?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
- Test m_pkthdr.fw_flags against DUMMYNET_MBUF_TAGGED before trying to locate
[dragonfly/netmp.git] / usr.sbin / pfctl / pfctl.c
blobbf57626c97c38a8605a523b6aa67b1f386d6bfb7
1 /* $OpenBSD: pfctl.c,v 1.213 2004/03/20 09:31:42 david Exp $ */
2 /* $DragonFly: src/usr.sbin/pfctl/pfctl.c,v 1.2 2005/02/11 22:31:45 joerg Exp $ */
3
4 /*
5 * Copyright (c) 2001 Daniel Hartmeier
6 * Copyright (c) 2002,2003 Henning Brauer
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35 #include <sys/types.h>
36 #include <sys/ioctl.h>
37 #include <sys/socket.h>
38
39 #include <net/if.h>
40 #include <netinet/in.h>
41 #include <net/pf/pfvar.h>
42 #include <arpa/inet.h>
43 #include <net/altq/altq.h>
44
45 #include <err.h>
46 #include <errno.h>
47 #include <fcntl.h>
48 #include <limits.h>
49 #include <netdb.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <string.h>
53 #include <unistd.h>
54
55 #include "pfctl_parser.h"
56 #include "pfctl.h"
57
58 void usage(void);
59 int pfctl_enable(int, int);
60 int pfctl_disable(int, int);
61 int pfctl_clear_stats(int, int);
62 int pfctl_clear_rules(int, int, char *, char *);
63 int pfctl_clear_nat(int, int, char *, char *);
64 int pfctl_clear_altq(int, int);
65 int pfctl_clear_src_nodes(int, int);
66 int pfctl_clear_states(int, const char *, int);
67 int pfctl_kill_states(int, const char *, int);
68 int pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
69 char *, char *);
70 void pfctl_print_rule_counters(struct pf_rule *, int);
71 int pfctl_show_rules(int, int, int, char *, char *);
72 int pfctl_show_nat(int, int, char *, char *);
73 int pfctl_show_src_nodes(int, int);
74 int pfctl_show_states(int, const char *, int);
75 int pfctl_show_status(int, int);
76 int pfctl_show_timeouts(int, int);
77 int pfctl_show_limits(int, int);
78 int pfctl_debug(int, u_int32_t, int);
79 int pfctl_clear_rule_counters(int, int);
80 int pfctl_test_altqsupport(int, int);
81 int pfctl_show_anchors(int, int, char *);
82 const char *pfctl_lookup_option(char *, const char **);
83
84 const char *clearopt;
85 char *rulesopt;
86 const char *showopt;
87 const char *debugopt;
88 char *anchoropt;
89 const char *pf_device = "/dev/pf";
90 char *ifaceopt;
91 char *tableopt;
92 const char *tblcmdopt;
93 int state_killers;
94 char *state_kill[2];
95 int loadopt;
96 int altqsupport;
97
98 int dev_fd = -1;
99 int first_title = 1;
100 int labels = 0;
101
102 const char *infile;
103
104 static const struct {
105 const char *name;
106 int index;
107 } pf_limits[] = {
108 { "states", PF_LIMIT_STATES },
109 { "src-nodes", PF_LIMIT_SRC_NODES },
110 { "frags", PF_LIMIT_FRAGS },
111 { NULL, 0 }
112 };
113
114 struct pf_hint {
115 const char *name;
116 int timeout;
117 };
118 static const struct pf_hint pf_hint_normal[] = {
119 { "tcp.first", 2 * 60 },
120 { "tcp.opening", 30 },
121 { "tcp.established", 24 * 60 * 60 },
122 { "tcp.closing", 15 * 60 },
123 { "tcp.finwait", 45 },
124 { "tcp.closed", 90 },
125 { NULL, 0 }
126 };
127 static const struct pf_hint pf_hint_satellite[] = {
128 { "tcp.first", 3 * 60 },
129 { "tcp.opening", 30 + 5 },
130 { "tcp.established", 24 * 60 * 60 },
131 { "tcp.closing", 15 * 60 + 5 },
132 { "tcp.finwait", 45 + 5 },
133 { "tcp.closed", 90 + 5 },
134 { NULL, 0 }
135 };
136 static const struct pf_hint pf_hint_conservative[] = {
137 { "tcp.first", 60 * 60 },
138 { "tcp.opening", 15 * 60 },
139 { "tcp.established", 5 * 24 * 60 * 60 },
140 { "tcp.closing", 60 * 60 },
141 { "tcp.finwait", 10 * 60 },
142 { "tcp.closed", 3 * 60 },
143 { NULL, 0 }
144 };
145 static const struct pf_hint pf_hint_aggressive[] = {
146 { "tcp.first", 30 },
147 { "tcp.opening", 5 },
148 { "tcp.established", 5 * 60 * 60 },
149 { "tcp.closing", 60 },
150 { "tcp.finwait", 30 },
151 { "tcp.closed", 30 },
152 { NULL, 0 }
153 };
154
155 static const struct {
156 const char *name;
157 const struct pf_hint *hint;
158 } pf_hints[] = {
159 { "normal", pf_hint_normal },
160 { "satellite", pf_hint_satellite },
161 { "high-latency", pf_hint_satellite },
162 { "conservative", pf_hint_conservative },
163 { "aggressive", pf_hint_aggressive },
164 { NULL, NULL }
165 };
166
167 static const char *clearopt_list[] = {
168 "nat", "queue", "rules", "Sources",
169 "state", "info", "Tables", "osfp", "all", NULL
170 };
171
172 static const char *showopt_list[] = {
173 "nat", "queue", "rules", "Anchors", "Sources", "state", "info",
174 "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
175 "all", NULL
176 };
177
178 static const char *tblcmdopt_list[] = {
179 "kill", "flush", "add", "delete", "load", "replace", "show",
180 "test", "zero", NULL
181 };
182
183 static const char *debugopt_list[] = {
184 "none", "urgent", "misc", "loud", NULL
185 };
186
187
188 void
189 usage(void)
190 {
191 fprintf(stderr, "usage: %s [-AdeghNnOqRrvz] ", getprogname());
192 fprintf(stderr, "[-a anchor[:ruleset]] [-D macro=value]\n");
193 fprintf(stderr, " ");
194 fprintf(stderr, "[-F modifier] [-f file] [-i interface] ");
195 fprintf(stderr, "[-k host] [-p device]\n");
196 fprintf(stderr, " ");
197 fprintf(stderr, "[-s modifier] [-T command [address ...]] ");
198 fprintf(stderr, "[-t table] [-x level]\n");
199 exit(1);
200 }
201
202 int
203 pfctl_enable(int dev, int opts)
204 {
205 if (ioctl(dev, DIOCSTART)) {
206 if (errno == EEXIST)
207 errx(1, "pf already enabled");
208 else
209 err(1, "DIOCSTART");
210 }
211 if ((opts & PF_OPT_QUIET) == 0)
212 fprintf(stderr, "pf enabled\n");
213
214 if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
215 if (errno != EEXIST)
216 err(1, "DIOCSTARTALTQ");
217
218 return (0);
219 }
220
221 int
222 pfctl_disable(int dev, int opts)
223 {
224 if (ioctl(dev, DIOCSTOP)) {
225 if (errno == ENOENT)
226 errx(1, "pf not enabled");
227 else
228 err(1, "DIOCSTOP");
229 }
230 if ((opts & PF_OPT_QUIET) == 0)
