parse.y revision 178894 
1/*	$OpenBSD: parse.y,v 1.517 2007/02/03 23:26:40 dhartmei Exp $	*/
2
3/*
4 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
5 * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
6 * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
7 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29%{
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/contrib/pf/pfctl/parse.y 178894 2008-05-09 23:53:01Z julian $");
32
33#include <sys/types.h>
34#include <sys/socket.h>
35#include <net/if.h>
36#include <netinet/in.h>
37#include <netinet/in_systm.h>
38#include <netinet/ip.h>
39#include <netinet/ip_icmp.h>
40#include <netinet/icmp6.h>
41#include <net/pfvar.h>
42#include <arpa/inet.h>
43#include <altq/altq.h>
44#include <altq/altq_cbq.h>
45#include <altq/altq_priq.h>
46#include <altq/altq_hfsc.h>
47
48#include <stdio.h>
49#include <stdlib.h>
50#include <netdb.h>
51#include <stdarg.h>
52#include <errno.h>
53#include <string.h>
54#include <ctype.h>
55#include <math.h>
56#include <err.h>
57#include <limits.h>
58#include <pwd.h>
59#include <grp.h>
60#include <md5.h>
61
62#include "pfctl_parser.h"
63#include "pfctl.h"
64
65#ifdef __FreeBSD__
66#define	HTONL(x)	(x) = htonl((__uint32_t)(x))
67#endif
68
69static struct pfctl	*pf = NULL;
70static FILE		*fin = NULL;
71static int		 debug = 0;
72static int		 lineno = 1;
73static int		 errors = 0;
74static int		 rulestate = 0;
75static u_int16_t	 returnicmpdefault =
76			    (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
77static u_int16_t	 returnicmp6default =
78			    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
79static int		 blockpolicy = PFRULE_DROP;
80static int		 require_order = 1;
81static int		 default_statelock;
82
83enum {
84	PFCTL_STATE_NONE,
85	PFCTL_STATE_OPTION,
86	PFCTL_STATE_SCRUB,
87	PFCTL_STATE_QUEUE,
88	PFCTL_STATE_NAT,
89	PFCTL_STATE_FILTER
90};
91
92struct node_proto {
93	u_int8_t		 proto;
94	struct node_proto	*next;
95	struct node_proto	*tail;
96};
97
98struct node_port {
99	u_int16_t		 port[2];
100	u_int8_t		 op;
101	struct node_port	*next;
102	struct node_port	*tail;
103};
104
105struct node_uid {
106	uid_t			 uid[2];
107	u_int8_t		 op;
108	struct node_uid		*next;
109	struct node_uid		*tail;
110};
111
112struct node_gid {
113	gid_t			 gid[2];
114	u_int8_t		 op;
115	struct node_gid		*next;
116	struct node_gid		*tail;
117};
118
119struct node_icmp {
120	u_int8_t		 code;
121	u_int8_t		 type;
122	u_int8_t		 proto;
123	struct node_icmp	*next;
124	struct node_icmp	*tail;
125};
126
127enum	{ PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
128	    PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
129	    PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
130	    PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
131	    PF_STATE_OPT_TIMEOUT };
132
133enum	{ PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
134
135struct node_state_opt {
136	int			 type;
137	union {
138		u_int32_t	 max_states;
139		u_int32_t	 max_src_states;
140		u_int32_t	 max_src_conn;
141		struct {
142			u_int32_t	limit;
143			u_int32_t	seconds;
144		}		 max_src_conn_rate;
145		struct {
146			u_int8_t	flush;
147			char		tblname[PF_TABLE_NAME_SIZE];
148		}		 overload;
149		u_int32_t	 max_src_nodes;
150		u_int8_t	 src_track;
151		u_int32_t	 statelock;
152		struct {
153			int		number;
154			u_int32_t	seconds;
155		}		 timeout;
156	}			 data;
157	struct node_state_opt	*next;
158	struct node_state_opt	*tail;
159};
160
161struct peer {
162	struct node_host	*host;
163	struct node_port	*port;
164};
165
166struct node_queue {
167	char			 queue[PF_QNAME_SIZE];
168	char			 parent[PF_QNAME_SIZE];
169	char			 ifname[IFNAMSIZ];
170	int			 scheduler;
171	struct node_queue	*next;
172	struct node_queue	*tail;
173}	*queues = NULL;
174
175struct node_qassign {
176	char		*qname;
177	char		*pqname;
178};
179
180struct filter_opts {
181	int			 marker;
182#define FOM_FLAGS	0x01
183#define FOM_ICMP	0x02
184#define FOM_TOS		0x04
185#define FOM_KEEP	0x08
186#define FOM_SRCTRACK	0x10
187	struct node_uid		*uid;
188	struct node_gid		*gid;
189	struct {
190		u_int8_t	 b1;
191		u_int8_t	 b2;
192		u_int16_t	 w;
193		u_int16_t	 w2;
194	} flags;
195	struct node_icmp	*icmpspec;
196	u_int32_t		 tos;
197	u_int32_t		 prob;
198	struct {
199		int			 action;
200		struct node_state_opt	*options;
201	} keep;
202	int			 fragment;
203	int			 allowopts;
204	char			*label;
205	struct node_qassign	 queues;
206	char			*tag;
207	char			*match_tag;
208	u_int8_t		 match_tag_not;
209	int			 rtableid;
210} filter_opts;
211
212struct antispoof_opts {
213	char			*label;
214	int			 rtableid;
215} antispoof_opts;
216
217struct scrub_opts {
218	int			marker;
219#define SOM_MINTTL	0x01
220#define SOM_MAXMSS	0x02
221#define SOM_FRAGCACHE	0x04
222	int			nodf;
223	int			minttl;
224	int			maxmss;
225	int			fragcache;
226	int			randomid;
227	int			reassemble_tcp;
228	int			rtableid;
229} scrub_opts;
230
231struct queue_opts {
232	int			marker;
233#define QOM_BWSPEC	0x01
234#define QOM_SCHEDULER	0x02
235#define QOM_PRIORITY	0x04
236#define QOM_TBRSIZE	0x08
237#define QOM_QLIMIT	0x10
238	struct node_queue_bw	queue_bwspec;
239	struct node_queue_opt	scheduler;
240	int			priority;
241	int			tbrsize;
242	int			qlimit;
243} queue_opts;
244
245struct table_opts {
246	int			flags;
247	int			init_addr;
248	struct node_tinithead	init_nodes;
249} table_opts;
250
251struct pool_opts {
252	int			 marker;
253#define POM_TYPE		0x01
254#define POM_STICKYADDRESS	0x02
255	u_int8_t		 opts;
256	int			 type;
257	int			 staticport;
258	struct pf_poolhashkey	*key;
259
260} pool_opts;
261
262
263struct node_hfsc_opts	hfsc_opts;
264
265int	yyerror(const char *, ...);
266int	disallow_table(struct node_host *, const char *);
267int	disallow_urpf_failed(struct node_host *, const char *);
268int	disallow_alias(struct node_host *, const char *);
269int	rule_consistent(struct pf_rule *, int);
270int	filter_consistent(struct pf_rule *, int);
271int	nat_consistent(struct pf_rule *);
272int	rdr_consistent(struct pf_rule *);
273int	process_tabledef(char *, struct table_opts *);
274int	yyparse(void);
275void	expand_label_str(char *, size_t, const char *, const char *);
276void	expand_label_if(const char *, char *, size_t, const char *);
277void	expand_label_addr(const char *, char *, size_t, u_int8_t,
278	    struct node_host *);
279void	expand_label_port(const char *, char *, size_t, struct node_port *);
280void	expand_label_proto(const char *, char *, size_t, u_int8_t);
281void	expand_label_nr(const char *, char *, size_t);
282void	expand_label(char *, size_t, const char *, u_int8_t, struct node_host *,
283	    struct node_port *, struct node_host *, struct node_port *,
284	    u_int8_t);
285void	expand_rule(struct pf_rule *, struct node_if *, struct node_host *,
286	    struct node_proto *, struct node_os*, struct node_host *,
287	    struct node_port *, struct node_host *, struct node_port *,
288	    struct node_uid *, struct node_gid *, struct node_icmp *,
289	    const char *);
290int	expand_altq(struct pf_altq *, struct node_if *, struct node_queue *,
291	    struct node_queue_bw bwspec, struct node_queue_opt *);
292int	expand_queue(struct pf_altq *, struct node_if *, struct node_queue *,
293	    struct node_queue_bw, struct node_queue_opt *);
294int	expand_skip_interface(struct node_if *);
295
296int	 check_rulestate(int);
297int	 kw_cmp(const void *, const void *);
298int	 lookup(char *);
299int	 lgetc(FILE *);
300int	 lungetc(int);
301int	 findeol(void);
302int	 yylex(void);
303int	 atoul(char *, u_long *);
304int	 getservice(char *);
305int	 rule_label(struct pf_rule *, char *);
306
307TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
308struct sym {
309	TAILQ_ENTRY(sym)	 entries;
310	int			 used;
311	int			 persist;
312	char			*nam;
313	char			*val;
314};
315
316
317int	 symset(const char *, const char *, int);
318char	*symget(const char *);
319
320void	 mv_rules(struct pf_ruleset *, struct pf_ruleset *);
321void	 decide_address_family(struct node_host *, sa_family_t *);
322void	 remove_invalid_hosts(struct node_host **, sa_family_t *);
323int	 invalid_redirect(struct node_host *, sa_family_t);
324u_int16_t parseicmpspec(char *, sa_family_t);
325
326TAILQ_HEAD(loadanchorshead, loadanchors)
327    loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
328
329struct loadanchors {
330	TAILQ_ENTRY(loadanchors)	 entries;
331	char				*anchorname;
332	char				*filename;
333};
334
335typedef struct {
336	union {
337		u_int32_t		 number;
338		int			 i;
339		char			*string;
340		int			 rtableid;
341		struct {
342			u_int8_t	 b1;
343			u_int8_t	 b2;
344			u_int16_t	 w;
345			u_int16_t	 w2;
346		}			 b;
347		struct range {
348			int		 a;
349			int		 b;
350			int		 t;
351		}			 range;
352		struct node_if		*interface;
353		struct node_proto	*proto;
354		struct node_icmp	*icmp;
355		struct node_host	*host;
356		struct node_os		*os;
357		struct node_port	*port;
358		struct node_uid		*uid;
359		struct node_gid		*gid;
360		struct node_state_opt	*state_opt;
361		struct peer		 peer;
362		struct {
363			struct peer	 src, dst;
364			struct node_os	*src_os;
365		}			 fromto;
366		struct {
367			struct node_host	*host;
368			u_int8_t		 rt;
369			u_int8_t		 pool_opts;
370			sa_family_t		 af;
371			struct pf_poolhashkey	*key;
372		}			 route;
373		struct redirection {
374			struct node_host	*host;
375			struct range		 rport;
376		}			*redirection;
377		struct {
378			int			 action;
379			struct node_state_opt	*options;
380		}			 keep_state;
381		struct {
382			u_int8_t	 log;
383			u_int8_t	 logif;
384			u_int8_t	 quick;
385		}			 logquick;
386		struct {
387			int		 neg;
388			char		*name;
389		}			 tagged;
390		struct pf_poolhashkey	*hashkey;
391		struct node_queue	*queue;
392		struct node_queue_opt	 queue_options;
393		struct node_queue_bw	 queue_bwspec;
394		struct node_qassign	 qassign;
395		struct filter_opts	 filter_opts;
396		struct antispoof_opts	 antispoof_opts;
397		struct queue_opts	 queue_opts;
398		struct scrub_opts	 scrub_opts;
399		struct table_opts	 table_opts;
400		struct pool_opts	 pool_opts;
401		struct node_hfsc_opts	 hfsc_opts;
402	} v;
403	int lineno;
404} YYSTYPE;
405
406#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
407	(!((addr).iflags & PFI_AFLAG_NOALIAS) ||		 \
408	!isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
409
410%}
411
412%token	PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
413%token	RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
414%token	ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
415%token	MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
416%token	NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
417%token	REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
418%token	SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
419%token	REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
420%token	ANTISPOOF FOR
421%token	BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
422%token	ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT
423%token	QUEUE PRIORITY QLIMIT RTABLE
424%token	LOAD RULESET_OPTIMIZATION
425%token	STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
426%token	MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH
427%token	TAGGED TAG IFBOUND FLOATING STATEPOLICY ROUTE
428%token	<v.string>		STRING
429%token	<v.i>			PORTBINARY
430%type	<v.interface>		interface if_list if_item_not if_item
431%type	<v.number>		number icmptype icmp6type uid gid
432%type	<v.number>		tos not yesno
433%type	<v.i>			no dir af fragcache optimizer
434%type	<v.i>			sourcetrack flush unaryop statelock
435%type	<v.b>			action nataction natpass scrubaction
436%type	<v.b>			flags flag blockspec
437%type	<v.range>		port rport
438%type	<v.hashkey>		hashkey
439%type	<v.proto>		proto proto_list proto_item
440%type	<v.icmp>		icmpspec
441%type	<v.icmp>		icmp_list icmp_item
442%type	<v.icmp>		icmp6_list icmp6_item
443%type	<v.fromto>		fromto
444%type	<v.peer>		ipportspec from to
445%type	<v.host>		ipspec xhost host dynaddr host_list
446%type	<v.host>		redir_host_list redirspec
447%type	<v.host>		route_host route_host_list routespec
448%type	<v.os>			os xos os_list
449%type	<v.port>		portspec port_list port_item
450%type	<v.uid>			uids uid_list uid_item
451%type	<v.gid>			gids gid_list gid_item
452%type	<v.route>		route
453%type	<v.redirection>		redirection redirpool
454%type	<v.string>		label string tag anchorname
455%type	<v.keep_state>		keep
456%type	<v.state_opt>		state_opt_spec state_opt_list state_opt_item
457%type	<v.logquick>		logquick quick log logopts logopt
458%type	<v.interface>		antispoof_ifspc antispoof_iflst antispoof_if
459%type	<v.qassign>		qname
460%type	<v.queue>		qassign qassign_list qassign_item
461%type	<v.queue_options>	scheduler
462%type	<v.number>		cbqflags_list cbqflags_item
463%type	<v.number>		priqflags_list priqflags_item
464%type	<v.hfsc_opts>		hfscopts_list hfscopts_item hfsc_opts
465%type	<v.queue_bwspec>	bandwidth
466%type	<v.filter_opts>		filter_opts filter_opt filter_opts_l
467%type	<v.antispoof_opts>	antispoof_opts antispoof_opt antispoof_opts_l
468%type	<v.queue_opts>		queue_opts queue_opt queue_opts_l
469%type	<v.scrub_opts>		scrub_opts scrub_opt scrub_opts_l
470%type	<v.table_opts>		table_opts table_opt table_opts_l
471%type	<v.pool_opts>		pool_opts pool_opt pool_opts_l
472%type	<v.tagged>		tagged
473%type	<v.rtableid>		rtable
474%%
475
476ruleset		: /* empty */
477		| ruleset '\n'
478		| ruleset option '\n'
479		| ruleset scrubrule '\n'
480		| ruleset natrule '\n'
481		| ruleset binatrule '\n'
482		| ruleset pfrule '\n'
483		| ruleset anchorrule '\n'
484		| ruleset loadrule '\n'
485		| ruleset altqif '\n'
486		| ruleset queuespec '\n'
487		| ruleset varset '\n'
488		| ruleset antispoof '\n'
489		| ruleset tabledef '\n'
490		| '{' fakeanchor '}' '\n';
491		| ruleset error '\n'		{ errors++; }
492		;
493
494/*
495 * apply to previouslys specified rule: must be careful to note
496 * what that is: pf or nat or binat or rdr
497 */
498fakeanchor	: fakeanchor '\n'
499		| fakeanchor anchorrule '\n'
500		| fakeanchor binatrule '\n'
501		| fakeanchor natrule '\n'
502		| fakeanchor pfrule '\n'
503		| fakeanchor error '\n'
504		;
505
506optimizer	: string	{
507			if (!strcmp($1, "none"))
508				$$ = 0;
509			else if (!strcmp($1, "basic"))
510				$$ = PF_OPTIMIZE_BASIC;
511			else if (!strcmp($1, "profile"))
512				$$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE;
513			else {
514				yyerror("unknown ruleset-optimization %s", $$);
515				YYERROR;
516			}
517		}
518		;
519
520option		: SET OPTIMIZATION STRING		{
521			if (check_rulestate(PFCTL_STATE_OPTION)) {
522				free($3);
523				YYERROR;
524			}
525			if (pfctl_set_optimization(pf, $3) != 0) {
526				yyerror("unknown optimization %s", $3);
527				free($3);
528				YYERROR;
529			}
530			free($3);
531		}
532		| SET RULESET_OPTIMIZATION optimizer {
533			if (!(pf->opts & PF_OPT_OPTIMIZE)) {
534				pf->opts |= PF_OPT_OPTIMIZE;
535				pf->optimize = $3;
536			}
537		}
538		| SET TIMEOUT timeout_spec
539		| SET TIMEOUT '{' timeout_list '}'
540		| SET LIMIT limit_spec
541		| SET LIMIT '{' limit_list '}'
542		| SET LOGINTERFACE STRING		{
543			if (check_rulestate(PFCTL_STATE_OPTION)) {
544				free($3);
545				YYERROR;
546			}
547			if (pfctl_set_logif(pf, $3) != 0) {
548				yyerror("error setting loginterface %s", $3);
549				free($3);
550				YYERROR;
551			}
552			free($3);
553		}
554		| SET HOSTID number {
555			if ($3 == 0) {
556				yyerror("hostid must be non-zero");
557				YYERROR;
558			}
559			if (pfctl_set_hostid(pf, $3) != 0) {
560				yyerror("error setting hostid %08x", $3);
561				YYERROR;
562			}
563		}
564		| SET BLOCKPOLICY DROP	{
565			if (pf->opts & PF_OPT_VERBOSE)
566				printf("set block-policy drop\n");
567			if (check_rulestate(PFCTL_STATE_OPTION))
568				YYERROR;
569			blockpolicy = PFRULE_DROP;
570		}
571		| SET BLOCKPOLICY RETURN {
572			if (pf->opts & PF_OPT_VERBOSE)
573				printf("set block-policy return\n");
574			if (check_rulestate(PFCTL_STATE_OPTION))
575				YYERROR;
576			blockpolicy = PFRULE_RETURN;
577		}
578		| SET REQUIREORDER yesno {
579			if (pf->opts & PF_OPT_VERBOSE)
580				printf("set require-order %s\n",
581				    $3 == 1 ? "yes" : "no");
582			require_order = $3;
583		}
584		| SET FINGERPRINTS STRING {
585			if (pf->opts & PF_OPT_VERBOSE)
586				printf("set fingerprints \"%s\"\n", $3);
587			if (check_rulestate(PFCTL_STATE_OPTION)) {
588				free($3);
589				YYERROR;
590			}
591			if (!pf->anchor->name[0]) {
592				if (pfctl_file_fingerprints(pf->dev,
593				    pf->opts, $3)) {
594					yyerror("error loading "
595					    "fingerprints %s", $3);
596					free($3);
597					YYERROR;
598				}
599			}
600			free($3);
601		}
602		| SET STATEPOLICY statelock {
603			if (pf->opts & PF_OPT_VERBOSE)
604				switch ($3) {
605				case 0:
606					printf("set state-policy floating\n");
607					break;
608				case PFRULE_IFBOUND:
609					printf("set state-policy if-bound\n");
610					break;
611				}
612			default_statelock = $3;
613		}
614		| SET DEBUG STRING {
615			if (check_rulestate(PFCTL_STATE_OPTION)) {
616				free($3);
617				YYERROR;
618			}
619			if (pfctl_set_debug(pf, $3) != 0) {
620				yyerror("error setting debuglevel %s", $3);
621				free($3);
622				YYERROR;
623			}
624			free($3);
625		}
626		| SET SKIP interface {
627			if (expand_skip_interface($3) != 0) {
628				yyerror("error setting skip interface(s)");
629				YYERROR;
630			}
631		}
632		;
633
634string		: string STRING				{
635			if (asprintf(&$$, "%s %s", $1, $2) == -1)
636				err(1, "string: asprintf");
637			free($1);
638			free($2);
639		}
640		| STRING
641		;
642
643varset		: STRING '=' string		{
644			if (pf->opts & PF_OPT_VERBOSE)
645				printf("%s = \"%s\"\n", $1, $3);
646			if (symset($1, $3, 0) == -1)
647				err(1, "cannot store variable %s", $1);
648			free($1);
649			free($3);
650		}
651		;
652
653anchorname	: STRING			{ $$ = $1; }
654		| /* empty */			{ $$ = NULL; }
655		;
656
657optnl		: optnl '\n'
658		|
659		;
660
661pfa_anchorlist	: pfrule optnl
662		| anchorrule optnl
663		| pfa_anchorlist pfrule optnl
664		| pfa_anchorlist anchorrule optnl
665		;
666
667pfa_anchor	: '{'
668		{
669			char ta[PF_ANCHOR_NAME_SIZE];
670			struct pf_ruleset *rs;
671
672			/* steping into a brace anchor */
673			pf->asd++;
674			pf->bn++;
675			pf->brace = 1;
676
677			/* create a holding ruleset in the root */
678			snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn);
679			rs = pf_find_or_create_ruleset(ta);
680			if (rs == NULL)
681				err(1, "pfa_anchor: pf_find_or_create_ruleset");
682			pf->astack[pf->asd] = rs->anchor;
683			pf->anchor = rs->anchor;
684		} '\n' pfa_anchorlist '}'
685		{
686			pf->alast = pf->anchor;
687			pf->asd--;
688			pf->anchor = pf->astack[pf->asd];
689		}
690		| /* empty */
691		;
692
693anchorrule	: ANCHOR anchorname dir quick interface af proto fromto
694		    filter_opts pfa_anchor
695		{
696			struct pf_rule	r;
697
698			if (check_rulestate(PFCTL_STATE_FILTER)) {
699				if ($2)
700					free($2);
701				YYERROR;
702			}
703
704			if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) {
705				free($2);
706				yyerror("anchor names beginning with '_' "
707				    "are reserved for internal use");
708				YYERROR;
709			}
710
711			memset(&r, 0, sizeof(r));
712			if (pf->astack[pf->asd + 1]) {
713				/* move inline rules into relative location */
714				pf_anchor_setup(&r,
715				    &pf->astack[pf->asd]->ruleset,
716				    $2 ? $2 : pf->alast->name);
717
718				if (r.anchor == NULL)
719					err(1, "anchorrule: unable to "
720					    "create ruleset");
721
722				if (pf->alast != r.anchor) {
723					if (r.anchor->match) {
724						yyerror("inline anchor '%s' "
725						    "already exists",
726						    r.anchor->name);
727						YYERROR;
728					}
729					mv_rules(&pf->alast->ruleset,
730					    &r.anchor->ruleset);
731				}
732				pf_remove_if_empty_ruleset(&pf->alast->ruleset);
733				pf->alast = r.anchor;
734			} else {
735				if (!$2) {
736					yyerror("anchors without explicit "
737					    "rules must specify a name");
738					YYERROR;
739				}
740			}
741			r.direction = $3;
742			r.quick = $4.quick;
743			r.af = $6;
744			r.prob = $9.prob;
745			r.rtableid = $9.rtableid;
746
747			if ($9.match_tag)
748				if (strlcpy(r.match_tagname, $9.match_tag,
749				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
750					yyerror("tag too long, max %u chars",
751					    PF_TAG_NAME_SIZE - 1);
752					YYERROR;
753				}
754			r.match_tag_not = $9.match_tag_not;
755
756			decide_address_family($8.src.host, &r.af);
757			decide_address_family($8.dst.host, &r.af);
758
759			expand_rule(&r, $5, NULL, $7, $8.src_os,
760			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
761			    0, 0, 0, pf->astack[pf->asd + 1] ?
