?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kernel - Add fuwordadd32(), fuwordadd64()
[dragonfly.git] / usr.sbin / pfctl / pfctl.c
blob5e5b6f2890790ee26cc776114ee9b5d7f40a0845
1 /* $OpenBSD: pfctl.c,v 1.277 2008/07/24 10:52:43 henning Exp $ */
2
3 /*
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002,2003 Henning Brauer
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 *
32 */
33
34 #include <sys/types.h>
35 #include <sys/ioctl.h>
36 #include <sys/socket.h>
37 #include <sys/stat.h>
38 #include <sys/endian.h>
39
40 #include <net/if.h>
41 #include <netinet/in.h>
42 #include <net/pf/pfvar.h>
43 #include <arpa/inet.h>
44 #include <net/altq/altq.h>
45 #include <sys/sysctl.h>
46
47 #include <err.h>
48 #include <errno.h>
49 #include <fcntl.h>
50 #include <inttypes.h>
51 #include <limits.h>
52 #include <netdb.h>
53 #include <stdio.h>
54 #include <stdlib.h>
55 #include <string.h>
56 #include <unistd.h>
57
58 #include "pfctl_parser.h"
59 #include "pfctl.h"
60
61 void usage(void) __dead2;
62 int pfctl_enable(int, int);
63 int pfctl_disable(int, int);
64 int pfctl_clear_stats(int, int);
65 int pfctl_clear_interface_flags(int, int);
66 int pfctl_clear_rules(int, int, char *);
67 int pfctl_clear_nat(int, int, char *);
68 int pfctl_clear_altq(int, int);
69 int pfctl_clear_src_nodes(int, int);
70 int pfctl_clear_states(int, const char *, int);
71 void pfctl_addrprefix(char *, struct pf_addr *);
72 int pfctl_kill_src_nodes(int, const char *, int);
73 int pfctl_net_kill_states(int, const char *, int);
74 int pfctl_label_kill_states(int, const char *, int);
75 int pfctl_id_kill_states(int, const char *, int);
76 void pfctl_init_options(struct pfctl *);
77 int pfctl_load_options(struct pfctl *);
78 int pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
79 int pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
80 int pfctl_load_debug(struct pfctl *, unsigned int);
81 int pfctl_load_logif(struct pfctl *, char *);
82 int pfctl_load_hostid(struct pfctl *, unsigned int);
83 int pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
84 char *);
85 void pfctl_print_rule_counters(struct pf_rule *, int);
86 int pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
87 int pfctl_show_nat(int, int, char *);
88 int pfctl_show_src_nodes(int, int);
89 int pfctl_show_states(int, const char *, int);
90 int pfctl_show_status(int, int);
91 int pfctl_show_timeouts(int, int);
92 int pfctl_show_limits(int, int);
93 void pfctl_debug(int, u_int32_t, int);
94 int pfctl_test_altqsupport(int, int);
95 int pfctl_show_anchors(int, int, char *);
96 int pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
97 int pfctl_load_ruleset(struct pfctl *, char *,
98 struct pf_ruleset *, int, int);
99 int pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
100 const char *pfctl_lookup_option(char *, const char **);
101
102 struct pf_anchor_global pf_anchors;
103 struct pf_anchor pf_main_anchor;
104
105 const char *clearopt;
106 char *rulesopt;
107 const char *showopt;
108 const char *debugopt;
109 char *anchoropt;
110 const char *optiopt = NULL;
111 const char *pf_device = "/dev/pf";
112 char *ifaceopt;
113 char *tableopt;
114 const char *tblcmdopt;
115 int src_node_killers;
116 char *src_node_kill[2];
117 int state_killers;
118 char *state_kill[2];
119 int loadopt;
120 int altqsupport;
121
122 int dev_fd = -1;
123 int first_title = 1;
124 int labels = 0;
125
126 #define INDENT(d, o) do { \
127 if (o) { \
128 int i; \
129 for (i=0; i < d; i++) \
130 printf(" "); \
131 } \
132 } while (0); \
133
134
135 static const struct {
136 const char *name;
137 int index;
138 } pf_limits[] = {
139 { "states", PF_LIMIT_STATES },
140 { "src-nodes", PF_LIMIT_SRC_NODES },
141 { "frags", PF_LIMIT_FRAGS },
142 { "tables", PF_LIMIT_TABLES },
143 { "table-entries", PF_LIMIT_TABLE_ENTRIES },
144 { NULL, 0 }
145 };
146
147 struct pf_hint {
148 const char *name;
149 int timeout;
150 };
151 static const struct pf_hint pf_hint_normal[] = {
152 { "tcp.first", 2 * 60 },
153 { "tcp.opening", 30 },
154 { "tcp.established", 24 * 60 * 60 },
155 { "tcp.closing", 15 * 60 },
156 { "tcp.finwait", 45 },
157 { "tcp.closed", 90 },
158 { "tcp.tsdiff", 30 },
159 { NULL, 0 }
160 };
161 static const struct pf_hint pf_hint_satellite[] = {
162 { "tcp.first", 3 * 60 },
163 { "tcp.opening", 30 + 5 },
164 { "tcp.established", 24 * 60 * 60 },
165 { "tcp.closing", 15 * 60 + 5 },
166 { "tcp.finwait", 45 + 5 },
167 { "tcp.closed", 90 + 5 },
168 { "tcp.tsdiff", 60 },
169 { NULL, 0 }
170 };
171 static const struct pf_hint pf_hint_conservative[] = {
172 { "tcp.first", 60 * 60 },
173 { "tcp.opening", 15 * 60 },
174 { "tcp.established", 5 * 24 * 60 * 60 },
175 { "tcp.closing", 60 * 60 },
176 { "tcp.finwait", 10 * 60 },
177 { "tcp.closed", 3 * 60 },
178 { "tcp.tsdiff", 60 },
179 { NULL, 0 }
180 };
181 static const struct pf_hint pf_hint_aggressive[] = {
182 { "tcp.first", 30 },
183 { "tcp.opening", 5 },
184 { "tcp.established", 5 * 60 * 60 },
185 { "tcp.closing", 60 },
186 { "tcp.finwait", 30 },
187 { "tcp.closed", 30 },
188 { "tcp.tsdiff", 10 },
189 { NULL, 0 }
190 };
191
192 static const struct {
193 const char *name;
194 const struct pf_hint *hint;
195 } pf_hints[] = {
196 { "normal", pf_hint_normal },
197 { "satellite", pf_hint_satellite },
198 { "high-latency", pf_hint_satellite },
199 { "conservative", pf_hint_conservative },
200 { "aggressive", pf_hint_aggressive },
201 { NULL, NULL }
202 };
203
204 static const char *clearopt_list[] = {
205 "nat", "queue", "rules", "Sources",
206 "states", "info", "Tables", "osfp", "all", NULL
207 };
208
209 static const char *showopt_list[] = {
210 "nat", "queue", "rules", "Anchors", "Sources", "states", "info",
211 "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
212 "all", NULL
213 };
214
215 static const char *tblcmdopt_list[] = {
216 "kill", "flush", "add", "delete", "load", "replace", "show",
217 "test", "zero", "expire", NULL
218 };
219
220 static const char *debugopt_list[] = {
221 "none", "urgent", "misc", "loud", NULL
222 };
223
224 static const char *optiopt_list[] = {
225 "none", "basic", "profile", NULL
226 };
227
228 void
229 usage(void)
230 {
231 fprintf(stderr, "usage: %s [-AdeghmNnOqRrvz] ", getprogname());
232 fprintf(stderr, "[-a anchor] [-D macro=value] [-F modifier]\n");
233 fprintf(stderr, "\t[-f file] [-i interface] [-K host | network] ");
234 fprintf(stderr, "[-k host | network | label | id]\n");
235 fprintf(stderr, "\t[-o level] [-p device] [-s modifier]\n");
236 fprintf(stderr, "\t[-t table -T command [address ...]] [-x level]\n");
237 exit(1);
238 }
239
240 int
241 pfctl_enable(int dev, int opts)
242 {
243 if (ioctl(dev, DIOCSTART)) {
244 if (errno == EEXIST)
245 errx(1, "pf already enabled");
246 else
247 err(1, "DIOCSTART");
248 }
249 if ((opts & PF_OPT_QUIET) == 0)
250 fprintf(stderr, "pf enabled\n");
251
252 if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
253 if (errno != EEXIST)
254 err(1, "DIOCSTARTALTQ");
255
256 return (0);
257 }
258
259 int
260 pfctl_disable(int dev, int opts)
261 {
262 if (ioctl(dev, DIOCSTOP)) {
263 if (errno == ENOENT)
264 errx(1, "pf not enabled");
265 else
266 err(1, "DIOCSTOP");
267 }
268 if ((opts & PF_OPT_QUIET) == 0)
269 fprintf(stderr, "pf disabled\n");
270
271 if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
272 if (errno != ENOENT)
273 err(1, "DIOCSTOPALTQ");
274
275 return (0);
276 }
277
278 int
279 pfctl_clear_stats(int dev, int opts)
280 {
281 if (ioctl(dev, DIOCCLRSTATUS))
282 err(1, "DIOCCLRSTATUS");
283 if ((opts & PF_OPT_QUIET) == 0)
284 fprintf(stderr, "pf: statistics cleared\n");
285 return (0);
286 }
287
288 int
289 pfctl_clear_interface_flags(int dev, int opts)
290 {
291 struct pfioc_iface pi;
292
293 if ((opts & PF_OPT_NOACTION) == 0) {
294 bzero(&pi, sizeof(pi));
295 pi.pfiio_flags = PFI_IFLAG_SKIP;
296
297 if (ioctl(dev, DIOCCLRIFFLAG, &pi))
298 err(1, "DIOCCLRIFFLAG");
299 if ((opts & PF_OPT_QUIET) == 0)
300 fprintf(stderr, "pf: interface flags reset\n");
301 }
302 return (0);
