1 /* $OpenBSD: pfctl.c,v 1.277 2008/07/24 10:52:43 henning Exp $ */
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002,2003 Henning Brauer
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
34 #include <sys/types.h>
35 #include <sys/ioctl.h>
36 #include <sys/socket.h>
38 #include <sys/endian.h>
41 #include <netinet/in.h>
42 #include <net/pf/pfvar.h>
43 #include <arpa/inet.h>
44 #include <net/altq/altq.h>
45 #include <sys/sysctl.h>
58 #include "pfctl_parser.h"
62 int pfctl_enable(int, int);
63 int pfctl_disable(int, int);
64 int pfctl_clear_stats(int, int);
65 int pfctl_clear_interface_flags(int, int);
66 int pfctl_clear_rules(int, int, char *);
67 int pfctl_clear_nat(int, int, char *);
68 int pfctl_clear_altq(int, int);
69 int pfctl_clear_src_nodes(int, int);
70 int pfctl_clear_states(int, const char *, int);
71 void pfctl_addrprefix(char *, struct pf_addr
*);
72 int pfctl_kill_src_nodes(int, const char *, int);
73 int pfctl_net_kill_states(int, const char *, int);
74 int pfctl_label_kill_states(int, const char *, int);
75 int pfctl_id_kill_states(int, const char *, int);
76 void pfctl_init_options(struct pfctl
*);
77 int pfctl_load_options(struct pfctl
*);
78 int pfctl_load_limit(struct pfctl
*, unsigned int, unsigned int);
79 int pfctl_load_timeout(struct pfctl
*, unsigned int, unsigned int);
80 int pfctl_load_debug(struct pfctl
*, unsigned int);
81 int pfctl_load_logif(struct pfctl
*, char *);
82 int pfctl_load_hostid(struct pfctl
*, unsigned int);
83 int pfctl_get_pool(int, struct pf_pool
*, u_int32_t
, u_int32_t
, int,
85 void pfctl_print_rule_counters(struct pf_rule
*, int);
86 int pfctl_show_rules(int, char *, int, enum pfctl_show
, char *, int);
87 int pfctl_show_nat(int, int, char *);
88 int pfctl_show_src_nodes(int, int);
89 int pfctl_show_states(int, const char *, int);
90 int pfctl_show_status(int, int);
91 int pfctl_show_timeouts(int, int);
92 int pfctl_show_limits(int, int);
93 void pfctl_debug(int, u_int32_t
, int);
94 int pfctl_test_altqsupport(int, int);
95 int pfctl_show_anchors(int, int, char *);
96 int pfctl_ruleset_trans(struct pfctl
*, char *, struct pf_anchor
*);
97 int pfctl_load_ruleset(struct pfctl
*, char *,
98 struct pf_ruleset
*, int, int);
99 int pfctl_load_rule(struct pfctl
*, char *, struct pf_rule
*, int);
100 const char *pfctl_lookup_option(char *, const char **);
102 struct pf_anchor_global pf_anchors
;
103 struct pf_anchor pf_main_anchor
;
105 const char *clearopt
;
108 const char *debugopt
;
110 const char *optiopt
= NULL
;
111 const char *pf_device
= "/dev/pf";
114 const char *tblcmdopt
;
115 int src_node_killers
;
116 char *src_node_kill
[2];
126 #define INDENT(d, o) do { \
129 for (i=0; i < d; i++) \
135 static const struct {
139 { "states", PF_LIMIT_STATES
},
140 { "src-nodes", PF_LIMIT_SRC_NODES
},
141 { "frags", PF_LIMIT_FRAGS
},
142 { "tables", PF_LIMIT_TABLES
},
143 { "table-entries", PF_LIMIT_TABLE_ENTRIES
},
151 static const struct pf_hint pf_hint_normal
[] = {
152 { "tcp.first", 2 * 60 },
153 { "tcp.opening", 30 },
154 { "tcp.established", 24 * 60 * 60 },
155 { "tcp.closing", 15 * 60 },
156 { "tcp.finwait", 45 },
157 { "tcp.closed", 90 },
158 { "tcp.tsdiff", 30 },
161 static const struct pf_hint pf_hint_satellite
[] = {
162 { "tcp.first", 3 * 60 },
163 { "tcp.opening", 30 + 5 },
164 { "tcp.established", 24 * 60 * 60 },
165 { "tcp.closing", 15 * 60 + 5 },
166 { "tcp.finwait", 45 + 5 },
167 { "tcp.closed", 90 + 5 },
168 { "tcp.tsdiff", 60 },
171 static const struct pf_hint pf_hint_conservative
[] = {
172 { "tcp.first", 60 * 60 },
173 { "tcp.opening", 15 * 60 },
174 { "tcp.established", 5 * 24 * 60 * 60 },
175 { "tcp.closing", 60 * 60 },
176 { "tcp.finwait", 10 * 60 },
177 { "tcp.closed", 3 * 60 },
178 { "tcp.tsdiff", 60 },
181 static const struct pf_hint pf_hint_aggressive
[] = {
183 { "tcp.opening", 5 },
184 { "tcp.established", 5 * 60 * 60 },
185 { "tcp.closing", 60 },
186 { "tcp.finwait", 30 },
187 { "tcp.closed", 30 },
188 { "tcp.tsdiff", 10 },
192 static const struct {
194 const struct pf_hint
*hint
;
196 { "normal", pf_hint_normal
},
197 { "satellite", pf_hint_satellite
},
198 { "high-latency", pf_hint_satellite
},
199 { "conservative", pf_hint_conservative
},
200 { "aggressive", pf_hint_aggressive
},
204 static const char *clearopt_list
[] = {
205 "nat", "queue", "rules", "Sources",
206 "states", "info", "Tables", "osfp", "all", NULL
209 static const char *showopt_list
[] = {
210 "nat", "queue", "rules", "Anchors", "Sources", "states", "info",
211 "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
215 static const char *tblcmdopt_list
[] = {
216 "kill", "flush", "add", "delete", "load", "replace", "show",
217 "test", "zero", "expire", NULL
220 static const char *debugopt_list
[] = {
221 "none", "urgent", "misc", "loud", NULL
224 static const char *optiopt_list
[] = {
225 "none", "basic", "profile", NULL
231 fprintf(stderr
, "usage: %s [-AdeghmNnOqRrvz] ", getprogname());
232 fprintf(stderr
, "[-a anchor] [-D macro=value] [-F modifier]\n");
233 fprintf(stderr
, "\t[-f file] [-i interface] [-K host | network] ");
234 fprintf(stderr
, "[-k host | network | label | id]\n");
235 fprintf(stderr
, "\t[-o level] [-p device] [-s modifier]\n");
236 fprintf(stderr
, "\t[-t table -T command [address ...]] [-x level]\n");
241 pfctl_enable(int dev
, int opts
)
243 if (ioctl(dev
, DIOCSTART
)) {
245 errx(1, "pf already enabled");
249 if ((opts
& PF_OPT_QUIET
) == 0)
250 fprintf(stderr
, "pf enabled\n");
252 if (altqsupport
&& ioctl(dev
, DIOCSTARTALTQ
))
254 err(1, "DIOCSTARTALTQ");
260 pfctl_disable(int dev
, int opts
)
262 if (ioctl(dev
, DIOCSTOP
)) {
264 errx(1, "pf not enabled");
268 if ((opts
& PF_OPT_QUIET
) == 0)
269 fprintf(stderr
, "pf disabled\n");
271 if (altqsupport
&& ioctl(dev
, DIOCSTOPALTQ
))
273 err(1, "DIOCSTOPALTQ");
279 pfctl_clear_stats(int dev
, int opts
)
281 if (ioctl(dev
, DIOCCLRSTATUS
))
282 err(1, "DIOCCLRSTATUS");
283 if ((opts
& PF_OPT_QUIET
) == 0)
284 fprintf(stderr
, "pf: statistics cleared\n");
289 pfctl_clear_interface_flags(int dev
, int opts
)
291 struct pfioc_iface pi
;
293 if ((opts
& PF_OPT_NOACTION
) == 0) {
294 bzero(&pi
, sizeof(pi
));
295 pi
.pfiio_flags
= PFI_IFLAG_SKIP
;
297 if (ioctl(dev
, DIOCCLRIFFLAG
, &pi
))
298 err(1, "DIOCCLRIFFLAG");
299 if ((opts
& PF_OPT_QUIET
) == 0)
300 fprintf(stderr
, "pf: interface flags reset\n");
306 pfctl_clear_rules(int dev
, int opts
, char *anchorname
)
310 memset(&t
, 0, sizeof(t
));
311 t
.pfrb_type
= PFRB_TRANS
;
312 if (pfctl_add_trans(&t
, PF_RULESET_SCRUB
, anchorname
) ||
313 pfctl_add_trans(&t
, PF_RULESET_FILTER
, anchorname
