/usr/src/sbin/pfctl/pfctl.c

Bug Summary

File:	src/sbin/pfctl/pfctl.c
Warning:	line 985, column 15 Potential leak of memory pointed to by 'npath'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name pfctl.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/pfctl/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sbin/pfctl -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -Wno-uninitialized -fdebug-compilation-dir=/usr/src/sbin/pfctl/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/sbin/pfctl/pfctl.c
1/*	$OpenBSD: pfctl.c,v 1.385 2021/11/11 12:49:53 sashan Exp $ */

3/*
* Copyright (c) 2001 Daniel Hartmeier
* Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
*    - Redistributions of source code must retain the above copyright
*      notice, this list of conditions and the following disclaimer.
*    - Redistributions in binary form must reproduce the above
*      copyright notice, this list of conditions and the following
*      disclaimer in the documentation and/or other materials provided
*      with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/

34#include <sys/types.h>
35#include <sys/ioctl.h>
36#include <sys/socket.h>
37#include <sys/stat.h>

39#include <net/if.h>
40#include <netinet/in.h>
41#include <net/pfvar.h>
42#include <arpa/inet.h>
43#include <sys/sysctl.h>

45#include <err.h>
46#include <errno(*__errno()).h>
47#include <fcntl.h>
48#include <limits.h>
49#include <netdb.h>
50#include <stdio.h>
51#include <stdlib.h>
52#include <string.h>
53#include <unistd.h>
54#include <syslog.h>
55#include <stdarg.h>
56#include <libgen.h>

58#include "pfctl_parser.h"
59#include "pfctl.h"

61void	 usage(void);
62int	 pfctl_enable(int, int);
63int	 pfctl_disable(int, int);
64void	 pfctl_clear_queues(struct pf_qihead *);
65void	 pfctl_clear_stats(int, const char *, int);
66void	 pfctl_clear_interface_flags(int, int);
67int	 pfctl_clear_rules(int, int, char *);
68void	 pfctl_clear_src_nodes(int, int);
69void	 pfctl_clear_states(int, const char *, int);
70struct addrinfo *
pfctl_addrprefix(char *, struct pf_addr *, int);
72void	 pfctl_kill_src_nodes(int, int);
73void	 pfctl_net_kill_states(int, const char *, int, int);
74void	 pfctl_label_kill_states(int, const char *, int, int);
75void	 pfctl_id_kill_states(int, int);
76void	 pfctl_key_kill_states(int, const char *, int, int);
77int	 pfctl_parse_host(char *, struct pf_rule_addr *);
78void	 pfctl_init_options(struct pfctl *);
79int	 pfctl_load_options(struct pfctl *);
80int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
81int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
82int	 pfctl_load_debug(struct pfctl *, unsigned int);
83int	 pfctl_load_logif(struct pfctl *, char *);
84int	 pfctl_load_hostid(struct pfctl *, unsigned int);
85int	 pfctl_load_reassembly(struct pfctl *, u_int32_t);
86int	 pfctl_load_syncookies(struct pfctl *, u_int8_t);
87int	 pfctl_set_synflwats(struct pfctl *, u_int32_t, u_int32_t);
88void	 pfctl_print_rule_counters(struct pf_rule *, int);
89int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int, int,
   long);
91int	 pfctl_show_src_nodes(int, int);
92int	 pfctl_show_states(int, const char *, int, long);
93int	 pfctl_show_status(int, int);
94int	 pfctl_show_timeouts(int, int);
95int	 pfctl_show_limits(int, int);
96void	 pfctl_debug(int, u_int32_t, int);
97int	 pfctl_show_anchors(int, int, char *);
98int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
99u_int	 pfctl_find_childqs(struct pfctl_qsitem *);
100void	 pfctl_load_queue(struct pfctl *, u_int32_t, struct pfctl_qsitem *);
101int	 pfctl_load_queues(struct pfctl *);
102u_int	 pfctl_leafqueue_check(char *);
103u_int	 pfctl_check_qassignments(struct pf_ruleset *);
104int	 pfctl_load_ruleset(struct pfctl *, char *, struct pf_ruleset *, int);
105int	 pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
106const char	*pfctl_lookup_option(char *, const char **);
107void	pfctl_state_store(int, const char *);
108void	pfctl_state_load(int, const char *);
109void	pfctl_reset(int, int);
110int	pfctl_walk_show(int, struct pfioc_ruleset *, void *);
111int	pfctl_walk_get(int, struct pfioc_ruleset *, void *);
112int	pfctl_walk_anchors(int, int, const char *,
  int(*)(int, struct pfioc_ruleset *, void *), void *);
114struct pfr_anchors *
pfctl_get_anchors(int, const char *, int);
116int	pfctl_recurse(int, int, const char *,
   int(*)(int, int, struct pfr_anchoritem *));
118int	pfctl_call_clearrules(int, int, struct pfr_anchoritem *);
119int	pfctl_call_cleartables(int, int, struct pfr_anchoritem *);
120int	pfctl_call_clearanchors(int, int, struct pfr_anchoritem *);

122const char	*clearopt;
123char		*rulesopt;
124const char	*showopt;
125const char	*debugopt;
126char		*anchoropt;
127const char	*optiopt = NULL((void *)0);
128char		*pf_device = "/dev/pf";
129char		*ifaceopt;
130char		*tableopt;
131const char	*tblcmdopt;
132int		 src_node_killers;
133char		*src_node_kill[2];
134int		 state_killers;
135char		*state_kill[2];

137int		 dev = -1;
138int		 first_title = 1;
139int		 labels = 0;
140int		 exit_val = 0;

142#define INDENT(d, o)do { if (o) { int i; for (i=0; i < d; i++) printf("  "); }
 } while (0)	do {						\
		if (o) {				\
			int i;				\
			for (i=0; i < d; i++)		\
				printf("  ");		\
		}					\
	} while (0)					\


151static const struct {
const char	*name;
int		index;
154} pf_limits[] = {
{ "states",		PF_LIMIT_STATES },
{ "src-nodes",		PF_LIMIT_SRC_NODES },
{ "frags",		PF_LIMIT_FRAGS },
{ "tables",		PF_LIMIT_TABLES },
{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
{ "pktdelay-pkts",	PF_LIMIT_PKTDELAY_PKTS },
{ NULL((void *)0),			0 }
162};

164struct pf_hint {
const char	*name;
int		timeout;
167};
168static const struct pf_hint pf_hint_normal[] = {
{ "tcp.first",		2 * 60 },
{ "tcp.opening",	30 },
{ "tcp.established",	24 * 60 * 60 },
{ "tcp.closing",	15 * 60 },
{ "tcp.finwait",	45 },
{ "tcp.closed",		90 },
{ "tcp.tsdiff",		30 },
{ NULL((void *)0),			0 }
177};
178static const struct pf_hint pf_hint_satellite[] = {
{ "tcp.first",		3 * 60 },
{ "tcp.opening",	30 + 5 },
{ "tcp.established",	24 * 60 * 60 },
{ "tcp.closing",	15 * 60 + 5 },
{ "tcp.finwait",	45 + 5 },
{ "tcp.closed",		90 + 5 },
{ "tcp.tsdiff",		60 },
{ NULL((void *)0),			0 }
187};
188static const struct pf_hint pf_hint_conservative[] = {
{ "tcp.first",		60 * 60 },
{ "tcp.opening",	15 * 60 },
{ "tcp.established",	5 * 24 * 60 * 60 },
{ "tcp.closing",	60 * 60 },
{ "tcp.finwait",	10 * 60 },
{ "tcp.closed",		3 * 60 },
{ "tcp.tsdiff",		60 },
{ NULL((void *)0),			0 }
197};
198static const struct pf_hint pf_hint_aggressive[] = {
{ "tcp.first",		30 },
{ "tcp.opening",	5 },
{ "tcp.established",	5 * 60 * 60 },
{ "tcp.closing",	60 },
{ "tcp.finwait",	30 },
{ "tcp.closed",		30 },
{ "tcp.tsdiff",		10 },
{ NULL((void *)0),			0 }
207};

209static const struct {
const char *name;
const struct pf_hint *hint;
212} pf_hints[] = {
{ "normal",		pf_hint_normal },
{ "satellite",		pf_hint_satellite },
{ "high-latency",	pf_hint_satellite },
{ "conservative",	pf_hint_conservative },
{ "aggressive",		pf_hint_aggressive },
{ NULL((void *)0),			NULL((void *)0) }
219};

221static const char *clearopt_list[] = {
"rules", "Sources", "states", "info", "Tables", "osfp", "Reset",
"all", NULL((void *)0)
224};

226static const char *showopt_list[] = {
"queue", "rules", "Anchors", "Sources", "states", "info",
"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
"all", NULL((void *)0)
230};

232static const char *tblcmdopt_list[] = {
"kill", "flush", "add", "delete", "replace", "show",
"test", "zero", "expire", NULL((void *)0)
235};

237static const char *debugopt_list[] = {
"debug", "info", "notice", "warning",
"error", "crit", "alert", "emerg",
NULL((void *)0)
241};

243static const char *optiopt_list[] = {
"none", "basic", "profile", NULL((void *)0)
245};

247struct pf_qihead qspecs = TAILQ_HEAD_INITIALIZER(qspecs){ ((void *)0), &(qspecs).tqh_first };
248struct pf_qihead rootqs = TAILQ_HEAD_INITIALIZER(rootqs){ ((void *)0), &(rootqs).tqh_first };

250__dead__attribute__((__noreturn__)) void
251usage(void)
252{
extern char *__progname;

fprintf(stderr(&__sF[2]), "usage: %s [-deghNnPqrvz] ", __progname);
fprintf(stderr(&__sF[2]), "[-a anchor] [-D macro=value] [-F modifier]");
fprintf(stderr(&__sF[2]), " [-f file]\n");
fprintf(stderr(&__sF[2]), "\t[-i interface] [-K key] [-k key] [-L statefile]");
fprintf(stderr(&__sF[2]), " [-o level]\n");
fprintf(stderr(&__sF[2]), "\t[-p device] [-S statefile] [-s modifier [-R id]]\n");
fprintf(stderr(&__sF[2]), "\t[-t table -T command [address ...]]");
fprintf(stderr(&__sF[2]), " [-V rdomain] [-x level]\n");
exit(1);
264}

266void
267pfctl_err(int opts, int eval, const char *fmt, ...)
268{
va_list	ap;

va_start(ap, fmt)__builtin_va_start(ap, fmt);

if ((opts & PF_OPT_IGNFAIL0x10000) == 0)
verr(eval, fmt, ap);
else
vwarn(fmt, ap);

va_end(ap)__builtin_va_end(ap);

exit_val = eval;
281}

283void
284pfctl_errx(int opts, int eval, const char *fmt, ...)
285{
va_list	ap;

va_start(ap, fmt)__builtin_va_start(ap, fmt);

if ((opts & PF_OPT_IGNFAIL0x10000) == 0)
verrx(eval, fmt, ap);
else
vwarnx(fmt, ap);

va_end(ap)__builtin_va_end(ap);

exit_val = eval;
298}

300int
301pfctl_enable(int dev, int opts)
302{
if (ioctl(dev, DIOCSTART((unsigned long)0x20000000 | ((0 & 0x1fff) << 16) |
 ((('D')) << 8) | ((1)))) == -1) {
if (errno(*__errno()) == EEXIST17)
	errx(1, "pf already enabled");
else
	err(1, "DIOCSTART");
}
if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "pf enabled\n");

return (0);
313}

315int
316pfctl_disable(int dev, int opts)
317{
if (ioctl(dev, DIOCSTOP((unsigned long)0x20000000 | ((0 & 0x1fff) << 16) |
 ((('D')) << 8) | ((2)))) == -1) {
if (errno(*__errno()) == ENOENT2)
	errx(1, "pf not enabled");
else
	err(1, "DIOCSTOP");
}
if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "pf disabled\n");

return (0);
328}

330void
331pfctl_clear_stats(int dev, const char *iface, int opts)
332{
struct pfioc_iface pi;

memset(&pi, 0, sizeof(pi));
if (iface != NULL((void *)0) && strlcpy(pi.pfiio_name, iface,
   sizeof(pi.pfiio_name)) >= sizeof(pi.pfiio_name))
pfctl_errx(opts, 1, "invalid interface: %s", iface);

if (ioctl(dev, DIOCCLRSTATUS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_iface) & 0x1fff) << 16) | ((('D')) <<
 8) | ((22))), &pi) == -1)
pfctl_err(opts, 1, "DIOCCLRSTATUS");
if ((opts & PF_OPT_QUIET0x00010) == 0) {
fprintf(stderr(&__sF[2]), "pf: statistics cleared");
if (iface != NULL((void *)0))
	fprintf(stderr(&__sF[2]), " for interface %s", iface);
fprintf(stderr(&__sF[2]), "\n");
}
348}

350void
351pfctl_clear_interface_flags(int dev, int opts)
352{
struct pfioc_iface	pi;

if ((opts & PF_OPT_NOACTION0x00008) == 0) {
bzero(&pi, sizeof(pi));
pi.pfiio_flags = PFI_IFLAG_SKIP0x0100;

if (ioctl(dev, DIOCCLRIFFLAG(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_iface) & 0x1fff) << 16) | ((('D')) <<
 8) | ((90))), &pi) == -1)
	pfctl_err(opts, 1, "DIOCCLRIFFLAG");
if ((opts & PF_OPT_QUIET0x00010) == 0)
	fprintf(stderr(&__sF[2]), "pf: interface flags reset\n");
}
364}

