pfctl.c revision 261937
1/* $OpenBSD: pfctl.c,v 1.278 2008/08/31 20:18:17 jmc Exp $ */ 2 3/* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 */ 33 34#include <sys/cdefs.h> 35__FBSDID("$FreeBSD: head/sbin/pfctl/pfctl.c 261937 2014-02-15 16:22:51Z glebius $"); 36 37#include <sys/types.h> 38#include <sys/ioctl.h> 39#include <sys/socket.h> 40#include <sys/stat.h> 41#include <sys/endian.h> 42 43#include <net/if.h> 44#include <netinet/in.h> 45#include <net/pfvar.h> 46#include <arpa/inet.h> 47#include <altq/altq.h> 48#include <sys/sysctl.h> 49 50#include <err.h> 51#include <errno.h> 52#include <fcntl.h> 53#include <inttypes.h> 54#include <limits.h> 55#include <netdb.h> 56#include <stdio.h> 57#include <stdlib.h> 58#include <string.h> 59#include <unistd.h> 60 61#include "pfctl_parser.h" 62#include "pfctl.h" 63 64void usage(void); 65int pfctl_enable(int, int); 66int pfctl_disable(int, int); 67int pfctl_clear_stats(int, int); 68int pfctl_clear_interface_flags(int, int); 69int pfctl_clear_rules(int, int, char *); 70int pfctl_clear_nat(int, int, char *); 71int pfctl_clear_altq(int, int); 72int pfctl_clear_src_nodes(int, int); 73int pfctl_clear_states(int, const char *, int); 74void pfctl_addrprefix(char *, struct pf_addr *); 75int pfctl_kill_src_nodes(int, const char *, int); 76int pfctl_net_kill_states(int, const char *, int); 77int pfctl_label_kill_states(int, const char *, int); 78int pfctl_id_kill_states(int, const char *, int); 79void pfctl_init_options(struct pfctl *); 80int pfctl_load_options(struct pfctl *); 81int pfctl_load_limit(struct pfctl *, unsigned int, unsigned int); 82int pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int); 83int pfctl_load_debug(struct pfctl *, unsigned int); 84int pfctl_load_logif(struct pfctl *, char *); 85int pfctl_load_hostid(struct pfctl *, unsigned int); 86int pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int, 87 char *); 88void pfctl_print_rule_counters(struct pf_rule *, int); 89int pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int); 90int pfctl_show_nat(int, int, char *); 91int pfctl_show_src_nodes(int, int); 92int pfctl_show_states(int, const char *, int); 93int pfctl_show_status(int, int); 94int pfctl_show_timeouts(int, int); 95int pfctl_show_limits(int, int); 96void pfctl_debug(int, u_int32_t, int); 97int pfctl_test_altqsupport(int, int); 98int pfctl_show_anchors(int, int, char *); 99int pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *); 100int pfctl_load_ruleset(struct pfctl *, char *, 101 struct pf_ruleset *, int, int); 102int pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int); 103const char *pfctl_lookup_option(char *, const char **); 104 105struct pf_anchor_global pf_anchors; 106struct pf_anchor pf_main_anchor; 107 108const char *clearopt; 109char *rulesopt; 110const char *showopt; 111const char *debugopt; 112char *anchoropt; 113const char *optiopt = NULL; 114char *pf_device = "/dev/pf"; 115char *ifaceopt; 116char *tableopt; 117const char *tblcmdopt; 118int src_node_killers; 119char *src_node_kill[2]; 120int state_killers; 121char *state_kill[2]; 122int loadopt; 123int altqsupport; 124 125int dev = -1; 126int first_title = 1; 127int labels = 0; 128 129#define INDENT(d, o) do { \ 130 if (o) { \ 131 int i; \ 132 for (i=0; i < d; i++) \ 133 printf(" "); \ 134 } \ 135 } while (0); \ 136 137 138static const struct { 139 const char *name; 140 int index; 141} pf_limits[] = { 142 { "states", PF_LIMIT_STATES }, 143 { "src-nodes", PF_LIMIT_SRC_NODES }, 144 { "frags", PF_LIMIT_FRAGS }, 145 { "table-entries", PF_LIMIT_TABLE_ENTRIES }, 146 { NULL, 0 } 147}; 148 149struct pf_hint { 150 const char *name; 151 int timeout; 152}; 153static const struct pf_hint pf_hint_normal[] = { 154 { "tcp.first", 2 * 60 }, 155 { "tcp.opening", 30 }, 156 { "tcp.established", 24 * 60 * 60 }, 157 { "tcp.closing", 15 * 60 }, 158 { "tcp.finwait", 45 }, 159 { "tcp.closed", 90 }, 160 { "tcp.tsdiff", 30 }, 161 { NULL, 0 } 162}; 163static const struct pf_hint pf_hint_satellite[] = { 164 { "tcp.first", 3 * 60 }, 165 { "tcp.opening", 30 + 5 }, 166 { "tcp.established", 24 * 60 * 60 }, 167 { "tcp.closing", 15 * 60 + 5 }, 168 { "tcp.finwait", 45 + 5 }, 169 { "tcp.closed", 90 + 5 }, 170 { "tcp.tsdiff", 60 }, 171 { NULL, 0 } 172}; 173static const struct pf_hint pf_hint_conservative[] = { 174 { "tcp.first", 60 * 60 }, 175 { "tcp.opening", 15 * 60 }, 176 { "tcp.established", 5 * 24 * 60 * 60 }, 177 { "tcp.closing", 60 * 60 }, 178 { "tcp.finwait", 10 * 60 }, 179 { "tcp.closed", 3 * 60 }, 180 { "tcp.tsdiff", 60 }, 181 { NULL, 0 } 182}; 183static const struct pf_hint pf_hint_aggressive[] = { 184 { "tcp.first", 30 }, 185 { "tcp.opening", 5 }, 186 { "tcp.established", 5 * 60 * 60 }, 187 { "tcp.closing", 60 }, 188 { "tcp.finwait", 30 }, 189 { "tcp.closed", 30 }, 190 { "tcp.tsdiff", 10 }, 191 { NULL, 0 } 192}; 193 194static const struct { 195 const char *name; 196 const struct pf_hint *hint; 197} pf_hints[] = { 198 { "normal", pf_hint_normal }, 199 { "satellite", pf_hint_satellite }, 200 { "high-latency", pf_hint_satellite }, 201 { "conservative", pf_hint_conservative }, 202 { "aggressive", pf_hint_aggressive }, 203 { NULL, NULL } 204}; 205 206static const char *clearopt_list[] = { 207 "nat", "queue", "rules", "Sources", 208 "states", "info", "Tables", "osfp", "all", NULL 209}; 210 211static const char *showopt_list[] = { 212 "nat", "queue", "rules", "Anchors", "Sources", "states", "info", 213 "Interfaces", "labels", "timeouts", "memory", "Tables", "osfp", 214 "all", NULL 215}; 216 217static const char *tblcmdopt_list[] = { 218 "kill", "flush", "add", "delete", "load", "replace", "show", 219 "test", "zero", "expire", NULL 220}; 221 222static const char *debugopt_list[] = { 223 "none", "urgent", "misc", "loud", NULL 224}; 225 226static const char *optiopt_list[] = { 227 "none", "basic", "profile", NULL 228}; 229 230void 231usage(void) 232{ 233 extern char *__progname; 234 235 fprintf(stderr, 236"usage: %s [-AdeghmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]\n" 237 "\t[-f file] [-i interface] [-K host | network]\n" 238 "\t[-k host | network | label | id] [-o level] [-p device]\n" 239 "\t[-s modifier] [-t table -T command [address ...]] [-x level]\n", 240 __progname); 241 242 exit(1); 243} 244 245int 246pfctl_enable(int dev, int opts) 247{ 248 if (ioctl(dev, DIOCSTART)) { 249 if (errno == EEXIST) 250 errx(1, "pf already enabled"); 251 else if (errno == ESRCH) 252 errx(1, "pfil registeration failed"); 253 else 254 err(1, "DIOCSTART"); 255 } 256 if ((opts & PF_OPT_QUIET) == 0) 257 fprintf(stderr, "pf enabled\n"); 258 259 if (altqsupport && ioctl(dev, DIOCSTARTALTQ)) 260 if (errno != EEXIST) 261 err(1, "DIOCSTARTALTQ"); 262 263 return (0); 264} 265 266int 267pfctl_disable(int dev, int opts) 268{ 269 if (ioctl(dev, DIOCSTOP)) { 270 if (errno == ENOENT) 271 errx(1, "pf not enabled"); 272 else 273 err(1, "DIOCSTOP"); 274 } 275 if ((opts & PF_OPT_QUIET) == 0) 276 fprintf(stderr, "pf disabled\n"); 277 278 if (altqsupport && ioctl(dev, DIOCSTOPALTQ)) 279 if (errno != ENOENT) 280 err(1, "DIOCSTOPALTQ"); 281 282 return (0); 283} 284 285int 286pfctl_clear_stats(int dev, int opts) 287{ 288 if (ioctl(dev, DIOCCLRSTATUS)) 289 err(1, "DIOCCLRSTATUS"); 290 if ((opts & PF_OPT_QUIET) == 0) 291 fprintf(stderr, "pf: statistics cleared\n"); 292 return (0); 293} 294 295int 296pfctl_clear_interface_flags(int dev, int opts) 297{ 298 struct pfioc_iface pi; 299 300 if ((opts & PF_OPT_NOACTION) == 0) { 301 bzero(&pi, sizeof(pi)); 302 pi.pfiio_flags = PFI_IFLAG_SKIP; 303 304 if (ioctl(dev, DIOCCLRIFFLAG, &pi)) 305 err(1, "DIOCCLRIFFLAG"); 306 if ((opts & PF_OPT_QUIET) == 0) 307 fprintf(stderr, "pf: interface flags reset\n"); 308 } 309 return (0); 310} 311 312int 313pfctl_clear_rules(int dev, int opts, char *anchorname) 314{ 315 struct pfr_buffer t; 316 317 memset(&t, 0, sizeof(t)); 318 t.pfrb_type = PFRB_TRANS; 319 