) ||
314 pfctl_trans(dev
, &t
, DIOCXBEGIN
, 0) ||
315 pfctl_trans(dev
, &t
, DIOCXCOMMIT
, 0))
316 err(1, "pfctl_clear_rules");
317 if ((opts
& PF_OPT_QUIET
) == 0)
318 fprintf(stderr
, "rules cleared\n");
323 pfctl_clear_nat(int dev
, int opts
, char *anchorname
)
327 memset(&t
, 0, sizeof(t
));
328 t
.pfrb_type
= PFRB_TRANS
;
329 if (pfctl_add_trans(&t
, PF_RULESET_NAT
, anchorname
) ||
330 pfctl_add_trans(&t
, PF_RULESET_BINAT
, anchorname
) ||
331 pfctl_add_trans(&t
, PF_RULESET_RDR
, anchorname
) ||
332 pfctl_trans(dev
, &t
, DIOCXBEGIN
, 0) ||
333 pfctl_trans(dev
, &t
, DIOCXCOMMIT
, 0))
334 err(1, "pfctl_clear_nat");
335 if ((opts
& PF_OPT_QUIET
) == 0)
336 fprintf(stderr
, "nat cleared\n");
341 pfctl_clear_altq(int dev
, int opts
)
347 memset(&t
, 0, sizeof(t
));
348 t
.pfrb_type
= PFRB_TRANS
;
349 if (pfctl_add_trans(&t
, PF_RULESET_ALTQ
, "") ||
350 pfctl_trans(dev
, &t
, DIOCXBEGIN
, 0) ||
351 pfctl_trans(dev
, &t
, DIOCXCOMMIT
, 0))
352 err(1, "pfctl_clear_altq");
353 if ((opts
& PF_OPT_QUIET
) == 0)
354 fprintf(stderr
, "altq cleared\n");
359 pfctl_clear_src_nodes(int dev
, int opts
)
361 if (ioctl(dev
, DIOCCLRSRCNODES
))
362 err(1, "DIOCCLRSRCNODES");
363 if ((opts
& PF_OPT_QUIET
) == 0)
364 fprintf(stderr
, "source tracking entries cleared\n");
369 pfctl_clear_states(int dev
, const char *iface
, int opts
)
371 struct pfioc_state_kill psk
;
373 memset(&psk
, 0, sizeof(psk
));
374 if (iface
!= NULL
&& strlcpy(psk
.psk_ifname
, iface
,
375 sizeof(psk
.psk_ifname
)) >= sizeof(psk
.psk_ifname
))
376 errx(1, "invalid interface: %s", iface
);
378 if (ioctl(dev
, DIOCCLRSTATES
, &psk
))
379 err(1, "DIOCCLRSTATES");
380 if ((opts
& PF_OPT_QUIET
) == 0)
381 fprintf(stderr
, "%d states cleared\n", psk
.psk_killed
);
386 pfctl_addrprefix(char *addr
, struct pf_addr
*mask
)
390 int prefix
, ret_ga
, q
, r
;
391 struct addrinfo hints
, *res
;
393 if ((p
= strchr(addr
, '/')) == NULL
)
397 prefix
= strtonum(p
, 0, 128, &errstr
);
399 errx(1, "prefix is %s: %s", errstr
, p
);
401 bzero(&hints
, sizeof(hints
));
402 /* prefix only with numeric addresses */
403 hints
.ai_flags
|= AI_NUMERICHOST
;
405 if ((ret_ga
= getaddrinfo(addr
, NULL
, &hints
, &res
))) {
406 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga
));
410 if (res
->ai_family
== AF_INET
&& prefix
> 32)
411 errx(1, "prefix too long for AF_INET");
412 else if (res
->ai_family
== AF_INET6
&& prefix
> 128)
413 errx(1, "prefix too long for AF_INET6");
417 switch (res
->ai_family
) {
419 bzero(&mask
->v4
, sizeof(mask
->v4
));
420 mask
->v4
.s_addr
= htonl((u_int32_t
)
421 (0xffffffffffULL
<< (32 - prefix
)));
424 bzero(&mask
->v6
, sizeof(mask
->v6
));
426 memset((void *)&mask
->v6
, 0xff, q
);
428 *((u_char
*)&mask
->v6
+ q
) =
429 (0xff00 >> r
) & 0xff;
436 pfctl_kill_src_nodes(int dev
, const char *iface __unused
, int opts
)
438 struct pfioc_src_node_kill psnk
;
439 struct addrinfo
*res
[2], *resp
[2];
440 struct sockaddr last_src
, last_dst
;
441 int killed
, sources
, dests
;
444 killed
= sources
= dests
= 0;
446 memset(&psnk
, 0, sizeof(psnk
));
447 memset(&psnk
.psnk_src
.addr
.v
.a
.mask
, 0xff,
448 sizeof(psnk
.psnk_src
.addr
.v
.a
.mask
));
449 memset(&last_src
, 0xff, sizeof(last_src
));
450 memset(&last_dst
, 0xff, sizeof(last_dst
));
452 pfctl_addrprefix(src_node_kill
[0], &psnk
.psnk_src
.addr
.v
.a
.mask
);
454 if ((ret_ga
= getaddrinfo(src_node_kill
[0], NULL
, NULL
, &res
[0]))) {
455 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga
));
458 for (resp
[0] = res
[0]; resp
[0]; resp
[0] = resp
[0]->ai_next
) {
459 if (resp
[0]->ai_addr
== NULL
)
461 /* We get lots of duplicates. Catch the easy ones */
462 if (memcmp(&last_src
, resp
[0]->ai_addr
, sizeof(last_src
)) == 0)
464 last_src
= *(struct sockaddr
*)resp
[0]->ai_addr
;
466 psnk
.psnk_af
= resp
[0]->ai_family
;
469 if (psnk
.psnk_af
== AF_INET
)
470 psnk
.psnk_src
.addr
.v
.a
.addr
.v4
=
471 ((struct sockaddr_in
*)resp
[0]->ai_addr
)->sin_addr
;
472 else if (psnk
.psnk_af
== AF_INET6
)
473 psnk
.psnk_src
.addr
.v
.a
.addr
.v6
=
474 ((struct sockaddr_in6
*)resp
[0]->ai_addr
)->
477 errx(1, "Unknown address family %d", psnk
.psnk_af
);
479 if (src_node_killers
> 1) {
481 memset(&psnk
.psnk_dst
.addr
.v
.a
.mask
, 0xff,
482 sizeof(psnk
.psnk_dst
.addr
.v
.a
.mask
));
483 memset(&last_dst
, 0xff, sizeof(last_dst
));
484 pfctl_addrprefix(src_node_kill
[1],
485 &psnk
.psnk_dst
.addr
.v
.a
.mask
);
486 if ((ret_ga
= getaddrinfo(src_node_kill
[1], NULL
, NULL
,
488 errx(1, "getaddrinfo: %s",
489 gai_strerror(ret_ga
));
492 for (resp
[1] = res
[1]; resp
[1];
493 resp
[1] = resp
[1]->ai_next
) {
494 if (resp
[1]->ai_addr
== NULL
)
496 if (psnk
.psnk_af
!= resp
[1]->ai_family
)
499 if (memcmp(&last_dst
, resp
[1]->ai_addr
,
500 sizeof(last_dst
)) == 0)
502 last_dst
= *(struct sockaddr
*)resp
[1]->ai_addr
;
506 if (psnk
.psnk_af
== AF_INET
)
507 psnk
.psnk_dst
.addr
.v
.a
.addr
.v4
=
508 ((struct sockaddr_in
*)resp
[1]->
510 else if (psnk
.psnk_af
== AF_INET6
)
511 psnk
.psnk_dst
.addr
.v
.a
.addr
.v6
=
512 ((struct sockaddr_in6
*)resp
[1]->
515 errx(1, "Unknown address family %d",
518 if (ioctl(dev
, DIOCKILLSRCNODES
, &psnk
))
519 err(1, "DIOCKILLSRCNODES");
520 killed
+= psnk
.psnk_killed
;
522 freeaddrinfo(res
[1]);
524 if (ioctl(dev
, DIOCKILLSRCNODES
, &psnk
))
525 err(1, "DIOCKILLSRCNODES");
526 killed
+= psnk
.psnk_killed
;
530 freeaddrinfo(res
[0]);
532 if ((opts
& PF_OPT_QUIET
) == 0)
533 fprintf(stderr
, "killed %d src nodes from %d sources and %d "
534 "destinations\n", killed
, sources
, dests
);
539 pfctl_net_kill_states(int dev
, const char *iface
, int opts
)
541 struct pfioc_state_kill psk
;
542 struct addrinfo
*res
[2], *resp
[2];
543 struct sockaddr last_src
, last_dst
;
544 int killed
, sources
, dests
;
547 killed
= sources
= dests
= 0;
549 memset(&psk
, 0, sizeof(psk
));
550 memset(&psk
.psk_src
.addr
.v
.a
.mask
, 0xff,
551 sizeof(psk
.psk_src
.addr
.v
.a
.mask
));
552 memset(&last_src
, 0xff, sizeof(last_src
));
553 memset(&last_dst
, 0xff, sizeof(last_dst
));
554 if (iface
!= NULL
&& strlcpy(psk
.psk_ifname
, iface
,
555 sizeof(psk
.psk_ifname
)) >= sizeof(psk
.psk_ifname
))
556 errx(1, "invalid interface: %s", iface
);
558 pfctl_addrprefix(state_kill
[0], &psk
.psk_src
.addr
.v
.a
.mask
);
560 if ((ret_ga
= getaddrinfo(state_kill
[0], NULL
, NULL
, &res
[0]))) {
561 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga
));
564 for (resp
[0] = res
[0]; resp
[0]; resp
[0] = resp
[0]->ai_next
) {
565 if (resp
[0]->ai_addr
== NULL
)
567 /* We get lots of duplicates. Catch the easy ones */
568 if (memcmp(&last_src