231 fprintf(stderr, "pf disabled\n");
232
233 if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
234 if (errno != ENOENT)
235 err(1, "DIOCSTOPALTQ");
236
237 return (0);
238 }
239
240 int
241 pfctl_clear_stats(int dev, int opts)
242 {
243 if (ioctl(dev, DIOCCLRSTATUS))
244 err(1, "DIOCCLRSTATUS");
245 if ((opts & PF_OPT_QUIET) == 0)
246 fprintf(stderr, "pf: statistics cleared\n");
247 return (0);
248 }
249
250 int
251 pfctl_clear_rules(int dev, int opts, char *anchorname, char *rulesetname)
252 {
253 struct pfr_buffer t;
254
255 if (*anchorname && !*rulesetname) {
256 struct pfioc_ruleset pr;
257 int mnr, nr, r;
258
259 memset(&pr, 0, sizeof(pr));
260 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
261 if (ioctl(dev, DIOCGETRULESETS, &pr)) {
262 if (errno == EINVAL)
263 fprintf(stderr, "No rulesets in anchor '%s'.\n",
264 anchorname);
265 else
266 err(1, "DIOCGETRULESETS");
267 return (-1);
268 }
269 mnr = pr.nr;
270 for (nr = mnr - 1; nr >= 0; --nr) {
271 pr.nr = nr;
272 if (ioctl(dev, DIOCGETRULESET, &pr))
273 err(1, "DIOCGETRULESET");
274 r = pfctl_clear_rules(dev, opts | PF_OPT_QUIET,
275 anchorname, pr.name);
276 if (r)
277 return (r);
278 }
279 if ((opts & PF_OPT_QUIET) == 0)
280 fprintf(stderr, "rules cleared\n");
281 return (0);
282 }
283 memset(&t, 0, sizeof(t));
284 t.pfrb_type = PFRB_TRANS;
285 if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname, rulesetname) ||
286 pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname, rulesetname) ||
287 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
288 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
289 err(1, "pfctl_clear_rules");
290 if ((opts & PF_OPT_QUIET) == 0)
291 fprintf(stderr, "rules cleared\n");
292 return (0);
293 }
294
295 int
296 pfctl_clear_nat(int dev, int opts, char *anchorname, char *rulesetname)
297 {
298 struct pfr_buffer t;
299
300 if (*anchorname && !*rulesetname) {
301 struct pfioc_ruleset pr;
302 int mnr, nr, r;
303
304 memset(&pr, 0, sizeof(pr));
305 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
306 if (ioctl(dev, DIOCGETRULESETS, &pr)) {
307 if (errno == EINVAL)
308 fprintf(stderr, "No rulesets in anchor '%s'.\n",
309 anchorname);
310 else
311 err(1, "DIOCGETRULESETS");
312 return (-1);
313 }
314 mnr = pr.nr;
315 for (nr = mnr - 1; nr >= 0; --nr) {
316 pr.nr = nr;
317 if (ioctl(dev, DIOCGETRULESET, &pr))
318 err(1, "DIOCGETRULESET");
319 r = pfctl_clear_nat(dev, opts | PF_OPT_QUIET,
320 anchorname, pr.name);
321 if (r)
322 return (r);
323 }
324 if ((opts & PF_OPT_QUIET) == 0)
325 fprintf(stderr, "nat cleared\n");
326 return (0);
327 }
328 memset(&t, 0, sizeof(t));
329 t.pfrb_type = PFRB_TRANS;
330 if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname, rulesetname) ||
331 pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname, rulesetname) ||
332 pfctl_add_trans(&t, PF_RULESET_RDR, anchorname, rulesetname) ||
333 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
334 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
335 err(1, "pfctl_clear_nat");
336 if ((opts & PF_OPT_QUIET) == 0)
337 fprintf(stderr, "nat cleared\n");
338 return (0);
339 }
340
341 int
342 pfctl_clear_altq(int dev, int opts)
343 {
344 struct pfr_buffer t;
345
346 if (!altqsupport)
347 return (-1);
348 memset(&t, 0, sizeof(t));
349 t.pfrb_type = PFRB_TRANS;
350 if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "", "") ||
351 pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
352 pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
353 err(1, "pfctl_clear_altq");
354 if ((opts & PF_OPT_QUIET) == 0)
355 fprintf(stderr, "altq cleared\n");
356 return (0);
357 }
358
359 int
360 pfctl_clear_src_nodes(int dev, int opts)
361 {
362 if (ioctl(dev, DIOCCLRSRCNODES))
363 err(1, "DIOCCLRSRCNODES");
364 if ((opts & PF_OPT_QUIET) == 0)
365 fprintf(stderr, "source tracking entries cleared\n");
366 return (0);
367 }
368
369 int
370 pfctl_clear_states(int dev, const char *iface, int opts)
371 {
372 struct pfioc_state_kill psk;
373
374 memset(&psk, 0, sizeof(psk));
375 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
376 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
377 errx(1, "invalid interface: %s", iface);
378
379 if (ioctl(dev, DIOCCLRSTATES, &psk))
380 err(1, "DIOCCLRSTATES");
381 if ((opts & PF_OPT_QUIET) == 0)
382 fprintf(stderr, "%d states cleared\n", psk.psk_af);
383 return (0);
384 }
385
386 int
387 pfctl_kill_states(int dev, const char *iface, int opts)
388 {
389 struct pfioc_state_kill psk;
390 struct addrinfo *res[2], *resp[2];
391 struct sockaddr last_src, last_dst;
392 int killed, sources, dests;
393 int ret_ga;
394
395 killed = sources = dests = 0;
396
397 memset(&psk, 0, sizeof(psk));
398 memset(&psk.psk_src.addr.v.a.mask, 0xff,
399 sizeof(psk.psk_src.addr.v.a.mask));
400 memset(&last_src, 0xff, sizeof(last_src));
401 memset(&last_dst, 0xff, sizeof(last_dst));
402 if (iface != NULL && strlcpy(psk.psk_ifname, iface,
403 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
404 errx(1, "invalid interface: %s", iface);
405
406 if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
407 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
408 /* NOTREACHED */
409 }
410 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
411 if (resp[0]->ai_addr == NULL)
412 continue;
413 /* We get lots of duplicates. Catch the easy ones */
414 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
415 continue;
416 last_src = *(struct sockaddr *)resp[0]->ai_addr;
417
418 psk.psk_af = resp[0]->ai_family;
419 sources++;
420
421 if (psk.psk_af == AF_INET)
422 psk.psk_src.addr.v.a.addr.v4 =
423 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
424 else if (psk.psk_af == AF_INET6)
425 psk.psk_src.addr.v.a.addr.v6 =
426 ((struct sockaddr_in6 *)resp[0]->ai_addr)->
427 sin6_addr;
428 else
