 @@ -1,1099 +1,1099 @@
-/*	$NetBSD: pfctl.c,v 1.5 2008/06/18 09:06:26 yamt Exp $	*/
+/*	$NetBSD: pfctl.c,v 1.6 2020/04/22 23:40:40 joerg Exp $	*/
 /*	$OpenBSD: pfctl.c,v 1.268 2007/06/30 18:25:08 henning Exp $ */
 /*
  * Copyright (c) 2001 Daniel Hartmeier
  * Copyright (c) 2002,2003 Henning Brauer
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
+ *
  *    - Redistributions of source code must retain the above copyright
  *      notice, this list of conditions and the following disclaimer.
  *    - Redistributions in binary form must reproduce the above
  *      copyright notice, this list of conditions and the following
  *      disclaimer in the documentation and/or other materials provided
  *      with the distribution.
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
+ *
  */
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <net/if.h>
 #include <netinet/in.h>
 #include <net/pfvar.h>
 #include <arpa/inet.h>
 #include <altq/altq.h>
 #include <sys/sysctl.h>
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <limits.h>
 #include <netdb.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 #include "pfctl_parser.h"
 #include "pfctl.h"
 void	 usage(void);
 int	 pfctl_enable(int, int);
 int	 pfctl_disable(int, int);
 int	 pfctl_clear_stats(int, int);
 int	 pfctl_clear_interface_flags(int, int);
 int	 pfctl_clear_rules(int, int, char *);
 int	 pfctl_clear_nat(int, int, char *);
 int	 pfctl_clear_altq(int, int);
 int	 pfctl_clear_src_nodes(int, int);
 int	 pfctl_clear_states(int, const char *, int);
 void	 pfctl_addrprefix(char *, struct pf_addr *);
 int	 pfctl_kill_src_nodes(int, const char *, int);
 int	 pfctl_kill_states(int, const char *, int);
 void	 pfctl_init_options(struct pfctl *);
 int	 pfctl_load_options(struct pfctl *);
 int	 pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
 int	 pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int);
 int	 pfctl_load_debug(struct pfctl *, unsigned int);
 int	 pfctl_load_logif(struct pfctl *, char *);
 int	 pfctl_load_hostid(struct pfctl *, unsigned int);
 int	 pfctl_get_pool(int, struct pf_pool *, u_int32_t, u_int32_t, int,
 	    char *);
 void	 pfctl_print_rule_counters(struct pf_rule *, int);
 int	 pfctl_show_rules(int, char *, int, enum pfctl_show, char *, int);
 int	 pfctl_show_nat(int, int, char *);
 int	 pfctl_show_src_nodes(int, int);
 int	 pfctl_show_states(int, const char *, int);
 int	 pfctl_show_status(int, int);
 int	 pfctl_show_timeouts(int, int);
 int	 pfctl_show_limits(int, int);
 void	 pfctl_debug(int, u_int32_t, int);
 int	 pfctl_test_altqsupport(int, int);
 int	 pfctl_show_anchors(int, int, char *);
 int	 pfctl_ruleset_trans(struct pfctl *, char *, struct pf_anchor *);
 int	 pfctl_load_ruleset(struct pfctl *, char *,
 		struct pf_ruleset *, int, int);
 int	 pfctl_load_rule(struct pfctl *, char *, struct pf_rule *, int);
 const char	*pfctl_lookup_option(char *, const char **);
-struct pf_anchor_global	 pf_anchors;
+extern struct pf_anchor_global	 pf_anchors;
-struct pf_anchor	 pf_main_anchor;
+extern struct pf_anchor	 pf_main_anchor;
 const char	*clearopt;
 char		*rulesopt;
 const char	*showopt;
 const char	*debugopt;
 char		*anchoropt;
 const char	*optiopt = NULL;
 char		*pf_device = "/dev/pf";
 char		*ifaceopt;
 char		*tableopt;
 const char	*tblcmdopt;
 int		 src_node_killers;
 char		*src_node_kill[2];
 int		 state_killers;
 char		*state_kill[2];
 int		 loadopt;
 int		 altqsupport;
 int		 dev = -1;
 int		 first_title = 1;
 int		 labels = 0;
 const char	*infile;