, resp
[0]->ai_addr
, sizeof(last_src
)) == 0)
570 last_src
= *(struct sockaddr
*)resp
[0]->ai_addr
;
572 psk
.psk_af
= resp
[0]->ai_family
;
575 if (psk
.psk_af
== AF_INET
)
576 psk
.psk_src
.addr
.v
.a
.addr
.v4
=
577 ((struct sockaddr_in
*)resp
[0]->ai_addr
)->sin_addr
;
578 else if (psk
.psk_af
== AF_INET6
)
579 psk
.psk_src
.addr
.v
.a
.addr
.v6
=
580 ((struct sockaddr_in6
*)resp
[0]->ai_addr
)->
583 errx(1, "Unknown address family %d", psk
.psk_af
);
585 if (state_killers
> 1) {
587 memset(&psk
.psk_dst
.addr
.v
.a
.mask
, 0xff,
588 sizeof(psk
.psk_dst
.addr
.v
.a
.mask
));
589 memset(&last_dst
, 0xff, sizeof(last_dst
));
590 pfctl_addrprefix(state_kill
[1],
591 &psk
.psk_dst
.addr
.v
.a
.mask
);
592 if ((ret_ga
= getaddrinfo(state_kill
[1], NULL
, NULL
,
594 errx(1, "getaddrinfo: %s",
595 gai_strerror(ret_ga
));
598 for (resp
[1] = res
[1]; resp
[1];
599 resp
[1] = resp
[1]->ai_next
) {
600 if (resp
[1]->ai_addr
== NULL
)
602 if (psk
.psk_af
!= resp
[1]->ai_family
)
605 if (memcmp(&last_dst
, resp
[1]->ai_addr
,
606 sizeof(last_dst
)) == 0)
608 last_dst
= *(struct sockaddr
*)resp
[1]->ai_addr
;
612 if (psk
.psk_af
== AF_INET
)
613 psk
.psk_dst
.addr
.v
.a
.addr
.v4
=
614 ((struct sockaddr_in
*)resp
[1]->
616 else if (psk
.psk_af
== AF_INET6
)
617 psk
.psk_dst
.addr
.v
.a
.addr
.v6
=
618 ((struct sockaddr_in6
*)resp
[1]->
621 errx(1, "Unknown address family %d",
624 if (ioctl(dev
, DIOCKILLSTATES
, &psk
))
625 err(1, "DIOCKILLSTATES");
626 killed
+= psk
.psk_killed
;
628 freeaddrinfo(res
[1]);
630 if (ioctl(dev
, DIOCKILLSTATES
, &psk
))
631 err(1, "DIOCKILLSTATES");
632 killed
+= psk
.psk_killed
;
636 freeaddrinfo(res
[0]);
638 if ((opts
& PF_OPT_QUIET
) == 0)
639 fprintf(stderr
, "killed %d states from %d sources and %d "
640 "destinations\n", killed
, sources
, dests
);
645 pfctl_label_kill_states(int dev
, const char *iface
, int opts
)
647 struct pfioc_state_kill psk
;
649 if (state_killers
!= 2 || (strlen(state_kill
[1]) == 0)) {
650 warnx("no label specified");
653 memset(&psk
, 0, sizeof(psk
));
654 if (iface
!= NULL
&& strlcpy(psk
.psk_ifname
, iface
,
655 sizeof(psk
.psk_ifname
)) >= sizeof(psk
.psk_ifname
))
656 errx(1, "invalid interface: %s", iface
);
658 if (strlcpy(psk
.psk_label
, state_kill
[1], sizeof(psk
.psk_label
)) >=
659 sizeof(psk
.psk_label
))
660 errx(1, "label too long: %s", state_kill
[1]);
662 if (ioctl(dev
, DIOCKILLSTATES
, &psk
))
663 err(1, "DIOCKILLSTATES");
665 if ((opts
& PF_OPT_QUIET
) == 0)
666 fprintf(stderr
, "killed %d states\n", psk
.psk_killed
);
672 pfctl_id_kill_states(int dev
, const char *iface
, int opts
)
674 struct pfioc_state_kill psk
;
676 if (state_killers
!= 2 || (strlen(state_kill
[1]) == 0)) {
677 warnx("no id specified");
681 memset(&psk
, 0, sizeof(psk
));
682 if ((sscanf(state_kill
[1], "%" SCNx64
"/%x",
683 &psk
.psk_pfcmp
.id
, &psk
.psk_pfcmp
.creatorid
)) == 2)
684 psk
.psk_pfcmp
.creatorid
=htonl(psk
.psk_pfcmp
.creatorid
);
685 else if ((sscanf(state_kill
[1], "%" SCNx64
, &psk
.psk_pfcmp
.id
)) == 1) {
686 psk
.psk_pfcmp
.creatorid
= 0;
688 warnx("wrong id format specified");
691 if (psk
.psk_pfcmp
.id
== 0) {
692 warnx("cannot kill id 0");
696 psk
.psk_pfcmp
.id
= htobe64(psk
.psk_pfcmp
.id
);
697 if (ioctl(dev
, DIOCKILLSTATES
, &psk
))
698 err(1, "DIOCKILLSTATES");
700 if ((opts
& PF_OPT_QUIET
) == 0)
701 fprintf(stderr
, "killed %d states\n", psk
.psk_killed
);
707 pfctl_get_pool(int dev
, struct pf_pool
*pool
, u_int32_t nr
,
708 u_int32_t ticket
, int r_action
, char *anchorname
)
710 struct pfioc_pooladdr pp
;
711 struct pf_pooladdr
*pa
;
714 memset(&pp
, 0, sizeof(pp
));
715 memcpy(pp
.anchor
, anchorname
, sizeof(pp
.anchor
));
716 pp
.r_action
= r_action
;
719 if (ioctl(dev
, DIOCGETADDRS
, &pp
)) {
720 warn("DIOCGETADDRS");
724 TAILQ_INIT(&pool
->list
);
725 for (pnr
= 0; pnr
< mpnr
; ++pnr
) {
727 if (ioctl(dev
, DIOCGETADDR
, &pp
)) {
731 pa
= calloc(1, sizeof(struct pf_pooladdr
));
734 bcopy(&pp
.addr
, pa
, sizeof(struct pf_pooladdr
));
735 TAILQ_INSERT_TAIL(&pool
->list
, pa
, entries
);
742 pfctl_move_pool(struct pf_pool
*src
, struct pf_pool
*dst
)
744 struct pf_pooladdr
*pa
;
746 while ((pa
= TAILQ_FIRST(&src
->list
)) != NULL
) {
747 TAILQ_REMOVE(&src
->list
, pa
, entries
);
748 TAILQ_INSERT_TAIL(&dst
->list
, pa
, entries
);
753 pfctl_clear_pool(struct pf_pool
*pool
)
755 struct pf_pooladdr
*pa
;
757 while ((pa
= TAILQ_FIRST(&pool
->list
)) != NULL
) {
758 TAILQ_REMOVE(&pool
->list
, pa
, entries
);
764 pfctl_print_rule_counters(struct pf_rule
*rule
, int opts
)
766 if (opts
& PF_OPT_DEBUG
) {
767 const char *t
[PF_SKIP_COUNT
] = { "i", "d", "f",
768 "p", "sa", "sp", "da", "dp" };
771 printf(" [ Skip steps: ");
772 for (i
= 0; i
< PF_SKIP_COUNT
; ++i
) {
773 if (rule
->skip
[i
].nr
== rule
->nr
+ 1)
776 if (rule
->skip
[i
].nr
== (uint32_t)(-1))
779 printf("%u ", rule
->skip
[i
].nr
);
783 printf(" [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
784 rule
->qname
, rule
->qid
, rule
->pqname
, rule
->pqid
);
786 if (opts
& PF_OPT_VERBOSE
) {
787 printf(" [ Evaluations: %-8llu Packets: %-8llu "
788 "Bytes: %-10llu States: %-6u]\n",
789 (unsigned long long)rule
->evaluations
,
790 (unsigned long long)(rule
->packets
[0] +
792 (unsigned long long)(rule
->bytes
[0] +
793 rule
->bytes
[1]), rule
->states_cur
);
794 if (!(opts
& PF_OPT_DEBUG
))
795 printf(" [ Inserted: uid %u pid %u "
796 "State Creations: %-6u]\n",
797 (unsigned)rule
->cuid
, (unsigned)rule
->cpid
,
803 pfctl_print_title(const char *title
)
808 printf("%s\n", title
);
812 pfctl_show_rules(int dev
, char *path
, int opts
, enum pfctl_show format
,
813 char *anchorname
, int depth
)
815 struct pfioc_rule pr
;
816 u_int32_t nr
, mnr
, header
= 0;
817 int rule_numbers
= opts
& (PF_OPT_VERBOSE2
| PF_OPT_DEBUG
);
818 int len
= strlen(path
);
823 snprintf(&path
[len
], MAXPATHLEN
- len
, "/%s", anchorname
);
825 snprintf(&path
[len
], MAXPATHLEN
- len
, "%s", anchorname
);
827 memset(&pr
, 0, sizeof(pr
));
828 memcpy(pr
.anchor
, path
, sizeof(pr
.anchor
));
829 if (opts
& PF_OPT_SHOWALL
) {
830 pr
.rule
.action
= PF_PASS
;
831 if (ioctl(dev
, DIOCGETRULES
, &pr
)) {
832 warn("DIOCGETRULES");
837 pr
.rule
.action
= PF_SCRUB
;
838 if (ioctl(dev
, DIOCGETRULES
, &pr
)) {
839 warn("DIOCGETRULES");
842 if (opts
& PF_OPT_SHOWALL
) {
843 if (format
== PFCTL_SHOW_RULES
&& (pr
.nr
> 0 || header
))
844 pfctl_print_title("FILTER RULES:");
845 else if (format
== PFCTL_SHOW_LABELS
&& labels
)
846 pfctl_print_title("LABEL COUNTERS:");
849 if (opts
& PF_OPT_CLRRULECTRS
)
850 pr
.action
= PF_GET_CLR_CNTR
;
852 for (nr
= 0; nr