366int
367pfctl_clear_rules(int dev, int opts, char *anchorname)
368{
struct pfr_buffer 	t;

memset(&t, 0, sizeof(t));
t.pfrb_type = PFRB_TRANS;
if (pfctl_add_trans(&t, PF_TRANS_RULESET, anchorname) ||
   pfctl_trans(dev, &t, DIOCXBEGIN(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((81))), 0) ||
   pfctl_trans(dev, &t, DIOCXCOMMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((82))), 0)) {
pfctl_err(opts, 1, "%s", __func__);
return (1);
} else if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "rules cleared\n");

return (0);
382}

384void
385pfctl_clear_src_nodes(int dev, int opts)
386{
if (ioctl(dev, DIOCCLRSRCNODES((unsigned long)0x20000000 | ((0 & 0x1fff) << 16) |
 ((('D')) << 8) | ((85)))) == -1)
pfctl_err(opts, 1, "DIOCCLRSRCNODES");
if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "source tracking entries cleared\n");
391}

393void
394pfctl_clear_states(int dev, const char *iface, int opts)
395{
struct pfioc_state_kill psk;

memset(&psk, 0, sizeof(psk));
if (iface != NULL((void *)0) && strlcpy(psk.psk_ifname, iface,
   sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
pfctl_errx(opts, 1, "invalid interface: %s", iface);

if (ioctl(dev, DIOCCLRSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state_kill) & 0x1fff) << 16) | ((('D'
)) << 8) | ((18))), &psk) == -1)
pfctl_err(opts, 1, "DIOCCLRSTATES");
if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "%d states cleared\n", psk.psk_killed);
407}

409struct addrinfo *
410pfctl_addrprefix(char *addr, struct pf_addr *mask, int numeric)
411{
char *p;
const char *errstr;
int prefix, ret_ga, q, r;
struct addrinfo hints, *res;

bzero(&hints, sizeof(hints));
hints.ai_socktype = SOCK_DGRAM2;	/* dummy */
if (numeric)
hints.ai_flags = AI_NUMERICHOST4;

if ((p = strchr(addr, '/')) != NULL((void *)0)) {
*p++ = '\0';
/* prefix only with numeric addresses */
hints.ai_flags |= AI_NUMERICHOST4;
}

if ((ret_ga = getaddrinfo(addr, NULL((void *)0), &hints, &res))) {
errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
/* NOTREACHED */
}

if (p == NULL((void *)0))
return res;

prefix = strtonum(p, 0, res->ai_family == AF_INET624 ? 128 : 32, &errstr);
if (errstr)
errx(1, "prefix is %s: %s", errstr, p);

q = prefix >> 3;
r = prefix & 7;
switch (res->ai_family) {
case AF_INET2:
bzero(&mask->v4pfa.v4, sizeof(mask->v4pfa.v4));
mask->v4pfa.v4.s_addr = htonl((u_int32_t)(__uint32_t)(__builtin_constant_p((u_int32_t) (0xffffffffffULL
 << (32 - prefix))) ? (__uint32_t)(((__uint32_t)((u_int32_t
) (0xffffffffffULL << (32 - prefix))) & 0xff) <<
| ((__uint32_t)((u_int32_t) (0xffffffffffULL << (32
 - prefix))) & 0xff00) << 8 | ((__uint32_t)((u_int32_t
) (0xffffffffffULL << (32 - prefix))) & 0xff0000) >>
| ((__uint32_t)((u_int32_t) (0xffffffffffULL << (32 -
 prefix))) & 0xff000000) >> 24) : __swap32md((u_int32_t
) (0xffffffffffULL << (32 - prefix))))
    (0xffffffffffULL << (32 - prefix)))(__uint32_t)(__builtin_constant_p((u_int32_t) (0xffffffffffULL
 << (32 - prefix))) ? (__uint32_t)(((__uint32_t)((u_int32_t
) (0xffffffffffULL << (32 - prefix))) & 0xff) <<
| ((__uint32_t)((u_int32_t) (0xffffffffffULL << (32
 - prefix))) & 0xff00) << 8 | ((__uint32_t)((u_int32_t
) (0xffffffffffULL << (32 - prefix))) & 0xff0000) >>
| ((__uint32_t)((u_int32_t) (0xffffffffffULL << (32 -
 prefix))) & 0xff000000) >> 24) : __swap32md((u_int32_t
) (0xffffffffffULL << (32 - prefix))));
break;
case AF_INET624:
bzero(&mask->v6pfa.v6, sizeof(mask->v6pfa.v6));
if (q > 0)
	memset((void *)&mask->v6pfa.v6, 0xff, q);
if (r > 0)
	*((u_char *)&mask->v6pfa.v6 + q) =
	    (0xff00 >> r) & 0xff;
break;
}

return res;
459}

461void
462pfctl_kill_src_nodes(int dev, int opts)
463{
struct pfioc_src_node_kill psnk;
struct addrinfo *res[2], *resp[2];
struct sockaddr last_src, last_dst;
int killed, sources, dests;

killed = sources = dests = 0;

memset(&psnk, 0, sizeof(psnk));
memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
   sizeof(psnk.psnk_src.addr.v.a.mask));
memset(&last_src, 0xff, sizeof(last_src));
memset(&last_dst, 0xff, sizeof(last_dst));

res[0] = pfctl_addrprefix(src_node_kill[0],
   &psnk.psnk_src.addr.v.a.mask, (opts & PF_OPT_NODNS0x01000));

for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
if (resp[0]->ai_addr == NULL((void *)0))
	continue;
/* We get lots of duplicates.  Catch the easy ones */
if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
	continue;
last_src = *(struct sockaddr *)resp[0]->ai_addr;

psnk.psnk_af = resp[0]->ai_family;
sources++;

copy_satopfaddr(&psnk.psnk_src.addr.v.a.addr, resp[0]->ai_addr);

if (src_node_killers > 1) {
	dests = 0;
	memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
	    sizeof(psnk.psnk_dst.addr.v.a.mask));
	memset(&last_dst, 0xff, sizeof(last_dst));
	res[1] = pfctl_addrprefix(src_node_kill[1],
	    &psnk.psnk_dst.addr.v.a.mask,
	    (opts & PF_OPT_NODNS0x01000));
	for (resp[1] = res[1]; resp[1];
	    resp[1] = resp[1]->ai_next) {
		if (resp[1]->ai_addr == NULL((void *)0))
			continue;
		if (psnk.psnk_af != resp[1]->ai_family)
			continue;

		if (memcmp(&last_dst, resp[1]->ai_addr,
		    sizeof(last_dst)) == 0)
			continue;
		last_dst = *(struct sockaddr *)resp[1]->ai_addr;

		dests++;

		copy_satopfaddr(&psnk.psnk_src.addr.v.a.addr,
		    resp[1]->ai_addr);

		if (ioctl(dev, DIOCKILLSRCNODES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_src_node_kill) & 0x1fff) << 16) | (((
'D')) << 8) | ((91))), &psnk) == -1)
			err(1, "DIOCKILLSRCNODES");
		killed += psnk.psnk_killed;
	}
	freeaddrinfo(res[1]);
} else {
	if (ioctl(dev, DIOCKILLSRCNODES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_src_node_kill) & 0x1fff) << 16) | (((
'D')) << 8) | ((91))), &psnk) == -1)
		err(1, "DIOCKILLSRCNODES");
	killed += psnk.psnk_killed;
}
}

freeaddrinfo(res[0]);

if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "killed %d src nodes from %d sources and %d "
    "destinations\n", killed, sources, dests);
535}

537void
538pfctl_net_kill_states(int dev, const char *iface, int opts, int rdomain)
539{
struct pfioc_state_kill psk;
struct addrinfo *res[2], *resp[2];
struct sockaddr last_src, last_dst;
int killed, sources, dests;

killed = sources = dests = 0;

memset(&psk, 0, sizeof(psk));
memset(&psk.psk_src.addr.v.a.mask, 0xff,
   sizeof(psk.psk_src.addr.v.a.mask));
memset(&last_src, 0xff, sizeof(last_src));
memset(&last_dst, 0xff, sizeof(last_dst));
if (iface != NULL((void *)0) && strlcpy(psk.psk_ifname, iface,
   sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
errx(1, "invalid interface: %s", iface);

psk.psk_rdomain = rdomain;

res[0] = pfctl_addrprefix(state_kill[0],
   &psk.psk_src.addr.v.a.mask, (opts & PF_OPT_NODNS0x01000));

for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
if (resp[0]->ai_addr == NULL((void *)0))
	continue;
/* We get lots of duplicates.  Catch the easy ones */
if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
	continue;
last_src = *(struct sockaddr *)resp[0]->ai_addr;

psk.psk_af = resp[0]->ai_family;
sources++;

copy_satopfaddr(&psk.psk_src.addr.v.a.addr, resp[0]->ai_addr);

if (state_killers > 1) {
	dests = 0;
	memset(&psk.psk_dst.addr.v.a.mask, 0xff,
	    sizeof(psk.psk_dst.addr.v.a.mask));
	memset(&last_dst, 0xff, sizeof(last_dst));
	res[1] = pfctl_addrprefix(state_kill[1],
	    &psk.psk_dst.addr.v.a.mask,
	    (opts & PF_OPT_NODNS0x01000));
	for (resp[1] = res[1]; resp[1];
	    resp[1] = resp[1]->ai_next) {
		if (resp[1]->ai_addr == NULL((void *)0))
			continue;
		if (psk.psk_af != resp[1]->ai_family)
			continue;

		if (memcmp(&last_dst, resp[1]->ai_addr,
		    sizeof(last_dst)) == 0)
			continue;
		last_dst = *(struct sockaddr *)resp[1]->ai_addr;

		dests++;

		copy_satopfaddr(&psk.psk_src.addr.v.a.addr,
		    resp[1]->ai_addr);

		if (ioctl(dev, DIOCKILLSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state_kill) & 0x1fff) << 16) | ((('D'
)) << 8) | ((41))), &psk) == -1)
			err(1, "DIOCKILLSTATES");
		killed += psk.psk_killed;
	}
	freeaddrinfo(res[1]);
} else {
	if (ioctl(dev, DIOCKILLSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state_kill) & 0x1fff) << 16) | ((('D'
)) << 8) | ((41))), &psk) == -1)
		err(1, "DIOCKILLSTATES");
	killed += psk.psk_killed;
}
}

freeaddrinfo(res[0]);

if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "killed %d states from %d sources and %d "
    "destinations\n", killed, sources, dests);
616}

618void
619pfctl_label_kill_states(int dev, const char *iface, int opts, int rdomain)
620{
struct pfioc_state_kill psk;

if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
warnx("no label specified");
usage();
}
memset(&psk, 0, sizeof(psk));
if (iface != NULL((void *)0) && strlcpy(psk.psk_ifname, iface,
   sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
errx(1, "invalid interface: %s", iface);

if (strlcpy(psk.psk_label, state_kill[1], sizeof(psk.psk_label)) >=
   sizeof(psk.psk_label))
errx(1, "label too long: %s", state_kill[1]);

psk.psk_rdomain = rdomain;

if (ioctl(dev, DIOCKILLSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state_kill) & 0x1fff) << 16) | ((('D'
)) << 8) | ((41))), &psk) == -1)
err(1, "DIOCKILLSTATES");

if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "killed %d states\n", psk.psk_killed);
643}

645void
646pfctl_id_kill_states(int dev, int opts)
647{
struct pfioc_state_kill psk;

if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
warnx("no id specified");
usage();
}

memset(&psk, 0, sizeof(psk));
if ((sscanf(state_kill[1], "%llx/%x",
   &psk.psk_pfcmp.id, &psk.psk_pfcmp.creatorid)) == 2)
HTONL(psk.psk_pfcmp.creatorid)(psk.psk_pfcmp.creatorid) = (__uint32_t)(__builtin_constant_p
((u_int32_t)(psk.psk_pfcmp.creatorid)) ? (__uint32_t)(((__uint32_t
)((u_int32_t)(psk.psk_pfcmp.creatorid)) & 0xff) << 24
 | ((__uint32_t)((u_int32_t)(psk.psk_pfcmp.creatorid)) & 0xff00
) << 8 | ((__uint32_t)((u_int32_t)(psk.psk_pfcmp.creatorid
)) & 0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(psk
.psk_pfcmp.creatorid)) & 0xff000000) >> 24) : __swap32md
((u_int32_t)(psk.psk_pfcmp.creatorid)));
else if ((sscanf(state_kill[1], "%llx", &psk.psk_pfcmp.id)) == 1) {
psk.psk_pfcmp.creatorid = 0;
} else {
warnx("wrong id format specified");
usage();
}
if (psk.psk_pfcmp.id == 0) {
warnx("cannot kill id 0");
usage();
}

psk.psk_pfcmp.id = htobe64(psk.psk_pfcmp.id)(__uint64_t)(__builtin_constant_p(psk.psk_pfcmp.id) ? (__uint64_t
)((((__uint64_t)(psk.psk_pfcmp.id) & 0xff) << 56) |
 ((__uint64_t)(psk.psk_pfcmp.id) & 0xff00ULL) << 40
 | ((__uint64_t)(psk.psk_pfcmp.id) & 0xff0000ULL) <<
| ((__uint64_t)(psk.psk_pfcmp.id) & 0xff000000ULL) <<
| ((__uint64_t)(psk.psk_pfcmp.id) & 0xff00000000ULL) >>
| ((__uint64_t)(psk.psk_pfcmp.id) & 0xff0000000000ULL)
 >> 24 | ((__uint64_t)(psk.psk_pfcmp.id) & 0xff000000000000ULL
) >> 40 | ((__uint64_t)(psk.psk_pfcmp.id) & 0xff00000000000000ULL
) >> 56) : __swap64md(psk.psk_pfcmp.id));
if (ioctl(dev, DIOCKILLSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state_kill) & 0x1fff) << 16) | ((('D'
)) << 8) | ((41))), &psk) == -1)
err(1, "DIOCKILLSTATES");

if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "killed %d states\n", psk.psk_killed);
676}