 #define INDENT(d, o)	do {						\
 				if (o) {				\
 					int i;				\
 					for (i=0; i < d; i++)		\
 						printf("  ");		\
 				}					\
 			} while (0);					\
 static const struct {
 	const char	*name;
 	int		index;
 } pf_limits[] = {
 	{ "states",		PF_LIMIT_STATES },
 	{ "src-nodes",		PF_LIMIT_SRC_NODES },
 	{ "frags",		PF_LIMIT_FRAGS },
 	{ "tables",		PF_LIMIT_TABLES },
 	{ "table-entries",	PF_LIMIT_TABLE_ENTRIES },
 	{ NULL,			0 }
 };
 struct pf_hint {
 	const char	*name;
 	int		timeout;
 };
 static const struct pf_hint pf_hint_normal[] = {
 	{ "tcp.first",		2 * 60 },
 	{ "tcp.opening",	30 },
 	{ "tcp.established",	24 * 60 * 60 },
 	{ "tcp.closing",	15 * 60 },
 	{ "tcp.finwait",	45 },
 	{ "tcp.closed",		90 },
 	{ "tcp.tsdiff",		30 },
 	{ NULL,			0 }
 };
 static const struct pf_hint pf_hint_satellite[] = {
 	{ "tcp.first",		3 * 60 },
 	{ "tcp.opening",	30 + 5 },
 	{ "tcp.established",	24 * 60 * 60 },
 	{ "tcp.closing",	15 * 60 + 5 },
 	{ "tcp.finwait",	45 + 5 },
 	{ "tcp.closed",		90 + 5 },
 	{ "tcp.tsdiff",		60 },
 	{ NULL,			0 }
 };
 static const struct pf_hint pf_hint_conservative[] = {
 	{ "tcp.first",		60 * 60 },
 	{ "tcp.opening",	15 * 60 },
 	{ "tcp.established",	5 * 24 * 60 * 60 },
 	{ "tcp.closing",	60 * 60 },
 	{ "tcp.finwait",	10 * 60 },
 	{ "tcp.closed",		3 * 60 },
 	{ "tcp.tsdiff",		60 },
 	{ NULL,			0 }
 };
 static const struct pf_hint pf_hint_aggressive[] = {
 	{ "tcp.first",		30 },
 	{ "tcp.opening",	5 },
 	{ "tcp.established",	5 * 60 * 60 },
 	{ "tcp.closing",	60 },
 	{ "tcp.finwait",	30 },
 	{ "tcp.closed",		30 },
 	{ "tcp.tsdiff",		10 },
 	{ NULL,			0 }
 };
 static const struct {
 	const char *name;
 	const struct pf_hint *hint;
 } pf_hints[] = {
 	{ "normal",		pf_hint_normal },
 	{ "satellite",		pf_hint_satellite },
 	{ "high-latency",	pf_hint_satellite },
 	{ "conservative",	pf_hint_conservative },
 	{ "aggressive",		pf_hint_aggressive },
 	{ NULL,			NULL }
 };
 static const char *clearopt_list[] = {
 	"nat", "queue", "rules", "Sources",
 	"states", "info", "Tables", "osfp", "all", NULL
 };
 static const char *showopt_list[] = {
 	"nat", "queue", "rules", "Anchors", "Sources", "states", "info",
 	"Interfaces", "labels", "timeouts", "memory", "Tables", "osfp",
 	"all", NULL
 };
 static const char *tblcmdopt_list[] = {
 	"kill", "flush", "add", "delete", "load", "replace", "show",
 	"test", "zero", "expire", NULL
 };
 static const char *debugopt_list[] = {
 	"none", "urgent", "misc", "loud", NULL
 };
 static const char *optiopt_list[] = {
 	"none", "basic", "profile", NULL
 };
 void
 usage(void)
+{
 	extern char *__progname;
 	fprintf(stderr, "usage: %s [-AdeghmNnOqRrvz] ", __progname);
 	fprintf(stderr, "[-a anchor] [-D macro=value] [-F modifier]\n");
 	fprintf(stderr, "\t[-f file] [-i interface] [-K host | network] ");
 	fprintf(stderr, "[-k host | network]\n");
 	fprintf(stderr, "\t[-o level] [-p device] [-s modifier]\n");
 	fprintf(stderr, "\t[-t table -T command [address ...]] [-x level]\n");
 	exit(1);
+}
 int
 pfctl_enable(int dev, int opts)
+{
 	if (ioctl(dev, DIOCSTART)) {
 		if (errno == EEXIST)
 			errx(1, "pf already enabled");
 		else
 			err(1, "DIOCSTART");
+	}
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "pf enabled\n");
 	if (altqsupport && ioctl(dev, DIOCSTARTALTQ))
 		if (errno != EEXIST)
 			err(1, "DIOCSTARTALTQ");
 	return (0);
+}
 int
 pfctl_disable(int dev, int opts)
+{
 	if (ioctl(dev, DIOCSTOP)) {
 		if (errno == ENOENT)
 			errx(1, "pf not enabled");
 		else
 			err(1, "DIOCSTOP");
+	}