762			    pf->alast->name : $2);
763			free($2);
764			pf->astack[pf->asd + 1] = NULL;
765		}
766		| NATANCHOR string interface af proto fromto rtable {
767			struct pf_rule	r;
768
769			if (check_rulestate(PFCTL_STATE_NAT)) {
770				free($2);
771				YYERROR;
772			}
773
774			memset(&r, 0, sizeof(r));
775			r.action = PF_NAT;
776			r.af = $4;
777			r.rtableid = $7;
778
779			decide_address_family($6.src.host, &r.af);
780			decide_address_family($6.dst.host, &r.af);
781
782			expand_rule(&r, $3, NULL, $5, $6.src_os,
783			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
784			    0, 0, 0, $2);
785			free($2);
786		}
787		| RDRANCHOR string interface af proto fromto rtable {
788			struct pf_rule	r;
789
790			if (check_rulestate(PFCTL_STATE_NAT)) {
791				free($2);
792				YYERROR;
793			}
794
795			memset(&r, 0, sizeof(r));
796			r.action = PF_RDR;
797			r.af = $4;
798			r.rtableid = $7;
799
800			decide_address_family($6.src.host, &r.af);
801			decide_address_family($6.dst.host, &r.af);
802
803			if ($6.src.port != NULL) {
804				yyerror("source port parameter not supported"
805				    " in rdr-anchor");
806				YYERROR;
807			}
808			if ($6.dst.port != NULL) {
809				if ($6.dst.port->next != NULL) {
810					yyerror("destination port list "
811					    "expansion not supported in "
812					    "rdr-anchor");
813					YYERROR;
814				} else if ($6.dst.port->op != PF_OP_EQ) {
815					yyerror("destination port operators"
816					    " not supported in rdr-anchor");
817					YYERROR;
818				}
819				r.dst.port[0] = $6.dst.port->port[0];
820				r.dst.port[1] = $6.dst.port->port[1];
821				r.dst.port_op = $6.dst.port->op;
822			}
823
824			expand_rule(&r, $3, NULL, $5, $6.src_os,
825			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
826			    0, 0, 0, $2);
827			free($2);
828		}
829		| BINATANCHOR string interface af proto fromto rtable {
830			struct pf_rule	r;
831
832			if (check_rulestate(PFCTL_STATE_NAT)) {
833				free($2);
834				YYERROR;
835			}
836
837			memset(&r, 0, sizeof(r));
838			r.action = PF_BINAT;
839			r.af = $4;
840			r.rtableid = $7;
841			if ($5 != NULL) {
842				if ($5->next != NULL) {
843					yyerror("proto list expansion"
844					    " not supported in binat-anchor");
845					YYERROR;
846				}
847				r.proto = $5->proto;
848				free($5);
849			}
850
851			if ($6.src.host != NULL || $6.src.port != NULL ||
852			    $6.dst.host != NULL || $6.dst.port != NULL) {
853				yyerror("fromto parameter not supported"
854				    " in binat-anchor");
855				YYERROR;
856			}
857
858			decide_address_family($6.src.host, &r.af);
859			decide_address_family($6.dst.host, &r.af);
860
861			pfctl_add_rule(pf, &r, $2);
862			free($2);
863		}
864		;
865
866loadrule	: LOAD ANCHOR string FROM string	{
867			struct loadanchors	*loadanchor;
868
869			if (strlen(pf->anchor->name) + 1 +
870			    strlen($3) >= MAXPATHLEN) {
871				yyerror("anchorname %s too long, max %u\n",
872				    $3, MAXPATHLEN - 1);
873				free($3);
874				YYERROR;
875			}
876			loadanchor = calloc(1, sizeof(struct loadanchors));
877			if (loadanchor == NULL)
878				err(1, "loadrule: calloc");
879			if ((loadanchor->anchorname = malloc(MAXPATHLEN)) ==
880			    NULL)
881				err(1, "loadrule: malloc");
882			if (pf->anchor->name[0])
883				snprintf(loadanchor->anchorname, MAXPATHLEN,
884				    "%s/%s", pf->anchor->name, $3);
885			else
886				strlcpy(loadanchor->anchorname, $3, MAXPATHLEN);
887			if ((loadanchor->filename = strdup($5)) == NULL)
888				err(1, "loadrule: strdup");
889
890			TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
891			    entries);
892
893			free($3);
894			free($5);
895		};
896
897scrubaction	: no SCRUB {
898			$$.b2 = $$.w = 0;
899			if ($1)
900				$$.b1 = PF_NOSCRUB;
901			else
902				$$.b1 = PF_SCRUB;
903		}
904		;
905
906scrubrule	: scrubaction dir logquick interface af proto fromto scrub_opts
907		{
908			struct pf_rule	r;
909
910			if (check_rulestate(PFCTL_STATE_SCRUB))
911				YYERROR;
912
913			memset(&r, 0, sizeof(r));
914
915			r.action = $1.b1;
916			r.direction = $2;
917
918			r.log = $3.log;
919			r.logif = $3.logif;
920			if ($3.quick) {
921				yyerror("scrub rules do not support 'quick'");
922				YYERROR;
923			}
924
925			r.af = $5;
926			if ($8.nodf)
927				r.rule_flag |= PFRULE_NODF;
928			if ($8.randomid)
929				r.rule_flag |= PFRULE_RANDOMID;
930			if ($8.reassemble_tcp) {
931				if (r.direction != PF_INOUT) {
932					yyerror("reassemble tcp rules can not "
933					    "specify direction");
934					YYERROR;
935				}
936				r.rule_flag |= PFRULE_REASSEMBLE_TCP;
937			}
938			if ($8.minttl)
939				r.min_ttl = $8.minttl;
940			if ($8.maxmss)
941				r.max_mss = $8.maxmss;
942			if ($8.fragcache)
943				r.rule_flag |= $8.fragcache;
944			r.rtableid = $8.rtableid;
945
946			expand_rule(&r, $4, NULL, $6, $7.src_os,
947			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
948			    NULL, NULL, NULL, "");
949		}
950		;
951
952scrub_opts	:	{
953				bzero(&scrub_opts, sizeof scrub_opts);
954				scrub_opts.rtableid = -1;
955			}
956		    scrub_opts_l
957			{ $$ = scrub_opts; }
958		| /* empty */ {
959			bzero(&scrub_opts, sizeof scrub_opts);
960			scrub_opts.rtableid = -1;
961			$$ = scrub_opts;
962		}
963		;
964
965scrub_opts_l	: scrub_opts_l scrub_opt
966		| scrub_opt
967		;
968
969scrub_opt	: NODF	{
970			if (scrub_opts.nodf) {
971				yyerror("no-df cannot be respecified");
972				YYERROR;
973			}
974			scrub_opts.nodf = 1;
975		}
976		| MINTTL number {
977			if (scrub_opts.marker & SOM_MINTTL) {
978				yyerror("min-ttl cannot be respecified");
979				YYERROR;
980			}
981			if ($2 > 255) {
982				yyerror("illegal min-ttl value %d", $2);
983				YYERROR;
984			}
985			scrub_opts.marker |= SOM_MINTTL;
986			scrub_opts.minttl = $2;
987		}
988		| MAXMSS number {
989			if (scrub_opts.marker & SOM_MAXMSS) {
990				yyerror("max-mss cannot be respecified");
991				YYERROR;
992			}
993			if ($2 > 65535) {
994				yyerror("illegal max-mss value %d", $2);
995				YYERROR;
996			}
997			scrub_opts.marker |= SOM_MAXMSS;
998			scrub_opts.maxmss = $2;
999		}
1000		| fragcache {
1001			if (scrub_opts.marker & SOM_FRAGCACHE) {
1002				yyerror("fragcache cannot be respecified");
1003				YYERROR;
1004			}
1005			scrub_opts.marker |= SOM_FRAGCACHE;
1006			scrub_opts.fragcache = $1;
1007		}
1008		| REASSEMBLE STRING {
1009			if (strcasecmp($2, "tcp") != 0) {
1010				yyerror("scrub reassemble supports only tcp, "
1011				    "not '%s'", $2);
1012				free($2);
1013				YYERROR;
1014			}
1015			free($2);
1016			if (scrub_opts.reassemble_tcp) {
1017				yyerror("reassemble tcp cannot be respecified");
1018				YYERROR;
1019			}
1020			scrub_opts.reassemble_tcp = 1;
1021		}
1022		| RANDOMID {
1023			if (scrub_opts.randomid) {
1024				yyerror("random-id cannot be respecified");
1025				YYERROR;
1026			}
1027			scrub_opts.randomid = 1;
1028		}
1029		| RTABLE number				{
1030#ifndef __FreeBSD__
1031			if ($2 > RT_TABLEID_MAX || $2 < 0) {
1032				yyerror("invalid rtable id");
1033				YYERROR;
1034			}
1035#endif
1036			scrub_opts.rtableid = $2;
1037		}
1038		;
1039
1040fragcache	: FRAGMENT REASSEMBLE	{ $$ = 0; /* default */ }
1041		| FRAGMENT FRAGCROP	{ $$ = PFRULE_FRAGCROP; }
1042		| FRAGMENT FRAGDROP	{ $$ = PFRULE_FRAGDROP; }
1043		;
1044
1045antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
1046			struct pf_rule		 r;
1047			struct node_host	*h = NULL, *hh;
1048			struct node_if		*i, *j;
1049
1050			if (check_rulestate(PFCTL_STATE_FILTER))
1051				YYERROR;
1052
1053			for (i = $3; i; i = i->next) {
1054				bzero(&r, sizeof(r));
1055
1056				r.action = PF_DROP;
1057				r.direction = PF_IN;
1058				r.log = $2.log;
1059				r.logif = $2.logif;
1060				r.quick = $2.quick;
1061				r.af = $4;
1062				if (rule_label(&r, $5.label))
1063					YYERROR;
1064				r.rtableid = $5.rtableid;
1065				j = calloc(1, sizeof(struct node_if));
1066				if (j == NULL)
1067					err(1, "antispoof: calloc");
1068				if (strlcpy(j->ifname, i->ifname,
1069				    sizeof(j->ifname)) >= sizeof(j->ifname)) {
1070					free(j);
1071					yyerror("interface name too long");
1072					YYERROR;
1073				}
1074				j->not = 1;
1075				if (i->dynamic) {
1076					h = calloc(1, sizeof(*h));
1077					if (h == NULL)
1078						err(1, "address: calloc");
1079					h->addr.type = PF_ADDR_DYNIFTL;
1080					set_ipmask(h, 128);
1081					if (strlcpy(h->addr.v.ifname, i->ifname,
1082					    sizeof(h->addr.v.ifname)) >=
1083					    sizeof(h->addr.v.ifname)) {
1084						free(h);
1085						yyerror(
1086						    "interface name too long");
1087						YYERROR;
1088					}
1089					hh = malloc(sizeof(*hh));
1090					if (hh == NULL)
1091						 err(1, "address: malloc");
1092					bcopy(h, hh, sizeof(*hh));
1093					h->addr.iflags = PFI_AFLAG_NETWORK;
1094				} else {
1095					h = ifa_lookup(j->ifname,
1096					    PFI_AFLAG_NETWORK);
1097					hh = NULL;
1098				}
1099
1100				if (h != NULL)
1101					expand_rule(&r, j, NULL, NULL, NULL, h,
1102					    NULL, NULL, NULL, NULL, NULL,
1103					    NULL, "");
1104
1105				if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
1106					bzero(&r, sizeof(r));
1107
1108					r.action = PF_DROP;
1109					r.direction = PF_IN;
1110					r.log = $2.log;
1111					r.quick = $2.quick;
1112					r.af = $4;
1113					if (rule_label(&r, $5.label))
1114						YYERROR;
1115					r.rtableid = $5.rtableid;
1116					if (hh != NULL)
1117						h = hh;
1118					else
1119						h = ifa_lookup(i->ifname, 0);
1120					if (h != NULL)
1121						expand_rule(&r, NULL, NULL,
1122						    NULL, NULL, h, NULL, NULL,
1123						    NULL, NULL, NULL, NULL, "");
1124				} else
1125					free(hh);
1126			}
1127			free($5.label);
1128		}
1129		;
1130
1131antispoof_ifspc	: FOR antispoof_if		{ $$ = $2; }
1132		| FOR '{' antispoof_iflst '}'	{ $$ = $3; }
1133		;
1134
1135antispoof_iflst	: antispoof_if				{ $$ = $1; }
1136		| antispoof_iflst comma antispoof_if	{
1137			$1->tail->next = $3;
1138			$1->tail = $3;
1139			$$ = $1;
1140		}
1141		;
1142
1143antispoof_if  : if_item				{ $$ = $1; }
1144		| '(' if_item ')'		{
1145			$2->dynamic = 1;
1146			$$ = $2;
1147		}
1148		;
1149
1150antispoof_opts	:	{
1151				bzero(&antispoof_opts, sizeof antispoof_opts);
1152				antispoof_opts.rtableid = -1;
1153			}
1154		    antispoof_opts_l
1155			{ $$ = antispoof_opts; }
1156		| /* empty */	{
1157			bzero(&antispoof_opts, sizeof antispoof_opts);
1158			antispoof_opts.rtableid = -1;
1159			$$ = antispoof_opts;
1160		}
1161		;
1162
1163antispoof_opts_l	: antispoof_opts_l antispoof_opt
1164			| antispoof_opt
1165			;
1166
1167antispoof_opt	: label	{
1168			if (antispoof_opts.label) {
1169				yyerror("label cannot be redefined");
1170				YYERROR;
1171			}
1172			antispoof_opts.label = $1;
1173		}
1174		| RTABLE number				{
1175#ifndef __FreeBSD__
1176			if ($2 > RT_TABLEID_MAX || $2 < 0) {
1177				yyerror("invalid rtable id");
1178				YYERROR;
1179			}
1180#endif
1181			antispoof_opts.rtableid = $2;
1182		}
1183		;
1184
1185not		: '!'		{ $$ = 1; }
1186		| /* empty */	{ $$ = 0; }
1187		;
1188
1189tabledef	: TABLE '<' STRING '>' table_opts {
1190			struct node_host	 *h, *nh;
1191			struct node_tinit	 *ti, *nti;
1192
1193			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
1194				yyerror("table name too long, max %d chars",
1195				    PF_TABLE_NAME_SIZE - 1);
1196				free($3);
1197				YYERROR;
1198			}
1199			if (pf->loadopt & PFCTL_FLAG_TABLE)
1200				if (process_tabledef($3, &$5)) {
1201					free($3);
1202					YYERROR;
1203				}
1204			free($3);
1205			for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
1206			    ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
1207				if (ti->file)
1208					free(ti->file);
1209				for (h = ti->host; h != NULL; h = nh) {
1210					nh = h->next;
1211					free(h);
1212				}
1213				nti = SIMPLEQ_NEXT(ti, entries);
1214				free(ti);
1215			}
1216		}
1217		;
1218
1219table_opts	:	{
1220			bzero(&table_opts, sizeof table_opts);
1221			SIMPLEQ_INIT(&table_opts.init_nodes);
1222		}
1223		    table_opts_l
1224			{ $$ = table_opts; }
1225		| /* empty */
1226			{
1227			bzero(&table_opts, sizeof table_opts);
1228			SIMPLEQ_INIT(&table_opts.init_nodes);
1229			$$ = table_opts;
1230		}
1231		;
1232
1233table_opts_l	: table_opts_l table_opt
1234		| table_opt
1235		;
1236
1237table_opt	: STRING		{
1238			if (!strcmp($1, "const"))
1239				table_opts.flags |= PFR_TFLAG_CONST;
1240			else if (!strcmp($1, "persist"))
1241				table_opts.flags |= PFR_TFLAG_PERSIST;
1242			else {
1243				yyerror("invalid table option '%s'", $1);
1244				free($1);
1245				YYERROR;
1246			}
1247			free($1);
1248		}
1249		| '{' '}'		{ table_opts.init_addr = 1; }
1250		| '{' host_list '}'	{
1251			struct node_host	*n;
1252			struct node_tinit	*ti;
1253
1254			for (n = $2; n != NULL; n = n->next) {
1255				switch (n->addr.type) {
1256				case PF_ADDR_ADDRMASK:
1257					continue; /* ok */
1258				case PF_ADDR_DYNIFTL:
1259					yyerror("dynamic addresses are not "
1260					    "permitted inside tables");
1261					break;
1262				case PF_ADDR_TABLE:
1263					yyerror("tables cannot contain tables");
1264					break;
1265				case PF_ADDR_NOROUTE:
1266					yyerror("\"no-route\" is not permitted "
1267					    "inside tables");
1268					break;
1269				case PF_ADDR_URPFFAILED:
1270					yyerror("\"urpf-failed\" is not "
1271					    "permitted inside tables");
1272					break;
1273				default:
1274					yyerror("unknown address type %d",
1275					    n->addr.type);
1276				}
1277				YYERROR;
1278			}
1279			if (!(ti = calloc(1, sizeof(*ti))))
1280				err(1, "table_opt: calloc");
1281			ti->host = $2;
1282			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1283			    entries);
1284			table_opts.init_addr = 1;
1285		}
1286		| FILENAME STRING	{
1287			struct node_tinit	*ti;
1288
1289			if (!(ti = calloc(1, sizeof(*ti))))
1290				err(1, "table_opt: calloc");
1291			ti->file = $2;
1292			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1293			    entries);
1294			table_opts.init_addr = 1;
1295		}
1296		;
1297
1298altqif		: ALTQ interface queue_opts QUEUE qassign {
1299			struct pf_altq	a;
1300
1301			if (check_rulestate(PFCTL_STATE_QUEUE))
1302				YYERROR;
1303
1304			memset(&a, 0, sizeof(a));
1305			if ($3.scheduler.qtype == ALTQT_NONE) {
1306				yyerror("no scheduler specified!");
1307				YYERROR;
1308			}
1309			a.scheduler = $3.scheduler.qtype;
1310			a.qlimit = $3.qlimit;
1311			a.tbrsize = $3.tbrsize;
1312			if ($5 == NULL) {
1313				yyerror("no child queues specified");
1314				YYERROR;
1315			}
1316			if (expand_altq(&a, $2, $5, $3.queue_bwspec,
1317			    &$3.scheduler))
1318				YYERROR;
1319		}
1320		;
1321
1322queuespec	: QUEUE STRING interface queue_opts qassign {
1323			struct pf_altq	a;
1324
1325			if (check_rulestate(PFCTL_STATE_QUEUE)) {
1326				free($2);
1327				YYERROR;
1328			}
1329
1330			memset(&a, 0, sizeof(a));
1331
1332			if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
1333			    sizeof(a.qname)) {
1334				yyerror("queue name too long (max "
1335				    "%d chars)", PF_QNAME_SIZE-1);
1336				free($2);
1337				YYERROR;
1338			}
1339			free($2);
1340			if ($4.tbrsize) {
1341				yyerror("cannot specify tbrsize for queue");
1342				YYERROR;
1343			}
1344			if ($4.priority > 255) {
1345				yyerror("priority out of range: max 255");
1346				YYERROR;
1347			}
1348			a.priority = $4.priority;
1349			a.qlimit = $4.qlimit;
1350			a.scheduler = $4.scheduler.qtype;
