
pfctl_show_anchors(int dev,int opts,char * anchorname)2784 pfctl_show_anchors(int dev, int opts, char *anchorname)
2785 {
2786 	struct pfioc_ruleset	 pr;
2787 	u_int32_t		 mnr, nr;
2788 
2789 	memset(&pr, 0, sizeof(pr));
2790 	memcpy(pr.path, anchorname, sizeof(pr.path));
2791 	if (ioctl(dev, DIOCGETRULESETS, &pr)) {
2792 		if (errno == EINVAL)
2793 			fprintf(stderr, "Anchor '%s' not found.\n",
2794 			    anchorname);
2795 		else
2796 			err(1, "DIOCGETRULESETS");
2797 		return (-1);
2798 	}
2799 	mnr = pr.nr;
2800 	for (nr = 0; nr < mnr; ++nr) {
2801 		char sub[MAXPATHLEN];
2802 
2803 		pr.nr = nr;
2804 		if (ioctl(dev, DIOCGETRULESET, &pr))
2805 			err(1, "DIOCGETRULESET");
2806 		if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
2807 			continue;
2808 		sub[0] = 0;
2809 		if (pr.path[0]) {
2810 			strlcat(sub, pr.path, sizeof(sub));
2811 			strlcat(sub, "/", sizeof(sub));
2812 		}
2813 		strlcat(sub, pr.name, sizeof(sub));
2814 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2815 			printf("  %s\n", sub);
2816 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
2817 			return (-1);
2818 	}
2819 	return (0);
2820 }
2821 
2822 int
pfctl_show_eth_anchors(int dev,int opts,char * anchorname)2823 pfctl_show_eth_anchors(int dev, int opts, char *anchorname)
2824 {
2825 	struct pfctl_eth_rulesets_info ri;
2826 	struct pfctl_eth_ruleset_info rs;
2827 	int ret;
2828 
2829 	if ((ret = pfctl_get_eth_rulesets_info(dev, &ri, anchorname)) != 0) {
2830 		if (ret == ENOENT)
2831 			fprintf(stderr, "Anchor '%s' not found.\n",
2832 			    anchorname);
2833 		else
2834 			err(1, "DIOCGETETHRULESETS");
2835 		return (-1);
2836 	}
2837 
2838 	for (int nr = 0; nr < ri.nr; nr++) {
2839 		char sub[MAXPATHLEN];
2840 
2841 		if (pfctl_get_eth_ruleset(dev, anchorname, nr, &rs) != 0)
2842 			err(1, "DIOCGETETHRULESET");
2843 
2844 		if (!strcmp(rs.name, PF_RESERVED_ANCHOR))
2845 			continue;
2846 		sub[0] = 0;
2847 		if (rs.path[0]) {
2848 			strlcat(sub, rs.path, sizeof(sub));
2849 			strlcat(sub, "/", sizeof(sub));
2850 		}
2851 		strlcat(sub, rs.name, sizeof(sub));
2852 		if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
2853 			printf("  %s\n", sub);
2854 		if ((opts & PF_OPT_VERBOSE) && pfctl_show_eth_anchors(dev, opts, sub))
2855 			return (-1);
2856 	}
2857 	return (0);
2858 }
2859 
2860 const char *
pfctl_lookup_option(char * cmd,const char * const * list)2861 pfctl_lookup_option(char *cmd, const char * const *list)
2862 {
2863 	if (cmd != NULL && *cmd)
2864 		for (; *list; list++)
2865 			if (!strncmp(cmd, *list, strlen(cmd)))
2866 				return (*list);
2867 	return (NULL);
2868 }
2869 
2870 int
main(int argc,char * argv[])2871 main(int argc, char *argv[])
2872 {
2873 	int	 error = 0;
2874 	int	 ch;
2875 	int	 mode = O_RDONLY;
2876 	int	 opts = 0;
2877 	int	 optimize = PF_OPTIMIZE_BASIC;
2878 	char	 anchorname[MAXPATHLEN];
2879 	char	*path;
2880 
2881 	if (argc < 2)
2882 		usage();