< mnr
; ++nr
) {
854 if (ioctl(dev
, DIOCGETRULE
, &pr
)) {
859 if (pfctl_get_pool(dev
, &pr
.rule
.rpool
,
860 nr
, pr
.ticket
, PF_SCRUB
, path
) != 0)
864 case PFCTL_SHOW_LABELS
:
866 case PFCTL_SHOW_RULES
:
867 if (pr
.rule
.label
[0] && (opts
& PF_OPT_SHOWALL
))
869 print_rule(&pr
.rule
, pr
.anchor_call
, rule_numbers
);
871 pfctl_print_rule_counters(&pr
.rule
, opts
);
873 case PFCTL_SHOW_NOTHING
:
876 pfctl_clear_pool(&pr
.rule
.rpool
);
878 pr
.rule
.action
= PF_PASS
;
879 if (ioctl(dev
, DIOCGETRULES
, &pr
)) {
880 warn("DIOCGETRULES");
884 for (nr
= 0; nr
< mnr
; ++nr
) {
886 if (ioctl(dev
, DIOCGETRULE
, &pr
)) {
891 if (pfctl_get_pool(dev
, &pr
.rule
.rpool
,
892 nr
, pr
.ticket
, PF_PASS
, path
) != 0)
896 case PFCTL_SHOW_LABELS
:
897 if (pr
.rule
.label
[0]) {
898 printf("%s %llu %llu %llu %llu"
899 " %llu %llu %llu %llu\n",
901 (unsigned long long)pr
.rule
.evaluations
,
902 (unsigned long long)(pr
.rule
.packets
[0] +
904 (unsigned long long)(pr
.rule
.bytes
[0] +
906 (unsigned long long)pr
.rule
.packets
[0],
907 (unsigned long long)pr
.rule
.bytes
[0],
908 (unsigned long long)pr
.rule
.packets
[1],
909 (unsigned long long)pr
.rule
.bytes
[1],
910 (unsigned long long)pr
.rule
.states_tot
);
913 case PFCTL_SHOW_RULES
:
915 if (pr
.rule
.label
[0] && (opts
& PF_OPT_SHOWALL
))
917 INDENT(depth
, !(opts
& PF_OPT_VERBOSE
));
918 if (pr
.anchor_call
[0] &&
919 ((((p
= strrchr(pr
.anchor_call
, '_')) != NULL
) &&
920 ((void *)p
== (void *)pr
.anchor_call
||
921 *(--p
) == '/')) || (opts
& PF_OPT_RECURSE
))) {
923 if ((p
= strrchr(pr
.anchor_call
, '/')) !=
927 p
= &pr
.anchor_call
[0];
929 p
= &pr
.anchor_call
[0];
931 print_rule(&pr
.rule
, p
, rule_numbers
);
936 pfctl_print_rule_counters(&pr
.rule
, opts
);
938 pfctl_show_rules(dev
, path
, opts
, format
,
940 INDENT(depth
, !(opts
& PF_OPT_VERBOSE
));
944 case PFCTL_SHOW_NOTHING
:
947 pfctl_clear_pool(&pr
.rule
.rpool
);
958 pfctl_show_nat(int dev
, int opts
, char *anchorname
)
960 struct pfioc_rule pr
;
962 static int nattype
[3] = { PF_NAT
, PF_RDR
, PF_BINAT
};
963 int i
, dotitle
= opts
& PF_OPT_SHOWALL
;
965 memset(&pr
, 0, sizeof(pr
));
966 memcpy(pr
.anchor
, anchorname
, sizeof(pr
.anchor
));
967 for (i
= 0; i
< 3; i
++) {
968 pr
.rule
.action
= nattype
[i
];
969 if (ioctl(dev
, DIOCGETRULES
, &pr
)) {
970 warn("DIOCGETRULES");
974 for (nr
= 0; nr
< mnr
; ++nr
) {
976 if (ioctl(dev
, DIOCGETRULE
, &pr
)) {
980 if (pfctl_get_pool(dev
, &pr
.rule
.rpool
, nr
,
981 pr
.ticket
, nattype
[i
], anchorname
) != 0)
984 pfctl_print_title("TRANSLATION RULES:");
987 print_rule(&pr
.rule
, pr
.anchor_call
,
988 opts
& PF_OPT_VERBOSE2
);
990 pfctl_print_rule_counters(&pr
.rule
, opts
);
991 pfctl_clear_pool(&pr
.rule
.rpool
);
998 pfctl_show_src_nodes(int dev
, int opts
)
1000 struct pfioc_src_nodes psn
;
1001 struct pf_src_node
*p
;
1002 char *inbuf
= NULL
, *newinbuf
= NULL
;
1003 unsigned int len
= 0;
1006 memset(&psn
, 0, sizeof(psn
));
1010 newinbuf
= realloc(inbuf
, len
);
1011 if (newinbuf
== NULL
)
1013 psn
.psn_buf
= inbuf
= newinbuf
;
1015 if (ioctl(dev
, DIOCGETSRCNODES
, &psn
) < 0) {
1016 warn("DIOCGETSRCNODES");
1020 if (psn
.psn_len
+ sizeof(struct pfioc_src_nodes
) < len
)
1022 if (len
== 0 && psn
.psn_len
== 0)
1024 if (len
== 0 && psn
.psn_len
!= 0)
1026 if (psn
.psn_len
== 0)
1027 goto done
; /* no src_nodes */
1030 p
= psn
.psn_src_nodes
;
1031 if (psn
.psn_len
> 0 && (opts
& PF_OPT_SHOWALL
))
1032 pfctl_print_title("SOURCE TRACKING NODES:");
1033 for (i
= 0; i
< psn
.psn_len
; i
+= sizeof(*p
)) {
1034 print_src_node(p
, opts
);
1043 pfctl_show_states(int dev
, const char *iface
, int opts
)
1045 struct pfioc_states ps
;
1046 struct pfsync_state
*p
;
1047 char *inbuf
= NULL
, *newinbuf
= NULL
;
1048 unsigned int len
= 0;
1049 int i
, dotitle
= (opts
& PF_OPT_SHOWALL
);
1051 memset(&ps
, 0, sizeof(ps
));
1055 newinbuf
= realloc(inbuf
, len
);
1056 if (newinbuf
== NULL
)
1058 ps
.ps_buf
= inbuf
= newinbuf
;
1060 if (ioctl(dev
, DIOCGETSTATES
, &ps
) < 0) {
1061 warn("DIOCGETSTATES");
1065 if (ps
.ps_len
+ sizeof(struct pfioc_states
) < len
)
1067 if (len
== 0 && ps
.ps_len
== 0)
1069 if (len
== 0 && ps
.ps_len
!= 0)
1072 goto done
; /* no states */
1076 for (i
= 0; i
< ps
.ps_len
; i
+= sizeof(*p
), p
++) {
1077 if (iface
!= NULL
&& strcmp(p
->ifname
, iface
))
1080 pfctl_print_title("STATES:");
1083 print_state(p
, opts
);
1091 pfctl_show_status(int dev
, int opts
)
1093 struct pf_status status
;
1095 if (ioctl(dev
, DIOCGETSTATUS
, &status
)) {
1096 warn("DIOCGETSTATUS");
1099 if (opts
& PF_OPT_SHOWALL
)
1100 pfctl_print_title("INFO:");
1101 print_status(&status
, opts
);
1106 pfctl_show_timeouts(int dev
, int opts
)
1111 if (opts
& PF_OPT_SHOWALL
)
1112 pfctl_print_title("TIMEOUTS:");
1113 memset(&pt
, 0, sizeof(pt
));
1114 for (i
= 0; pf_timeouts
[i
].name
; i
++) {
1115 pt
.timeout
= pf_timeouts
[i
].timeout
;
1116 if (ioctl(dev
, DIOCGETTIMEOUT
, &pt
))
1117 err(1, "DIOCGETTIMEOUT");
1118 printf("%-20s %10d", pf_timeouts
[i
].name
, pt
.seconds
);
1119 if (pf_timeouts
[i
].timeout
>= PFTM_ADAPTIVE_START
&&
1120 pf_timeouts
[i
].timeout
<= PFTM_ADAPTIVE_END
)
1131 pfctl_show_limits(int dev
, int opts
)
1133 struct pfioc_limit pl
;
1136 if (opts
& PF_OPT_SHOWALL
)
1137 pfctl_print_title("LIMITS:");
1138 memset(&pl
, 0, sizeof(pl
));
1139 for (i
= 0; pf_limits
[i
].name
; i
++) {
1140 pl
.index
= pf_limits
[i
].index
;
1141 if (ioctl(dev
, DIOCGETLIMIT
, &pl
))
1142 err(1, "DIOCGETLIMIT");
1143 printf("%-13s ", pf_limits
[i
].name
);
1144 if (pl
.limit
== UINT_MAX
)
1145 printf("unlimited\n");
1147 printf("hard limit %8u\n", pl
.limit
);
1152 /* callbacks for rule/nat/rdr/addr */
1154 pfctl_add_pool(struct pfctl
*pf
, struct pf_pool
*p
, sa_family_t af
)
1156 struct pf_pooladdr
*pa
;
1158 if ((pf
->opts
& PF_OPT_NOACTION
) == 0) {
1159 if (ioctl(pf
->dev
, DIOCBEGINADDRS
, &pf
->paddr
))
1160 err(1, "DIOCBEGINADDRS");
1164 TAILQ_FOREACH(pa
, &p
->list
, entries
) {
1165 memcpy(&pf
->paddr
.addr
, pa
, sizeof(struct pf_pooladdr
));
1166 if ((pf
->opts
& PF_OPT_NOACTION
) == 0) {
1167 if (ioctl(pf
->dev
, DIOCADDADDR
, &pf
->paddr
))
1168 err(1, "DIOCADDADDR");
1175 pfctl_add_rule(struct pfctl
*pf
, struct pf_rule
*r
, const char *anchor_call
)
1178 struct pf_rule
*rule
;
1179 struct pf_ruleset
*rs
;
1182 rs_num
= pf_get_ruleset_number(r
->action
);
1183 if (rs_num
== PF_RULESET_MAX
)
1184 errx(1, "Invalid rule type %d", r
->action
);
1186 rs
= &pf
->anchor
->ruleset
;
1188 if (anchor_call
[0] && r
->anchor
== NULL
) {
1190 * Don't make non-brace anchors part of the main anchor pool.