1351			if (expand_queue(&a, $3, $5, $4.queue_bwspec,
1352			    &$4.scheduler)) {
1353				yyerror("errors in queue definition");
1354				YYERROR;
1355			}
1356		}
1357		;
1358
1359queue_opts	:	{
1360			bzero(&queue_opts, sizeof queue_opts);
1361			queue_opts.priority = DEFAULT_PRIORITY;
1362			queue_opts.qlimit = DEFAULT_QLIMIT;
1363			queue_opts.scheduler.qtype = ALTQT_NONE;
1364			queue_opts.queue_bwspec.bw_percent = 100;
1365		}
1366		    queue_opts_l
1367			{ $$ = queue_opts; }
1368		| /* empty */ {
1369			bzero(&queue_opts, sizeof queue_opts);
1370			queue_opts.priority = DEFAULT_PRIORITY;
1371			queue_opts.qlimit = DEFAULT_QLIMIT;
1372			queue_opts.scheduler.qtype = ALTQT_NONE;
1373			queue_opts.queue_bwspec.bw_percent = 100;
1374			$$ = queue_opts;
1375		}
1376		;
1377
1378queue_opts_l	: queue_opts_l queue_opt
1379		| queue_opt
1380		;
1381
1382queue_opt	: BANDWIDTH bandwidth	{
1383			if (queue_opts.marker & QOM_BWSPEC) {
1384				yyerror("bandwidth cannot be respecified");
1385				YYERROR;
1386			}
1387			queue_opts.marker |= QOM_BWSPEC;
1388			queue_opts.queue_bwspec = $2;
1389		}
1390		| PRIORITY number	{
1391			if (queue_opts.marker & QOM_PRIORITY) {
1392				yyerror("priority cannot be respecified");
1393				YYERROR;
1394			}
1395			if ($2 > 255) {
1396				yyerror("priority out of range: max 255");
1397				YYERROR;
1398			}
1399			queue_opts.marker |= QOM_PRIORITY;
1400			queue_opts.priority = $2;
1401		}
1402		| QLIMIT number	{
1403			if (queue_opts.marker & QOM_QLIMIT) {
1404				yyerror("qlimit cannot be respecified");
1405				YYERROR;
1406			}
1407			if ($2 > 65535) {
1408				yyerror("qlimit out of range: max 65535");
1409				YYERROR;
1410			}
1411			queue_opts.marker |= QOM_QLIMIT;
1412			queue_opts.qlimit = $2;
1413		}
1414		| scheduler	{
1415			if (queue_opts.marker & QOM_SCHEDULER) {
1416				yyerror("scheduler cannot be respecified");
1417				YYERROR;
1418			}
1419			queue_opts.marker |= QOM_SCHEDULER;
1420			queue_opts.scheduler = $1;
1421		}
1422		| TBRSIZE number	{
1423			if (queue_opts.marker & QOM_TBRSIZE) {
1424				yyerror("tbrsize cannot be respecified");
1425				YYERROR;
1426			}
1427			if ($2 > 65535) {
1428				yyerror("tbrsize too big: max 65535");
1429				YYERROR;
1430			}
1431			queue_opts.marker |= QOM_TBRSIZE;
1432			queue_opts.tbrsize = $2;
1433		}
1434		;
1435
1436bandwidth	: STRING {
1437			double	 bps;
1438			char	*cp;
1439
1440			$$.bw_percent = 0;
1441
1442			bps = strtod($1, &cp);
1443			if (cp != NULL) {
1444				if (!strcmp(cp, "b"))
1445					; /* nothing */
1446				else if (!strcmp(cp, "Kb"))
1447					bps *= 1000;
1448				else if (!strcmp(cp, "Mb"))
1449					bps *= 1000 * 1000;
1450				else if (!strcmp(cp, "Gb"))
1451					bps *= 1000 * 1000 * 1000;
1452				else if (!strcmp(cp, "%")) {
1453					if (bps < 0 || bps > 100) {
1454						yyerror("bandwidth spec "
1455						    "out of range");
1456						free($1);
1457						YYERROR;
1458					}
1459					$$.bw_percent = bps;
1460					bps = 0;
1461				} else {
1462					yyerror("unknown unit %s", cp);
1463					free($1);
1464					YYERROR;
1465				}
1466			}
1467			free($1);
1468			$$.bw_absolute = (u_int32_t)bps;
1469		}
1470		;
1471
1472scheduler	: CBQ				{
1473			$$.qtype = ALTQT_CBQ;
1474			$$.data.cbq_opts.flags = 0;
1475		}
1476		| CBQ '(' cbqflags_list ')'	{
1477			$$.qtype = ALTQT_CBQ;
1478			$$.data.cbq_opts.flags = $3;
1479		}
1480		| PRIQ				{
1481			$$.qtype = ALTQT_PRIQ;
1482			$$.data.priq_opts.flags = 0;
1483		}
1484		| PRIQ '(' priqflags_list ')'	{
1485			$$.qtype = ALTQT_PRIQ;
1486			$$.data.priq_opts.flags = $3;
1487		}
1488		| HFSC				{
1489			$$.qtype = ALTQT_HFSC;
1490			bzero(&$$.data.hfsc_opts,
1491			    sizeof(struct node_hfsc_opts));
1492		}
1493		| HFSC '(' hfsc_opts ')'	{
1494			$$.qtype = ALTQT_HFSC;
1495			$$.data.hfsc_opts = $3;
1496		}
1497		;
1498
1499cbqflags_list	: cbqflags_item				{ $$ |= $1; }
1500		| cbqflags_list comma cbqflags_item	{ $$ |= $3; }
1501		;
1502
1503cbqflags_item	: STRING	{
1504			if (!strcmp($1, "default"))
1505				$$ = CBQCLF_DEFCLASS;
1506			else if (!strcmp($1, "borrow"))
1507				$$ = CBQCLF_BORROW;
1508			else if (!strcmp($1, "red"))
1509				$$ = CBQCLF_RED;
1510			else if (!strcmp($1, "ecn"))
1511				$$ = CBQCLF_RED|CBQCLF_ECN;
1512			else if (!strcmp($1, "rio"))
1513				$$ = CBQCLF_RIO;
1514			else {
1515				yyerror("unknown cbq flag \"%s\"", $1);
1516				free($1);
1517				YYERROR;
1518			}
1519			free($1);
1520		}
1521		;
1522
1523priqflags_list	: priqflags_item			{ $$ |= $1; }
1524		| priqflags_list comma priqflags_item	{ $$ |= $3; }
1525		;
1526
1527priqflags_item	: STRING	{
1528			if (!strcmp($1, "default"))
1529				$$ = PRCF_DEFAULTCLASS;
1530			else if (!strcmp($1, "red"))
1531				$$ = PRCF_RED;
1532			else if (!strcmp($1, "ecn"))
1533				$$ = PRCF_RED|PRCF_ECN;
1534			else if (!strcmp($1, "rio"))
1535				$$ = PRCF_RIO;
1536			else {
1537				yyerror("unknown priq flag \"%s\"", $1);
1538				free($1);
1539				YYERROR;
1540			}
1541			free($1);
1542		}
1543		;
1544
1545hfsc_opts	:	{
1546				bzero(&hfsc_opts,
1547				    sizeof(struct node_hfsc_opts));
1548			}
1549		    hfscopts_list				{
1550			$$ = hfsc_opts;
1551		}
1552		;
1553
1554hfscopts_list	: hfscopts_item
1555		| hfscopts_list comma hfscopts_item
1556		;
1557
1558hfscopts_item	: LINKSHARE bandwidth				{
1559			if (hfsc_opts.linkshare.used) {
1560				yyerror("linkshare already specified");
1561				YYERROR;
1562			}
1563			hfsc_opts.linkshare.m2 = $2;
1564			hfsc_opts.linkshare.used = 1;
1565		}
1566		| LINKSHARE '(' bandwidth comma number comma bandwidth ')'
1567		    {
1568			if (hfsc_opts.linkshare.used) {
1569				yyerror("linkshare already specified");
1570				YYERROR;
1571			}
1572			hfsc_opts.linkshare.m1 = $3;
1573			hfsc_opts.linkshare.d = $5;
1574			hfsc_opts.linkshare.m2 = $7;
1575			hfsc_opts.linkshare.used = 1;
1576		}
1577		| REALTIME bandwidth				{
1578			if (hfsc_opts.realtime.used) {
1579				yyerror("realtime already specified");
1580				YYERROR;
1581			}
1582			hfsc_opts.realtime.m2 = $2;
1583			hfsc_opts.realtime.used = 1;
1584		}
1585		| REALTIME '(' bandwidth comma number comma bandwidth ')'
1586		    {
1587			if (hfsc_opts.realtime.used) {
1588				yyerror("realtime already specified");
1589				YYERROR;
1590			}
1591			hfsc_opts.realtime.m1 = $3;
1592			hfsc_opts.realtime.d = $5;
1593			hfsc_opts.realtime.m2 = $7;
1594			hfsc_opts.realtime.used = 1;
1595		}
1596		| UPPERLIMIT bandwidth				{
1597			if (hfsc_opts.upperlimit.used) {
1598				yyerror("upperlimit already specified");
1599				YYERROR;
1600			}
1601			hfsc_opts.upperlimit.m2 = $2;
1602			hfsc_opts.upperlimit.used = 1;
1603		}
1604		| UPPERLIMIT '(' bandwidth comma number comma bandwidth ')'
1605		    {
1606			if (hfsc_opts.upperlimit.used) {
1607				yyerror("upperlimit already specified");
1608				YYERROR;
1609			}
1610			hfsc_opts.upperlimit.m1 = $3;
1611			hfsc_opts.upperlimit.d = $5;
1612			hfsc_opts.upperlimit.m2 = $7;
1613			hfsc_opts.upperlimit.used = 1;
1614		}
1615		| STRING	{
1616			if (!strcmp($1, "default"))
1617				hfsc_opts.flags |= HFCF_DEFAULTCLASS;
1618			else if (!strcmp($1, "red"))
1619				hfsc_opts.flags |= HFCF_RED;
1620			else if (!strcmp($1, "ecn"))
1621				hfsc_opts.flags |= HFCF_RED|HFCF_ECN;
1622			else if (!strcmp($1, "rio"))
1623				hfsc_opts.flags |= HFCF_RIO;
1624			else {
1625				yyerror("unknown hfsc flag \"%s\"", $1);
1626				free($1);
1627				YYERROR;
1628			}
1629			free($1);
1630		}
1631		;
1632
1633qassign		: /* empty */		{ $$ = NULL; }
1634		| qassign_item		{ $$ = $1; }
1635		| '{' qassign_list '}'	{ $$ = $2; }
1636		;
1637
1638qassign_list	: qassign_item			{ $$ = $1; }
1639		| qassign_list comma qassign_item	{
1640			$1->tail->next = $3;
1641			$1->tail = $3;
1642			$$ = $1;
1643		}
1644		;
1645
1646qassign_item	: STRING			{
1647			$$ = calloc(1, sizeof(struct node_queue));
1648			if ($$ == NULL)
1649				err(1, "qassign_item: calloc");
1650			if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
1651			    sizeof($$->queue)) {
1652				yyerror("queue name '%s' too long (max "
1653				    "%d chars)", $1, sizeof($$->queue)-1);
1654				free($1);
1655				free($$);
1656				YYERROR;
1657			}
1658			free($1);
1659			$$->next = NULL;
1660			$$->tail = $$;
1661		}
1662		;
1663
1664pfrule		: action dir logquick interface route af proto fromto
1665		    filter_opts
1666		{
1667			struct pf_rule		 r;
1668			struct node_state_opt	*o;
1669			struct node_proto	*proto;
1670			int			 srctrack = 0;
1671			int			 statelock = 0;
1672			int			 adaptive = 0;
1673
1674			if (check_rulestate(PFCTL_STATE_FILTER))
1675				YYERROR;
1676
1677			memset(&r, 0, sizeof(r));
1678
1679			r.action = $1.b1;
1680			switch ($1.b2) {
1681			case PFRULE_RETURNRST:
1682				r.rule_flag |= PFRULE_RETURNRST;
1683				r.return_ttl = $1.w;
1684				break;
1685			case PFRULE_RETURNICMP:
1686				r.rule_flag |= PFRULE_RETURNICMP;
1687				r.return_icmp = $1.w;
1688				r.return_icmp6 = $1.w2;
1689				break;
1690			case PFRULE_RETURN:
1691				r.rule_flag |= PFRULE_RETURN;
1692				r.return_icmp = $1.w;
1693				r.return_icmp6 = $1.w2;
1694				break;
1695			}
1696			r.direction = $2;
1697			r.log = $3.log;
1698			r.logif = $3.logif;
1699			r.quick = $3.quick;
1700			r.prob = $9.prob;
1701			r.rtableid = $9.rtableid;
1702
1703			r.af = $6;
1704			if ($9.tag)
1705				if (strlcpy(r.tagname, $9.tag,
1706				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1707					yyerror("tag too long, max %u chars",
1708					    PF_TAG_NAME_SIZE - 1);
1709					YYERROR;
1710				}
1711			if ($9.match_tag)
1712				if (strlcpy(r.match_tagname, $9.match_tag,
1713				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1714					yyerror("tag too long, max %u chars",
1715					    PF_TAG_NAME_SIZE - 1);
1716					YYERROR;
1717				}
1718			r.match_tag_not = $9.match_tag_not;
1719			if (rule_label(&r, $9.label))
1720				YYERROR;
1721			free($9.label);
1722			r.flags = $9.flags.b1;
1723			r.flagset = $9.flags.b2;
1724			if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
1725				yyerror("flags always false");
1726				YYERROR;
1727			}
1728			if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
1729				for (proto = $7; proto != NULL &&
1730				    proto->proto != IPPROTO_TCP;
1731				    proto = proto->next)
1732					;	/* nothing */
1733				if (proto == NULL && $7 != NULL) {
1734					if ($9.flags.b1 || $9.flags.b2)
1735						yyerror(
1736						    "flags only apply to tcp");
1737					if ($8.src_os)
1738						yyerror(
1739						    "OS fingerprinting only "
1740						    "apply to tcp");
1741					YYERROR;
1742				}
1743#if 0
1744				if (($9.flags.b1 & parse_flags("S")) == 0 &&
1745				    $8.src_os) {
1746					yyerror("OS fingerprinting requires "
1747					    "the SYN TCP flag (flags S/SA)");
1748					YYERROR;
1749				}
1750#endif
1751			}
1752
1753			r.tos = $9.tos;
1754			r.keep_state = $9.keep.action;
1755
1756			/* 'keep state' by default on pass rules. */
1757			if (!r.keep_state && !r.action &&
1758			    !($9.marker & FOM_KEEP))
1759				r.keep_state = PF_STATE_NORMAL;
1760
1761			o = $9.keep.options;
1762			while (o) {
1763				struct node_state_opt	*p = o;
1764
1765				switch (o->type) {
1766				case PF_STATE_OPT_MAX:
1767					if (r.max_states) {
1768						yyerror("state option 'max' "
1769						    "multiple definitions");
1770						YYERROR;
1771					}
1772					r.max_states = o->data.max_states;
1773					break;
1774				case PF_STATE_OPT_NOSYNC:
1775					if (r.rule_flag & PFRULE_NOSYNC) {
1776						yyerror("state option 'sync' "
1777						    "multiple definitions");
1778						YYERROR;
1779					}
1780					r.rule_flag |= PFRULE_NOSYNC;
1781					break;
1782				case PF_STATE_OPT_SRCTRACK:
1783					if (srctrack) {
1784						yyerror("state option "
1785						    "'source-track' "
1786						    "multiple definitions");
1787						YYERROR;
1788					}
1789					srctrack =  o->data.src_track;
1790					r.rule_flag |= PFRULE_SRCTRACK;
1791					break;
1792				case PF_STATE_OPT_MAX_SRC_STATES:
1793					if (r.max_src_states) {
1794						yyerror("state option "
1795						    "'max-src-states' "
1796						    "multiple definitions");
1797						YYERROR;
1798					}
1799					if (o->data.max_src_states == 0) {
1800						yyerror("'max-src-states' must "
1801						    "be > 0");
1802						YYERROR;
1803					}
1804					r.max_src_states =
1805					    o->data.max_src_states;
1806					r.rule_flag |= PFRULE_SRCTRACK;
1807					break;
1808				case PF_STATE_OPT_OVERLOAD:
1809					if (r.overload_tblname[0]) {
1810						yyerror("multiple 'overload' "
1811						    "table definitions");
1812						YYERROR;
1813					}
1814					if (strlcpy(r.overload_tblname,
1815					    o->data.overload.tblname,
1816					    PF_TABLE_NAME_SIZE) >=
1817					    PF_TABLE_NAME_SIZE) {
1818						yyerror("state option: "
1819						    "strlcpy");
1820						YYERROR;
1821					}
1822					r.flush = o->data.overload.flush;
1823					break;
1824				case PF_STATE_OPT_MAX_SRC_CONN:
1825					if (r.max_src_conn) {
1826						yyerror("state option "
1827						    "'max-src-conn' "
1828						    "multiple definitions");
1829						YYERROR;
1830					}
1831					if (o->data.max_src_conn == 0) {
1832						yyerror("'max-src-conn' "
1833						    "must be > 0");
1834						YYERROR;
1835					}
1836					r.max_src_conn =
1837					    o->data.max_src_conn;
1838					r.rule_flag |= PFRULE_SRCTRACK |
1839					    PFRULE_RULESRCTRACK;
1840					break;
1841				case PF_STATE_OPT_MAX_SRC_CONN_RATE:
1842					if (r.max_src_conn_rate.limit) {
1843						yyerror("state option "
1844						    "'max-src-conn-rate' "
1845						    "multiple definitions");
1846						YYERROR;
1847					}
1848					if (!o->data.max_src_conn_rate.limit ||
1849					    !o->data.max_src_conn_rate.seconds) {
1850						yyerror("'max-src-conn-rate' "
1851						    "values must be > 0");
1852						YYERROR;
1853					}
1854					if (o->data.max_src_conn_rate.limit >
1855					    PF_THRESHOLD_MAX) {
1856						yyerror("'max-src-conn-rate' "
1857						    "maximum rate must be < %u",
1858						    PF_THRESHOLD_MAX);
1859						YYERROR;
1860					}
1861					r.max_src_conn_rate.limit =
1862					    o->data.max_src_conn_rate.limit;
1863					r.max_src_conn_rate.seconds =
1864					    o->data.max_src_conn_rate.seconds;
1865					r.rule_flag |= PFRULE_SRCTRACK |
1866					    PFRULE_RULESRCTRACK;
1867					break;
1868				case PF_STATE_OPT_MAX_SRC_NODES:
1869					if (r.max_src_nodes) {
1870						yyerror("state option "
1871						    "'max-src-nodes' "
1872						    "multiple definitions");
1873						YYERROR;
1874					}
1875					if (o->data.max_src_nodes == 0) {
1876						yyerror("'max-src-nodes' must "
1877						    "be > 0");
1878						YYERROR;
1879					}
1880					r.max_src_nodes =
1881					    o->data.max_src_nodes;
1882					r.rule_flag |= PFRULE_SRCTRACK |
1883					    PFRULE_RULESRCTRACK;
1884					break;
1885				case PF_STATE_OPT_STATELOCK:
1886					if (statelock) {
1887						yyerror("state locking option: "
1888						    "multiple definitions");
1889						YYERROR;
1890					}
1891					statelock = 1;
1892					r.rule_flag |= o->data.statelock;
1893					break;
1894				case PF_STATE_OPT_TIMEOUT:
1895					if (o->data.timeout.number ==
1896					    PFTM_ADAPTIVE_START ||
1897					    o->data.timeout.number ==
1898					    PFTM_ADAPTIVE_END)
1899						adaptive = 1;
1900					if (r.timeout[o->data.timeout.number]) {
1901						yyerror("state timeout %s "
1902						    "multiple definitions",
1903						    pf_timeouts[o->data.