678void
679pfctl_key_kill_states(int dev, const char *iface, int opts, int rdomain)
680{
struct pfioc_state_kill psk;
char *s, *token, *tokens[4];
struct protoent *p;
u_int i, sidx, didx;

if (state_killers != 2 || (strlen(state_kill[1]) == 0)) {
warnx("no key specified");
usage();
}
memset(&psk, 0, sizeof(psk));

if (iface != NULL((void *)0) && strlcpy(psk.psk_ifname, iface,
   sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
errx(1, "invalid interface: %s", iface);

psk.psk_rdomain = rdomain;

s = strdup(state_kill[1]);
if (!s)
errx(1, "pfctl_key_kill_states: strdup");
i = 0;
while ((token = strsep(&s, " \t")) != NULL((void *)0))
if (*token != '\0') {
	if (i < 4)
		tokens[i] = token;
	i++;
}
if (i != 4)
errx(1, "pfctl_key_kill_states: key must be "
    "\"protocol host1:port1 direction host2:port2\" format");

if ((p = getprotobyname(tokens[0])) == NULL((void *)0))
errx(1, "invalid protocol: %s", tokens[0]);
psk.psk_proto = p->p_proto;

if (strcmp(tokens[2], "->") == 0) {
sidx = 1;
didx = 3;
} else if (strcmp(tokens[2], "<-") == 0) {
sidx = 3;
didx = 1;
} else
errx(1, "invalid direction: %s", tokens[2]);

if (pfctl_parse_host(tokens[sidx], &psk.psk_src) == -1)
errx(1, "invalid host: %s", tokens[sidx]);
if (pfctl_parse_host(tokens[didx], &psk.psk_dst) == -1)
errx(1, "invalid host: %s", tokens[didx]);

if (ioctl(dev, DIOCKILLSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state_kill) & 0x1fff) << 16) | ((('D'
)) << 8) | ((41))), &psk) == -1)
err(1, "DIOCKILLSTATES");

if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "killed %d states\n", psk.psk_killed);
735}

737int
738pfctl_parse_host(char *str, struct pf_rule_addr *addr)
739{
char *s = NULL((void *)0), *sbs, *sbe;
struct addrinfo hints, *ai;

s = strdup(str);
if (!s)
errx(1, "pfctl_parse_host: strdup");

memset(&hints, 0, sizeof(hints));
hints.ai_socktype = SOCK_DGRAM2;	/* dummy */
hints.ai_flags = AI_NUMERICHOST4;

if ((sbs = strchr(s, '[')) != NULL((void *)0) && (sbe = strrchr(s, ']')) != NULL((void *)0)) {
hints.ai_family = AF_INET624;
*(sbs++) = *sbe = '\0';
} else if ((sbs = strchr(s, ':')) != NULL((void *)0)) {
hints.ai_family = AF_INET2;
*(sbs++) = '\0';
} else
goto error;

if (getaddrinfo(s, sbs, &hints, &ai) != 0)
goto error;

copy_satopfaddr(&addr->addr.v.a.addr, ai->ai_addr);
addr->port[0] = ai->ai_family == AF_INET624 ?
   ((struct sockaddr_in6 *)ai->ai_addr)->sin6_port :
   ((struct sockaddr_in *)ai->ai_addr)->sin_port;

freeaddrinfo(ai);
free(s);

memset(&addr->addr.v.a.mask, 0xff, sizeof(struct pf_addr));
addr->port_op = PF_OP_EQ;
addr->addr.type = PF_ADDR_ADDRMASK;

return (0);

error:
free(s);
return (-1);
780}

782void
783pfctl_print_rule_counters(struct pf_rule *rule, int opts)
784{
if (opts & PF_OPT_DEBUG0x00200) {
const char *t[PF_SKIP_COUNT9] = { "i", "d", "r", "f",
    "p", "sa", "da", "sp", "dp" };
int i;

printf("  [ Skip steps: ");
for (i = 0; i < PF_SKIP_COUNT9; ++i) {
	if (rule->skip[i].nr == rule->nr + 1)
		continue;
	printf("%s=", t[i]);
	if (rule->skip[i].nr == -1)
		printf("end ");
	else
		printf("%u ", rule->skip[i].nr);
}
printf("]\n");

printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
    rule->qname, rule->qid, rule->pqname, rule->pqid);
}
if (opts & PF_OPT_VERBOSE0x00004) {
printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
	    "Bytes: %-10llu  States: %-6u]\n",
	    (unsigned long long)rule->evaluations,
	    (unsigned long long)(rule->packets[0] +
	    rule->packets[1]),
	    (unsigned long long)(rule->bytes[0] +
	    rule->bytes[1]), rule->states_cur);
if (!(opts & PF_OPT_DEBUG0x00200))
	printf("  [ Inserted: uid %lu pid %lu "
	    "State Creations: %-6u]\n",
	    (unsigned long)rule->cuid, (unsigned long)rule->cpid,
	    rule->states_tot);
}
819}

821void
822pfctl_print_title(char *title)
823{
if (!first_title)
printf("\n");
first_title = 0;
printf("%s\n", title);
828}

830int
831pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
  char *anchorname, int depth, int wildcard, long shownr)
833{
struct pfioc_rule pr;
u_int32_t nr, mnr, header = 0;
int len = strlen(path), ret = 0;
char *npath, *p;

/*
* Truncate a trailing / and * on an anchorname before searching for
* the ruleset, this is syntactic sugar that doesn't actually make it
* to the kernel.
*/
if ((p = strrchr(anchorname, '/')) != NULL((void *)0) &&
1
Assuming the condition is false→
   p[1] == '*' && p[2] == '\0') {
p[0] = '\0';
}

memset(&pr, 0, sizeof(pr));
if (anchorname[0] == '/') {
2
←
Assuming the condition is true→
3
←
Taking true branch→
if ((npath = calloc(1, PATH_MAX1024)) == NULL((void *)0))
4
←
Memory is allocated→
5
←
Assuming the condition is false→
6
←
Taking false branch→
	err(1, "calloc");
strlcpy(npath, anchorname, PATH_MAX1024);
} else {
if (path[0])
	snprintf(&path[len], PATH_MAX1024 - len, "/%s", anchorname);
else
	snprintf(&path[len], PATH_MAX1024 - len, "%s", anchorname);
npath = path;
}

memcpy(pr.anchor, npath, sizeof(pr.anchor));
if (opts & PF_OPT_SHOWALL0x00400) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
pr.rule.action = PF_PASS;
if (ioctl(dev, DIOCGETRULES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_rule) & 0x1fff) << 16) | ((('D')) <<
 8) | ((6))), &pr) == -1) {
	warnx("%s", pf_strerror(errno(*__errno())));
	ret = -1;
	goto error;
}
header++;
if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
	pfctl_print_title("FILTER RULES:");
else if (format == PFCTL_SHOW_LABELS && labels)
	pfctl_print_title("LABEL COUNTERS:");
}
if (opts & PF_OPT_CLRRULECTRS0x00020)
9
←
Assuming the condition is false→
10
←
Taking false branch→
pr.action = PF_GET_CLR_CNTR;

pr.rule.action = PF_PASS;
if (ioctl(dev, DIOCGETRULES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_rule) & 0x1fff) << 16) | ((('D')) <<
 8) | ((6))), &pr) == -1) {
11
←
Assuming the condition is false→
12
←
Taking false branch→
warnx("%s", pf_strerror(errno(*__errno())));
ret = -1;
goto error;
}

if (shownr < 0) {
13
←
Assuming 'shownr' is < 0→
14
←
Taking true branch→
mnr = pr.nr;
nr = 0;
} else if (shownr < pr.nr) {
nr = shownr;
mnr = shownr + 1;
} else {
warnx("rule %ld not found", shownr);
ret = -1;
goto error;
}
for (; nr < mnr; ++nr) {
15
←
Assuming 'nr' is >= 'mnr'→
16
←
Loop condition is false. Execution continues on line 964→
pr.nr = nr;
if (ioctl(dev, DIOCGETRULE(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_rule) & 0x1fff) << 16) | ((('D')) <<
 8) | ((7))), &pr) == -1) {
	warn("DIOCGETRULE");
	ret = -1;
	goto error;
}

/* anchor is the same for all rules in it */
if (pr.rule.anchor_wildcard == 0)
	wildcard = 0;

switch (format) {
case PFCTL_SHOW_LABELS:
	if (pr.rule.label[0]) {
		INDENT(depth, !(opts & PF_OPT_VERBOSE))do { if (!(opts & 0x00004)) { int i; for (i=0; i < depth
; i++) printf("  "); } } while (0);
		printf("%s %llu %llu %llu %llu"
		    " %llu %llu %llu %llu\n",
		    pr.rule.label,
		    (unsigned long long)pr.rule.evaluations,
		    (unsigned long long)(pr.rule.packets[0] +
		    pr.rule.packets[1]),
		    (unsigned long long)(pr.rule.bytes[0] +
		    pr.rule.bytes[1]),
		    (unsigned long long)pr.rule.packets[0],
		    (unsigned long long)pr.rule.bytes[0],
		    (unsigned long long)pr.rule.packets[1],
		    (unsigned long long)pr.rule.bytes[1],
		    (unsigned long long)pr.rule.states_tot);
	}
	break;
case PFCTL_SHOW_RULES:
	if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL0x00400))
		labels = 1;
	INDENT(depth, !(opts & PF_OPT_VERBOSE))do { if (!(opts & 0x00004)) { int i; for (i=0; i < depth
; i++) printf("  "); } } while (0);
	print_rule(&pr.rule, pr.anchor_call, opts);

	/*
	 * If this is an 'unnamed' brace notation anchor OR
	 * the user has explicitly requested recursion,
	 * print it recursively.
	 */
     		        if (pr.anchor_call[0] &&
	    (((p = strrchr(pr.anchor_call, '/')) ?
	    p[1] == '_' : pr.anchor_call[0] == '_') ||
	    opts & PF_OPT_RECURSE0x04000)) {
		printf(" {\n");
		pfctl_print_rule_counters(&pr.rule, opts);
		pfctl_show_rules(dev, npath, opts, format,
		    pr.anchor_call, depth + 1,
		    pr.rule.anchor_wildcard, -1);
		INDENT(depth, !(opts & PF_OPT_VERBOSE))do { if (!(opts & 0x00004)) { int i; for (i=0; i < depth
; i++) printf("  "); } } while (0);
		printf("}\n");
	} else {
		printf("\n");
		pfctl_print_rule_counters(&pr.rule, opts);
	}
	break;
case PFCTL_SHOW_NOTHING:
	break;
}
}

/*
* If this anchor was called with a wildcard path, go through
* the rulesets in the anchor rather than the rules.
*/
if (wildcard && (opts & PF_OPT_RECURSE0x04000)) {
17
←
Assuming 'wildcard' is not equal to 0→
18
←
Assuming the condition is true→
19
←
Taking true branch→
struct pfioc_ruleset	 prs;
u_int32_t		 mnr, nr;

memset(&prs, 0, sizeof(prs));
memcpy(prs.path, npath, sizeof(prs.path));
if (ioctl(dev, DIOCGETRULESETS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_ruleset) & 0x1fff) << 16) | ((('D')) <<
 8) | ((58))), &prs) == -1)
20
←
Assuming the condition is false→
21
←
Taking false branch→
	errx(1, "%s", pf_strerror(errno(*__errno())));
mnr = prs.nr;

for (nr = 0; nr < mnr; ++nr) {
22
←
Assuming 'nr' is >= 'mnr'→
23
←
Loop condition is false. Execution continues on line 985→
	prs.nr = nr;
	if (ioctl(dev, DIOCGETRULESET(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_ruleset) & 0x1fff) << 16) | ((('D')) <<
 8) | ((59))), &prs) == -1)
		errx(1, "%s", pf_strerror(errno(*__errno())));
	INDENT(depth, !(opts & PF_OPT_VERBOSE))do { if (!(opts & 0x00004)) { int i; for (i=0; i < depth
; i++) printf("  "); } } while (0);
	printf("anchor \"%s\" all {\n", prs.name);
	pfctl_show_rules(dev, npath, opts,
	    format, prs.name, depth + 1, 0, shownr);
	INDENT(depth, !(opts & PF_OPT_VERBOSE))do { if (!(opts & 0x00004)) { int i; for (i=0; i < depth
; i++) printf("  "); } } while (0);
	printf("}\n");
}
path[len] = '\0';
24
←
Potential leak of memory pointed to by 'npath'
return (0);
}

error:
if (path != npath)
free(npath);
path[len] = '\0';
return (ret);
994}

996int
997pfctl_show_src_nodes(int dev, int opts)
998{
struct pfioc_src_nodes psn;
struct pf_src_node *p;
char *inbuf = NULL((void *)0), *newinbuf = NULL((void *)0);
size_t i, len = 0;

memset(&psn, 0, sizeof(psn));
for (;;) {
psn.psn_len = len;
if (len) {
	newinbuf = realloc(inbuf, len);
	if (newinbuf == NULL((void *)0))
		err(1, "realloc");
	psn.psn_bufpsn_u.psu_buf = inbuf = newinbuf;
}
if (ioctl(dev, DIOCGETSRCNODES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_src_nodes) & 0x1fff) << 16) | ((('D')
) << 8) | ((84))), &psn) == -1) {
	warn("DIOCGETSRCNODES");
	free(inbuf);
	return (-1);
}
if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
	break;
if (len == 0 && psn.psn_len == 0)
	goto done;
if (len == 0 && psn.psn_len != 0)
	len = psn.psn_len;
if (psn.psn_len == 0)
	goto done;	/* no src_nodes */
len *= 2;
}
p = psn.psn_src_nodespsn_u.psu_src_nodes;
if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL0x00400))
pfctl_print_title("SOURCE TRACKING NODES:");
for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
print_src_node(p, opts);
p++;
}
1035done:
free(inbuf);
return (0);
1038}

