1223637Sbz/* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */ 2126353Smlaier 3126353Smlaier/* 4126353Smlaier * Copyright (c) 2001 Markus Friedl. All rights reserved. 5126353Smlaier * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6130617Smlaier * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7130617Smlaier * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8126353Smlaier * 9126353Smlaier * Redistribution and use in source and binary forms, with or without 10126353Smlaier * modification, are permitted provided that the following conditions 11126353Smlaier * are met: 12126353Smlaier * 1. Redistributions of source code must retain the above copyright 13126353Smlaier * notice, this list of conditions and the following disclaimer. 14126353Smlaier * 2. Redistributions in binary form must reproduce the above copyright 15126353Smlaier * notice, this list of conditions and the following disclaimer in the 16126353Smlaier * documentation and/or other materials provided with the distribution. 17126353Smlaier * 18126353Smlaier * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19126353Smlaier * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20126353Smlaier * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21126353Smlaier * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22126353Smlaier * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23126353Smlaier * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24126353Smlaier * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25126353Smlaier * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26126353Smlaier * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27126353Smlaier * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28126353Smlaier */ 29126353Smlaier%{ 30127082Sobrien#include <sys/cdefs.h> 31127082Sobrien__FBSDID("$FreeBSD$"); 32127082Sobrien 33126353Smlaier#include <sys/types.h> 34126353Smlaier#include <sys/socket.h> 35223637Sbz#include <sys/stat.h> 36231852Sbz#ifdef __FreeBSD__ 37231852Sbz#include <sys/sysctl.h> 38231852Sbz#endif 39126353Smlaier#include <net/if.h> 40126353Smlaier#include <netinet/in.h> 41126353Smlaier#include <netinet/in_systm.h> 42126353Smlaier#include <netinet/ip.h> 43126353Smlaier#include <netinet/ip_icmp.h> 44126353Smlaier#include <netinet/icmp6.h> 45126353Smlaier#include <net/pfvar.h> 46126353Smlaier#include <arpa/inet.h> 47126353Smlaier#include <altq/altq.h> 48126353Smlaier#include <altq/altq_cbq.h> 49126353Smlaier#include <altq/altq_priq.h> 50126353Smlaier#include <altq/altq_hfsc.h> 51126353Smlaier 52126353Smlaier#include <stdio.h> 53223637Sbz#include <unistd.h> 54126353Smlaier#include <stdlib.h> 55126353Smlaier#include <netdb.h> 56126353Smlaier#include <stdarg.h> 57126353Smlaier#include <errno.h> 58126353Smlaier#include <string.h> 59126353Smlaier#include <ctype.h> 60145840Smlaier#include <math.h> 61126353Smlaier#include <err.h> 62127024Smlaier#include <limits.h> 63126353Smlaier#include <pwd.h> 64126353Smlaier#include <grp.h> 65126353Smlaier#include <md5.h> 66126353Smlaier 67126353Smlaier#include "pfctl_parser.h" 68126353Smlaier#include "pfctl.h" 69126353Smlaier 70126353Smlaierstatic struct pfctl *pf = NULL; 71126353Smlaierstatic int debug = 0; 72126353Smlaierstatic int rulestate = 0; 73126353Smlaierstatic u_int16_t returnicmpdefault = 74126353Smlaier (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 75126353Smlaierstatic u_int16_t returnicmp6default = 76126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 77126353Smlaierstatic int blockpolicy = PFRULE_DROP; 78126353Smlaierstatic int require_order = 1; 79130617Smlaierstatic int default_statelock; 80126353Smlaier 81223637SbzTAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 82223637Sbzstatic struct file { 83223637Sbz TAILQ_ENTRY(file) entry; 84223637Sbz FILE *stream; 85223637Sbz char *name; 86223637Sbz int lineno; 87223637Sbz int errors; 88223637Sbz} *file; 89223637Sbzstruct file *pushfile(const char *, int); 90223637Sbzint popfile(void); 91223637Sbzint check_file_secrecy(int, const char *); 92223637Sbzint yyparse(void); 93223637Sbzint yylex(void); 94223637Sbzint yyerror(const char *, ...); 95223637Sbzint kw_cmp(const void *, const void *); 96223637Sbzint lookup(char *); 97223637Sbzint lgetc(int); 98223637Sbzint lungetc(int); 99223637Sbzint findeol(void); 100223637Sbz 101223637SbzTAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 102223637Sbzstruct sym { 103223637Sbz TAILQ_ENTRY(sym) entry; 104223637Sbz int used; 105223637Sbz int persist; 106223637Sbz char *nam; 107223637Sbz char *val; 108223637Sbz}; 109223637Sbzint symset(const char *, const char *, int); 110223637Sbzchar *symget(const char *); 111223637Sbz 112223637Sbzint atoul(char *, u_long *); 113223637Sbz 114126353Smlaierenum { 115126353Smlaier PFCTL_STATE_NONE, 116126353Smlaier PFCTL_STATE_OPTION, 117126353Smlaier PFCTL_STATE_SCRUB, 118126353Smlaier PFCTL_STATE_QUEUE, 119126353Smlaier PFCTL_STATE_NAT, 120126353Smlaier PFCTL_STATE_FILTER 121126353Smlaier}; 122126353Smlaier 123126353Smlaierstruct node_proto { 124126353Smlaier u_int8_t proto; 125126353Smlaier struct node_proto *next; 126126353Smlaier struct node_proto *tail; 127126353Smlaier}; 128126353Smlaier 129126353Smlaierstruct node_port { 130126353Smlaier u_int16_t port[2]; 131126353Smlaier u_int8_t op; 132126353Smlaier struct node_port *next; 133126353Smlaier struct node_port *tail; 134126353Smlaier}; 135126353Smlaier 136126353Smlaierstruct node_uid { 137126353Smlaier uid_t uid[2]; 138126353Smlaier u_int8_t op; 139126353Smlaier struct node_uid *next; 140126353Smlaier struct node_uid *tail; 141126353Smlaier}; 142126353Smlaier 143126353Smlaierstruct node_gid { 144126353Smlaier gid_t gid[2]; 145126353Smlaier u_int8_t op; 146126353Smlaier struct node_gid *next; 147126353Smlaier struct node_gid *tail; 148126353Smlaier}; 149126353Smlaier 150126353Smlaierstruct node_icmp { 151126353Smlaier u_int8_t code; 152126353Smlaier u_int8_t type; 153126353Smlaier u_int8_t proto; 154126353Smlaier struct node_icmp *next; 155126353Smlaier struct node_icmp *tail; 156126353Smlaier}; 157126353Smlaier 158130617Smlaierenum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 159145840Smlaier PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 160145840Smlaier PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 161145840Smlaier PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 162240233Sglebius PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, }; 163130617Smlaier 164130617Smlaierenum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 165130617Smlaier 166126353Smlaierstruct node_state_opt { 167126353Smlaier int type; 168126353Smlaier union { 169126353Smlaier u_int32_t max_states; 170130617Smlaier u_int32_t max_src_states; 171145840Smlaier u_int32_t max_src_conn; 172145840Smlaier struct { 173145840Smlaier u_int32_t limit; 174145840Smlaier u_int32_t seconds; 175145840Smlaier } max_src_conn_rate; 176145840Smlaier struct { 177145840Smlaier u_int8_t flush; 178145840Smlaier char tblname[PF_TABLE_NAME_SIZE]; 179145840Smlaier } overload; 180130617Smlaier u_int32_t max_src_nodes; 181130617Smlaier u_int8_t src_track; 182130617Smlaier u_int32_t statelock; 183126353Smlaier struct { 184126353Smlaier int number; 185126353Smlaier u_int32_t seconds; 186126353Smlaier } timeout; 187126353Smlaier } data; 188126353Smlaier struct node_state_opt *next; 189126353Smlaier struct node_state_opt *tail; 190126353Smlaier}; 191126353Smlaier 192126353Smlaierstruct peer { 193126353Smlaier struct node_host *host; 