429 errx(1, "Unknown address family %d", psk.psk_af);
430
431 if (state_killers > 1) {
432 dests = 0;
433 memset(&psk.psk_dst.addr.v.a.mask, 0xff,
434 sizeof(psk.psk_dst.addr.v.a.mask));
435 memset(&last_dst, 0xff, sizeof(last_dst));
436 if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
437 &res[1]))) {
438 errx(1, "getaddrinfo: %s",
439 gai_strerror(ret_ga));
440 /* NOTREACHED */
441 }
442 for (resp[1] = res[1]; resp[1];
443 resp[1] = resp[1]->ai_next) {
444 if (resp[1]->ai_addr == NULL)
445 continue;
446 if (psk.psk_af != resp[1]->ai_family)
447 continue;
448
449 if (memcmp(&last_dst, resp[1]->ai_addr,
450 sizeof(last_dst)) == 0)
451 continue;
452 last_dst = *(struct sockaddr *)resp[1]->ai_addr;
453
454 dests++;
455
456 if (psk.psk_af == AF_INET)
457 psk.psk_dst.addr.v.a.addr.v4 =
458 ((struct sockaddr_in *)resp[1]->
459 ai_addr)->sin_addr;
460 else if (psk.psk_af == AF_INET6)
461 psk.psk_dst.addr.v.a.addr.v6 =
462 ((struct sockaddr_in6 *)resp[1]->
463 ai_addr)->sin6_addr;
464 else
465 errx(1, "Unknown address family %d",
466 psk.psk_af);
467
468 if (ioctl(dev, DIOCKILLSTATES, &psk))
469 err(1, "DIOCKILLSTATES");
470 killed += psk.psk_af;
471 /* fixup psk.psk_af */
472 psk.psk_af = resp[1]->ai_family;
473 }
474 freeaddrinfo(res[1]);
475 } else {
476 if (ioctl(dev, DIOCKILLSTATES, &psk))
477 err(1, "DIOCKILLSTATES");
478 killed += psk.psk_af;
479 /* fixup psk.psk_af */
480 psk.psk_af = res[0]->ai_family;
481 }
482 }
483
484 freeaddrinfo(res[0]);
485
486 if ((opts & PF_OPT_QUIET) == 0)
487 fprintf(stderr, "killed %d states from %d sources and %d "
488 "destinations\n", killed, sources, dests);
489 return (0);
490 }
491
492 int
493 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
494 u_int32_t ticket, int r_action, char *anchorname, char *rulesetname)
495 {
496 struct pfioc_pooladdr pp;
497 struct pf_pooladdr *pa;
498 u_int32_t pnr, mpnr;
499
500 memset(&pp, 0, sizeof(pp));
501 memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
502 memcpy(pp.ruleset, rulesetname, sizeof(pp.ruleset));
503 pp.r_action = r_action;
504 pp.r_num = nr;
505 pp.ticket = ticket;
506 if (ioctl(dev, DIOCGETADDRS, &pp)) {
507 warn("DIOCGETADDRS");
508 return (-1);
509 }
510 mpnr = pp.nr;
511 TAILQ_INIT(&pool->list);
512 for (pnr = 0; pnr < mpnr; ++pnr) {
513 pp.nr = pnr;
514 if (ioctl(dev, DIOCGETADDR, &pp)) {
515 warn("DIOCGETADDR");
516 return (-1);
517 }
518 pa = calloc(1, sizeof(struct pf_pooladdr));
519 if (pa == NULL)
520 err(1, "calloc");
521 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
522 TAILQ_INSERT_TAIL(&pool->list, pa, entries);
523 }
524
525 return (0);
526 }
527
528 void
529 pfctl_clear_pool(struct pf_pool *pool)
530 {
531 struct pf_pooladdr *pa;
532
533 while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
534 TAILQ_REMOVE(&pool->list, pa, entries);
535 free(pa);
536 }
537 }
538
539 void
540 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
541 {
542 if (opts & PF_OPT_DEBUG) {
543 const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
544 "p", "sa", "sp", "da", "dp" };
545 int i;
546
547 printf(" [ Skip steps: ");
548 for (i = 0; i < PF_SKIP_COUNT; ++i) {
549 if (rule->skip[i].nr == rule->nr + 1)
550 continue;
551 printf("%s=", t[i]);
552 if (rule->skip[i].nr == (uint32_t)(-1))
553 printf("end ");
554 else
555 printf("%u ", rule->skip[i].nr);
556 }
557 printf("]\n");
558
559 printf(" [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
560 rule->qname, rule->qid, rule->pqname, rule->pqid);
561 }
562 if (opts & PF_OPT_VERBOSE)
563 printf(" [ Evaluations: %-8llu Packets: %-8llu "
564 "Bytes: %-10llu States: %-6u]\n",
565 (unsigned long long)rule->evaluations,
566 (unsigned long long)rule->packets,
567 (unsigned long long)rule->bytes, rule->states);
568 }
569
570 void
571 pfctl_print_title(const char *title)
572 {
573 if (!first_title)
574 printf("\n");
575 first_title = 0;
576 printf("%s\n", title);
577 }
578
579 int
580 pfctl_show_rules(int dev, int opts, int format, char *anchorname,
581 char *rulesetname)
582 {
583 struct pfioc_rule pr;
584 u_int32_t nr, mnr, header = 0;
585 int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
586
587 if (*anchorname && !*rulesetname) {
588 struct pfioc_ruleset pr2;
589 int r;
590
591 memset(&pr2, 0, sizeof(pr2));
592 memcpy(pr2.anchor, anchorname, sizeof(pr2.anchor));
593 if (ioctl(dev, DIOCGETRULESETS, &pr2)) {
594 if (errno == EINVAL)
595 fprintf(stderr, "No rulesets in anchor '%s'.\n",
596 anchorname);
597 else
598 err(1, "DIOCGETRULESETS");
599 return (-1);
600 }
601 if (opts & PF_OPT_SHOWALL && pr2.nr)
602 pfctl_print_title("FILTER RULES:");
603 mnr = pr2.nr;
604 for (nr = 0; nr < mnr; ++nr) {
605 pr2.nr = nr;
606 if (ioctl(dev, DIOCGETRULESET, &pr2))
607 err(1, "DIOCGETRULESET");
608 r = pfctl_show_rules(dev, opts, format, anchorname,
609 pr2.name);
610 if (r)
611 return (r);
612 }
613 return (0);
614 }
615
616 memset(&pr, 0, sizeof(pr));
617 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
618 memcpy(pr.ruleset, rulesetname, sizeof(pr.ruleset));
619 if (opts & PF_OPT_SHOWALL) {
620 pr.rule.action = PF_PASS;
621 if (ioctl(dev, DIOCGETRULES, &pr)) {
622 warn("DIOCGETRULES");
623 return (-1);
624 }
625 header++;
626 }
627 pr.rule.action = PF_SCRUB;
628 if (ioctl(dev, DIOCGETRULES, &pr)) {
629 warn("DIOCGETRULES");
630 return (-1);
631 }
632 if (opts & PF_OPT_SHOWALL) {
633 if (format == 0 && (pr.nr > 0 || header))
634 pfctl_print_title("FILTER RULES:");
635 else if (format == 1 && labels)
636 pfctl_print_title("LABEL COUNTERS:");
637 }
638 mnr = pr.nr;
639 for (nr = 0; nr < mnr; ++nr) {
640 pr.nr = nr;
641 if (ioctl(dev, DIOCGETRULE, &pr)) {
642 warn("DIOCGETRULE");
643 return (-1);
644 }
645
646 if (pfctl_get_pool(dev, &pr.rule.rpool,
647 nr, pr.ticket, PF_SCRUB, anchorname, rulesetname) != 0)
648 return (-1);
649
650 switch (format) {
651 case 1:
652 if (pr.rule.label[0]) {
653 printf("%s ", pr.rule.label);
654 printf("%llu %llu %llu\n",
655 (unsigned long long)pr.rule.evaluations,
656 (unsigned long long)pr.rule.packets,
657 (unsigned long long)pr.rule.bytes);
658 }
659 break;
660 default:
661 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
662 labels = 1;
663 print_rule(&pr.rule, rule_numbers);
664 pfctl_print_rule_counters(&pr.rule, opts);
665 }
666 pfctl_clear_pool(&pr.rule.rpool);
667 }
668 pr.rule.action = PF_PASS;
669 if (ioctl(dev, DIOCGETRULES, &pr)) {
670 warn("DIOCGETRULES");
671 return (-1);
672 }
673 mnr = pr.nr;
674 for (nr = 0; nr < mnr; ++nr) {
675 pr.nr = nr;
676 if (ioctl(dev, DIOCGETRULE, &pr)) {
677 warn("DIOCGETRULE");
678 return (-1);
679 }
680
681 if (pfctl_get_pool(dev, &pr.rule.rpool,
682 nr, pr.ticket, PF_PASS, anchorname, rulesetname) != 0)
683 return (-1);
684
685 switch (format) {
686 case 1:
687 if (pr.rule.label[0]) {
688 printf("%s ", pr.rule.label);
689 printf("%llu %llu %llu\n",
690 (unsigned long long)pr.rule.evaluations,
691 (unsigned long long)pr.rule.packets,
692 (unsigned long long)pr.rule.bytes);
693 }
694 break;
695 default:
696 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
697 labels = 1;
698 print_rule(&pr.rule, rule_numbers);
699 pfctl_print_rule_counters(&pr.rule, opts);
700 }
701 pfctl_clear_pool(&pr.rule.rpool);
702 }
703 return (0);
704 }
705
706 int
707 pfctl_show_nat(int dev, int opts, char *anchorname, char *rulesetname)
708 {
709 struct pfioc_rule pr;
710 u_int32_t mnr, nr;
711 static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
712 int i, dotitle = opts & PF_OPT_SHOWALL;
713
714 if (*anchorname && !*rulesetname) {
715 struct pfioc_ruleset pr2;
716 int r;
717
718 memset(&pr2, 0, sizeof(pr2));
719 memcpy(pr2.anchor, anchorname, sizeof(pr2.anchor));
720 if (ioctl(dev, DIOCGETRULESETS, &pr2)) {
721 if (errno == EINVAL)
722 fprintf(stderr, "No rulesets in anchor '%s'.\n",
723 anchorname);
724 else
725 err(1, "DIOCGETRULESETS");
726 return (-1);
727 }
728 mnr = pr2.nr;
729 for (nr = 0; nr < mnr; ++nr) {
730 pr2.nr = nr;
731 if (ioctl(dev, DIOCGETRULESET, &pr2))
732 err(1, "DIOCGETRULESET");
733 r = pfctl_show_nat(dev, opts, anchorname, pr2.name);
734 if (r)
735 return (r);
736 }
737 return (0);
738 }
739
740 memset(&pr, 0, sizeof(pr));
741 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
742 memcpy(pr.ruleset, rulesetname, sizeof(pr.ruleset));
743 for (i = 0; i < 3; i++) {
744 pr.rule.action = nattype[i];
745 if (ioctl(dev, DIOCGETRULES, &pr)) {
746 warn("DIOCGETRULES");
747 return (-1);
748 }
749 mnr = pr.nr;
750 for (nr = 0; nr < mnr; ++nr) {
751 pr.nr = nr;
752 if (ioctl(dev, DIOCGETRULE, &pr)) {
753 warn("DIOCGETRULE");
754 return (-1);
755 }
756 if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
757 pr.ticket, nattype[i], anchorname,
758 rulesetname) != 0)
759 return (-1);
760 if (dotitle) {
761 pfctl_print_title("TRANSLATION RULES:");
762 dotitle = 0;
763 }
764 print_rule(&pr.rule, opts & PF_OPT_VERBOSE2);
765 pfctl_print_rule_counters(&pr.rule, opts);
766 pfctl_clear_pool(&pr.rule.rpool);
767 }
768 }
769 return (0);
770 }
771
772 int
773 pfctl_show_src_nodes(int dev, int opts)
774 {
775 struct pfioc_src_nodes psn;
776 struct pf_src_node *p;
777 char *inbuf = NULL, *newinbuf = NULL;
778 unsigned len = 0;
779 int i;
780
781 memset(&psn, 0, sizeof(psn));
782 for (;;) {
783 psn.psn_len = len;
784 if (len) {
785 newinbuf = realloc(inbuf, len);
786 if (newinbuf == NULL)
787 err(1, "realloc");
788 psn.psn_buf = inbuf = newinbuf;
789 }
790 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
791 warn("DIOCGETSRCNODES");
792 return (-1);
793 }
794 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
795 break;
796 if (len == 0 && psn.psn_len == 0)
797 return (0);
798 if (len == 0 && psn.psn_len != 0)
799 len = psn.psn_len;
800 if (psn.psn_len == 0)
801 return (0); /* no src_nodes */
802 len *= 2;
803 }
804 p = psn.psn_src_nodes;
805 if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
806 pfctl_print_title("SOURCE TRACKING NODES:");
807 for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
808 print_src_node(p, opts);
809 p++;
810 }
811 return (0);
812 }
813
814 int
815 pfctl_show_states(int dev, const char *iface, int opts)
816 {
817 struct pfioc_states ps;
818 struct pf_state *p;
819 char *inbuf = NULL, *newinbuf = NULL;
820 unsigned len = 0;
821 int i, dotitle = (opts & PF_OPT_SHOWALL);
822
823 memset(&ps, 0, sizeof(ps));
824 for (;;) {
825 ps.ps_len = len;
826 if (len) {
827 newinbuf = realloc(inbuf, len);
828 if (newinbuf == NULL)
829 err(1, "realloc");
830 ps.ps_buf = inbuf = newinbuf;
831 }
832 if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
833 warn("DIOCGETSTATES");
834 return (-1);
835 }
836 if (ps.ps_len + sizeof(struct pfioc_states) < len)
837 break;
838 if (len == 0 && ps.ps_len == 0)
839 return (0);
840 if (len == 0 && ps.ps_len != 0)
841 len = ps.ps_len;
842 if (ps.ps_len == 0)
843 return (0); /* no states */
844 len *= 2;
845 }
846 p = ps.ps_states;
847 for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
848 if (iface != NULL && strcmp(p->u.ifname, iface))
849 continue;
850 if (dotitle) {
851 pfctl_print_title("STATES:");
852 dotitle = 0;
853 }
854 print_state(p, opts);
855 }
856 return (0);
857 }
858
859 int
860 pfctl_show_status(int dev, int opts)
861 {
862 struct pf_status status;
863
864 if (ioctl(dev, DIOCGETSTATUS, &status)) {
865 warn("DIOCGETSTATUS");
866 return (-1);
867 }
868 if (opts & PF_OPT_SHOWALL)
869 pfctl_print_title("INFO:");
870 print_status(&status, opts);
871 return (0);
872 }
873
874 int
875 pfctl_show_timeouts(int dev, int opts)
876 {
877 struct pfioc_tm pt;
878 int i;
879
880 if (opts & PF_OPT_SHOWALL)
881 pfctl_print_title("TIMEOUTS:");
882 memset(&pt, 0, sizeof(pt));
883 for (i = 0; pf_timeouts[i].name; i++) {