1040int
1041pfctl_show_states(int dev, const char *iface, int opts, long shownr)
1042{
struct pfioc_states ps;
struct pfsync_state *p;
char *inbuf = NULL((void *)0), *newinbuf = NULL((void *)0);
size_t i, len = 0;
int dotitle = (opts & PF_OPT_SHOWALL0x00400);

memset(&ps, 0, sizeof(ps));
for (;;) {
ps.ps_len = len;
if (len) {
	newinbuf = realloc(inbuf, len);
	if (newinbuf == NULL((void *)0))
		err(1, "realloc");
	ps.ps_bufps_u.psu_buf = inbuf = newinbuf;
}
if (ioctl(dev, DIOCGETSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_states) & 0x1fff) << 16) | ((('D')) <<
 8) | ((25))), &ps) == -1) {
	warn("DIOCGETSTATES");
	free(inbuf);
	return (-1);
}
if (ps.ps_len + sizeof(struct pfioc_states) < len)
	break;
if (len == 0 && ps.ps_len == 0)
	goto done;
if (len == 0 && ps.ps_len != 0)
	len = ps.ps_len;
if (ps.ps_len == 0)
	goto done;	/* no states */
len *= 2;
}
p = ps.ps_statesps_u.psu_states;
for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
if (iface != NULL((void *)0) && strcmp(p->ifname, iface))
	continue;
if (dotitle) {
	pfctl_print_title("STATES:");
	dotitle = 0;
}
if (shownr < 0 || ntohl(p->rule)(__uint32_t)(__builtin_constant_p(p->rule) ? (__uint32_t)(
((__uint32_t)(p->rule) & 0xff) << 24 | ((__uint32_t
)(p->rule) & 0xff00) << 8 | ((__uint32_t)(p->
rule) & 0xff0000) >> 8 | ((__uint32_t)(p->rule) &
 0xff000000) >> 24) : __swap32md(p->rule)) == shownr)
	print_state(p, opts);
}
1084done:
free(inbuf);
return (0);
1087}

1089int
1090pfctl_show_status(int dev, int opts)
1091{
struct pf_status status;
struct pfctl_watermarks wats;
struct pfioc_synflwats iocwats;

if (ioctl(dev, DIOCGETSTATUS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pf_status) & 0x1fff) << 16) | ((('D')) <<
 8) | ((21))), &status) == -1) {
warn("DIOCGETSTATUS");
return (-1);
}
if (ioctl(dev, DIOCGETSYNFLWATS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_synflwats) & 0x1fff) << 16) | ((('D')
) << 8) | ((99))), &iocwats) == -1) {
warn("DIOCGETSYNFLWATS");
return (-1);
}
wats.hi = iocwats.hiwat;
wats.lo = iocwats.lowat;
if (opts & PF_OPT_SHOWALL0x00400)
pfctl_print_title("INFO:");
print_status(&status, &wats, opts);
return (0);
1110}

1112int
1113pfctl_show_timeouts(int dev, int opts)
1114{
struct pfioc_tm pt;
int i;

if (opts & PF_OPT_SHOWALL0x00400)
pfctl_print_title("TIMEOUTS:");
memset(&pt, 0, sizeof(pt));
for (i = 0; pf_timeouts[i].name; i++) {
pt.timeout = pf_timeouts[i].timeout;
if (ioctl(dev, DIOCGETTIMEOUT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_tm) & 0x1fff) << 16) | ((('D')) <<
 8) | ((30))), &pt) == -1)
	err(1, "DIOCGETTIMEOUT");
printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
	printf(" states");
else
	printf("s");
printf("\n");
}
return (0);

1135}

1137int
1138pfctl_show_limits(int dev, int opts)
1139{
struct pfioc_limit pl;
int i;

if (opts & PF_OPT_SHOWALL0x00400)
pfctl_print_title("LIMITS:");
memset(&pl, 0, sizeof(pl));
for (i = 0; pf_limits[i].name; i++) {
pl.index = pf_limits[i].index;
if (ioctl(dev, DIOCGETLIMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_limit) & 0x1fff) << 16) | ((('D')) <<
 8) | ((39))), &pl) == -1)
	err(1, "DIOCGETLIMIT");
printf("%-13s ", pf_limits[i].name);
if (pl.limit == UINT_MAX(2147483647 *2U +1U))
	printf("unlimited\n");
else
	printf("hard limit %8u\n", pl.limit);
}
return (0);
1157}

1159/* callbacks for rule/nat/rdr/addr */
1160void
1161pfctl_add_rule(struct pfctl *pf, struct pf_rule *r)
1162{
struct pf_rule		*rule;
struct pf_ruleset	*rs;

rs = &pf->anchor->ruleset;

if ((rule = calloc(1, sizeof(*rule))) == NULL((void *)0))
err(1, "calloc");
bcopy(r, rule, sizeof(*rule));

TAILQ_INSERT_TAIL(rs->rules.active.ptr, rule, entries)do { (rule)->entries.tqe_next = ((void *)0); (rule)->entries
.tqe_prev = (rs->rules.active.ptr)->tqh_last; *(rs->
rules.active.ptr)->tqh_last = (rule); (rs->rules.active
.ptr)->tqh_last = &(rule)->entries.tqe_next; } while
 (0);
1173}

1175int
1176pfctl_ruleset_trans(struct pfctl *pf, char *path, struct pf_anchor *a)
1177{
int osize = pf->trans->pfrb_size;

if (pfctl_add_trans(pf->trans, PF_TRANS_RULESET, path))
return (3);
if (pfctl_add_trans(pf->trans, PF_TRANS_TABLE, path))
return (4);
if (pfctl_trans(pf->dev, pf->trans, DIOCXBEGIN(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((81))), osize))
return (5);

return (0);
1188}

1190int
1191pfctl_add_queue(struct pfctl *pf, struct pf_queuespec *q)
1192{
struct pfctl_qsitem	*qi;

if (pf->anchor->name[0]) {
printf("must not have queue definitions in an anchor\n");
return (1);
}

if (q->parent[0] == '\0') {
TAILQ_FOREACH(qi, &rootqs, entries)for((qi) = ((&rootqs)->tqh_first); (qi) != ((void *)0)
; (qi) = ((qi)->entries.tqe_next)) {
	if (strcmp(q->ifname, qi->qs.ifname))
	    continue;
	printf("A root queue is already defined on %s\n",
	    qi->qs.ifname);
	return (1);
}
}

if ((qi = calloc(1, sizeof(*qi))) == NULL((void *)0))
err(1, "calloc");
bcopy(q, &qi->qs, sizeof(qi->qs));
TAILQ_INIT(&qi->children)do { (&qi->children)->tqh_first = ((void *)0); (&
qi->children)->tqh_last = &(&qi->children)->
tqh_first; } while (0);

if (qi->qs.parent[0])
TAILQ_INSERT_TAIL(&qspecs, qi, entries)do { (qi)->entries.tqe_next = ((void *)0); (qi)->entries
.tqe_prev = (&qspecs)->tqh_last; *(&qspecs)->tqh_last
 = (qi); (&qspecs)->tqh_last = &(qi)->entries.tqe_next
; } while (0);
else
TAILQ_INSERT_TAIL(&rootqs, qi, entries)do { (qi)->entries.tqe_next = ((void *)0); (qi)->entries
.tqe_prev = (&rootqs)->tqh_last; *(&rootqs)->tqh_last
 = (qi); (&rootqs)->tqh_last = &(qi)->entries.tqe_next
; } while (0);

return (0);
1221}

1223struct pfctl_qsitem *
1224pfctl_find_queue(char *what, struct pf_qihead *where)
1225{
struct pfctl_qsitem *q;

TAILQ_FOREACH(q, where, entries)for((q) = ((where)->tqh_first); (q) != ((void *)0); (q) = (
(q)->entries.tqe_next))
if (strcmp(q->qs.qname, what) == 0)
	return (q);

return (NULL((void *)0));
1233}

1235u_int
1236pfctl_find_childqs(struct pfctl_qsitem *qi)
1237{
struct pfctl_qsitem	*n, *p, *q;
u_int			 flags = qi->qs.flags;

TAILQ_FOREACH(p, &qspecs, entries)for((p) = ((&qspecs)->tqh_first); (p) != ((void *)0); (
p) = ((p)->entries.tqe_next)) {
if (strcmp(p->qs.parent, qi->qs.qname))
	continue;
if (p->qs.ifname[0] && strcmp(p->qs.ifname, qi->qs.ifname))
	continue;
if (++p->matches > 10000)
	errx(1, "pfctl_find_childqs: excessive matches, loop?");

if ((q = pfctl_find_queue(p->qs.qname, &qi->children)) == NULL((void *)0)) {
	/* insert */
	if ((n = calloc(1, sizeof(*n))) == NULL((void *)0))
		err(1, "calloc");
	TAILQ_INIT(&n->children)do { (&n->children)->tqh_first = ((void *)0); (&
n->children)->tqh_last = &(&n->children)->
tqh_first; } while (0);
	bcopy(&p->qs, &n->qs, sizeof(n->qs));
	TAILQ_INSERT_TAIL(&qi->children, n, entries)do { (n)->entries.tqe_next = ((void *)0); (n)->entries.
tqe_prev = (&qi->children)->tqh_last; *(&qi->
children)->tqh_last = (n); (&qi->children)->tqh_last
 = &(n)->entries.tqe_next; } while (0);
} else {
	if ((q->qs.ifname[0] && p->qs.ifname[0]))
		errx(1, "queue %s on %s respecified",
		    q->qs.qname, q->qs.ifname);
	if (!q->qs.ifname[0] && !p->qs.ifname[0])
		errx(1, "queue %s respecified",
		    q->qs.qname);
	/* ifbound beats floating */
	if (!q->qs.ifname[0])
		bcopy(&p->qs, &q->qs, sizeof(q->qs));
}
}

TAILQ_FOREACH(p, &qi->children, entries)for((p) = ((&qi->children)->tqh_first); (p) != ((void
 *)0); (p) = ((p)->entries.tqe_next))
flags |= pfctl_find_childqs(p);

if (!TAILQ_EMPTY(&qi->children)(((&qi->children)->tqh_first) == ((void *)0))) {
if (qi->qs.flags & PFQS_DEFAULT0x1000)
	errx(1, "default queue %s is not a leaf queue",
	    qi->qs.qname);
if (qi->qs.flags & PFQS_FLOWQUEUE0x0001)
	errx(1, "flow queue %s is not a leaf queue",
	    qi->qs.qname);
}

return (flags);
1282}

1284void
1285pfctl_load_queue(struct pfctl *pf, u_int32_t ticket, struct pfctl_qsitem *qi)
1286{
struct pfioc_queue	 q;
struct pfctl_qsitem	*p;

q.ticket = ticket;
bcopy(&qi->qs, &q.queue, sizeof(q.queue));
if ((pf->opts & PF_OPT_NOACTION0x00008) == 0)
if (ioctl(pf->dev, DIOCADDQUEUE(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_queue) & 0x1fff) << 16) | ((('D')) <<
 8) | ((93))), &q) == -1)
	err(1, "DIOCADDQUEUE");
if (pf->opts & PF_OPT_VERBOSE0x00004)
print_queuespec(&qi->qs);

TAILQ_FOREACH(p, &qi->children, entries)for((p) = ((&qi->children)->tqh_first); (p) != ((void
 *)0); (p) = ((p)->entries.tqe_next)) {
strlcpy(p->qs.ifname, qi->qs.ifname, IFNAMSIZ16);
pfctl_load_queue(pf, ticket, p);
}
1302}

1304int
1305pfctl_load_queues(struct pfctl *pf)
1306{
struct pfctl_qsitem	*qi, *tempqi;
struct pf_queue_scspec	*rtsc, *lssc, *ulsc;
u_int32_t		 ticket;

TAILQ_FOREACH(qi, &qspecs, entries)for((qi) = ((&qspecs)->tqh_first); (qi) != ((void *)0)
; (qi) = ((qi)->entries.tqe_next)) {
if (qi->matches == 0)
	errx(1, "queue %s: parent %s not found", qi->qs.qname,
	    qi->qs.parent);

rtsc = &qi->qs.realtime;
lssc = &qi->qs.linkshare;
ulsc = &qi->qs.upperlimit;

if (rtsc->m1.percent || rtsc->m2.percent ||
    lssc->m1.percent || lssc->m2.percent ||
    ulsc->m1.percent || ulsc->m2.percent)
	errx(1, "only absolute bandwidth specs for now");

/* Link sharing policy must be specified for child classes */
if (qi->qs.parent[0] != '\0' &&
    lssc->m1.absolute == 0 && lssc->m2.absolute == 0)
	errx(1, "queue %s: no bandwidth was specified",
	    qi->qs.qname);
}

if ((pf->opts & PF_OPT_NOACTION0x00008) == 0)
ticket = pfctl_get_ticket(pf->trans, PF_TRANS_RULESET, "");