303 }
304
305 int
306 pfctl_clear_rules(int dev, int opts, char *anchorname)
307 {
308 struct pfr_buffer t;
309
310 memset(&t, 0, sizeof(t));
311 t.pfrb_type = PFRB_TRANS;
312 if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
313 pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
314 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
315 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
316 err(1, "pfctl_clear_rules");
317 if ((opts & PF_OPT_QUIET) == 0)
318 fprintf(stderr, "rules cleared\n");
319 return (0);
320 }
321
322 int
323 pfctl_clear_nat(int dev, int opts, char *anchorname)
324 {
325 struct pfr_buffer t;
326
327 memset(&t, 0, sizeof(t));
328 t.pfrb_type = PFRB_TRANS;
329 if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
330 pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
331 pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
332 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
333 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
334 err(1, "pfctl_clear_nat");
335 if ((opts & PF_OPT_QUIET) == 0)
336 fprintf(stderr, "nat cleared\n");
337 return (0);
338 }
339
340 int
341 pfctl_clear_altq(int dev, int opts)
342 {
343 struct pfr_buffer t;
344
345 if (!altqsupport)
346 return (-1);
347 memset(&t, 0, sizeof(t));
348 t.pfrb_type = PFRB_TRANS;
349 if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
350 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
351 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
352 err(1, "pfctl_clear_altq");
353 if ((opts & PF_OPT_QUIET) == 0)
354 fprintf(stderr, "altq cleared\n");
355 return (0);
356 }
357
358 int
359 pfctl_clear_src_nodes(int dev, int opts)
360 {
361 if (ioctl(dev, DIOCCLRSRCNODES))
362 err(1, "DIOCCLRSRCNODES");
363 if ((opts & PF_OPT_QUIET) == 0)
364 fprintf(stderr, "source tracking entries cleared\n");
365 return (0);
366 }
367
368 int
369 pfctl_clear_states(int dev, const char *iface, int opts)
370 {
371 struct pfioc_state_kill psk;
372
373 memset(&psk, 0, sizeof(psk));
374 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
375 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
376 errx(1, "invalid interface: %s", iface);
377
378 if (ioctl(dev, DIOCCLRSTATES, &psk))
379 err(1, "DIOCCLRSTATES");
380 if ((opts & PF_OPT_QUIET) == 0)
381 fprintf(stderr, "%d states cleared\n", psk.psk_killed);
382 return (0);
383 }
384
385 void
386 pfctl_addrprefix(char *addr, struct pf_addr *mask)
387 {
388 char *p;
389 const char *errstr;
390 int prefix, ret_ga, q, r;
391 struct addrinfo hints, *res;
392
393 if ((p = strchr(addr, '/')) == NULL)
394 return;
395
396 *p++ = '\0';
397 prefix = strtonum(p, 0, 128, &errstr);
398 if (errstr)
399 errx(1, "prefix is %s: %s", errstr, p);
400
401 bzero(&hints, sizeof(hints));
402 /* prefix only with numeric addresses */
403 hints.ai_flags |= AI_NUMERICHOST;
404
405 if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
406 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
407 /* NOTREACHED */
408 }
409
410 if (res->ai_family == AF_INET && prefix > 32)
411 errx(1, "prefix too long for AF_INET");
412 else if (res->ai_family == AF_INET6 && prefix > 128)
413 errx(1, "prefix too long for AF_INET6");
414
415 q = prefix >> 3;
416 r = prefix & 7;
417 switch (res->ai_family) {
418 case AF_INET:
419 bzero(&mask->v4, sizeof(mask->v4));
420 mask->v4.s_addr = htonl((u_int32_t)
421 (0xffffffffffULL << (32 - prefix)));
422 break;
423 case AF_INET6:
424 bzero(&mask->v6, sizeof(mask->v6));
425 if (q > 0)
426 memset((void *)&mask->v6, 0xff, q);
427 if (r > 0)
428 *((u_char *)&mask->v6 + q) =
429 (0xff00 >> r) & 0xff;
430 break;
431 }
432 freeaddrinfo(res);
433 }
434
435 int
436 pfctl_kill_src_nodes(int dev, const char *iface __unused, int opts)
437 {
438 struct pfioc_src_node_kill psnk;
439 struct addrinfo *res[2], *resp[2];
440 struct sockaddr last_src, last_dst;
441 int killed, sources, dests;
442 int ret_ga;
443
444 killed = sources = dests = 0;
445
446 memset(&psnk, 0, sizeof(psnk));
447 memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
448 sizeof(psnk.psnk_src.addr.v.a.mask));
449 memset(&last_src, 0xff, sizeof(last_src));
450 memset(&last_dst, 0xff, sizeof(last_dst));
451
452 pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
453
454 if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
455 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
456 /* NOTREACHED */
457 }
458 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
459 if (resp[0]->ai_addr == NULL)
460 continue;
461 /* We get lots of duplicates. Catch the easy ones */
462 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
463 continue;
464 last_src = *(struct sockaddr *)resp[0]->ai_addr;
465
466 psnk.psnk_af = resp[0]->ai_family;
467 sources++;
468
469 if (psnk.psnk_af == AF_INET)
470 psnk.psnk_src.addr.v.a.addr.v4 =
471 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
472 else if (psnk.psnk_af == AF_INET6)
473 psnk.psnk_src.addr.v.a.addr.v6 =
474 ((struct sockaddr_in6 *)resp[0]->ai_addr)->
475 sin6_addr;
476 else
477 errx(1, "Unknown address family %d", psnk.psnk_af);
478
479 if (src_node_killers > 1) {
480 dests = 0;
481 memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
482 sizeof(psnk.psnk_dst.addr.v.a.mask));
483 memset(&last_dst, 0xff, sizeof(last_dst));
484 pfctl_addrprefix(src_node_kill[1],
485 &psnk.psnk_dst.addr.v.a.mask);
486 if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
487 &res[1]))) {
488 errx(1, "getaddrinfo: %s",
489 gai_strerror(ret_ga));
490 /* NOTREACHED */
491 }
492 for (resp[1] = res[1]; resp[1];
493 resp[1] = resp[1]->ai_next) {
494 if (resp[1]->ai_addr == NULL)
495 continue;
496 if (psnk.psnk_af != resp[1]->ai_family)
497 continue;
498
499 if (memcmp(&last_dst, resp[1]->ai_addr,
500 sizeof(last_dst)) == 0)
501 continue;
502 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
503
504 dests++;
505
506 if (psnk.psnk_af == AF_INET)
507 psnk.psnk_dst.addr.v.a.addr.v4 =
508 ((struct sockaddr_in *)resp[1]->
509 ai_addr)->sin_addr;
510 else if (psnk.psnk_af == AF_INET6)
511 psnk.psnk_dst.addr.v.a.addr.v6 =
512 ((struct sockaddr_in6 *)resp[1]->
513 ai_addr)->sin6_addr;
514 else
515 errx(1, "Unknown address family %d",
516 psnk.psnk_af);
517
518 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
519 err(1, "DIOCKILLSRCNODES");
520 killed += psnk.psnk_killed;
521 }
522 freeaddrinfo(res[1]);
523 } else {
524 if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
525 err(1, "DIOCKILLSRCNODES");
526 killed += psnk.psnk_killed;
527 }
528 }
529
530 freeaddrinfo(res[0]);
531
532 if ((opts & PF_OPT_QUIET) == 0)
533 fprintf(stderr, "killed %d src nodes from %d sources and %d "
534 "destinations\n", killed, sources, dests);
535 return (0);
536 }
537
538 int
539 pfctl_net_kill_states(int dev, const char *iface, int opts)
540 {
541 struct pfioc_state_kill psk;
542 struct addrinfo *res[2], *resp[2];
543 struct sockaddr last_src, last_dst;
544 int killed, sources, dests;
545 int ret_ga;
546
547 killed = sources = dests = 0;
548
549 memset(&psk, 0, sizeof(psk));
550 memset(&psk.psk_src.addr.v.a.mask, 0xff,
551 sizeof(psk.psk_src.addr.v.a.mask));
552 memset(&last_src, 0xff, sizeof(last_src));
553 memset(&last_dst, 0xff, sizeof(last_dst));
554 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
555 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
556 errx(1, "invalid interface: %s", iface);
557
558 pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
559
560 if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
561 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
562 /* NOTREACHED */
563 }
564 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
565 if (resp[0]->ai_addr == NULL)
566 continue;
567 /* We get lots of duplicates. Catch the easy ones */
568 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
569 continue;
570 last_src = *(struct sockaddr *)resp[0]->ai_addr;
571
572 psk.psk_af = resp[0]->ai_family;
573 sources++;
574
575 if (psk.psk_af == AF_INET)
576 psk.psk_src.addr.v.a.addr.v4 =