884 pt.timeout = pf_timeouts[i].timeout;
885 if (ioctl(dev, DIOCGETTIMEOUT, &pt))
886 err(1, "DIOCGETTIMEOUT");
887 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
888 if (i >= PFTM_ADAPTIVE_START && i <= PFTM_ADAPTIVE_END)
889 printf(" states");
890 else
891 printf("s");
892 printf("\n");
893 }
894 return (0);
895
896 }
897
898 int
899 pfctl_show_limits(int dev, int opts)
900 {
901 struct pfioc_limit pl;
902 int i;
903
904 if (opts & PF_OPT_SHOWALL)
905 pfctl_print_title("LIMITS:");
906 memset(&pl, 0, sizeof(pl));
907 for (i = 0; pf_limits[i].name; i++) {
908 pl.index = pf_limits[i].index;
909 if (ioctl(dev, DIOCGETLIMIT, &pl))
910 err(1, "DIOCGETLIMIT");
911 printf("%-10s ", pf_limits[i].name);
912 if (pl.limit == UINT_MAX)
913 printf("unlimited\n");
914 else
915 printf("hard limit %6u\n", pl.limit);
916 }
917 return (0);
918 }
919
920 /* callbacks for rule/nat/rdr/addr */
921 int
922 pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af)
923 {
924 struct pf_pooladdr *pa;
925
926 if ((pf->opts & PF_OPT_NOACTION) == 0) {
927 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr))
928 err(1, "DIOCBEGINADDRS");
929 }
930
931 pf->paddr.af = af;
932 TAILQ_FOREACH(pa, &p->list, entries) {
933 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr));
934 if ((pf->opts & PF_OPT_NOACTION) == 0) {
935 if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr))
936 err(1, "DIOCADDADDR");
937 }
938 }
939 return (0);
940 }
941
942 int
943 pfctl_add_rule(struct pfctl *pf, struct pf_rule *r)
944 {
945 u_int8_t rs_num;
946 struct pfioc_rule pr;
947
948 switch (r->action) {
949 case PF_SCRUB:
950 if ((loadopt & PFCTL_FLAG_FILTER) == 0)
951 return (0);
952 rs_num = PF_RULESET_SCRUB;
953 break;
954 case PF_DROP:
955 case PF_PASS:
956 if ((loadopt & PFCTL_FLAG_FILTER) == 0)
957 return (0);
958 rs_num = PF_RULESET_FILTER;
959 break;
960 case PF_NAT:
961 case PF_NONAT:
962 if ((loadopt & PFCTL_FLAG_NAT) == 0)
963 return (0);
964 rs_num = PF_RULESET_NAT;
965 break;
966 case PF_RDR:
967 case PF_NORDR:
968 if ((loadopt & PFCTL_FLAG_NAT) == 0)
969 return (0);
970 rs_num = PF_RULESET_RDR;
971 break;
972 case PF_BINAT:
973 case PF_NOBINAT:
974 if ((loadopt & PFCTL_FLAG_NAT) == 0)
975 return (0);
976 rs_num = PF_RULESET_BINAT;
977 break;
978 default:
979 errx(1, "Invalid rule type");
980 break;
981 }
982
983 if ((pf->opts & PF_OPT_NOACTION) == 0) {
984 bzero(&pr, sizeof(pr));
985 if (strlcpy(pr.anchor, pf->anchor, sizeof(pr.anchor)) >=
986 sizeof(pr.anchor) ||
987 strlcpy(pr.ruleset, pf->ruleset, sizeof(pr.ruleset)) >=
988 sizeof(pr.ruleset))
989 errx(1, "pfctl_add_rule: strlcpy");
990 if (pfctl_add_pool(pf, &r->rpool, r->af))
991 return (1);
992 pr.ticket = pfctl_get_ticket(pf->trans, rs_num, pf->anchor,
993 pf->ruleset);
994 pr.pool_ticket = pf->paddr.ticket;
995 memcpy(&pr.rule, r, sizeof(pr.rule));
996 if (ioctl(pf->dev, DIOCADDRULE, &pr))
997 err(1, "DIOCADDRULE");
998 }
999 if (pf->opts & PF_OPT_VERBOSE)
1000 print_rule(r, pf->opts & PF_OPT_VERBOSE2);
1001 pfctl_clear_pool(&r->rpool);
1002 return (0);
1003 }
1004
1005 int
1006 pfctl_add_altq(struct pfctl *pf, struct pf_altq *a)
1007 {
1008 if (altqsupport &&
1009 (loadopt & PFCTL_FLAG_ALTQ) != 0) {
1010 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq));
1011 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1012 if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) {
1013 if (errno == ENXIO)
1014 errx(1, "qtype not configured");
1015 else if (errno == ENODEV)
1016 errx(1, "%s: driver does not support "
1017 "altq", a->ifname);
1018 else
1019 err(1, "DIOCADDALTQ");
1020 }
1021 }
1022 pfaltq_store(&pf->paltq->altq);
1023 }
1024 return (0);
1025 }
1026
1027 int
1028 pfctl_rules(int dev, char *filename, int opts, char *anchorname,
1029 char *rulesetname, struct pfr_buffer *trans)
1030 {
1031 #define ERR(x) do { warn(x); goto _error; } while(0)
1032 #define ERRX(x) do { warnx(x); goto _error; } while(0)
1033
1034 FILE *fin;
1035 struct pfr_buffer *t, buf;
1036 struct pfioc_altq pa;
1037 struct pfctl pf;
1038 struct pfr_table trs;
1039 int osize;
1040
1041 if (trans == NULL) {
1042 bzero(&buf, sizeof(buf));
1043 buf.pfrb_type = PFRB_TRANS;
1044 t = &buf;
1045 osize = 0;
1046 } else {
1047 t = trans;
1048 osize = t->pfrb_size;
1049 }
1050
1051 memset(&pa, 0, sizeof(pa));
1052 memset(&pf, 0, sizeof(pf));
1053 memset(&trs, 0, sizeof(trs));
1054 if (strlcpy(trs.pfrt_anchor, anchorname,
1055 sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor) ||
1056 strlcpy(trs.pfrt_ruleset, rulesetname,
1057 sizeof(trs.pfrt_ruleset)) >= sizeof(trs.pfrt_ruleset))
1058 ERRX("pfctl_rules: strlcpy");
1059 if (strcmp(filename, "-") == 0) {
1060 fin = stdin;
1061 infile = "stdin";
1062 } else {
1063 if ((fin = fopen(filename, "r")) == NULL) {
1064 warn("%s", filename);
1065 return (1);
1066 }
1067 infile = filename;
1068 }
1069 pf.dev = dev;
1070 pf.opts = opts;
1071 pf.loadopt = loadopt;
1072 if (anchorname[0])
1073 pf.loadopt &= ~PFCTL_FLAG_ALTQ;
1074 pf.paltq = &pa;
1075 pf.trans = t;
1076 pf.rule_nr = 0;
1077 pf.anchor = anchorname;
1078 pf.ruleset = rulesetname;
1079
1080 if ((opts & PF_OPT_NOACTION) == 0) {
1081 if ((pf.loadopt & PFCTL_FLAG_NAT) != 0) {
1082 if (pfctl_add_trans(t, PF_RULESET_NAT, anchorname,
1083 rulesetname) ||
1084 pfctl_add_trans(t, PF_RULESET_BINAT, anchorname,
1085 rulesetname) ||
1086 pfctl_add_trans(t, PF_RULESET_RDR, anchorname,
1087 rulesetname))
1088 ERR("pfctl_rules");
1089 }
1090 if (((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))) {
1091 if (pfctl_add_trans(t, PF_RULESET_ALTQ, anchorname,
1092 rulesetname))
1093 ERR("pfctl_rules");
1094 }
1095 if ((pf.loadopt & PFCTL_FLAG_FILTER) != 0) {
1096 if (pfctl_add_trans(t, PF_RULESET_SCRUB, anchorname,
1097 rulesetname) ||
1098 pfctl_add_trans(t, PF_RULESET_FILTER, anchorname,
1099 rulesetname))