1904						    timeout.number].name);
1905						YYERROR;
1906					}
1907					r.timeout[o->data.timeout.number] =
1908					    o->data.timeout.seconds;
1909				}
1910				o = o->next;
1911				free(p);
1912			}
1913
1914			/* 'flags S/SA' by default on stateful rules */
1915			if (!r.action && !r.flags && !r.flagset &&
1916			    !$9.fragment && !($9.marker & FOM_FLAGS) &&
1917			    r.keep_state) {
1918				r.flags = parse_flags("S");
1919				r.flagset =  parse_flags("SA");
1920			}
1921			if (!adaptive && r.max_states) {
1922				r.timeout[PFTM_ADAPTIVE_START] =
1923				    (r.max_states / 10) * 6;
1924				r.timeout[PFTM_ADAPTIVE_END] =
1925				    (r.max_states / 10) * 12;
1926			}
1927			if (r.rule_flag & PFRULE_SRCTRACK) {
1928				if (srctrack == PF_SRCTRACK_GLOBAL &&
1929				    r.max_src_nodes) {
1930					yyerror("'max-src-nodes' is "
1931					    "incompatible with "
1932					    "'source-track global'");
1933					YYERROR;
1934				}
1935				if (srctrack == PF_SRCTRACK_GLOBAL &&
1936				    r.max_src_conn) {
1937					yyerror("'max-src-conn' is "
1938					    "incompatible with "
1939					    "'source-track global'");
1940					YYERROR;
1941				}
1942				if (srctrack == PF_SRCTRACK_GLOBAL &&
1943				    r.max_src_conn_rate.seconds) {
1944					yyerror("'max-src-conn-rate' is "
1945					    "incompatible with "
1946					    "'source-track global'");
1947					YYERROR;
1948				}
1949				if (r.timeout[PFTM_SRC_NODE] <
1950				    r.max_src_conn_rate.seconds)
1951					r.timeout[PFTM_SRC_NODE] =
1952					    r.max_src_conn_rate.seconds;
1953				r.rule_flag |= PFRULE_SRCTRACK;
1954				if (srctrack == PF_SRCTRACK_RULE)
1955					r.rule_flag |= PFRULE_RULESRCTRACK;
1956			}
1957			if (r.keep_state && !statelock)
1958				r.rule_flag |= default_statelock;
1959
1960			if ($9.fragment)
1961				r.rule_flag |= PFRULE_FRAGMENT;
1962			r.allow_opts = $9.allowopts;
1963
1964			decide_address_family($8.src.host, &r.af);
1965			decide_address_family($8.dst.host, &r.af);
1966
1967			if ($5.rt) {
1968				if (!r.direction) {
1969					yyerror("direction must be explicit "
1970					    "with rules that specify routing");
1971					YYERROR;
1972				}
1973				r.rt = $5.rt;
1974				r.rpool.opts = $5.pool_opts;
1975				if ($5.key != NULL)
1976					memcpy(&r.rpool.key, $5.key,
1977					    sizeof(struct pf_poolhashkey));
1978			}
1979			if (r.rt && r.rt != PF_FASTROUTE) {
1980				decide_address_family($5.host, &r.af);
1981				remove_invalid_hosts(&$5.host, &r.af);
1982				if ($5.host == NULL) {
1983					yyerror("no routing address with "
1984					    "matching address family found.");
1985					YYERROR;
1986				}
1987				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
1988				    PF_POOL_NONE && ($5.host->next != NULL ||
1989				    $5.host->addr.type == PF_ADDR_TABLE ||
1990				    DYNIF_MULTIADDR($5.host->addr)))
1991					r.rpool.opts |= PF_POOL_ROUNDROBIN;
1992				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1993				    PF_POOL_ROUNDROBIN &&
1994				    disallow_table($5.host, "tables are only "
1995				    "supported in round-robin routing pools"))
1996					YYERROR;
1997				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1998				    PF_POOL_ROUNDROBIN &&
1999				    disallow_alias($5.host, "interface (%s) "
2000				    "is only supported in round-robin "
2001				    "routing pools"))
2002					YYERROR;
2003				if ($5.host->next != NULL) {
2004					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2005					    PF_POOL_ROUNDROBIN) {
2006						yyerror("r.rpool.opts must "
2007						    "be PF_POOL_ROUNDROBIN");
2008						YYERROR;
2009					}
2010				}
2011			}
2012			if ($9.queues.qname != NULL) {
2013				if (strlcpy(r.qname, $9.queues.qname,
2014				    sizeof(r.qname)) >= sizeof(r.qname)) {
2015					yyerror("rule qname too long (max "
2016					    "%d chars)", sizeof(r.qname)-1);
2017					YYERROR;
2018				}
2019				free($9.queues.qname);
2020			}
2021			if ($9.queues.pqname != NULL) {
2022				if (strlcpy(r.pqname, $9.queues.pqname,
2023				    sizeof(r.pqname)) >= sizeof(r.pqname)) {
2024					yyerror("rule pqname too long (max "
2025					    "%d chars)", sizeof(r.pqname)-1);
2026					YYERROR;
2027				}
2028				free($9.queues.pqname);
2029			}
2030
2031			expand_rule(&r, $4, $5.host, $7, $8.src_os,
2032			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
2033			    $9.uid, $9.gid, $9.icmpspec, "");
2034		}
2035		;
2036
2037filter_opts	:	{
2038				bzero(&filter_opts, sizeof filter_opts);
2039				filter_opts.rtableid = -1;
2040			}
2041		    filter_opts_l
2042			{ $$ = filter_opts; }
2043		| /* empty */	{
2044			bzero(&filter_opts, sizeof filter_opts);
2045			filter_opts.rtableid = -1;
2046			$$ = filter_opts;
2047		}
2048		;
2049
2050filter_opts_l	: filter_opts_l filter_opt
2051		| filter_opt
2052		;
2053
2054filter_opt	: USER uids {
2055			if (filter_opts.uid)
2056				$2->tail->next = filter_opts.uid;
2057			filter_opts.uid = $2;
2058		}
2059		| GROUP gids {
2060			if (filter_opts.gid)
2061				$2->tail->next = filter_opts.gid;
2062			filter_opts.gid = $2;
2063		}
2064		| flags {
2065			if (filter_opts.marker & FOM_FLAGS) {
2066				yyerror("flags cannot be redefined");
2067				YYERROR;
2068			}
2069			filter_opts.marker |= FOM_FLAGS;
2070			filter_opts.flags.b1 |= $1.b1;
2071			filter_opts.flags.b2 |= $1.b2;
2072			filter_opts.flags.w |= $1.w;
2073			filter_opts.flags.w2 |= $1.w2;
2074		}
2075		| icmpspec {
2076			if (filter_opts.marker & FOM_ICMP) {
2077				yyerror("icmp-type cannot be redefined");
2078				YYERROR;
2079			}
2080			filter_opts.marker |= FOM_ICMP;
2081			filter_opts.icmpspec = $1;
2082		}
2083		| tos {
2084			if (filter_opts.marker & FOM_TOS) {
2085				yyerror("tos cannot be redefined");
2086				YYERROR;
2087			}
2088			filter_opts.marker |= FOM_TOS;
2089			filter_opts.tos = $1;
2090		}
2091		| keep {
2092			if (filter_opts.marker & FOM_KEEP) {
2093				yyerror("modulate or keep cannot be redefined");
2094				YYERROR;
2095			}
2096			filter_opts.marker |= FOM_KEEP;
2097			filter_opts.keep.action = $1.action;
2098			filter_opts.keep.options = $1.options;
2099		}
2100		| FRAGMENT {
2101			filter_opts.fragment = 1;
2102		}
2103		| ALLOWOPTS {
2104			filter_opts.allowopts = 1;
2105		}
2106		| label	{
2107			if (filter_opts.label) {
2108				yyerror("label cannot be redefined");
2109				YYERROR;
2110			}
2111			filter_opts.label = $1;
2112		}
2113		| qname	{
2114			if (filter_opts.queues.qname) {
2115				yyerror("queue cannot be redefined");
2116				YYERROR;
2117			}
2118			filter_opts.queues = $1;
2119		}
2120		| TAG string				{
2121			filter_opts.tag = $2;
2122		}
2123		| not TAGGED string			{
2124			filter_opts.match_tag = $3;
2125			filter_opts.match_tag_not = $1;
2126		}
2127		| PROBABILITY STRING			{
2128			char	*e;
2129			double	 p = strtod($2, &e);
2130
2131			if (*e == '%') {
2132				p *= 0.01;
2133				e++;
2134			}
2135			if (*e) {
2136				yyerror("invalid probability: %s", $2);
2137				free($2);
2138				YYERROR;
2139			}
2140			p = floor(p * (UINT_MAX+1.0) + 0.5);
2141			if (p < 1.0 || p >= (UINT_MAX+1.0)) {
2142				yyerror("invalid probability: %s", $2);
2143				free($2);
2144				YYERROR;
2145			}
2146			filter_opts.prob = (u_int32_t)p;
2147			free($2);
2148		}
2149		| RTABLE number				{
2150#ifndef __FreeBSD__
2151			if ($2 > RT_TABLEID_MAX || $2 < 0) {
2152				yyerror("invalid rtable id");
2153				YYERROR;
2154			}
2155#endif
2156			filter_opts.rtableid = $2;
2157		}
2158		;
2159
2160action		: PASS			{ $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
2161		| BLOCK blockspec	{ $$ = $2; $$.b1 = PF_DROP; }
2162		;
2163
2164blockspec	: /* empty */		{
2165			$$.b2 = blockpolicy;
2166			$$.w = returnicmpdefault;
2167			$$.w2 = returnicmp6default;
2168		}
2169		| DROP			{
2170			$$.b2 = PFRULE_DROP;
2171			$$.w = 0;
2172			$$.w2 = 0;
2173		}
2174		| RETURNRST		{
2175			$$.b2 = PFRULE_RETURNRST;
2176			$$.w = 0;
2177			$$.w2 = 0;
2178		}
2179		| RETURNRST '(' TTL number ')'	{
2180			if ($4 > 255) {
2181				yyerror("illegal ttl value %d", $4);
2182				YYERROR;
2183			}
2184			$$.b2 = PFRULE_RETURNRST;
2185			$$.w = $4;
2186			$$.w2 = 0;
2187		}
2188		| RETURNICMP		{
2189			$$.b2 = PFRULE_RETURNICMP;
2190			$$.w = returnicmpdefault;
2191			$$.w2 = returnicmp6default;
2192		}
2193		| RETURNICMP6		{
2194			$$.b2 = PFRULE_RETURNICMP;
2195			$$.w = returnicmpdefault;
2196			$$.w2 = returnicmp6default;
2197		}
2198		| RETURNICMP '(' STRING ')'	{
2199			$$.b2 = PFRULE_RETURNICMP;
2200			if (!($$.w = parseicmpspec($3, AF_INET))) {
2201				free($3);
2202				YYERROR;
2203			}
2204			free($3);
2205			$$.w2 = returnicmp6default;
2206		}
2207		| RETURNICMP6 '(' STRING ')'	{
2208			$$.b2 = PFRULE_RETURNICMP;
2209			$$.w = returnicmpdefault;
2210			if (!($$.w2 = parseicmpspec($3, AF_INET6))) {
2211				free($3);
2212				YYERROR;
2213			}
2214			free($3);
2215		}
2216		| RETURNICMP '(' STRING comma STRING ')' {
2217			$$.b2 = PFRULE_RETURNICMP;
2218			if (!($$.w = parseicmpspec($3, AF_INET)) ||
2219			    !($$.w2 = parseicmpspec($5, AF_INET6))) {
2220				free($3);
2221				free($5);
2222				YYERROR;
2223			}
2224			free($3);
2225			free($5);
2226		}
2227		| RETURN {
2228			$$.b2 = PFRULE_RETURN;
2229			$$.w = returnicmpdefault;
2230			$$.w2 = returnicmp6default;
2231		}
2232		;
2233
2234dir		: /* empty */			{ $$ = 0; }
2235		| IN				{ $$ = PF_IN; }
2236		| OUT				{ $$ = PF_OUT; }
2237		;
2238
2239quick		: /* empty */			{ $$.quick = 0; }
2240		| QUICK				{ $$.quick = 1; }
2241		;
2242
2243logquick	: /* empty */	{ $$.log = 0; $$.quick = 0; $$.logif = 0; }
2244		| log		{ $$ = $1; $$.quick = 0; }
2245		| QUICK		{ $$.quick = 1; $$.log = 0; $$.logif = 0; }
2246		| log QUICK	{ $$ = $1; $$.quick = 1; }
2247		| QUICK log	{ $$ = $2; $$.quick = 1; }
2248		;
2249
2250log		: LOG			{ $$.log = PF_LOG; $$.logif = 0; }
2251		| LOG '(' logopts ')'	{
2252			$$.log = PF_LOG | $3.log;
2253			$$.logif = $3.logif;
2254		}
2255		;
2256
2257logopts		: logopt			{ $$ = $1; }
2258		| logopts comma logopt		{
2259			$$.log = $1.log | $3.log;
2260			$$.logif = $3.logif;
2261			if ($$.logif == 0)
2262				$$.logif = $1.logif;
2263		}
2264		;
2265
2266logopt		: ALL		{ $$.log = PF_LOG_ALL; $$.logif = 0; }
2267		| USER		{ $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2268		| GROUP		{ $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2269		| TO string	{
2270			const char	*errstr;
2271			u_int		 i;
2272
2273			$$.log = 0;
2274			if (strncmp($2, "pflog", 5)) {
2275				yyerror("%s: should be a pflog interface", $2);
2276				free($2);
2277				YYERROR;
2278			}
2279			i = strtonum($2 + 5, 0, 255, &errstr);
2280			if (errstr) {
2281				yyerror("%s: %s", $2, errstr);
2282				free($2);
2283				YYERROR;
2284			}
2285			free($2);
2286			$$.logif = i;
2287		}
2288		;
2289
2290interface	: /* empty */			{ $$ = NULL; }
2291		| ON if_item_not		{ $$ = $2; }
2292		| ON '{' if_list '}'		{ $$ = $3; }
2293		;
2294
2295if_list		: if_item_not			{ $$ = $1; }
2296		| if_list comma if_item_not	{
2297			$1->tail->next = $3;
2298			$1->tail = $3;
2299			$$ = $1;
2300		}
2301		;
2302
2303if_item_not	: not if_item			{ $$ = $2; $$->not = $1; }
2304		;
2305
2306if_item		: STRING			{
2307			struct node_host	*n;
2308
2309			$$ = calloc(1, sizeof(struct node_if));
2310			if ($$ == NULL)
2311				err(1, "if_item: calloc");
2312			if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
2313			    sizeof($$->ifname)) {
2314				free($1);
2315				free($$);
2316				yyerror("interface name too long");
2317				YYERROR;
2318			}
2319
2320			if ((n = ifa_exists($1)) != NULL)
2321				$$->ifa_flags = n->ifa_flags;
2322
2323			free($1);
2324			$$->not = 0;
2325			$$->next = NULL;
2326			$$->tail = $$;
2327		}
2328		;
2329
2330af		: /* empty */			{ $$ = 0; }
2331		| INET				{ $$ = AF_INET; }
2332		| INET6				{ $$ = AF_INET6; }
2333		;
2334
2335proto		: /* empty */			{ $$ = NULL; }
2336		| PROTO proto_item		{ $$ = $2; }
2337		| PROTO '{' proto_list '}'	{ $$ = $3; }
2338		;
2339
2340proto_list	: proto_item			{ $$ = $1; }
2341		| proto_list comma proto_item	{
2342			$1->tail->next = $3;
2343			$1->tail = $3;
2344			$$ = $1;
2345		}
2346		;
2347
2348proto_item	: STRING			{
2349			u_int8_t	pr;
2350			u_long		ulval;
2351
2352			if (atoul($1, &ulval) == 0) {
2353				if (ulval > 255) {
2354					yyerror("protocol outside range");
2355					free($1);
2356					YYERROR;
2357				}
2358				pr = (u_int8_t)ulval;
2359			} else {
2360				struct protoent	*p;
2361
2362				p = getprotobyname($1);
2363				if (p == NULL) {
2364					yyerror("unknown protocol %s", $1);
2365					free($1);
2366					YYERROR;
2367				}
2368				pr = p->p_proto;
2369			}
2370			free($1);
2371			if (pr == 0) {
2372				yyerror("proto 0 cannot be used");
2373				YYERROR;
2374			}
2375			$$ = calloc(1, sizeof(struct node_proto));
2376			if ($$ == NULL)
2377				err(1, "proto_item: calloc");
2378			$$->proto = pr;
2379			$$->next = NULL;
2380			$$->tail = $$;
2381		}
2382		;
2383
2384fromto		: ALL				{
2385			$$.src.host = NULL;
2386			$$.src.port = NULL;
2387			$$.dst.host = NULL;
2388			$$.dst.port = NULL;
2389			$$.src_os = NULL;
2390		}
2391		| from os to			{
2392			$$.src = $1;
2393			$$.src_os = $2;
2394			$$.dst = $3;
2395		}
2396		;
2397
2398os		: /* empty */			{ $$ = NULL; }
2399		| OS xos			{ $$ = $2; }
2400		| OS '{' os_list '}'		{ $$ = $3; }
2401		;
2402
2403xos		: STRING {
2404			$$ = calloc(1, sizeof(struct node_os));
2405			if ($$ == NULL)
2406				err(1, "os: calloc");
2407			$$->os = $1;
2408			$$->tail = $$;
2409		}
2410		;
2411
2412os_list		: xos				{ $$ = $1; }
2413		| os_list comma xos		{
2414			$1->tail->next = $3;
2415			$1->tail = $3;
2416			$$ = $1;
2417		}
2418		;
2419
2420from		: /* empty */			{
2421			$$.host = NULL;
2422			$$.port = NULL;
2423		}
2424		| FROM ipportspec		{
2425			$$ = $2;
2426		}
2427		;
2428
2429to		: /* empty */			{
2430			$$.host = NULL;
2431			$$.port = NULL;
2432		}
2433		| TO ipportspec		{
2434			if (disallow_urpf_failed($2.host, "\"urpf-failed\" is "
2435			    "not permitted in a destination address"))
2436				YYERROR;
2437			$$ = $2;
2438		}
2439		;
2440
2441ipportspec	: ipspec			{
2442			$$.host = $1;
2443			$$.port = NULL;
2444		}
2445		| ipspec PORT portspec		{
2446			$$.host = $1;
2447			$$.port = $3;
2448		}
2449		| PORT portspec			{
2450			$$.host = NULL;
2451			$$.port = $2;
2452		}
2453		;
2454
2455ipspec		: ANY				{ $$ = NULL; }
2456		| xhost				{ $$ = $1; }
2457		| '{' host_list '}'		{ $$ = $2; }
2458		;
2459
2460host_list	: ipspec			{ $$ = $1; }
2461		| host_list comma ipspec	{
2462			if ($3 == NULL)
2463				$$ = $1;
2464			else if ($1 == NULL)
2465				$$ = $3;
2466			else {
2467				$1->tail->next = $3;
2468				$1->tail = $3->tail;
2469				$$ = $1;
2470			}
2471		}
2472		;
2473
2474xhost		: not host			{
2475			struct node_host	*n;
2476
2477			for (n = $2; n != NULL; n = n->next)
2478				n->not = $1;
2479			$$ = $2;
2480		}
2481		| not NOROUTE			{
2482			$$ = calloc(1, sizeof(struct node_host));
2483			if ($$ == NULL)
2484				err(1, "xhost: calloc");
2485			$$->addr.type = PF_ADDR_NOROUTE;
2486			$$->next = NULL;
2487			$$->not = $1;
2488			$$->tail = $$;
2489		}
2490		| not URPFFAILED		{
2491			$$ = calloc(1, sizeof(struct node_host));
2492			if ($$ == NULL)
2493				err(1, "xhost: calloc");
2494			$$->addr.type = PF_ADDR_URPFFAILED;
2495			$$->next = NULL;
2496			$$->not = $1;
2497			$$->tail = $$;
2498		}
2499		;
2500
2501host		: STRING			{
2502			if (($$ = host($1)) == NULL)	{
2503				/* error. "any" is handled elsewhere */
2504				free($1);
2505				yyerror("could not parse host specification");
2506				YYERROR;
2507			}
2508			free($1);
2509
2510		}
2511		| STRING '/' number		{
2512			char	*buf;
2513
2514			if (asprintf(&buf, "%s/%u", $1, $3) == -1)
2515				err(1, "host: asprintf");
2516			free($1);
2517			if (($$ = host(buf)) == NULL)	{
2518				/* error. "any" is handled elsewhere */
2519				free(buf);
2520				yyerror("could not parse host specification");
2521				YYERROR;
2522			}
2523			free(buf);
2524		}
2525		| dynaddr
2526		| dynaddr '/' number		{
2527			struct node_host	*n;
2528
2529			$$ = $1;
2530			for (n = $1; n != NULL; n = n->next)
2531				set_ipmask(n, $3);
2532		}
2533		| '<' STRING '>'	{
2534			if (strlen($2) >= PF_TABLE_NAME_SIZE) {
2535				yyerror("table name '%s' too long", $2);
2536				free($2);
2537				YYERROR;
2538			}
2539			$$ = calloc(1, sizeof(struct node_host));
2540			if ($$ == NULL)
2541				err(1, "host: calloc");
2542			$$->addr.type = PF_ADDR_TABLE;
2543			if (strlcpy($$->addr.v.tblname, $2,
2544			    sizeof($$->addr.v.tblname)) >=
2545			    sizeof($$->addr.v.tblname))
2546				errx(1, "host: strlcpy");
2547			free($2);
2548			$$->next = NULL;
2549			$$->tail = $$;
2550		}
2551		| ROUTE	STRING		{
2552			$$ = calloc(1, sizeof(struct node_host));
2553			if ($$ == NULL) {
2554				free($2);
2555				err(1, "host: calloc");
2556			}
2557			$$->addr.type = PF_ADDR_RTLABEL;
2558			if (strlcpy($$->addr.v.rtlabelname, $2,
2559			    sizeof($$->addr.v.rtlabelname)) >=
2560			    sizeof($$->addr.v.rtlabelname)) {
2561				yyerror("route label too long, max %u chars",
2562				    sizeof($$->addr.v.rtlabelname) - 1);
2563				free($2);
2564				free($$);
2565				YYERROR;
2566			}
2567			$$->next = NULL;
2568			$$->tail = $$;
2569			free($2);
2570		}
2571		;
2572
2573number		: STRING			{
2574			u_long	ulval;
2575
2576			if (atoul($1, &ulval) == -1) {
2577				yyerror("%s is not a number", $1);
2578				free($1);
2579				YYERROR;
2580			} else
2581				$$ = ulval;
2582			free($1);
2583		}
2584		;
2585
2586dynaddr		: '(' STRING ')'		{
2587			int	 flags = 0;
2588			char	*p, *op;
2589
2590			op = $2;
2591			if (!isalpha(op[0])) {
2592				yyerror("invalid interface name '%s'", op);
2593				free(op);
2594				YYERROR;
2595			}
2596			while ((p = strrchr($2, ':')) != NULL) {
2597				if (!strcmp(p+1, "network"))