TAILQ_FOREACH_SAFE(qi, &rootqs, entries, tempqi)for ((qi) = ((&rootqs)->tqh_first); (qi) != ((void *)0
) && ((tempqi) = ((qi)->entries.tqe_next), 1); (qi
) = (tempqi)) {
TAILQ_REMOVE(&rootqs, qi, entries)do { if (((qi)->entries.tqe_next) != ((void *)0)) (qi)->
entries.tqe_next->entries.tqe_prev = (qi)->entries.tqe_prev
; else (&rootqs)->tqh_last = (qi)->entries.tqe_prev
; *(qi)->entries.tqe_prev = (qi)->entries.tqe_next; ; ;
 } while (0);
pfctl_load_queue(pf, ticket, qi);
TAILQ_INSERT_HEAD(&rootqs, qi, entries)do { if (((qi)->entries.tqe_next = (&rootqs)->tqh_first
) != ((void *)0)) (&rootqs)->tqh_first->entries.tqe_prev
 = &(qi)->entries.tqe_next; else (&rootqs)->tqh_last
 = &(qi)->entries.tqe_next; (&rootqs)->tqh_first
 = (qi); (qi)->entries.tqe_prev = &(&rootqs)->tqh_first
; } while (0);
}

return (0);
1342}

1344void
1345pfctl_clear_queues(struct pf_qihead *head)
1346{
struct pfctl_qsitem *qi;

while ((qi = TAILQ_FIRST(head)((head)->tqh_first)) != NULL((void *)0)) {
TAILQ_REMOVE(head, qi, entries)do { if (((qi)->entries.tqe_next) != ((void *)0)) (qi)->
entries.tqe_next->entries.tqe_prev = (qi)->entries.tqe_prev
; else (head)->tqh_last = (qi)->entries.tqe_prev; *(qi)
->entries.tqe_prev = (qi)->entries.tqe_next; ; ; } while
 (0);
pfctl_clear_queues(&qi->children);
free(qi);
}
1354}

1356u_int
1357pfctl_leafqueue_check(char *qname)
1358{
struct pfctl_qsitem	*qi;
if (qname == NULL((void *)0) || qname[0] == 0)
return (0);

TAILQ_FOREACH(qi, &rootqs, entries)for((qi) = ((&rootqs)->tqh_first); (qi) != ((void *)0)
; (qi) = ((qi)->entries.tqe_next)) {
if (strcmp(qname, qi->qs.qname))
	continue;
if (!TAILQ_EMPTY(&qi->children)(((&qi->children)->tqh_first) == ((void *)0))) {
	printf("queue %s: packets must be assigned to leaf "
	    "queues only\n", qname);
	return (1);
}
}
TAILQ_FOREACH(qi, &qspecs, entries)for((qi) = ((&qspecs)->tqh_first); (qi) != ((void *)0)
; (qi) = ((qi)->entries.tqe_next)) {
if (strcmp(qname, qi->qs.qname))
	continue;
if (!TAILQ_EMPTY(&qi->children)(((&qi->children)->tqh_first) == ((void *)0))) {
	printf("queue %s: packets must be assigned to leaf "
	    "queues only\n", qname);
	return (1);
}
}
return (0);
1382}

1384u_int
1385pfctl_check_qassignments(struct pf_ruleset *rs)
1386{
struct pf_rule		*r;
struct pfctl_qsitem	*qi;
u_int			 flags, errs = 0;

/* main ruleset: need find_childqs to populate qi->children */
if (rs->anchor->path[0] == 0) {
TAILQ_FOREACH(qi, &rootqs, entries)for((qi) = ((&rootqs)->tqh_first); (qi) != ((void *)0)
; (qi) = ((qi)->entries.tqe_next)) {
	flags = pfctl_find_childqs(qi);
	if (!(qi->qs.flags & PFQS_ROOTCLASS0x0002) &&
	    !TAILQ_EMPTY(&qi->children)(((&qi->children)->tqh_first) == ((void *)0))) {
		if (qi->qs.flags & PFQS_FLOWQUEUE0x0001)
			errx(1, "root queue %s doesn't "
			    "support hierarchy",
			    qi->qs.qname);
		else
			errx(1, "no bandwidth was specified "
			    "for root queue %s", qi->qs.qname);
	}
	if ((qi->qs.flags & PFQS_ROOTCLASS0x0002) &&
	    !(flags & PFQS_DEFAULT0x1000))
		errx(1, "no default queue specified");
}
}

TAILQ_FOREACH(r, rs->rules.active.ptr, entries)for((r) = ((rs->rules.active.ptr)->tqh_first); (r) != (
(void *)0); (r) = ((r)->entries.tqe_next)) {
if (r->anchor)
	errs += pfctl_check_qassignments(&r->anchor->ruleset);
if (pfctl_leafqueue_check(r->qname) ||
    pfctl_leafqueue_check(r->pqname))
	errs++;
}
return (errs);
1419}

1421int
1422pfctl_load_ruleset(struct pfctl *pf, char *path, struct pf_ruleset *rs,
  int depth)
1424{
struct pf_rule *r;
int		error, len = strlen(path);
int		brace = 0;
unsigned int	rno = 0;

pf->anchor = rs->anchor;

if (path[0])
snprintf(&path[len], PATH_MAX1024 - len, "/%s", pf->anchor->name);
else
snprintf(&path[len], PATH_MAX1024 - len, "%s", pf->anchor->path);

if (depth) {
if (TAILQ_FIRST(rs->rules.active.ptr)((rs->rules.active.ptr)->tqh_first) != NULL((void *)0)) {
	brace++;
	if (pf->opts & PF_OPT_VERBOSE0x00004)
		printf(" {\n");
	if ((pf->opts & PF_OPT_NOACTION0x00008) == 0 &&
	    (error = pfctl_ruleset_trans(pf,
	    path, rs->anchor))) {
		printf("pfctl_load_ruleset: "
		    "pfctl_ruleset_trans %d\n", error);
		goto error;
	}
} else if (pf->opts & PF_OPT_VERBOSE0x00004)
	printf("\n");
}

if (pf->optimize)
pfctl_optimize_ruleset(pf, rs);

while ((r = TAILQ_FIRST(rs->rules.active.ptr)((rs->rules.active.ptr)->tqh_first)) != NULL((void *)0)) {
TAILQ_REMOVE(rs->rules.active.ptr, r, entries)do { if (((r)->entries.tqe_next) != ((void *)0)) (r)->entries
.tqe_next->entries.tqe_prev = (r)->entries.tqe_prev; else
 (rs->rules.active.ptr)->tqh_last = (r)->entries.tqe_prev
; *(r)->entries.tqe_prev = (r)->entries.tqe_next; ; ; }
 while (0);
pfctl_expand_label_nr(r, rno);
rno++;
if ((error = pfctl_load_rule(pf, path, r, depth)))
	goto error;
if (r->anchor) {
	if ((error = pfctl_load_ruleset(pf, path,
	    &r->anchor->ruleset, depth + 1)))
		goto error;
} else if (pf->opts & PF_OPT_VERBOSE0x00004)
	printf("\n");
free(r);
}
if (brace && pf->opts & PF_OPT_VERBOSE0x00004) {
INDENT(depth - 1, (pf->opts & PF_OPT_VERBOSE))do { if ((pf->opts & 0x00004)) { int i; for (i=0; i <
 depth - 1; i++) printf("  "); } } while (0);
printf("}\n");
}
path[len] = '\0';
return (0);

error:
path[len] = '\0';
return (error);

1481}

1483int
1484pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
1485{
char			*name;
struct pfioc_rule	pr;
int			len = strlen(path);

bzero(&pr, sizeof(pr));
/* set up anchor before adding to path for anchor_call */
if ((pf->opts & PF_OPT_NOACTION0x00008) == 0)
pr.ticket = pfctl_get_ticket(pf->trans, PF_TRANS_RULESET, path);
if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
errx(1, "pfctl_load_rule: strlcpy");

if (r->anchor) {
if (r->anchor->match) {
	if (path[0])
		snprintf(&path[len], PATH_MAX1024 - len,
		    "/%s", r->anchor->name);
	else
		snprintf(&path[len], PATH_MAX1024 - len,
		    "%s", r->anchor->name);
	name = r->anchor->name;
} else
	name = r->anchor->path;
} else
name = "";

if ((pf->opts & PF_OPT_NOACTION0x00008) == 0) {
memcpy(&pr.rule, r, sizeof(pr.rule));
if (r->anchor && strlcpy(pr.anchor_call, name,
    sizeof(pr.anchor_call)) >= sizeof(pr.anchor_call))
	errx(1, "pfctl_load_rule: strlcpy");
if (ioctl(pf->dev, DIOCADDRULE(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_rule) & 0x1fff) << 16) | ((('D')) <<
 8) | ((4))), &pr) == -1)
	err(1, "DIOCADDRULE");
}

if (pf->opts & PF_OPT_VERBOSE0x00004) {
INDENT(depth, !(pf->opts & PF_OPT_VERBOSE2))do { if (!(pf->opts & 0x00080)) { int i; for (i=0; i <
 depth; i++) printf("  "); } } while (0);
print_rule(r, name, pf->opts);
}
path[len] = '\0';
return (0);
1526}

1528int
1529pfctl_rules(int dev, char *filename, int opts, int optimize,
  char *anchorname, struct pfr_buffer *trans)
1531{
1532#define ERR(x) do { warn(x); goto _error; } while(0)
1533#define ERRX(x) do { warnx(x); goto _error; } while(0)

struct pfr_buffer	*t, buf;
struct pfctl		 pf;
struct pf_ruleset	*rs;
struct pfr_table	 trs;
char			*path = NULL((void *)0);
int			 osize;
char			*p;

bzero(&pf, sizeof(pf));
RB_INIT(&pf_anchors)do { (&pf_anchors)->rbh_root = ((void *)0); } while (0
);
memset(&pf_main_anchor, 0, sizeof(pf_main_anchor));
pf_init_ruleset(&pf_main_anchor.ruleset);
if (trans == NULL((void *)0)) {
bzero(&buf, sizeof(buf));
buf.pfrb_type = PFRB_TRANS;
t = &buf;
osize = 0;
} else {
t = trans;
osize = t->pfrb_size;
}

memset(&pf, 0, sizeof(pf));
memset(&trs, 0, sizeof(trs));
if ((path = calloc(1, PATH_MAX1024)) == NULL((void *)0))
ERRX("pfctl_rules: calloc");
if (strlcpy(trs.pfrt_anchor, anchorname,
   sizeof(trs.pfrt_anchor)) >= sizeof(trs.pfrt_anchor))
ERRX("pfctl_rules: strlcpy");
pf.dev = dev;
pf.opts = opts;
pf.optimize = optimize;

/* non-brace anchor, create without resolving the path */
if ((pf.anchor = calloc(1, sizeof(*pf.anchor))) == NULL((void *)0))
ERRX("pfctl_rules: calloc");
rs = &pf.anchor->ruleset;
pf_init_ruleset(rs);
rs->anchor = pf.anchor;
if (strlcpy(pf.anchor->path, anchorname,
   sizeof(pf.anchor->path)) >= sizeof(pf.anchor->path))
errx(1, "%s: strlcpy", __func__);

if ((p = strrchr(anchorname, '/')) != NULL((void *)0)) {
if (strlen(p) == 1)
	errx(1, "%s: bad anchor name %s", __func__, anchorname);
} else
p = anchorname;

if (strlcpy(pf.anchor->name, p,
   sizeof(pf.anchor->name)) >= sizeof(pf.anchor->name))
errx(1, "%s: strlcpy", __func__);

pf.astack[0] = pf.anchor;
pf.asd = 0;
pf.trans = t;
pfctl_init_options(&pf);

if ((opts & PF_OPT_NOACTION0x00008) == 0) {
/*
 * XXX For the time being we need to open transactions for
 * the main ruleset before parsing, because tables are still
 * loaded at parse time.
 */
if (pfctl_ruleset_trans(&pf, anchorname, pf.anchor))
	ERRX("pfctl_rules");
pf.astack[0]->ruleset.tticket =
    pfctl_get_ticket(t, PF_TRANS_TABLE, anchorname);
}

if (parse_config(filename, &pf) < 0) {
if ((opts & PF_OPT_NOACTION0x00008) == 0)
	ERRX("Syntax error in config file: "
	    "pf rules not loaded");
else
	goto _error;
}

if (!anchorname[0] && (pfctl_check_qassignments(&pf.anchor->ruleset) ||
   pfctl_load_queues(&pf))) {
if ((opts & PF_OPT_NOACTION0x00008) == 0)
	ERRX("Unable to load queues into kernel");
else
	goto _error;
}

if (pfctl_load_ruleset(&pf, path, rs, 0)) {
if ((opts & PF_OPT_NOACTION0x00008) == 0)
	ERRX("Unable to load rules into kernel");
else
	goto _error;
}

free(path);
path = NULL((void *)0);

if (trans == NULL((void *)0)) {
/*
 * process "load anchor" directives that might have used queues
 */
if (pfctl_load_anchors(dev, &pf, t) == -1)
	ERRX("load anchors");
pfctl_clear_queues(&qspecs);
pfctl_clear_queues(&rootqs);

if ((opts & PF_OPT_NOACTION0x00008) == 0) {
	if (!anchorname[0] && pfctl_load_options(&pf))
		goto _error;
	if (pfctl_trans(dev, t, DIOCXCOMMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((82))), osize))
		ERR("DIOCXCOMMIT");
}
}
return (0);

1649_error:
if (trans == NULL((void *)0)) {	/* main ruleset */
if ((opts & PF_OPT_NOACTION0x00008) == 0)
	if (pfctl_trans(dev, t, DIOCXROLLBACK(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((83))), osize))
		err(1, "DIOCXROLLBACK");
exit(1);
} else {		/* sub ruleset */
free(path);
return (-1);
}

1660#undef ERR
1661#undef ERRX
1662}

1664FILE *
1665pfctl_fopen(const char *name, const char *mode)
1666{
struct stat	 st;
FILE		*fp;

fp = fopen(name, mode);
if (fp == NULL((void *)0))
return (NULL((void *)0));
if (fstat(fileno(fp)(!__isthreaded ? ((fp)->_file) : (fileno)(fp)), &st) == -1) {
fclose(fp);
return (NULL((void *)0));
}
if (S_ISDIR(st.st_mode)((st.st_mode & 0170000) == 0040000)) {
fclose(fp);
errno(*__errno()) = EISDIR21;
return (NULL((void *)0));
}
return (fp);
1683}