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "pf disabled\n");
 	if (altqsupport && ioctl(dev, DIOCSTOPALTQ))
 			if (errno != ENOENT)
 				err(1, "DIOCSTOPALTQ");
 	return (0);
+}
 int
 pfctl_clear_stats(int dev, int opts)
+{
 	if (ioctl(dev, DIOCCLRSTATUS))
 		err(1, "DIOCCLRSTATUS");
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "pf: statistics cleared\n");
 	return (0);
+}
 int
 pfctl_clear_interface_flags(int dev, int opts)
+{
 	struct pfioc_iface	pi;
 	if ((opts & PF_OPT_NOACTION) == 0) {
 		bzero(&pi, sizeof(pi));
 		pi.pfiio_flags = PFI_IFLAG_SKIP;
 		if (ioctl(dev, DIOCCLRIFFLAG, &pi))
 			err(1, "DIOCCLRIFFLAG");
 		if ((opts & PF_OPT_QUIET) == 0)
 			fprintf(stderr, "pf: interface flags reset\n");
+	}
 	return (0);
+}
 int
 pfctl_clear_rules(int dev, int opts, char *anchorname)
+{
 	struct pfr_buffer t;
 	memset(&t, 0, sizeof(t));
 	t.pfrb_type = PFRB_TRANS;
 	if (pfctl_add_trans(&t, PF_RULESET_SCRUB, anchorname) ||
 	    pfctl_add_trans(&t, PF_RULESET_FILTER, anchorname) ||
 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 		err(1, "pfctl_clear_rules");
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "rules cleared\n");
 	return (0);
+}
 int
 pfctl_clear_nat(int dev, int opts, char *anchorname)
+{
 	struct pfr_buffer t;
 	memset(&t, 0, sizeof(t));
 	t.pfrb_type = PFRB_TRANS;
 	if (pfctl_add_trans(&t, PF_RULESET_NAT, anchorname) ||
 	    pfctl_add_trans(&t, PF_RULESET_BINAT, anchorname) ||
 	    pfctl_add_trans(&t, PF_RULESET_RDR, anchorname) ||
 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 		err(1, "pfctl_clear_nat");
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "nat cleared\n");
 	return (0);
+}
 int
 pfctl_clear_altq(int dev, int opts)
+{
 	struct pfr_buffer t;
 	if (!altqsupport)
 		return (-1);
 	memset(&t, 0, sizeof(t));
 	t.pfrb_type = PFRB_TRANS;
 	if (pfctl_add_trans(&t, PF_RULESET_ALTQ, "") ||
 	    pfctl_trans(dev, &t, DIOCXBEGIN, 0) ||
 	    pfctl_trans(dev, &t, DIOCXCOMMIT, 0))
 		err(1, "pfctl_clear_altq");
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "altq cleared\n");
 	return (0);
+}
 int
 pfctl_clear_src_nodes(int dev, int opts)
+{
 	if (ioctl(dev, DIOCCLRSRCNODES))
 		err(1, "DIOCCLRSRCNODES");
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "source tracking entries cleared\n");
 	return (0);
+}
 int
 pfctl_clear_states(int dev, const char *iface, int opts)
+{
 	struct pfioc_state_kill psk;
 	memset(&psk, 0, sizeof(psk));
 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 		errx(1, "invalid interface: %s", iface);
 	if (ioctl(dev, DIOCCLRSTATES, &psk))
 		err(1, "DIOCCLRSTATES");
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "%d states cleared\n", psk.psk_af);
 	return (0);
+}
 void
 pfctl_addrprefix(char *addr, struct pf_addr *mask)
+{
 	char *p;
 	const char *errstr = NULL; /* XXX gcc */
 	int prefix, ret_ga, q, r;
 	struct addrinfo hints, *res;
 	if ((p = strchr(addr, '/')) == NULL)
 		return;
 	*p++ = '\0';
 	prefix = strtonum(p, 0, 128, &errstr);
 	if (errstr)
 		errx(1, "prefix is %s: %s", errstr, p);
 	bzero(&hints, sizeof(hints));
 	/* prefix only with numeric addresses */
 	hints.ai_flags |= AI_NUMERICHOST;
 	if ((ret_ga = getaddrinfo(addr, NULL, &hints, &res))) {
 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 		/* NOTREACHED */
+	}
 	if (res->ai_family == AF_INET && prefix > 32)
 		errx(1, "prefix too long for AF_INET");
 	else if (res->ai_family == AF_INET6 && prefix > 128)
 		errx(1, "prefix too long for AF_INET6");
 	q = prefix >> 3;
 	r = prefix & 7;