if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) || 320 pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) || 321 pfctl_trans(dev, &t, DIOCXBEGIN, 0) || 322 pfctl_trans(dev, &t, DIOCXCOMMIT, 0)) 323 err(1, "pfctl_clear_rules"); 324 if ((opts & PF_OPT_QUIET) == 0) 325 fprintf(stderr, "rules cleared\n"); 326 return (0); 327} 328 329int 330pfctl_clear_nat(int dev, int opts, char *anchorname) 331{ 332 struct pfr_buffer t; 333 334 memset(&t, 0, sizeof(t)); 335 t.pfrb_type = PFRB_TRANS; 336 if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) || 337 pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) || 338 pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) || 339 pfctl_trans(dev, &t, DIOCXBEGIN, 0) || 340 pfctl_trans(dev, &t, DIOCXCOMMIT, 0)) 341 err(1, "pfctl_clear_nat"); 342 if ((opts & PF_OPT_QUIET) == 0) 343 fprintf(stderr, "nat cleared\n"); 344 return (0); 345} 346 347int 348pfctl_clear_altq(int dev, int opts) 349{ 350 struct pfr_buffer t; 351 352 if (!altqsupport) 353 return (-1); 354 memset(&t, 0, sizeof(t)); 355 t.pfrb_type = PFRB_TRANS; 356 if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") || 357 pfctl_trans(dev, &t, DIOCXBEGIN, 0) || 358 pfctl_trans(dev, &t, DIOCXCOMMIT, 0)) 359 err(1, "pfctl_clear_altq"); 360 if ((opts & PF_OPT_QUIET) == 0) 361 fprintf(stderr, "altq cleared\n"); 362 return (0); 363} 364 365int 366pfctl_clear_src_nodes(int dev, int opts) 367{ 368 if (ioctl(dev, DIOCCLRSRCNODES)) 369 err(1, "DIOCCLRSRCNODES"); 370 if ((opts & PF_OPT_QUIET) == 0) 371 fprintf(stderr, "source tracking entries cleared\n"); 372 return (0); 373} 374 375int 376pfctl_clear_states(int dev, const char *iface, int opts) 377{ 378 struct pfioc_state_kill psk; 379 380 memset(&psk, 0, sizeof(psk)); 381 if (iface != NULL && strlcpy(psk.psk_ifname, iface, 382 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname)) 383 errx(1, "invalid interface: %s", iface); 384 385 if (ioctl(dev, DIOCCLRSTATES, &psk)) 386 err(1, "DIOCCLRSTATES"); 387 if ((opts & PF_OPT_QUIET) == 0) 388 fprintf(stderr, "%d states cleared\n", psk.psk_killed); 389 return (0); 390} 391 392void 393pfctl_addrprefix(char *addr, struct pf_addr *mask) 394{ 395 char *p; 396 const char *errstr; 397 int prefix, ret_ga, q, r; 398 struct addrinfo hints, *res; 399 400 if ((p = strchr(addr, '/')) == NULL) 401 return; 402 403 *p++ = '\0'; 404 prefix = strtonum(p, 0, 128, &errstr); 405 if (errstr) 406 errx(1, "prefix is %s: %s", errstr, p); 407 408 bzero(&hints, sizeof(hints)); 409 /* prefix only with numeric addresses */ 410 hints.ai_flags |= AI_NUMERICHOST; 411 412 if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) { 413 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga)); 414 /* NOTREACHED */ 415 } 416 417 if (res->ai_family == AF_INET && prefix > 32) 418 errx(1, "prefix too long for AF_INET"); 419 else if (res->ai_family == AF_INET6 && prefix > 128) 420 errx(1, "prefix too long for AF_INET6"); 421 422 q = prefix >> 3; 423 r = prefix & 7; 424 switch (res->ai_family) { 425 case AF_INET: 426 bzero(&mask->v4, sizeof(mask->v4)); 427 mask->v4.s_addr = htonl((u_int32_t) 428 (0xffffffffffULL << (32 - prefix))); 429 break; 430 case AF_INET6: 431 bzero(&mask->v6, sizeof(mask->v6)); 432 if (q > 0) 433 memset((void *)&mask->v6, 0xff, q); 434 if (r > 0) 435 *((u_char *)&mask->v6 + q) = 436 (0xff00 >> r) & 0xff; 437 break; 438 } 439 freeaddrinfo(res); 440} 441 442int 443pfctl_kill_src_nodes(int dev, const char *iface, int opts) 444{ 445 struct pfioc_src_node_kill psnk; 446 struct addrinfo *res[2], *resp[2]; 447 struct sockaddr last_src, last_dst; 448 int killed, sources, dests; 449 int ret_ga; 450 451 killed = sources = dests = 0; 452 453 memset(&psnk, 0, sizeof(psnk)); 454 memset(&psnk.psnk_src.addr.v.a.mask, 0xff, 455 sizeof(psnk.psnk_src.addr.v.a.mask)); 456 memset(&last_src, 0xff, sizeof(last_src)); 457 memset(&last_dst, 0xff, sizeof(last_dst)); 458 459 pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask); 460 461 if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) { 462 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga)); 463 /* NOTREACHED */ 464 } 465 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) { 466 if (resp[0]->ai_addr == NULL) 467 continue; 468 /* We get lots of duplicates. Catch the easy ones */ 469 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0) 470 continue; 471 last_src = *(struct sockaddr *)resp[0]->ai_addr; 472 473 psnk.psnk_af = resp[0]->ai_family; 474 sources++; 475 476 if (psnk.psnk_af == AF_INET) 477 psnk.psnk_src.addr.v.a.addr.v4 = 478 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr; 479 else if (psnk.psnk_af == AF_INET6) 480 psnk.psnk_src.addr.v.a.addr.v6 = 481 ((struct sockaddr_in6 *)resp[0]->ai_addr)-> 482 sin6_addr; 483 else 484 errx(1, "Unknown address family %d", psnk.psnk_af); 485 486 if (src_node_killers > 1) { 487 dests = 0; 488 memset(&psnk.psnk_dst.addr.v.a.mask, 0xff, 489 sizeof(psnk.psnk_dst.addr.v.a.mask)); 490 memset(&last_dst, 0xff, sizeof(last_dst)); 491 pfctl_addrprefix(src_node_kill[1], 492 &psnk.psnk_dst.addr.v.a.mask); 493 if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL, 494 &res[1]))) { 495 errx(1, "getaddrinfo: %s", 496 gai_strerror(ret_ga)); 497 /* NOTREACHED */ 498 } 499 for (resp[1] = res[1]; resp[1]; 500 resp[1] = resp[1]->ai_next) { 501 if (resp[1]->ai_addr == NULL) 502 continue; 503 if (psnk.psnk_af != resp[1]->ai_family) 504 continue; 505 506 if (memcmp(&last_dst, resp[1]->ai_addr, 507 sizeof(last_dst)) == 0) 508 continue; 509 last_dst = *(struct sockaddr *)resp[1]->ai_addr; 510 511 dests++; 512 513 if (psnk.psnk_af == AF_INET) 514 psnk.psnk_dst.addr.v.a.addr.v4 = 515 ((struct sockaddr_in *)resp[1]-> 516 ai_addr)->sin_addr; 517 else if (psnk.psnk_af == AF_INET6) 518 psnk.psnk_dst.addr.v.a.addr.v6 = 519 ((struct sockaddr_in6 *)resp[1]-> 520 ai_addr)->sin6_addr; 521 else 522 errx(1, "Unknown address family %d", 523 psnk.psnk_af); 524 525 if (ioctl(dev, DIOCKILLSRCNODES, &psnk)) 526 err(1, "DIOCKILLSRCNODES"); 527 killed += psnk.psnk_killed; 528 } 529 freeaddrinfo(res[1]); 530 } else { 531 if (ioctl(dev, DIOCKILLSRCNODES, &psnk)) 532 err(1, "DIOCKILLSRCNODES"); 533 killed += psnk.psnk_killed; 534 } 535 } 536 537 freeaddrinfo(res[0]); 538 539 if ((opts & PF_OPT_QUIET) == 0) 540 fprintf(stderr, "killed %d src nodes from %d sources and %d " 541 "destinations\n", killed, sources, dests); 542 return (0); 543} 544 545int 546pfctl_net_kill_states(int dev, const char *iface, int opts) 547{ 548 struct pfioc_state_kill psk; 549 struct addrinfo *res[2], *resp[2]; 550 struct sockaddr last_src, last_dst; 551 int killed, sources, dests; 552 int ret_ga; 553 554 killed = sources = dests = 0; 555 556 memset(&psk, 0, sizeof(psk)); 557 memset(&psk.psk_src.addr.v.a.mask, 0xff, 558 sizeof(psk.psk_src.addr.v.a.mask)); 559 memset(&last_src, 0xff, sizeof(last_src)); 560 memset(&last_dst, 0xff, sizeof(last_dst)); 561 if (iface != NULL && strlcpy(psk.psk_ifname, iface, 562 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname)) 563 errx(1, "invalid interface: %s", iface); 564 565 pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask); 566 567 if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) { 568 errx(1, "getaddrinfo: %s", gai_strerror(ret_ga)); 569 /* NOTREACHED */ 570 } 571 for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) { 572 if (resp[0]->ai_addr == NULL) 573 continue; 574 /* We get lots of duplicates. Catch the easy ones */ 575 if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0) 576 continue; 577 last_src = *(struct sockaddr *)resp[0]->ai_addr; 578 579 psk.psk_af = resp[0]->ai_family; 580 sources++; 581 582 if (psk.psk_af == AF_INET) 583 psk.psk_src.addr.v.a.addr.v4 = 584 ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr; 585 else if (psk.psk_af == AF_INET6) 586 psk.psk_src.addr.v.a.addr.v6 = 587 ((struct sockaddr_in6 *)resp[0]->ai_addr)-> 588 sin6_addr; 589 else 590 errx(1, "Unknown