1100 ERR("pfctl_rules");
1101 }
1102 if (pf.loadopt & PFCTL_FLAG_TABLE) {
1103 if (pfctl_add_trans(t, PF_RULESET_TABLE, anchorname,
1104 rulesetname))
1105 ERR("pfctl_rules");
1106 }
1107 if (pfctl_trans(dev, t, DIOCXBEGIN, osize))
1108 ERR("DIOCXBEGIN");
1109 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ))
1110 pa.ticket = pfctl_get_ticket(t, PF_RULESET_ALTQ,
1111 anchorname, rulesetname);
1112 if (pf.loadopt & PFCTL_FLAG_TABLE)
1113 pf.tticket = pfctl_get_ticket(t, PF_RULESET_TABLE,
1114 anchorname, rulesetname);
1115 }
1116 if (parse_rules(fin, &pf) < 0) {
1117 if ((opts & PF_OPT_NOACTION) == 0)
1118 ERRX("Syntax error in config file: "
1119 "pf rules not loaded");
1120 else
1121 goto _error;
1122 }
1123 if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0))
1124 if (check_commit_altq(dev, opts) != 0)
1125 ERRX("errors in altq config");
1126 if (fin != stdin)
1127 fclose(fin);
1128
1129 /* process "load anchor" directives */
1130 if (!anchorname[0] && !rulesetname[0])
1131 if (pfctl_load_anchors(dev, opts, t) == -1)
1132 ERRX("load anchors");
1133
1134 if (trans == NULL && (opts & PF_OPT_NOACTION) == 0)
1135 if (pfctl_trans(dev, t, DIOCXCOMMIT, 0))
1136 ERR("DIOCXCOMMIT");
1137 return (0);
1138
1139 _error:
1140 if (trans == NULL) { /* main ruleset */
1141 if ((opts & PF_OPT_NOACTION) == 0)
1142 if (pfctl_trans(dev, t, DIOCXROLLBACK, 0))
1143 err(1, "DIOCXROLLBACK");
1144 exit(1);
1145 } else /* sub ruleset */
1146 return (-1);
1147
1148 #undef ERR
1149 #undef ERRX
1150 }
1151
1152 int
1153 pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1154 {
1155 struct pfioc_limit pl;
1156 int i;
1157
1158 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1159 return (0);
1160
1161 memset(&pl, 0, sizeof(pl));
1162 for (i = 0; pf_limits[i].name; i++) {
1163 if (strcasecmp(opt, pf_limits[i].name) == 0) {
1164 pl.index = pf_limits[i].index;
1165 pl.limit = limit;
1166 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1167 if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) {
1168 if (errno == EBUSY) {
1169 warnx("Current pool "
1170 "size exceeds requested "
1171 "hard limit");
1172 return (1);
1173 } else
1174 err(1, "DIOCSETLIMIT");
1175 }
1176 }
1177 break;
1178 }
1179 }
1180 if (pf_limits[i].name == NULL) {
1181 warnx("Bad pool name.");
1182 return (1);
1183 }
1184
1185 if (pf->opts & PF_OPT_VERBOSE)
1186 printf("set limit %s %d\n", opt, limit);
1187
1188 return (0);
1189 }
1190
1191 int
1192 pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1193 {
1194 struct pfioc_tm pt;
1195 int i;
1196
1197 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1198 return (0);
1199
1200 memset(&pt, 0, sizeof(pt));
1201 for (i = 0; pf_timeouts[i].name; i++) {
1202 if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
1203 pt.timeout = pf_timeouts[i].timeout;
1204 break;
1205 }
1206 }
1207
1208 if (pf_timeouts[i].name == NULL) {
1209 warnx("Bad timeout name.");
1210 return (1);
1211 }
1212
1213 pt.seconds = seconds;
1214 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1215 if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt))
1216 err(1, "DIOCSETTIMEOUT");
1217 }
1218
1219 if (pf->opts & PF_OPT_VERBOSE && ! quiet)
1220 printf("set timeout %s %d\n", opt, seconds);
1221
1222 return (0);
1223 }
1224
1225 int
1226 pfctl_set_optimization(struct pfctl *pf, const char *opt)
1227 {
1228 const struct pf_hint *hint;
1229 int i, r;
1230
1231 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1232 return (0);
1233
1234 for (i = 0; pf_hints[i].name; i++)
1235 if (strcasecmp(opt, pf_hints[i].name) == 0)
1236 break;
1237
1238 hint = pf_hints[i].hint;
1239 if (hint == NULL) {
1240 warnx("Bad hint name.");
1241 return (1);
1242 }
1243
1244 for (i = 0; hint[i].name; i++)
1245 if ((r = pfctl_set_timeout(pf, hint[i].name,
1246 hint[i].timeout, 1)))
1247 return (r);
1248
1249 if (pf->opts & PF_OPT_VERBOSE)
1250 printf("set optimization %s\n", opt);
1251
1252 return (0);
1253 }
1254
1255 int
1256 pfctl_set_logif(struct pfctl *pf, char *ifname)
1257 {
1258 struct pfioc_if pi;
1259
1260 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1261 return (0);
1262
1263 memset(&pi, 0, sizeof(pi));
1264 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1265 if (!strcmp(ifname, "none"))
1266 bzero(pi.ifname, sizeof(pi.ifname));
1267 else {
1268 if (strlcpy(pi.ifname, ifname,
1269 sizeof(pi.ifname)) >= sizeof(pi.ifname))
1270 errx(1, "pfctl_set_logif: strlcpy");
1271 }
1272 if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi))
1273 err(1, "DIOCSETSTATUSIF");
1274 }
1275
1276 if (pf->opts & PF_OPT_VERBOSE)
1277 printf("set loginterface %s\n", ifname);
1278
1279 return (0);
1280 }
1281
1282 int
1283 pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
1284 {
1285 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1286 return (0);
1287
1288 hostid = htonl(hostid);
1289
1290 if ((pf->opts & PF_OPT_NOACTION) == 0) {
1291 if (ioctl(dev_fd, DIOCSETHOSTID, &hostid))
1292 err(1, "DIOCSETHOSTID");
1293 }
1294
1295 if (pf->opts & PF_OPT_VERBOSE)
1296 printf("set hostid 0x%08x\n", ntohl(hostid));
1297
1298 return (0);
1299 }
1300
1301 int
1302 pfctl_set_debug(struct pfctl *pf, char *d)
1303 {
1304 u_int32_t level;
1305
1306 if ((loadopt & PFCTL_FLAG_OPTION) == 0)
1307 return (0);
1308
1309 if (!strcmp(d, "none"))
1310 level = PF_DEBUG_NONE;
1311 else if (!strcmp(d, "urgent"))
1312 level = PF_DEBUG_URGENT;
1313 else if (!strcmp(d, "misc"))
1314 level = PF_DEBUG_MISC;
1315 else if (!strcmp(d, "loud"))
1316 level = PF_DEBUG_NOISY;
1317 else {
1318 warnx("unknown debug level \"%s\"", d);
1319 return (-1);
1320 }
1321
1322 if ((pf->opts & PF_OPT_NOACTION) == 0)
1323 if (ioctl(dev_fd, DIOCSETDEBUG, &level))
1324 err(1, "DIOCSETDEBUG");
1325
1326 if (pf->opts & PF_OPT_VERBOSE)
1327 printf("set debug %s\n", d);
1328
1329 return (0);