 	switch (res->ai_family) {
 	case AF_INET:
 		bzero(&mask->v4, sizeof(mask->v4));
 		mask->v4.s_addr = htonl((u_int32_t)
 		    (0xffffffffffULL << (32 - prefix)));
 		break;
 	case AF_INET6:
 		bzero(&mask->v6, sizeof(mask->v6));
 		if (q > 0)
 			memset((void *)&mask->v6, 0xff, q);
 		if (r > 0)
 			*((u_char *)&mask->v6 + q) =
 			    (0xff00 >> r) & 0xff;
 		break;
+	}
 	freeaddrinfo(res);
+}
 int
 pfctl_kill_src_nodes(int dev, const char *iface, int opts)
+{
 	struct pfioc_src_node_kill psnk;
 	struct addrinfo *res[2], *resp[2];
 	struct sockaddr last_src, last_dst;
 	int killed, sources, dests;
 	int ret_ga;
 	killed = sources = dests = 0;
 	memset(&psnk, 0, sizeof(psnk));
 	memset(&psnk.psnk_src.addr.v.a.mask, 0xff,
 	    sizeof(psnk.psnk_src.addr.v.a.mask));
 	memset(&last_src, 0xff, sizeof(last_src));
 	memset(&last_dst, 0xff, sizeof(last_dst));
 	pfctl_addrprefix(src_node_kill[0], &psnk.psnk_src.addr.v.a.mask);
 	if ((ret_ga = getaddrinfo(src_node_kill[0], NULL, NULL, &res[0]))) {
 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 		/* NOTREACHED */
+	}
 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 		if (resp[0]->ai_addr == NULL)
 			continue;
 		/* We get lots of duplicates.  Catch the easy ones */
 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 			continue;
 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
 		psnk.psnk_af = resp[0]->ai_family;
 		sources++;
 		if (psnk.psnk_af == AF_INET)
 			psnk.psnk_src.addr.v.a.addr.v4 =
 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 		else if (psnk.psnk_af == AF_INET6)
 			psnk.psnk_src.addr.v.a.addr.v6 =
 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 			    sin6_addr;
 		else
 			errx(1, "Unknown address family %d", psnk.psnk_af);
 		if (src_node_killers > 1) {
 			dests = 0;
 			memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
 			    sizeof(psnk.psnk_dst.addr.v.a.mask));
 			memset(&last_dst, 0xff, sizeof(last_dst));
 			pfctl_addrprefix(src_node_kill[1],
 			    &psnk.psnk_dst.addr.v.a.mask);
 			if ((ret_ga = getaddrinfo(src_node_kill[1], NULL, NULL,
 			    &res[1]))) {
 				errx(1, "getaddrinfo: %s",
 				    gai_strerror(ret_ga));
 				/* NOTREACHED */
+			}
 			for (resp[1] = res[1]; resp[1];
 			    resp[1] = resp[1]->ai_next) {
 				if (resp[1]->ai_addr == NULL)
 					continue;
 				if (psnk.psnk_af != resp[1]->ai_family)
 					continue;
 				if (memcmp(&last_dst, resp[1]->ai_addr,
 				    sizeof(last_dst)) == 0)
 					continue;
 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 				dests++;
 				if (psnk.psnk_af == AF_INET)
 					psnk.psnk_dst.addr.v.a.addr.v4 =
 					    ((struct sockaddr_in *)resp[1]->
 					    ai_addr)->sin_addr;
 				else if (psnk.psnk_af == AF_INET6)
 					psnk.psnk_dst.addr.v.a.addr.v6 =
 					    ((struct sockaddr_in6 *)resp[1]->
 					    ai_addr)->sin6_addr;
 				else
 					errx(1, "Unknown address family %d",
 					    psnk.psnk_af);
 				if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 					err(1, "DIOCKILLSRCNODES");
 				killed += psnk.psnk_af;
 				/* fixup psnk.psnk_af */
 				psnk.psnk_af = resp[1]->ai_family;
+			}
 			freeaddrinfo(res[1]);
 		} else {
 			if (ioctl(dev, DIOCKILLSRCNODES, &psnk))
 				err(1, "DIOCKILLSRCNODES");
 			killed += psnk.psnk_af;
 			/* fixup psnk.psnk_af */
 			psnk.psnk_af = res[0]->ai_family;
+		}
+	}
 	freeaddrinfo(res[0]);
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "killed %d src nodes from %d sources and %d "
 		    "destinations\n", killed, sources, dests);