address family %d", psk.psk_af); 591 592 if (state_killers > 1) { 593 dests = 0; 594 memset(&psk.psk_dst.addr.v.a.mask, 0xff, 595 sizeof(psk.psk_dst.addr.v.a.mask)); 596 memset(&last_dst, 0xff, sizeof(last_dst)); 597 pfctl_addrprefix(state_kill[1], 598 &psk.psk_dst.addr.v.a.mask); 599 if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL, 600 &res[1]))) { 601 errx(1, "getaddrinfo: %s", 602 gai_strerror(ret_ga)); 603 /* NOTREACHED */ 604 } 605 for (resp[1] = res[1]; resp[1]; 606 resp[1] = resp[1]->ai_next) { 607 if (resp[1]->ai_addr == NULL) 608 continue; 609 if (psk.psk_af != resp[1]->ai_family) 610 continue; 611 612 if (memcmp(&last_dst, resp[1]->ai_addr, 613 sizeof(last_dst)) == 0) 614 continue; 615 last_dst = *(struct sockaddr *)resp[1]->ai_addr; 616 617 dests++; 618 619 if (psk.psk_af == AF_INET) 620 psk.psk_dst.addr.v.a.addr.v4 = 621 ((struct sockaddr_in *)resp[1]-> 622 ai_addr)->sin_addr; 623 else if (psk.psk_af == AF_INET6) 624 psk.psk_dst.addr.v.a.addr.v6 = 625 ((struct sockaddr_in6 *)resp[1]-> 626 ai_addr)->sin6_addr; 627 else 628 errx(1, "Unknown address family %d", 629 psk.psk_af); 630 631 if (ioctl(dev, DIOCKILLSTATES, &psk)) 632 err(1, "DIOCKILLSTATES"); 633 killed += psk.psk_killed; 634 } 635 freeaddrinfo(res[1]); 636 } else { 637 if (ioctl(dev, DIOCKILLSTATES, &psk)) 638 err(1, "DIOCKILLSTATES"); 639 killed += psk.psk_killed; 640 } 641 } 642 643 freeaddrinfo(res[0]); 644 645 if ((opts & PF_OPT_QUIET) == 0) 646 fprintf(stderr, "killed %d states from %d sources and %d " 647 "destinations\n", killed, sources, dests); 648 return (0); 649} 650 651int 652pfctl_label_kill_states(int dev, const char *iface, int opts) 653{ 654 struct pfioc_state_kill psk; 655 656 if (state_killers != 2 || (strlen(state_kill[1]) == 0)) { 657 warnx("no label specified"); 658 usage(); 659 } 660 memset(&psk, 0, sizeof(psk)); 661 if (iface != NULL && strlcpy(psk.psk_ifname, iface, 662 sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname)) 663 errx(1, "invalid interface: %s", iface); 664 665 if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >= 666 sizeof(psk.psk_label)) 667 errx(1, "label too long: %s", state_kill[1]); 668 669 if (ioctl(dev, DIOCKILLSTATES, &psk)) 670 err(1, "DIOCKILLSTATES"); 671 672 if ((opts & PF_OPT_QUIET) == 0) 673 fprintf(stderr, "killed %d states\n", psk.psk_killed); 674 675 return (0); 676} 677 678int 679pfctl_id_kill_states(int dev, const char *iface, int opts) 680{ 681 struct pfioc_state_kill psk; 682 683 if (state_killers != 2 || (strlen(state_kill[1]) == 0)) { 684 warnx("no id specified"); 685 usage(); 686 } 687 688 memset(&psk, 0, sizeof(psk)); 689 if ((sscanf(state_kill[1], "%jx/%x", 690 &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2) 691 HTONL(psk.psk_pfcmp.creatorid); 692 else if ((sscanf(state_kill[1], "%jx", &psk.psk_pfcmp.id)) == 1) { 693 psk.psk_pfcmp.creatorid = 0; 694 } else { 695 warnx("wrong id format specified"); 696 usage(); 697 } 698 if (psk.psk_pfcmp.id == 0) { 699 warnx("cannot kill id 0"); 700 usage(); 701 } 702 703 psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id); 704 if (ioctl(dev, DIOCKILLSTATES, &psk)) 705 err(1, "DIOCKILLSTATES"); 706 707 if ((opts & PF_OPT_QUIET) == 0) 708 fprintf(stderr, "killed %d states\n", psk.psk_killed); 709 710 return (0); 711} 712 713int 714pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr, 715 u_int32_t ticket, int r_action, char *anchorname) 716{ 717 struct pfioc_pooladdr pp; 718 struct pf_pooladdr *pa; 719 u_int32_t pnr, mpnr; 720 721 memset(&pp, 0, sizeof(pp)); 722 memcpy(pp.anchor, anchorname, sizeof(pp.anchor)); 723 pp.r_action = r_action; 724 pp.r_num = nr; 725 pp.ticket = ticket; 726 if (ioctl(dev, DIOCGETADDRS, &pp)) { 727 warn("DIOCGETADDRS"); 728 return (-1); 729 } 730 mpnr = pp.nr; 731 TAILQ_INIT(&pool->list); 732 for (pnr = 0; pnr < mpnr; ++pnr) { 733 pp.nr = pnr; 734 if (ioctl(dev, DIOCGETADDR, &pp)) { 735 warn("DIOCGETADDR"); 736 return (-1); 737 } 738 pa = calloc(1, sizeof(struct pf_pooladdr)); 739 if (pa == NULL) 740 err(1, "calloc"); 741 bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr)); 742 TAILQ_INSERT_TAIL(&pool->list, pa, entries); 743 } 744 745 return (0); 746} 747 748void 749pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst) 750{ 751 struct pf_pooladdr *pa; 752 753 while ((pa = TAILQ_FIRST(&src->list)) != NULL) { 754 TAILQ_REMOVE(&src->list, pa, entries); 755 TAILQ_INSERT_TAIL(&dst->list, pa, entries); 756 } 757} 758 759void 760pfctl_clear_pool(struct pf_pool *pool) 761{ 762 struct pf_pooladdr *pa; 763 764 while ((pa = TAILQ_FIRST(&pool->list)) != NULL) { 765 TAILQ_REMOVE(&pool->list, pa, entries); 766 free(pa); 767 } 768} 769 770void 771pfctl_print_rule_counters(struct pf_rule *rule, int opts) 772{ 773 if (opts & PF_OPT_DEBUG) { 774 const char *t[PF_SKIP_COUNT] = { "i", "d", "f", 775 "p", "sa", "sp", "da", "dp" }; 776 int i; 777 778 printf(" [ Skip steps: "); 779 for (i = 0; i < PF_SKIP_COUNT; ++i) { 780 if (rule->skip[i].nr == rule->nr + 1) 781 continue; 782 printf("%s=", t[i]); 783 if (rule->skip[i].nr == -1) 784 printf("end "); 785 else 786 printf("%u ", rule->skip[i].nr); 787 } 788 printf("]\n"); 789 790 printf(" [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n", 791 rule->qname, rule->qid, rule->pqname, rule->pqid); 792 } 793 if (opts & PF_OPT_VERBOSE) { 794 printf(" [ Evaluations: %-8llu Packets: %-8llu " 795 "Bytes: %-10llu States: %-6"PRIuPTR"]\n", 796 (unsigned long long)rule->evaluations, 797 (unsigned long long)(rule->packets[0] + 798 rule->packets[1]), 799 (unsigned long long)(rule->bytes[0] + 800 rule->bytes[1]), 801 (uintptr_t)rule->states_cur); 802 if (!(opts & PF_OPT_DEBUG)) 803 printf(" [ Inserted: uid %u pid %u " 804 "State Creations: %-6"PRIuPTR"]\n", 805 (unsigned)rule->cuid, (unsigned)rule->cpid, 806 (uintptr_t)rule->states_tot); 807 } 808} 809 810void 811pfctl_print_title(char *title) 812{ 813 if (!first_title) 814 printf("\n"); 815 first_title = 0; 816 printf("%s\n", title); 817} 818 819int 820pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format, 821 char *anchorname, int depth) 822{ 823 struct pfioc_rule pr; 824 u_int32_t nr, mnr, header = 0; 825 int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG); 826 int numeric = opts & PF_OPT_NUMERIC; 827 int len = strlen(path); 828 int brace; 829 char *p; 830 831 if (path[0]) 832 snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname); 833 else 834 snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname); 835 836 memset(&pr, 0, sizeof(pr)); 837 memcpy(pr.anchor, path, sizeof(pr.anchor)); 838 if (opts & PF_OPT_SHOWALL) { 839 pr.rule.action = PF_PASS; 840 if (ioctl(dev, DIOCGETRULES, &pr)) { 841 warn("DIOCGETRULES"); 842 goto error; 843 } 844 header++; 845 } 846 pr.rule.action = PF_SCRUB; 847 if (ioctl(dev, DIOCGETRULES, &pr)) { 848 warn("DIOCGETRULES"); 849 goto error; 850 } 851 if (opts & PF_OPT_SHOWALL) { 852 if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header)) 853 pfctl_print_title("FILTER RULES:"); 854 else if (format == PFCTL_SHOW_LABELS && labels) 855 pfctl_print_title("LABEL COUNTERS:"); 856 } 857 mnr = pr.nr; 858 if (opts & PF_OPT_CLRRULECTRS) 859 pr.action = PF_GET_CLR_CNTR; 860 861 for (nr = 0; nr < mnr; ++nr) { 862 pr.nr = nr; 863 if (ioctl(dev, DIOCGETRULE, &pr)) { 864 warn("DIOCGETRULE"); 865 goto error; 866 } 867 868 if (pfctl_get_pool(dev, &pr.rule.rpool, 869 nr, pr.ticket, PF_SCRUB, path) != 0) 870 goto error; 871 872 switch (format) { 873 case PFCTL_SHOW_LABELS: 874 break; 875 case PFCTL_SHOW_RULES: 876 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL)) 877 labels = 1; 878 print_rule(&pr.rule, pr.anchor_call, rule_numbers, numeric); 879 printf("\n"); 880 pfctl_print_rule_counters(&pr.rule, opts); 881 break; 882 case PFCTL_SHOW_NOTHING: 883 break; 884 } 885 pfctl_clear_pool(&pr.rule.rpool); 886 } 887 pr.rule.action = PF_PASS; 888 if (ioctl(dev, DIOCGETRULES, &pr)) { 889 warn("DIOCGETRULES"); 890 goto error; 891 } 892 mnr = pr.nr; 893 for (nr = 0; nr < mnr; ++nr) { 894 pr.nr = nr; 895 if (ioctl(dev, DIOCGETRULE, &pr)) { 896 warn("DIOCGETRULE"); 897 goto error; 898 } 899 900 if (pfctl_get_pool(dev, &pr.rule.rpool, 901 nr, pr.ticket, PF_PASS, path) != 0) 902 goto error; 903 904 switch (format) { 905 case PFCTL_SHOW_LABELS: 906 if (pr.rule.label[0]) { 907 printf("%s %llu %llu %llu %llu" 908 " %llu %llu %llu %"PRIuPTR"\n", 909 pr.rule.label, 910 (unsigned long long)pr.rule.evaluations, 911 (unsigned long long)(pr.rule.packets[0] + 912 pr.rule.packets[1]), 913 (unsigned long long)(pr.rule.bytes[0] + 914 pr.rule.bytes[1]), 915 (unsigned long long)pr.rule.packets[0], 916 (unsigned long long)pr.rule.bytes[0], 917 (unsigned long long)pr.rule.packets[1], 918 (unsigned long long)pr.rule.bytes[1], 919 (uintptr_t)pr.rule.states_tot); 920 } 921 break; 922 case PFCTL_SHOW_RULES: 923 brace = 0; 924 if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL)) 925 labels = 1; 926 INDENT(depth, !