577 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
578 else if (psk.psk_af == AF_INET6)
579 psk.psk_src.addr.v.a.addr.v6 =
580 ((struct sockaddr_in6 *)resp[0]->ai_addr)->
581 sin6_addr;
582 else
583 errx(1, "Unknown address family %d", psk.psk_af);
584
585 if (state_killers > 1) {
586 dests = 0;
587 memset(&psk.psk_dst.addr.v.a.mask, 0xff,
588 sizeof(psk.psk_dst.addr.v.a.mask));
589 memset(&last_dst, 0xff, sizeof(last_dst));
590 pfctl_addrprefix(state_kill[1],
591 &psk.psk_dst.addr.v.a.mask);
592 if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
593 &res[1]))) {
594 errx(1, "getaddrinfo: %s",
595 gai_strerror(ret_ga));
596 /* NOTREACHED */
597 }
598 for (resp[1] = res[1]; resp[1];
599 resp[1] = resp[1]->ai_next) {
600 if (resp[1]->ai_addr == NULL)
601 continue;
602 if (psk.psk_af != resp[1]->ai_family)
603 continue;
604
605 if (memcmp(&last_dst, resp[1]->ai_addr,
606 sizeof(last_dst)) == 0)
607 continue;
608 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
609
610 dests++;
611
612 if (psk.psk_af == AF_INET)
613 psk.psk_dst.addr.v.a.addr.v4 =
614 ((struct sockaddr_in *)resp[1]->
615 ai_addr)->sin_addr;
616 else if (psk.psk_af == AF_INET6)
617 psk.psk_dst.addr.v.a.addr.v6 =
618 ((struct sockaddr_in6 *)resp[1]->
619 ai_addr)->sin6_addr;
620 else
621 errx(1, "Unknown address family %d",
622 psk.psk_af);
623
624 if (ioctl(dev, DIOCKILLSTATES, &psk))
625 err(1, "DIOCKILLSTATES");
626 killed += psk.psk_killed;
627 }
628 freeaddrinfo(res[1]);
629 } else {
630 if (ioctl(dev, DIOCKILLSTATES, &psk))
631 err(1, "DIOCKILLSTATES");
632 killed += psk.psk_killed;
633 }
634 }
635
636 freeaddrinfo(res[0]);
637
638 if ((opts & PF_OPT_QUIET) == 0)
639 fprintf(stderr, "killed %d states from %d sources and %d "
640 "destinations\n", killed, sources, dests);
641 return (0);
642 }
643
644 int
645 pfctl_label_kill_states(int dev, const char *iface, int opts)
646 {
647 struct pfioc_state_kill psk;
648
649 if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
650 warnx("no label specified");
651 usage();
652 }
653 memset(&psk, 0, sizeof(psk));
654 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
655 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
656 errx(1, "invalid interface: %s", iface);
657
658 if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
659 sizeof(psk.psk_label))
660 errx(1, "label too long: %s", state_kill[1]);
661
662 if (ioctl(dev, DIOCKILLSTATES, &psk))
663 err(1, "DIOCKILLSTATES");
664
665 if ((opts & PF_OPT_QUIET) == 0)
666 fprintf(stderr, "killed %d states\n", psk.psk_killed);
667
668 return (0);
669 }
670
671 int
672 pfctl_id_kill_states(int dev, const char *iface, int opts)
673 {
674 struct pfioc_state_kill psk;
675
676 if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
677 warnx("no id specified");
678 usage();
679 }
680
681 memset(&psk, 0, sizeof(psk));
682 if ((sscanf(state_kill[1], "%" SCNx64 "/%x",
683 &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
684 psk.psk_pfcmp.creatorid=htonl(psk.psk_pfcmp.creatorid);
685 else if ((sscanf(state_kill[1], "%" SCNx64, &psk.psk_pfcmp.id)) == 1) {
686 psk.psk_pfcmp.creatorid = 0;
687 } else {
688 warnx("wrong id format specified");
689 usage();
690 }
691 if (psk.psk_pfcmp.id == 0) {
692 warnx("cannot kill id 0");
693 usage();
694 }
695
696 psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id);
697 if (ioctl(dev, DIOCKILLSTATES, &psk))
698 err(1, "DIOCKILLSTATES");
699
700 if ((opts & PF_OPT_QUIET) == 0)
701 fprintf(stderr, "killed %d states\n", psk.psk_killed);
702
703 return (0);
704 }
705
706 int
707 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
708 u_int32_t ticket, int r_action, char *anchorname)
709 {
710 struct pfioc_pooladdr pp;
711 struct pf_pooladdr *pa;
712 u_int32_t pnr, mpnr;
713
714 memset(&pp, 0, sizeof(pp));
715 memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
716 pp.r_action = r_action;
717 pp.r_num = nr;
718 pp.ticket = ticket;
719 if (ioctl(dev, DIOCGETADDRS, &pp)) {
720 warn("DIOCGETADDRS");
721 return (-1);
722 }
723 mpnr = pp.nr;
724 TAILQ_INIT(&pool->list);
725 for (pnr = 0; pnr < mpnr; ++pnr) {
726 pp.nr = pnr;
727 if (ioctl(dev, DIOCGETADDR, &pp)) {
728 warn("DIOCGETADDR");
729 return (-1);
730 }
731 pa = calloc(1, sizeof(struct pf_pooladdr));
732 if (pa == NULL)
733 err(1, "calloc");
734 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
735 TAILQ_INSERT_TAIL(&pool->list, pa, entries);
736 }
737
738 return (0);
739 }
740
741 void
742 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
743 {
744 struct pf_pooladdr *pa;
745
746 while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
747 TAILQ_REMOVE(&src->list, pa, entries);
748 TAILQ_INSERT_TAIL(&dst->list, pa, entries);
749 }
750 }
751
752 void
753 pfctl_clear_pool(struct pf_pool *pool)
754 {
755 struct pf_pooladdr *pa;
756
757 while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
758 TAILQ_REMOVE(&pool->list, pa, entries);
759 free(pa);
760 }
761 }
762
763 void
764 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
765 {
766 if (opts & PF_OPT_DEBUG) {
767 const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
768 "p", "sa", "sp", "da", "dp" };
769 int i;
770
771 printf(" [ Skip steps: ");
772 for (i = 0; i < PF_SKIP_COUNT; ++i) {
773 if (rule->skip[i].nr == rule->nr + 1)
774 continue;
775 printf("%s=", t[i]);
776 if (rule->skip[i].nr == (uint32_t)(-1))
777 printf("end ");
778 else
779 printf("%u ", rule->skip[i].nr);
780 }
781 printf("]\n");
782
783 printf(" [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
784 rule->qname, rule->qid, rule->pqname, rule->pqid);
785 }
786 if (opts & PF_OPT_VERBOSE) {
787 printf(" [ Evaluations: %-8llu Packets: %-8llu "
788 "Bytes: %-10llu States: %-6u]\n",
789 (unsigned long long)rule->evaluations,
790 (unsigned long long)(rule->packets[0] +
791 rule->packets[1]),
792 (unsigned long long)(rule->bytes[0] +
793 rule->bytes[1]), rule->states_cur);
794 if (!(opts & PF_OPT_DEBUG))
795 printf(" [ Inserted: uid %u pid %u "
796 "State Creations: %-6u]\n",
797 (unsigned)rule->cuid, (unsigned)rule->cpid,
798 rule->states_tot);
799 }
800 }
801
802 void
803 pfctl_print_title(const char *title)
804 {
805 if (!first_title)
806 printf("\n");
807 first_title = 0;
808 printf("%s\n", title);
809 }
810
811 int
812 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
813 char *anchorname, int depth)
814 {
815 struct pfioc_rule pr;
816 u_int32_t nr, mnr, header = 0;
817 int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
818 int len = strlen(path);
819 int brace;
820 char *p;
821
822 if (path[0])
823 snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
824 else
825 snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
826
827 memset(&pr, 0, sizeof(pr));
828 memcpy(pr.anchor, path, sizeof(pr.anchor));
829 if (opts & PF_OPT_SHOWALL) {
830 pr.rule.action = PF_PASS;
831 if (ioctl(dev, DIOCGETRULES, &pr)) {
832 warn("DIOCGETRULES");
833 goto error;
834 }
835 header++;
836 }
837 pr.rule.action = PF_SCRUB;
838 if (ioctl(dev, DIOCGETRULES, &pr)) {
839 warn("DIOCGETRULES");
840 goto error;
841 }
842 if (opts & PF_OPT_SHOWALL) {
843 if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
844 pfctl_print_title("FILTER RULES:");
845 else if (format == PFCTL_SHOW_LABELS && labels)
846 pfctl_print_title("LABEL COUNTERS:");
847 }
848 mnr = pr.nr;
849 if (opts & PF_OPT_CLRRULECTRS)
850 pr.action = PF_GET_CLR_CNTR;
851
852 for (nr = 0; nr < mnr; ++nr) {
853 pr.nr = nr;
854 if (ioctl(dev, DIOCGETRULE, &pr)) {
855 warn("DIOCGETRULE");
856 goto error;
857 }
858
859 if (pfctl_get_pool(dev, &pr.rule.rpool,
860 nr, pr.ticket, PF_SCRUB, path) != 0)
861 goto error;
862
863 switch (format) {
864 case PFCTL_SHOW_LABELS:
865 break;
866 case PFCTL_SHOW_RULES:
867 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
868 labels = 1;
869 print_rule(&pr.rule, pr.anchor_call, rule_numbers);
870 printf("\n");
871 pfctl_print_rule_counters(&pr.rule, opts);
872 break;
873 case PFCTL_SHOW_NOTHING:
874 break;
875 }
876 pfctl_clear_pool(&pr.rule.rpool);