2883 
2884 	while ((ch = getopt(argc, argv,
2885 	    "a:AdD:eqf:F:ghi:k:K:mMnNOo:Pp:rRs:t:T:vx:z")) != -1) {
2886 		switch (ch) {
2887 		case 'a':
2888 			anchoropt = optarg;
2889 			break;
2890 		case 'd':
2891 			opts |= PF_OPT_DISABLE;
2892 			mode = O_RDWR;
2893 			break;
2894 		case 'D':
2895 			if (pfctl_cmdline_symset(optarg) < 0)
2896 				warnx("could not parse macro definition %s",
2897 				    optarg);
2898 			break;
2899 		case 'e':
2900 			opts |= PF_OPT_ENABLE;
2901 			mode = O_RDWR;
2902 			break;
2903 		case 'q':
2904 			opts |= PF_OPT_QUIET;
2905 			break;
2906 		case 'F':
2907 			clearopt = pfctl_lookup_option(optarg, clearopt_list);
2908 			if (clearopt == NULL) {
2909 				warnx("Unknown flush modifier '%s'", optarg);
2910 				usage();
2911 			}
2912 			mode = O_RDWR;
2913 			break;
2914 		case 'i':
2915 			ifaceopt = optarg;
2916 			break;
2917 		case 'k':
2918 			if (state_killers >= 2) {
2919 				warnx("can only specify -k twice");
2920 				usage();
2921 				/* NOTREACHED */
2922 			}
2923 			state_kill[state_killers++] = optarg;
2924 			mode = O_RDWR;
2925 			break;
2926 		case 'K':
2927 			if (src_node_killers >= 2) {
2928 				warnx("can only specify -K twice");
2929 				usage();
2930 				/* NOTREACHED */
2931 			}
2932 			src_node_kill[src_node_killers++] = optarg;
2933 			mode = O_RDWR;
2934 			break;
2935 		case 'm':
2936 			opts |= PF_OPT_MERGE;
2937 			break;
2938 		case 'M':
2939 			opts |= PF_OPT_KILLMATCH;
2940 			break;
2941 		case 'n':
2942 			opts |= PF_OPT_NOACTION;
2943 			break;
2944 		case 'N':
2945 			loadopt |= PFCTL_FLAG_NAT;
2946 			break;
2947 		case 'r':
2948 			opts |= PF_OPT_USEDNS;
2949 			break;
2950 		case 'f':
2951 			rulesopt = optarg;
2952 			mode = O_RDWR;
2953 			break;
2954 		case 'g':
2955 			opts |= PF_OPT_DEBUG;
2956 			break;
2957 		case 'A':
2958 			loadopt |= PFCTL_FLAG_ALTQ;
2959 			break;
2960 		case 'R':
2961 			loadopt |= PFCTL_FLAG_FILTER;
2962 			break;
2963 		case 'o':
2964 			optiopt = pfctl_lookup_option(optarg, optiopt_list);
2965 			if (optiopt == NULL) {
2966 				warnx("Unknown optimization '%s'", optarg);
2967 				usage();
2968 			}
2969 			opts |= PF_OPT_OPTIMIZE;
2970 			break;
2971 		case 'O':
2972 			loadopt |= PFCTL_FLAG_OPTION;
2973 			break;
2974 		case 'p':
2975 			pf_device = optarg;
2976 			break;
2977 		case 'P':
2978 			opts |= PF_OPT_NUMERIC;
2979 			break;
2980 		case 's':
2981 			showopt = pfctl_lookup_option(optarg, showopt_list);
2982 			if (showopt == NULL) {
2983 				warnx("Unknown show modifier '%s'", optarg);
2984 				usage();
2985 			}
2986 			break;
2987 		case 't':
2988 			tableopt = optarg;
2989 			break;
2990 		case 'T':
2991 			tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2992 			if (tblcmdopt == NULL) {
2993 				warnx("Unknown table command '%s'", optarg);
2994 				usage();
2995 			}
2996 			break;
2997 		case 'v':
2998 			if (opts & PF_OPT_VERBOSE)
2999 				opts |= PF_OPT_VERBOSE2;