1192 if ((r
->anchor
= calloc(1, sizeof(*r
->anchor
))) == NULL
)
1193 err(1, "pfctl_add_rule: calloc");
1195 pf_init_ruleset(&r
->anchor
->ruleset
);
1196 r
->anchor
->ruleset
.anchor
= r
->anchor
;
1197 if (strlcpy(r
->anchor
->path
, anchor_call
,
1198 sizeof(rule
->anchor
->path
)) >= sizeof(rule
->anchor
->path
))
1199 errx(1, "pfctl_add_rule: strlcpy");
1200 if ((p
= strrchr(anchor_call
, '/')) != NULL
) {
1202 err(1, "pfctl_add_rule: bad anchor name %s",
1205 p
= __DECONST(char *, anchor_call
);
1206 if (strlcpy(r
->anchor
->name
, p
,
1207 sizeof(rule
->anchor
->name
)) >= sizeof(rule
->anchor
->name
))
1208 errx(1, "pfctl_add_rule: strlcpy");
1211 if ((rule
= calloc(1, sizeof(*rule
))) == NULL
)
1213 bcopy(r
, rule
, sizeof(*rule
));
1214 TAILQ_INIT(&rule
->rpool
.list
);
1215 pfctl_move_pool(&r
->rpool
, &rule
->rpool
);
1217 TAILQ_INSERT_TAIL(rs
->rules
[rs_num
].active
.ptr
, rule
, entries
);
1222 pfctl_ruleset_trans(struct pfctl
*pf
, char *path
, struct pf_anchor
*a
)
1224 int osize
= pf
->trans
->pfrb_size
;
1226 if ((pf
->loadopt
& PFCTL_FLAG_NAT
) != 0) {
1227 if (pfctl_add_trans(pf
->trans
, PF_RULESET_NAT
, path
) ||
1228 pfctl_add_trans(pf
->trans
, PF_RULESET_BINAT
, path
) ||
1229 pfctl_add_trans(pf
->trans
, PF_RULESET_RDR
, path
))
1232 if (a
== pf
->astack
[0] && ((altqsupport
&&
1233 (pf
->loadopt
& PFCTL_FLAG_ALTQ
) != 0))) {
1234 if (pfctl_add_trans(pf
->trans
, PF_RULESET_ALTQ
, path
))
1237 if ((pf
->loadopt
& PFCTL_FLAG_FILTER
) != 0) {
1238 if (pfctl_add_trans(pf
->trans
, PF_RULESET_SCRUB
, path
) ||
1239 pfctl_add_trans(pf
->trans
, PF_RULESET_FILTER
, path
))
1242 if (pf
->loadopt
& PFCTL_FLAG_TABLE
)
1243 if (pfctl_add_trans(pf
->trans
, PF_RULESET_TABLE
, path
))
1245 if (pfctl_trans(pf
->dev
, pf
->trans
, DIOCXBEGIN
, osize
))
1252 pfctl_load_ruleset(struct pfctl
*pf
, char *path
, struct pf_ruleset
*rs
,
1253 int rs_num
, int depth
)
1256 int error
, len
= strlen(path
);
1259 pf
->anchor
= rs
->anchor
;
1262 snprintf(&path
[len
], MAXPATHLEN
- len
, "/%s", pf
->anchor
->name
);
1264 snprintf(&path
[len
], MAXPATHLEN
- len
, "%s", pf
->anchor
->name
);
1267 if (TAILQ_FIRST(rs
->rules
[rs_num
].active
.ptr
) != NULL
) {
1269 if (pf
->opts
& PF_OPT_VERBOSE
)
1271 if ((pf
->opts
& PF_OPT_NOACTION
) == 0 &&
1272 (error
= pfctl_ruleset_trans(pf
,
1273 path
, rs
->anchor
))) {
1274 printf("pfctl_load_rulesets: "
1275 "pfctl_ruleset_trans %d\n", error
);
1278 } else if (pf
->opts
& PF_OPT_VERBOSE
)
1283 if (pf
->optimize
&& rs_num
== PF_RULESET_FILTER
)
1284 pfctl_optimize_ruleset(pf
, rs
);
1286 while ((r
= TAILQ_FIRST(rs
->rules
[rs_num
].active
.ptr
)) != NULL
) {
1287 TAILQ_REMOVE(rs
->rules
[rs_num
].active
.ptr
, r
, entries
);
1288 if ((error
= pfctl_load_rule(pf
, path
, r
, depth
)))
1291 if ((error
= pfctl_load_ruleset(pf
, path
,
1292 &r
->anchor
->ruleset
, rs_num
, depth
+ 1)))
1294 } else if (pf
->opts
& PF_OPT_VERBOSE
)
1298 if (brace
&& pf
->opts
& PF_OPT_VERBOSE
) {
1299 INDENT(depth
- 1, (pf
->opts
& PF_OPT_VERBOSE
));
1312 pfctl_load_rule(struct pfctl
*pf
, char *path
, struct pf_rule
*r
, int depth
)
1314 u_int8_t rs_num
= pf_get_ruleset_number(r
->action
);
1316 struct pfioc_rule pr
;
1317 int len
= strlen(path
);
1319 bzero(&pr
, sizeof(pr
));
1320 /* set up anchor before adding to path for anchor_call */
1321 if ((pf
->opts
& PF_OPT_NOACTION
) == 0)
1322 pr
.ticket
= pfctl_get_ticket(pf
->trans
, rs_num
, path
);
1323 if (strlcpy(pr
.anchor
, path
, sizeof(pr
.anchor
)) >= sizeof(pr
.anchor
))
1324 errx(1, "pfctl_load_rule: strlcpy");
1327 if (r
->anchor
->match
) {
1329 snprintf(&path
[len
], MAXPATHLEN
- len
,
1330 "/%s", r
->anchor
->name
);
1332 snprintf(&path
[len
], MAXPATHLEN
- len
,
1333 "%s", r
->anchor
->name
);
1336 name
= r
->anchor
->path
;
1338 name
= __DECONST(char *, "");
1340 if ((pf
->opts
& PF_OPT_NOACTION
) == 0) {
1341 if (pfctl_add_pool(pf
, &r
->rpool
, r
->af
))
1343 pr
.pool_ticket
= pf
->paddr
.ticket
;
1344 memcpy(&pr
.rule
, r
, sizeof(pr
.rule
));
1345 if (r
->anchor
&& strlcpy(pr
.anchor_call
, name
,
1346 sizeof(pr
.anchor_call
)) >= sizeof(pr
.anchor_call
))
1347 errx(1, "pfctl_load_rule: strlcpy");
1348 if (ioctl(pf
->dev
, DIOCADDRULE
, &pr
))
1349 err(1, "DIOCADDRULE");
1352 if (pf
->opts
& PF_OPT_VERBOSE
) {
1353 INDENT(depth
, !(pf
->opts
& PF_OPT_VERBOSE2
));
1354 print_rule(r
, r
->anchor
? r
->anchor
->name
: "",
1355 pf
->opts
& PF_OPT_VERBOSE2
);
1358 pfctl_clear_pool(&r
->rpool
);
1363 pfctl_add_altq(struct pfctl
*pf
, struct pf_altq
*a
)
1366 (loadopt
& PFCTL_FLAG_ALTQ
) != 0) {
1367 memcpy(&pf
->paltq
->altq
, a
, sizeof(struct pf_altq
));
1368 if ((pf
->opts
& PF_OPT_NOACTION
) == 0) {
1369 if (ioctl(pf
->dev
, DIOCADDALTQ
, pf
->paltq
)) {
1371 errx(1, "qtype not configured");
1372 else if (errno
== ENODEV
)
1373 errx(1, "%s: driver does not support "
1376 err(1, "DIOCADDALTQ");
1379 pfaltq_store(&pf
->paltq
->altq
);
1385 pfctl_rules(int dev
, char *filename
, int opts
, int optimize
,
1386 char *anchorname
, struct pfr_buffer
*trans
)
1388 #define ERR(x) do { warn(x); goto _error; } while(0)
1389 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1391 struct pfr_buffer
*t
, buf
;
1392 struct pfioc_altq pa
;
1394 struct pf_ruleset
*rs
;
1395 struct pfr_table trs
;
1399 RB_INIT(&pf_anchors
);
1400 memset(&pf_main_anchor
, 0, sizeof(pf_main_anchor
));
1401 pf_init_ruleset(&pf_main_anchor
.ruleset
);
1402 pf_main_anchor
.ruleset
.anchor
= &pf_main_anchor
;
1403 if (trans
== NULL
) {
1404 bzero(&buf
, sizeof(buf
));
1405 buf
.pfrb_type
= PFRB_TRANS
;
1410 osize
= t
->pfrb_size
;
1413 memset(&pa
, 0, sizeof(pa
));
1414 memset(&pf
, 0, sizeof(pf
));
1415 memset(&trs
, 0, sizeof(trs
));
1416 if ((path
= calloc(1, MAXPATHLEN
)) == NULL
)
1417 ERRX("pfctl_rules: calloc");
1418 if (strlcpy(trs
.pfrt_anchor
, anchorname
,
1419 sizeof(trs
.pfrt_anchor
)) >= sizeof(trs
.pfrt_anchor
))
1420 ERRX("pfctl_rules: strlcpy");
1423 pf
.optimize
= optimize
;
1424 pf
.loadopt
= loadopt
;
1426 /* non-brace anchor, create without resolving the path */
1427 if ((pf
.anchor
= calloc(1, sizeof(*pf
.anchor
))) == NULL
)
1428 ERRX("pfctl_rules: calloc");
1429 rs
= &pf
.anchor
->ruleset
;
1430 pf_init_ruleset(rs
);
1431 rs
->anchor
= pf
.anchor
;
1432 if (strlcpy(pf
.anchor
->path
, anchorname
,
1433 sizeof(pf
.anchor
->path
)) >= sizeof(pf
.anchor
->path
))
1434 errx(1, "pfctl_add_rule: strlcpy");
1435 if (strlcpy(pf
.anchor
->name
, anchorname
,
1436 sizeof(pf
.anchor
->name
)) >= sizeof(pf
.anchor
->name
))
1437 errx(1, "pfctl_add_rule: strlcpy");
1440 pf
.astack
[0] = pf
.anchor
;
1443 pf
.loadopt
&= ~PFCTL_FLAG_ALTQ
;
1446 pfctl_init_options(&pf
);
1448 if ((opts
& PF_OPT_NOACTION
) == 0) {
1450 * XXX For the time being we need to open transactions for
1451 * the main ruleset before parsing, because tables are still
1452 * loaded at parse time.