877 }
878 pr.rule.action = PF_PASS;
879 if (ioctl(dev, DIOCGETRULES, &pr)) {
880 warn("DIOCGETRULES");
881 goto error;
882 }
883 mnr = pr.nr;
884 for (nr = 0; nr < mnr; ++nr) {
885 pr.nr = nr;
886 if (ioctl(dev, DIOCGETRULE, &pr)) {
887 warn("DIOCGETRULE");
888 goto error;
889 }
890
891 if (pfctl_get_pool(dev, &pr.rule.rpool,
892 nr, pr.ticket, PF_PASS, path) != 0)
893 goto error;
894
895 switch (format) {
896 case PFCTL_SHOW_LABELS:
897 if (pr.rule.label[0]) {
898 printf("%s %llu %llu %llu %llu"
899 " %llu %llu %llu %llu\n",
900 pr.rule.label,
901 (unsigned long long)pr.rule.evaluations,
902 (unsigned long long)(pr.rule.packets[0] +
903 pr.rule.packets[1]),
904 (unsigned long long)(pr.rule.bytes[0] +
905 pr.rule.bytes[1]),
906 (unsigned long long)pr.rule.packets[0],
907 (unsigned long long)pr.rule.bytes[0],
908 (unsigned long long)pr.rule.packets[1],
909 (unsigned long long)pr.rule.bytes[1],
910 (unsigned long long)pr.rule.states_tot);
911 }
912 break;
913 case PFCTL_SHOW_RULES:
914 brace = 0;
915 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
916 labels = 1;
917 INDENT(depth, !(opts & PF_OPT_VERBOSE));
918 if (pr.anchor_call[0] &&
919 ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
920 ((void *)p == (void *)pr.anchor_call ||
921 *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
922 brace++;
923 if ((p = strrchr(pr.anchor_call, '/')) !=
924 NULL)
925 p++;
926 else
927 p = &pr.anchor_call[0];
928 } else
929 p = &pr.anchor_call[0];
930
931 print_rule(&pr.rule, p, rule_numbers);
932 if (brace)
933 printf(" {\n");
934 else
935 printf("\n");
936 pfctl_print_rule_counters(&pr.rule, opts);
937 if (brace) {
938 pfctl_show_rules(dev, path, opts, format,
939 p, depth + 1);
940 INDENT(depth, !(opts & PF_OPT_VERBOSE));
941 printf("}\n");
942 }
943 break;
944 case PFCTL_SHOW_NOTHING:
945 break;
946 }
947 pfctl_clear_pool(&pr.rule.rpool);
948 }
949 path[len] = '\0';
950 return (0);
951
952 error:
953 path[len] = '\0';
954 return (-1);
955 }
956
957 int
958 pfctl_show_nat(int dev, int opts, char *anchorname)
959 {
960 struct pfioc_rule pr;
961 u_int32_t mnr, nr;
962 static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
963 int i, dotitle = opts & PF_OPT_SHOWALL;
964
965 memset(&pr, 0, sizeof(pr));
966 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
967 for (i = 0; i < 3; i++) {
968 pr.rule.action = nattype[i];
969 if (ioctl(dev, DIOCGETRULES, &pr)) {
970 warn("DIOCGETRULES");
971 return (-1);
972 }
973 mnr = pr.nr;
974 for (nr = 0; nr < mnr; ++nr) {
975 pr.nr = nr;
976 if (ioctl(dev, DIOCGETRULE, &pr)) {
977 warn("DIOCGETRULE");
978 return (-1);
979 }
980 if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
981 pr.ticket, nattype[i], anchorname) != 0)
982 return (-1);
983 if (dotitle) {
984 pfctl_print_title("TRANSLATION RULES:");
985 dotitle = 0;
986 }
987 print_rule(&pr.rule, pr.anchor_call,
988 opts & PF_OPT_VERBOSE2);
989 printf("\n");
990 pfctl_print_rule_counters(&pr.rule, opts);
991 pfctl_clear_pool(&pr.rule.rpool);
992 }
993 }
994 return (0);
995 }
996
997 int
998 pfctl_show_src_nodes(int dev, int opts)
999 {
1000 struct pfioc_src_nodes psn;
1001 struct pf_src_node *p;
1002 char *inbuf = NULL, *newinbuf = NULL;
1003 unsigned int len = 0;
1004 int i;
1005
1006 memset(&psn, 0, sizeof(psn));
1007 for (;;) {
1008 psn.psn_len = len;
1009 if (len) {
1010 newinbuf = realloc(inbuf, len);
1011 if (newinbuf == NULL)
1012 err(1, "realloc");
1013 psn.psn_buf = inbuf = newinbuf;
1014 }
1015 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
1016 warn("DIOCGETSRCNODES");
1017 free(inbuf);
1018 return (-1);
1019 }
1020 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
1021 break;
1022 if (len == 0 && psn.psn_len == 0)
1023 goto done;
1024 if (len == 0 && psn.psn_len != 0)
1025 len = psn.psn_len;
1026 if (psn.psn_len == 0)
1027 goto done; /* no src_nodes */
1028 len *= 2;
1029 }
1030 p = psn.psn_src_nodes;
1031 if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
1032 pfctl_print_title("SOURCE TRACKING NODES:");
1033 for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
1034 print_src_node(p, opts);
1035 p++;
1036 }
1037 done:
1038 free(inbuf);
1039 return (0);
1040 }
1041
1042 int
1043 pfctl_show_states(int dev, const char *iface, int opts)
1044 {
1045 struct pfioc_states ps;
1046 struct pfsync_state *p;
1047 char *inbuf = NULL, *newinbuf = NULL;
1048 unsigned int len = 0;
1049 int i, dotitle = (opts & PF_OPT_SHOWALL);
1050
1051 memset(&ps, 0, sizeof(ps));
1052 for (;;) {
1053 ps.ps_len = len;
1054 if (len) {
1055 newinbuf = realloc(inbuf, len);
1056 if (newinbuf == NULL)
1057 err(1, "realloc");
1058 ps.ps_buf = inbuf = newinbuf;
1059 }
1060 if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
1061 warn("DIOCGETSTATES");
1062 free(inbuf);
1063 return (-1);
1064 }
1065 if (ps.ps_len + sizeof(struct pfioc_states) < len)
1066 break;
1067 if (len == 0 && ps.ps_len == 0)
1068 goto done;
1069 if (len == 0 && ps.ps_len != 0)
1070 len = ps.ps_len;
1071 if (ps.ps_len == 0)
1072 goto done; /* no states */
1073 len *= 2;
1074 }
1075 p = ps.ps_states;
1076 for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
1077 if (iface != NULL && strcmp(p->ifname, iface))
1078 continue;
1079 if (dotitle) {
1080 pfctl_print_title("STATES:");
1081 dotitle = 0;
1082 }
1083 print_state(p, opts);
1084 }
1085 done:
1086 free(inbuf);
1087 return (0);
1088 }
1089
1090 int
1091 pfctl_show_status(int dev, int opts)
1092 {
1093 struct pf_status status;
1094
1095 if (ioctl(dev, DIOCGETSTATUS, &status)) {
1096 warn("DIOCGETSTATUS");
1097 return (-1);
1098 }
1099 if (opts & PF_OPT_SHOWALL)
1100 pfctl_print_title("INFO:");
1101 print_status(&status, opts);
1102 return (0);
1103 }
1104
1105 int
1106 pfctl_show_timeouts(int dev, int opts)
1107 {
1108 struct pfioc_tm pt;
1109 int i;
1110
1111 if (opts & PF_OPT_SHOWALL)
1112 pfctl_print_title("TIMEOUTS:");
1113 memset(&pt, 0, sizeof(pt));
1114 for (i = 0; pf_timeouts[i].name; i++) {
1115 pt.timeout = pf_timeouts[i].timeout;
1116 if (ioctl(dev, DIOCGETTIMEOUT, &pt))
1117 err(1, "DIOCGETTIMEOUT");
1118 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
1119 if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
1120 pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
1121 printf(" states");
1122 else
1123 printf("s");
1124 printf("\n");
1125 }
1126 return (0);
1127
1128 }
1129
1130 int
1131 pfctl_show_limits(int dev, int opts)
1132 {
1133 struct pfioc_limit pl;
1134 int i;
1135
1136 if (opts & PF_OPT_SHOWALL)
1137 pfctl_print_title("LIMITS:");
1138 memset(&pl, 0, sizeof(pl));
1139 for (i = 0; pf_limits[i].name; i++) {
1140 pl.index = pf_limits[i].index;
1141 if (ioctl(dev, DIOCGETLIMIT, &pl))
1142 err(1, "DIOCGETLIMIT");
1143 printf("%-13s ", pf_limits[i].name);
1144 if (pl.limit == UINT_MAX)
1145 printf("unlimited\n");
1146 else
1147 printf("hard limit %8u\n", pl.limit);
1148 }
1149 return (0);
1150 }
1151
1152 /* callbacks for rule/nat/rdr/addr */
1153 int
1154 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
1155 {
1156 struct pf_pooladdr *pa;
1157
1158 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1159 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
1160 err(1, "DIOCBEGINADDRS");
1161 }
1162
1163 pf->paddr.af = af;
1164 TAILQ_FOREACH(pa, &p->list, entries) {
1165 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
1166 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1167 if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
1168 err(1, "DIOCADDADDR");
1169 }
1170 }
1171 return (0);
1172 }
1173
1174 int
1175 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
1176 {
1177 u_int8_t rs_num;
1178 struct pf_rule *rule;
1179 struct pf_ruleset *rs;
1180 char *p;
1181
1182 rs_num = pf_get_ruleset_number(r->action);
1183 if (rs_num == PF_RULESET_MAX)
1184 errx(1, "Invalid rule type %d", r->action);
1185
1186 rs = &pf->anchor->ruleset;
1187
1188 if (anchor_call[0] && r->anchor == NULL) {
1189 /*
1190 * Don't make non-brace anchors part of the main anchor pool.