194126353Smlaier struct node_port *port; 195126353Smlaier}; 196126353Smlaier 197126353Smlaierstruct node_queue { 198126353Smlaier char queue[PF_QNAME_SIZE]; 199126353Smlaier char parent[PF_QNAME_SIZE]; 200126353Smlaier char ifname[IFNAMSIZ]; 201126353Smlaier int scheduler; 202126353Smlaier struct node_queue *next; 203126353Smlaier struct node_queue *tail; 204126353Smlaier} *queues = NULL; 205126353Smlaier 206126353Smlaierstruct node_qassign { 207126353Smlaier char *qname; 208126353Smlaier char *pqname; 209126353Smlaier}; 210126353Smlaier 211126353Smlaierstruct filter_opts { 212126353Smlaier int marker; 213126353Smlaier#define FOM_FLAGS 0x01 214126353Smlaier#define FOM_ICMP 0x02 215126353Smlaier#define FOM_TOS 0x04 216126353Smlaier#define FOM_KEEP 0x08 217130617Smlaier#define FOM_SRCTRACK 0x10 218126353Smlaier struct node_uid *uid; 219126353Smlaier struct node_gid *gid; 220126353Smlaier struct { 221126353Smlaier u_int8_t b1; 222126353Smlaier u_int8_t b2; 223126353Smlaier u_int16_t w; 224126353Smlaier u_int16_t w2; 225126353Smlaier } flags; 226126353Smlaier struct node_icmp *icmpspec; 227126353Smlaier u_int32_t tos; 228145840Smlaier u_int32_t prob; 229126353Smlaier struct { 230126353Smlaier int action; 231126353Smlaier struct node_state_opt *options; 232126353Smlaier } keep; 233126353Smlaier int fragment; 234126353Smlaier int allowopts; 235126353Smlaier char *label; 236126353Smlaier struct node_qassign queues; 237126353Smlaier char *tag; 238126353Smlaier char *match_tag; 239126353Smlaier u_int8_t match_tag_not; 240223637Sbz u_int rtableid; 241223637Sbz struct { 242223637Sbz struct node_host *addr; 243223637Sbz u_int16_t port; 244223637Sbz } divert; 245126353Smlaier} filter_opts; 246126353Smlaier 247126353Smlaierstruct antispoof_opts { 248126353Smlaier char *label; 249223637Sbz u_int rtableid; 250126353Smlaier} antispoof_opts; 251126353Smlaier 252126353Smlaierstruct scrub_opts { 253223637Sbz int marker; 254126353Smlaier#define SOM_MINTTL 0x01 255126353Smlaier#define SOM_MAXMSS 0x02 256126353Smlaier#define SOM_FRAGCACHE 0x04 257223637Sbz#define SOM_SETTOS 0x08 258223637Sbz int nodf; 259223637Sbz int minttl; 260223637Sbz int maxmss; 261223637Sbz int settos; 262223637Sbz int fragcache; 263223637Sbz int randomid; 264223637Sbz int reassemble_tcp; 265223637Sbz char *match_tag; 266223637Sbz u_int8_t match_tag_not; 267223637Sbz u_int rtableid; 268126353Smlaier} scrub_opts; 269126353Smlaier 270126353Smlaierstruct queue_opts { 271126353Smlaier int marker; 272126353Smlaier#define QOM_BWSPEC 0x01 273126353Smlaier#define QOM_SCHEDULER 0x02 274126353Smlaier#define QOM_PRIORITY 0x04 275126353Smlaier#define QOM_TBRSIZE 0x08 276126353Smlaier#define QOM_QLIMIT 0x10 277126353Smlaier struct node_queue_bw queue_bwspec; 278126353Smlaier struct node_queue_opt scheduler; 279126353Smlaier int priority; 280126353Smlaier int tbrsize; 281126353Smlaier int qlimit; 282126353Smlaier} queue_opts; 283126353Smlaier 284126353Smlaierstruct table_opts { 285126353Smlaier int flags; 286126353Smlaier int init_addr; 287126353Smlaier struct node_tinithead init_nodes; 288126353Smlaier} table_opts; 289126353Smlaier 290130617Smlaierstruct pool_opts { 291130617Smlaier int marker; 292130617Smlaier#define POM_TYPE 0x01 293130617Smlaier#define POM_STICKYADDRESS 0x02 294130617Smlaier u_int8_t opts; 295130617Smlaier int type; 296130617Smlaier int staticport; 297130617Smlaier struct pf_poolhashkey *key; 298130617Smlaier 299130617Smlaier} pool_opts; 300130617Smlaier 301130617Smlaier 302223637Sbzstruct node_hfsc_opts hfsc_opts; 303223637Sbzstruct node_state_opt *keep_state_defaults = NULL; 304126353Smlaier 305223637Sbzint disallow_table(struct node_host *, const char *); 306223637Sbzint disallow_urpf_failed(struct node_host *, const char *); 307223637Sbzint disallow_alias(struct node_host *, const char *); 308223637Sbzint rule_consistent(struct pf_rule *, int); 309223637Sbzint filter_consistent(struct pf_rule *, int); 310223637Sbzint nat_consistent(struct pf_rule *); 311223637Sbzint rdr_consistent(struct pf_rule *); 312223637Sbzint process_tabledef(char *, struct table_opts *); 313223637Sbzvoid expand_label_str(char *, size_t, const char *, const char *); 314223637Sbzvoid expand_label_if(const char *, char *, size_t, const char *); 315223637Sbzvoid expand_label_addr(const char *, char *, size_t, u_int8_t, 316223637Sbz struct node_host *); 317223637Sbzvoid expand_label_port(const char *, char *, size_t, 318223637Sbz struct node_port *); 319223637Sbzvoid expand_label_proto(const char *, char *, size_t, u_int8_t); 320223637Sbzvoid expand_label_nr(const char *, char *, size_t); 321223637Sbzvoid expand_label(char *, size_t, const char *, u_int8_t, 322223637Sbz struct node_host *, struct node_port *, struct node_host *, 323223637Sbz struct node_port *, u_int8_t); 324223637Sbzvoid expand_rule(struct pf_rule *, struct node_if *, 325223637Sbz struct node_host *, struct node_proto *, struct node_os *, 326223637Sbz struct node_host *, struct node_port *, struct node_host *, 327223637Sbz struct node_port *, struct node_uid *, struct node_gid *, 328223637Sbz struct node_icmp *, const char *); 329223637Sbzint expand_altq(struct pf_altq *, struct node_if *, 330223637Sbz struct node_queue *, struct node_queue_bw bwspec, 331223637Sbz struct node_queue_opt *); 332223637Sbzint expand_queue(struct pf_altq *, struct node_if *, 333223637Sbz struct node_queue *, struct node_queue_bw, 334223637Sbz struct node_queue_opt *); 335223637Sbzint expand_skip_interface(struct node_if *); 336126353Smlaier 337126353Smlaierint check_rulestate(int); 338126353Smlaierint getservice(char *); 339126353Smlaierint rule_label(struct pf_rule *, char *); 340231852Sbzint rt_tableid_max(void); 341126353Smlaier 342171172Smlaiervoid mv_rules(struct pf_ruleset *, struct pf_ruleset *); 343126353Smlaiervoid decide_address_family(struct node_host *, sa_family_t *); 344126353Smlaiervoid remove_invalid_hosts(struct node_host **, sa_family_t *); 345126353Smlaierint invalid_redirect(struct node_host *, sa_family_t); 346126353Smlaieru_int16_t parseicmpspec(char *, sa_family_t); 347126353Smlaier 348130617SmlaierTAILQ_HEAD(loadanchorshead, loadanchors) 349130617Smlaier loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 350130617Smlaier 351126353Smlaierstruct loadanchors { 352126353Smlaier TAILQ_ENTRY(loadanchors) entries; 353126353Smlaier char *anchorname; 354126353Smlaier char *filename; 355126353Smlaier}; 356126353Smlaier 357126353Smlaiertypedef struct { 358126353Smlaier union { 359223637Sbz int64_t number; 360223637Sbz double probability; 361126353Smlaier int i; 362126353Smlaier char *string; 363223637Sbz u_int rtableid; 364126353Smlaier struct { 365126353Smlaier u_int8_t b1; 366126353Smlaier u_int8_t b2; 367126353Smlaier u_int16_t w; 368126353Smlaier u_int16_t w2; 369126353Smlaier } b; 370126353Smlaier struct range { 371126353Smlaier int a; 372126353Smlaier int b; 373126353Smlaier int t; 374126353Smlaier } range; 375126353Smlaier struct node_if *interface; 376126353Smlaier struct node_proto *proto; 377126353Smlaier struct node_icmp *icmp; 378126353Smlaier struct node_host *host; 379126353Smlaier struct node_os *os; 380126353Smlaier struct node_port *port; 381126353Smlaier struct node_uid *uid; 382126353Smlaier struct node_gid *gid; 383126353Smlaier struct node_state_opt *state_opt; 384126353Smlaier struct peer peer; 385126353Smlaier struct { 386126353Smlaier struct peer src, dst; 387126353Smlaier struct node_os *src_os; 388126353Smlaier } fromto; 389126353Smlaier struct { 390126353Smlaier