1454 if (pfctl_ruleset_trans(&pf
, anchorname
, pf
.anchor
))
1455 ERRX("pfctl_rules");
1456 if (altqsupport
&& (pf
.loadopt
& PFCTL_FLAG_ALTQ
))
1458 pfctl_get_ticket(t
, PF_RULESET_ALTQ
, anchorname
);
1459 if (pf
.loadopt
& PFCTL_FLAG_TABLE
)
1460 pf
.astack
[0]->ruleset
.tticket
=
1461 pfctl_get_ticket(t
, PF_RULESET_TABLE
, anchorname
);
1464 if (parse_config(filename
, &pf
) < 0) {
1465 if ((opts
& PF_OPT_NOACTION
) == 0)
1466 ERRX("Syntax error in config file: "
1467 "pf rules not loaded");
1472 if ((pf
.loadopt
& PFCTL_FLAG_FILTER
&&
1473 (pfctl_load_ruleset(&pf
, path
, rs
, PF_RULESET_SCRUB
, 0))) ||
1474 (pf
.loadopt
& PFCTL_FLAG_NAT
&&
1475 (pfctl_load_ruleset(&pf
, path
, rs
, PF_RULESET_NAT
, 0) ||
1476 pfctl_load_ruleset(&pf
, path
, rs
, PF_RULESET_RDR
, 0) ||
1477 pfctl_load_ruleset(&pf
, path
, rs
, PF_RULESET_BINAT
, 0))) ||
1478 (pf
.loadopt
& PFCTL_FLAG_FILTER
&&
1479 pfctl_load_ruleset(&pf
, path
, rs
, PF_RULESET_FILTER
, 0))) {
1480 if ((opts
& PF_OPT_NOACTION
) == 0)
1481 ERRX("Unable to load rules into kernel");
1486 if ((altqsupport
&& (pf
.loadopt
& PFCTL_FLAG_ALTQ
) != 0))
1487 if (check_commit_altq(dev
, opts
) != 0)
1488 ERRX("errors in altq config");
1490 /* process "load anchor" directives */
1492 if (pfctl_load_anchors(dev
, &pf
, t
) == -1)
1493 ERRX("load anchors");
1495 if (trans
== NULL
&& (opts
& PF_OPT_NOACTION
) == 0) {
1497 if (pfctl_load_options(&pf
))
1499 if (pfctl_trans(dev
, t
, DIOCXCOMMIT
, osize
))
1505 if (trans
== NULL
) { /* main ruleset */
1506 if ((opts
& PF_OPT_NOACTION
) == 0)
1507 if (pfctl_trans(dev
, t
, DIOCXROLLBACK
, osize
))
1508 err(1, "DIOCXROLLBACK");
1510 } else { /* sub ruleset */
1519 pfctl_fopen(const char *name
, const char *mode
)
1524 fp
= fopen(name
, mode
);
1527 if (fstat(fileno(fp
), &st
)) {
1531 if (S_ISDIR(st
.st_mode
)) {
1540 pfctl_init_options(struct pfctl
*pf
)
1546 pf
->timeout
[PFTM_TCP_FIRST_PACKET
] = PFTM_TCP_FIRST_PACKET_VAL
;
1547 pf
->timeout
[PFTM_TCP_OPENING
] = PFTM_TCP_OPENING_VAL
;
1548 pf
->timeout
[PFTM_TCP_ESTABLISHED
] = PFTM_TCP_ESTABLISHED_VAL
;
1549 pf
->timeout
[PFTM_TCP_CLOSING
] = PFTM_TCP_CLOSING_VAL
;
1550 pf
->timeout
[PFTM_TCP_FIN_WAIT
] = PFTM_TCP_FIN_WAIT_VAL
;
1551 pf
->timeout
[PFTM_TCP_CLOSED
] = PFTM_TCP_CLOSED_VAL
;
1552 pf
->timeout
[PFTM_UDP_FIRST_PACKET
] = PFTM_UDP_FIRST_PACKET_VAL
;
1553 pf
->timeout
[PFTM_UDP_SINGLE
] = PFTM_UDP_SINGLE_VAL
;
1554 pf
->timeout
[PFTM_UDP_MULTIPLE
] = PFTM_UDP_MULTIPLE_VAL
;
1555 pf
->timeout
[PFTM_ICMP_FIRST_PACKET
] = PFTM_ICMP_FIRST_PACKET_VAL
;
1556 pf
->timeout
[PFTM_ICMP_ERROR_REPLY
] = PFTM_ICMP_ERROR_REPLY_VAL
;
1557 pf
->timeout
[PFTM_OTHER_FIRST_PACKET
] = PFTM_OTHER_FIRST_PACKET_VAL
;
1558 pf
->timeout
[PFTM_OTHER_SINGLE
] = PFTM_OTHER_SINGLE_VAL
;
1559 pf
->timeout
[PFTM_OTHER_MULTIPLE
] = PFTM_OTHER_MULTIPLE_VAL
;
1560 pf
->timeout
[PFTM_FRAG
] = PFTM_FRAG_VAL
;
1561 pf
->timeout
[PFTM_INTERVAL
] = PFTM_INTERVAL_VAL
;
1562 pf
->timeout
[PFTM_SRC_NODE
] = PFTM_SRC_NODE_VAL
;
1563 pf
->timeout
[PFTM_TS_DIFF
] = PFTM_TS_DIFF_VAL
;
1564 pf
->timeout
[PFTM_ADAPTIVE_START
] = PFSTATE_ADAPT_START
;
1565 pf
->timeout
[PFTM_ADAPTIVE_END
] = PFSTATE_ADAPT_END
;
1567 pf
->limit
[PF_LIMIT_STATES
] = PFSTATE_HIWAT
;
1568 pf
->limit
[PF_LIMIT_FRAGS
] = PFFRAG_FRENT_HIWAT
;
1569 pf
->limit
[PF_LIMIT_SRC_NODES
] = PFSNODE_HIWAT
;
1570 pf
->limit
[PF_LIMIT_TABLES
] = PFR_KTABLE_HIWAT
;
1571 pf
->limit
[PF_LIMIT_TABLE_ENTRIES
] = PFR_KENTRY_HIWAT
;
1574 mib
[1] = HW_PHYSMEM
;
1576 if (sysctl(mib
, 2, &mem
, &size
, NULL
, 0) == -1)
1578 if (mem
<= 100*1024*1024)
1579 pf
->limit
[PF_LIMIT_TABLE_ENTRIES
] = PFR_KENTRY_HIWAT_SMALL
;
1581 pf
->debug
= PF_DEBUG_URGENT
;
1585 pfctl_load_options(struct pfctl
*pf
)
1589 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1593 for (i
= 0; i
< PF_LIMIT_MAX
; i
++) {
1594 if ((pf
->opts
& PF_OPT_MERGE
) && !pf
->limit_set
[i
])
1596 if (pfctl_load_limit(pf
, i
, pf
->limit
[i
]))
1601 * If we've set the limit, but haven't explicitly set adaptive
1602 * timeouts, do it now with a start of 60% and end of 120%.