1191 */
1192 if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL)
1193 err(1, "pfctl_add_rule: calloc");
1194
1195 pf_init_ruleset(&r->anchor->ruleset);
1196 r->anchor->ruleset.anchor = r->anchor;
1197 if (strlcpy(r->anchor->path, anchor_call,
1198 sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path))
1199 errx(1, "pfctl_add_rule: strlcpy");
1200 if ((p = strrchr(anchor_call, '/')) != NULL) {
1201 if (!strlen(p))
1202 err(1, "pfctl_add_rule: bad anchor name %s",
1203 anchor_call);
1204 } else
1205 p = __DECONST(char *, anchor_call);
1206 if (strlcpy(r->anchor->name, p,
1207 sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name))
1208 errx(1, "pfctl_add_rule: strlcpy");
1209 }
1210
1211 if ((rule = calloc(1, sizeof(*rule))) == NULL)
1212 err(1, "calloc");
1213 bcopy(r, rule, sizeof(*rule));
1214 TAILQ_INIT(&rule->rpool.list);
1215 pfctl_move_pool(&r->rpool, &rule->rpool);
1216
1217 TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
1218 return (0);
1219 }
1220
1221 int
1222 pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1223 {
1224 int osize = pf->trans->pfrb_size;
1225
1226 if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) {
1227 if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) ||
1228 pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) ||
1229 pfctl_add_trans(pf->trans, PF_RULESET_RDR, path))
1230 return (1);
1231 }
1232 if (a == pf->astack[0] && ((altqsupport &&
1233 (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1234 if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path))
1235 return (2);
1236 }
1237 if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) {
1238 if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) ||
1239 pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path))
1240 return (3);
1241 }
1242 if (pf->loadopt & PFCTL_FLAG_TABLE)
1243 if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path))
1244 return (4);
1245 if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize))
1246 return (5);
1247
1248 return (0);
1249 }
1250
1251 int
1252 pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
1253 int rs_num, int depth)
1254 {
1255 struct pf_rule *r;
1256 int error, len = strlen(path);
1257 int brace = 0;
1258
1259 pf->anchor = rs->anchor;
1260
1261 if (path[0])
1262 snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name);
1263 else
1264 snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name);
1265
1266 if (depth) {
1267 if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) {
1268 brace++;
1269 if (pf->opts & PF_OPT_VERBOSE)
1270 printf(" {\n");
1271 if ((pf->opts & PF_OPT_NOACTION) == 0 &&
1272 (error = pfctl_ruleset_trans(pf,
1273 path, rs->anchor))) {
1274 printf("pfctl_load_rulesets: "
1275 "pfctl_ruleset_trans %d\n", error);
1276 goto error;
1277 }
1278 } else if (pf->opts & PF_OPT_VERBOSE)
1279 printf("\n");
1280
1281 }
1282
1283 if (pf->optimize && rs_num == PF_RULESET_FILTER)
1284 pfctl_optimize_ruleset(pf, rs);
1285
1286 while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) {
1287 TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries);
1288 if ((error = pfctl_load_rule(pf, path, r, depth)))
1289 goto error;
1290 if (r->anchor) {
1291 if ((error = pfctl_load_ruleset(pf, path,
1292 &r->anchor->ruleset, rs_num, depth + 1)))
1293 goto error;
1294 } else if (pf->opts & PF_OPT_VERBOSE)
1295 printf("\n");
1296 free(r);
1297 }
1298 if (brace && pf->opts & PF_OPT_VERBOSE) {
1299 INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE));
1300 printf("}\n");
1301 }
1302 path[len] = '\0';
1303 return (0);
1304
1305 error:
1306 path[len] = '\0';
1307 return (error);
1308
1309 }
1310
1311 int
1312 pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1313 {
1314 u_int8_t rs_num = pf_get_ruleset_number(r->action);
1315 char *name;
1316 struct pfioc_rule pr;
1317 int len = strlen(path);
1318
1319 bzero(&pr, sizeof(pr));
1320 /* set up anchor before adding to path for anchor_call */
1321 if ((pf->opts & PF_OPT_NOACTION) == 0)
1322 pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path);
1323 if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
1324 errx(1, "pfctl_load_rule: strlcpy");
1325
1326 if (r->anchor) {
1327 if (r->anchor->match) {
1328 if (path[0])
1329 snprintf(&path[len], MAXPATHLEN - len,
1330 "/%s", r->anchor->name);
1331 else
1332 snprintf(&path[len], MAXPATHLEN - len,
1333 "%s", r->anchor->name);
1334 name = path;
1335 } else
1336 name = r->anchor->path;
1337 } else
1338 name = __DECONST(char *, "");
1339
1340 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1341 if (pfctl_add_pool(pf, &r->rpool, r->af))
1342 return (1);
1343 pr.pool_ticket = pf->paddr.ticket;
1344 memcpy(&pr.rule, r, sizeof(pr.rule));
1345 if (r->anchor && strlcpy(pr.anchor_call, name,
1346 sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
1347 errx(1, "pfctl_load_rule: strlcpy");
1348 if (ioctl(pf->dev, DIOCADDRULE, &pr))
1349 err(1, "DIOCADDRULE");
1350 }
1351
1352 if (pf->opts & PF_OPT_VERBOSE) {
1353 INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2));
1354 print_rule(r, r->anchor ? r->anchor->name : "",
1355 pf->opts & PF_OPT_VERBOSE2);
1356 }
1357 path[len] = '\0';
1358 pfctl_clear_pool(&r->rpool);
1359 return (0);
1360 }
1361
1362 int
1363 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1364 {
1365 if (altqsupport &&
1366 (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1367 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1368 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1369 if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1370 if (errno == ENXIO)
1371 errx(1, "qtype not configured");
1372 else if (errno == ENODEV)
1373 errx(1, "%s: driver does not support "
1374 "altq", a->ifname);
1375 else
1376 err(1, "DIOCADDALTQ");
1377 }
1378 }
1379 pfaltq_store(&pf->paltq->altq);
1380 }
1381 return (0);
1382 }
1383
1384 int
1385 pfctl_rules(int dev, char *filename, int opts, int optimize,
1386 char *anchorname, struct pfr_buffer *trans)
1387 {
1388 #define ERR(x) do { warn(x); goto _error; } while(0)
1389 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1390
1391 struct pfr_buffer *t, buf;
1392 struct pfioc_altq pa;
1393 struct pfctl pf;
1394 struct pf_ruleset *rs;
1395 struct pfr_table trs;
1396 char *path;
1397 int osize;
1398
1399 RB_INIT(&pf_anchors);
1400 memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
1401 pf_init_ruleset(&pf_main_anchor.ruleset);
1402 pf_main_anchor.ruleset.anchor = &pf_main_anchor;
1403 if (trans == NULL) {
1404 bzero(&buf, sizeof(buf));
1405 buf.pfrb_type = PFRB_TRANS;
1406 t = &buf;
1407 osize = 0;
1408 } else {
1409 t = trans;
1410 osize = t->pfrb_size;
1411 }
1412
1413 memset(&pa, 0, sizeof(pa));
1414 memset(&pf, 0, sizeof(pf));
1415 memset(&trs, 0, sizeof(trs));
1416 if ((path = calloc(1, MAXPATHLEN)) == NULL)
1417 ERRX("pfctl_rules: calloc");
1418 if (strlcpy(trs.pfrt_anchor, anchorname,
1419 sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
1420 ERRX("pfctl_rules: strlcpy");
1421 pf.dev = dev;
1422 pf.opts = opts;
1423 pf.optimize = optimize;
1424 pf.loadopt = loadopt;
1425
1426 /* non-brace anchor, create without resolving the path */
1427 if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL)
1428 ERRX("pfctl_rules: calloc");
1429 rs = &pf.anchor->ruleset;
1430 pf_init_ruleset(rs);
1431 rs->anchor = pf.anchor;
1432 if (strlcpy(pf.anchor->path, anchorname,
1433 sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
1434 errx(1, "pfctl_add_rule: strlcpy");
1435 if (strlcpy(pf.anchor->name, anchorname,
1436 sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
1437 errx(1, "pfctl_add_rule: strlcpy");
1438
1439
1440 pf.astack[0] = pf.anchor;
1441 pf.asd = 0;
1442 if (anchorname[0])
1443 pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1444 pf.paltq = &pa;
1445 pf.trans = t;
1446 pfctl_init_options(&pf);
1447
1448 if ((opts & PF_OPT_NOACTION) == 0) {
1449 /*
1450 * XXX For the time being we need to open transactions for
1451 * the main ruleset before parsing, because tables are still
1452 * loaded at parse time.