1330 }
1331
1332 int
1333 pfctl_debug(int dev, u_int32_t level, int opts)
1334 {
1335 if (ioctl(dev, DIOCSETDEBUG, &level))
1336 err(1, "DIOCSETDEBUG");
1337 if ((opts & PF_OPT_QUIET) == 0) {
1338 fprintf(stderr, "debug level set to '");
1339 switch (level) {
1340 case PF_DEBUG_NONE:
1341 fprintf(stderr, "none");
1342 break;
1343 case PF_DEBUG_URGENT:
1344 fprintf(stderr, "urgent");
1345 break;
1346 case PF_DEBUG_MISC:
1347 fprintf(stderr, "misc");
1348 break;
1349 case PF_DEBUG_NOISY:
1350 fprintf(stderr, "loud");
1351 break;
1352 default:
1353 fprintf(stderr, "<invalid>");
1354 break;
1355 }
1356 fprintf(stderr, "'\n");
1357 }
1358 return (0);
1359 }
1360
1361 int
1362 pfctl_clear_rule_counters(int dev, int opts)
1363 {
1364 if (ioctl(dev, DIOCCLRRULECTRS))
1365 err(1, "DIOCCLRRULECTRS");
1366 if ((opts & PF_OPT_QUIET) == 0)
1367 fprintf(stderr, "pf: rule counters cleared\n");
1368 return (0);
1369 }
1370
1371 int
1372 pfctl_test_altqsupport(int dev, int opts)
1373 {
1374 struct pfioc_altq pa;
1375
1376 if (ioctl(dev, DIOCGETALTQS, &pa)) {
1377 if (errno == ENODEV) {
1378 if (!(opts & PF_OPT_QUIET))
1379 fprintf(stderr, "No ALTQ support in kernel\n"
1380 "ALTQ related functions disabled\n");
1381 return (0);
1382 } else
1383 err(1, "DIOCGETALTQS");
1384 }
1385 return (1);
1386 }
1387
1388 int
1389 pfctl_show_anchors(int dev, int opts, char *anchorname)
1390 {
1391 u_int32_t nr, mnr;
1392
1393 if (!*anchorname) {
1394 struct pfioc_anchor pa;
1395
1396 memset(&pa, 0, sizeof(pa));
1397 if (ioctl(dev, DIOCGETANCHORS, &pa)) {
1398 warn("DIOCGETANCHORS");
1399 return (-1);
1400 }
1401 mnr = pa.nr;
1402 for (nr = 0; nr < mnr; ++nr) {
1403 pa.nr = nr;
1404 if (ioctl(dev, DIOCGETANCHOR, &pa)) {
1405 warn("DIOCGETANCHOR");
1406 return (-1);
1407 }
1408 if (!(opts & PF_OPT_VERBOSE) &&
1409 !strcmp(pa.name, PF_RESERVED_ANCHOR))
1410 continue;
1411 printf(" %s\n", pa.name);
1412 }
1413 } else {
1414 struct pfioc_ruleset pr;
1415
1416 memset(&pr, 0, sizeof(pr));
1417 memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
1418 if (ioctl(dev, DIOCGETRULESETS, &pr)) {
1419 if (errno == EINVAL)
1420 fprintf(stderr, "No rulesets in anchor '%s'.\n",
1421 anchorname);
1422 else
1423 err(1, "DIOCGETRULESETS");
1424 return (-1);
1425 }
1426 mnr = pr.nr;
1427 for (nr = 0; nr < mnr; ++nr) {
1428 pr.nr = nr;
1429 if (ioctl(dev, DIOCGETRULESET, &pr))
1430 err(1, "DIOCGETRULESET");
1431 printf(" %s:%s\n", pr.anchor, pr.name);
1432 }
1433 }
1434 return (0);
1435 }
1436
1437 const char *
1438 pfctl_lookup_option(char *cmd, const char **list)
1439 {
1440 if (cmd != NULL && *cmd)
1441 for (; *list; list++)
1442 if (!strncmp(cmd, *list, strlen(cmd)))
1443 return (*list);
1444 return (NULL);
1445 }
1446
1447 int
1448 main(int argc, char *argv[])
1449 {
1450 int error = 0;
1451 int ch;
1452 int mode = O_RDONLY;
1453 int opts = 0;
1454 char anchorname[PF_ANCHOR_NAME_SIZE];
1455 char rulesetname[PF_RULESET_NAME_SIZE];
1456
1457 if (argc < 2)
1458 usage();
1459
1460 while ((ch = getopt(argc, argv,
1461 "a:AdD:eqf:F:ghi:k:nNOp:rRs:t:T:vx:z")) != -1) {
1462 switch (ch) {
1463 case 'a':
1464 anchoropt = optarg;
1465 break;
1466 case 'd':
1467 opts |= PF_OPT_DISABLE;
1468 mode = O_RDWR;
1469 break;
1470 case 'D':
1471 if (pfctl_cmdline_symset(optarg) < 0)
1472 warnx("could not parse macro definition %s",
1473 optarg);
1474 break;
1475 case 'e':
1476 opts |= PF_OPT_ENABLE;
1477 mode = O_RDWR;
1478 break;
1479 case 'q':
1480 opts |= PF_OPT_QUIET;
1481 break;
1482 case 'F':
1483 clearopt = pfctl_lookup_option(optarg, clearopt_list);
1484 if (clearopt == NULL) {
1485 warnx("Unknown flush modifier '%s'", optarg);
1486 usage();
1487 }
1488 mode = O_RDWR;
1489 break;
1490 case 'i':
1491 ifaceopt = optarg;
1492 break;
1493 case 'k':
1494 if (state_killers >= 2) {
1495 warnx("can only specify -k twice");
1496 usage();
1497 /* NOTREACHED */
1498 }
1499 state_kill[state_killers++] = optarg;
1500 mode = O_RDWR;
1501 break;
1502 case 'n':
1503 opts |= PF_OPT_NOACTION;
1504 break;
1505 case 'N':
1506 loadopt |= PFCTL_FLAG_NAT;
1507 break;
1508 case 'r':
1509 opts |= PF_OPT_USEDNS;
1510 break;
1511 case 'f':
1512 rulesopt = optarg;
1513 mode = O_RDWR;
1514 break;
1515 case 'g':
1516 opts |= PF_OPT_DEBUG;
1517 break;
1518 case 'A':
1519 loadopt |= PFCTL_FLAG_ALTQ;
1520 break;
1521 case 'R':
1522 loadopt |= PFCTL_FLAG_FILTER;
1523 break;
1524 case 'O':
1525 loadopt |= PFCTL_FLAG_OPTION;
1526 break;
1527 case 'p':
1528 pf_device = optarg;
1529 break;
1530 case 's':
1531 showopt = pfctl_lookup_option(optarg, showopt_list);
1532 if (showopt == NULL) {
1533 warnx("Unknown show modifier '%s'", optarg);
1534 usage();
1535 }
1536 break;
1537 case 't':
1538 tableopt = optarg;
1539 break;
1540 case 'T':
1541 tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
1542 if (tblcmdopt == NULL) {
1543 warnx("Unknown table command '%s'", optarg);
1544 usage();
1545 }
1546 break;
1547 case 'v':
1548 if (opts & PF_OPT_VERBOSE)
1549 opts |= PF_OPT_VERBOSE2;
1550 opts |= PF_OPT_VERBOSE;
1551 break;
1552 case 'x':
1553 debugopt = pfctl_lookup_option(optarg, debugopt_list);
1554 if (debugopt == NULL) {
1555 warnx("Unknown debug level '%s'", optarg);
1556 usage();
1557 }
1558 mode = O_RDWR;
1559 break;
1560 case 'z':
1561 opts |= PF_OPT_CLRRULECTRS;
1562 mode = O_RDWR;
1563 break;
1564 case 'h':
1565 /* FALLTHROUGH */
1566 default:
1567 usage();
1568 /* NOTREACHED */
1569 }
1570 }
1571
1572 if (tblcmdopt != NULL) {
1573 argc -= optind;
1574 argv += optind;
1575 ch = *tblcmdopt;
1576 if (ch == 'l') {
1577 loadopt |= PFCTL_FLAG_TABLE;
1578 tblcmdopt = NULL;
1579 } else
1580 mode = strchr("acdfkrz", ch) ? O_RDWR : O_RDONLY;
1581 } else if (argc != optind) {
1582 warnx("unknown command line argument: %s ...", argv[optind]);
1583 usage();
1584 /* NOTREACHED */
1585 }
1586 if (loadopt == 0)