1604 if (pf
->limit_set
[PF_LIMIT_STATES
] &&
1605 !pf
->timeout_set
[PFTM_ADAPTIVE_START
] &&
1606 !pf
->timeout_set
[PFTM_ADAPTIVE_END
]) {
1607 pf
->timeout
[PFTM_ADAPTIVE_START
] =
1608 (pf
->limit
[PF_LIMIT_STATES
] / 10) * 6;
1609 pf
->timeout_set
[PFTM_ADAPTIVE_START
] = 1;
1610 pf
->timeout
[PFTM_ADAPTIVE_END
] =
1611 (pf
->limit
[PF_LIMIT_STATES
] / 10) * 12;
1612 pf
->timeout_set
[PFTM_ADAPTIVE_END
] = 1;
1616 for (i
= 0; i
< PFTM_MAX
; i
++) {
1617 if ((pf
->opts
& PF_OPT_MERGE
) && !pf
->timeout_set
[i
])
1619 if (pfctl_load_timeout(pf
, i
, pf
->timeout
[i
]))
1624 if (!(pf
->opts
& PF_OPT_MERGE
) || pf
->debug_set
)
1625 if (pfctl_load_debug(pf
, pf
->debug
))
1629 if (!(pf
->opts
& PF_OPT_MERGE
) || pf
->ifname_set
)
1630 if (pfctl_load_logif(pf
, pf
->ifname
))
1634 if (!(pf
->opts
& PF_OPT_MERGE
) || pf
->hostid_set
)
1635 if (pfctl_load_hostid(pf
, pf
->hostid
))
1642 pfctl_set_limit(struct pfctl
*pf
, const char *opt
, unsigned int limit
)
1647 for (i
= 0; pf_limits
[i
].name
; i
++) {
1648 if (strcasecmp(opt
, pf_limits
[i
].name
) == 0) {
1649 pf
->limit
[pf_limits
[i
].index
] = limit
;
1650 pf
->limit_set
[pf_limits
[i
].index
] = 1;
1654 if (pf_limits
[i
].name
== NULL
) {
1655 warnx("Bad pool name.");
1659 if (pf
->opts
& PF_OPT_VERBOSE
)
1660 printf("set limit %s %d\n", opt
, limit
);
1666 pfctl_load_limit(struct pfctl
*pf
, unsigned int his_index
, unsigned int limit
)
1668 struct pfioc_limit pl
;
1670 memset(&pl
, 0, sizeof(pl
));
1671 pl
.index
= his_index
;
1673 if (ioctl(pf
->dev
, DIOCSETLIMIT
, &pl
)) {
1675 warnx("Current pool size exceeds requested hard limit");
1677 warnx("DIOCSETLIMIT");
1684 pfctl_set_timeout(struct pfctl
*pf
, const char *opt
, int seconds
, int quiet
)
1688 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1691 for (i
= 0; pf_timeouts
[i
].name
; i
++) {
1692 if (strcasecmp(opt
, pf_timeouts
[i
].name
) == 0) {
1693 pf
->timeout
[pf_timeouts
[i
].timeout
] = seconds
;
1694 pf
->timeout_set
[pf_timeouts
[i
].timeout
] = 1;
1699 if (pf_timeouts
[i
].name
== NULL
) {
1700 warnx("Bad timeout name.");
1705 if (pf
->opts
& PF_OPT_VERBOSE
&& ! quiet
)
1706 printf("set timeout %s %d\n", opt
, seconds
);
1712 pfctl_load_timeout(struct pfctl
*pf
, unsigned int timeout
, unsigned int seconds
)
1716 memset(&pt
, 0, sizeof(pt
));
1717 pt
.timeout
= timeout
;
1718 pt
.seconds
= seconds
;
1719 if (ioctl(pf
->dev
, DIOCSETTIMEOUT
, &pt
)) {
1720 warnx("DIOCSETTIMEOUT");
1727 pfctl_set_optimization(struct pfctl
*pf
, const char *opt
)
1729 const struct pf_hint
*hint
;
1732 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1735 for (i
= 0; pf_hints
[i
].name
; i
++)
1736 if (strcasecmp(opt
, pf_hints
[i
].name
) == 0)
1739 hint
= pf_hints
[i
].hint
;
1741 warnx("invalid state timeouts optimization");
1745 for (i
= 0; hint
[i
].name
; i
++)
1746 if ((r
= pfctl_set_timeout(pf
, hint
[i
].name
,
1747 hint
[i
].timeout
, 1)))
1750 if (pf
->opts
& PF_OPT_VERBOSE
)
1751 printf("set optimization %s\n", opt
);
1757 pfctl_set_logif(struct pfctl
*pf
, char *ifname
)
1760 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1763 if (!strcmp(ifname
, "none")) {
1767 pf
->ifname
= strdup(ifname
);
1769 errx(1, "pfctl_set_logif: strdup");
1773 if (pf
->opts
& PF_OPT_VERBOSE
)
1774 printf("set loginterface %s\n", ifname
);
1780 pfctl_load_logif(struct pfctl
*pf
, char *ifname
)
1784 memset(&pi
, 0, sizeof(pi
));
1785 if (ifname
&& strlcpy(pi
.ifname
, ifname
,
1786 sizeof(pi
.ifname
)) >= sizeof(pi
.ifname
)) {
1787 warnx("pfctl_load_logif: strlcpy");
1790 if (ioctl(pf
->dev
, DIOCSETSTATUSIF
, &pi
)) {
1791 warnx("DIOCSETSTATUSIF");
1798 pfctl_set_hostid(struct pfctl
*pf
, u_int32_t hostid
)
1800 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1803 hostid
= htonl(hostid
);
1805 pf
->hostid
= hostid
;
1808 if (pf
->opts
& PF_OPT_VERBOSE
)
1809 printf("set hostid 0x%08x\n", ntohl(hostid
));
1815 pfctl_load_hostid(struct pfctl
*pf __unused
, u_int32_t hostid
)
1817 if (ioctl(dev_fd
, DIOCSETHOSTID
, &hostid
)) {
1818 warnx("DIOCSETHOSTID");
1825 pfctl_set_debug(struct pfctl
*pf
, char *d
)
1829 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1832 if (!strcmp(d
, "none"))
1833 pf
->debug
= PF_DEBUG_NONE
;
1834 else if (!strcmp(d
, "urgent"))
1835 pf
->debug
= PF_DEBUG_URGENT
;
1836 else if (!strcmp(d
, "misc"))
1837 pf
->debug
= PF_DEBUG_MISC
;
1838 else if (!strcmp(d
, "loud"))
1839 pf
->debug
= PF_DEBUG_NOISY
;
1841 warnx("unknown debug level \"%s\"", d
);
1847 if ((pf
->opts
& PF_OPT_NOACTION
) == 0)
1848 if (ioctl(dev_fd
, DIOCSETDEBUG
, &level
))
1849 err(1, "DIOCSETDEBUG");
1851 if (pf
->opts
& PF_OPT_VERBOSE
)
1852 printf("set debug %s\n", d
);
1858 pfctl_load_debug(struct pfctl
*pf
, unsigned int level
)
1860 if (ioctl(pf
->dev
, DIOCSETDEBUG
, &level
)) {
1861 warnx("DIOCSETDEBUG");
1868 pfctl_set_interface_flags(struct pfctl
*pf
, char *ifname
, int flags
, int how
)
1870 struct pfioc_iface pi
;
1872 if ((loadopt
& PFCTL_FLAG_OPTION
) == 0)
1875 bzero(&pi
, sizeof(pi
));
1877 pi
.pfiio_flags
= flags
;
1879 if (strlcpy(pi
.pfiio_name
, ifname
, sizeof(pi
.pfiio_name
)) >=
1880 sizeof(pi
.pfiio_name
))
1881 errx(1, "pfctl_set_interface_flags: strlcpy");
1883 if ((pf
->opts
& PF_OPT_NOACTION
) == 0) {
1885 if (ioctl(pf
->dev
, DIOCCLRIFFLAG
, &pi
))
1886 err(1, "DIOCCLRIFFLAG");
1888 if (ioctl(pf
->dev
, DIOCSETIFFLAG
, &pi
))
1889 err(1, "DIOCSETIFFLAG");
1896 pfctl_debug(int dev
, u_int32_t level
, int opts
)
1898 if (ioctl(dev
, DIOCSETDEBUG
, &level
))
1899 err(1, "DIOCSETDEBUG");
1900 if ((opts
& PF_OPT_QUIET
) == 0) {
1901 fprintf(stderr
, "debug level set to '");
1904 fprintf(stderr
, "none");
1906 case PF_DEBUG_URGENT
:
1907 fprintf(stderr
, "urgent");
1910 fprintf(stderr
, "misc");
1912 case PF_DEBUG_NOISY
:
1913 fprintf(stderr
, "loud");
1916 fprintf(stderr
, "<invalid>");
1919 fprintf(stderr
, "'\n");
1924 pfctl_test_altqsupport(int dev
, int opts
)
1926 struct pfioc_altq pa
;
1928 if (ioctl(dev
, DIOCGETALTQS
, &pa
)) {
1929 if (errno
== ENODEV
) {
1930 if (!(opts
& PF_OPT_QUIET
))
1931 fprintf(stderr
, "No ALTQ support in kernel\n"
1932 "ALTQ related functions disabled\n");
1935 err(1, "DIOCGETALTQS");
1941 pfctl_show_anchors(int dev
, int opts
, char *anchorname
)
1943 struct pfioc_ruleset pr
;
1946 memset(&pr
, 0, sizeof(pr
));
1947 memcpy(pr
.path
, anchorname
, sizeof(pr
.path
));
1948 if (ioctl(dev
, DIOCGETRULESETS
, &pr
)) {
1949 if (errno
== EINVAL
)
1950 fprintf(stderr
, "Anchor '%s' not found.\n",
1953 err(1, "DIOCGETRULESETS");
1957 for (nr
= 0; nr
< mnr
; ++nr
) {
1958 char sub
[MAXPATHLEN
];
1961 if (ioctl(dev
, DIOCGETRULESET
, &pr
))
1962 err(1, "DIOCGETRULESET");
1963 if (!strcmp(pr
.name
, PF_RESERVED_ANCHOR
))
1967 strlcat(sub
, pr
.path
, sizeof(sub
));
1968 strlcat(sub
, "/", sizeof(sub
));
1970 strlcat(sub
, pr
.name
, sizeof(sub
));
1971 if (sub
[0] != '_' || (opts
& PF_OPT_VERBOSE
))
1972 printf(" %s\n", sub
);
1973 if ((opts
& PF_OPT_VERBOSE
) && pfctl_show_anchors(dev
, opts
, sub
))
1980 pfctl_lookup_option(char *cmd
, const char **list
)
1982 if (cmd
!= NULL
&& *cmd
)
1983 for (; *list
; list
++)
1984 if (!strncmp(cmd
, *list
, strlen(cmd
)))
1990 main(int argc
, char *argv
[])
1994 int mode
= O_RDONLY
;