1685void
1686pfctl_init_options(struct pfctl *pf)
1687{
int64_t mem;
int mib[2], mcl;
size_t size;

pf->timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL120;
pf->timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL30;
pf->timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL24*60*60;
pf->timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL15 * 60;
pf->timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL45;
pf->timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL90;
pf->timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL60;
pf->timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL30;
pf->timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL60;
pf->timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL20;
pf->timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL10;
pf->timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL60;
pf->timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL30;
pf->timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL60;
pf->timeout[PFTM_FRAG] = PFTM_FRAG_VAL60;
pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL10;
pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL0;
pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL30;
pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START60000;
pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END120000;

pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT100000;

pf->syncookieswat[0] = PF_SYNCOOKIES_LOWATPCT25/2;
pf->syncookieswat[1] = PF_SYNCOOKIES_HIWATPCT25;

mib[0] = CTL_KERN1;
mib[1] = KERN_MAXCLUSTERS67;
size = sizeof(mcl);
if (sysctl(mib, 2, &mcl, &size, NULL((void *)0), 0) == -1)
err(1, "sysctl");
pf->limit[PF_LIMIT_FRAGS] = mcl / 4;

pf->limit[PF_LIMIT_SRC_NODES] = PFSNODE_HIWAT10000;
pf->limit[PF_LIMIT_TABLES] = PFR_KTABLE_HIWAT1000;
pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT200000;
pf->limit[PF_LIMIT_PKTDELAY_PKTS] = PF_PKTDELAY_MAXPKTS10000;

mib[0] = CTL_HW6;
mib[1] = HW_PHYSMEM6419;
size = sizeof(mem);
if (sysctl(mib, 2, &mem, &size, NULL((void *)0), 0) == -1)
err(1, "sysctl");
if (mem <= 100*1024*1024)
pf->limit[PF_LIMIT_TABLE_ENTRIES] = PFR_KENTRY_HIWAT_SMALL100000;

pf->debug = LOG_ERR3;
pf->debug_set = 0;
pf->reassemble = PF_REASS_ENABLED0x01;
1741}

1743int
1744pfctl_load_options(struct pfctl *pf)
1745{
int i, error = 0;

/* load limits */
for (i = 0; i < PF_LIMIT_MAX; i++)
if (pfctl_load_limit(pf, i, pf->limit[i]))
	error = 1;

/*
* If we've set the states limit, but haven't explicitly set adaptive
* timeouts, do it now with a start of 60% and end of 120%.
*/
if (pf->limit_set[PF_LIMIT_STATES] &&
   !pf->timeout_set[PFTM_ADAPTIVE_START] &&
   !pf->timeout_set[PFTM_ADAPTIVE_END]) {
pf->timeout[PFTM_ADAPTIVE_START] =
	(pf->limit[PF_LIMIT_STATES] / 10) * 6;
pf->timeout_set[PFTM_ADAPTIVE_START] = 1;
pf->timeout[PFTM_ADAPTIVE_END] =
	(pf->limit[PF_LIMIT_STATES] / 10) * 12;
pf->timeout_set[PFTM_ADAPTIVE_END] = 1;
}

/* load timeouts */
for (i = 0; i < PFTM_MAX; i++)
if (pfctl_load_timeout(pf, i, pf->timeout[i]))
	error = 1;

/* load debug */
if (pf->debug_set && pfctl_load_debug(pf, pf->debug))
error = 1;

/* load logif */
if (pf->ifname_set && pfctl_load_logif(pf, pf->ifname))
error = 1;

/* load hostid */
if (pf->hostid_set && pfctl_load_hostid(pf, pf->hostid))
error = 1;

/* load reassembly settings */
if (pf->reass_set && pfctl_load_reassembly(pf, pf->reassemble))
error = 1;

/* load syncookies settings */
if (pf->syncookies_set && pfctl_load_syncookies(pf, pf->syncookies))
error = 1;
if (pf->syncookieswat_set) {
struct pfioc_limit pl;
unsigned curlim;

if (pf->limit_set[PF_LIMIT_STATES])
	curlim = pf->limit[PF_LIMIT_STATES];
else {
	memset(&pl, 0, sizeof(pl));
	pl.index = pf_limits[PF_LIMIT_STATES].index;
	if (ioctl(dev, DIOCGETLIMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_limit) & 0x1fff) << 16) | ((('D')) <<
 8) | ((39))), &pl) == -1)
		err(1, "DIOCGETLIMIT");
	curlim = pl.limit;
}
if (pfctl_set_synflwats(pf, curlim * pf->syncookieswat[0]/100,
    curlim * pf->syncookieswat[1]/100))
	error = 1;
}

return (error);
1811}

1813int
1814pfctl_set_limit(struct pfctl *pf, const char *opt, unsigned int limit)
1815{
int i;

for (i = 0; pf_limits[i].name; i++) {
if (strcasecmp(opt, pf_limits[i].name) == 0) {
	pf->limit[pf_limits[i].index] = limit;
	pf->limit_set[pf_limits[i].index] = 1;
	break;
}
}
if (pf_limits[i].name == NULL((void *)0)) {
warnx("Bad pool name.");
return (1);
}

if (pf->opts & PF_OPT_VERBOSE0x00004)
printf("set limit %s %d\n", opt, limit);

return (0);
1834}

1836int
1837pfctl_load_limit(struct pfctl *pf, unsigned int index, unsigned int limit)
1838{
struct pfioc_limit pl;

memset(&pl, 0, sizeof(pl));
pl.index = index;
pl.limit = limit;
if (ioctl(pf->dev, DIOCSETLIMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_limit) & 0x1fff) << 16) | ((('D')) <<
 8) | ((40))), &pl) == -1) {
if (errno(*__errno()) == EBUSY16)
	warnx("Current pool size exceeds requested %s limit %u",
	    pf_limits[index].name, limit);
else
	warnx("Cannot set %s limit to %u",
	    pf_limits[index].name, limit);
return (1);
}
return (0);
1854}

1856int
1857pfctl_set_timeout(struct pfctl *pf, const char *opt, int seconds, int quiet)
1858{
int i;

for (i = 0; pf_timeouts[i].name; i++) {
if (strcasecmp(opt, pf_timeouts[i].name) == 0) {
	pf->timeout[pf_timeouts[i].timeout] = seconds;
	pf->timeout_set[pf_timeouts[i].timeout] = 1;
	break;
}
}

if (pf_timeouts[i].name == NULL((void *)0)) {
warnx("Bad timeout name.");
return (1);
}


if (pf->opts & PF_OPT_VERBOSE0x00004 && ! quiet)
printf("set timeout %s %d\n", opt, seconds);

return (0);
1879}

1881int
1882pfctl_load_timeout(struct pfctl *pf, unsigned int timeout, unsigned int seconds)
1883{
struct pfioc_tm pt;

memset(&pt, 0, sizeof(pt));
pt.timeout = timeout;
pt.seconds = seconds;
if (ioctl(pf->dev, DIOCSETTIMEOUT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_tm) & 0x1fff) << 16) | ((('D')) <<
 8) | ((29))), &pt) == -1) {
warnx("DIOCSETTIMEOUT");
return (1);
}
return (0);
1894}

1896int
1897pfctl_set_synflwats(struct pfctl *pf, u_int32_t lowat, u_int32_t hiwat)
1898{
struct pfioc_synflwats ps;

memset(&ps, 0, sizeof(ps));
ps.hiwat = hiwat;
ps.lowat = lowat;

if (ioctl(pf->dev, DIOCSETSYNFLWATS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_synflwats) & 0x1fff) << 16) | ((('D')
) << 8) | ((97))), &ps) == -1) {
warnx("Cannot set synflood detection watermarks");
return (1);
}
return (0);
1910}

1912int
1913pfctl_set_reassembly(struct pfctl *pf, int on, int nodf)
1914{
pf->reass_set = 1;
if (on) {
pf->reassemble = PF_REASS_ENABLED0x01;
if (nodf)
	pf->reassemble |= PF_REASS_NODF0x02;
} else {
pf->reassemble = 0;
}

if (pf->opts & PF_OPT_VERBOSE0x00004)
printf("set reassemble %s %s\n", on ? "yes" : "no",
    nodf ? "no-df" : "");

return (0);
1929}

1931int
1932pfctl_set_syncookies(struct pfctl *pf, u_int8_t val, struct pfctl_watermarks *w)
1933{
if (val != PF_SYNCOOKIES_ADAPTIVE2 && w != NULL((void *)0)) {
warnx("syncookies start/end only apply to adaptive");
return (1);
}
if (val == PF_SYNCOOKIES_ADAPTIVE2 && w != NULL((void *)0)) {
if (!w->hi)
	w->hi = PF_SYNCOOKIES_HIWATPCT25;
if (!w->lo)
	w->lo = w->hi / 2;
if (w->lo >= w->hi) {
	warnx("start must be higher than end");
	return (1);
}
pf->syncookieswat[0] = w->lo;
pf->syncookieswat[1] = w->hi;
pf->syncookieswat_set = 1;
}

if (pf->opts & PF_OPT_VERBOSE0x00004) {
if (val == PF_SYNCOOKIES_NEVER0)
	printf("set syncookies never\n");
else if (val == PF_SYNCOOKIES_ALWAYS1)
	printf("set syncookies always\n");
else if (val == PF_SYNCOOKIES_ADAPTIVE2) {
	if (pf->syncookieswat_set)
		printf("set syncookies adaptive (start %u%%, "
		    "end %u%%)\n", pf->syncookieswat[1],
		    pf->syncookieswat[0]);
	else
		printf("set syncookies adaptive\n");
} else {	/* cannot happen */
	warnx("king bula ate all syncookies");
	return (1);
}
}

pf->syncookies_set = 1;
pf->syncookies = val;
return (0);
1973}

1975int
1976pfctl_set_optimization(struct pfctl *pf, const char *opt)
1977{
const struct pf_hint *hint;
int i, r;

for (i = 0; pf_hints[i].name; i++)
if (strcasecmp(opt, pf_hints[i].name) == 0)
	break;

hint = pf_hints[i].hint;
if (hint == NULL((void *)0)) {
warnx("invalid state timeouts optimization");
return (1);
}

for (i = 0; hint[i].name; i++)
if ((r = pfctl_set_timeout(pf, hint[i].name,
    hint[i].timeout, 1)))
	return (r);

if (pf->opts & PF_OPT_VERBOSE0x00004)
printf("set optimization %s\n", opt);

return (0);
2000}

2002int
2003pfctl_set_logif(struct pfctl *pf, char *ifname)
2004{
if (!strcmp(ifname, "none")) {
free(pf->ifname);
pf->ifname = NULL((void *)0);
} else {
pf->ifname = strdup(ifname);
if (!pf->ifname)
	errx(1, "pfctl_set_logif: strdup");
}
pf->ifname_set = 1;

if (pf->opts & PF_OPT_VERBOSE0x00004)
printf("set loginterface %s\n", ifname);

return (0);
2019}

2021int
2022pfctl_load_logif(struct pfctl *pf, char *ifname)
2023{
struct pfioc_iface	pi;

memset(&pi, 0, sizeof(pi));
if (ifname && strlcpy(pi.pfiio_name, ifname,
   sizeof(pi.pfiio_name)) >= sizeof(pi.pfiio_name)) {
warnx("pfctl_load_logif: strlcpy");
return (1);
}
if (ioctl(pf->dev, DIOCSETSTATUSIF(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_iface) & 0x1fff) << 16) | ((('D')) <<
 8) | ((20))), &pi) == -1) {
warnx("DIOCSETSTATUSIF");
return (1);
}
return (0);
2037}

2039void
2040pfctl_set_hostid(struct pfctl *pf, u_int32_t hostid)
2041{
HTONL(hostid)(hostid) = (__uint32_t)(__builtin_constant_p((u_int32_t)(hostid
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(hostid)) & 0xff
) << 24 | ((__uint32_t)((u_int32_t)(hostid)) & 0xff00
) << 8 | ((__uint32_t)((u_int32_t)(hostid)) & 0xff0000
) >> 8 | ((__uint32_t)((u_int32_t)(hostid)) & 0xff000000
) >> 24) : __swap32md((u_int32_t)(hostid)));

pf->hostid = hostid;
pf->hostid_set = 1;

if (pf->opts & PF_OPT_VERBOSE0x00004)
printf("set hostid 0x%08x\n", ntohl(hostid)(__uint32_t)(__builtin_constant_p(hostid) ? (__uint32_t)(((__uint32_t
)(hostid) & 0xff) << 24 | ((__uint32_t)(hostid) &
 0xff00) << 8 | ((__uint32_t)(hostid) & 0xff0000) >>
| ((__uint32_t)(hostid) & 0xff000000) >> 24) : __swap32md
(hostid)));
2049}

2051int
2052pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid)
2053{
if (ioctl(dev, DIOCSETHOSTID(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(u_int32_t) & 0x1fff) << 16) | ((('D')) << 8)
 | ((86))), &hostid) == -1) {
warnx("DIOCSETHOSTID");
return (1);
}
return (0);
2059}

2061int
2062pfctl_load_reassembly(struct pfctl *pf, u_int32_t reassembly)
2063{
if (ioctl(dev, DIOCSETREASS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(u_int32_t) & 0x1fff) << 16) | ((('D')) << 8)
 | ((92))), &reassembly) == -1) {
warnx("DIOCSETREASS");
return (1);
}
return (0);
2069}

2071int
2072pfctl_load_syncookies(struct pfctl *pf, u_int8_t val)
2073{
if (ioctl(dev, DIOCSETSYNCOOKIES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(u_int8_t) & 0x1fff) << 16) | ((('D')) << 8) |
 ((98))), &val) == -1) {
warnx("DIOCSETSYNCOOKIES");
return (1);
}
return (0);
2079}