struct node_host *host; 391126353Smlaier u_int8_t rt; 392126353Smlaier u_int8_t pool_opts; 393126353Smlaier sa_family_t af; 394126353Smlaier struct pf_poolhashkey *key; 395126353Smlaier } route; 396126353Smlaier struct redirection { 397126353Smlaier struct node_host *host; 398126353Smlaier struct range rport; 399126353Smlaier } *redirection; 400126353Smlaier struct { 401126353Smlaier int action; 402126353Smlaier struct node_state_opt *options; 403126353Smlaier } keep_state; 404126353Smlaier struct { 405126353Smlaier u_int8_t log; 406171172Smlaier u_int8_t logif; 407126353Smlaier u_int8_t quick; 408126353Smlaier } logquick; 409145840Smlaier struct { 410145840Smlaier int neg; 411145840Smlaier char *name; 412145840Smlaier } tagged; 413130617Smlaier struct pf_poolhashkey *hashkey; 414126353Smlaier struct node_queue *queue; 415126353Smlaier struct node_queue_opt queue_options; 416126353Smlaier struct node_queue_bw queue_bwspec; 417126353Smlaier struct node_qassign qassign; 418126353Smlaier struct filter_opts filter_opts; 419126353Smlaier struct antispoof_opts antispoof_opts; 420126353Smlaier struct queue_opts queue_opts; 421126353Smlaier struct scrub_opts scrub_opts; 422126353Smlaier struct table_opts table_opts; 423130617Smlaier struct pool_opts pool_opts; 424126353Smlaier struct node_hfsc_opts hfsc_opts; 425126353Smlaier } v; 426126353Smlaier int lineno; 427126353Smlaier} YYSTYPE; 428126353Smlaier 429223637Sbz#define PPORT_RANGE 1 430223637Sbz#define PPORT_STAR 2 431223637Sbzint parseport(char *, struct range *r, int); 432223637Sbz 433130617Smlaier#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 434130617Smlaier (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 435130617Smlaier !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 436130617Smlaier 437126353Smlaier%} 438126353Smlaier 439171172Smlaier%token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 440126353Smlaier%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 441126353Smlaier%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 442126353Smlaier%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 443171172Smlaier%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 444126353Smlaier%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 445126353Smlaier%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 446145840Smlaier%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 447223637Sbz%token ANTISPOOF FOR INCLUDE 448145840Smlaier%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 449126353Smlaier%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 450171172Smlaier%token QUEUE PRIORITY QLIMIT RTABLE 451171172Smlaier%token LOAD RULESET_OPTIMIZATION 452130617Smlaier%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 453240233Sglebius%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY 454223637Sbz%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 455223637Sbz%token DIVERTTO DIVERTREPLY 456126353Smlaier%token <v.string> STRING 457223637Sbz%token <v.number> NUMBER 458126353Smlaier%token <v.i> PORTBINARY 459126353Smlaier%type <v.interface> interface if_list if_item_not if_item 460126353Smlaier%type <v.number> number icmptype icmp6type uid gid 461171172Smlaier%type <v.number> tos not yesno 462223637Sbz%type <v.probability> probability 463171172Smlaier%type <v.i> no dir af fragcache optimizer 464171172Smlaier%type <v.i> sourcetrack flush unaryop statelock 465223637Sbz%type <v.b> action nataction natpasslog scrubaction 466145840Smlaier%type <v.b> flags flag blockspec 467223637Sbz%type <v.range> portplain portstar portrange 468126353Smlaier%type <v.hashkey> hashkey 469126353Smlaier%type <v.proto> proto proto_list proto_item 470223637Sbz%type <v.number> protoval 471126353Smlaier%type <v.icmp> icmpspec 472126353Smlaier%type <v.icmp> icmp_list icmp_item 473126353Smlaier%type <v.icmp> icmp6_list icmp6_item 474223637Sbz%type <v.number> reticmpspec reticmp6spec 475126353Smlaier%type <v.fromto> fromto 476126353Smlaier%type <v.peer> ipportspec from to 477223637Sbz%type <v.host> ipspec toipspec xhost host dynaddr host_list 478126353Smlaier%type <v.host> redir_host_list redirspec 479126353Smlaier%type <v.host> route_host route_host_list routespec 480126353Smlaier%type <v.os> os xos os_list 481126353Smlaier%type <v.port> portspec port_list port_item 482126353Smlaier%type <v.uid> uids uid_list uid_item 483126353Smlaier%type <v.gid> gids gid_list gid_item 484126353Smlaier%type <v.route> route 485126353Smlaier%type <v.redirection> redirection redirpool 486223637Sbz%type <v.string> label stringall tag anchorname 487223637Sbz%type <v.string> string varstring numberstring 488126353Smlaier%type <v.keep_state> keep 489126353Smlaier%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 490171172Smlaier%type <v.logquick> logquick quick log logopts logopt 491145840Smlaier%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 492126353Smlaier%type <v.qassign> qname 493126353Smlaier%type <v.queue> qassign qassign_list qassign_item 494126353Smlaier%type <v.queue_options> scheduler 495126353Smlaier%type <v.number> cbqflags_list cbqflags_item 496126353Smlaier%type <v.number> priqflags_list priqflags_item 497126353Smlaier%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 498126353Smlaier%type <v.queue_bwspec> bandwidth 499126353Smlaier%type <v.filter_opts> filter_opts filter_opt filter_opts_l 500126353Smlaier%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 501126353Smlaier%type <v.queue_opts> queue_opts queue_opt queue_opts_l 502126353Smlaier%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 503126353Smlaier%type <v.table_opts> table_opts table_opt table_opts_l 504130617Smlaier%type <v.pool_opts> pool_opts pool_opt pool_opts_l 505145840Smlaier%type <v.tagged> tagged 506171172Smlaier%type <v.rtableid> rtable 507126353Smlaier%% 508126353Smlaier 509126353Smlaierruleset : /* empty */ 510223637Sbz | ruleset include '\n' 511126353Smlaier | ruleset '\n' 512126353Smlaier | ruleset option '\n' 513126353Smlaier | ruleset scrubrule '\n' 514126353Smlaier | ruleset natrule '\n' 515126353Smlaier | ruleset binatrule '\n' 516126353Smlaier | ruleset pfrule '\n' 517126353Smlaier | ruleset anchorrule '\n' 518126353Smlaier | ruleset loadrule '\n' 519126353Smlaier | ruleset altqif '\n' 520126353Smlaier | ruleset queuespec '\n' 521126353Smlaier | ruleset varset '\n' 522126353Smlaier | ruleset antispoof '\n' 523126353Smlaier | ruleset tabledef '\n' 524171172Smlaier | '{' fakeanchor '}' '\n'; 525223637Sbz | ruleset error '\n' { file->errors++; } 526126353Smlaier ; 527126353Smlaier 528223637Sbzinclude : INCLUDE STRING { 529223637Sbz struct file *nfile; 530223637Sbz 531223637Sbz if ((nfile = pushfile($2, 0)) == NULL) { 532223637Sbz yyerror("failed to include file %s", $2); 533223637Sbz free($2); 534223637Sbz YYERROR; 535223637Sbz } 536223637Sbz free($2); 537223637Sbz 538223637Sbz file = nfile; 539223637Sbz lungetc('\n'); 540223637Sbz } 541223637Sbz ; 542223637Sbz 543171172Smlaier/* 544171172Smlaier * apply to previouslys specified rule: must be careful to note 545171172Smlaier * what that is: pf or nat or binat or rdr 546171172Smlaier */ 547171172Smlaierfakeanchor : fakeanchor '\n' 548171172Smlaier | fakeanchor anchorrule '\n' 549171172Smlaier | fakeanchor binatrule '\n' 550171172Smlaier | fakeanchor natrule '\n' 551171172Smlaier | fakeanchor pfrule '\n' 552171172Smlaier | fakeanchor error '\n' 553171172Smlaier ; 554171172Smlaier 555171172Smlaieroptimizer : string { 556171172Smlaier if (!strcmp($1, "none")) 557171172Smlaier $$ = 0; 558171172Smlaier else if (!strcmp($1, "basic")) 559171172Smlaier $$ = PF_OPTIMIZE_BASIC; 560171172Smlaier else if (!strcmp($1, "profile")) 561171172Smlaier $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 562171172Smlaier else { 563223637Sbz yyerror("unknown ruleset-optimization %s", $1); 564171172Smlaier YYERROR; 565171172Smlaier } 566171172Smlaier } 567171172Smlaier ; 568171172Smlaier 569126353Smlaieroption : SET OPTIMIZATION STRING { 570130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 571130617Smlaier free($3); 572126353Smlaier YYERROR; 573130617Smlaier } 574126353Smlaier if (pfctl_set_optimization(pf, $3) != 0) { 575126353Smlaier yyerror("unknown optimization %s", $3); 576130617Smlaier free($3); 577126353Smlaier YYERROR; 578126353Smlaier } 579171172Smlaier free($3); 580126353Smlaier } 581171172Smlaier | SET RULESET_OPTIMIZATION optimizer { 582171172Smlaier if (!