 	return (0);
+}
 int
 pfctl_kill_states(int dev, const char *iface, int opts)
+{
 	struct pfioc_state_kill psk;
 	struct addrinfo *res[2], *resp[2];
 	struct sockaddr last_src, last_dst;
 	int killed, sources, dests;
 	int ret_ga;
 	killed = sources = dests = 0;
 	memset(&psk, 0, sizeof(psk));
 	memset(&psk.psk_src.addr.v.a.mask, 0xff,
 	    sizeof(psk.psk_src.addr.v.a.mask));
 	memset(&last_src, 0xff, sizeof(last_src));
 	memset(&last_dst, 0xff, sizeof(last_dst));
 	if (iface != NULL && strlcpy(psk.psk_ifname, iface,
 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
 		errx(1, "invalid interface: %s", iface);
 	pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
 	if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
 		errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));
 		/* NOTREACHED */
+	}
 	for (resp[0] = res[0]; resp[0]; resp[0] = resp[0]->ai_next) {
 		if (resp[0]->ai_addr == NULL)
 			continue;
 		/* We get lots of duplicates.  Catch the easy ones */
 		if (memcmp(&last_src, resp[0]->ai_addr, sizeof(last_src)) == 0)
 			continue;
 		last_src = *(struct sockaddr *)resp[0]->ai_addr;
 		psk.psk_af = resp[0]->ai_family;
 		sources++;
 		if (psk.psk_af == AF_INET)
 			psk.psk_src.addr.v.a.addr.v4 =
 			    ((struct sockaddr_in *)resp[0]->ai_addr)->sin_addr;
 		else if (psk.psk_af == AF_INET6)
 			psk.psk_src.addr.v.a.addr.v6 =
 			    ((struct sockaddr_in6 *)resp[0]->ai_addr)->
 			    sin6_addr;
 		else
 			errx(1, "Unknown address family %d", psk.psk_af);
 		if (state_killers > 1) {
 			dests = 0;
 			memset(&psk.psk_dst.addr.v.a.mask, 0xff,
 			    sizeof(psk.psk_dst.addr.v.a.mask));
 			memset(&last_dst, 0xff, sizeof(last_dst));
 			pfctl_addrprefix(state_kill[1],
 			    &psk.psk_dst.addr.v.a.mask);
 			if ((ret_ga = getaddrinfo(state_kill[1], NULL, NULL,
 			    &res[1]))) {
 				errx(1, "getaddrinfo: %s",
 				    gai_strerror(ret_ga));
 				/* NOTREACHED */
+			}
 			for (resp[1] = res[1]; resp[1];
 			    resp[1] = resp[1]->ai_next) {
 				if (resp[1]->ai_addr == NULL)
 					continue;
 				if (psk.psk_af != resp[1]->ai_family)
 					continue;
 				if (memcmp(&last_dst, resp[1]->ai_addr,
 				    sizeof(last_dst)) == 0)
 					continue;
 				last_dst = *(struct sockaddr *)resp[1]->ai_addr;
 				dests++;
 				if (psk.psk_af == AF_INET)
 					psk.psk_dst.addr.v.a.addr.v4 =
 					    ((struct sockaddr_in *)resp[1]->
 					    ai_addr)->sin_addr;
 				else if (psk.psk_af == AF_INET6)
 					psk.psk_dst.addr.v.a.addr.v6 =
 					    ((struct sockaddr_in6 *)resp[1]->
 					    ai_addr)->sin6_addr;
 				else
 					errx(1, "Unknown address family %d",
 					    psk.psk_af);
 				if (ioctl(dev, DIOCKILLSTATES, &psk))
 					err(1, "DIOCKILLSTATES");
 				killed += psk.psk_af;
 				/* fixup psk.psk_af */
 				psk.psk_af = resp[1]->ai_family;
+			}
 			freeaddrinfo(res[1]);
 		} else {
 			if (ioctl(dev, DIOCKILLSTATES, &psk))
 				err(1, "DIOCKILLSTATES");
 			killed += psk.psk_af;
 			/* fixup psk.psk_af */
 			psk.psk_af = res[0]->ai_family;
+		}
+	}
 	freeaddrinfo(res[0]);
 	if ((opts & PF_OPT_QUIET) == 0)
 		fprintf(stderr, "killed %d states from %d sources and %d "
 		    "destinations\n", killed, sources, dests);
 	return (0);
+}
 int
 pfctl_get_pool(int dev, struct pf_pool *pool, u_int32_t nr,
     u_int32_t ticket, int r_action, char *anchorname)
+{
 	struct pfioc_pooladdr pp;
 	struct pf_pooladdr *pa;
 	u_int32_t pnr, mpnr;
 	memset(&pp, 0, sizeof(pp));
 	memcpy(pp.anchor, anchorname, sizeof(pp.anchor));
 	pp.r_action = r_action;