2598					flags |= PFI_AFLAG_NETWORK;
2599				else if (!strcmp(p+1, "broadcast"))
2600					flags |= PFI_AFLAG_BROADCAST;
2601				else if (!strcmp(p+1, "peer"))
2602					flags |= PFI_AFLAG_PEER;
2603				else if (!strcmp(p+1, "0"))
2604					flags |= PFI_AFLAG_NOALIAS;
2605				else {
2606					yyerror("interface %s has bad modifier",
2607					    $2);
2608					free(op);
2609					YYERROR;
2610				}
2611				*p = '\0';
2612			}
2613			if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
2614				free(op);
2615				yyerror("illegal combination of "
2616				    "interface modifiers");
2617				YYERROR;
2618			}
2619			$$ = calloc(1, sizeof(struct node_host));
2620			if ($$ == NULL)
2621				err(1, "address: calloc");
2622			$$->af = 0;
2623			set_ipmask($$, 128);
2624			$$->addr.type = PF_ADDR_DYNIFTL;
2625			$$->addr.iflags = flags;
2626			if (strlcpy($$->addr.v.ifname, $2,
2627			    sizeof($$->addr.v.ifname)) >=
2628			    sizeof($$->addr.v.ifname)) {
2629				free(op);
2630				free($$);
2631				yyerror("interface name too long");
2632				YYERROR;
2633			}
2634			free(op);
2635			$$->next = NULL;
2636			$$->tail = $$;
2637		}
2638		;
2639
2640portspec	: port_item			{ $$ = $1; }
2641		| '{' port_list '}'		{ $$ = $2; }
2642		;
2643
2644port_list	: port_item			{ $$ = $1; }
2645		| port_list comma port_item	{
2646			$1->tail->next = $3;
2647			$1->tail = $3;
2648			$$ = $1;
2649		}
2650		;
2651
2652port_item	: port				{
2653			$$ = calloc(1, sizeof(struct node_port));
2654			if ($$ == NULL)
2655				err(1, "port_item: calloc");
2656			$$->port[0] = $1.a;
2657			$$->port[1] = $1.b;
2658			if ($1.t)
2659				$$->op = PF_OP_RRG;
2660			else
2661				$$->op = PF_OP_EQ;
2662			$$->next = NULL;
2663			$$->tail = $$;
2664		}
2665		| unaryop port		{
2666			if ($2.t) {
2667				yyerror("':' cannot be used with an other "
2668				    "port operator");
2669				YYERROR;
2670			}
2671			$$ = calloc(1, sizeof(struct node_port));
2672			if ($$ == NULL)
2673				err(1, "port_item: calloc");
2674			$$->port[0] = $2.a;
2675			$$->port[1] = $2.b;
2676			$$->op = $1;
2677			$$->next = NULL;
2678			$$->tail = $$;
2679		}
2680		| port PORTBINARY port		{
2681			if ($1.t || $3.t) {
2682				yyerror("':' cannot be used with an other "
2683				    "port operator");
2684				YYERROR;
2685			}
2686			$$ = calloc(1, sizeof(struct node_port));
2687			if ($$ == NULL)
2688				err(1, "port_item: calloc");
2689			$$->port[0] = $1.a;
2690			$$->port[1] = $3.a;
2691			$$->op = $2;
2692			$$->next = NULL;
2693			$$->tail = $$;
2694		}
2695		;
2696
2697port		: STRING			{
2698			char	*p = strchr($1, ':');
2699
2700			if (p == NULL) {
2701				if (($$.a = getservice($1)) == -1) {
2702					free($1);
2703					YYERROR;
2704				}
2705				$$.b = $$.t = 0;
2706			} else {
2707				int port[2];
2708
2709				*p++ = 0;
2710				if ((port[0] = getservice($1)) == -1 ||
2711				    (port[1] = getservice(p)) == -1) {
2712					free($1);
2713					YYERROR;
2714				}
2715				$$.a = port[0];
2716				$$.b = port[1];
2717				$$.t = PF_OP_RRG;
2718			}
2719			free($1);
2720		}
2721		;
2722
2723uids		: uid_item			{ $$ = $1; }
2724		| '{' uid_list '}'		{ $$ = $2; }
2725		;
2726
2727uid_list	: uid_item			{ $$ = $1; }
2728		| uid_list comma uid_item	{
2729			$1->tail->next = $3;
2730			$1->tail = $3;
2731			$$ = $1;
2732		}
2733		;
2734
2735uid_item	: uid				{
2736			$$ = calloc(1, sizeof(struct node_uid));
2737			if ($$ == NULL)
2738				err(1, "uid_item: calloc");
2739			$$->uid[0] = $1;
2740			$$->uid[1] = $1;
2741			$$->op = PF_OP_EQ;
2742			$$->next = NULL;
2743			$$->tail = $$;
2744		}
2745		| unaryop uid			{
2746			if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2747				yyerror("user unknown requires operator = or "
2748				    "!=");
2749				YYERROR;
2750			}
2751			$$ = calloc(1, sizeof(struct node_uid));
2752			if ($$ == NULL)
2753				err(1, "uid_item: calloc");
2754			$$->uid[0] = $2;
2755			$$->uid[1] = $2;
2756			$$->op = $1;
2757			$$->next = NULL;
2758			$$->tail = $$;
2759		}
2760		| uid PORTBINARY uid		{
2761			if ($1 == UID_MAX || $3 == UID_MAX) {
2762				yyerror("user unknown requires operator = or "
2763				    "!=");
2764				YYERROR;
2765			}
2766			$$ = calloc(1, sizeof(struct node_uid));
2767			if ($$ == NULL)
2768				err(1, "uid_item: calloc");
2769			$$->uid[0] = $1;
2770			$$->uid[1] = $3;
2771			$$->op = $2;
2772			$$->next = NULL;
2773			$$->tail = $$;
2774		}
2775		;
2776
2777uid		: STRING			{
2778			u_long	ulval;
2779
2780			if (atoul($1, &ulval) == -1) {
2781				if (!strcmp($1, "unknown"))
2782					$$ = UID_MAX;
2783				else {
2784					struct passwd	*pw;
2785
2786					if ((pw = getpwnam($1)) == NULL) {
2787						yyerror("unknown user %s", $1);
2788						free($1);
2789						YYERROR;
2790					}
2791					$$ = pw->pw_uid;
2792				}
2793			} else {
2794				if (ulval >= UID_MAX) {
2795					free($1);
2796					yyerror("illegal uid value %lu", ulval);
2797					YYERROR;
2798				}
2799				$$ = ulval;
2800			}
2801			free($1);
2802		}
2803		;
2804
2805gids		: gid_item			{ $$ = $1; }
2806		| '{' gid_list '}'		{ $$ = $2; }
2807		;
2808
2809gid_list	: gid_item			{ $$ = $1; }
2810		| gid_list comma gid_item	{
2811			$1->tail->next = $3;
2812			$1->tail = $3;
2813			$$ = $1;
2814		}
2815		;
2816
2817gid_item	: gid				{
2818			$$ = calloc(1, sizeof(struct node_gid));
2819			if ($$ == NULL)
2820				err(1, "gid_item: calloc");
2821			$$->gid[0] = $1;
2822			$$->gid[1] = $1;
2823			$$->op = PF_OP_EQ;
2824			$$->next = NULL;
2825			$$->tail = $$;
2826		}
2827		| unaryop gid			{
2828			if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2829				yyerror("group unknown requires operator = or "
2830				    "!=");
2831				YYERROR;
2832			}
2833			$$ = calloc(1, sizeof(struct node_gid));
2834			if ($$ == NULL)
2835				err(1, "gid_item: calloc");
2836			$$->gid[0] = $2;
2837			$$->gid[1] = $2;
2838			$$->op = $1;
2839			$$->next = NULL;
2840			$$->tail = $$;
2841		}
2842		| gid PORTBINARY gid		{
2843			if ($1 == GID_MAX || $3 == GID_MAX) {
2844				yyerror("group unknown requires operator = or "
2845				    "!=");
2846				YYERROR;
2847			}
2848			$$ = calloc(1, sizeof(struct node_gid));
2849			if ($$ == NULL)
2850				err(1, "gid_item: calloc");
2851			$$->gid[0] = $1;
2852			$$->gid[1] = $3;
2853			$$->op = $2;
2854			$$->next = NULL;
2855			$$->tail = $$;
2856		}
2857		;
2858
2859gid		: STRING			{
2860			u_long	ulval;
2861
2862			if (atoul($1, &ulval) == -1) {
2863				if (!strcmp($1, "unknown"))
2864					$$ = GID_MAX;
2865				else {
2866					struct group	*grp;
2867
2868					if ((grp = getgrnam($1)) == NULL) {
2869						yyerror("unknown group %s", $1);
2870						free($1);
2871						YYERROR;
2872					}
2873					$$ = grp->gr_gid;
2874				}
2875			} else {
2876				if (ulval >= GID_MAX) {
2877					yyerror("illegal gid value %lu", ulval);
2878					free($1);
2879					YYERROR;
2880				}
2881				$$ = ulval;
2882			}
2883			free($1);
2884		}
2885		;
2886
2887flag		: STRING			{
2888			int	f;
2889
2890			if ((f = parse_flags($1)) < 0) {
2891				yyerror("bad flags %s", $1);
2892				free($1);
2893				YYERROR;
2894			}
2895			free($1);
2896			$$.b1 = f;
2897		}
2898		;
2899
2900flags		: FLAGS flag '/' flag	{ $$.b1 = $2.b1; $$.b2 = $4.b1; }
2901		| FLAGS '/' flag	{ $$.b1 = 0; $$.b2 = $3.b1; }
2902		| FLAGS ANY		{ $$.b1 = 0; $$.b2 = 0; }
2903		;
2904
2905icmpspec	: ICMPTYPE icmp_item		{ $$ = $2; }
2906		| ICMPTYPE '{' icmp_list '}'	{ $$ = $3; }
2907		| ICMP6TYPE icmp6_item		{ $$ = $2; }
2908		| ICMP6TYPE '{' icmp6_list '}'	{ $$ = $3; }
2909		;
2910
2911icmp_list	: icmp_item			{ $$ = $1; }
2912		| icmp_list comma icmp_item	{
2913			$1->tail->next = $3;
2914			$1->tail = $3;
2915			$$ = $1;
2916		}
2917		;
2918
2919icmp6_list	: icmp6_item			{ $$ = $1; }
2920		| icmp6_list comma icmp6_item	{
2921			$1->tail->next = $3;
2922			$1->tail = $3;
2923			$$ = $1;
2924		}
2925		;
2926
2927icmp_item	: icmptype		{
2928			$$ = calloc(1, sizeof(struct node_icmp));
2929			if ($$ == NULL)
2930				err(1, "icmp_item: calloc");
2931			$$->type = $1;
2932			$$->code = 0;
2933			$$->proto = IPPROTO_ICMP;
2934			$$->next = NULL;
2935			$$->tail = $$;
2936		}
2937		| icmptype CODE STRING	{
2938			const struct icmpcodeent	*p;
2939			u_long				 ulval;
2940
2941			if (atoul($3, &ulval) == 0) {
2942				if (ulval > 255) {
2943					free($3);
2944					yyerror("illegal icmp-code %lu", ulval);
2945					YYERROR;
2946				}
2947			} else {
2948				if ((p = geticmpcodebyname($1-1, $3,
2949				    AF_INET)) == NULL) {
2950					yyerror("unknown icmp-code %s", $3);
2951					free($3);
2952					YYERROR;
2953				}
2954				ulval = p->code;
2955			}
2956			free($3);
2957			$$ = calloc(1, sizeof(struct node_icmp));
2958			if ($$ == NULL)
2959				err(1, "icmp_item: calloc");
2960			$$->type = $1;
2961			$$->code = ulval + 1;
2962			$$->proto = IPPROTO_ICMP;
2963			$$->next = NULL;
2964			$$->tail = $$;
2965		}
2966		;
2967
2968icmp6_item	: icmp6type		{
2969			$$ = calloc(1, sizeof(struct node_icmp));
2970			if ($$ == NULL)
2971				err(1, "icmp_item: calloc");
2972			$$->type = $1;
2973			$$->code = 0;
2974			$$->proto = IPPROTO_ICMPV6;
2975			$$->next = NULL;
2976			$$->tail = $$;
2977		}
2978		| icmp6type CODE STRING	{
2979			const struct icmpcodeent	*p;
2980			u_long				 ulval;
2981
2982			if (atoul($3, &ulval) == 0) {
2983				if (ulval > 255) {
2984					yyerror("illegal icmp6-code %lu",
2985					    ulval);
2986					free($3);
2987					YYERROR;
2988				}
2989			} else {
2990				if ((p = geticmpcodebyname($1-1, $3,
2991				    AF_INET6)) == NULL) {
2992					yyerror("unknown icmp6-code %s", $3);
2993					free($3);
2994					YYERROR;
2995				}
2996				ulval = p->code;
2997			}
2998			free($3);
2999			$$ = calloc(1, sizeof(struct node_icmp));
3000			if ($$ == NULL)
3001				err(1, "icmp_item: calloc");
3002			$$->type = $1;
3003			$$->code = ulval + 1;
3004			$$->proto = IPPROTO_ICMPV6;
3005			$$->next = NULL;
3006			$$->tail = $$;
3007		}
3008		;
3009
3010icmptype	: STRING			{
3011			const struct icmptypeent	*p;
3012			u_long				 ulval;
3013
3014			if (atoul($1, &ulval) == 0) {
3015				if (ulval > 255) {
3016					yyerror("illegal icmp-type %lu", ulval);
3017					free($1);
3018					YYERROR;
3019				}
3020				$$ = ulval + 1;
3021			} else {
3022				if ((p = geticmptypebyname($1, AF_INET)) ==
3023				    NULL) {
3024					yyerror("unknown icmp-type %s", $1);
3025					free($1);
3026					YYERROR;
3027				}
3028				$$ = p->type + 1;
3029			}
3030			free($1);
3031		}
3032		;
3033
3034icmp6type	: STRING			{
3035			const struct icmptypeent	*p;
3036			u_long				 ulval;
3037
3038			if (atoul($1, &ulval) == 0) {
3039				if (ulval > 255) {
3040					yyerror("illegal icmp6-type %lu",
3041					    ulval);
3042					free($1);
3043					YYERROR;
3044				}
3045				$$ = ulval + 1;
3046			} else {
3047				if ((p = geticmptypebyname($1, AF_INET6)) ==
3048				    NULL) {
3049					yyerror("unknown icmp6-type %s", $1);
3050					free($1);
3051					YYERROR;
3052				}
3053				$$ = p->type + 1;
3054			}
3055			free($1);
3056		}
3057		;
3058
3059tos		: TOS STRING			{
3060			if (!strcmp($2, "lowdelay"))
3061				$$ = IPTOS_LOWDELAY;
3062			else if (!strcmp($2, "throughput"))
3063				$$ = IPTOS_THROUGHPUT;
3064			else if (!strcmp($2, "reliability"))
3065				$$ = IPTOS_RELIABILITY;
3066			else if ($2[0] == '0' && $2[1] == 'x')
3067				$$ = strtoul($2, NULL, 16);
3068			else
3069				$$ = strtoul($2, NULL, 10);
3070			if (!$$ || $$ > 255) {
3071				yyerror("illegal tos value %s", $2);
3072				free($2);
3073				YYERROR;
3074			}
3075			free($2);
3076		}
3077		;
3078
3079sourcetrack	: SOURCETRACK		{ $$ = PF_SRCTRACK; }
3080		| SOURCETRACK GLOBAL	{ $$ = PF_SRCTRACK_GLOBAL; }
3081		| SOURCETRACK RULE	{ $$ = PF_SRCTRACK_RULE; }
3082		;
3083
3084statelock	: IFBOUND {
3085			$$ = PFRULE_IFBOUND;
3086		}
3087		| FLOATING {
3088			$$ = 0;
3089		}
3090		;
3091
3092keep		: NO STATE			{
3093			$$.action = 0;
3094			$$.options = NULL;
3095		}
3096		| KEEP STATE state_opt_spec	{
3097			$$.action = PF_STATE_NORMAL;
3098			$$.options = $3;
3099		}
3100		| MODULATE STATE state_opt_spec {
3101			$$.action = PF_STATE_MODULATE;
3102			$$.options = $3;
3103		}
3104		| SYNPROXY STATE state_opt_spec {
3105			$$.action = PF_STATE_SYNPROXY;
3106			$$.options = $3;
3107		}
3108		;
3109
3110flush		: /* empty */			{ $$ = 0; }
3111		| FLUSH				{ $$ = PF_FLUSH; }
3112		| FLUSH GLOBAL			{
3113			$$ = PF_FLUSH | PF_FLUSH_GLOBAL;
3114		}
3115		;
3116
3117state_opt_spec	: '(' state_opt_list ')'	{ $$ = $2; }
3118		| /* empty */			{ $$ = NULL; }
3119		;
3120
3121state_opt_list	: state_opt_item		{ $$ = $1; }
3122		| state_opt_list comma state_opt_item {
3123			$1->tail->next = $3;
3124			$1->tail = $3;
3125			$$ = $1;
3126		}
3127		;
3128
3129state_opt_item	: MAXIMUM number		{
3130			$$ = calloc(1, sizeof(struct node_state_opt));
3131			if ($$ == NULL)
3132				err(1, "state_opt_item: calloc");
3133			$$->type = PF_STATE_OPT_MAX;
3134			$$->data.max_states = $2;
3135			$$->next = NULL;
3136			$$->tail = $$;
3137		}
3138		| NOSYNC				{
3139			$$ = calloc(1, sizeof(struct node_state_opt));
3140			if ($$ == NULL)
3141				err(1, "state_opt_item: calloc");
3142			$$->type = PF_STATE_OPT_NOSYNC;
3143			$$->next = NULL;
3144			$$->tail = $$;
3145		}
3146		| MAXSRCSTATES number			{
3147			$$ = calloc(1, sizeof(struct node_state_opt));
3148			if ($$ == NULL)
3149				err(1, "state_opt_item: calloc");
3150			$$->type = PF_STATE_OPT_MAX_SRC_STATES;
3151			$$->data.max_src_states = $2;
3152			$$->next = NULL;
3153			$$->tail = $$;
3154		}
3155		| MAXSRCCONN number			{
3156			$$ = calloc(1, sizeof(struct node_state_opt));
3157			if ($$ == NULL)
3158				err(1, "state_opt_item: calloc");
3159			$$->type = PF_STATE_OPT_MAX_SRC_CONN;
3160			$$->data.max_src_conn = $2;
3161			$$->next = NULL;
3162			$$->tail = $$;
3163		}
3164		| MAXSRCCONNRATE number '/' number	{
3165			$$ = calloc(1, sizeof(struct node_state_opt));
3166			if ($$ == NULL)
3167				err(1, "state_opt_item: calloc");
3168			$$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
3169			$$->data.max_src_conn_rate.limit = $2;
3170			$$->data.max_src_conn_rate.seconds = $4;
3171			$$->next = NULL;
3172			$$->tail = $$;
3173		}
3174		| OVERLOAD '<' STRING '>' flush		{
3175			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
3176				yyerror("table name '%s' too long", $3);
3177				free($3);
3178				YYERROR;
3179			}
3180			$$ = calloc(1, sizeof(struct node_state_opt));
3181			if ($$ == NULL)
3182				err(1, "state_opt_item: calloc");
3183			if (strlcpy($$->data.overload.tblname, $3,
3184			    PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
3185				errx(1, "state_opt_item: strlcpy");
3186			free($3);
3187			$$->type = PF_STATE_OPT_OVERLOAD;
3188			$$->data.overload.flush = $5;
3189			$$->next = NULL;
3190			$$->tail = $$;
3191		}
3192		| MAXSRCNODES number			{
3193			$$ = calloc(1, sizeof(struct node_state_opt));
3194			if ($$ == NULL)
3195				err(1, "state_opt_item: calloc");
3196			$$->type = PF_STATE_OPT_MAX_SRC_NODES;
3197			$$->data.max_src_nodes = $2;
3198			$$->next = NULL;
3199			$$->tail = $$;
3200		}
3201		| sourcetrack {
3202			$$ = calloc(1, sizeof(struct node_state_opt));
3203			if ($$ == NULL)
3204				err(1, "state_opt_item: calloc");
3205			$$->type = PF_STATE_OPT_SRCTRACK;
3206			$$->data.src_track = $1;
3207			$$->next = NULL;
3208			$$->tail = $$;
3209		}
3210		| statelock {
3211			$$ = calloc(1, sizeof(struct node_state_opt));
3212			if ($$ == NULL)
3213				err(1, "state_opt_item: calloc");
3214			$$->type = PF_STATE_OPT_STATELOCK;
3215			$$->data.statelock = $1;
3216			$$->next = NULL;
3217			$$->tail = $$;
3218		}
3219		| STRING number			{
3220			int	i;
3221
3222			for (i = 0; pf_timeouts[i].name &&
3223			    strcmp(pf_timeouts[i].name, $1); ++i)
3224				;	/* nothing */
3225			if (!pf_timeouts[i].name) {
3226				yyerror("illegal timeout name %s", $1);
3227				free($1);
3228				YYERROR;
3229			}
3230			if (strchr(pf_timeouts[i].name, '.') == NULL) {
3231				yyerror("illegal state timeout %s", $1);
3232				free($1);
3233				YYERROR;
3234			}
3235			free($1);
3236			$$ = calloc(1, sizeof(struct node_state_opt));
3237			if ($$ == NULL)
3238				err(1, "state_opt_item: calloc");
3239			$$->type = PF_STATE_OPT_TIMEOUT;
3240			$$->data.timeout.number = pf_timeouts[i].timeout;
3241			$$->data.timeout.seconds = $2;
3242			$$->next = NULL;
3243			$$->tail = $$;
3244		}
3245		;
3246
3247label		: LABEL STRING			{
3248			$$ = $2;
3249		}
3250		;
3251
3252qname		: QUEUE STRING				{
3253			$$.qname = $2;
3254		}
3255		| QUEUE '(' STRING ')'			{
3256			$$.qname = $3;
3257		}
3258		| QUEUE '(' STRING comma STRING ')'	{
3259			$$.qname = $3;
3260			$$.pqname = $5;
3261		}
3262		;
3263
3264no		: /* empty */			{ $$ = 0; }
3265		| NO				{ $$ = 1; }
3266		;
3267
3268rport		: STRING			{
3269			char	*p = strchr($1, ':');
3270
3271			if (p == NULL) {
3272				if (($$.a = getservice($1)) == -1) {
3273					free($1);
3274					YYERROR;
3275				}
3276				$$.b = $$.t = 0;
3277			} else if (!strcmp(p+1, "*")) {
3278				*p = 0;
3279				if (($$.a = getservice($1)) == -1) {
3280					free($1);
3281					YYERROR;
3282				}
3283				$$.b = 0;
3284				$$.t = 1;
3285			} else {
3286				*p++ = 0;
3287				if (($$.a = getservice($1)) == -1 ||
3288				    ($$.b = getservice(p)) == -1) {
3289					free($1);
3290					YYERROR;
3291				}
3292				if ($$.a == $$.b)
3293					$$.b = 0;
3294				$$.t = 0;
3295			}
3296			free($1);
3297		}
3298		;
3299
3300redirspec	: host				{ $$ = $1; }
3301		| '{' redir_host_list '}'	{ $$ = $2; }
3302		;
3303
3304redir_host_list	: host				{ $$ = $1; }
3305		| redir_host_list comma host	{
3306			$1->tail->next = $3;
3307			$1->tail = $3->tail;
3308			$$ = $1;
3309		}
3310		;
3311
3312redirpool	: /* empty */			{ $$ = NULL; }
3313		| ARROW redirspec		{
3314			$$ = calloc(1, sizeof(struct redirection));