(pf->opts & PF_OPT_OPTIMIZE)) { 583171172Smlaier pf->opts |= PF_OPT_OPTIMIZE; 584171172Smlaier pf->optimize = $3; 585171172Smlaier } 586171172Smlaier } 587126353Smlaier | SET TIMEOUT timeout_spec 588223637Sbz | SET TIMEOUT '{' optnl timeout_list '}' 589126353Smlaier | SET LIMIT limit_spec 590223637Sbz | SET LIMIT '{' optnl limit_list '}' 591223637Sbz | SET LOGINTERFACE stringall { 592130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 593130617Smlaier free($3); 594126353Smlaier YYERROR; 595130617Smlaier } 596126353Smlaier if (pfctl_set_logif(pf, $3) != 0) { 597126353Smlaier yyerror("error setting loginterface %s", $3); 598130617Smlaier free($3); 599126353Smlaier YYERROR; 600126353Smlaier } 601130617Smlaier free($3); 602126353Smlaier } 603130617Smlaier | SET HOSTID number { 604223637Sbz if ($3 == 0 || $3 > UINT_MAX) { 605130617Smlaier yyerror("hostid must be non-zero"); 606130617Smlaier YYERROR; 607130617Smlaier } 608130617Smlaier if (pfctl_set_hostid(pf, $3) != 0) { 609145840Smlaier yyerror("error setting hostid %08x", $3); 610130617Smlaier YYERROR; 611130617Smlaier } 612130617Smlaier } 613126353Smlaier | SET BLOCKPOLICY DROP { 614126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 615126353Smlaier printf("set block-policy drop\n"); 616126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 617126353Smlaier YYERROR; 618126353Smlaier blockpolicy = PFRULE_DROP; 619126353Smlaier } 620126353Smlaier | SET BLOCKPOLICY RETURN { 621126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 622126353Smlaier printf("set block-policy return\n"); 623126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 624126353Smlaier YYERROR; 625126353Smlaier blockpolicy = PFRULE_RETURN; 626126353Smlaier } 627126353Smlaier | SET REQUIREORDER yesno { 628126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 629126353Smlaier printf("set require-order %s\n", 630126353Smlaier $3 == 1 ? "yes" : "no"); 631126353Smlaier require_order = $3; 632126353Smlaier } 633126353Smlaier | SET FINGERPRINTS STRING { 634126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 635171172Smlaier printf("set fingerprints \"%s\"\n", $3); 636130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 637130617Smlaier free($3); 638126353Smlaier YYERROR; 639130617Smlaier } 640171172Smlaier if (!pf->anchor->name[0]) { 641145840Smlaier if (pfctl_file_fingerprints(pf->dev, 642145840Smlaier pf->opts, $3)) { 643145840Smlaier yyerror("error loading " 644145840Smlaier "fingerprints %s", $3); 645145840Smlaier free($3); 646145840Smlaier YYERROR; 647145840Smlaier } 648126353Smlaier } 649130617Smlaier free($3); 650126353Smlaier } 651130617Smlaier | SET STATEPOLICY statelock { 652130617Smlaier if (pf->opts & PF_OPT_VERBOSE) 653130617Smlaier switch ($3) { 654130617Smlaier case 0: 655130617Smlaier printf("set state-policy floating\n"); 656130617Smlaier break; 657130617Smlaier case PFRULE_IFBOUND: 658130617Smlaier printf("set state-policy if-bound\n"); 659130617Smlaier break; 660130617Smlaier } 661130617Smlaier default_statelock = $3; 662130617Smlaier } 663130617Smlaier | SET DEBUG STRING { 664130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 665130617Smlaier free($3); 666130617Smlaier YYERROR; 667130617Smlaier } 668130617Smlaier if (pfctl_set_debug(pf, $3) != 0) { 669130617Smlaier yyerror("error setting debuglevel %s", $3); 670130617Smlaier free($3); 671130617Smlaier YYERROR; 672130617Smlaier } 673130617Smlaier free($3); 674130617Smlaier } 675145840Smlaier | SET SKIP interface { 676145840Smlaier if (expand_skip_interface($3) != 0) { 677145840Smlaier yyerror("error setting skip interface(s)"); 678145840Smlaier YYERROR; 679145840Smlaier } 680145840Smlaier } 681223637Sbz | SET STATEDEFAULTS state_opt_list { 682223637Sbz if (keep_state_defaults != NULL) { 683223637Sbz yyerror("cannot redefine state-defaults"); 684223637Sbz YYERROR; 685223637Sbz } 686223637Sbz keep_state_defaults = $3; 687223637Sbz } 688126353Smlaier ; 689126353Smlaier 690223637Sbzstringall : STRING { $$ = $1; } 691223637Sbz | ALL { 692223637Sbz if (($$ = strdup("all")) == NULL) { 693223637Sbz err(1, "stringall: strdup"); 694223637Sbz } 695223637Sbz } 696223637Sbz ; 697223637Sbz 698223637Sbzstring : STRING string { 699126353Smlaier if (asprintf(&$$, "%s %s", $1, $2) == -1) 700126353Smlaier err(1, "string: asprintf"); 701126353Smlaier free($1); 702126353Smlaier free($2); 703126353Smlaier } 704126353Smlaier | STRING 705126353Smlaier ; 706126353Smlaier 707223637Sbzvarstring : numberstring varstring { 708223637Sbz if (asprintf(&$$, "%s %s", $1, $2) == -1) 709223637Sbz err(1, "string: asprintf"); 710223637Sbz free($1); 711223637Sbz free($2); 712223637Sbz } 713223637Sbz | numberstring 714223637Sbz ; 715223637Sbz 716223637Sbznumberstring : NUMBER { 717223637Sbz char *s; 718223637Sbz if (asprintf(&s, "%lld", (long long)$1) == -1) { 719223637Sbz yyerror("string: asprintf"); 720223637Sbz YYERROR; 721223637Sbz } 722223637Sbz $$ = s; 723223637Sbz } 724223637Sbz | STRING 725223637Sbz ; 726223637Sbz 727223637Sbzvarset : STRING '=' varstring { 728126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 729126353Smlaier printf("%s = \"%s\"\n", $1, $3); 730126353Smlaier if (symset($1, $3, 0) == -1) 731126353Smlaier err(1, "cannot store variable %s", $1); 732130617Smlaier free($1); 733130617Smlaier free($3); 734126353Smlaier } 735126353Smlaier ; 736126353Smlaier 737171172Smlaieranchorname : STRING { $$ = $1; } 738171172Smlaier | /* empty */ { $$ = NULL; } 739171172Smlaier ; 740171172Smlaier 741223637Sbzpfa_anchorlist : /* empty */ 742223637Sbz | pfa_anchorlist '\n' 743223637Sbz | pfa_anchorlist pfrule '\n' 744223637Sbz | pfa_anchorlist anchorrule '\n' 745171172Smlaier ; 746171172Smlaier 747171172Smlaierpfa_anchor : '{' 748171172Smlaier { 749171172Smlaier char ta[PF_ANCHOR_NAME_SIZE]; 750171172Smlaier struct pf_ruleset *rs; 751171172Smlaier 752171172Smlaier /* steping into a brace anchor */ 753171172Smlaier pf->asd++; 754171172Smlaier pf->bn++; 755171172Smlaier pf->brace = 1; 756171172Smlaier 757171172Smlaier /* create a holding ruleset in the root */ 758171172Smlaier snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 759171172Smlaier rs = pf_find_or_create_ruleset(ta); 760171172Smlaier if (rs == NULL) 761171172Smlaier err(1, "pfa_anchor: pf_find_or_create_ruleset"); 762171172Smlaier pf->astack[pf->asd] = rs->anchor; 763171172Smlaier pf->anchor = rs->anchor; 764171172Smlaier } '\n' pfa_anchorlist '}' 765171172Smlaier { 766171172Smlaier pf->alast = pf->anchor; 767171172Smlaier pf->asd--; 768171172Smlaier pf->anchor = pf->astack[pf->asd]; 769171172Smlaier } 770171172Smlaier | /* empty */ 