 	pp.r_num = nr;
 	pp.ticket = ticket;
 	if (ioctl(dev, DIOCGETADDRS, &pp)) {
 		warn("DIOCGETADDRS");
 		return (-1);
+	}
 	mpnr = pp.nr;
 	TAILQ_INIT(&pool->list);
 	for (pnr = 0; pnr < mpnr; ++pnr) {
 		pp.nr = pnr;
 		if (ioctl(dev, DIOCGETADDR, &pp)) {
 			warn("DIOCGETADDR");
 			return (-1);
+		}
 		pa = calloc(1, sizeof(struct pf_pooladdr));
 		if (pa == NULL)
 			err(1, "calloc");
 		bcopy(&pp.addr, pa, sizeof(struct pf_pooladdr));
 		TAILQ_INSERT_TAIL(&pool->list, pa, entries);
+	}
 	return (0);
+}
 void
 pfctl_move_pool(struct pf_pool *src, struct pf_pool *dst)
+{
 	struct pf_pooladdr *pa;
 	while ((pa = TAILQ_FIRST(&src->list)) != NULL) {
 		TAILQ_REMOVE(&src->list, pa, entries);
 		TAILQ_INSERT_TAIL(&dst->list, pa, entries);
+	}
+}
 void
 pfctl_clear_pool(struct pf_pool *pool)
+{
 	struct pf_pooladdr *pa;
 	while ((pa = TAILQ_FIRST(&pool->list)) != NULL) {
 		TAILQ_REMOVE(&pool->list, pa, entries);
 		free(pa);
+	}
+}
 void
 pfctl_print_rule_counters(struct pf_rule *rule, int opts)
+{
 	if (opts & PF_OPT_DEBUG) {
 		const char *t[PF_SKIP_COUNT] = { "i", "d", "f",
 		    "p", "sa", "sp", "da", "dp" };
 		int i;
 		printf("  [ Skip steps: ");
 		for (i = 0; i < PF_SKIP_COUNT; ++i) {
 			if (rule->skip[i].nr == rule->nr + 1)
 				continue;
 			printf("%s=", t[i]);
 			if (rule->skip[i].nr == -1)
 				printf("end ");
 			else
 				printf("%u ", rule->skip[i].nr);
+		}
 		printf("]\n");
 		printf("  [ queue: qname=%s qid=%u pqname=%s pqid=%u ]\n",
 		    rule->qname, rule->qid, rule->pqname, rule->pqid);
+	}
 	if (opts & PF_OPT_VERBOSE) {
 		printf("  [ Evaluations: %-8llu  Packets: %-8llu  "
 			    "Bytes: %-10llu  States: %-6u]\n",
 			    (unsigned long long)rule->evaluations,
 			    (unsigned long long)(rule->packets[0] +
 			    rule->packets[1]),
 			    (unsigned long long)(rule->bytes[0] +
 			    rule->bytes[1]), rule->states);
 		if (!(opts & PF_OPT_DEBUG))
 			printf("  [ Inserted: uid %u pid %u ]\n",
 			    (unsigned)rule->cuid, (unsigned)rule->cpid);
+	}
+}
 void
 pfctl_print_title(char *title)
+{
 	if (!first_title)
 		printf("\n");
 	first_title = 0;
 	printf("%s\n", title);
+}
 int
 pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
     char *anchorname, int depth)
+{
 	struct pfioc_rule pr;
 	u_int32_t nr, mnr, header = 0;
 	int rule_numbers = opts & (PF_OPT_VERBOSE2 | PF_OPT_DEBUG);
 	int len = strlen(path);
 	int brace;
 	char *p;
 	if (path[0])
 		snprintf(&path[len], MAXPATHLEN - len, "/%s", anchorname);
 	else
 		snprintf(&path[len], MAXPATHLEN - len, "%s", anchorname);
 	memset(&pr, 0, sizeof(pr));
 	memcpy(pr.anchor, path, sizeof(pr.anchor));
 	if (opts & PF_OPT_SHOWALL) {
 		pr.rule.action = PF_PASS;
 		if (ioctl(dev, DIOCGETRULES, &pr)) {
 			warn("DIOCGETRULES");
 			goto error;
+		}
 		header++;
+	}
 	pr.rule.action = PF_SCRUB;
 	if (ioctl(dev, DIOCGETRULES, &pr)) {
 		warn("DIOCGETRULES");
 		goto error;
+	}
 	if (opts & PF_OPT_SHOWALL) {
 		if (format == PFCTL_SHOW_RULES && (pr.nr > 0 || header))
 			pfctl_print_title("FILTER RULES:");
 		else if (format == PFCTL_SHOW_LABELS && labels)
 			pfctl_print_title("LABEL COUNTERS:");
+	}
 	mnr = pr.nr;
 	if (opts & PF_OPT_CLRRULECTRS)
 		pr.action = PF_GET_CLR_CNTR;
 	for (nr = 0; nr < mnr; ++nr) {
 		pr.nr = nr;
 		if (ioctl(dev, DIOCGETRULE, &pr)) {
 			warn("DIOCGETRULE");
 			goto error;
+		}
 		if (pfctl_get_pool(dev, &pr.rule.rpool,
 		    nr, pr.ticket, PF_SCRUB, path) != 0)
 			goto error;
 		switch (format) {
 		case PFCTL_SHOW_LABELS:
 			if (pr.rule.label[0]) {