3315			if ($$ == NULL)
3316				err(1, "redirection: calloc");
3317			$$->host = $2;
3318			$$->rport.a = $$->rport.b = $$->rport.t = 0;
3319		}
3320		| ARROW redirspec PORT rport	{
3321			$$ = calloc(1, sizeof(struct redirection));
3322			if ($$ == NULL)
3323				err(1, "redirection: calloc");
3324			$$->host = $2;
3325			$$->rport = $4;
3326		}
3327		;
3328
3329hashkey		: /* empty */
3330		{
3331			$$ = calloc(1, sizeof(struct pf_poolhashkey));
3332			if ($$ == NULL)
3333				err(1, "hashkey: calloc");
3334			$$->key32[0] = arc4random();
3335			$$->key32[1] = arc4random();
3336			$$->key32[2] = arc4random();
3337			$$->key32[3] = arc4random();
3338		}
3339		| string
3340		{
3341			if (!strncmp($1, "0x", 2)) {
3342				if (strlen($1) != 34) {
3343					free($1);
3344					yyerror("hex key must be 128 bits "
3345						"(32 hex digits) long");
3346					YYERROR;
3347				}
3348				$$ = calloc(1, sizeof(struct pf_poolhashkey));
3349				if ($$ == NULL)
3350					err(1, "hashkey: calloc");
3351
3352				if (sscanf($1, "0x%8x%8x%8x%8x",
3353				    &$$->key32[0], &$$->key32[1],
3354				    &$$->key32[2], &$$->key32[3]) != 4) {
3355					free($$);
3356					free($1);
3357					yyerror("invalid hex key");
3358					YYERROR;
3359				}
3360			} else {
3361				MD5_CTX	context;
3362
3363				$$ = calloc(1, sizeof(struct pf_poolhashkey));
3364				if ($$ == NULL)
3365					err(1, "hashkey: calloc");
3366				MD5Init(&context);
3367				MD5Update(&context, (unsigned char *)$1,
3368				    strlen($1));
3369				MD5Final((unsigned char *)$$, &context);
3370				HTONL($$->key32[0]);
3371				HTONL($$->key32[1]);
3372				HTONL($$->key32[2]);
3373				HTONL($$->key32[3]);
3374			}
3375			free($1);
3376		}
3377		;
3378
3379pool_opts	:	{ bzero(&pool_opts, sizeof pool_opts); }
3380		    pool_opts_l
3381			{ $$ = pool_opts; }
3382		| /* empty */	{
3383			bzero(&pool_opts, sizeof pool_opts);
3384			$$ = pool_opts;
3385		}
3386		;
3387
3388pool_opts_l	: pool_opts_l pool_opt
3389		| pool_opt
3390		;
3391
3392pool_opt	: BITMASK	{
3393			if (pool_opts.type) {
3394				yyerror("pool type cannot be redefined");
3395				YYERROR;
3396			}
3397			pool_opts.type =  PF_POOL_BITMASK;
3398		}
3399		| RANDOM	{
3400			if (pool_opts.type) {
3401				yyerror("pool type cannot be redefined");
3402				YYERROR;
3403			}
3404			pool_opts.type = PF_POOL_RANDOM;
3405		}
3406		| SOURCEHASH hashkey {
3407			if (pool_opts.type) {
3408				yyerror("pool type cannot be redefined");
3409				YYERROR;
3410			}
3411			pool_opts.type = PF_POOL_SRCHASH;
3412			pool_opts.key = $2;
3413		}
3414		| ROUNDROBIN	{
3415			if (pool_opts.type) {
3416				yyerror("pool type cannot be redefined");
3417				YYERROR;
3418			}
3419			pool_opts.type = PF_POOL_ROUNDROBIN;
3420		}
3421		| STATICPORT	{
3422			if (pool_opts.staticport) {
3423				yyerror("static-port cannot be redefined");
3424				YYERROR;
3425			}
3426			pool_opts.staticport = 1;
3427		}
3428		| STICKYADDRESS	{
3429			if (filter_opts.marker & POM_STICKYADDRESS) {
3430				yyerror("sticky-address cannot be redefined");
3431				YYERROR;
3432			}
3433			pool_opts.marker |= POM_STICKYADDRESS;
3434			pool_opts.opts |= PF_POOL_STICKYADDR;
3435		}
3436		;
3437
3438redirection	: /* empty */			{ $$ = NULL; }
3439		| ARROW host			{
3440			$$ = calloc(1, sizeof(struct redirection));
3441			if ($$ == NULL)
3442				err(1, "redirection: calloc");
3443			$$->host = $2;
3444			$$->rport.a = $$->rport.b = $$->rport.t = 0;
3445		}
3446		| ARROW host PORT rport	{
3447			$$ = calloc(1, sizeof(struct redirection));
3448			if ($$ == NULL)
3449				err(1, "redirection: calloc");
3450			$$->host = $2;
3451			$$->rport = $4;
3452		}
3453		;
3454
3455/* ifdef __FreeBSD__ */
3456natpass		: /* empty */	{ $$.b1 = $$.b2 = 0; $$.w2 = 0; }
3457		| PASS		{ $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; }
3458/* else
3459natpass		:  empty 	{ $$.b1 = $$.b2 = 0; }
3460		| PASS		{ $$.b1 = 1; $$.b2 = 0; }
3461 * endif */
3462		| PASS log	{ $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; }
3463		;
3464
3465nataction	: no NAT natpass {
3466			if ($1 && $3.b1) {
3467				yyerror("\"pass\" not valid with \"no\"");
3468				YYERROR;
3469			}
3470			if ($1)
3471				$$.b1 = PF_NONAT;
3472			else
3473				$$.b1 = PF_NAT;
3474			$$.b2 = $3.b1;
3475			$$.w = $3.b2;
3476			$$.w2 = $3.w2;
3477		}
3478		| no RDR natpass {
3479			if ($1 && $3.b1) {
3480				yyerror("\"pass\" not valid with \"no\"");
3481				YYERROR;
3482			}
3483			if ($1)
3484				$$.b1 = PF_NORDR;
3485			else
3486				$$.b1 = PF_RDR;
3487			$$.b2 = $3.b1;
3488			$$.w = $3.b2;
3489			$$.w2 = $3.w2;
3490		}
3491		;
3492
3493natrule		: nataction interface af proto fromto tag tagged rtable
3494		    redirpool pool_opts
3495		{
3496			struct pf_rule	r;
3497
3498			if (check_rulestate(PFCTL_STATE_NAT))
3499				YYERROR;
3500
3501			memset(&r, 0, sizeof(r));
3502
3503			r.action = $1.b1;
3504			r.natpass = $1.b2;
3505			r.log = $1.w;
3506			r.logif = $1.w2;
3507			r.af = $3;
3508
3509			if (!r.af) {
3510				if ($5.src.host && $5.src.host->af &&
3511				    !$5.src.host->ifindex)
3512					r.af = $5.src.host->af;
3513				else if ($5.dst.host && $5.dst.host->af &&
3514				    !$5.dst.host->ifindex)
3515					r.af = $5.dst.host->af;
3516			}
3517
3518			if ($6 != NULL)
3519				if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
3520				    PF_TAG_NAME_SIZE) {
3521					yyerror("tag too long, max %u chars",
3522					    PF_TAG_NAME_SIZE - 1);
3523					YYERROR;
3524				}
3525
3526			if ($7.name)
3527				if (strlcpy(r.match_tagname, $7.name,
3528				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
3529					yyerror("tag too long, max %u chars",
3530					    PF_TAG_NAME_SIZE - 1);
3531					YYERROR;
3532				}
3533			r.match_tag_not = $7.neg;
3534			r.rtableid = $8;
3535
3536			if (r.action == PF_NONAT || r.action == PF_NORDR) {
3537				if ($9 != NULL) {
3538					yyerror("translation rule with 'no' "
3539					    "does not need '->'");
3540					YYERROR;
3541				}
3542			} else {
3543				if ($9 == NULL || $9->host == NULL) {
3544					yyerror("translation rule requires '-> "
3545					    "address'");
3546					YYERROR;
3547				}
3548				if (!r.af && ! $9->host->ifindex)
3549					r.af = $9->host->af;
3550
3551				remove_invalid_hosts(&$9->host, &r.af);
3552				if (invalid_redirect($9->host, r.af))
3553					YYERROR;
3554				if (check_netmask($9->host, r.af))
3555					YYERROR;
3556
3557				r.rpool.proxy_port[0] = ntohs($9->rport.a);
3558
3559				switch (r.action) {
3560				case PF_RDR:
3561					if (!$9->rport.b && $9->rport.t &&
3562					    $5.dst.port != NULL) {
3563						r.rpool.proxy_port[1] =
3564						    ntohs($9->rport.a) +
3565						    (ntohs(
3566						    $5.dst.port->port[1]) -
3567						    ntohs(
3568						    $5.dst.port->port[0]));
3569					} else
3570						r.rpool.proxy_port[1] =
3571						    ntohs($9->rport.b);
3572					break;
3573				case PF_NAT:
3574					r.rpool.proxy_port[1] =
3575					    ntohs($9->rport.b);
3576					if (!r.rpool.proxy_port[0] &&
3577					    !r.rpool.proxy_port[1]) {
3578						r.rpool.proxy_port[0] =
3579						    PF_NAT_PROXY_PORT_LOW;
3580						r.rpool.proxy_port[1] =
3581						    PF_NAT_PROXY_PORT_HIGH;
3582					} else if (!r.rpool.proxy_port[1])
3583						r.rpool.proxy_port[1] =
3584						    r.rpool.proxy_port[0];
3585					break;
3586				default:
3587					break;
3588				}
3589
3590				r.rpool.opts = $10.type;
3591				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
3592				    PF_POOL_NONE && ($9->host->next != NULL ||
3593				    $9->host->addr.type == PF_ADDR_TABLE ||
3594				    DYNIF_MULTIADDR($9->host->addr)))
3595					r.rpool.opts = PF_POOL_ROUNDROBIN;
3596				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
3597				    PF_POOL_ROUNDROBIN &&
3598				    disallow_table($9->host, "tables are only "
3599				    "supported in round-robin redirection "
3600				    "pools"))
3601					YYERROR;
3602				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
3603				    PF_POOL_ROUNDROBIN &&
3604				    disallow_alias($9->host, "interface (%s) "
3605				    "is only supported in round-robin "
3606				    "redirection pools"))
3607					YYERROR;
3608				if ($9->host->next != NULL) {
3609					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
3610					    PF_POOL_ROUNDROBIN) {
3611						yyerror("only round-robin "
3612						    "valid for multiple "
3613						    "redirection addresses");
3614						YYERROR;
3615					}
3616				}
3617			}
3618
3619			if ($10.key != NULL)
3620				memcpy(&r.rpool.key, $10.key,
3621				    sizeof(struct pf_poolhashkey));
3622
3623			 if ($10.opts)
3624				r.rpool.opts |= $10.opts;
3625
3626			if ($10.staticport) {
3627				if (r.action != PF_NAT) {
3628					yyerror("the 'static-port' option is "
3629					    "only valid with nat rules");
3630					YYERROR;
3631				}
3632				if (r.rpool.proxy_port[0] !=
3633				    PF_NAT_PROXY_PORT_LOW &&
3634				    r.rpool.proxy_port[1] !=
3635				    PF_NAT_PROXY_PORT_HIGH) {
3636					yyerror("the 'static-port' option can't"
3637					    " be used when specifying a port"
3638					    " range");
3639					YYERROR;
3640				}
3641				r.rpool.proxy_port[0] = 0;
3642				r.rpool.proxy_port[1] = 0;
3643			}
3644
3645			expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4,
3646			    $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
3647			    $5.dst.port, 0, 0, 0, "");
3648			free($9);
3649		}
3650		;
3651
3652binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
3653		    tagged rtable redirection
3654		{
3655			struct pf_rule		binat;
3656			struct pf_pooladdr	*pa;
3657
3658			if (check_rulestate(PFCTL_STATE_NAT))
3659				YYERROR;
3660			if (disallow_urpf_failed($10, "\"urpf-failed\" is not "
3661			    "permitted as a binat destination"))
3662				YYERROR;
3663
3664			memset(&binat, 0, sizeof(binat));
3665
3666			if ($1 && $3.b1) {
3667				yyerror("\"pass\" not valid with \"no\"");
3668				YYERROR;
3669			}
3670			if ($1)
3671				binat.action = PF_NOBINAT;
3672			else
3673				binat.action = PF_BINAT;
3674			binat.natpass = $3.b1;
3675			binat.log = $3.b2;
3676			binat.logif = $3.w2;
3677			binat.af = $5;
3678			if (!binat.af && $8 != NULL && $8->af)
3679				binat.af = $8->af;
3680			if (!binat.af && $10 != NULL && $10->af)
3681				binat.af = $10->af;
3682
3683			if (!binat.af && $14 != NULL && $14->host)
3684				binat.af = $14->host->af;
3685			if (!binat.af) {
3686				yyerror("address family (inet/inet6) "
3687				    "undefined");
3688				YYERROR;
3689			}
3690
3691			if ($4 != NULL) {
3692				memcpy(binat.ifname, $4->ifname,
3693				    sizeof(binat.ifname));
3694				binat.ifnot = $4->not;
3695				free($4);
3696			}
3697
3698			if ($11 != NULL)
3699				if (strlcpy(binat.tagname, $11,
3700				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
3701					yyerror("tag too long, max %u chars",
3702					    PF_TAG_NAME_SIZE - 1);
3703					YYERROR;
3704				}
3705			if ($12.name)
3706				if (strlcpy(binat.match_tagname, $12.name,
3707				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
3708					yyerror("tag too long, max %u chars",
3709					    PF_TAG_NAME_SIZE - 1);
3710					YYERROR;
3711				}
3712			binat.match_tag_not = $12.neg;
3713			binat.rtableid = $13;
3714
3715			if ($6 != NULL) {
3716				binat.proto = $6->proto;
3717				free($6);
3718			}
3719
3720			if ($8 != NULL && disallow_table($8, "invalid use of "
3721			    "table <%s> as the source address of a binat rule"))
3722				YYERROR;
3723			if ($8 != NULL && disallow_alias($8, "invalid use of "
3724			    "interface (%s) as the source address of a binat "
3725			    "rule"))
3726				YYERROR;
3727			if ($14 != NULL && $14->host != NULL && disallow_table(
3728			    $14->host, "invalid use of table <%s> as the "
3729			    "redirect address of a binat rule"))
3730				YYERROR;
3731			if ($14 != NULL && $14->host != NULL && disallow_alias(
3732			    $14->host, "invalid use of interface (%s) as the "
3733			    "redirect address of a binat rule"))
3734				YYERROR;
3735
3736			if ($8 != NULL) {
3737				if ($8->next) {
3738					yyerror("multiple binat ip addresses");
3739					YYERROR;
3740				}
3741				if ($8->addr.type == PF_ADDR_DYNIFTL)
3742					$8->af = binat.af;
3743				if ($8->af != binat.af) {
3744					yyerror("binat ip versions must match");
3745					YYERROR;
3746				}
3747				if (check_netmask($8, binat.af))
3748					YYERROR;
3749				memcpy(&binat.src.addr, &$8->addr,
3750				    sizeof(binat.src.addr));
3751				free($8);
3752			}
3753			if ($10 != NULL) {
3754				if ($10->next) {
3755					yyerror("multiple binat ip addresses");
3756					YYERROR;
3757				}
3758				if ($10->af != binat.af && $10->af) {
3759					yyerror("binat ip versions must match");
3760					YYERROR;
3761				}
3762				if (check_netmask($10, binat.af))
3763					YYERROR;
3764				memcpy(&binat.dst.addr, &$10->addr,
3765				    sizeof(binat.dst.addr));
3766				binat.dst.neg = $10->not;
3767				free($10);
3768			}
3769
3770			if (binat.action == PF_NOBINAT) {
3771				if ($14 != NULL) {
3772					yyerror("'no binat' rule does not need"
3773					    " '->'");
3774					YYERROR;
3775				}
3776			} else {
3777				if ($14 == NULL || $14->host == NULL) {
3778					yyerror("'binat' rule requires"
3779					    " '-> address'");
3780					YYERROR;
3781				}
3782
3783				remove_invalid_hosts(&$14->host, &binat.af);
3784				if (invalid_redirect($14->host, binat.af))
3785					YYERROR;
3786				if ($14->host->next != NULL) {
3787					yyerror("binat rule must redirect to "
3788					    "a single address");
3789					YYERROR;
3790				}
3791				if (check_netmask($14->host, binat.af))
3792					YYERROR;
3793
3794				if (!PF_AZERO(&binat.src.addr.v.a.mask,
3795				    binat.af) &&
3796				    !PF_AEQ(&binat.src.addr.v.a.mask,
3797				    &$14->host->addr.v.a.mask, binat.af)) {
3798					yyerror("'binat' source mask and "
3799					    "redirect mask must be the same");
3800					YYERROR;
3801				}
3802
3803				TAILQ_INIT(&binat.rpool.list);
3804				pa = calloc(1, sizeof(struct pf_pooladdr));
3805				if (pa == NULL)
3806					err(1, "binat: calloc");
3807				pa->addr = $14->host->addr;
3808				pa->ifname[0] = 0;
3809				TAILQ_INSERT_TAIL(&binat.rpool.list,
3810				    pa, entries);
3811
3812				free($14);
3813			}
3814
3815			pfctl_add_rule(pf, &binat, "");
3816		}
3817		;
3818
3819tag		: /* empty */		{ $$ = NULL; }
3820		| TAG STRING		{ $$ = $2; }
3821		;
3822
3823tagged		: /* empty */		{ $$.neg = 0; $$.name = NULL; }
3824		| not TAGGED string	{ $$.neg = $1; $$.name = $3; }
3825		;
3826
3827rtable		: /* empty */		{ $$ = -1; }
3828		| RTABLE number		{
3829#ifdef __FreeBSD__
3830			yyerror("rtable id not supported in FreeBSD, yet");
3831			YYERROR;
3832#else
3833			if ($2 > RT_TABLEID_MAX || $2 < 0) {
3834				yyerror("invalid rtable id");
3835				YYERROR;
3836			}
3837			$$ = $2;
3838#endif
3839		}
3840		;
3841
3842route_host	: STRING			{
3843			$$ = calloc(1, sizeof(struct node_host));
3844			if ($$ == NULL)
3845				err(1, "route_host: calloc");
3846			$$->ifname = $1;
3847			set_ipmask($$, 128);
3848			$$->next = NULL;
3849			$$->tail = $$;
3850		}
3851		| '(' STRING host ')'		{
3852			$$ = $3;
3853			$$->ifname = $2;
3854		}
3855		;
3856
3857route_host_list	: route_host				{ $$ = $1; }
3858		| route_host_list comma route_host	{
3859			if ($1->af == 0)
3860				$1->af = $3->af;
3861			if ($1->af != $3->af) {
3862				yyerror("all pool addresses must be in the "
3863				    "same address family");
3864				YYERROR;
3865			}
3866			$1->tail->next = $3;
3867			$1->tail = $3->tail;
3868			$$ = $1;
3869		}
3870		;
3871
3872routespec	: route_host			{ $$ = $1; }
3873		| '{' route_host_list '}'	{ $$ = $2; }
3874		;
3875
3876route		: /* empty */			{
3877			$$.host = NULL;
3878			$$.rt = 0;
3879			$$.pool_opts = 0;
3880		}
3881		| FASTROUTE {
3882			$$.host = NULL;
3883			$$.rt = PF_FASTROUTE;
3884			$$.pool_opts = 0;
3885		}
3886		| ROUTETO routespec pool_opts {
3887			$$.host = $2;
3888			$$.rt = PF_ROUTETO;
3889			$$.pool_opts = $3.type | $3.opts;
3890			if ($3.key != NULL)
3891				$$.key = $3.key;
3892		}
3893		| REPLYTO routespec pool_opts {
3894			$$.host = $2;
3895			$$.rt = PF_REPLYTO;
3896			$$.pool_opts = $3.type | $3.opts;
3897			if ($3.key != NULL)
3898				$$.key = $3.key;
3899		}
3900		| DUPTO routespec pool_opts {
3901			$$.host = $2;
3902			$$.rt = PF_DUPTO;
3903			$$.pool_opts = $3.type | $3.opts;
3904			if ($3.key != NULL)
3905				$$.key = $3.key;
3906		}
3907		;
3908
3909timeout_spec	: STRING number
3910		{
3911			if (check_rulestate(PFCTL_STATE_OPTION)) {
3912				free($1);
3913				YYERROR;
3914			}
3915			if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
3916				yyerror("unknown timeout %s", $1);
3917				free($1);
3918				YYERROR;
3919			}
3920			free($1);
3921		}
3922		;
3923
3924timeout_list	: timeout_list comma timeout_spec
3925		| timeout_spec
3926		;
3927
3928limit_spec	: STRING number
3929		{
3930			if (check_rulestate(PFCTL_STATE_OPTION)) {
3931				free($1);
3932				YYERROR;
3933			}
3934			if (pfctl_set_limit(pf, $1, $2) != 0) {
3935				yyerror("unable to set limit %s %u", $1, $2);
3936				free($1);
3937				YYERROR;
3938			}
3939			free($1);
3940		}
3941		;
3942
3943limit_list	: limit_list comma limit_spec
3944		| limit_spec
3945		;
3946
3947comma		: ','
3948		| /* empty */
3949		;
3950
3951yesno		: NO			{ $$ = 0; }
3952		| STRING		{
3953			if (!strcmp($1, "yes"))
3954				$$ = 1;
3955			else {
3956				yyerror("invalid value '%s', expected 'yes' "
3957				    "or 'no'", $1);
3958				free($1);
3959				YYERROR;
3960			}
3961			free($1);
3962		}
3963		;
3964
3965unaryop		: '='		{ $$ = PF_OP_EQ; }
3966		| '!' '='	{ $$ = PF_OP_NE; }
3967		| '<' '='	{ $$ = PF_OP_LE; }
3968		| '<'		{ $$ = PF_OP_LT; }
3969		| '>' '='	{ $$ = PF_OP_GE; }
3970		| '>'		{ $$ = PF_OP_GT; }
3971		;
3972
3973%%
3974
3975int
3976yyerror(const char *fmt, ...)