1587 loadopt = ~0;
1588
1589 memset(anchorname, 0, sizeof(anchorname));
1590 memset(rulesetname, 0, sizeof(rulesetname));
1591 if (anchoropt != NULL) {
1592 char *t;
1593
1594 if ((t = strchr(anchoropt, ':')) == NULL) {
1595 if (strlcpy(anchorname, anchoropt,
1596 sizeof(anchorname)) >= sizeof(anchorname))
1597 errx(1, "anchor name '%s' too long",
1598 anchoropt);
1599 } else {
1600 char *p;
1601
1602 if ((p = strdup(anchoropt)) == NULL)
1603 err(1, "anchoropt: strdup");
1604 t = strsep(&p, ":");
1605 if (*t == '\0' || *p == '\0')
1606 errx(1, "anchor '%s' invalid", anchoropt);
1607 if (strlcpy(anchorname, t, sizeof(anchorname)) >=
1608 sizeof(anchorname))
1609 errx(1, "anchor name '%s' too long", t);
1610 if (strlcpy(rulesetname, p, sizeof(rulesetname)) >=
1611 sizeof(rulesetname))
1612 errx(1, "ruleset name '%s' too long", p);
1613 free(t); /* not p */
1614 }
1615 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE;
1616 }
1617
1618 if ((opts & PF_OPT_NOACTION) == 0) {
1619 dev_fd = open(pf_device, mode);
1620 if (dev_fd == -1)
1621 err(1, "%s", pf_device);
1622 altqsupport = pfctl_test_altqsupport(dev_fd, opts);
1623 } else {
1624 dev_fd = open(pf_device, O_RDONLY);
1625 if (dev_fd >= 0)
1626 opts |= PF_OPT_DUMMYACTION;
1627 /* turn off options */
1628 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE);
1629 clearopt = showopt = debugopt = NULL;
1630 altqsupport = 1;
1631 }
1632
1633 if (opts & PF_OPT_DISABLE)
1634 if (pfctl_disable(dev_fd, opts))
1635 error = 1;
1636
1637 if (showopt != NULL) {
1638 switch (*showopt) {
1639 case 'A':
1640 pfctl_show_anchors(dev_fd, opts, anchorname);
1641 break;
1642 case 'r':
1643 pfctl_load_fingerprints(dev_fd, opts);
1644 pfctl_show_rules(dev_fd, opts, 0, anchorname,
1645 rulesetname);
1646 break;
1647 case 'l':
1648 pfctl_load_fingerprints(dev_fd, opts);
1649 pfctl_show_rules(dev_fd, opts, 1, anchorname,
1650 rulesetname);
1651 break;
1652 case 'n':
1653 pfctl_load_fingerprints(dev_fd, opts);
1654 pfctl_show_nat(dev_fd, opts, anchorname, rulesetname);
1655 break;
1656 case 'q':
1657 pfctl_show_altq(dev_fd, ifaceopt, opts,
1658 opts & PF_OPT_VERBOSE2);
1659 break;
1660 case 's':
1661 pfctl_show_states(dev_fd, ifaceopt, opts);
1662 break;
1663 case 'S':
1664 pfctl_show_src_nodes(dev_fd, opts);
1665 break;
1666 case 'i':
1667 pfctl_show_status(dev_fd, opts);
1668 break;
1669 case 't':
1670 pfctl_show_timeouts(dev_fd, opts);
1671 break;
1672 case 'm':
1673 pfctl_show_limits(dev_fd, opts);
1674 break;
1675 case 'a':
1676 opts |= PF_OPT_SHOWALL;
1677 pfctl_load_fingerprints(dev_fd, opts);
1678
1679 pfctl_show_nat(dev_fd, opts, anchorname, rulesetname);
1680 pfctl_show_rules(dev_fd, opts, 0, anchorname,
1681 rulesetname);
1682 pfctl_show_altq(dev_fd, ifaceopt, opts, 0);
1683 pfctl_show_states(dev_fd, ifaceopt, opts);
1684 pfctl_show_src_nodes(dev_fd, opts);
1685 pfctl_show_status(dev_fd, opts);
1686 pfctl_show_rules(dev_fd, opts, 1, anchorname, rulesetname);
1687 pfctl_show_timeouts(dev_fd, opts);
1688 pfctl_show_limits(dev_fd, opts);
1689 pfctl_show_tables(anchorname, rulesetname, opts);
1690 pfctl_show_fingerprints(opts);
1691 break;
1692 case 'T':
1693 pfctl_show_tables(anchorname, rulesetname, opts);
1694 break;
1695 case 'o':
1696 pfctl_load_fingerprints(dev_fd, opts);
1697 pfctl_show_fingerprints(opts);
1698 break;
1699 case 'I':
1700 pfctl_show_ifaces(ifaceopt, opts);
1701 break;
1702 }
1703 }
1704
1705 if (clearopt != NULL) {
1706 switch (*clearopt) {
1707 case 'r':
1708 pfctl_clear_rules(dev_fd, opts, anchorname, rulesetname);
1709 break;
1710 case 'n':
1711 pfctl_clear_nat(dev_fd, opts, anchorname, rulesetname);
1712 break;
1713 case 'q':
1714 pfctl_clear_altq(dev_fd, opts);
1715 break;
1716 case 's':
1717 pfctl_clear_states(dev_fd, ifaceopt, opts);
1718 break;
1719 case 'S':
1720 pfctl_clear_src_nodes(dev_fd, opts);
1721 break;
1722 case 'i':
1723 pfctl_clear_stats(dev_fd, opts);
1724 break;
1725 case 'a':
1726 pfctl_clear_rules(dev_fd, opts, anchorname, rulesetname);
1727 pfctl_clear_nat(dev_fd, opts, anchorname, rulesetname);
1728 pfctl_clear_tables(anchorname, rulesetname, opts);
1729 if (!*anchorname && !*rulesetname) {
1730 pfctl_clear_altq(dev_fd, opts);
1731 pfctl_clear_states(dev_fd, ifaceopt, opts);
1732 pfctl_clear_src_nodes(dev_fd, opts);
1733 pfctl_clear_stats(dev_fd, opts);
1734 pfctl_clear_fingerprints(dev_fd, opts);
1735 }
1736 break;
1737 case 'o':
1738 pfctl_clear_fingerprints(dev_fd, opts);
1739 break;
1740 case 'T':
1741 pfctl_clear_tables(anchorname, rulesetname, opts);
1742 break;
1743 }
1744 }
1745 if (state_killers)
1746 pfctl_kill_states(dev_fd, ifaceopt, opts);
1747
1748 if (tblcmdopt != NULL) {
1749 error = pfctl_command_tables(argc, argv, tableopt,
1750 tblcmdopt, rulesopt, anchorname, rulesetname, opts);
1751 rulesopt = NULL;
1752 }
1753
1754 if (rulesopt != NULL)
1755 if (pfctl_file_fingerprints(dev_fd, opts, PF_OSFP_FILE))
1756 error = 1;
1757
1758 if (rulesopt != NULL) {
1759 if (pfctl_rules(dev_fd, rulesopt, opts, anchorname, rulesetname,
1760 NULL))
1761 error = 1;
1762 else if (!(opts & PF_OPT_NOACTION) &&
1763 (loadopt & PFCTL_FLAG_TABLE))
1764 warn_namespace_collision(NULL);
1765 }
1766
1767 if (opts & PF_OPT_ENABLE)
1768 if (pfctl_enable(dev_fd, opts))
1769 error = 1;
1770
1771 if (debugopt != NULL) {
1772 switch (*debugopt) {
1773 case 'n':
1774 pfctl_debug(dev_fd, PF_DEBUG_NONE, opts);
1775 break;
1776 case 'u':
1777 pfctl_debug(dev_fd, PF_DEBUG_URGENT, opts);
1778 break;
1779 case 'm':
1780 pfctl_debug(dev_fd, PF_DEBUG_MISC, opts);
1781 break;
1782 case 'l':
1783 pfctl_debug(dev_fd, PF_DEBUG_NOISY, opts);
1784 break;
1785 }
1786 }
1787
1788 if (opts & PF_OPT_CLRRULECTRS) {
1789 if (pfctl_clear_rule_counters(dev_fd, opts))
1790 error = 1;
1791 }
1792 exit(error);
1793 }
MP support for (parts of) the network stack