2081int
2082pfctl_set_debug(struct pfctl *pf, char *d)
2083{
u_int32_t	level;
int		loglevel;

if ((loglevel = string_to_loglevel(d)) >= 0)
level = loglevel;
else {
warnx("unknown debug level \"%s\"", d);
return (-1);
}
pf->debug = level;
pf->debug_set = 1;

if ((pf->opts & PF_OPT_NOACTION0x00008) == 0)
if (ioctl(dev, DIOCSETDEBUG(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(u_int32_t) & 0x1fff) << 16) | ((('D')) << 8)
 | ((24))), &level) == -1)
	err(1, "DIOCSETDEBUG");

if (pf->opts & PF_OPT_VERBOSE0x00004)
printf("set debug %s\n", d);

return (0);
2104}

2106int
2107pfctl_load_debug(struct pfctl *pf, unsigned int level)
2108{
if (ioctl(pf->dev, DIOCSETDEBUG(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(u_int32_t) & 0x1fff) << 16) | ((('D')) << 8)
 | ((24))), &level) == -1) {
warnx("DIOCSETDEBUG");
return (1);
}
return (0);
2114}

2116int
2117pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
2118{
struct pfioc_iface	pi;

bzero(&pi, sizeof(pi));

pi.pfiio_flags = flags;

if (strlcpy(pi.pfiio_name, ifname, sizeof(pi.pfiio_name)) >=
   sizeof(pi.pfiio_name))
errx(1, "pfctl_set_interface_flags: strlcpy");

if ((pf->opts & PF_OPT_NOACTION0x00008) == 0) {
if (how == 0) {
	if (ioctl(pf->dev, DIOCCLRIFFLAG(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_iface) & 0x1fff) << 16) | ((('D')) <<
 8) | ((90))), &pi) == -1)
		err(1, "DIOCCLRIFFLAG");
} else {
	if (ioctl(pf->dev, DIOCSETIFFLAG(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_iface) & 0x1fff) << 16) | ((('D')) <<
 8) | ((89))), &pi) == -1)
		err(1, "DIOCSETIFFLAG");
}
}
return (0);
2139}

2141void
2142pfctl_debug(int dev, u_int32_t level, int opts)
2143{
struct pfr_buffer t;

memset(&t, 0, sizeof(t));
t.pfrb_type = PFRB_TRANS;
if (pfctl_trans(dev, &t, DIOCXBEGIN(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((81))), 0) ||
   ioctl(dev, DIOCSETDEBUG(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(u_int32_t) & 0x1fff) << 16) | ((('D')) << 8)
 | ((24))), &level) == -1||
   pfctl_trans(dev, &t, DIOCXCOMMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((82))), 0))
err(1, "pfctl_debug ioctl");

if ((opts & PF_OPT_QUIET0x00010) == 0)
fprintf(stderr(&__sF[2]), "debug level set to '%s'\n",
    loglevel_to_string(level));
2156}

2158int
2159pfctl_walk_show(int opts, struct pfioc_ruleset *pr, void *warg)
2160{
if (pr->path[0]) {
if (pr->path[0] != '_' || (opts & PF_OPT_VERBOSE0x00004))
	printf("  %s/%s\n", pr->path, pr->name);
} else if (pr->name[0] != '_' || (opts & PF_OPT_VERBOSE0x00004))
printf("  %s\n", pr->name);

return (0);
2168}

2170int
2171pfctl_walk_get(int opts, struct pfioc_ruleset *pr, void *warg)
2172{
struct pfr_anchoritem	*pfra;
struct pfr_anchors	*anchors;
int			 e;

anchors = (struct pfr_anchors *) warg;

pfra = malloc(sizeof(*pfra));
if (pfra == NULL((void *)0))
err(1, "%s", __func__);

if (pr->path[0])
e = asprintf(&pfra->pfra_anchorname, "%s/%s", pr->path,
    pr->name);
else
e = asprintf(&pfra->pfra_anchorname, "%s", pr->name);

if (e == -1)
err(1, "%s", __func__);


SLIST_INSERT_HEAD(anchors, pfra, pfra_sle)do { (pfra)->pfra_sle.sle_next = (anchors)->slh_first; (
anchors)->slh_first = (pfra); } while (0);

return (0);
2196}

2198int
2199pfctl_walk_anchors(int dev, int opts, const char *anchor,
  int(walkf)(int, struct pfioc_ruleset *, void *), void *warg)
2201{
struct pfioc_ruleset	 pr;
u_int32_t		 mnr, nr;

memset(&pr, 0, sizeof(pr));
strlcpy(pr.path, anchor, sizeof(pr.path));
if (ioctl(dev, DIOCGETRULESETS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_ruleset) & 0x1fff) << 16) | ((('D')) <<
 8) | ((58))), &pr) == -1)
errx(1, "%s", pf_strerror(errno(*__errno())));
mnr = pr.nr;
for (nr = 0; nr < mnr; ++nr) {
char sub[PATH_MAX1024];

pr.nr = nr;
if (ioctl(dev, DIOCGETRULESET(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_ruleset) & 0x1fff) << 16) | ((('D')) <<
 8) | ((59))), &pr) == -1)
	errx(1, "%s", pf_strerror(errno(*__errno())));
if (!strcmp(pr.name, PF_RESERVED_ANCHOR"_pf"))
	continue;
sub[0] = '\0';

if (walkf(opts, &pr, warg))
	return (-1);

if (pr.path[0])
	snprintf(sub, sizeof(sub), "%s/%s",
	    pr.path, pr.name);
else
	snprintf(sub, sizeof(sub), "%s",
	    pr.name);
if (pfctl_walk_anchors(dev, opts, sub, walkf, warg))
	return (-1);
}
return (0);
2233}

2235int
2236pfctl_show_anchors(int dev, int opts, char *anchor)
2237{
return (
   pfctl_walk_anchors(dev, opts, anchor, pfctl_walk_show, NULL((void *)0)));
2240}

2242struct pfr_anchors *
2243pfctl_get_anchors(int dev, const char *anchor, int opts)
2244{
struct pfioc_ruleset	pr;
static struct pfr_anchors anchors;
char anchorbuf[PATH_MAX1024];
char *n;

SLIST_INIT(&anchors){ ((&anchors)->slh_first) = ((void *)0); };

memset(&pr, 0, sizeof(pr));
if (*anchor != '\0') {
strlcpy(anchorbuf, anchor, sizeof(anchorbuf));
n = dirname(anchorbuf);
if (n[0] != '.' && n[1] != '\0')
	strlcpy(pr.path, n, sizeof(pr.path));
strlcpy(anchorbuf, anchor, sizeof(anchorbuf));
n = basename(anchorbuf);
if (n != NULL((void *)0))
	strlcpy(pr.name, n, sizeof(pr.name));
}

/* insert a root anchor first. */
pfctl_walk_get(opts, &pr, &anchors);

if (pfctl_walk_anchors(dev, opts, anchor, pfctl_walk_get, &anchors))
errx(1,
    "%s failed to retrieve list of anchors, can't continue",
    __func__);

return (&anchors);
2273}

2275int
2276pfctl_call_cleartables(int dev, int opts, struct pfr_anchoritem *pfra)
2277{
/*
* PF_OPT_QUIET makes pfctl_clear_tables() to stop printing number of
* tables cleared for given anchor.
*/
opts |= PF_OPT_QUIET0x00010;
return ((pfctl_clear_tables(pfra->pfra_anchorname, opts) == -1) ?
   1 : 0);
2285}

2287int
2288pfctl_call_clearrules(int dev, int opts, struct pfr_anchoritem *pfra)
2289{
/*
* PF_OPT_QUIET makes pfctl_clear_rules() to stop printing a 'rules
* cleared' message for every anchor it deletes.
*/
opts |= PF_OPT_QUIET0x00010;
return (pfctl_clear_rules(dev, opts, pfra->pfra_anchorname));
2296}

2298int
2299pfctl_call_clearanchors(int dev, int opts, struct pfr_anchoritem *pfra)
2300{
int	rv = 0;

rv |= pfctl_call_cleartables(dev, opts, pfra);
rv |= pfctl_call_clearrules(dev, opts, pfra);

return (rv);
2307}

2309int
2310pfctl_recurse(int dev, int opts, const char *anchorname,
  int(*walkf)(int, int, struct pfr_anchoritem *))
2312{
int			 rv = 0;
struct pfr_anchors	*anchors;
struct pfr_anchoritem	*pfra, *pfra_save;

anchors = pfctl_get_anchors(dev, anchorname, opts);
/*
* While traversing the list, pfctl_clear_*() must always return
* so that failures on one anchor do not prevent clearing others.
*/
opts |= PF_OPT_IGNFAIL0x10000;
printf("Removing:\n");
SLIST_FOREACH_SAFE(pfra, anchors, pfra_sle, pfra_save)for ((pfra) = ((anchors)->slh_first); (pfra) && ((
pfra_save) = ((pfra)->pfra_sle.sle_next), 1); (pfra) = (pfra_save
)) {
printf("  %s\n", (*pfra->pfra_anchorname == '\0') ?
    "/" : pfra->pfra_anchorname);
rv |= walkf(dev, opts, pfra);
SLIST_REMOVE(anchors, pfra, pfr_anchoritem, pfra_sle)do { if ((anchors)->slh_first == (pfra)) { do { ((anchors)
)->slh_first = ((anchors))->slh_first->pfra_sle.sle_next
; } while (0); } else { struct pfr_anchoritem *curelm = (anchors
)->slh_first; while (curelm->pfra_sle.sle_next != (pfra
)) curelm = curelm->pfra_sle.sle_next; curelm->pfra_sle
.sle_next = curelm->pfra_sle.sle_next->pfra_sle.sle_next
; } ; } while (0);
free(pfra->pfra_anchorname);
free(pfra);
}

return (rv);
2334}

2336const char *
2337pfctl_lookup_option(char *cmd, const char **list)
2338{
const char *item = NULL((void *)0);

if (cmd != NULL((void *)0) && *cmd)
for (; *list; list++)
	if (!strncmp(cmd, *list, strlen(cmd))) {
		if (item == NULL((void *)0))
			item = *list;
		else
			errx(1, "%s is ambigious", cmd);
	}

return (item);
2351}


2354void
2355pfctl_state_store(int dev, const char *file)
2356{
FILE *f;
struct pfioc_states ps;
char *inbuf = NULL((void *)0), *newinbuf = NULL((void *)0);
size_t n, len = 0;

f = fopen(file, "w");
if (f == NULL((void *)0))
err(1, "open: %s", file);

memset(&ps, 0, sizeof(ps));
for (;;) {
ps.ps_len = len;
if (len) {
	newinbuf = realloc(inbuf, len);
	if (newinbuf == NULL((void *)0))
		err(1, "realloc");
	ps.ps_bufps_u.psu_buf = inbuf = newinbuf;
}
if (ioctl(dev, DIOCGETSTATES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_states) & 0x1fff) << 16) | ((('D')) <<
 8) | ((25))), &ps) == -1)
	err(1, "DIOCGETSTATES");

if (ps.ps_len + sizeof(struct pfioc_states) < len)
	break;
if (len == 0 && ps.ps_len == 0)
	goto done;
if (len == 0 && ps.ps_len != 0)
	len = ps.ps_len;
if (ps.ps_len == 0)
	goto done;	/* no states */
len *= 2;
}

n = ps.ps_len / sizeof(struct pfsync_state);
if (fwrite(inbuf, sizeof(struct pfsync_state), n, f) < n)
err(1, "fwrite");

2393done:
free(inbuf);
fclose(f);
2396}

2398void
2399pfctl_state_load(int dev, const char *file)
2400{
FILE *f;
struct pfioc_state ps;

f = fopen(file, "r");
if (f == NULL((void *)0))
err(1, "open: %s", file);

while (fread(&ps.state, sizeof(ps.state), 1, f) == 1) {
if (ioctl(dev, DIOCADDSTATE(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_state) & 0x1fff) << 16) | ((('D')) <<
 8) | ((37))), &ps) == -1) {
	switch (errno(*__errno())) {
	case EEXIST17:
	case EINVAL22:
		break;
	default:
		err(1, "DIOCADDSTATE");
	}
}
}

fclose(f);
2421}

2423void
2424pfctl_reset(int dev, int opts)
2425{
struct pfctl	pf;
struct pfr_buffer t;
int		i;

pf.dev = dev;
pfctl_init_options(&pf);