3977{
3978	va_list		 ap;
3979	extern char	*infile;
3980
3981	errors = 1;
3982	va_start(ap, fmt);
3983	fprintf(stderr, "%s:%d: ", infile, yylval.lineno);
3984	vfprintf(stderr, fmt, ap);
3985	fprintf(stderr, "\n");
3986	va_end(ap);
3987	return (0);
3988}
3989
3990int
3991disallow_table(struct node_host *h, const char *fmt)
3992{
3993	for (; h != NULL; h = h->next)
3994		if (h->addr.type == PF_ADDR_TABLE) {
3995			yyerror(fmt, h->addr.v.tblname);
3996			return (1);
3997		}
3998	return (0);
3999}
4000
4001int
4002disallow_urpf_failed(struct node_host *h, const char *fmt)
4003{
4004	for (; h != NULL; h = h->next)
4005		if (h->addr.type == PF_ADDR_URPFFAILED) {
4006			yyerror(fmt);
4007			return (1);
4008		}
4009	return (0);
4010}
4011
4012int
4013disallow_alias(struct node_host *h, const char *fmt)
4014{
4015	for (; h != NULL; h = h->next)
4016		if (DYNIF_MULTIADDR(h->addr)) {
4017			yyerror(fmt, h->addr.v.tblname);
4018			return (1);
4019		}
4020	return (0);
4021}
4022
4023int
4024rule_consistent(struct pf_rule *r, int anchor_call)
4025{
4026	int	problems = 0;
4027
4028	switch (r->action) {
4029	case PF_PASS:
4030	case PF_DROP:
4031	case PF_SCRUB:
4032	case PF_NOSCRUB:
4033		problems = filter_consistent(r, anchor_call);
4034		break;
4035	case PF_NAT:
4036	case PF_NONAT:
4037		problems = nat_consistent(r);
4038		break;
4039	case PF_RDR:
4040	case PF_NORDR:
4041		problems = rdr_consistent(r);
4042		break;
4043	case PF_BINAT:
4044	case PF_NOBINAT:
4045	default:
4046		break;
4047	}
4048	return (problems);
4049}
4050
4051int
4052filter_consistent(struct pf_rule *r, int anchor_call)
4053{
4054	int	problems = 0;
4055
4056	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
4057	    (r->src.port_op || r->dst.port_op)) {
4058		yyerror("port only applies to tcp/udp");
4059		problems++;
4060	}
4061	if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
4062	    (r->type || r->code)) {
4063		yyerror("icmp-type/code only applies to icmp");
4064		problems++;
4065	}
4066	if (!r->af && (r->type || r->code)) {
4067		yyerror("must indicate address family with icmp-type/code");
4068		problems++;
4069	}
4070	if (r->overload_tblname[0] &&
4071	    r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
4072		yyerror("'overload' requires 'max-src-conn' "
4073		    "or 'max-src-conn-rate'");
4074		problems++;
4075	}
4076	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
4077	    (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
4078		yyerror("proto %s doesn't match address family %s",
4079		    r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
4080		    r->af == AF_INET ? "inet" : "inet6");
4081		problems++;
4082	}
4083	if (r->allow_opts && r->action != PF_PASS) {
4084		yyerror("allow-opts can only be specified for pass rules");
4085		problems++;
4086	}
4087	if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
4088	    r->dst.port_op || r->flagset || r->type || r->code)) {
4089		yyerror("fragments can be filtered only on IP header fields");
4090		problems++;
4091	}
4092	if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
4093		yyerror("return-rst can only be applied to TCP rules");
4094		problems++;
4095	}
4096	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
4097		yyerror("max-src-nodes requires 'source-track rule'");
4098		problems++;
4099	}
4100	if (r->action == PF_DROP && r->keep_state) {
4101		yyerror("keep state on block rules doesn't make sense");
4102		problems++;
4103	}
4104	return (-problems);
4105}
4106
4107int
4108nat_consistent(struct pf_rule *r)
4109{
4110	return (0);	/* yeah! */
4111}
4112
4113int
4114rdr_consistent(struct pf_rule *r)
4115{
4116	int			 problems = 0;
4117
4118	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
4119		if (r->src.port_op) {
4120			yyerror("src port only applies to tcp/udp");
4121			problems++;
4122		}
4123		if (r->dst.port_op) {
4124			yyerror("dst port only applies to tcp/udp");
4125			problems++;
4126		}
4127		if (r->rpool.proxy_port[0]) {
4128			yyerror("rpool port only applies to tcp/udp");
4129			problems++;
4130		}
4131	}
4132	if (r->dst.port_op &&
4133	    r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
4134		yyerror("invalid port operator for rdr destination port");
4135		problems++;
4136	}
4137	return (-problems);
4138}
4139
4140int
4141process_tabledef(char *name, struct table_opts *opts)
4142{
4143	struct pfr_buffer	 ab;
4144	struct node_tinit	*ti;
4145
4146	bzero(&ab, sizeof(ab));
4147	ab.pfrb_type = PFRB_ADDRS;
4148	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
4149		if (ti->file)
4150			if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
4151				if (errno)
4152					yyerror("cannot load \"%s\": %s",
4153					    ti->file, strerror(errno));
4154				else
4155					yyerror("file \"%s\" contains bad data",
4156					    ti->file);
4157				goto _error;
4158			}
4159		if (ti->host)
4160			if (append_addr_host(&ab, ti->host, 0, 0)) {
4161				yyerror("cannot create address buffer: %s",
4162				    strerror(errno));
4163				goto _error;
4164			}
4165	}
4166	if (pf->opts & PF_OPT_VERBOSE)
4167		print_tabledef(name, opts->flags, opts->init_addr,
4168		    &opts->init_nodes);
4169	if (!(pf->opts & PF_OPT_NOACTION) &&
4170	    pfctl_define_table(name, opts->flags, opts->init_addr,
4171	    pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) {
4172		yyerror("cannot define table %s: %s", name,
4173		    pfr_strerror(errno));
4174		goto _error;
4175	}
4176	pf->tdirty = 1;
4177	pfr_buf_clear(&ab);
4178	return (0);
4179_error:
4180	pfr_buf_clear(&ab);
4181	return (-1);
4182}
4183
4184struct keywords {
4185	const char	*k_name;
4186	int		 k_val;
4187};
4188
4189/* macro gore, but you should've seen the prior indentation nightmare... */
4190
4191#define FREE_LIST(T,r) \
4192	do { \
4193		T *p, *node = r; \
4194		while (node != NULL) { \
4195			p = node; \
4196			node = node->next; \
4197			free(p); \
4198		} \
4199	} while (0)
4200
4201#define LOOP_THROUGH(T,n,r,C) \
4202	do { \
4203		T *n; \
4204		if (r == NULL) { \
4205			r = calloc(1, sizeof(T)); \
4206			if (r == NULL) \
4207				err(1, "LOOP: calloc"); \
4208			r->next = NULL; \
4209		} \
4210		n = r; \
4211		while (n != NULL) { \
4212			do { \
4213				C; \
4214			} while (0); \
4215			n = n->next; \
4216		} \
4217	} while (0)
4218
4219void
4220expand_label_str(char *label, size_t len, const char *srch, const char *repl)
4221{
4222	char *tmp;
4223	char *p, *q;
4224
4225	if ((tmp = calloc(1, len)) == NULL)
4226		err(1, "expand_label_str: calloc");
4227	p = q = label;
4228	while ((q = strstr(p, srch)) != NULL) {
4229		*q = '\0';
4230		if ((strlcat(tmp, p, len) >= len) ||
4231		    (strlcat(tmp, repl, len) >= len))
4232			errx(1, "expand_label: label too long");
4233		q += strlen(srch);
4234		p = q;
4235	}
4236	if (strlcat(tmp, p, len) >= len)
4237		errx(1, "expand_label: label too long");
4238	strlcpy(label, tmp, len);	/* always fits */
4239	free(tmp);
4240}
4241
4242void
4243expand_label_if(const char *name, char *label, size_t len, const char *ifname)
4244{
4245	if (strstr(label, name) != NULL) {
4246		if (!*ifname)
4247			expand_label_str(label, len, name, "any");
4248		else
4249			expand_label_str(label, len, name, ifname);
4250	}
4251}
4252
4253void
4254expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
4255    struct node_host *h)
4256{
4257	char tmp[64], tmp_not[66];
4258
4259	if (strstr(label, name) != NULL) {
4260		switch (h->addr.type) {
4261		case PF_ADDR_DYNIFTL:
4262			snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
4263			break;
4264		case PF_ADDR_TABLE:
4265			snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
4266			break;
4267		case PF_ADDR_NOROUTE:
4268			snprintf(tmp, sizeof(tmp), "no-route");
4269			break;
4270		case PF_ADDR_URPFFAILED:
4271			snprintf(tmp, sizeof(tmp), "urpf-failed");
4272			break;
4273		case PF_ADDR_ADDRMASK:
4274			if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
4275			    PF_AZERO(&h->addr.v.a.mask, af)))
4276				snprintf(tmp, sizeof(tmp), "any");
4277			else {
4278				char	a[48];
4279				int	bits;
4280
4281				if (inet_ntop(af, &h->addr.v.a.addr, a,
4282				    sizeof(a)) == NULL)
4283					snprintf(tmp, sizeof(tmp), "?");
4284				else {
4285					bits = unmask(&h->addr.v.a.mask, af);
4286					if ((af == AF_INET && bits < 32) ||
4287					    (af == AF_INET6 && bits < 128))
4288						snprintf(tmp, sizeof(tmp),
4289						    "%s/%d", a, bits);
4290					else
4291						snprintf(tmp, sizeof(tmp),
4292						    "%s", a);
4293				}
4294			}
4295			break;
4296		default:
4297			snprintf(tmp, sizeof(tmp), "?");
4298			break;
4299		}
4300
4301		if (h->not) {
4302			snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
4303			expand_label_str(label, len, name, tmp_not);
4304		} else
4305			expand_label_str(label, len, name, tmp);
4306	}
4307}
4308
4309void
4310expand_label_port(const char *name, char *label, size_t len,
4311    struct node_port *port)
4312{
4313	char	 a1[6], a2[6], op[13] = "";
4314
4315	if (strstr(label, name) != NULL) {
4316		snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
4317		snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
4318		if (!port->op)
4319			;
4320		else if (port->op == PF_OP_IRG)
4321			snprintf(op, sizeof(op), "%s><%s", a1, a2);
4322		else if (port->op == PF_OP_XRG)
4323			snprintf(op, sizeof(op), "%s<>%s", a1, a2);
4324		else if (port->op == PF_OP_EQ)
4325			snprintf(op, sizeof(op), "%s", a1);
4326		else if (port->op == PF_OP_NE)
4327			snprintf(op, sizeof(op), "!=%s", a1);
4328		else if (port->op == PF_OP_LT)
4329			snprintf(op, sizeof(op), "<%s", a1);
4330		else if (port->op == PF_OP_LE)
4331			snprintf(op, sizeof(op), "<=%s", a1);
4332		else if (port->op == PF_OP_GT)
4333			snprintf(op, sizeof(op), ">%s", a1);
4334		else if (port->op == PF_OP_GE)
4335			snprintf(op, sizeof(op), ">=%s", a1);
4336		expand_label_str(label, len, name, op);
4337	}
4338}
4339
4340void
4341expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
4342{
4343	struct protoent *pe;
4344	char n[4];
4345
4346	if (strstr(label, name) != NULL) {
4347		pe = getprotobynumber(proto);
4348		if (pe != NULL)
4349			expand_label_str(label, len, name, pe->p_name);
4350		else {
4351			snprintf(n, sizeof(n), "%u", proto);
4352			expand_label_str(label, len, name, n);
4353		}
4354	}
4355}
4356
4357void
4358expand_label_nr(const char *name, char *label, size_t len)
4359{
4360	char n[11];
4361
4362	if (strstr(label, name) != NULL) {
4363		snprintf(n, sizeof(n), "%u", pf->anchor->match);
4364		expand_label_str(label, len, name, n);
4365	}
4366}
4367
4368void
4369expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
4370    struct node_host *src_host, struct node_port *src_port,
4371    struct node_host *dst_host, struct node_port *dst_port,
4372    u_int8_t proto)
4373{
4374	expand_label_if("$if", label, len, ifname);
4375	expand_label_addr("$srcaddr", label, len, af, src_host);
4376	expand_label_addr("$dstaddr", label, len, af, dst_host);
4377	expand_label_port("$srcport", label, len, src_port);
4378	expand_label_port("$dstport", label, len, dst_port);
4379	expand_label_proto("$proto", label, len, proto);
4380	expand_label_nr("$nr", label, len);
4381}
4382
4383int
4384expand_altq(struct pf_altq *a, struct node_if *interfaces,
4385    struct node_queue *nqueues, struct node_queue_bw bwspec,
4386    struct node_queue_opt *opts)
4387{
4388	struct pf_altq		 pa, pb;
4389	char			 qname[PF_QNAME_SIZE];
4390	struct node_queue	*n;
4391	struct node_queue_bw	 bw;
4392	int			 errs = 0;
4393
4394	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
4395		FREE_LIST(struct node_if, interfaces);
4396		FREE_LIST(struct node_queue, nqueues);
4397		return (0);
4398	}
4399
4400	LOOP_THROUGH(struct node_if, interface, interfaces,
4401		memcpy(&pa, a, sizeof(struct pf_altq));
4402		if (strlcpy(pa.ifname, interface->ifname,
4403		    sizeof(pa.ifname)) >= sizeof(pa.ifname))
4404			errx(1, "expand_altq: strlcpy");
4405
4406		if (interface->not) {
4407			yyerror("altq on ! <interface> is not supported");
4408			errs++;
4409		} else {
4410			if (eval_pfaltq(pf, &pa, &bwspec, opts))
4411				errs++;
4412			else
4413				if (pfctl_add_altq(pf, &pa))
4414					errs++;
4415
4416			if (pf->opts & PF_OPT_VERBOSE) {
4417				print_altq(&pf->paltq->altq, 0,
4418				    &bwspec, opts);
4419				if (nqueues && nqueues->tail) {
4420					printf("queue { ");
4421					LOOP_THROUGH(struct node_queue, queue,
4422					    nqueues,
4423						printf("%s ",
4424						    queue->queue);
4425					);
4426					printf("}");
4427				}
4428				printf("\n");
4429			}
4430
4431			if (pa.scheduler == ALTQT_CBQ ||
4432			    pa.scheduler == ALTQT_HFSC) {
4433				/* now create a root queue */
4434				memset(&pb, 0, sizeof(struct pf_altq));
4435				if (strlcpy(qname, "root_", sizeof(qname)) >=
4436				    sizeof(qname))
4437					errx(1, "expand_altq: strlcpy");
4438				if (strlcat(qname, interface->ifname,
4439				    sizeof(qname)) >= sizeof(qname))
4440					errx(1, "expand_altq: strlcat");
4441				if (strlcpy(pb.qname, qname,
4442				    sizeof(pb.qname)) >= sizeof(pb.qname))
4443					errx(1, "expand_altq: strlcpy");
4444				if (strlcpy(pb.ifname, interface->ifname,
4445				    sizeof(pb.ifname)) >= sizeof(pb.ifname))
4446					errx(1, "expand_altq: strlcpy");
4447				pb.qlimit = pa.qlimit;
4448				pb.scheduler = pa.scheduler;
4449				bw.bw_absolute = pa.ifbandwidth;
4450				bw.bw_percent = 0;
4451				if (eval_pfqueue(pf, &pb, &bw, opts))
4452					errs++;
4453				else
4454					if (pfctl_add_altq(pf, &pb))
4455						errs++;
4456			}
4457
4458			LOOP_THROUGH(struct node_queue, queue, nqueues,
4459				n = calloc(1, sizeof(struct node_queue));
4460				if (n == NULL)
4461					err(1, "expand_altq: calloc");
4462				if (pa.scheduler == ALTQT_CBQ ||
4463				    pa.scheduler == ALTQT_HFSC)
4464					if (strlcpy(n->parent, qname,
4465					    sizeof(n->parent)) >=
4466					    sizeof(n->parent))
4467						errx(1, "expand_altq: strlcpy");
4468				if (strlcpy(n->queue, queue->queue,
4469				    sizeof(n->queue)) >= sizeof(n->queue))
4470					errx(1, "expand_altq: strlcpy");
4471				if (strlcpy(n->ifname, interface->ifname,
4472				    sizeof(n->ifname)) >= sizeof(n->ifname))
4473					errx(1, "expand_altq: strlcpy");
4474				n->scheduler = pa.scheduler;
4475				n->next = NULL;
4476				n->tail = n;
4477				if (queues == NULL)
4478					queues = n;
4479				else {
4480					queues->tail->next = n;
4481					queues->tail = n;
4482				}
4483			);
4484		}
4485	);
4486	FREE_LIST(struct node_if, interfaces);
4487	FREE_LIST(struct node_queue, nqueues);
4488
4489	return (errs);
4490}
4491
4492int
4493expand_queue(struct pf_altq *a, struct node_if *interfaces,
4494    struct node_queue *nqueues, struct node_queue_bw bwspec,
4495    struct node_queue_opt *opts)
4496{
4497	struct node_queue	*n, *nq;
4498	struct pf_altq		 pa;
4499	u_int8_t		 found = 0;
4500	u_int8_t		 errs = 0;
4501
4502	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
4503		FREE_LIST(struct node_queue, nqueues);
4504		return (0);
4505	}
4506
4507	if (queues == NULL) {
4508		yyerror("queue %s has no parent", a->qname);
4509		FREE_LIST(struct node_queue, nqueues);
4510		return (1);
4511	}
4512
4513	LOOP_THROUGH(struct node_if, interface, interfaces,
4514		LOOP_THROUGH(struct node_queue, tqueue, queues,
4515			if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
4516			    (interface->ifname[0] == 0 ||
4517			    (!interface->not && !strncmp(interface->ifname,
4518			    tqueue->ifname, IFNAMSIZ)) ||
4519			    (interface->not && strncmp(interface->ifname,
4520			    tqueue->ifname, IFNAMSIZ)))) {
4521				/* found ourself in queues */
4522				found++;
4523
4524				memcpy(&pa, a, sizeof(struct pf_altq));
4525
4526				if (pa.scheduler != ALTQT_NONE &&
4527				    pa.scheduler != tqueue->scheduler) {
4528					yyerror("exactly one scheduler type "
4529					    "per interface allowed");
4530					return (1);
4531				}
4532				pa.scheduler = tqueue->scheduler;
4533
4534				/* scheduler dependent error checking */
4535				switch (pa.scheduler) {
4536				case ALTQT_PRIQ:
4537					if (nqueues != NULL) {
4538						yyerror("priq queues cannot "
4539						    "have child queues");
4540						return (1);
4541					}
4542					if (bwspec.bw_absolute > 0 ||
4543					    bwspec.bw_percent < 100) {
4544						yyerror("priq doesn't take "
4545						    "bandwidth");
4546						return (1);
4547					}
4548					break;
4549				default:
4550					break;
4551				}
4552
4553				if (strlcpy(pa.ifname, tqueue->ifname,
4554				    sizeof(pa.ifname)) >= sizeof(pa.ifname))
4555					errx(1, "expand_queue: strlcpy");
4556				if (strlcpy(pa.parent, tqueue->parent,
4557				    sizeof(pa.parent)) >= sizeof(pa.parent))
4558					errx(1, "expand_queue: strlcpy");
4559
4560				if (eval_pfqueue(pf, &pa, &bwspec, opts))
4561					errs++;
4562				else
4563					if (pfctl_add_altq(pf, &pa))
4564						errs++;
4565
4566				for (nq = nqueues; nq != NULL; nq = nq->next) {
4567					if (!strcmp(a->qname, nq->queue)) {
4568						yyerror("queue cannot have "
4569						    "itself as child");
4570						errs++;
4571						continue;
4572					}
4573					n = calloc(1,
4574					    sizeof(struct node_queue));
4575					if (n == NULL)
4576						err(1, "expand_queue: calloc");
4577					if (strlcpy(n->parent, a->qname,
4578					    sizeof(n->parent)) >=
4579					    sizeof(n->parent))
4580						errx(1, "expand_queue strlcpy");
4581					if (strlcpy(n->queue, nq->queue,
4582					    sizeof(n->queue)) >=
4583					    sizeof(n->queue))
4584						errx(1, "expand_queue strlcpy");
4585					if (strlcpy(n->ifname, tqueue->ifname,
4586					    sizeof(n->ifname)) >=
4587					    sizeof(n->ifname))
4588						errx(1, "expand_queue strlcpy");
4589					n->scheduler = tqueue->scheduler;
4590					n->next = NULL;
4591					n->tail = n;
4592					if (queues == NULL)
4593						queues = n;
4594					else {
4595						queues->tail->next = n;
4596						queues->tail = n;
4597					}
4598				}
4599				if ((pf->opts & PF_OPT_VERBOSE) && (
4600				    (found == 1 && interface->ifname[0] == 0) ||
4601				    (found > 0 && interface->ifname[0] != 0))) {
4602					print_queue(&pf->paltq->altq, 0,
4603					    &bwspec, interface->ifname[0] != 0,
4604					    opts);
4605					if (nqueues && nqueues->tail) {
4606						printf("{ ");
4607						LOOP_THROUGH(struct node_queue,
4608						    queue, nqueues,
4609							printf("%s ",
4610							    queue->queue);
4611						);
4612						printf("}");
4613					}
4614					printf("\n");
4615				}
4616			}
4617		);
4618	);
4619
4620	FREE_LIST(struct node_queue, nqueues);
4621	FREE_LIST(struct node_if, interfaces);
4622
4623	if (!found) {
4624		yyerror("queue %s has no parent", a->qname);
4625		errs++;
4626	}
4627
4628	if (errs)
4629		return (1);
4630	else
4631		return (0);
4632}
4633
4634void
4635expand_rule(struct pf_rule *r,
4636    struct node_if *interfaces, struct node_host *rpool_hosts,
4637    struct node_proto *protos, struct node_os *src_oses,
4638    struct node_host *src_hosts, struct node_port *src_ports,
4639    struct node_host *dst_hosts, struct node_port *dst_ports,
4640    struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types,
4641    const char *anchor_call)
4642{
4643	sa_family_t		 af = r->af;
4644	int			 added = 0, error = 0;
4645	char			 ifname[IF_NAMESIZE];
4646	char			 label[PF_RULE_LABEL_SIZE];
4647	char			 tagname[PF_TAG_NAME_SIZE];
4648	char			 match_tagname[PF_TAG_NAME_SIZE];
4649	struct pf_pooladdr	*pa;
4650	struct node_host	*h;
4651	u_int8_t		 flags, flagset, keep_state;
4652
4653	if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
4654		errx(1, "expand_rule: strlcpy");
4655	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
4656		errx(1, "expand_rule: strlcpy");
4657	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
4658	    sizeof(match_tagname))
4659		errx(1, "expand_rule: strlcpy");
4660	flags = r->flags;
4661	flagset = r->flagset;
4662	keep_state = r->keep_state;
4663
4664	LOOP_THROUGH(struct node_if, interface, interfaces,
4665	LOOP_THROUGH(struct node_proto, proto, protos,
4666	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
4667	LOOP_THROUGH(struct node_host, src_host, src_hosts,
4668	LOOP_THROUGH(struct node_port, src_port, src_ports,
4669	LOOP_THROUGH(struct node_os, src_os, src_oses,
4670	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
4671	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
4672	LOOP_THROUGH(struct node_uid, uid, uids,
4673	LOOP_THROUGH(struct node_gid, gid, gids,
4674
4675		r->af = af;
4676		/* for link-local IPv6 address, interface must match up */
4677		if ((r->af && src_host->af && r->af != src_host->af) ||
4678		    (r->af && dst_host->af && r->af != dst_host->af) ||
4679		    (src_host->af && dst_host->af &&
4680		    src_host->af != dst_host->af) ||
4681		    (src_host->ifindex && dst_host->ifindex &&
4682		    src_host->ifindex != dst_host->ifindex) ||
4683		    (src_host->ifindex && *interface->ifname &&
4684		    src_host->ifindex != if_nametoindex(interface->ifname)) ||
4685		    (dst_host->ifindex && *interface->ifname &&
4686		    dst_host->ifindex != if_nametoindex(interface->ifname)))
4687			continue;
4688		if (!r->af && src_host->af)
4689			r->af = src_host->af;