1453 */
1454 if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
1455 ERRX("pfctl_rules");
1456 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1457 pa.ticket =
1458 pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname);
1459 if (pf.loadopt & PFCTL_FLAG_TABLE)
1460 pf.astack[0]->ruleset.tticket =
1461 pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname);
1462 }
1463
1464 if (parse_config(filename, &pf) < 0) {
1465 if ((opts & PF_OPT_NOACTION) == 0)
1466 ERRX("Syntax error in config file: "
1467 "pf rules not loaded");
1468 else
1469 goto _error;
1470 }
1471
1472 if ((pf.loadopt & PFCTL_FLAG_FILTER &&
1473 (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) ||
1474 (pf.loadopt & PFCTL_FLAG_NAT &&
1475 (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) ||
1476 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) ||
1477 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) ||
1478 (pf.loadopt & PFCTL_FLAG_FILTER &&
1479 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) {
1480 if ((opts & PF_OPT_NOACTION) == 0)
1481 ERRX("Unable to load rules into kernel");
1482 else
1483 goto _error;
1484 }
1485
1486 if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1487 if (check_commit_altq(dev, opts) != 0)
1488 ERRX("errors in altq config");
1489
1490 /* process "load anchor" directives */
1491 if (!anchorname[0])
1492 if (pfctl_load_anchors(dev, &pf, t) == -1)
1493 ERRX("load anchors");
1494
1495 if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) {
1496 if (!anchorname[0])
1497 if (pfctl_load_options(&pf))
1498 goto _error;
1499 if (pfctl_trans(dev, t, DIOCXCOMMIT, osize))
1500 ERR("DIOCXCOMMIT");
1501 }
1502 return (0);
1503
1504 _error:
1505 if (trans == NULL) { /* main ruleset */
1506 if ((opts & PF_OPT_NOACTION) == 0)
1507 if (pfctl_trans(dev, t, DIOCXROLLBACK, osize))
1508 err(1, "DIOCXROLLBACK");
1509 exit(1);
1510 } else { /* sub ruleset */
1511 return (-1);
1512 }
1513
1514 #undef ERR
1515 #undef ERRX
1516 }
1517
1518 FILE *
1519 pfctl_fopen(const char *name, const char *mode)
1520 {
1521 struct stat st;
1522 FILE *fp;
1523
1524 fp = fopen(name, mode);
1525 if (fp == NULL)
1526 return (NULL);
1527 if (fstat(fileno(fp), &st)) {
1528 fclose(fp);
1529 return (NULL);
1530 }
1531 if (S_ISDIR(st.st_mode)) {
1532 fclose(fp);
1533 errno = EISDIR;
1534 return (NULL);
1535 }
1536 return (fp);
1537 }
1538
1539 void
1540 pfctl_init_options(struct pfctl *pf)
1541 {
1542 int64_t mem;
1543 int mib[2];
1544 size_t size;
1545
1546 pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
1547 pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
1548 pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
1549 pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
1550 pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
1551 pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
1552 pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
1553 pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
1554 pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
1555 pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
1556 pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
1557 pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
1558 pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
1559 pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
1560 pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
1561 pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
1562 pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
1563 pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
1564 pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
1565 pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
1566
1567 pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT;
1568 pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT;
1569 pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT;
1570 pf->limit[PF_LIMIT_TABLES] = PFR_KTABLE_HIWAT;
1571 pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT;
1572
1573 mib[0] = CTL_HW;
1574 mib[1] = HW_PHYSMEM;
1575 size = sizeof(mem);
1576 if (sysctl(mib, 2, &mem, &size, NULL, 0) == -1)
1577 err(1, "sysctl");
1578 if (mem <= 100*1024*1024)
1579 pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT_SMALL;
1580
1581 pf->debug = PF_DEBUG_URGENT;
1582 }
1583
1584 int
1585 pfctl_load_options(struct pfctl *pf)
1586 {
1587 int i, error = 0;
1588
1589 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1590 return (0);
1591
1592 /* load limits */
1593 for (i = 0; i < PF_LIMIT_MAX; i++) {
1594 if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i])
1595 continue;
1596 if (pfctl_load_limit(pf, i, pf->limit[i]))
1597 error = 1;
1598 }
1599
1600 /*
1601 * If we've set the limit, but haven't explicitly set adaptive
1602 * timeouts, do it now with a start of 60% and end of 120%.
1603 */
1604 if (pf->limit_set[PF_LIMIT_STATES] &&
1605 !pf->timeout_set[PFTM_ADAPTIVE_START] &&
1606 !pf->timeout_set[PFTM_ADAPTIVE_END]) {
1607 pf->timeout[PFTM_ADAPTIVE_START] =
1608 (pf->limit[PF_LIMIT_STATES] / 10) * 6;
1609 pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
1610 pf->timeout[PFTM_ADAPTIVE_END] =
1611 (pf->limit[PF_LIMIT_STATES] / 10) * 12;
1612 pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
1613 }
1614
1615 /* load timeouts */
1616 for (i = 0; i < PFTM_MAX; i++) {
1617 if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i])
1618 continue;
1619 if (pfctl_load_timeout(pf, i, pf->timeout[i]))
1620 error = 1;
1621 }
1622
1623 /* load debug */
1624 if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set)
1625 if (pfctl_load_debug(pf, pf->debug))
1626 error = 1;
1627
1628 /* load logif */
1629 if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set)
1630 if (pfctl_load_logif(pf, pf->ifname))
1631 error = 1;
1632
1633 /* load hostid */
1634 if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set)
1635 if (pfctl_load_hostid(pf, pf->hostid))
1636 error = 1;
1637
1638 return (error);
1639 }
1640
1641 int
1642 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1643 {
1644 int i;
1645
1646
1647 for (i = 0; pf_limits[i].name; i++) {
1648 if (strcasecmp(opt, pf_limits[i].name) == 0) {
1649 pf->limit[pf_limits[i].index] = limit;
1650 pf->limit_set[pf_limits[i].index] = 1;
1651 break;
1652 }
1653 }
1654 if (pf_limits[i].name == NULL) {
1655 warnx("Bad pool name.");
1656 return (1);
1657 }
1658
1659 if (pf->opts & PF_OPT_VERBOSE)
1660 printf("set limit %s %d\n", opt, limit);
1661
1662 return (0);
1663 }
1664
1665 int
1666 pfctl_load_limit(struct pfctl *pf, unsigned int his_index, unsigned int limit)
1667 {
1668 struct pfioc_limit pl;
1669
1670 memset(&pl, 0, sizeof(pl));
1671 pl.index = his_index;
1672 pl.limit = limit;
1673 if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1674 if (errno == EBUSY)
1675 warnx("Current pool size exceeds requested hard limit");
1676 else
1677 warnx("DIOCSETLIMIT");
1678 return (1);
1679 }
1680 return (0);
1681 }
1682
1683 int
1684 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1685 {
1686 int i;
1687
1688 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1689 return (0);
1690
1691 for (i = 0; pf_timeouts[i].name; i++) {
1692 if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1693 pf->timeout[pf_timeouts[i].timeout] = seconds;
1694 pf->timeout_set[pf_timeouts[i].timeout] = 1;
1695 break;
1696 }
1697 }
1698
1699 if (pf_timeouts[i].name == NULL) {
1700 warnx("Bad timeout name.");
1701 return (1);
1702 }
1703
1704
1705 if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1706 printf("set timeout %s %d\n", opt, seconds);
1707
1708 return (0);
1709 }
1710
1711 int
1712 pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1713 {
1714 struct pfioc_tm pt;
1715
1716 memset(&pt, 0, sizeof(pt));
1717 pt.timeout = timeout;
1718 pt.seconds = seconds;
1719 if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) {
1720 warnx("DIOCSETTIMEOUT");
1721 return (1);
1722 }
1723 return (0);
1724 }
1725
1726 int
1727 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1728 {
1729 const struct pf_hint *hint;
1730 int i, r;
1731