3000 			opts |= PF_OPT_VERBOSE;
3001 			break;
3002 		case 'x':
3003 			debugopt = pfctl_lookup_option(optarg, debugopt_list);
3004 			if (debugopt == NULL) {
3005 				warnx("Unknown debug level '%s'", optarg);
3006 				usage();
3007 			}
3008 			mode = O_RDWR;
3009 			break;
3010 		case 'z':
3011 			opts |= PF_OPT_CLRRULECTRS;
3012 			mode = O_RDWR;
3013 			break;
3014 		case 'h':
3015 			/* FALLTHROUGH */
3016 		default:
3017 			usage();
3018 			/* NOTREACHED */
3019 		}
3020 	}
3021 
3022 	if (tblcmdopt != NULL) {
3023 		argc -= optind;
3024 		argv += optind;
3025 		ch = *tblcmdopt;
3026 		if (ch == 'l') {
3027 			loadopt |= PFCTL_FLAG_TABLE;
3028 			tblcmdopt = NULL;
3029 		} else
3030 			mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
3031 	} else if (argc != optind) {
3032 		warnx("unknown command line argument: %s ...", argv[optind]);
3033 		usage();
3034 		/* NOTREACHED */
3035 	}
3036 	if (loadopt == 0)
3037 		loadopt = ~0;
3038 
3039 	if ((path = calloc(1, MAXPATHLEN)) == NULL)
3040 		errx(1, "pfctl: calloc");
3041 	memset(anchorname, 0, sizeof(anchorname));
3042 	if (anchoropt != NULL) {
3043 		int len = strlen(anchoropt);
3044 
3045 		if (len >= 1 && anchoropt[len - 1] == '*') {
3046 			if (len >= 2 && anchoropt[len - 2] == '/')
3047 				anchoropt[len - 2] = '\0';
3048 			else
3049 				anchoropt[len - 1] = '\0';
3050 			opts |= PF_OPT_RECURSE;
3051 		}
3052 		if (strlcpy(anchorname, anchoropt,
3053 		    sizeof(anchorname)) >= sizeof(anchorname))
3054 			errx(1, "anchor name '%s' too long",
3055 			    anchoropt);
3056 		loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE|PFCTL_FLAG_ETH;
3057 	}
3058 
3059 	if ((opts & PF_OPT_NOACTION) == 0) {
3060 		dev = open(pf_device, mode);
3061 		if (dev == -1)
3062 			err(1, "%s", pf_device);
3063 		altqsupport = pfctl_test_altqsupport(dev, opts);
3064 	} else {
3065 		dev = open(pf_device, O_RDONLY);
3066 		if (dev >= 0)
3067 			opts |= PF_OPT_DUMMYACTION;
3068 		/* turn off options */
3069 		opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
3070 		clearopt = showopt = debugopt = NULL;
3071 #if !defined(ENABLE_ALTQ)
3072 		altqsupport = 0;
3073 #else
3074 		altqsupport = 1;
3075 #endif
3076 	}
3077 
3078 	if (opts & PF_OPT_DISABLE)
3079 		if (pfctl_disable(dev, opts))
3080 			error = 1;
3081 
3082 	if (showopt != NULL) {
3083 		switch (*showopt) {
3084 		case 'A':
3085 			pfctl_show_anchors(dev, opts, anchorname);
3086 			if (opts & PF_OPT_VERBOSE2)
3087 				printf("Ethernet:\n");
3088 			pfctl_show_eth_anchors(dev, opts, anchorname);
3089 			break;
3090 		case 'r':
3091 			pfctl_load_fingerprints(dev, opts);
3092 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
3093 			    anchorname, 0, 0);
3094 			break;
3095 		case 'l':
3096 			pfctl_load_fingerprints(dev, opts);
3097 			pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
3098 			    anchorname, 0, 0);
3099 			break;
3100 		case 'n':