(opts & PF_OPT_VERBOSE)); 927 if (pr.anchor_call[0] && 928 ((((p = strrchr(pr.anchor_call, '_')) != NULL) && 929 ((void *)p == (void *)pr.anchor_call || 930 *(--p) == '/')) || (opts & PF_OPT_RECURSE))) { 931 brace++; 932 if ((p = strrchr(pr.anchor_call, '/')) != 933 NULL) 934 p++; 935 else 936 p = &pr.anchor_call[0]; 937 } else 938 p = &pr.anchor_call[0]; 939 940 print_rule(&pr.rule, p, rule_numbers, numeric); 941 if (brace) 942 printf(" {\n"); 943 else 944 printf("\n"); 945 pfctl_print_rule_counters(&pr.rule, opts); 946 if (brace) { 947 pfctl_show_rules(dev, path, opts, format, 948 p, depth + 1); 949 INDENT(depth, !(opts & PF_OPT_VERBOSE)); 950 printf("}\n"); 951 } 952 break; 953 case PFCTL_SHOW_NOTHING: 954 break; 955 } 956 pfctl_clear_pool(&pr.rule.rpool); 957 } 958 path[len] = '\0'; 959 return (0); 960 961 error: 962 path[len] = '\0'; 963 return (-1); 964} 965 966int 967pfctl_show_nat(int dev, int opts, char *anchorname) 968{ 969 struct pfioc_rule pr; 970 u_int32_t mnr, nr; 971 static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT }; 972 int i, dotitle = opts & PF_OPT_SHOWALL; 973 974 memset(&pr, 0, sizeof(pr)); 975 memcpy(pr.anchor, anchorname, sizeof(pr.anchor)); 976 for (i = 0; i < 3; i++) { 977 pr.rule.action = nattype[i]; 978 if (ioctl(dev, DIOCGETRULES, &pr)) { 979 warn("DIOCGETRULES"); 980 return (-1); 981 } 982 mnr = pr.nr; 983 for (nr = 0; nr < mnr; ++nr) { 984 pr.nr = nr; 985 if (ioctl(dev, DIOCGETRULE, &pr)) { 986 warn("DIOCGETRULE"); 987 return (-1); 988 } 989 if (pfctl_get_pool(dev, &pr.rule.rpool, nr, 990 pr.ticket, nattype[i], anchorname) != 0) 991 return (-1); 992 if (dotitle) { 993 pfctl_print_title("TRANSLATION RULES:"); 994 dotitle = 0; 995 } 996 print_rule(&pr.rule, pr.anchor_call, 997 opts & PF_OPT_VERBOSE2, opts & PF_OPT_NUMERIC); 998 printf("\n"); 999 pfctl_print_rule_counters(&pr.rule, opts); 1000 pfctl_clear_pool(&pr.rule.rpool); 1001 } 1002 } 1003 return (0); 1004} 1005 1006int 1007pfctl_show_src_nodes(int dev, int opts) 1008{ 1009 struct pfioc_src_nodes psn; 1010 struct pf_src_node *p; 1011 char *inbuf = NULL, *newinbuf = NULL; 1012 unsigned int len = 0; 1013 int i; 1014 1015 memset(&psn, 0, sizeof(psn)); 1016 for (;;) { 1017 psn.psn_len = len; 1018 if (len) { 1019 newinbuf = realloc(inbuf, len); 1020 if (newinbuf == NULL) 1021 err(1, "realloc"); 1022 psn.psn_buf = inbuf = newinbuf; 1023 } 1024 if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) { 1025 warn("DIOCGETSRCNODES"); 1026 free(inbuf); 1027 return (-1); 1028 } 1029 if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len) 1030 break; 1031 if (len == 0 && psn.psn_len == 0) 1032 goto done; 1033 if (len == 0 && psn.psn_len != 0) 1034 len = psn.psn_len; 1035 if (psn.psn_len == 0) 1036 goto done; /* no src_nodes */ 1037 len *= 2; 1038 } 1039 p = psn.psn_src_nodes; 1040 if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL)) 1041 pfctl_print_title("SOURCE TRACKING NODES:"); 1042 for (i = 0; i < psn.psn_len; i += sizeof(*p)) { 1043 print_src_node(p, opts); 1044 p++; 1045 } 1046done: 1047 free(inbuf); 1048 return (0); 1049} 1050 1051int 1052pfctl_show_states(int dev, const char *iface, int opts) 1053{ 1054 struct pfioc_states ps; 1055 struct pfsync_state *p; 1056 char *inbuf = NULL, *newinbuf = NULL; 1057 unsigned int len = 0; 1058 int i, dotitle = (opts & PF_OPT_SHOWALL); 1059 1060 memset(&ps, 0, sizeof(ps)); 1061 for (;;) { 1062 ps.ps_len = len; 1063 if (len) { 1064 newinbuf = realloc(inbuf, len); 1065 if (newinbuf == NULL) 1066 err(1, "realloc"); 1067 ps.ps_buf = inbuf = newinbuf; 1068 } 1069 if (ioctl(dev, DIOCGETSTATES, &ps) < 0) { 1070 warn("DIOCGETSTATES"); 1071 free(inbuf); 1072 return (-1); 1073 } 1074 if (ps.ps_len + sizeof(struct pfioc_states) < len) 1075 break; 1076 if (len == 0 && ps.ps_len == 0) 1077 goto done; 1078 if (len == 0 && ps.ps_len != 0) 1079 len = ps.ps_len; 1080 if (ps.ps_len == 0) 1081 goto done; /* no states */ 1082 len *= 2; 1083 } 1084 p = ps.ps_states; 1085 for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) { 1086 if (iface != NULL && strcmp(p->ifname, iface)) 1087 continue; 1088 if (dotitle) { 1089 pfctl_print_title("STATES:"); 1090 dotitle = 0; 1091 } 1092 print_state(p, opts); 1093 } 1094done: 1095 free(inbuf); 1096 return (0); 1097} 1098 1099int 1100pfctl_show_status(int dev, int opts) 1101{ 1102 struct pf_status status; 1103 1104 if (ioctl(dev, DIOCGETSTATUS, &status)) { 1105 warn("DIOCGETSTATUS"); 1106 return (-1); 1107 } 1108 if (opts & PF_OPT_SHOWALL) 1109 pfctl_print_title("INFO:"); 1110 print_status(&status, opts); 1111 return (0); 1112} 1113 1114int 1115pfctl_show_timeouts(int dev, int opts) 1116{ 1117 struct pfioc_tm pt; 1118 int i; 1119 1120 if (opts & PF_OPT_SHOWALL) 1121 pfctl_print_title("TIMEOUTS:"); 1122 memset(&pt, 0, sizeof(pt)); 1123 for (i = 0; pf_timeouts[i].name; i++) { 1124 pt.timeout = pf_timeouts[i].timeout; 1125 if (ioctl(dev, DIOCGETTIMEOUT, &pt)) 1126 err(1, "DIOCGETTIMEOUT"); 1127 printf("%-20s %10d", pf_timeouts[i].name, pt.seconds); 1128 if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START && 1129 pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END) 1130 printf(" states"); 1131 else 1132 printf("s"); 1133 printf("\n"); 1134 } 1135 return (0); 1136 1137} 1138 1139int 1140pfctl_show_limits(int dev, int opts) 1141{ 1142 struct pfioc_limit pl; 1143 int i; 1144 1145 if (opts & PF_OPT_SHOWALL) 1146 pfctl_print_title("LIMITS:"); 1147 memset(&pl, 0, sizeof(pl)); 1148 for (i = 0; pf_limits[i].name; i++) { 1149 pl.index = pf_limits[i].index; 1150 if (ioctl(dev, DIOCGETLIMIT, &pl)) 1151 err(1, "DIOCGETLIMIT"); 1152 printf("%-13s ", pf_limits[i].name); 1153 if (pl.limit == UINT_MAX) 1154 printf("unlimited\n"); 1155 else 1156 printf("hard limit %8u\n", pl.limit); 1157 } 1158 return (0); 1159} 1160 1161/* callbacks for rule/nat/rdr/addr */ 1162int 1163pfctl_add_pool(struct pfctl *pf, struct pf_pool *p, sa_family_t af) 1164{ 1165 struct pf_pooladdr *pa; 1166 1167 if ((pf->opts & PF_OPT_NOACTION) == 0) { 1168 if (ioctl(pf->dev, DIOCBEGINADDRS, &pf->paddr)) 1169 err(1, "DIOCBEGINADDRS"); 1170 } 1171 1172 pf->paddr.af = af; 1173 TAILQ_FOREACH(pa, &p->list, entries) { 1174 memcpy(&pf->paddr.addr, pa, sizeof(struct pf_pooladdr)); 1175 if ((pf->opts & PF_OPT_NOACTION) == 0) { 1176 if (ioctl(pf->dev, DIOCADDADDR, &pf->paddr)) 1177 err(1, "DIOCADDADDR"); 1178 } 1179 } 1180 return (0); 1181} 1182 1183int 1184pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call) 1185{ 1186 u_int8_t rs_num; 1187 struct pf_rule *rule; 1188 struct pf_ruleset *rs; 1189 char *p; 1190 1191 rs_num = pf_get_ruleset_number(r->action); 1192 if (rs_num == PF_RULESET_MAX) 1193 errx(1, "Invalid rule type %d", r->action); 1194 1195 rs = &pf->anchor->ruleset; 1196 1197 if (anchor_call[0] && r->anchor == NULL) { 1198 /* 1199 * Don't make non-brace anchors part of the main anchor pool. 1200 */ 1201 if ((r->anchor = calloc(1, sizeof(*r->anchor))) == NULL) 1202 err(1, "pfctl_add_rule: calloc"); 1203 1204 pf_init_ruleset(&r->anchor->ruleset); 1205 r->anchor->ruleset.anchor = r->anchor; 1206 if (strlcpy(r->anchor->path, anchor_call, 1207 sizeof(rule->anchor->path)) >= sizeof(rule->anchor->path)) 1208 errx(1, "pfctl_add_rule: strlcpy"); 1209 if ((p = strrchr(anchor_call, '/')) != NULL) { 1210 if (!strlen(p)) 1211 err(1, "pfctl_add_rule: bad anchor name %s", 1212 anchor_call); 1213 } else 1214 p = (char *)anchor_call; 1215 if (strlcpy(r->anchor->name, p, 1216 sizeof(rule->anchor->name)) >= sizeof(rule->anchor->name)) 1217 errx(1, "pfctl_add_rule: strlcpy"); 1218 } 1219 1220 if ((rule = calloc(1, sizeof(*rule))) == NULL) 1221 err(1, "calloc"); 1222 bcopy(r, rule, sizeof(*rule)); 1223 TAILQ_INIT(&rule->rpool.list); 1224 pfctl_move_pool(&r->rpool, &rule->rpool); 1225 1226 TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries); 1227 return (0); 1228} 1229 1230int 1231pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a) 1232{ 1233 int osize = pf->trans->pfrb_size; 1234 1235 if ((pf->loadopt & PFCTL_FLAG_NAT) != 0) { 1236 if (pfctl_add_trans(pf->trans, PF_RULESET_NAT, path) || 1237 pfctl_add_trans(pf->trans, PF_RULESET_BINAT, path) || 1238 pfctl_add_trans(pf->trans, PF_RULESET_RDR, path)) 1239 return (1); 1240 } 1241 if (a == pf->astack[0] && ((altqsupport && 1242 (pf->loadopt & PFCTL_FLAG_ALTQ) != 0))) { 1243 if (pfctl_add_trans(pf->trans, PF_RULESET_ALTQ, path)) 1244 return (2); 1245 } 1246 if ((pf->loadopt & PFCTL_FLAG_FILTER) != 0) { 1247 if (pfctl_add_trans(pf->trans, PF_RULESET_SCRUB, path) || 1248 pfctl_add_trans(pf->trans, PF_RULESET_FILTER, path)) 1249 return (3); 1250 } 1251 if (pf->loadopt & PFCTL_FLAG_TABLE) 1252 if (pfctl_add_trans(pf->trans, PF_RULESET_TABLE, path)) 1253 return (4); 1254 if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN, osize)) 1255 return (5); 1256 1257 return (0); 1258} 1259 1260int 1261pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs, 1262 int rs_num, int depth) 1263{ 1264 struct pf_rule *r; 1265 int error, len = strlen(path); 1266 int brace = 0; 1267 1268 pf->anchor = rs->anchor; 1269 1270 if (path[0]) 1271 snprintf(&path[len], MAXPATHLEN - len, "/%s", pf->anchor->name); 1272 else 1273 snprintf(&path[len], MAXPATHLEN - len, "%s", pf->anchor->name); 1274 1275 if (depth) { 1276 if (TAILQ_FIRST(rs->rules[rs_num].active.ptr) != NULL) { 1277 brace++; 1278 if (pf->opts & PF_OPT_VERBOSE) 1279 printf(" {\n"); 1280 if ((pf->opts & PF_OPT_NOACTION) == 0 && 1281 (error = pfctl_ruleset_trans(pf, 1282 path, rs->anchor))) { 1283 printf("pfctl_load_rulesets: " 1284 "pfctl_ruleset_trans %d\n", error); 1285 goto error; 1286 } 1287 } else if (pf->opts & PF_OPT_VERBOSE) 1288 printf("\n"); 1289 1290 } 1291 1292 if (pf->optimize && rs_num == PF_RULESET_FILTER) 1293 pfctl_optimize_ruleset(pf, rs); 1294 1295 while ((r = TAILQ_FIRST(rs->rules[rs_num].active.ptr)) != NULL) { 1296 TAILQ_REMOVE(rs->rules[rs_num].active.ptr, r, entries); 1297 if ((error = pfctl_load_rule(pf, path, r, depth))) 1298 goto error; 1299 if (r->anchor) { 1300 if ((error = pfctl_load_ruleset(pf, path, 1301 &r->anchor->ruleset, rs_num, depth + 1))) 1302 goto error; 1303 } else if (pf->opts & PF_OPT_VERBOSE) 1304 printf("\n"); 1305 free(r); 1306 } 1307 if (brace && pf->opts & PF_OPT_VERBOSE) { 1308 INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE)); 1309 printf("}\n"); 1310 } 1311 path[len] = '\0'; 1312 return (0); 1313 1314 error: 1315 path[len] = '\0'; 1316 return (error); 1317 1318} 1319 1320int 1321pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth) 1322{ 1323 u_int8_t rs_num = pf_get_ruleset_number(r->action); 1324 char *name; 1325 struct pfioc_rule pr; 1326 int len = strlen(path); 1327 1328 bzero(&pr, sizeof(pr)); 1329 /* set up anchor before adding to path for anchor_call */ 1330 if ((pf->opts & PF_OPT_NOACTION) == 0) 1331 pr.ticket = pfctl_get_ticket(pf->trans, rs_num, path); 1332 if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor)) 1333 errx(1, "pfctl_load_rule: strlcpy"); 1334 1335 if (r->anchor) { 1336 if (r->anchor->match) { 1337 if (path[0]) 1338 snprintf(&path[len], MAXPATHLEN - len, 1339 "/%s", r->anchor->name); 1340 else 1341 snprintf(&path[len], MAXPATHLEN - len, 1342 "%s", r->anchor->name); 1343 name = path; 1344 } else 1345 name = r->anchor->path; 1346 } else 1347 name = ""; 1348 1349 if ((pf->opts & PF_OPT_NOACTION) == 0) { 1350 if (pfctl_add_pool(pf, &r->rpool, r->af)) 1351 return (1); 1352 pr.pool_ticket = pf->paddr.ticket; 1353 memcpy(&pr.rule, r, sizeof(pr.rule)); 1354 if (r->anchor && strlcpy(pr.anchor_call, name, 1355 sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call)) 1356 errx(1, "pfctl_load_rule: strlcpy"); 1357 if (ioctl(pf->dev, DIOCADDRULE, &pr)) 1358 err(1, "DIOCADDRULE"); 1359 } 1360 1361 if (pf->opts & PF_OPT_VERBOSE) { 1362 INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2)); 1363 print_rule(r, r->anchor ? r->anchor->name : "", 1364 pf->opts & PF_OPT_VERBOSE2, 1365 pf->opts & PF_OPT_NUMERIC); 1366 } 1367 path[len] = '\0'; 1368 pfctl_clear_pool(&r->rpool); 1369 return (0); 1370} 1371 1372int 1373pfctl_add_altq(struct pfctl *pf, struct pf_altq *a) 1374{ 1375 if (altqsupport && 1376 (loadopt & PFCTL_FLAG_ALTQ) != 0) { 1377 memcpy(&pf->paltq->altq, a, sizeof(struct pf_altq)); 1378 if ((pf->opts & PF_OPT_NOACTION) == 0) { 1379 if (ioctl(pf->dev, DIOCADDALTQ, pf->paltq)) { 1380 if (errno == ENXIO) 1381 errx(1, "qtype not configured"); 1382 else if (errno == ENODEV) 1383 errx(1, "%s: driver does not support " 1384 "altq", a->ifname); 1385 else 1386 err(1, "DIOCADDALTQ"); 1387 } 1388 } 1389 pfaltq_store(&pf->paltq->altq); 1390 } 1391 return (0); 1392} 1393 1394int 1395pfctl_rules(int dev, char *filename, int opts, int optimize, 1396 char *anchorname, struct pfr_buffer *trans) 1397{ 1398#define ERR(x) do { warn(x); goto _error; } while(0) 1399#define ERRX(x) do { warnx(x); goto _error; } while(0) 1400 1401 struct pfr_buffer *t, buf; 1402 struct pfioc_altq pa; 1403 struct pfctl pf; 1404 struct pf_ruleset *rs; 1405 struct pfr_table trs; 1406 char *path; 1407 int osize; 1408 1409 RB_INIT(&pf_anchors); 1410 memset(&pf_main_anchor, 0, sizeof(pf_main_anchor)); 1411 pf_init_ruleset(&pf_main_anchor.ruleset); 1412 pf_main_anchor.ruleset.anchor = &pf_main_anchor; 1413 if (trans == NULL) { 1414 bzero(&buf, sizeof(buf)); 1415 buf.pfrb_type = PFRB_TRANS; 1416 t = &buf; 1417 osize = 0; 1418 } else { 1419 t = trans; 1420 osize = t->pfrb_size; 1421 } 1422 1423 memset(&pa, 0, sizeof(pa)); 1424 memset(&pf, 0, sizeof(pf)); 1425 memset(&trs, 0, sizeof(trs)); 1426 if ((path = calloc(1, MAXPATHLEN)) == NULL) 1427 ERRX("pfctl_rules: calloc"); 1428 if (strlcpy(trs.pfrt_anchor, anchorname, 1429 sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor)) 1430 ERRX("pfctl_rules: strlcpy"); 1431 pf.dev = dev; 1432 pf.opts = opts; 1433 pf.optimize = optimize; 1434 pf.loadopt = loadopt; 1435 1436 /* non-brace anchor, create without resolving the path */ 1437 if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL) 1438 ERRX("pfctl_rules: calloc"); 1439 rs = &pf.anchor->ruleset; 1440 pf_init_ruleset(rs); 1441 rs->anchor = pf.anchor; 1442 if (strlcpy(pf.anchor->path, anchorname, 1443 sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path)) 1444 errx(1, "pfctl_add_rule: strlcpy"); 1445 if (strlcpy(pf.anchor->name, anchorname, 1446 sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name)) 1447 errx(1, "pfctl_add_rule: strlcpy"); 1448 1449 1450 pf.astack[0] = pf.anchor; 1451 pf.asd = 0; 1452 if (anchorname[0]) 1453 pf.loadopt &= ~PFCTL_FLAG_ALTQ; 1454 pf.paltq = &pa; 1455 pf.trans = t; 1456 pfctl_init_options(&pf); 1457 1458 if ((opts & PF_OPT_NOACTION) == 0) { 1459 /* 1460 * XXX For the time being we need to open transactions for 1461 * the main ruleset before parsing, because tables are still 1462 * loaded at parse