771171172Smlaier ; 772171172Smlaier 773171172Smlaieranchorrule : ANCHOR anchorname dir quick interface af proto fromto 774171172Smlaier filter_opts pfa_anchor 775171172Smlaier { 776126353Smlaier struct pf_rule r; 777223637Sbz struct node_proto *proto; 778126353Smlaier 779130617Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) { 780171172Smlaier if ($2) 781171172Smlaier free($2); 782171172Smlaier YYERROR; 783171172Smlaier } 784171172Smlaier 785171172Smlaier if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 786130617Smlaier free($2); 787171172Smlaier yyerror("anchor names beginning with '_' " 788171172Smlaier "are reserved for internal use"); 789126353Smlaier YYERROR; 790130617Smlaier } 791126353Smlaier 792145840Smlaier memset(&r, 0, sizeof(r)); 793171172Smlaier if (pf->astack[pf->asd + 1]) { 794171172Smlaier /* move inline rules into relative location */ 795171172Smlaier pf_anchor_setup(&r, 796171172Smlaier &pf->astack[pf->asd]->ruleset, 797171172Smlaier $2 ? $2 : pf->alast->name); 798171172Smlaier 799171172Smlaier if (r.anchor == NULL) 800171172Smlaier err(1, "anchorrule: unable to " 801171172Smlaier "create ruleset"); 802171172Smlaier 803171172Smlaier if (pf->alast != r.anchor) { 804171172Smlaier if (r.anchor->match) { 805171172Smlaier yyerror("inline anchor '%s' " 806171172Smlaier "already exists", 807171172Smlaier r.anchor->name); 808171172Smlaier YYERROR; 809171172Smlaier } 810171172Smlaier mv_rules(&pf->alast->ruleset, 811171172Smlaier &r.anchor->ruleset); 812171172Smlaier } 813171172Smlaier pf_remove_if_empty_ruleset(&pf->alast->ruleset); 814171172Smlaier pf->alast = r.anchor; 815171172Smlaier } else { 816171172Smlaier if (!$2) { 817171172Smlaier yyerror("anchors without explicit " 818171172Smlaier "rules must specify a name"); 819171172Smlaier YYERROR; 820171172Smlaier } 821171172Smlaier } 822126353Smlaier r.direction = $3; 823171172Smlaier r.quick = $4.quick; 824171172Smlaier r.af = $6; 825171172Smlaier r.prob = $9.prob; 826171172Smlaier r.rtableid = $9.rtableid; 827126353Smlaier 828223637Sbz if ($9.tag) 829223637Sbz if (strlcpy(r.tagname, $9.tag, 830223637Sbz PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 831223637Sbz yyerror("tag too long, max %u chars", 832223637Sbz PF_TAG_NAME_SIZE - 1); 833223637Sbz YYERROR; 834223637Sbz } 835171172Smlaier if ($9.match_tag) 836171172Smlaier if (strlcpy(r.match_tagname, $9.match_tag, 837130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 838130617Smlaier yyerror("tag too long, max %u chars", 839130617Smlaier PF_TAG_NAME_SIZE - 1); 840130617Smlaier YYERROR; 841130617Smlaier } 842171172Smlaier r.match_tag_not = $9.match_tag_not; 843223637Sbz if (rule_label(&r, $9.label)) 844223637Sbz YYERROR; 845223637Sbz free($9.label); 846223637Sbz r.flags = $9.flags.b1; 847223637Sbz r.flagset = $9.flags.b2; 848223637Sbz if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 849223637Sbz yyerror("flags always false"); 850223637Sbz YYERROR; 851223637Sbz } 852223637Sbz if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 853223637Sbz for (proto = $7; proto != NULL && 854223637Sbz proto->proto != IPPROTO_TCP; 855223637Sbz proto = proto->next) 856223637Sbz ; /* nothing */ 857223637Sbz if (proto == NULL && $7 != NULL) { 858223637Sbz if ($9.flags.b1 || $9.flags.b2) 859223637Sbz yyerror( 860223637Sbz "flags only apply to tcp"); 861223637Sbz if ($8.src_os) 862223637Sbz yyerror( 863223637Sbz "OS fingerprinting only " 864223637Sbz "applies to tcp"); 865223637Sbz YYERROR; 866223637Sbz } 867223637Sbz } 868130617Smlaier 869223637Sbz r.tos = $9.tos; 870223637Sbz 871223637Sbz if ($9.keep.action) { 872223637Sbz yyerror("cannot specify state handling " 873223637Sbz "on anchors"); 874223637Sbz YYERROR; 875223637Sbz } 876223637Sbz 877223637Sbz if ($9.match_tag) 878223637Sbz if (strlcpy(r.match_tagname, $9.match_tag, 879223637Sbz PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 880223637Sbz yyerror("tag too long, max %u chars", 881223637Sbz PF_TAG_NAME_SIZE - 1); 882223637Sbz YYERROR; 883223637Sbz } 884223637Sbz r.match_tag_not = $9.match_tag_not; 885223637Sbz 886171172Smlaier decide_address_family($8.src.host, &r.af); 887171172Smlaier decide_address_family($8.dst.host, &r.af); 888126353Smlaier 889171172Smlaier expand_rule(&r, $5, NULL, $7, $8.src_os, 890171172Smlaier $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 891223637Sbz $9.uid, $9.gid, $9.icmpspec, 892223637Sbz pf->astack[pf->asd + 1] ? pf->alast->name : $2); 893145840Smlaier free($2); 894171172Smlaier pf->astack[pf->asd + 1] = NULL; 895126353Smlaier } 896171172Smlaier | NATANCHOR string interface af proto fromto rtable { 897126353Smlaier struct pf_rule r; 898126353Smlaier 899130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 900130617Smlaier free($2); 901126353Smlaier YYERROR; 902130617Smlaier } 903126353Smlaier 904145840Smlaier memset(&r, 0, sizeof(r)); 905126353Smlaier r.action = PF_NAT; 906126353Smlaier r.af = $4; 907171172Smlaier r.rtableid = $7; 908126353Smlaier 909126353Smlaier decide_address_family($6.src.host, &r.af); 910126353Smlaier decide_address_family($6.dst.host, &r.af); 911126353Smlaier 912126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 913126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 914145840Smlaier 0, 0, 0, $2); 915145840Smlaier free($2); 916126353Smlaier } 917171172Smlaier | RDRANCHOR string interface af proto fromto rtable { 918126353Smlaier struct pf_rule r; 919126353Smlaier 920130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 921130617Smlaier free($2); 922126353Smlaier YYERROR; 923130617Smlaier } 924126353Smlaier 925145840Smlaier memset(&r, 0, sizeof(r)); 926126353Smlaier r.action = PF_RDR; 927126353Smlaier r.af = $4; 928171172Smlaier r.rtableid = $7; 929126353Smlaier 930126353Smlaier decide_address_family($6.src.host, &r.af); 931126353Smlaier decide_address_family($6.dst.host, &r.af); 932126353Smlaier 933126353Smlaier if ($6.src.port != NULL) { 934126353Smlaier yyerror("source port parameter not supported" 935126353Smlaier " in rdr-anchor"); 936126353Smlaier YYERROR; 937126353Smlaier } 938126353Smlaier if ($6.dst.port != NULL) { 939126353Smlaier if ($6.dst.port->next != NULL) { 940126353Smlaier yyerror("destination port list " 941126353Smlaier "expansion not supported in " 942126353Smlaier "rdr-anchor"); 943126353Smlaier YYERROR; 944126353Smlaier } else if ($6.dst.port->op != PF_OP_EQ) { 945126353Smlaier yyerror("destination port operators" 946126353Smlaier " not supported in rdr-anchor"); 947126353Smlaier YYERROR; 948126353Smlaier } 949126353Smlaier r.dst.port[0] = $6.dst.port->port[0]; 950126353Smlaier r.dst.port[1] = $6.dst.port->port[1]; 951126353Smlaier r.dst.port_op = $6.dst.port->op; 952126353Smlaier } 953126353Smlaier 954126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 955126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 956145840Smlaier 0, 0, 0, $2); 957145840Smlaier free($2); 958126353Smlaier } 959171172Smlaier | BINATANCHOR string interface af proto fromto rtable { 960126353Smlaier struct pf_rule r; 961126353Smlaier 962130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 963130617Smlaier free($2); 964126353Smlaier YYERROR; 965130617Smlaier } 966126353Smlaier 967145840Smlaier memset(&r, 0, sizeof(r)); 968126353Smlaier r.action = PF_BINAT; 969126353Smlaier r.af = $4; 970171172Smlaier r.rtableid = $7; 971126353Smlaier if ($5 != NULL) { 972126353Smlaier if ($5->next != NULL) { 973126353Smlaier yyerror("proto list expansion" 974126353Smlaier " not supported in binat-anchor"); 975126353Smlaier