3101 			pfctl_load_fingerprints(dev, opts);
3102 			pfctl_show_nat(dev, path, opts, anchorname, 0, 0);
3103 			break;
3104 		case 'q':
3105 			pfctl_show_altq(dev, ifaceopt, opts,
3106 			    opts & PF_OPT_VERBOSE2);
3107 			break;
3108 		case 's':
3109 			pfctl_show_states(dev, ifaceopt, opts);
3110 			break;
3111 		case 'S':
3112 			pfctl_show_src_nodes(dev, opts);
3113 			break;
3114 		case 'i':
3115 			pfctl_show_status(dev, opts);
3116 			break;
3117 		case 'R':
3118 			error = pfctl_show_running(dev);
3119 			break;
3120 		case 't':
3121 			pfctl_show_timeouts(dev, opts);
3122 			break;
3123 		case 'm':
3124 			pfctl_show_limits(dev, opts);
3125 			break;
3126 		case 'e':
3127 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0,
3128 			    0);
3129 			break;
3130 		case 'a':
3131 			opts |= PF_OPT_SHOWALL;
3132 			pfctl_load_fingerprints(dev, opts);
3133 
3134 			pfctl_show_eth_rules(dev, path, opts, 0, anchorname, 0,
3135 			    0);
3136 
3137 			pfctl_show_nat(dev, path, opts, anchorname, 0, 0);
3138 			pfctl_show_rules(dev, path, opts, 0, anchorname, 0, 0);
3139 			pfctl_show_altq(dev, ifaceopt, opts, 0);
3140 			pfctl_show_states(dev, ifaceopt, opts);
3141 			pfctl_show_src_nodes(dev, opts);
3142 			pfctl_show_status(dev, opts);
3143 			pfctl_show_rules(dev, path, opts, 1, anchorname, 0, 0);
3144 			pfctl_show_timeouts(dev, opts);
3145 			pfctl_show_limits(dev, opts);
3146 			pfctl_show_tables(anchorname, opts);
3147 			pfctl_show_fingerprints(opts);
3148 			break;
3149 		case 'T':
3150 			pfctl_show_tables(anchorname, opts);
3151 			break;
3152 		case 'o':
3153 			pfctl_load_fingerprints(dev, opts);
3154 			pfctl_show_fingerprints(opts);
3155 			break;
3156 		case 'I':
3157 			pfctl_show_ifaces(ifaceopt, opts);
3158 			break;
3159 		}
3160 	}
3161 
3162 	if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL) {
3163 		pfctl_show_eth_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
3164 		    anchorname, 0, 0);
3165 		pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
3166 		    anchorname, 0, 0);
3167 	}
3168 
3169 	if (clearopt != NULL) {
3170 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
3171 			errx(1, "anchor names beginning with '_' cannot "
3172 			    "be modified from the command line");
3173 
3174 		switch (*clearopt) {
3175 		case 'e':
3176 			pfctl_flush_eth_rules(dev, opts, anchorname);
3177 			break;
3178 		case 'r':
3179 			pfctl_flush_rules(dev, opts, anchorname);
3180 			break;
3181 		case 'n':
3182 			pfctl_flush_nat(dev, opts, anchorname);
3183 			break;
3184 		case 'q':
3185 			pfctl_clear_altq(dev, opts);
3186 			break;
3187 		case 's':
3188 			pfctl_clear_iface_states(dev, ifaceopt, opts);
3189 			break;
3190 		case 'S':
3191 			pfctl_clear_src_nodes(dev, opts);
3192 			break;
3193 		case 'i':
3194 			pfctl_clear_stats(dev, opts);
3195 			break;
3196 		case 'a':
3197 			pfctl_flush_eth_rules(dev, opts, anchorname);