time. 1463 */ 1464 if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor)) 1465 ERRX("pfctl_rules"); 1466 if (altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ)) 1467 pa.ticket = 1468 pfctl_get_ticket(t, PF_RULESET_ALTQ, anchorname); 1469 if (pf.loadopt & PFCTL_FLAG_TABLE) 1470 pf.astack[0]->ruleset.tticket = 1471 pfctl_get_ticket(t, PF_RULESET_TABLE, anchorname); 1472 } 1473 1474 if (parse_config(filename, &pf) < 0) { 1475 if ((opts & PF_OPT_NOACTION) == 0) 1476 ERRX("Syntax error in config file: " 1477 "pf rules not loaded"); 1478 else 1479 goto _error; 1480 } 1481 1482 if ((pf.loadopt & PFCTL_FLAG_FILTER && 1483 (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_SCRUB, 0))) || 1484 (pf.loadopt & PFCTL_FLAG_NAT && 1485 (pfctl_load_ruleset(&pf, path, rs, PF_RULESET_NAT, 0) || 1486 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_RDR, 0) || 1487 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_BINAT, 0))) || 1488 (pf.loadopt & PFCTL_FLAG_FILTER && 1489 pfctl_load_ruleset(&pf, path, rs, PF_RULESET_FILTER, 0))) { 1490 if ((opts & PF_OPT_NOACTION) == 0) 1491 ERRX("Unable to load rules into kernel"); 1492 else 1493 goto _error; 1494 } 1495 1496 if ((altqsupport && (pf.loadopt & PFCTL_FLAG_ALTQ) != 0)) 1497 if (check_commit_altq(dev, opts) != 0) 1498 ERRX("errors in altq config"); 1499 1500 /* process "load anchor" directives */ 1501 if (!anchorname[0]) 1502 if (pfctl_load_anchors(dev, &pf, t) == -1) 1503 ERRX("load anchors"); 1504 1505 if (trans == NULL && (opts & PF_OPT_NOACTION) == 0) { 1506 if (!anchorname[0]) 1507 if (pfctl_load_options(&pf)) 1508 goto _error; 1509 if (pfctl_trans(dev, t, DIOCXCOMMIT, osize)) 1510 ERR("DIOCXCOMMIT"); 1511 } 1512 return (0); 1513 1514_error: 1515 if (trans == NULL) { /* main ruleset */ 1516 if ((opts & PF_OPT_NOACTION) == 0) 1517 if (pfctl_trans(dev, t, DIOCXROLLBACK, osize)) 1518 err(1, "DIOCXROLLBACK"); 1519 exit(1); 1520 } else { /* sub ruleset */ 1521 return (-1); 1522 } 1523 1524#undef ERR 1525#undef ERRX 1526} 1527 1528FILE * 1529pfctl_fopen(const char *name, const char *mode) 1530{ 1531 struct stat st; 1532 FILE *fp; 1533 1534 fp = fopen(name, mode); 1535 if (fp == NULL) 1536 return (NULL); 1537 if (fstat(fileno(fp), &st)) { 1538 fclose(fp); 1539 return (NULL); 1540 } 1541 if (S_ISDIR(st.st_mode)) { 1542 fclose(fp); 1543 errno = EISDIR; 1544 return (NULL); 1545 } 1546 return (fp); 1547} 1548 1549void 1550pfctl_init_options(struct pfctl *pf) 1551{ 1552 1553 pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 1554 pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 1555 pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 1556 pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 1557 pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 1558 pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 1559 pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 1560 pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 1561 pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 1562 pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 1563 pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 1564 pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 1565 pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 1566 pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 1567 pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 1568 pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 1569 pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 1570 pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 1571 pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 1572 pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 1573 1574 pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT; 1575 pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT; 1576 pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT; 1577 pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT; 1578 1579 pf->debug = PF_DEBUG_URGENT; 1580} 1581 1582int 1583pfctl_load_options(struct pfctl *pf) 1584{ 1585 int i, error = 0; 1586 1587 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1588 return (0); 1589 1590 /* load limits */ 1591 for (i = 0; i < PF_LIMIT_MAX; i++) { 1592 if ((pf->opts & PF_OPT_MERGE) && !pf->limit_set[i]) 1593 continue; 1594 if (pfctl_load_limit(pf, i, pf->limit[i])) 1595 error = 1; 1596 } 1597 1598 /* 1599 * If we've set the limit, but haven't explicitly set adaptive 1600 * timeouts, do it now with a start of 60% and end of 120%. 1601 */ 1602 if (pf->limit_set[PF_LIMIT_STATES] && 1603 !pf->timeout_set[PFTM_ADAPTIVE_START] && 1604 !pf->timeout_set[PFTM_ADAPTIVE_END]) { 1605 pf->timeout[PFTM_ADAPTIVE_START] = 1606 (pf->limit[PF_LIMIT_STATES] / 10) * 6; 1607 pf->timeout_set[PFTM_ADAPTIVE_START] = 1; 1608 pf->timeout[PFTM_ADAPTIVE_END] = 1609 (pf->limit[PF_LIMIT_STATES] / 10) * 12; 1610 pf->timeout_set[PFTM_ADAPTIVE_END] = 1; 1611 } 1612 1613 /* load timeouts */ 1614 for (i = 0; i < PFTM_MAX; i++) { 1615 if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i]) 1616 continue; 1617 if (pfctl_load_timeout(pf, i, pf->timeout[i])) 1618 error = 1; 1619 } 1620 1621 /* load debug */ 1622 if (!(pf->opts & PF_OPT_MERGE) || pf->debug_set) 1623 if (pfctl_load_debug(pf, pf->debug)) 1624 error = 1; 1625 1626 /* load logif */ 1627 if (!(pf->opts & PF_OPT_MERGE) || pf->ifname_set) 1628 if (pfctl_load_logif(pf, pf->ifname)) 1629 error = 1; 1630 1631 /* load hostid */ 1632 if (!(pf->opts & PF_OPT_MERGE) || pf->hostid_set) 1633 if (pfctl_load_hostid(pf, pf->hostid)) 1634 error = 1; 1635 1636 return (error); 1637} 1638 1639int 1640pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit) 1641{ 1642 int i; 1643 1644 1645 for (i = 0; pf_limits[i].name; i++) { 1646 if (strcasecmp(opt, pf_limits[i].name) == 0) { 1647 pf->limit[pf_limits[i].index] = limit; 1648 pf->limit_set[pf_limits[i].index] = 1; 1649 break; 1650 } 1651 } 1652 if (pf_limits[i].name == NULL) { 1653 warnx("Bad pool name."); 1654 return (1); 1655 } 1656 1657 if (pf->opts & PF_OPT_VERBOSE) 1658 printf("set limit %s %d\n", opt, limit); 1659 1660 return (0); 1661} 1662 1663int 1664pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit) 1665{ 1666 struct pfioc_limit pl; 1667 1668 memset(&pl, 0, sizeof(pl)); 1669 pl.index = index; 1670 pl.limit = limit; 1671 if (ioctl(pf->dev, DIOCSETLIMIT, &pl)) { 1672 if (errno == EBUSY) 1673 warnx("Current pool size exceeds requested hard limit"); 1674 else 1675 warnx("DIOCSETLIMIT"); 1676 return (1); 1677 } 1678 return (0); 1679} 1680 1681int 1682pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet) 1683{ 1684 int i; 1685 1686 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1687 return (0); 1688 1689 for (i = 0; pf_timeouts[i].name; i++) { 1690 if (strcasecmp(opt, pf_timeouts[i].name) == 0) { 1691 pf->timeout[pf_timeouts[i].timeout] = seconds; 1692 pf->timeout_set[pf_timeouts[i].timeout] = 1; 1693 break; 1694 } 1695 } 1696 1697 if (pf_timeouts[i].name == NULL) { 1698 warnx("Bad timeout name."); 1699 return (1); 1700 } 1701 1702 1703 if (pf->opts & PF_OPT_VERBOSE && ! quiet) 1704 printf("set timeout %s %d\n", opt, seconds); 1705 1706 return (0); 1707} 1708 1709int 1710pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds) 1711{ 1712 struct pfioc_tm pt; 1713 1714 memset(&pt, 0, sizeof(pt)); 1715 pt.timeout = timeout; 1716 pt.seconds = seconds; 1717 if (ioctl(pf->dev, DIOCSETTIMEOUT, &pt)) { 1718 warnx("DIOCSETTIMEOUT"); 1719 return (1); 1720 } 1721 return (0); 1722} 1723 1724int 1725pfctl_set_optimization(struct pfctl *pf, const char *opt) 1726{ 1727 const struct pf_hint *hint; 1728 int i, r; 1729 1730 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1731 return (0); 1732 1733 for (i = 0; pf_hints[i].name; i++) 1734 if (strcasecmp(opt, pf_hints[i].name) == 0) 1735 break; 1736 1737 hint = pf_hints[i].hint; 1738 if (hint == NULL) { 1739 warnx("invalid state timeouts optimization"); 1740 