1732 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1733 return (0);
1734
1735 for (i = 0; pf_hints[i].name; i++)
1736 if (strcasecmp(opt, pf_hints[i].name) == 0)
1737 break;
1738
1739 hint = pf_hints[i].hint;
1740 if (hint == NULL) {
1741 warnx("invalid state timeouts optimization");
1742 return (1);
1743 }
1744
1745 for (i = 0; hint[i].name; i++)
1746 if ((r = pfctl_set_timeout(pf, hint[i].name,
1747 hint[i].timeout, 1)))
1748 return (r);
1749
1750 if (pf->opts & PF_OPT_VERBOSE)
1751 printf("set optimization %s\n", opt);
1752
1753 return (0);
1754 }
1755
1756 int
1757 pfctl_set_logif(struct pfctl *pf, char *ifname)
1758 {
1759
1760 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1761 return (0);
1762
1763 if (!strcmp(ifname, "none")) {
1764 free(pf->ifname);
1765 pf->ifname = NULL;
1766 } else {
1767 pf->ifname = strdup(ifname);
1768 if (!pf->ifname)
1769 errx(1, "pfctl_set_logif: strdup");
1770 }
1771 pf->ifname_set = 1;
1772
1773 if (pf->opts & PF_OPT_VERBOSE)
1774 printf("set loginterface %s\n", ifname);
1775
1776 return (0);
1777 }
1778
1779 int
1780 pfctl_load_logif(struct pfctl *pf, char *ifname)
1781 {
1782 struct pfioc_if pi;
1783
1784 memset(&pi, 0, sizeof(pi));
1785 if (ifname && strlcpy(pi.ifname, ifname,
1786 sizeof(pi.ifname)) >= sizeof(pi.ifname)) {
1787 warnx("pfctl_load_logif: strlcpy");
1788 return (1);
1789 }
1790 if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) {
1791 warnx("DIOCSETSTATUSIF");
1792 return (1);
1793 }
1794 return (0);
1795 }
1796
1797 int
1798 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1799 {
1800 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1801 return (0);
1802
1803 hostid = htonl(hostid);
1804
1805 pf->hostid = hostid;
1806 pf->hostid_set = 1;
1807
1808 if (pf->opts & PF_OPT_VERBOSE)
1809 printf("set hostid 0x%08x\n", ntohl(hostid));
1810
1811 return (0);
1812 }
1813
1814 int
1815 pfctl_load_hostid(struct pfctl *pf __unused, u_int32_t hostid)
1816 {
1817 if (ioctl(dev_fd, DIOCSETHOSTID, &hostid)) {
1818 warnx("DIOCSETHOSTID");
1819 return (1);
1820 }
1821 return (0);
1822 }
1823
1824 int
1825 pfctl_set_debug(struct pfctl *pf, char *d)
1826 {
1827 u_int32_t level;
1828
1829 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1830 return (0);
1831
1832 if (!strcmp(d, "none"))
1833 pf->debug = PF_DEBUG_NONE;
1834 else if (!strcmp(d, "urgent"))
1835 pf->debug = PF_DEBUG_URGENT;
1836 else if (!strcmp(d, "misc"))
1837 pf->debug = PF_DEBUG_MISC;
1838 else if (!strcmp(d, "loud"))
1839 pf->debug = PF_DEBUG_NOISY;
1840 else {
1841 warnx("unknown debug level \"%s\"", d);
1842 return (-1);
1843 }
1844
1845 pf->debug_set = 1;
1846
1847 if ((pf->opts & PF_OPT_NOACTION) == 0)
1848 if (ioctl(dev_fd, DIOCSETDEBUG, &level))
1849 err(1, "DIOCSETDEBUG");
1850
1851 if (pf->opts & PF_OPT_VERBOSE)
1852 printf("set debug %s\n", d);
1853
1854 return (0);
1855 }
1856
1857 int
1858 pfctl_load_debug(struct pfctl *pf, unsigned int level)
1859 {
1860 if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
1861 warnx("DIOCSETDEBUG");
1862 return (1);
1863 }
1864 return (0);
1865 }
1866
1867 int
1868 pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
1869 {
1870 struct pfioc_iface pi;
1871
1872 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1873 return (0);
1874
1875 bzero(&pi, sizeof(pi));
1876
1877 pi.pfiio_flags = flags;
1878
1879 if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
1880 sizeof(pi.pfiio_name))
1881 errx(1, "pfctl_set_interface_flags: strlcpy");
1882
1883 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1884 if (how == 0) {
1885 if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi))
1886 err(1, "DIOCCLRIFFLAG");
1887 } else {
1888 if (ioctl(pf->dev, DIOCSETIFFLAG, &pi))
1889 err(1, "DIOCSETIFFLAG");
1890 }
1891 }
1892 return (0);
1893 }
1894
1895 void
1896 pfctl_debug(int dev, u_int32_t level, int opts)
1897 {
1898 if (ioctl(dev, DIOCSETDEBUG, &level))
1899 err(1, "DIOCSETDEBUG");
1900 if ((opts & PF_OPT_QUIET) == 0) {
1901 fprintf(stderr, "debug level set to '");
1902 switch (level) {
1903 case PF_DEBUG_NONE:
1904 fprintf(stderr, "none");
1905 break;
1906 case PF_DEBUG_URGENT:
1907 fprintf(stderr, "urgent");
1908 break;
1909 case PF_DEBUG_MISC:
1910 fprintf(stderr, "misc");
1911 break;
1912 case PF_DEBUG_NOISY:
1913 fprintf(stderr, "loud");
1914 break;
1915 default:
1916 fprintf(stderr, "<invalid>");
1917 break;
1918 }
1919 fprintf(stderr, "'\n");
1920 }
1921 }
1922
1923 int
1924 pfctl_test_altqsupport(int dev, int opts)
1925 {
1926 struct pfioc_altq pa;
1927
1928 if (ioctl(dev, DIOCGETALTQS, &pa)) {
1929 if (errno == ENODEV) {
1930 if (!(opts & PF_OPT_QUIET))
1931 fprintf(stderr, "No ALTQ support in kernel\n"
1932 "ALTQ related functions disabled\n");
1933 return (0);
1934 } else
1935 err(1, "DIOCGETALTQS");
1936 }
1937 return (1);
1938 }
1939
1940 int
1941 pfctl_show_anchors(int dev, int opts, char *anchorname)
1942 {
1943 struct pfioc_ruleset pr;
1944 u_int32_t mnr, nr;
1945
1946 memset(&pr, 0, sizeof(pr));
1947 memcpy(pr.path, anchorname, sizeof(pr.path));
1948 if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1949 if (errno == EINVAL)
1950 fprintf(stderr, "Anchor '%s' not found.\n",
1951 anchorname);
1952 else
1953 err(1, "DIOCGETRULESETS");
1954 return (-1);
1955 }
1956 mnr = pr.nr;
1957 for (nr = 0; nr < mnr; ++nr) {
1958 char sub[MAXPATHLEN];
1959
1960 pr.nr = nr;
1961 if (ioctl(dev, DIOCGETRULESET, &pr))
1962 err(1, "DIOCGETRULESET");
1963 if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
1964 continue;
1965 sub[0] = 0;
1966 if (pr.path[0]) {
1967 strlcat(sub, pr.path, sizeof(sub));
1968 strlcat(sub, "/", sizeof(sub));
1969 }
1970 strlcat(sub, pr.name, sizeof(sub));
1971 if (sub[0] != '_' || (opts & PF_OPT_VERBOSE))
1972 printf(" %s\n", sub);
1973 if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub))
1974 return (-1);
1975 }
1976 return (0);
1977 }
1978
1979 const char *
1980 pfctl_lookup_option(char *cmd, const char **list)
1981 {
1982 if (cmd != NULL && *cmd)
1983 for (; *list; list++)
1984 if (!strncmp(cmd, *list, strlen(cmd)))
1985 return (*list);
1986 return (NULL);
1987 }
1988
1989 int
1990 main(int argc, char *argv[])
1991 {
1992 int error = 0;
1993 int ch;
1994 int mode = O_RDONLY;
1995 int opts = 0;
1996 int optimize = PF_OPTIMIZE_BASIC;
1997 char anchorname[MAXPATHLEN];
1998 char *path;
1999
2000 if (argc < 2)
2001 usage();
2002
2003 while ((ch = getopt(argc, argv,
2004 "a:AdD:eqf:F:ghi:k:K:mnNOo:p:rRs:t:T:vx:z")) != -1) {
2005 switch (ch) {
2006 case 'a':
2007 anchoropt = optarg;
2008 break;
2009 case 'd':
2010 opts |= PF_OPT_DISABLE;
2011 mode = O_RDWR;
2012 break;
2013 case 'D':
2014 if (pfctl_cmdline_symset(optarg) < 0)
2015 warnx("could not parse macro definition %s",
2016 optarg);
2017 break;
2018 case 'e':
2019 opts |= PF_OPT_ENABLE;
2020 mode = O_RDWR;
2021 break;
2022 case 'q':
2023 opts |= PF_OPT_QUIET;
2024 break;
2025 case 'F':
2026 clearopt = pfctl_lookup_option(optarg, clearopt_list);
2027 if (clearopt == NULL) {
2028 warnx("Unknown flush modifier '%s'", optarg);
2029 usage();
2030 }
2031 mode = O_RDWR;
2032 break;
2033 case 'i':
2034 ifaceopt = optarg;
2035 break;
2036 case 'k':
2037 if (state_killers >= 2) {
2038 warnx("can only specify -k twice");
2039 usage();
2040 /* NOTREACHED */
2041 }
2042 state_kill[state_killers++] = optarg;
2043 mode = O_RDWR;
2044 break;
2045 case 'K':
2046 if (src_node_killers >= 2) {
2047 warnx("can only specify -K twice");
2048 usage();
2049 /* NOTREACHED */
2050 }
2051 src_node_kill[src_node_killers++] = optarg;
2052 mode = O_RDWR;
2053 break;
2054 case 'm':
2055 opts |= PF_OPT_MERGE;
2056 break;
2057 case 'n':
2058 opts |= PF_OPT_NOACTION;
2059 break;
2060 case 'N':
2061 loadopt |= PFCTL_FLAG_NAT;
2062 break;
2063 case 'r':
2064 opts |= PF_OPT_USEDNS;
2065 break;
2066 case 'f':
2067 rulesopt = optarg;
2068 mode = O_RDWR;
2069 break;
2070 case 'g':
2071 opts |= PF_OPT_DEBUG;
2072 break;
2073 case 'A':
2074 loadopt |= PFCTL_FLAG_ALTQ;
2075 break;
2076 case 'R':
2077 loadopt |= PFCTL_FLAG_FILTER;
2078 break;
2079 case 'o':
2080 optiopt = pfctl_lookup_option(optarg, optiopt_list);
2081 if (optiopt == NULL) {