3198 			pfctl_flush_rules(dev, opts, anchorname);
3199 			pfctl_flush_nat(dev, opts, anchorname);
3200 			pfctl_clear_tables(anchorname, opts);
3201 			if (!*anchorname) {
3202 				pfctl_clear_altq(dev, opts);
3203 				pfctl_clear_iface_states(dev, ifaceopt, opts);
3204 				pfctl_clear_src_nodes(dev, opts);
3205 				pfctl_clear_stats(dev, opts);
3206 				pfctl_clear_fingerprints(dev, opts);
3207 				pfctl_clear_interface_flags(dev, opts);
3208 			}
3209 			break;
3210 		case 'o':
3211 			pfctl_clear_fingerprints(dev, opts);
3212 			break;
3213 		case 'T':
3214 			pfctl_clear_tables(anchorname, opts);
3215 			break;
3216 		}
3217 	}
3218 	if (state_killers) {
3219 		if (!strcmp(state_kill[0], "label"))
3220 			pfctl_label_kill_states(dev, ifaceopt, opts);
3221 		else if (!strcmp(state_kill[0], "id"))
3222 			pfctl_id_kill_states(dev, ifaceopt, opts);
3223 		else if (!strcmp(state_kill[0], "gateway"))
3224 			pfctl_gateway_kill_states(dev, ifaceopt, opts);
3225 		else
3226 			pfctl_net_kill_states(dev, ifaceopt, opts);
3227 	}
3228 
3229 	if (src_node_killers)
3230 		pfctl_kill_src_nodes(dev, ifaceopt, opts);
3231 
3232 	if (tblcmdopt != NULL) {
3233 		error = pfctl_command_tables(argc, argv, tableopt,
3234 		    tblcmdopt, rulesopt, anchorname, opts);
3235 		rulesopt = NULL;
3236 	}
3237 	if (optiopt != NULL) {
3238 		switch (*optiopt) {
3239 		case 'n':
3240 			optimize = 0;
3241 			break;
3242 		case 'b':
3243 			optimize |= PF_OPTIMIZE_BASIC;
3244 			break;
3245 		case 'o':
3246 		case 'p':
3247 			optimize |= PF_OPTIMIZE_PROFILE;
3248 			break;
3249 		}
3250 	}
3251 
3252 	if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
3253 	    !anchorname[0] && !(opts & PF_OPT_NOACTION))
3254 		if (pfctl_get_skip_ifaces())
3255 			error = 1;
3256 
3257 	if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
3258 	    !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
3259 		if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE))
3260 			error = 1;
3261 
3262 	if (rulesopt != NULL) {
3263 		if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
3264 			errx(1, "anchor names beginning with '_' cannot "
3265 			    "be modified from the command line");
3266 		if (pfctl_rules(dev, rulesopt, opts, optimize,
3267 		    anchorname, NULL))
3268 			error = 1;
3269 		else if (!(opts & PF_OPT_NOACTION) &&
3270 		    (loadopt & PFCTL_FLAG_TABLE))
3271 			warn_namespace_collision(NULL);
3272 	}
3273 
3274 	if (opts & PF_OPT_ENABLE)
3275 		if (pfctl_enable(dev, opts))
3276 			error = 1;
3277 
3278 	if (debugopt != NULL) {
3279 		switch (*debugopt) {
3280 		case 'n':
3281 			pfctl_debug(dev, PF_DEBUG_NONE, opts);
3282 			break;
3283 		case 'u':
3284 			pfctl_debug(dev, PF_DEBUG_URGENT, opts);
3285 			break;
3286 		case 'm':
3287 			pfctl_debug(dev, PF_DEBUG_MISC, opts);
3288 			break;
3289 		case 'l':
3290 			pfctl_debug(dev, PF_DEBUG_NOISY, opts);
3291 			break;
3292 		}
3293 	}
3294 
3295 	exit(error);
3296 }
3297