return (1); 1741 } 1742 1743 for (i = 0; hint[i].name; i++) 1744 if ((r = pfctl_set_timeout(pf, hint[i].name, 1745 hint[i].timeout, 1))) 1746 return (r); 1747 1748 if (pf->opts & PF_OPT_VERBOSE) 1749 printf("set optimization %s\n", opt); 1750 1751 return (0); 1752} 1753 1754int 1755pfctl_set_logif(struct pfctl *pf, char *ifname) 1756{ 1757 1758 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1759 return (0); 1760 1761 if (!strcmp(ifname, "none")) { 1762 free(pf->ifname); 1763 pf->ifname = NULL; 1764 } else { 1765 pf->ifname = strdup(ifname); 1766 if (!pf->ifname) 1767 errx(1, "pfctl_set_logif: strdup"); 1768 } 1769 pf->ifname_set = 1; 1770 1771 if (pf->opts & PF_OPT_VERBOSE) 1772 printf("set loginterface %s\n", ifname); 1773 1774 return (0); 1775} 1776 1777int 1778pfctl_load_logif(struct pfctl *pf, char *ifname) 1779{ 1780 struct pfioc_if pi; 1781 1782 memset(&pi, 0, sizeof(pi)); 1783 if (ifname && strlcpy(pi.ifname, ifname, 1784 sizeof(pi.ifname)) >= sizeof(pi.ifname)) { 1785 warnx("pfctl_load_logif: strlcpy"); 1786 return (1); 1787 } 1788 if (ioctl(pf->dev, DIOCSETSTATUSIF, &pi)) { 1789 warnx("DIOCSETSTATUSIF"); 1790 return (1); 1791 } 1792 return (0); 1793} 1794 1795int 1796pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid) 1797{ 1798 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1799 return (0); 1800 1801 HTONL(hostid); 1802 1803 pf->hostid = hostid; 1804 pf->hostid_set = 1; 1805 1806 if (pf->opts & PF_OPT_VERBOSE) 1807 printf("set hostid 0x%08x\n", ntohl(hostid)); 1808 1809 return (0); 1810} 1811 1812int 1813pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid) 1814{ 1815 if (ioctl(dev, DIOCSETHOSTID, &hostid)) { 1816 warnx("DIOCSETHOSTID"); 1817 return (1); 1818 } 1819 return (0); 1820} 1821 1822int 1823pfctl_set_debug(struct pfctl *pf, char *d) 1824{ 1825 u_int32_t level; 1826 1827 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1828 return (0); 1829 1830 if (!strcmp(d, "none")) 1831 pf->debug = PF_DEBUG_NONE; 1832 else if (!strcmp(d, "urgent")) 1833 pf->debug = PF_DEBUG_URGENT; 1834 else if (!strcmp(d, "misc")) 1835 pf->debug = PF_DEBUG_MISC; 1836 else if (!strcmp(d, "loud")) 1837 pf->debug = PF_DEBUG_NOISY; 1838 else { 1839 warnx("unknown debug level \"%s\"", d); 1840 return (-1); 1841 } 1842 1843 pf->debug_set = 1; 1844 1845 if ((pf->opts & PF_OPT_NOACTION) == 0) 1846 if (ioctl(dev, DIOCSETDEBUG, &level)) 1847 err(1, "DIOCSETDEBUG"); 1848 1849 if (pf->opts & PF_OPT_VERBOSE) 1850 printf("set debug %s\n", d); 1851 1852 return (0); 1853} 1854 1855int 1856pfctl_load_debug(struct pfctl *pf, unsigned int level) 1857{ 1858 if (ioctl(pf->dev, DIOCSETDEBUG, &level)) { 1859 warnx("DIOCSETDEBUG"); 1860 return (1); 1861 } 1862 return (0); 1863} 1864 1865int 1866pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how) 1867{ 1868 struct pfioc_iface pi; 1869 1870 if ((loadopt & PFCTL_FLAG_OPTION) == 0) 1871 return (0); 1872 1873 bzero(&pi, sizeof(pi)); 1874 1875 pi.pfiio_flags = flags; 1876 1877 if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >= 1878 sizeof(pi.pfiio_name)) 1879 errx(1, "pfctl_set_interface_flags: strlcpy"); 1880 1881 if ((pf->opts & PF_OPT_NOACTION) == 0) { 1882 if (how == 0) { 1883 if (ioctl(pf->dev, DIOCCLRIFFLAG, &pi)) 1884 err(1, "DIOCCLRIFFLAG"); 1885 } else { 1886 if (ioctl(pf->dev, DIOCSETIFFLAG, &pi)) 1887 err(1, "DIOCSETIFFLAG"); 1888 } 1889 } 1890 return (0); 1891} 1892 1893void 1894pfctl_debug(int dev, u_int32_t level, int opts) 1895{ 1896 if (ioctl(dev, DIOCSETDEBUG, &level)) 1897 err(1, "DIOCSETDEBUG"); 1898 if ((opts & PF_OPT_QUIET) == 0) { 1899 fprintf(stderr, "debug level set to '"); 1900 switch (level) { 1901 case PF_DEBUG_NONE: 1902 fprintf(stderr, "none"); 1903 break; 1904 case PF_DEBUG_URGENT: 1905 fprintf(stderr, "urgent"); 1906 break; 1907 case PF_DEBUG_MISC: 1908 fprintf(stderr, "misc"); 1909 break; 1910 case PF_DEBUG_NOISY: 1911 fprintf(stderr, "loud"); 1912 break; 1913 default: 1914 fprintf(stderr, "<invalid>"); 1915 break; 1916 } 1917 fprintf(stderr, "'\n"); 1918 } 1919} 1920 1921int 1922pfctl_test_altqsupport(int dev, int opts) 1923{ 1924 struct pfioc_altq pa; 1925 1926 if (ioctl(dev, DIOCGETALTQS, &pa)) { 1927 if (errno == ENODEV) { 1928 if (!(opts & PF_OPT_QUIET)) 1929 fprintf(stderr, "No ALTQ support in kernel\n" 1930 "ALTQ related functions disabled\n"); 1931 return (0); 1932 } else 1933 err(1, "DIOCGETALTQS"); 1934 } 1935 return (1); 1936} 1937 1938int 1939pfctl_show_anchors(int dev, int opts, char *anchorname) 1940{ 1941 struct pfioc_ruleset pr; 1942 u_int32_t mnr, nr; 1943 1944 memset(&pr, 0, sizeof(pr)); 1945 memcpy(pr.path, anchorname, sizeof(pr.path)); 1946 if (ioctl(dev, DIOCGETRULESETS, &pr)) { 1947 if (errno == EINVAL) 1948 fprintf(stderr, "Anchor '%s' not found.\n", 1949 anchorname); 1950 else 1951 err(1, "DIOCGETRULESETS"); 1952 return (-1); 1953 } 1954 mnr = pr.nr; 1955 for (nr = 0; nr < mnr; ++nr) { 1956 char sub[MAXPATHLEN]; 1957 1958 pr.nr = nr; 1959 if (ioctl(dev, DIOCGETRULESET, &pr)) 1960 err(1, "DIOCGETRULESET"); 1961 if (!strcmp(pr.name, PF_RESERVED_ANCHOR)) 1962 continue; 1963 sub[0] = 0; 1964 if (pr.path[0]) { 1965 strlcat(sub, pr.path, sizeof(sub)); 1966 strlcat(sub, "/", sizeof(sub)); 1967 } 1968 strlcat(sub, pr.name, sizeof(sub)); 1969 if (sub[0] != '_' || (opts & PF_OPT_VERBOSE)) 1970 printf(" %s\n", sub); 1971 if ((opts & PF_OPT_VERBOSE) && pfctl_show_anchors(dev, opts, sub)) 1972 return (-1); 1973 } 1974 return (0); 1975} 1976 1977const char * 1978pfctl_lookup_option(char *cmd, const char **list) 1979{ 1980 if (cmd != NULL && *cmd) 1981 for (; *list; list++) 1982 if (!strncmp(cmd, *list, strlen(cmd))) 1983 return (*list); 1984 return (NULL); 1985} 1986 1987int 1988main(int argc, char *argv[]) 1989{ 1990 int error = 0; 1991 int ch; 1992 int mode = O_RDONLY; 1993 int opts = 0; 1994 int optimize = PF_OPTIMIZE_BASIC; 1995 char anchorname[MAXPATHLEN]; 1996 char *path; 1997 1998 if (argc < 2) 1999 usage(); 2000 2001 while ((ch = getopt(argc, argv, 2002 "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:z")) != -1) { 2003 switch (ch) { 2004 case 'a': 2005 anchoropt = optarg; 2006 break; 2007 case 'd': 2008 opts |= PF_OPT_DISABLE; 2009 mode = O_RDWR; 2010 break; 2011 case 'D': 2012 if (pfctl_cmdline_symset(optarg) < 0) 2013 warnx("could not parse macro definition %s", 2014 optarg); 2015 break; 2016 case 'e': 2017 opts |= PF_OPT_ENABLE; 2018 mode = O_RDWR; 2019 break; 2020 case 'q': 2021 opts |= PF_OPT_QUIET; 2022 break; 2023 case 'F': 2024 clearopt = pfctl_lookup_option(optarg, clearopt_list); 2025 if (clearopt == NULL) { 2026 warnx("Unknown flush modifier '%s'", optarg); 2027 usage(); 2028 } 2029 mode = O_RDWR; 2030 break; 2031 case 'i': 2032 ifaceopt = optarg; 2033 break; 2034 case 'k': 2035 if (state_killers >= 2) { 2036 warnx("can only specify -k twice"); 2037 usage(); 2038 /* NOTREACHED */ 2039 } 2040 state_kill[state_killers++] = optarg; 2041 mode = O_RDWR; 2042 break; 2043 case 'K': 2044 if (src_node_killers >= 2) { 2045 warnx("can only specify -K twice"); 2046 usage(); 2047 /* NOTREACHED */ 2048 } 2049 src_node_kill[src_node_killers++] = optarg; 2050 mode = O_RDWR; 2051 break; 2052 case 'm': 2053 opts |= PF_OPT_MERGE; 2054 break; 2055 case 'n': 2056 opts |= PF_OPT_NOACTION; 2057 break; 2058 case 'N': 2059 loadopt |= PFCTL_FLAG_NAT; 2060 break; 2061 case 'r': 2062 opts |= PF_OPT_USEDNS; 2063 break; 2064 case 'f': 2065 rulesopt = optarg; 2066 mode = O_RDWR; 2067 break; 2068 case 'g': 2069 opts |= PF_OPT_DEBUG; 2070 break; 2071 case 'A': 2072 loadopt |= PFCTL_FLAG_ALTQ; 2073 break; 2074 case 'R': 2075 loadopt |= PFCTL_FLAG_FILTER; 2076 break; 2077 case 'o': 2078 optiopt = pfctl_lookup_option(optarg, optiopt_list); 2079 if (optiopt == NULL) { 2080 warnx("Unknown optimization '%s'", optarg); 2081 usage(); 2082 } 2083 opts |= PF_OPT_OPTIMIZE; 2084 break; 2085 case 'O': 2086 loadopt |= PFCTL_FLAG_OPTION; 2087 break; 2088 case 'p': 2089 