1996 int optimize
= PF_OPTIMIZE_BASIC
;
1997 char anchorname
[MAXPATHLEN
];
2003 while ((ch
= getopt(argc
, argv
,
2004 "a:AdD:eqf:F:ghi:k:K:mnNOo:p:rRs:t:T:vx:z")) != -1) {
2010 opts
|= PF_OPT_DISABLE
;
2014 if (pfctl_cmdline_symset(optarg
) < 0)
2015 warnx("could not parse macro definition %s",
2019 opts
|= PF_OPT_ENABLE
;
2023 opts
|= PF_OPT_QUIET
;
2026 clearopt
= pfctl_lookup_option(optarg
, clearopt_list
);
2027 if (clearopt
== NULL
) {
2028 warnx("Unknown flush modifier '%s'", optarg
);
2037 if (state_killers
>= 2) {
2038 warnx("can only specify -k twice");
2042 state_kill
[state_killers
++] = optarg
;
2046 if (src_node_killers
>= 2) {
2047 warnx("can only specify -K twice");
2051 src_node_kill
[src_node_killers
++] = optarg
;
2055 opts
|= PF_OPT_MERGE
;
2058 opts
|= PF_OPT_NOACTION
;
2061 loadopt
|= PFCTL_FLAG_NAT
;
2064 opts
|= PF_OPT_USEDNS
;
2071 opts
|= PF_OPT_DEBUG
;
2074 loadopt
|= PFCTL_FLAG_ALTQ
;
2077 loadopt
|= PFCTL_FLAG_FILTER
;
2080 optiopt
= pfctl_lookup_option(optarg
, optiopt_list
);
2081 if (optiopt
== NULL
) {
2082 warnx("Unknown optimization '%s'", optarg
);
2085 opts
|= PF_OPT_OPTIMIZE
;
2088 loadopt
|= PFCTL_FLAG_OPTION
;
2094 showopt
= pfctl_lookup_option(optarg
, showopt_list
);
2095 if (showopt
== NULL
) {
2096 warnx("Unknown show modifier '%s'", optarg
);
2104 tblcmdopt
= pfctl_lookup_option(optarg
, tblcmdopt_list
);
2105 if (tblcmdopt
== NULL
) {
2106 warnx("Unknown table command '%s'", optarg
);
2111 if (opts
& PF_OPT_VERBOSE
)
2112 opts
|= PF_OPT_VERBOSE2
;
2113 opts
|= PF_OPT_VERBOSE
;
2116 debugopt
= pfctl_lookup_option(optarg
, debugopt_list
);
2117 if (debugopt
== NULL
) {
2118 warnx("Unknown debug level '%s'", optarg
);
2124 opts
|= PF_OPT_CLRRULECTRS
;
2135 if (tblcmdopt
!= NULL
) {
2140 loadopt
|= PFCTL_FLAG_TABLE
;
2143 mode
= strchr("acdefkrz", ch
) ? O_RDWR
: O_RDONLY
;
2144 } else if (argc
!= optind
) {
2145 warnx("unknown command line argument: %s ...", argv
[optind
]);
2152 if ((path
= calloc(1, MAXPATHLEN
)) == NULL
)
2153 errx(1, "pfctl: calloc");
2154 memset(anchorname
, 0, sizeof(anchorname
));
2155 if (anchoropt
!= NULL
) {
2156 int len
= strlen(anchoropt
);
2158 if (anchoropt
[len
- 1] == '*') {
2159 if (len
>= 2 && anchoropt
[len
- 2] == '/')
2160 anchoropt
[len
- 2] = '\0';
2162 anchoropt
[len
- 1] = '\0';
2163 opts
|= PF_OPT_RECURSE
;
2165 if (strlcpy(anchorname
, anchoropt
,
2166 sizeof(anchorname
)) >= sizeof(anchorname
))
2167 errx(1, "anchor name '%s' too long",
2169 loadopt
&= PFCTL_FLAG_FILTER
|PFCTL_FLAG_NAT
|PFCTL_FLAG_TABLE
;
2172 if ((opts
& PF_OPT_NOACTION
) == 0) {
2173 dev_fd
= open(pf_device
, mode
);
2175 err(1, "%s", pf_device
);
2176 altqsupport
= pfctl_test_altqsupport(dev_fd
, opts
);
2178 dev_fd
= open(pf_device
, O_RDONLY
);
2180 opts
|= PF_OPT_DUMMYACTION
;
2181 /* turn off options */
2182 opts
&= ~ (PF_OPT_DISABLE
| PF_OPT_ENABLE
);
2183 clearopt
= showopt
= debugopt
= NULL
;
2187 if (opts
& PF_OPT_DISABLE
)
2188 if (pfctl_disable(dev_fd
, opts
))
2191 if (showopt
!= NULL
) {
2194 pfctl_show_anchors(dev_fd
, opts
, anchorname
);
2197 pfctl_load_fingerprints(dev_fd
, opts
);
2198 pfctl_show_rules(dev_fd
, path
, opts
, PFCTL_SHOW_RULES
,
2202 pfctl_load_fingerprints(dev_fd
, opts
);
2203 pfctl_show_rules(dev_fd
, path
, opts
, PFCTL_SHOW_LABELS
,
2207 pfctl_load_fingerprints(dev_fd
, opts
);
2208 pfctl_show_nat(dev_fd
, opts
, anchorname
);
2211 pfctl_show_altq(dev_fd
, ifaceopt
, opts
,
2212 opts
& PF_OPT_VERBOSE2
);
2215 pfctl_show_states(dev_fd
, ifaceopt
, opts
);
2218 pfctl_show_src_nodes(dev_fd
, opts
);
2221 pfctl_show_status(dev_fd
, opts
);
2224 pfctl_show_timeouts(dev_fd
, opts
);
2227 pfctl_show_limits(dev_fd
, opts
);
2230 opts
|= PF_OPT_SHOWALL
;
2231 pfctl_load_fingerprints(dev_fd
, opts
);
2233 pfctl_show_nat(dev_fd
, opts
, anchorname
);
2234 pfctl_show_rules(dev_fd
, path
, opts
, 0, anchorname
, 0);
2235 pfctl_show_altq(dev_fd
, ifaceopt
, opts
, 0);
2236 pfctl_show_states(dev_fd
, ifaceopt
, opts
);
2237 pfctl_show_src_nodes(dev_fd
, opts
);
2238 pfctl_show_status(dev_fd
, opts
);
2239 pfctl_show_rules(dev_fd
, path
, opts
, 1, anchorname
, 0);
2240 pfctl_show_timeouts(dev_fd
, opts
);
2241 pfctl_show_limits(dev_fd
, opts
);
2242 pfctl_show_tables(anchorname
, opts
);
2243 pfctl_show_fingerprints(opts
);
2246 pfctl_show_tables(anchorname
, opts
);
2249 pfctl_load_fingerprints(dev_fd
, opts
);
2250 pfctl_show_fingerprints(opts
);
2253 pfctl_show_ifaces(ifaceopt
, opts
);
2258 if ((opts
& PF_OPT_CLRRULECTRS
) && showopt
== NULL
)
2259 pfctl_show_rules(dev_fd
, path
, opts
, PFCTL_SHOW_NOTHING
,
2262 if (clearopt
!= NULL
) {
2263 if (anchorname
[0] == '_' || strstr(anchorname
, "/_") != NULL
)
2264 errx(1, "anchor names beginning with '_' cannot "
2265 "be modified from the command line");
2267 switch (*clearopt
) {
2269 pfctl_clear_rules(dev_fd
, opts
, anchorname
);
2272 pfctl_clear_nat(dev_fd
, opts
, anchorname
);
2275 pfctl_clear_altq(dev_fd
, opts
);
2278 pfctl_clear_states(dev_fd
, ifaceopt
, opts
);
2281 pfctl_clear_src_nodes(dev_fd
, opts
);
2284 pfctl_clear_stats(dev_fd
, opts
);
2287 pfctl_clear_rules(dev_fd
, opts
, anchorname
);
2288 pfctl_clear_nat(dev_fd
, opts
, anchorname
);
2289 pfctl_clear_tables(anchorname
, opts
);
2291 pfctl_clear_altq(dev_fd
, opts
);
2292 pfctl_clear_states(dev_fd
, ifaceopt
, opts
);
2293 pfctl_clear_src_nodes(dev_fd
, opts
);
2294 pfctl_clear_stats(dev_fd
, opts
);
2295 pfctl_clear_fingerprints(dev_fd
, opts
);
2296 pfctl_clear_interface_flags(dev_fd
, opts
);
2300 pfctl_clear_fingerprints(dev_fd
, opts
);
2303 pfctl_clear_tables(anchorname
, opts
);
2307 if (state_killers
) {
2308 if (!strcmp(state_kill
[0], "label"))
2309 pfctl_label_kill_states(dev_fd
, ifaceopt
, opts
);
2310 else if (!strcmp(state_kill
[0], "id"))
2311 pfctl_id_kill_states(dev_fd
, ifaceopt
, opts
);
2313 pfctl_net_kill_states(dev_fd
, ifaceopt
, opts
);
2316 if (src_node_killers
)
2317 pfctl_kill_src_nodes(dev_fd
, ifaceopt
, opts
);
2319 if (tblcmdopt
!= NULL
) {
2320 error
= pfctl_command_tables(argc
, argv
, tableopt
,
2321 tblcmdopt
, rulesopt
, anchorname
, opts
);
2324 if (optiopt
!= NULL
) {
2330 optimize
|= PF_OPTIMIZE_BASIC
;
2334 optimize
|= PF_OPTIMIZE_PROFILE
;
2339 if ((rulesopt
!= NULL
) && (loadopt
& PFCTL_FLAG_OPTION
) &&
2341 if (pfctl_clear_interface_flags(dev_fd
, opts
| PF_OPT_QUIET
))
2344 if (rulesopt
!= NULL
&& !(opts
& (PF_OPT_MERGE
|PF_OPT_NOACTION
)) &&
2345 !anchorname
[0] && (loadopt
& PFCTL_FLAG_OPTION
))
2346 if (pfctl_file_fingerprints(dev_fd
, opts
, PF_OSFP_FILE
))
2349 if (rulesopt
!= NULL
) {
2350 if (anchorname
[0] == '_' || strstr(anchorname
, "/_") != NULL
)
2351 errx(1, "anchor names beginning with '_' cannot "
2352 "be modified from the command line");
2353 if (pfctl_rules(dev_fd
, rulesopt
, opts
, optimize
,
2356 else if (!(opts
& PF_OPT_NOACTION
) &&
2357 (loadopt
& PFCTL_FLAG_TABLE
))
2358 warn_namespace_collision(NULL
);
2361 if (opts
& PF_OPT_ENABLE
)
2362 if (pfctl_enable(dev_fd
, opts
))
2365 if (debugopt
!= NULL
) {
2366 switch (*debugopt
) {
2368 pfctl_debug(dev_fd
, PF_DEBUG_NONE
, opts
);
2371 pfctl_debug(dev_fd
, PF_DEBUG_URGENT
, opts
);
2374 pfctl_debug(dev_fd
, PF_DEBUG_MISC
, opts
);
2377 pfctl_debug(dev_fd
, PF_DEBUG_NOISY
, opts
);