2082 warnx("Unknown optimization '%s'", optarg);
2083 usage();
2084 }
2085 opts |= PF_OPT_OPTIMIZE;
2086 break;
2087 case 'O':
2088 loadopt |= PFCTL_FLAG_OPTION;
2089 break;
2090 case 'p':
2091 pf_device = optarg;
2092 break;
2093 case 's':
2094 showopt = pfctl_lookup_option(optarg, showopt_list);
2095 if (showopt == NULL) {
2096 warnx("Unknown show modifier '%s'", optarg);
2097 usage();
2098 }
2099 break;
2100 case 't':
2101 tableopt = optarg;
2102 break;
2103 case 'T':
2104 tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
2105 if (tblcmdopt == NULL) {
2106 warnx("Unknown table command '%s'", optarg);
2107 usage();
2108 }
2109 break;
2110 case 'v':
2111 if (opts & PF_OPT_VERBOSE)
2112 opts |= PF_OPT_VERBOSE2;
2113 opts |= PF_OPT_VERBOSE;
2114 break;
2115 case 'x':
2116 debugopt = pfctl_lookup_option(optarg, debugopt_list);
2117 if (debugopt == NULL) {
2118 warnx("Unknown debug level '%s'", optarg);
2119 usage();
2120 }
2121 mode = O_RDWR;
2122 break;
2123 case 'z':
2124 opts |= PF_OPT_CLRRULECTRS;
2125 mode = O_RDWR;
2126 break;
2127 case 'h':
2128 /* FALLTHROUGH */
2129 default:
2130 usage();
2131 /* NOTREACHED */
2132 }
2133 }
2134
2135 if (tblcmdopt != NULL) {
2136 argc -= optind;
2137 argv += optind;
2138 ch = *tblcmdopt;
2139 if (ch == 'l') {
2140 loadopt |= PFCTL_FLAG_TABLE;
2141 tblcmdopt = NULL;
2142 } else
2143 mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY;
2144 } else if (argc != optind) {
2145 warnx("unknown command line argument: %s ...", argv[optind]);
2146 usage();
2147 /* NOTREACHED */
2148 }
2149 if (loadopt == 0)
2150 loadopt = ~0;
2151
2152 if ((path = calloc(1, MAXPATHLEN)) == NULL)
2153 errx(1, "pfctl: calloc");
2154 memset(anchorname, 0, sizeof(anchorname));
2155 if (anchoropt != NULL) {
2156 int len = strlen(anchoropt);
2157
2158 if (anchoropt[len - 1] == '*') {
2159 if (len >= 2 && anchoropt[len - 2] == '/')
2160 anchoropt[len - 2] = '\0';
2161 else
2162 anchoropt[len - 1] = '\0';
2163 opts |= PF_OPT_RECURSE;
2164 }
2165 if (strlcpy(anchorname, anchoropt,
2166 sizeof(anchorname)) >= sizeof(anchorname))
2167 errx(1, "anchor name '%s' too long",
2168 anchoropt);
2169 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
2170 }
2171
2172 if ((opts & PF_OPT_NOACTION) == 0) {
2173 dev_fd = open(pf_device, mode);
2174 if (dev_fd == -1)
2175 err(1, "%s", pf_device);
2176 altqsupport = pfctl_test_altqsupport(dev_fd, opts);
2177 } else {
2178 dev_fd = open(pf_device, O_RDONLY);
2179 if (dev_fd >= 0)
2180 opts |= PF_OPT_DUMMYACTION;
2181 /* turn off options */
2182 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
2183 clearopt = showopt = debugopt = NULL;
2184 altqsupport = 1;
2185 }
2186
2187 if (opts & PF_OPT_DISABLE)
2188 if (pfctl_disable(dev_fd, opts))
2189 error = 1;
2190
2191 if (showopt != NULL) {
2192 switch (*showopt) {
2193 case 'A':
2194 pfctl_show_anchors(dev_fd, opts, anchorname);
2195 break;
2196 case 'r':
2197 pfctl_load_fingerprints(dev_fd, opts);
2198 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_RULES,
2199 anchorname, 0);
2200 break;
2201 case 'l':
2202 pfctl_load_fingerprints(dev_fd, opts);
2203 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_LABELS,
2204 anchorname, 0);
2205 break;
2206 case 'n':
2207 pfctl_load_fingerprints(dev_fd, opts);
2208 pfctl_show_nat(dev_fd, opts, anchorname);
2209 break;
2210 case 'q':
2211 pfctl_show_altq(dev_fd, ifaceopt, opts,
2212 opts & PF_OPT_VERBOSE2);
2213 break;
2214 case 's':
2215 pfctl_show_states(dev_fd, ifaceopt, opts);
2216 break;
2217 case 'S':
2218 pfctl_show_src_nodes(dev_fd, opts);
2219 break;
2220 case 'i':
2221 pfctl_show_status(dev_fd, opts);
2222 break;
2223 case 't':
2224 pfctl_show_timeouts(dev_fd, opts);
2225 break;
2226 case 'm':
2227 pfctl_show_limits(dev_fd, opts);
2228 break;
2229 case 'a':
2230 opts |= PF_OPT_SHOWALL;
2231 pfctl_load_fingerprints(dev_fd, opts);
2232
2233 pfctl_show_nat(dev_fd, opts, anchorname);
2234 pfctl_show_rules(dev_fd, path, opts, 0, anchorname, 0);
2235 pfctl_show_altq(dev_fd, ifaceopt, opts, 0);
2236 pfctl_show_states(dev_fd, ifaceopt, opts);
2237 pfctl_show_src_nodes(dev_fd, opts);
2238 pfctl_show_status(dev_fd, opts);
2239 pfctl_show_rules(dev_fd, path, opts, 1, anchorname, 0);
2240 pfctl_show_timeouts(dev_fd, opts);
2241 pfctl_show_limits(dev_fd, opts);
2242 pfctl_show_tables(anchorname, opts);
2243 pfctl_show_fingerprints(opts);
2244 break;
2245 case 'T':
2246 pfctl_show_tables(anchorname, opts);
2247 break;
2248 case 'o':
2249 pfctl_load_fingerprints(dev_fd, opts);
2250 pfctl_show_fingerprints(opts);
2251 break;
2252 case 'I':
2253 pfctl_show_ifaces(ifaceopt, opts);
2254 break;
2255 }
2256 }
2257
2258 if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL)
2259 pfctl_show_rules(dev_fd, path, opts, PFCTL_SHOW_NOTHING,
2260 anchorname, 0);
2261
2262 if (clearopt != NULL) {
2263 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2264 errx(1, "anchor names beginning with '_' cannot "
2265 "be modified from the command line");
2266
2267 switch (*clearopt) {
2268 case 'r':
2269 pfctl_clear_rules(dev_fd, opts, anchorname);
2270 break;
2271 case 'n':
2272 pfctl_clear_nat(dev_fd, opts, anchorname);
2273 break;
2274 case 'q':
2275 pfctl_clear_altq(dev_fd, opts);
2276 break;
2277 case 's':
2278 pfctl_clear_states(dev_fd, ifaceopt, opts);
2279 break;
2280 case 'S':
2281 pfctl_clear_src_nodes(dev_fd, opts);
2282 break;
2283 case 'i':
2284 pfctl_clear_stats(dev_fd, opts);
2285 break;
2286 case 'a':
2287 pfctl_clear_rules(dev_fd, opts, anchorname);
2288 pfctl_clear_nat(dev_fd, opts, anchorname);
2289 pfctl_clear_tables(anchorname, opts);
2290 if (!*anchorname) {
2291 pfctl_clear_altq(dev_fd, opts);
2292 pfctl_clear_states(dev_fd, ifaceopt, opts);
2293 pfctl_clear_src_nodes(dev_fd, opts);
2294 pfctl_clear_stats(dev_fd, opts);
2295 pfctl_clear_fingerprints(dev_fd, opts);
2296 pfctl_clear_interface_flags(dev_fd, opts);
2297 }
2298 break;
2299 case 'o':
2300 pfctl_clear_fingerprints(dev_fd, opts);
2301 break;
2302 case 'T':
2303 pfctl_clear_tables(anchorname, opts);
2304 break;
2305 }
2306 }
2307 if (state_killers) {
2308 if (!strcmp(state_kill[0], "label"))
2309 pfctl_label_kill_states(dev_fd, ifaceopt, opts);
2310 else if (!strcmp(state_kill[0], "id"))
2311 pfctl_id_kill_states(dev_fd, ifaceopt, opts);
2312 else
2313 pfctl_net_kill_states(dev_fd, ifaceopt, opts);
2314 }
2315
2316 if (src_node_killers)
2317 pfctl_kill_src_nodes(dev_fd, ifaceopt, opts);
2318
2319 if (tblcmdopt != NULL) {
2320 error = pfctl_command_tables(argc, argv, tableopt,
2321 tblcmdopt, rulesopt, anchorname, opts);
2322 rulesopt = NULL;
2323 }
2324 if (optiopt != NULL) {
2325 switch (*optiopt) {
2326 case 'n':
2327 optimize = 0;
2328 break;
2329 case 'b':
2330 optimize |= PF_OPTIMIZE_BASIC;
2331 break;
2332 case 'o':
2333 case 'p':
2334 optimize |= PF_OPTIMIZE_PROFILE;
2335 break;
2336 }
2337 }
2338
2339 if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) &&
2340 !anchorname[0])
2341 if (pfctl_clear_interface_flags(dev_fd, opts | PF_OPT_QUIET))
2342 error = 1;
2343
2344 if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) &&
2345 !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION))
2346 if (pfctl_file_fingerprints(dev_fd, opts, PF_OSFP_FILE))
2347 error = 1;
2348
2349 if (rulesopt != NULL) {
2350 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL)
2351 errx(1, "anchor names beginning with '_' cannot "
2352 "be modified from the command line");
2353 if (pfctl_rules(dev_fd, rulesopt, opts, optimize,
2354 anchorname, NULL))
2355 error = 1;
2356 else if (!(opts & PF_OPT_NOACTION) &&
2357 (loadopt & PFCTL_FLAG_TABLE))
2358 warn_namespace_collision(NULL);
2359 }
2360
2361 if (opts & PF_OPT_ENABLE)
2362 if (pfctl_enable(dev_fd, opts))
2363 error = 1;
2364
2365 if (debugopt != NULL) {
2366 switch (*debugopt) {
2367 case 'n':
2368 pfctl_debug(dev_fd, PF_DEBUG_NONE, opts);
2369 break;
2370 case 'u':
2371 pfctl_debug(dev_fd, PF_DEBUG_URGENT, opts);
2372 break;
2373 case 'm':
2374 pfctl_debug(dev_fd, PF_DEBUG_MISC, opts);
2375 break;
2376 case 'l':
2377 pfctl_debug(dev_fd, PF_DEBUG_NOISY, opts);
2378 break;
2379 }
2380 }
2381
2382 exit(error);
2383 }
DragonFly BSD