 				printf("%s ", pr.rule.label);
 				printf("%llu %llu %llu %llu %llu %llu %llu\n",
 				    (unsigned long long)pr.rule.evaluations,
 				    (unsigned long long)(pr.rule.packets[0] +
 				    pr.rule.packets[1]),
 				    (unsigned long long)(pr.rule.bytes[0] +
 				    pr.rule.bytes[1]),
 				    (unsigned long long)pr.rule.packets[0],
 				    (unsigned long long)pr.rule.bytes[0],
 				    (unsigned long long)pr.rule.packets[1],
 				    (unsigned long long)pr.rule.bytes[1]);
+			}
 			break;
 		case PFCTL_SHOW_RULES:
 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 				labels = 1;
 			print_rule(&pr.rule, pr.anchor_call, rule_numbers);
 			printf("\n");
 			pfctl_print_rule_counters(&pr.rule, opts);
 			break;
 		case PFCTL_SHOW_NOTHING:
 			break;
+		}
 		pfctl_clear_pool(&pr.rule.rpool);
+	}
 	pr.rule.action = PF_PASS;
 	if (ioctl(dev, DIOCGETRULES, &pr)) {
 		warn("DIOCGETRULES");
 		goto error;
+	}
 	mnr = pr.nr;
 	for (nr = 0; nr < mnr; ++nr) {
 		pr.nr = nr;
 		if (ioctl(dev, DIOCGETRULE, &pr)) {
 			warn("DIOCGETRULE");
 			goto error;
+		}
 		if (pfctl_get_pool(dev, &pr.rule.rpool,
 		    nr, pr.ticket, PF_PASS, path) != 0)
 			goto error;
 		switch (format) {
 		case PFCTL_SHOW_LABELS:
 			if (pr.rule.label[0]) {
 				printf("%s ", pr.rule.label);
 				printf("%llu %llu %llu %llu %llu %llu %llu\n",
 				    (unsigned long long)pr.rule.evaluations,
 				    (unsigned long long)(pr.rule.packets[0] +
 				    pr.rule.packets[1]),
 				    (unsigned long long)(pr.rule.bytes[0] +
 				    pr.rule.bytes[1]),
 				    (unsigned long long)pr.rule.packets[0],
 				    (unsigned long long)pr.rule.bytes[0],
 				    (unsigned long long)pr.rule.packets[1],
 				    (unsigned long long)pr.rule.bytes[1]);
+			}
 			break;
 		case PFCTL_SHOW_RULES:
 			brace = 0;
 			if (pr.rule.label[0] && (opts & PF_OPT_SHOWALL))
 				labels = 1;
 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
 			if (pr.anchor_call[0] &&
 			   ((((p = strrchr(pr.anchor_call, '_')) != NULL) &&
 			   ((void *)p == (void *)pr.anchor_call ||
 			   *(--p) == '/')) || (opts & PF_OPT_RECURSE))) {
 				brace++;
 				if ((p = strrchr(pr.anchor_call, '/')) !=
 				    NULL)
 					p++;
 				else
 					p = &pr.anchor_call[0];
 			} else
 				p = &pr.anchor_call[0];
 			print_rule(&pr.rule, p, rule_numbers);
 			if (brace)
 				printf(" {\n");
 			else
 				printf("\n");
 			pfctl_print_rule_counters(&pr.rule, opts);
 			if (brace) {
 				pfctl_show_rules(dev, path, opts, format,
 				    p, depth + 1);
 				INDENT(depth, !(opts & PF_OPT_VERBOSE));
 				printf("}\n");
+			}
 			break;
 		case PFCTL_SHOW_NOTHING:
 			break;
+		}
 		pfctl_clear_pool(&pr.rule.rpool);
+	}
 	path[len] = '\0';
 	return (0);
  error:
 	path[len] = '\0';
 	return (-1);
+}
 int
 pfctl_show_nat(int dev, int opts, char *anchorname)
+{
 	struct pfioc_rule pr;
 	u_int32_t mnr, nr;
 	static int nattype[3] = { PF_NAT, PF_RDR, PF_BINAT };
 	int i, dotitle = opts & PF_OPT_SHOWALL;
 	memset(&pr, 0, sizeof(pr));
 	memcpy(pr.anchor, anchorname, sizeof(pr.anchor));
 	for (i = 0; i < 3; i++) {
 		pr.rule.action = nattype[i];
 		if (ioctl(dev, DIOCGETRULES, &pr)) {
 			warn("DIOCGETRULES");
 			return (-1);
+		}
 		mnr = pr.nr;
 		for (nr = 0; nr < mnr; ++nr) {
 			pr.nr = nr;
 			if (ioctl(dev, DIOCGETRULE, &pr)) {
 				warn("DIOCGETRULE");
 				return (-1);
+			}
 			if (pfctl_get_pool(dev, &pr.rule.rpool, nr,
 			    pr.ticket, nattype[i], anchorname) != 0)
 				return (-1);
 			if (dotitle) {