YYERROR; 976126353Smlaier } 977126353Smlaier r.proto = $5->proto; 978126353Smlaier free($5); 979126353Smlaier } 980126353Smlaier 981126353Smlaier if ($6.src.host != NULL || $6.src.port != NULL || 982126353Smlaier $6.dst.host != NULL || $6.dst.port != NULL) { 983126353Smlaier yyerror("fromto parameter not supported" 984126353Smlaier " in binat-anchor"); 985126353Smlaier YYERROR; 986126353Smlaier } 987126353Smlaier 988126353Smlaier decide_address_family($6.src.host, &r.af); 989126353Smlaier decide_address_family($6.dst.host, &r.af); 990126353Smlaier 991145840Smlaier pfctl_add_rule(pf, &r, $2); 992145840Smlaier free($2); 993126353Smlaier } 994126353Smlaier ; 995126353Smlaier 996126353Smlaierloadrule : LOAD ANCHOR string FROM string { 997126353Smlaier struct loadanchors *loadanchor; 998126353Smlaier 999171172Smlaier if (strlen(pf->anchor->name) + 1 + 1000171172Smlaier strlen($3) >= MAXPATHLEN) { 1001126353Smlaier yyerror("anchorname %s too long, max %u\n", 1002145840Smlaier $3, MAXPATHLEN - 1); 1003145840Smlaier free($3); 1004126353Smlaier YYERROR; 1005126353Smlaier } 1006126353Smlaier loadanchor = calloc(1, sizeof(struct loadanchors)); 1007126353Smlaier if (loadanchor == NULL) 1008126353Smlaier err(1, "loadrule: calloc"); 1009171172Smlaier if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 1010171172Smlaier NULL) 1011171172Smlaier err(1, "loadrule: malloc"); 1012171172Smlaier if (pf->anchor->name[0]) 1013171172Smlaier snprintf(loadanchor->anchorname, MAXPATHLEN, 1014171172Smlaier "%s/%s", pf->anchor->name, $3); 1015171172Smlaier else 1016171172Smlaier strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 1017126353Smlaier if ((loadanchor->filename = strdup($5)) == NULL) 1018126353Smlaier err(1, "loadrule: strdup"); 1019126353Smlaier 1020126353Smlaier TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 1021126353Smlaier entries); 1022126353Smlaier 1023145840Smlaier free($3); 1024126353Smlaier free($5); 1025126353Smlaier }; 1026126353Smlaier 1027145840Smlaierscrubaction : no SCRUB { 1028145840Smlaier $$.b2 = $$.w = 0; 1029145840Smlaier if ($1) 1030145840Smlaier $$.b1 = PF_NOSCRUB; 1031145840Smlaier else 1032145840Smlaier $$.b1 = PF_SCRUB; 1033145840Smlaier } 1034145840Smlaier ; 1035145840Smlaier 1036145840Smlaierscrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 1037126353Smlaier { 1038126353Smlaier struct pf_rule r; 1039126353Smlaier 1040126353Smlaier if (check_rulestate(PFCTL_STATE_SCRUB)) 1041126353Smlaier YYERROR; 1042126353Smlaier 1043126353Smlaier memset(&r, 0, sizeof(r)); 1044126353Smlaier 1045145840Smlaier r.action = $1.b1; 1046126353Smlaier r.direction = $2; 1047126353Smlaier 1048126353Smlaier r.log = $3.log; 1049171172Smlaier r.logif = $3.logif; 1050126353Smlaier if ($3.quick) { 1051126353Smlaier yyerror("scrub rules do not support 'quick'"); 1052126353Smlaier YYERROR; 1053126353Smlaier } 1054126353Smlaier 1055126353Smlaier r.af = $5; 1056126353Smlaier if ($8.nodf) 1057126353Smlaier r.rule_flag |= PFRULE_NODF; 1058126353Smlaier if ($8.randomid) 1059126353Smlaier r.rule_flag |= PFRULE_RANDOMID; 1060126353Smlaier if ($8.reassemble_tcp) { 1061126353Smlaier if (r.direction != PF_INOUT) { 1062126353Smlaier yyerror("reassemble tcp rules can not " 1063126353Smlaier "specify direction"); 1064126353Smlaier YYERROR; 1065126353Smlaier } 1066126353Smlaier r.rule_flag |= PFRULE_REASSEMBLE_TCP; 1067126353Smlaier } 1068126353Smlaier if ($8.minttl) 1069126353Smlaier r.min_ttl = $8.minttl; 1070126353Smlaier if ($8.maxmss) 1071126353Smlaier r.max_mss = $8.maxmss; 1072223637Sbz if ($8.marker & SOM_SETTOS) { 1073223637Sbz r.rule_flag |= PFRULE_SET_TOS; 1074223637Sbz r.set_tos = $8.settos; 1075223637Sbz } 1076126353Smlaier if ($8.fragcache) 1077126353Smlaier r.rule_flag |= $8.fragcache; 1078223637Sbz if ($8.match_tag) 1079223637Sbz if (strlcpy(r.match_tagname, $8.match_tag, 1080223637Sbz PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1081223637Sbz yyerror("tag too long, max %u chars", 1082223637Sbz PF_TAG_NAME_SIZE - 1); 1083223637Sbz YYERROR; 1084223637Sbz } 1085223637Sbz r.match_tag_not = $8.match_tag_not; 1086171172Smlaier r.rtableid = $8.rtableid; 1087126353Smlaier 1088126353Smlaier expand_rule(&r, $4, NULL, $6, $7.src_os, 1089126353Smlaier $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 1090145840Smlaier NULL, NULL, NULL, ""); 1091126353Smlaier } 1092126353Smlaier ; 1093126353Smlaier 1094126353Smlaierscrub_opts : { 1095171172Smlaier bzero(&scrub_opts, sizeof scrub_opts); 1096171172Smlaier scrub_opts.rtableid = -1; 1097171172Smlaier } 1098130617Smlaier scrub_opts_l 1099126353Smlaier { $$ = scrub_opts; } 1100126353Smlaier | /* empty */ { 1101126353Smlaier bzero(&scrub_opts, sizeof scrub_opts); 1102171172Smlaier scrub_opts.rtableid = -1; 1103126353Smlaier $$ = scrub_opts; 1104126353Smlaier } 1105126353Smlaier ; 1106126353Smlaier 1107126353Smlaierscrub_opts_l : scrub_opts_l scrub_opt 1108126353Smlaier | scrub_opt 1109126353Smlaier ; 1110126353Smlaier 1111126353Smlaierscrub_opt : NODF { 1112126353Smlaier if (scrub_opts.nodf) { 1113126353Smlaier yyerror("no-df cannot be respecified"); 1114126353Smlaier YYERROR; 1115126353Smlaier } 1116126353Smlaier scrub_opts.nodf = 1; 1117126353Smlaier } 1118223637Sbz | MINTTL NUMBER { 1119126353Smlaier if (scrub_opts.marker & SOM_MINTTL) { 1120126353Smlaier yyerror("min-ttl cannot be respecified"); 1121126353Smlaier YYERROR; 1122126353Smlaier } 1123223637Sbz if ($2 < 0 || $2 > 255) { 1124126353Smlaier yyerror("illegal min-ttl value %d", $2); 1125126353Smlaier YYERROR; 1126126353Smlaier } 1127126353Smlaier scrub_opts.marker |= SOM_MINTTL; 1128126353Smlaier scrub_opts.minttl = $2; 1129126353Smlaier } 1130223637Sbz | MAXMSS NUMBER { 1131126353Smlaier if (scrub_opts.marker & SOM_MAXMSS) { 1132126353Smlaier yyerror("max-mss cannot be respecified"); 1133126353Smlaier YYERROR; 1134126353Smlaier } 1135223637Sbz if ($2 < 0 || $2 > 65535) { 1136126353Smlaier yyerror("illegal max-mss value %d", $2); 1137126353Smlaier YYERROR; 1138126353Smlaier } 1139126353Smlaier scrub_opts.marker |= SOM_MAXMSS; 1140126353Smlaier scrub_opts.maxmss = $2; 1141126353Smlaier } 1142223637Sbz | SETTOS tos { 1143223637Sbz if (scrub_opts.marker & SOM_SETTOS) { 1144223637Sbz yyerror("set-tos cannot be respecified"); 1145223637Sbz YYERROR; 1146223637Sbz } 1147223637Sbz scrub_opts.marker |= SOM_SETTOS; 1148223637Sbz scrub_opts.settos = $2; 1149223637Sbz } 1150126353Smlaier | fragcache { 1151126353Smlaier if (scrub_opts.marker & SOM_FRAGCACHE) { 1152126353Smlaier yyerror("fragcache cannot be respecified"); 1153126353Smlaier YYERROR; 1154126353Smlaier } 1155126353Smlaier scrub_opts.marker |= SOM_FRAGCACHE; 1156126353Smlaier scrub_opts.fragcache = $1; 1157126353Smlaier } 1158126353Smlaier | REASSEMBLE STRING { 1159130617Smlaier if (strcasecmp($2, "tcp") != 0) { 1160145840Smlaier yyerror("scrub reassemble supports only tcp, " 1161145840Smlaier "not '%s'", $2); 1162130617Smlaier free($2); 1163126353Smlaier YYERROR; 1164130617Smlaier } 1165130617Smlaier free($2); 1166126353Smlaier if (scrub_opts.reassemble_tcp) { 1167126353Smlaier yyerror("reassemble tcp cannot be respecified"); 1168126353Smlaier YYERROR; 1169126353Smlaier } 1170126353Smlaier scrub_opts.reassemble_tcp = 1; 1171126353Smlaier } 1172126353Smlaier | RANDOMID { 1173126353Smlaier if (scrub_opts.randomid) { 1174126353Smlaier yyerror("random-id cannot be respecified"); 1175126353Smlaier YYERROR; 1176126353Smlaier } 1177126353Smlaier scrub_opts.randomid = 1; 1178126353Smlaier } 1179223637Sbz | RTABLE NUMBER { 1180231852Sbz if ($2 < 0 || $2 > rt_tableid_max()) { 1181171172Smlaier yyerror("invalid rtable id"); 1182171172Smlaier YYERROR; 1183171172Smlaier } 1184171172Smlaier scrub_opts.rtableid = $2; 1185171172Smlaier } 1186223637Sbz | not TAGGED string { 1187223637Sbz scrub_opts.match_tag = $3; 1188223637Sbz scrub_opts.match_tag_not = $1; 1189223637Sbz } 1190126353Smlaier ; 1191126353Smlaier 1192126353Smlaierfragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 1193126353Smlaier | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 1194126353Smlaier | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 1195126353Smlaier ; 1196126353Smlaier 1197126353Smlaierantispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1198126353Smlaier struct pf_rule r; 1199145840Smlaier struct node_host *h = NULL, *hh; 1200126353Smlaier struct node_if *i, *j; 1201126353Smlaier 1202126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 1203126353Smlaier YYERROR; 1204126353Smlaier 1205126353Smlaier for (i = $3; i; i = i->next) { 1206126353Smlaier bzero(&r, sizeof(r)); 1207126353Smlaier 1208126353Smlaier r.action = PF_DROP; 1209126353Smlaier r.direction = PF_IN; 1210126353Smlaier r.log = $2.log; 1211171172Smlaier r.logif = $2.logif; 1212126353Smlaier r.quick = $2.quick; 1213126353Smlaier r.af = $4; 1214126353Smlaier if (rule_label(&r, $5.label)) 1215126353Smlaier YYERROR; 1216171172Smlaier r.rtableid = $5.rtableid; 1217126353Smlaier j = calloc(1, sizeof(struct node_if)); 1218126353Smlaier if (j == NULL) 1219126353Smlaier err(1, "antispoof: calloc"); 1220126353Smlaier if (strlcpy(j->ifname, i->ifname, 1221126353Smlaier sizeof(j->ifname)) >= sizeof(j->ifname)) { 1222126353Smlaier free(j); 1223126353Smlaier yyerror("interface name too long"); 1224126353Smlaier YYERROR; 1225126353Smlaier } 1226126353Smlaier j->not = 1; 1227145840Smlaier if (i->dynamic) { 1228145840Smlaier h = calloc(1, sizeof(*h)); 1229145840Smlaier if (h == NULL) 1230145840Smlaier err(1, "address: calloc"); 1231145840Smlaier h->addr.type = PF_ADDR_DYNIFTL; 1232145840Smlaier set_ipmask(h, 128); 1233145840Smlaier if (strlcpy(h->addr.v.ifname, i->ifname, 1234145840Smlaier sizeof(h->addr.v.ifname)) >= 1235145840Smlaier sizeof(h->addr.v.ifname)) { 1236145840Smlaier free(h); 1237145840Smlaier yyerror( 1238145840Smlaier "interface name too long"); 1239145840Smlaier YYERROR; 1240145840Smlaier } 1241145840Smlaier hh = malloc(sizeof(*hh)); 1242145840Smlaier if (hh == NULL) 1243145840Smlaier err(1, "address: malloc"); 1244145840Smlaier bcopy(h, hh, sizeof(*hh)); 1245145840Smlaier h->addr.iflags = PFI_AFLAG_NETWORK; 1246145840Smlaier } else { 1247145840Smlaier h = ifa_lookup(j->ifname, 1248145840Smlaier PFI_AFLAG_NETWORK); 1249145840Smlaier hh = NULL; 1250145840Smlaier } 1251126353Smlaier 1252130617Smlaier if (h != NULL) 1253130617Smlaier expand_rule(&r, j, NULL, NULL, NULL, h, 1254145840Smlaier NULL, NULL, NULL, NULL, NULL, 1255145840Smlaier NULL, ""); 1256126353Smlaier 1257126353Smlaier if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1258126353Smlaier bzero(&r, sizeof(r)); 1259126353Smlaier 1260126353Smlaier r.action = PF_DROP; 1261126353Smlaier r.direction = PF_IN; 1262126353Smlaier r.log = $2.log; 1263223637Sbz r.logif = $2.logif; 1264126353Smlaier r.quick = $2.quick; 1265126353Smlaier r.af = $4; 1266126353Smlaier if (rule_label(&r, $5.label)) 1267126353Smlaier YYERROR; 1268171172Smlaier r.rtableid = $5.rtableid; 1269145840Smlaier if (hh != NULL) 1270145840Smlaier h = hh; 1271145840Smlaier else 1272145840Smlaier h = ifa_lookup(i->ifname, 0); 1273130617Smlaier if (h != NULL) 1274130617Smlaier expand_rule(&r, NULL, NULL, 1275130617Smlaier NULL, NULL, h, NULL, NULL, 1276145840Smlaier NULL, NULL, NULL, NULL, ""); 1277145840Smlaier } else 1278145840Smlaier free(hh); 1279126353Smlaier } 1280126353Smlaier free($5.label); 1281126353Smlaier } 1282126353Smlaier ; 1283126353Smlaier 1284223637Sbzantispoof_ifspc : FOR antispoof_if { $$ = $2; } 1285223637Sbz | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1286126353Smlaier ; 1287126353Smlaier 1288223637Sbzantispoof_iflst : antispoof_if optnl { $$ = $1; } 1289223637Sbz | antispoof_iflst comma antispoof_if optnl { 1290126353Smlaier $1->tail->next = $3; 1291126353Smlaier $1->tail = $3; 1292126353Smlaier $$ = $1; 1293126353Smlaier } 1294126353Smlaier ; 1295126353Smlaier 1296223637Sbzantispoof_if : if_item { $$ = $1; } 1297223637Sbz | '(' if_item ')' { 1298145840Smlaier $2->dynamic = 1; 1299145840Smlaier $$ = $2; 1300145840Smlaier } 1301145840Smlaier ; 1302145840Smlaier 1303171172Smlaierantispoof_opts : { 1304171172Smlaier bzero(&antispoof_opts, sizeof antispoof_opts); 1305171172Smlaier antispoof_opts.rtableid = -1; 1306171172Smlaier } 1307130617Smlaier antispoof_opts_l 1308126353Smlaier { $$ = antispoof_opts; } 1309126353Smlaier | /* empty */ { 1310126353Smlaier bzero(&antispoof_opts, sizeof antispoof_opts); 1311171172Smlaier antispoof_opts.rtableid = -1; 1312126353Smlaier $$ = antispoof_opts; 1313126353Smlaier } 1314126353Smlaier ; 1315126353Smlaier 1316126353Smlaierantispoof_opts_l : antispoof_opts_l antispoof_opt 1317126353Smlaier | antispoof_opt 1318126353Smlaier ; 1319126353Smlaier 1320126353Smlaierantispoof_opt : label { 1321126353Smlaier if (antispoof_opts.label) { 1322126353Smlaier yyerror("label cannot be redefined"); 1323126353Smlaier YYERROR; 1324126353Smlaier } 1325126353Smlaier antispoof_opts.label = $1; 1326126353Smlaier } 1327223637Sbz | RTABLE NUMBER { 1328231852Sbz if ($2 < 0 || $2 > rt_tableid_max()) { 1329171172Smlaier yyerror("invalid rtable id"); 1330171172Smlaier YYERROR; 1331171172Smlaier } 1332171172Smlaier antispoof_opts.rtableid = $2; 1333171172Smlaier } 1334126353Smlaier ; 1335126353Smlaier 1336126353Smlaiernot : '!' { $$ = 1; } 1337126353Smlaier | /* empty */ { $$ = 0; } 1338130617Smlaier ; 1339126353Smlaier 1340126353Smlaiertabledef : TABLE '<' STRING '>' table_opts { 1341126353Smlaier struct node_host *h, *nh; 1342126353Smlaier struct node_tinit *ti, *nti; 1343126353Smlaier 1344126353Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1345126353Smlaier yyerror("table name too long, max %d chars", 1346126353Smlaier PF_TABLE_NAME_SIZE - 1); 1347130617Smlaier free($3); 1348126353Smlaier YYERROR; 1349126353Smlaier } 1350126353Smlaier if (pf->loadopt & PFCTL_FLAG_TABLE) 1351130617Smlaier if (process_tabledef($3, &$5)) { 1352130617Smlaier free($3); 1353126353Smlaier YYERROR; 1354130617Smlaier } 1355130617Smlaier free($3); 1356126353Smlaier for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1357126353Smlaier ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1358126353Smlaier if (ti->file) 1359126353Smlaier free(ti->file); 1360126353Smlaier for (h = ti->host; h != NULL; h = nh) { 1361126353Smlaier nh = h->next; 1362126353Smlaier free(h); 1363126353Smlaier } 1364126353Smlaier nti = SIMPLEQ_NEXT(ti, entries); 1365130617Smlaier free(ti); 1366126353Smlaier } 1367126353Smlaier } 1368126353Smlaier ; 1369126353Smlaier 1370126353Smlaiertable_opts : { 1371126353Smlaier bzero(&table_opts, sizeof table_opts); 1372126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 1373126353Smlaier } 1374130617Smlaier table_opts_l 1375126353Smlaier { $$ = table_opts; } 1376126353Smlaier | /* empty */ 1377126353Smlaier { 1378126353Smlaier bzero(&table_opts, sizeof table_opts); 1379126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 1380126353Smlaier $$ = table_opts; 1381126353Smlaier } 1382126353Smlaier ; 1383126353Smlaier 1384126353Smlaiertable_opts_l : table_opts_l table_opt 