4690		else if (!r->af && dst_host->af)
4691			r->af = dst_host->af;
4692
4693		if (*interface->ifname)
4694			strlcpy(r->ifname, interface->ifname,
4695			    sizeof(r->ifname));
4696		else if (if_indextoname(src_host->ifindex, ifname))
4697			strlcpy(r->ifname, ifname, sizeof(r->ifname));
4698		else if (if_indextoname(dst_host->ifindex, ifname))
4699			strlcpy(r->ifname, ifname, sizeof(r->ifname));
4700		else
4701			memset(r->ifname, '\0', sizeof(r->ifname));
4702
4703		if (strlcpy(r->label, label, sizeof(r->label)) >=
4704		    sizeof(r->label))
4705			errx(1, "expand_rule: strlcpy");
4706		if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
4707		    sizeof(r->tagname))
4708			errx(1, "expand_rule: strlcpy");
4709		if (strlcpy(r->match_tagname, match_tagname,
4710		    sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
4711			errx(1, "expand_rule: strlcpy");
4712		expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
4713		    src_host, src_port, dst_host, dst_port, proto->proto);
4714		expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
4715		    src_host, src_port, dst_host, dst_port, proto->proto);
4716		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
4717		    r->af, src_host, src_port, dst_host, dst_port,
4718		    proto->proto);
4719
4720		error += check_netmask(src_host, r->af);
4721		error += check_netmask(dst_host, r->af);
4722
4723		r->ifnot = interface->not;
4724		r->proto = proto->proto;
4725		r->src.addr = src_host->addr;
4726		r->src.neg = src_host->not;
4727		r->src.port[0] = src_port->port[0];
4728		r->src.port[1] = src_port->port[1];
4729		r->src.port_op = src_port->op;
4730		r->dst.addr = dst_host->addr;
4731		r->dst.neg = dst_host->not;
4732		r->dst.port[0] = dst_port->port[0];
4733		r->dst.port[1] = dst_port->port[1];
4734		r->dst.port_op = dst_port->op;
4735		r->uid.op = uid->op;
4736		r->uid.uid[0] = uid->uid[0];
4737		r->uid.uid[1] = uid->uid[1];
4738		r->gid.op = gid->op;
4739		r->gid.gid[0] = gid->gid[0];
4740		r->gid.gid[1] = gid->gid[1];
4741		r->type = icmp_type->type;
4742		r->code = icmp_type->code;
4743
4744		if ((keep_state == PF_STATE_MODULATE ||
4745		    keep_state == PF_STATE_SYNPROXY) &&
4746		    r->proto && r->proto != IPPROTO_TCP)
4747			r->keep_state = PF_STATE_NORMAL;
4748		else
4749			r->keep_state = keep_state;
4750
4751		if (r->proto && r->proto != IPPROTO_TCP) {
4752			r->flags = 0;
4753			r->flagset = 0;
4754		} else {
4755			r->flags = flags;
4756			r->flagset = flagset;
4757		}
4758		if (icmp_type->proto && r->proto != icmp_type->proto) {
4759			yyerror("icmp-type mismatch");
4760			error++;
4761		}
4762
4763		if (src_os && src_os->os) {
4764			r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
4765			if ((pf->opts & PF_OPT_VERBOSE2) &&
4766			    r->os_fingerprint == PF_OSFP_NOMATCH)
4767				fprintf(stderr,
4768				    "warning: unknown '%s' OS fingerprint\n",
4769				    src_os->os);
4770		} else {
4771			r->os_fingerprint = PF_OSFP_ANY;
4772		}
4773
4774		TAILQ_INIT(&r->rpool.list);
4775		for (h = rpool_hosts; h != NULL; h = h->next) {
4776			pa = calloc(1, sizeof(struct pf_pooladdr));
4777			if (pa == NULL)
4778				err(1, "expand_rule: calloc");
4779			pa->addr = h->addr;
4780			if (h->ifname != NULL) {
4781				if (strlcpy(pa->ifname, h->ifname,
4782				    sizeof(pa->ifname)) >=
4783				    sizeof(pa->ifname))
4784					errx(1, "expand_rule: strlcpy");
4785			} else
4786				pa->ifname[0] = 0;
4787			TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
4788		}
4789
4790		if (rule_consistent(r, anchor_call[0]) < 0 || error)
4791			yyerror("skipping rule due to errors");
4792		else {
4793			r->nr = pf->astack[pf->asd]->match++;
4794			pfctl_add_rule(pf, r, anchor_call);
4795			added++;
4796		}
4797
4798	))))))))));
4799
4800	FREE_LIST(struct node_if, interfaces);
4801	FREE_LIST(struct node_proto, protos);
4802	FREE_LIST(struct node_host, src_hosts);
4803	FREE_LIST(struct node_port, src_ports);
4804	FREE_LIST(struct node_os, src_oses);
4805	FREE_LIST(struct node_host, dst_hosts);
4806	FREE_LIST(struct node_port, dst_ports);
4807	FREE_LIST(struct node_uid, uids);
4808	FREE_LIST(struct node_gid, gids);
4809	FREE_LIST(struct node_icmp, icmp_types);
4810	FREE_LIST(struct node_host, rpool_hosts);
4811
4812	if (!added)
4813		yyerror("rule expands to no valid combination");
4814}
4815
4816int
4817expand_skip_interface(struct node_if *interfaces)
4818{
4819	int	errs = 0;
4820
4821	if (!interfaces || (!interfaces->next && !interfaces->not &&
4822	    !strcmp(interfaces->ifname, "none"))) {
4823		if (pf->opts & PF_OPT_VERBOSE)
4824			printf("set skip on none\n");
4825		errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
4826		return (errs);
4827	}
4828
4829	if (pf->opts & PF_OPT_VERBOSE)
4830		printf("set skip on {");
4831	LOOP_THROUGH(struct node_if, interface, interfaces,
4832		if (pf->opts & PF_OPT_VERBOSE)
4833			printf(" %s", interface->ifname);
4834		if (interface->not) {
4835			yyerror("skip on ! <interface> is not supported");
4836			errs++;
4837		} else
4838			errs += pfctl_set_interface_flags(pf,
4839			    interface->ifname, PFI_IFLAG_SKIP, 1);
4840	);
4841	if (pf->opts & PF_OPT_VERBOSE)
4842		printf(" }\n");
4843
4844	FREE_LIST(struct node_if, interfaces);
4845
4846	if (errs)
4847		return (1);
4848	else
4849		return (0);
4850}
4851
4852#undef FREE_LIST
4853#undef LOOP_THROUGH
4854
4855int
4856check_rulestate(int desired_state)
4857{
4858	if (require_order && (rulestate > desired_state)) {
4859		yyerror("Rules must be in order: options, normalization, "
4860		    "queueing, translation, filtering");
4861		return (1);
4862	}
4863	rulestate = desired_state;
4864	return (0);
4865}
4866
4867int
4868kw_cmp(const void *k, const void *e)
4869{
4870	return (strcmp(k, ((const struct keywords *)e)->k_name));
4871}
4872
4873int
4874lookup(char *s)
4875{
4876	/* this has to be sorted always */
4877	static const struct keywords keywords[] = {
4878		{ "all",		ALL},
4879		{ "allow-opts",		ALLOWOPTS},
4880		{ "altq",		ALTQ},
4881		{ "anchor",		ANCHOR},
4882		{ "antispoof",		ANTISPOOF},
4883		{ "any",		ANY},
4884		{ "bandwidth",		BANDWIDTH},
4885		{ "binat",		BINAT},
4886		{ "binat-anchor",	BINATANCHOR},
4887		{ "bitmask",		BITMASK},
4888		{ "block",		BLOCK},
4889		{ "block-policy",	BLOCKPOLICY},
4890		{ "cbq",		CBQ},
4891		{ "code",		CODE},
4892		{ "crop",		FRAGCROP},
4893		{ "debug",		DEBUG},
4894		{ "drop",		DROP},
4895		{ "drop-ovl",		FRAGDROP},
4896		{ "dup-to",		DUPTO},
4897		{ "fastroute",		FASTROUTE},
4898		{ "file",		FILENAME},
4899		{ "fingerprints",	FINGERPRINTS},
4900		{ "flags",		FLAGS},
4901		{ "floating",		FLOATING},
4902		{ "flush",		FLUSH},
4903		{ "for",		FOR},
4904		{ "fragment",		FRAGMENT},
4905		{ "from",		FROM},
4906		{ "global",		GLOBAL},
4907		{ "group",		GROUP},
4908		{ "hfsc",		HFSC},
4909		{ "hostid",		HOSTID},
4910		{ "icmp-type",		ICMPTYPE},
4911		{ "icmp6-type",		ICMP6TYPE},
4912		{ "if-bound",		IFBOUND},
4913		{ "in",			IN},
4914		{ "inet",		INET},
4915		{ "inet6",		INET6},
4916		{ "keep",		KEEP},
4917		{ "label",		LABEL},
4918		{ "limit",		LIMIT},
4919		{ "linkshare",		LINKSHARE},
4920		{ "load",		LOAD},
4921		{ "log",		LOG},
4922		{ "loginterface",	LOGINTERFACE},
4923		{ "max",		MAXIMUM},
4924		{ "max-mss",		MAXMSS},
4925		{ "max-src-conn",	MAXSRCCONN},
4926		{ "max-src-conn-rate",	MAXSRCCONNRATE},
4927		{ "max-src-nodes",	MAXSRCNODES},
4928		{ "max-src-states",	MAXSRCSTATES},
4929		{ "min-ttl",		MINTTL},
4930		{ "modulate",		MODULATE},
4931		{ "nat",		NAT},
4932		{ "nat-anchor",		NATANCHOR},
4933		{ "no",			NO},
4934		{ "no-df",		NODF},
4935		{ "no-route",		NOROUTE},
4936		{ "no-sync",		NOSYNC},
4937		{ "on",			ON},
4938		{ "optimization",	OPTIMIZATION},
4939		{ "os",			OS},
4940		{ "out",		OUT},
4941		{ "overload",		OVERLOAD},
4942		{ "pass",		PASS},
4943		{ "port",		PORT},
4944		{ "priority",		PRIORITY},
4945		{ "priq",		PRIQ},
4946		{ "probability",	PROBABILITY},
4947		{ "proto",		PROTO},
4948		{ "qlimit",		QLIMIT},
4949		{ "queue",		QUEUE},
4950		{ "quick",		QUICK},
4951		{ "random",		RANDOM},
4952		{ "random-id",		RANDOMID},
4953		{ "rdr",		RDR},
4954		{ "rdr-anchor",		RDRANCHOR},
4955		{ "realtime",		REALTIME},
4956		{ "reassemble",		REASSEMBLE},
4957		{ "reply-to",		REPLYTO},
4958		{ "require-order",	REQUIREORDER},
4959		{ "return",		RETURN},
4960		{ "return-icmp",	RETURNICMP},
4961		{ "return-icmp6",	RETURNICMP6},
4962		{ "return-rst",		RETURNRST},
4963		{ "round-robin",	ROUNDROBIN},
4964		{ "route",		ROUTE},
4965		{ "route-to",		ROUTETO},
4966		{ "rtable",		RTABLE},
4967		{ "rule",		RULE},
4968		{ "ruleset-optimization",	RULESET_OPTIMIZATION},
4969		{ "scrub",		SCRUB},
4970		{ "set",		SET},
4971		{ "skip",		SKIP},
4972		{ "source-hash",	SOURCEHASH},
4973		{ "source-track",	SOURCETRACK},
4974		{ "state",		STATE},
4975		{ "state-policy",	STATEPOLICY},
4976		{ "static-port",	STATICPORT},
4977		{ "sticky-address",	STICKYADDRESS},
4978		{ "synproxy",		SYNPROXY},
4979		{ "table",		TABLE},
4980		{ "tag",		TAG},
4981		{ "tagged",		TAGGED},
4982		{ "tbrsize",		TBRSIZE},
4983		{ "timeout",		TIMEOUT},
4984		{ "to",			TO},
4985		{ "tos",		TOS},
4986		{ "ttl",		TTL},
4987		{ "upperlimit",		UPPERLIMIT},
4988		{ "urpf-failed",	URPFFAILED},
4989		{ "user",		USER},
4990	};
4991	const struct keywords	*p;
4992
4993	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
4994	    sizeof(keywords[0]), kw_cmp);
4995
4996	if (p) {
4997		if (debug > 1)
4998			fprintf(stderr, "%s: %d\n", s, p->k_val);
4999		return (p->k_val);
5000	} else {
5001		if (debug > 1)
5002			fprintf(stderr, "string: %s\n", s);
5003		return (STRING);
5004	}
5005}
5006
5007#define MAXPUSHBACK	128
5008
5009char	*parsebuf;
5010int	 parseindex;
5011char	 pushback_buffer[MAXPUSHBACK];
5012int	 pushback_index = 0;
5013
5014int
5015lgetc(FILE *f)
5016{
5017	int	c, next;
5018
5019	if (parsebuf) {
5020		/* Read character from the parsebuffer instead of input. */
5021		if (parseindex >= 0) {
5022			c = parsebuf[parseindex++];
5023			if (c != '\0')
5024				return (c);
5025			parsebuf = NULL;
5026		} else
5027			parseindex++;
5028	}
5029
5030	if (pushback_index)
5031		return (pushback_buffer[--pushback_index]);
5032
5033	while ((c = getc(f)) == '\\') {
5034		next = getc(f);
5035		if (next != '\n') {
5036			c = next;
5037			break;
5038		}
5039		yylval.lineno = lineno;
5040		lineno++;
5041	}
5042	if (c == '\t' || c == ' ') {
5043		/* Compress blanks to a single space. */
5044		do {
5045			c = getc(f);
5046		} while (c == '\t' || c == ' ');
5047		ungetc(c, f);
5048		c = ' ';
5049	}
5050
5051	return (c);
5052}
5053
5054int
5055lungetc(int c)
5056{
5057	if (c == EOF)
5058		return (EOF);
5059	if (parsebuf) {
5060		parseindex--;
5061		if (parseindex >= 0)
5062			return (c);
5063	}
5064	if (pushback_index < MAXPUSHBACK-1)
5065		return (pushback_buffer[pushback_index++] = c);
5066	else
5067		return (EOF);
5068}
5069
5070int
5071findeol(void)
5072{
5073	int	c;
5074
5075	parsebuf = NULL;
5076	pushback_index = 0;
5077
5078	/* skip to either EOF or the first real EOL */
5079	while (1) {
5080		c = lgetc(fin);
5081		if (c == '\n') {
5082			lineno++;
5083			break;
5084		}
5085		if (c == EOF)
5086			break;
5087	}
5088	return (ERROR);
5089}
5090
5091int
5092yylex(void)
5093{
5094	char	 buf[8096];
5095	char	*p, *val;
5096	int	 endc, c, next;
5097	int	 token;
5098
5099top:
5100	p = buf;
5101	while ((c = lgetc(fin)) == ' ')
5102		; /* nothing */
5103
5104	yylval.lineno = lineno;
5105	if (c == '#')
5106		while ((c = lgetc(fin)) != '\n' && c != EOF)
5107			; /* nothing */
5108	if (c == '$' && parsebuf == NULL) {
5109		while (1) {
5110			if ((c = lgetc(fin)) == EOF)
5111				return (0);
5112
5113			if (p + 1 >= buf + sizeof(buf) - 1) {
5114				yyerror("string too long");
5115				return (findeol());
5116			}
5117			if (isalnum(c) || c == '_') {
5118				*p++ = (char)c;
5119				continue;
5120			}
5121			*p = '\0';
5122			lungetc(c);
5123			break;
5124		}
5125		val = symget(buf);
5126		if (val == NULL) {
5127			yyerror("macro '%s' not defined", buf);
5128			return (findeol());
5129		}
5130		parsebuf = val;
5131		parseindex = 0;
5132		goto top;
5133	}
5134
5135	switch (c) {
5136	case '\'':
5137	case '"':
5138		endc = c;
5139		while (1) {
5140			if ((c = lgetc(fin)) == EOF)
5141				return (0);
5142			if (c == endc) {
5143				*p = '\0';
5144				break;
5145			}
5146			if (c == '\n') {
5147				lineno++;
5148				continue;
5149			}
5150			if (p + 1 >= buf + sizeof(buf) - 1) {
5151				yyerror("string too long");
5152				return (findeol());
5153			}
5154			*p++ = (char)c;
5155		}
5156		yylval.v.string = strdup(buf);
5157		if (yylval.v.string == NULL)
5158			err(1, "yylex: strdup");
5159		return (STRING);
5160	case '<':
5161		next = lgetc(fin);
5162		if (next == '>') {
5163			yylval.v.i = PF_OP_XRG;
5164			return (PORTBINARY);
5165		}
5166		lungetc(next);
5167		break;
5168	case '>':
5169		next = lgetc(fin);
5170		if (next == '<') {
5171			yylval.v.i = PF_OP_IRG;
5172			return (PORTBINARY);
5173		}
5174		lungetc(next);
5175		break;
5176	case '-':
5177		next = lgetc(fin);
5178		if (next == '>')
5179			return (ARROW);
5180		lungetc(next);
5181		break;
5182	}
5183
5184#define allowed_in_string(x) \
5185	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
5186	x != '{' && x != '}' && x != '<' && x != '>' && \
5187	x != '!' && x != '=' && x != '/' && x != '#' && \
5188	x != ','))
5189
5190	if (isalnum(c) || c == ':' || c == '_') {
5191		do {
5192			*p++ = c;
5193			if ((unsigned)(p-buf) >= sizeof(buf)) {
5194				yyerror("string too long");
5195				return (findeol());
5196			}
5197		} while ((c = lgetc(fin)) != EOF && (allowed_in_string(c)));
5198		lungetc(c);
5199		*p = '\0';
5200		if ((token = lookup(buf)) == STRING)
5201			if ((yylval.v.string = strdup(buf)) == NULL)
5202				err(1, "yylex: strdup");
5203		return (token);
5204	}
5205	if (c == '\n') {
5206		yylval.lineno = lineno;
5207		lineno++;
5208	}
5209	if (c == EOF)
5210		return (0);
5211	return (c);
5212}
5213
5214int
5215parse_rules(FILE *input, struct pfctl *xpf)
5216{
5217	struct sym	*sym, *next;
5218
5219	fin = input;
5220	pf = xpf;
5221	lineno = 1;
5222	errors = 0;
5223	rulestate = PFCTL_STATE_NONE;
5224	returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
5225	returnicmp6default =
5226	    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
5227	blockpolicy = PFRULE_DROP;
5228	require_order = 1;
5229
5230	yyparse();
5231
5232	/* Free macros and check which have not been used. */
5233	for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) {
5234		next = TAILQ_NEXT(sym, entries);
5235		if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
5236			fprintf(stderr, "warning: macro '%s' not "
5237			    "used\n", sym->nam);
5238		free(sym->nam);
5239		free(sym->val);
5240		TAILQ_REMOVE(&symhead, sym, entries);
5241		free(sym);
5242	}
5243
5244	return (errors ? -1 : 0);
5245}
5246
5247/*
5248 * Over-designed efficiency is a French and German concept, so how about
5249 * we wait until they discover this ugliness and make it all fancy.
5250 */
5251int
5252symset(const char *nam, const char *val, int persist)
5253{
5254	struct sym	*sym;
5255
5256	for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
5257	    sym = TAILQ_NEXT(sym, entries))
5258		;	/* nothing */
5259
5260	if (sym != NULL) {
5261		if (sym->persist == 1)
5262			return (0);
5263		else {
5264			free(sym->nam);
5265			free(sym->val);
5266			TAILQ_REMOVE(&symhead, sym, entries);
5267			free(sym);
5268		}
5269	}
5270	if ((sym = calloc(1, sizeof(*sym))) == NULL)
5271		return (-1);
5272
5273	sym->nam = strdup(nam);
5274	if (sym->nam == NULL) {
5275		free(sym);
5276		return (-1);
5277	}
5278	sym->val = strdup(val);
5279	if (sym->val == NULL) {
5280		free(sym->nam);
5281		free(sym);
5282		return (-1);
5283	}
5284	sym->used = 0;
5285	sym->persist = persist;
5286	TAILQ_INSERT_TAIL(&symhead, sym, entries);
5287	return (0);
5288}
5289
5290int
5291pfctl_cmdline_symset(char *s)
5292{
5293	char	*sym, *val;
5294	int	 ret;
5295
5296	if ((val = strrchr(s, '=')) == NULL)
5297		return (-1);
5298
5299	if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
5300		err(1, "pfctl_cmdline_symset: malloc");
5301
5302	strlcpy(sym, s, strlen(s) - strlen(val) + 1);
5303
5304	ret = symset(sym, val + 1, 1);
5305	free(sym);
5306
5307	return (ret);
5308}
5309
5310char *
5311symget(const char *nam)
5312{
5313	struct sym	*sym;
5314
5315	TAILQ_FOREACH(sym, &symhead, entries)
5316		if (strcmp(nam, sym->nam) == 0) {
5317			sym->used = 1;
5318			return (sym->val);
5319		}
5320	return (NULL);
5321}
5322
5323void
5324mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst)
5325{
5326	int i;
5327	struct pf_rule *r;
5328
5329	for (i = 0; i < PF_RULESET_MAX; ++i) {
5330		while ((r = TAILQ_FIRST(src->rules[i].active.ptr))
5331		    != NULL) {
5332			TAILQ_REMOVE(src->rules[i].active.ptr, r, entries);
5333			TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries);
5334			dst->anchor->match++;
5335		}
5336		src->anchor->match = 0;
5337		while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr))
5338		    != NULL) {
5339			TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries);
5340			TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr,
5341				r, entries);
5342		}
5343	}
5344}
5345
5346void
5347decide_address_family(struct node_host *n, sa_family_t *af)
5348{
5349	if (*af != 0 || n == NULL)
5350		return;
5351	*af = n->af;
5352	while ((n = n->next) != NULL) {
5353		if (n->af != *af) {
5354			*af = 0;
5355			return;
5356		}
5357	}
5358}
5359
5360void
5361remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
5362{
5363	struct node_host	*n = *nh, *prev = NULL;
5364
5365	while (n != NULL) {
5366		if (*af && n->af && n->af != *af) {
5367			/* unlink and free n */
5368			struct node_host *next = n->next;
5369
5370			/* adjust tail pointer */
5371			if (n == (*nh)->tail)
5372				(*nh)->tail = prev;
5373			/* adjust previous node's next pointer */
5374			if (prev == NULL)
5375				*nh = next;
5376			else
5377				prev->next = next;
5378			/* free node */
5379			if (n->ifname != NULL)
5380				free(n->ifname);
5381			free(n);
5382			n = next;
5383		} else {
5384			if (n->af && !*af)
5385				*af = n->af;
5386			prev = n;
5387			n = n->next;
5388		}
5389	}
5390}
5391
5392int
5393invalid_redirect(struct node_host *nh, sa_family_t af)
5394{
5395	if (!af) {
5396		struct node_host *n;
5397
5398		/* tables and dyniftl are ok without an address family */
5399		for (n = nh; n != NULL; n = n->next) {
5400			if (n->addr.type != PF_ADDR_TABLE &&
5401			    n->addr.type != PF_ADDR_DYNIFTL) {
5402				yyerror("address family not given and "
5403				    "translation address expands to multiple "
5404				    "address families");
5405				return (1);
5406			}
5407		}
5408	}
5409	if (nh == NULL) {
5410		yyerror("no translation address with matching address family "
5411		    "found.");
5412		return (1);
5413	}
5414	return (0);
5415}
5416
5417int
5418atoul(char *s, u_long *ulvalp)
5419{
5420	u_long	 ulval;
5421	char	*ep;
5422
5423	errno = 0;
5424	ulval = strtoul(s, &ep, 0);
5425	if (s[0] == '\0' || *ep != '\0')
5426		return (-1);
5427	if (errno == ERANGE && ulval == ULONG_MAX)
5428		return (-1);
5429	*ulvalp = ulval;
5430	return (0);
5431}
5432
5433int
5434getservice(char *n)
5435{
5436	struct servent	*s;
5437	u_long		 ulval;
5438
5439	if (atoul(n, &ulval) == 0) {
5440		if (ulval > 65535) {
5441			yyerror("illegal port value %lu", ulval);
5442			return (-1);
5443		}
5444		return (htons(ulval));
5445	} else {
5446		s = getservbyname(n, "tcp");
5447		if (s == NULL)
5448			s = getservbyname(n, "udp");
5449		if (s == NULL) {
5450			yyerror("unknown port %s", n);
5451			return (-1);
5452		}
5453		return (s->s_port);
5454	}
5455}
5456
5457int
5458rule_label(struct pf_rule *r, char *s)
5459{
5460	if (s) {
5461		if (strlcpy(r->label, s, sizeof(r->label)) >=
5462		    sizeof(r->label)) {
5463			yyerror("rule label too long (max %d chars)",
5464			    sizeof(r->label)-1);
5465			return (-1);
5466		}
5467	}
5468	return (0);
5469}
5470
5471u_int16_t
5472parseicmpspec(char *w, sa_family_t af)
5473{
5474	const struct icmpcodeent	*p;
5475	u_long				 ulval;
5476	u_int8_t			 icmptype;
5477
5478	if (af == AF_INET)
5479		icmptype = returnicmpdefault >> 8;
5480	else
5481		icmptype = returnicmp6default >> 8;
5482
5483	if (atoul(w, &ulval) == -1) {
5484		if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
5485			yyerror("unknown icmp code %s", w);
5486			return (0);
5487		}
5488		ulval = p->code;
5489	}
5490	if (ulval > 255) {
5491		yyerror("invalid icmp code %lu", ulval);
5492		return (0);
5493	}
5494	return (icmptype << 8 | ulval);
5495}
5496
5497int
5498pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans)
5499{
5500	struct loadanchors	*la;
5501	FILE			*fin;
5502
5503	TAILQ_FOREACH(la, &loadanchorshead, entries) {
5504		if (pf->opts & PF_OPT_VERBOSE)
5505			fprintf(stderr, "\nLoading anchor %s from %s\n",
5506			    la->anchorname, la->filename);
5507		if ((fin = pfctl_fopen(la->filename, "r")) == NULL) {
5508			warn("%s", la->filename);
5509			continue;
5510		}
5511		if (pfctl_rules(dev, la->filename, fin, pf->opts, pf->optimize,
5512		    la->anchorname, trans) == -1)
5513			return (-1);
5514	}
5515
5516	return (0);
5517}
5518