pf_device = optarg; 2090 break; 2091 case 'P': 2092 opts |= PF_OPT_NUMERIC; 2093 break; 2094 case 's': 2095 showopt = pfctl_lookup_option(optarg, showopt_list); 2096 if (showopt == NULL) { 2097 warnx("Unknown show modifier '%s'", optarg); 2098 usage(); 2099 } 2100 break; 2101 case 't': 2102 tableopt = optarg; 2103 break; 2104 case 'T': 2105 tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list); 2106 if (tblcmdopt == NULL) { 2107 warnx("Unknown table command '%s'", optarg); 2108 usage(); 2109 } 2110 break; 2111 case 'v': 2112 if (opts & PF_OPT_VERBOSE) 2113 opts |= PF_OPT_VERBOSE2; 2114 opts |= PF_OPT_VERBOSE; 2115 break; 2116 case 'x': 2117 debugopt = pfctl_lookup_option(optarg, debugopt_list); 2118 if (debugopt == NULL) { 2119 warnx("Unknown debug level '%s'", optarg); 2120 usage(); 2121 } 2122 mode = O_RDWR; 2123 break; 2124 case 'z': 2125 opts |= PF_OPT_CLRRULECTRS; 2126 mode = O_RDWR; 2127 break; 2128 case 'h': 2129 /* FALLTHROUGH */ 2130 default: 2131 usage(); 2132 /* NOTREACHED */ 2133 } 2134 } 2135 2136 if (tblcmdopt != NULL) { 2137 argc -= optind; 2138 argv += optind; 2139 ch = *tblcmdopt; 2140 if (ch == 'l') { 2141 loadopt |= PFCTL_FLAG_TABLE; 2142 tblcmdopt = NULL; 2143 } else 2144 mode = strchr("acdefkrz", ch) ? O_RDWR : O_RDONLY; 2145 } else if (argc != optind) { 2146 warnx("unknown command line argument: %s ...", argv[optind]); 2147 usage(); 2148 /* NOTREACHED */ 2149 } 2150 if (loadopt == 0) 2151 loadopt = ~0; 2152 2153 if ((path = calloc(1, MAXPATHLEN)) == NULL) 2154 errx(1, "pfctl: calloc"); 2155 memset(anchorname, 0, sizeof(anchorname)); 2156 if (anchoropt != NULL) { 2157 int len = strlen(anchoropt); 2158 2159 if (anchoropt[len - 1] == '*') { 2160 if (len >= 2 && anchoropt[len - 2] == '/') 2161 anchoropt[len - 2] = '\0'; 2162 else 2163 anchoropt[len - 1] = '\0'; 2164 opts |= PF_OPT_RECURSE; 2165 } 2166 if (strlcpy(anchorname, anchoropt, 2167 sizeof(anchorname)) >= sizeof(anchorname)) 2168 errx(1, "anchor name '%s' too long", 2169 anchoropt); 2170 loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE; 2171 } 2172 2173 if ((opts & PF_OPT_NOACTION) == 0) { 2174 dev = open(pf_device, mode); 2175 if (dev == -1) 2176 err(1, "%s", pf_device); 2177 altqsupport = pfctl_test_altqsupport(dev, opts); 2178 } else { 2179 dev = open(pf_device, O_RDONLY); 2180 if (dev >= 0) 2181 opts |= PF_OPT_DUMMYACTION; 2182 /* turn off options */ 2183 opts &= ~ (PF_OPT_DISABLE | PF_OPT_ENABLE); 2184 clearopt = showopt = debugopt = NULL; 2185#if !defined(ENABLE_ALTQ) 2186 altqsupport = 0; 2187#else 2188 altqsupport = 1; 2189#endif 2190 } 2191 2192 if (opts & PF_OPT_DISABLE) 2193 if (pfctl_disable(dev, opts)) 2194 error = 1; 2195 2196 if (showopt != NULL) { 2197 switch (*showopt) { 2198 case 'A': 2199 pfctl_show_anchors(dev, opts, anchorname); 2200 break; 2201 case 'r': 2202 pfctl_load_fingerprints(dev, opts); 2203 pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES, 2204 anchorname, 0); 2205 break; 2206 case 'l': 2207 pfctl_load_fingerprints(dev, opts); 2208 pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS, 2209 anchorname, 0); 2210 break; 2211 case 'n': 2212 pfctl_load_fingerprints(dev, opts); 2213 pfctl_show_nat(dev, opts, anchorname); 2214 break; 2215 case 'q': 2216 pfctl_show_altq(dev, ifaceopt, opts, 2217 opts & PF_OPT_VERBOSE2); 2218 break; 2219 case 's': 2220 pfctl_show_states(dev, ifaceopt, opts); 2221 break; 2222 case 'S': 2223 pfctl_show_src_nodes(dev, opts); 2224 break; 2225 case 'i': 2226 pfctl_show_status(dev, opts); 2227 break; 2228 case 't': 2229 pfctl_show_timeouts(dev, opts); 2230 break; 2231 case 'm': 2232 pfctl_show_limits(dev, opts); 2233 break; 2234 case 'a': 2235 opts |= PF_OPT_SHOWALL; 2236 pfctl_load_fingerprints(dev, opts); 2237 2238 pfctl_show_nat(dev, opts, anchorname); 2239 pfctl_show_rules(dev, path, opts, 0, anchorname, 0); 2240 pfctl_show_altq(dev, ifaceopt, opts, 0); 2241 pfctl_show_states(dev, ifaceopt, opts); 2242 pfctl_show_src_nodes(dev, opts); 2243 pfctl_show_status(dev, opts); 2244 pfctl_show_rules(dev, path, opts, 1, anchorname, 0); 2245 pfctl_show_timeouts(dev, opts); 2246 pfctl_show_limits(dev, opts); 2247 pfctl_show_tables(anchorname, opts); 2248 pfctl_show_fingerprints(opts); 2249 break; 2250 case 'T': 2251 pfctl_show_tables(anchorname, opts); 2252 break; 2253 case 'o': 2254 pfctl_load_fingerprints(dev, opts); 2255 pfctl_show_fingerprints(opts); 2256 break; 2257 case 'I': 2258 pfctl_show_ifaces(ifaceopt, opts); 2259 break; 2260 } 2261 } 2262 2263 if ((opts & PF_OPT_CLRRULECTRS) && showopt == NULL) 2264 pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING, 2265 anchorname, 0); 2266 2267 if (clearopt != NULL) { 2268 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL) 2269 errx(1, "anchor names beginning with '_' cannot " 2270 "be modified from the command line"); 2271 2272 switch (*clearopt) { 2273 case 'r': 2274 pfctl_clear_rules(dev, opts, anchorname); 2275 break; 2276 case 'n': 2277 pfctl_clear_nat(dev, opts, anchorname); 2278 break; 2279 case 'q': 2280 pfctl_clear_altq(dev, opts); 2281 break; 2282 case 's': 2283 pfctl_clear_states(dev, ifaceopt, opts); 2284 break; 2285 case 'S': 2286 pfctl_clear_src_nodes(dev, opts); 2287 break; 2288 case 'i': 2289 pfctl_clear_stats(dev, opts); 2290 break; 2291 case 'a': 2292 pfctl_clear_rules(dev, opts, anchorname); 2293 pfctl_clear_nat(dev, opts, anchorname); 2294 pfctl_clear_tables(anchorname, opts); 2295 if (!*anchorname) { 2296 pfctl_clear_altq(dev, opts); 2297 pfctl_clear_states(dev, ifaceopt, opts); 2298 pfctl_clear_src_nodes(dev, opts); 2299 pfctl_clear_stats(dev, opts); 2300 pfctl_clear_fingerprints(dev, opts); 2301 pfctl_clear_interface_flags(dev, opts); 2302 } 2303 break; 2304 case 'o': 2305 pfctl_clear_fingerprints(dev, opts); 2306 break; 2307 case 'T': 2308 pfctl_clear_tables(anchorname, opts); 2309 break; 2310 } 2311 } 2312 if (state_killers) { 2313 if (!strcmp(state_kill[0], "label")) 2314 pfctl_label_kill_states(dev, ifaceopt, opts); 2315 else if (!strcmp(state_kill[0], "id")) 2316 pfctl_id_kill_states(dev, ifaceopt, opts); 2317 else 2318 pfctl_net_kill_states(dev, ifaceopt, opts); 2319 } 2320 2321 if (src_node_killers) 2322 pfctl_kill_src_nodes(dev, ifaceopt, opts); 2323 2324 if (tblcmdopt != NULL) { 2325 error = pfctl_command_tables(argc, argv, tableopt, 2326 tblcmdopt, rulesopt, anchorname, opts); 2327 rulesopt = NULL; 2328 } 2329 if (optiopt != NULL) { 2330 switch (*optiopt) { 2331 case 'n': 2332 optimize = 0; 2333 break; 2334 case 'b': 2335 optimize |= PF_OPTIMIZE_BASIC; 2336 break; 2337 case 'o': 2338 case 'p': 2339 optimize |= PF_OPTIMIZE_PROFILE; 2340 break; 2341 } 2342 } 2343 2344 if ((rulesopt != NULL) && (loadopt & PFCTL_FLAG_OPTION) && 2345 !anchorname[0]) 2346 if (pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET)) 2347 error = 1; 2348 2349 if (rulesopt != NULL && !(opts & (PF_OPT_MERGE|PF_OPT_NOACTION)) && 2350 !anchorname[0] && (loadopt & PFCTL_FLAG_OPTION)) 2351 if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE)) 2352 error = 1; 2353 2354 if (rulesopt != NULL) { 2355 if (anchorname[0] == '_' || strstr(anchorname, "/_") != NULL) 2356 errx(1, "anchor names beginning with '_' cannot " 2357 "be modified from the command line"); 2358 if (pfctl_rules(dev, rulesopt, opts, optimize, 2359 anchorname, NULL)) 2360 error = 1; 2361 else if (!(opts & PF_OPT_NOACTION) && 2362 (loadopt & PFCTL_FLAG_TABLE)) 2363 warn_namespace_collision(NULL); 2364 } 2365 2366 if (opts & PF_OPT_ENABLE) 2367 if (pfctl_enable(dev, opts)) 2368 error = 1; 2369 2370 if (debugopt != NULL) { 2371 switch (*debugopt) { 2372 case 'n': 2373 pfctl_debug(dev, PF_DEBUG_NONE, opts); 2374 break; 2375 case 'u': 2376 pfctl_debug(dev, PF_DEBUG_URGENT, opts); 2377 break; 2378 case 'm': 2379 pfctl_debug(dev, PF_DEBUG_MISC, opts); 2380 break; 2381 case 'l': 2382 pfctl_debug(dev, PF_DEBUG_NOISY, opts); 2383 break; 2384 } 2385 } 2386 2387 exit(error); 2388} 2389