 				pfctl_print_title("TRANSLATION RULES:");
 				dotitle = 0;
+			}
 			print_rule(&pr.rule, pr.anchor_call,
 			    opts & PF_OPT_VERBOSE2);
 			printf("\n");
 			pfctl_print_rule_counters(&pr.rule, opts);
 			pfctl_clear_pool(&pr.rule.rpool);
+		}
+	}
 	return (0);
+}
 int
 pfctl_show_src_nodes(int dev, int opts)
+{
 	struct pfioc_src_nodes psn;
 	struct pf_src_node *p;
 	char *inbuf = NULL, *newinbuf = NULL;
 	unsigned len = 0;
 	int i;
 	memset(&psn, 0, sizeof(psn));
 	for (;;) {
 		psn.psn_len = len;
 		if (len) {
 			newinbuf = realloc(inbuf, len);
 			if (newinbuf == NULL)
 				err(1, "realloc");
 			psn.psn_buf = inbuf = newinbuf;
+		}
 		if (ioctl(dev, DIOCGETSRCNODES, &psn) < 0) {
 			warn("DIOCGETSRCNODES");
 			free(inbuf);
 			return (-1);
+		}
 		if (psn.psn_len + sizeof(struct pfioc_src_nodes) < len)
 			break;
 		if (len == 0 && psn.psn_len == 0)
 			goto done;
 		if (len == 0 && psn.psn_len != 0)
 			len = psn.psn_len;
 		if (psn.psn_len == 0)
 			goto done;	/* no src_nodes */
 		len *= 2;
+	}
 	p = psn.psn_src_nodes;
 	if (psn.psn_len > 0 && (opts & PF_OPT_SHOWALL))
 		pfctl_print_title("SOURCE TRACKING NODES:");
 	for (i = 0; i < psn.psn_len; i += sizeof(*p)) {
 		print_src_node(p, opts);
 		p++;
+	}
 done:
 	free(inbuf);
 	return (0);
+}
 int
 pfctl_show_states(int dev, const char *iface, int opts)
+{
 	struct pfioc_states ps;
 	struct pfsync_state *p;
 	char *inbuf = NULL, *newinbuf = NULL;
 	unsigned len = 0;
 	int i, dotitle = (opts & PF_OPT_SHOWALL);
 	memset(&ps, 0, sizeof(ps));
 	for (;;) {
 		ps.ps_len = len;
 		if (len) {
 			newinbuf = realloc(inbuf, len);
 			if (newinbuf == NULL)
 				err(1, "realloc");
 			ps.ps_buf = inbuf = newinbuf;
+		}
 		if (ioctl(dev, DIOCGETSTATES, &ps) < 0) {
 			warn("DIOCGETSTATES");
 			free(inbuf);
 			return (-1);
+		}
 		if (ps.ps_len + sizeof(struct pfioc_states) < len)
 			break;
 		if (len == 0 && ps.ps_len == 0)
 			goto done;
 		if (len == 0 && ps.ps_len != 0)
 			len = ps.ps_len;
 		if (ps.ps_len == 0)
 			goto done;	/* no states */
 		len *= 2;
+	}
 	p = ps.ps_states;
 	for (i = 0; i < ps.ps_len; i += sizeof(*p), p++) {
 		if (iface != NULL && strcmp(p->ifname, iface))
 			continue;
 		if (dotitle) {
 			pfctl_print_title("STATES:");
 			dotitle = 0;
+		}
 		print_state(p, opts);
+	}
 done:
 	free(inbuf);
 	return (0);
+}
 int
 pfctl_show_status(int dev, int opts)
+{
 	struct pf_status status;
 	if (ioctl(dev, DIOCGETSTATUS, &status)) {
 		warn("DIOCGETSTATUS");
 		return (-1);
+	}
 	if (opts & PF_OPT_SHOWALL)
 		pfctl_print_title("INFO:");
 	print_status(&status, opts);
 	return (0);
+}
 int
 pfctl_show_timeouts(int dev, int opts)
+{
 	struct pfioc_tm pt;
 	int i;
 	if (opts & PF_OPT_SHOWALL)
 		pfctl_print_title("TIMEOUTS:");
 	memset(&pt, 0, sizeof(pt));
 	for (i = 0; pf_timeouts[i].name; i++) {
 		pt.timeout = pf_timeouts[i].timeout;
 		if (ioctl(dev, DIOCGETTIMEOUT, &pt))
 			err(1, "DIOCGETTIMEOUT");
 		printf("%-20s %10d", pf_timeouts[i].name, pt.seconds);
 		if (pf_timeouts[i].timeout >= PFTM_ADAPTIVE_START &&
 		    pf_timeouts[i].timeout <= PFTM_ADAPTIVE_END)
 			printf(" states");
 		else
 			printf("s");
 		printf("\n");
+	}
 	return (0);
+}
 int
 pfctl_show_limits(int dev, int opts)
+{
 	struct pfioc_limit pl;
 	int i;
 	if (opts & PF_OPT_SHOWALL)
 		pfctl_print_title("LIMITS:");
 	memset(&pl, 0, sizeof(pl));
 	for (i = 0; pf_limits[i].name; i++) {
 		pl.index = pf_limits[i].index;
 		if (ioctl(dev, DIOCGETLIMIT, &pl))
 			err(1, "DIOCGETLIMIT");
 		printf("%-13s ", pf_limits[i].name);