/* Force reset upon pfctl_load_options() */
pf.debug_set = 1;
pf.reass_set = 1;
pf.syncookieswat_set = 1;
pf.syncookies_set = 1;
pf.ifname = strdup("none");
if (pf.ifname == NULL((void *)0))
err(1, "%s: strdup", __func__);
pf.ifname_set = 1;

memset(&t, 0, sizeof(t));
t.pfrb_type = PFRB_TRANS;
if (pfctl_trans(dev, &t, DIOCXBEGIN(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((81))), 0))
err(1, "%s: DIOCXBEGIN", __func__);

for (i = 0; pf_limits[i].name; i++)
pf.limit_set[pf_limits[i].index] = 1;

for (i = 0; pf_timeouts[i].name; i++)
pf.timeout_set[pf_timeouts[i].timeout] = 1;

pfctl_load_options(&pf);

if (pfctl_trans(dev, &t, DIOCXCOMMIT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct pfioc_trans) & 0x1fff) << 16) | ((('D')) <<
 8) | ((82))), 0))
err(1, "%s: DIOCXCOMMIT", __func__);

pfctl_clear_interface_flags(dev, opts);
2460}

2462#ifndef	REGRESS_NOMAIN
2463int
2464main(int argc, char *argv[])
2465{
int	 ch;
int	 mode = O_RDONLY0x0000;
int	 opts = 0;
int	 optimize = PF_OPTIMIZE_BASIC0x0001;
int	 level;
int	 rdomain = 0;
char	 anchorname[PATH_MAX1024];
int	 anchor_wildcard = 0;
char	*path;
char	*lfile = NULL((void *)0), *sfile = NULL((void *)0);
const char *errstr;
long	 shownr = -1;

if (argc < 2)
usage();

while ((ch = getopt(argc, argv,
   "a:dD:eqf:F:ghi:k:K:L:Nno:Pp:R:rS:s:t:T:vV:x:z")) != -1) {
switch (ch) {
case 'a':
	anchoropt = optarg;
	break;
case 'd':
	opts |= PF_OPT_DISABLE0x00001;
	mode = O_RDWR0x0002;
	break;
case 'D':
	if (pfctl_cmdline_symset(optarg) < 0)
		warnx("could not parse macro definition %s",
		    optarg);
	break;
case 'e':
	opts |= PF_OPT_ENABLE0x00002;
	mode = O_RDWR0x0002;
	break;
case 'q':
	opts |= PF_OPT_QUIET0x00010;
	break;
case 'F':
	clearopt = pfctl_lookup_option(optarg, clearopt_list);
	if (clearopt == NULL((void *)0)) {
		warnx("Unknown flush modifier '%s'", optarg);
		usage();
	}
	mode = O_RDWR0x0002;
	break;
case 'i':
	ifaceopt = optarg;
	break;
case 'k':
	if (state_killers >= 2) {
		warnx("can only specify -k twice");
		usage();
		/* NOTREACHED */
	}
	state_kill[state_killers++] = optarg;
	mode = O_RDWR0x0002;
	break;
case 'K':
	if (src_node_killers >= 2) {
		warnx("can only specify -K twice");
		usage();
		/* NOTREACHED */
	}
	src_node_kill[src_node_killers++] = optarg;
	mode = O_RDWR0x0002;
	break;
case 'N':
	opts |= PF_OPT_NODNS0x01000;
	break;
case 'n':
	opts |= PF_OPT_NOACTION0x00008;
	break;
case 'r':
	opts |= PF_OPT_USEDNS0x00040;
	break;
case 'R':
	shownr = strtonum(optarg, -1, LONG_MAX9223372036854775807L, &errstr);
	if (errstr) {
		warnx("invalid rule id: %s", errstr);
		usage();
	}
	break;
case 'f':
	rulesopt = optarg;
	mode = O_RDWR0x0002;
	break;
case 'g':
	opts |= PF_OPT_DEBUG0x00200;
	break;
case 'o':
	optiopt = pfctl_lookup_option(optarg, optiopt_list);
	if (optiopt == NULL((void *)0)) {
		warnx("Unknown optimization '%s'", optarg);
		usage();
	}
	opts |= PF_OPT_OPTIMIZE0x00800;
	break;
case 'P':
	opts |= PF_OPT_PORTNAMES0x08000;
	break;
case 'p':
	pf_device = optarg;
	break;
case 's':
	showopt = pfctl_lookup_option(optarg, showopt_list);
	if (showopt == NULL((void *)0)) {
		warnx("Unknown show modifier '%s'", optarg);
		usage();
	}
	break;
case 't':
	tableopt = optarg;
	break;
case 'T':
	tblcmdopt = pfctl_lookup_option(optarg, tblcmdopt_list);
	if (tblcmdopt == NULL((void *)0)) {
		warnx("Unknown table command '%s'", optarg);
		usage();
	}
	break;
case 'v':
	if (opts & PF_OPT_VERBOSE0x00004)
		opts |= PF_OPT_VERBOSE20x00080;
	opts |= PF_OPT_VERBOSE0x00004;
	break;
case 'V':
	rdomain = strtonum(optarg, 0, RT_TABLEID_MAX255, &errstr);
	if (errstr) {
		warnx("Invalid rdomain: %s", errstr);
		usage();
	}
	break;
case 'x':
	debugopt = pfctl_lookup_option(optarg, debugopt_list);
	if (debugopt == NULL((void *)0)) {
		warnx("Unknown debug level '%s'", optarg);
		usage();
	}
	mode = O_RDWR0x0002;
	break;
case 'z':
	opts |= PF_OPT_CLRRULECTRS0x00020;
	mode = O_RDWR0x0002;
	break;
case 'S':
	sfile = optarg;
	break;
case 'L':
	mode = O_RDWR0x0002;
	lfile = optarg;
	break;
case 'h':
	/* FALLTHROUGH */
default:
	usage();
	/* NOTREACHED */
}
}

if ((opts & PF_OPT_NODNS0x01000) && (opts & PF_OPT_USEDNS0x00040))
errx(1, "-N and -r are mutually exclusive");

if ((tblcmdopt == NULL((void *)0)) ^ (tableopt == NULL((void *)0)))
usage();

if (tblcmdopt != NULL((void *)0)) {
argc -= optind;
argv += optind;
ch = *tblcmdopt;
mode = strchr("st", ch) ? O_RDONLY0x0000 : O_RDWR0x0002;
} else if (argc != optind) {
warnx("unknown command line argument: %s ...", argv[optind]);
usage();
/* NOTREACHED */
}

memset(anchorname, 0, sizeof(anchorname));
if (anchoropt != NULL((void *)0)) {
if (anchoropt[0] == '\0')
	errx(1, "anchor name must not be empty");
if (mode == O_RDONLY0x0000 && showopt == NULL((void *)0) && tblcmdopt == NULL((void *)0)) {
	warnx("anchors apply to -f, -F, -s, and -T only");
	usage();
}
if (mode == O_RDWR0x0002 && tblcmdopt == NULL((void *)0) &&
    (anchoropt[0] == '_' || strstr(anchoropt, "/_") != NULL((void *)0)))
	errx(1, "anchor names beginning with '_' cannot "
	    "be modified from the command line");
int len = strlen(anchoropt);

if (anchoropt[len - 1] == '*') {
	if (len >= 2 && anchoropt[len - 2] == '/') {
		anchoropt[len - 2] = '\0';
		anchor_wildcard = 1;
	} else
		anchoropt[len - 1] = '\0';
	opts |= PF_OPT_RECURSE0x04000;
}
if (strlcpy(anchorname, anchoropt,
    sizeof(anchorname)) >= sizeof(anchorname))
	errx(1, "anchor name '%s' too long",
	    anchoropt);
}

if ((opts & PF_OPT_NOACTION0x00008) == 0) {
dev = open(pf_device, mode);
if (dev == -1)
	err(1, "%s", pf_device);
} else {
dev = open(pf_device, O_RDONLY0x0000);
if (dev >= 0)
	opts |= PF_OPT_DUMMYACTION0x00100;
/* turn off options */
opts &= ~ (PF_OPT_DISABLE0x00001 | PF_OPT_ENABLE0x00002);
clearopt = showopt = debugopt = NULL((void *)0);
}

if (opts & PF_OPT_DISABLE0x00001)
if (pfctl_disable(dev, opts))
	exit_val = 1;

if ((path = calloc(1, PATH_MAX1024)) == NULL((void *)0))
errx(1, "%s: calloc", __func__);

if (showopt != NULL((void *)0)) {
switch (*showopt) {
case 'A':
	pfctl_show_anchors(dev, opts, anchorname);
	break;
case 'r':
	pfctl_load_fingerprints(dev, opts);
	pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
	    anchorname, 0, anchor_wildcard, shownr);
	break;
case 'l':
	pfctl_load_fingerprints(dev, opts);
	pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
	    anchorname, 0, anchor_wildcard, shownr);
	break;
case 'q':
	pfctl_show_queues(dev, ifaceopt, opts,
	    opts & PF_OPT_VERBOSE20x00080);
	break;
case 's':
	pfctl_show_states(dev, ifaceopt, opts, shownr);
	break;
case 'S':
	pfctl_show_src_nodes(dev, opts);
	break;
case 'i':
	pfctl_show_status(dev, opts);
	break;
case 't':
	pfctl_show_timeouts(dev, opts);
	break;
case 'm':
	pfctl_show_limits(dev, opts);
	break;
case 'a':
	opts |= PF_OPT_SHOWALL0x00400;
	pfctl_load_fingerprints(dev, opts);

	pfctl_show_rules(dev, path, opts, PFCTL_SHOW_RULES,
	    anchorname, 0, 0, -1);
	pfctl_show_queues(dev, ifaceopt, opts,
	    opts & PF_OPT_VERBOSE20x00080);
	pfctl_show_states(dev, ifaceopt, opts, -1);
	pfctl_show_src_nodes(dev, opts);
	pfctl_show_status(dev, opts);
	pfctl_show_rules(dev, path, opts, PFCTL_SHOW_LABELS,
	    anchorname, 0, 0, -1);
	pfctl_show_timeouts(dev, opts);
	pfctl_show_limits(dev, opts);
	pfctl_show_tables(anchorname, opts);
	pfctl_show_fingerprints(opts);
	break;
case 'T':
	pfctl_show_tables(anchorname, opts);
	break;
case 'o':
	pfctl_load_fingerprints(dev, opts);
	pfctl_show_fingerprints(opts);
	break;
case 'I':
	pfctl_show_ifaces(ifaceopt, opts);
	break;
}
}

if ((opts & PF_OPT_CLRRULECTRS0x00020) && showopt == NULL((void *)0))
pfctl_show_rules(dev, path, opts, PFCTL_SHOW_NOTHING,
    anchorname, 0, 0, -1);

if (clearopt != NULL((void *)0)) {
switch (*clearopt) {
case 'r':
	if (opts & PF_OPT_RECURSE0x04000)
		pfctl_recurse(dev, opts, anchorname,
		    pfctl_call_clearrules);
	else
		pfctl_clear_rules(dev, opts, anchorname);
	break;
case 's':
	pfctl_clear_states(dev, ifaceopt, opts);
	break;
case 'S':
	pfctl_clear_src_nodes(dev, opts);
	break;
case 'i':
	pfctl_clear_stats(dev, ifaceopt, opts);
	break;
case 'a':
	if (ifaceopt) {
		warnx("don't specify an interface with -Fall");
		usage();
		/* NOTREACHED */
	}
	if (opts & PF_OPT_RECURSE0x04000)
		pfctl_recurse(dev, opts, anchorname,
		    pfctl_call_clearanchors);
	else {
		pfctl_clear_tables(anchorname, opts);
		pfctl_clear_rules(dev, opts, anchorname);
	}

	if (!*anchorname) {
		pfctl_clear_states(dev, ifaceopt, opts);
		pfctl_clear_src_nodes(dev, opts);
		pfctl_clear_stats(dev, ifaceopt, opts);
		pfctl_clear_fingerprints(dev, opts);
		pfctl_reset(dev, opts);
	}
	break;
case 'o':
	pfctl_clear_fingerprints(dev, opts);
	break;
case 'T':
	if ((opts & PF_OPT_RECURSE0x04000) == 0)
		pfctl_clear_tables(anchorname, opts);
	else
		pfctl_recurse(dev, opts, anchorname,
		    pfctl_call_cleartables);
	break;
case 'R':
	pfctl_reset(dev, opts);
	break;
}
}
if (state_killers) {
if (!strcmp(state_kill[0], "label"))
	pfctl_label_kill_states(dev, ifaceopt, opts, rdomain);
else if (!strcmp(state_kill[0], "id"))
	pfctl_id_kill_states(dev, opts);
else if (!strcmp(state_kill[0], "key"))
	pfctl_key_kill_states(dev, ifaceopt, opts, rdomain);
else
	pfctl_net_kill_states(dev, ifaceopt, opts, rdomain);
}

if (src_node_killers)
pfctl_kill_src_nodes(dev, opts);

if (tblcmdopt != NULL((void *)0)) {
exit_val = pfctl_table(argc, argv, tableopt,
    tblcmdopt, rulesopt, anchorname, opts);
rulesopt = NULL((void *)0);
}
if (optiopt != NULL((void *)0)) {
switch (*optiopt) {
case 'n':
	optimize = 0;
	break;
case 'b':
	optimize |= PF_OPTIMIZE_BASIC0x0001;
	break;
case 'o':
case 'p':
	optimize |= PF_OPTIMIZE_PROFILE0x0002;
	break;
}
}

if (rulesopt != NULL((void *)0) && !anchorname[0]) {
pfctl_clear_interface_flags(dev, opts | PF_OPT_QUIET0x00010);
if (pfctl_file_fingerprints(dev, opts, PF_OSFP_FILE"/etc/pf.os"))
	exit_val = 1;
}

if (rulesopt != NULL((void *)0)) {
if (pfctl_rules(dev, rulesopt, opts, optimize,
    anchorname, NULL((void *)0)))
	exit_val = 1;
}

if (opts & PF_OPT_ENABLE0x00002)
if (pfctl_enable(dev, opts))
	exit_val = 1;

if (debugopt != NULL((void *)0)) {
if ((level = string_to_loglevel((char *)debugopt)) < 0) {
	switch (*debugopt) {
	case 'n':
		level = LOG_CRIT2;
		break;
	case 'u':
		level = LOG_ERR3;
		break;
	case 'm':
		level = LOG_NOTICE5;
		break;
	case 'l':
		level = LOG_DEBUG7;
		break;
	}
}
if (level >= 0)
	pfctl_debug(dev, level, opts);
}

if (sfile != NULL((void *)0))
pfctl_state_store(dev, sfile);
if (lfile != NULL((void *)0))
pfctl_state_load(dev, lfile);

exit(exit_val);
2892}
2893#endif	/* REGRESS_NOMAIN */

2895char *
2896pf_strerror(int errnum)
2897{
switch (errnum) {
case ESRCH3:
return "Table does not exist";
case EINVAL22:
case ENOENT2:
return "Anchor does not exist";
default:
return strerror(errnum);
}
2907}