1385126353Smlaier | table_opt 1386126353Smlaier ; 1387126353Smlaier 1388126353Smlaiertable_opt : STRING { 1389126353Smlaier if (!strcmp($1, "const")) 1390126353Smlaier table_opts.flags |= PFR_TFLAG_CONST; 1391126353Smlaier else if (!strcmp($1, "persist")) 1392126353Smlaier table_opts.flags |= PFR_TFLAG_PERSIST; 1393223637Sbz else if (!strcmp($1, "counters")) 1394223637Sbz table_opts.flags |= PFR_TFLAG_COUNTERS; 1395130617Smlaier else { 1396145840Smlaier yyerror("invalid table option '%s'", $1); 1397130617Smlaier free($1); 1398126353Smlaier YYERROR; 1399130617Smlaier } 1400130617Smlaier free($1); 1401126353Smlaier } 1402223637Sbz | '{' optnl '}' { table_opts.init_addr = 1; } 1403223637Sbz | '{' optnl host_list '}' { 1404126353Smlaier struct node_host *n; 1405126353Smlaier struct node_tinit *ti; 1406126353Smlaier 1407223637Sbz for (n = $3; n != NULL; n = n->next) { 1408130617Smlaier switch (n->addr.type) { 1409126353Smlaier case PF_ADDR_ADDRMASK: 1410126353Smlaier continue; /* ok */ 1411223637Sbz case PF_ADDR_RANGE: 1412223637Sbz yyerror("address ranges are not " 1413223637Sbz "permitted inside tables"); 1414223637Sbz break; 1415126353Smlaier case PF_ADDR_DYNIFTL: 1416126353Smlaier yyerror("dynamic addresses are not " 1417126353Smlaier "permitted inside tables"); 1418126353Smlaier break; 1419126353Smlaier case PF_ADDR_TABLE: 1420126353Smlaier yyerror("tables cannot contain tables"); 1421126353Smlaier break; 1422126353Smlaier case PF_ADDR_NOROUTE: 1423126353Smlaier yyerror("\"no-route\" is not permitted " 1424126353Smlaier "inside tables"); 1425126353Smlaier break; 1426171172Smlaier case PF_ADDR_URPFFAILED: 1427171172Smlaier yyerror("\"urpf-failed\" is not " 1428171172Smlaier "permitted inside tables"); 1429171172Smlaier break; 1430126353Smlaier default: 1431126353Smlaier yyerror("unknown address type %d", 1432126353Smlaier n->addr.type); 1433126353Smlaier } 1434126353Smlaier YYERROR; 1435126353Smlaier } 1436126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 1437126353Smlaier err(1, "table_opt: calloc"); 1438223637Sbz ti->host = $3; 1439126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1440126353Smlaier entries); 1441126353Smlaier table_opts.init_addr = 1; 1442126353Smlaier } 1443126353Smlaier | FILENAME STRING { 1444126353Smlaier struct node_tinit *ti; 1445126353Smlaier 1446126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 1447126353Smlaier err(1, "table_opt: calloc"); 1448126353Smlaier ti->file = $2; 1449126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1450126353Smlaier entries); 1451126353Smlaier table_opts.init_addr = 1; 1452126353Smlaier } 1453126353Smlaier ; 1454126353Smlaier 1455126353Smlaieraltqif : ALTQ interface queue_opts QUEUE qassign { 1456126353Smlaier struct pf_altq a; 1457126353Smlaier 1458126353Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) 1459126353Smlaier YYERROR; 1460126353Smlaier 1461126353Smlaier memset(&a, 0, sizeof(a)); 1462126353Smlaier if ($3.scheduler.qtype == ALTQT_NONE) { 1463126353Smlaier yyerror("no scheduler specified!"); 1464126353Smlaier YYERROR; 1465126353Smlaier } 1466126353Smlaier a.scheduler = $3.scheduler.qtype; 1467126353Smlaier a.qlimit = $3.qlimit; 1468126353Smlaier a.tbrsize = $3.tbrsize; 1469126353Smlaier if ($5 == NULL) { 1470126353Smlaier yyerror("no child queues specified"); 1471126353Smlaier YYERROR; 1472126353Smlaier } 1473126353Smlaier if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1474126353Smlaier &$3.scheduler)) 1475126353Smlaier YYERROR; 1476126353Smlaier } 1477126353Smlaier ; 1478126353Smlaier 1479126353Smlaierqueuespec : QUEUE STRING interface queue_opts qassign { 1480126353Smlaier struct pf_altq a; 1481126353Smlaier 1482130617Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) { 1483130617Smlaier free($2); 1484126353Smlaier YYERROR; 1485130617Smlaier } 1486126353Smlaier 1487126353Smlaier memset(&a, 0, sizeof(a)); 1488126353Smlaier 1489126353Smlaier if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1490126353Smlaier sizeof(a.qname)) { 1491126353Smlaier yyerror("queue name too long (max " 1492126353Smlaier "%d chars)", PF_QNAME_SIZE-1); 1493130617Smlaier free($2); 1494126353Smlaier YYERROR; 1495126353Smlaier } 1496130617Smlaier free($2); 1497126353Smlaier if ($4.tbrsize) { 1498126353Smlaier yyerror("cannot specify tbrsize for queue"); 1499126353Smlaier YYERROR; 1500126353Smlaier } 1501126353Smlaier if ($4.priority > 255) { 1502126353Smlaier yyerror("priority out of range: max 255"); 1503126353Smlaier YYERROR; 1504126353Smlaier } 1505126353Smlaier a.priority = $4.priority; 1506126353Smlaier a.qlimit = $4.qlimit; 1507126353Smlaier a.scheduler = $4.scheduler.qtype; 1508126353Smlaier if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1509126353Smlaier &$4.scheduler)) { 1510126353Smlaier yyerror("errors in queue definition"); 1511126353Smlaier YYERROR; 1512126353Smlaier } 1513126353Smlaier } 1514126353Smlaier ; 1515126353Smlaier 1516126353Smlaierqueue_opts : { 1517126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1518126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1519126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1520126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1521126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1522126353Smlaier } 1523130617Smlaier queue_opts_l 1524126353Smlaier { $$ = queue_opts; } 1525126353Smlaier | /* empty */ { 1526126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1527126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1528126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1529126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1530126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1531126353Smlaier $$ = queue_opts; 1532126353Smlaier } 1533126353Smlaier ; 1534126353Smlaier 1535126353Smlaierqueue_opts_l : queue_opts_l queue_opt 1536126353Smlaier | queue_opt 1537126353Smlaier ; 1538126353Smlaier 1539126353Smlaierqueue_opt : BANDWIDTH bandwidth { 1540126353Smlaier if (queue_opts.marker & QOM_BWSPEC) { 1541126353Smlaier yyerror("bandwidth cannot be respecified"); 1542126353Smlaier YYERROR; 1543126353Smlaier } 1544126353Smlaier queue_opts.marker |= QOM_BWSPEC; 1545126353Smlaier queue_opts.queue_bwspec = $2; 1546126353Smlaier } 1547223637Sbz | PRIORITY NUMBER { 1548126353Smlaier if (queue_opts.marker & QOM_PRIORITY) { 1549126353Smlaier yyerror("priority cannot be respecified"); 1550126353Smlaier YYERROR; 1551126353Smlaier } 1552223637Sbz if ($2 < 0 || $2 > 255) { 1553126353Smlaier yyerror("priority out of range: max 255"); 1554126353Smlaier YYERROR; 1555126353Smlaier } 1556126353Smlaier queue_opts.marker |= QOM_PRIORITY; 1557126353Smlaier queue_opts.priority = $2; 1558126353Smlaier } 1559223637Sbz | QLIMIT NUMBER { 1560126353Smlaier if (queue_opts.marker & QOM_QLIMIT) { 1561126353Smlaier yyerror("qlimit cannot be respecified"); 1562126353Smlaier YYERROR; 1563126353Smlaier } 1564223637Sbz if ($2 < 0 || $2 > 65535) { 1565126353Smlaier yyerror("qlimit out of range: max 65535"); 1566126353Smlaier YYERROR; 1567126353Smlaier } 1568126353Smlaier queue_opts.marker |= QOM_QLIMIT; 1569126353Smlaier queue_opts.qlimit = $2; 1570126353Smlaier } 1571126353Smlaier | scheduler { 1572126353Smlaier if (queue_opts.marker & QOM_SCHEDULER) { 1573126353Smlaier yyerror("scheduler cannot be respecified"); 1574126353Smlaier YYERROR; 1575126353Smlaier } 1576126353Smlaier queue_opts.marker |= QOM_SCHEDULER; 1577126353Smlaier queue_opts.scheduler = $1; 1578126353Smlaier } 1579223637Sbz | TBRSIZE NUMBER { 1580126353Smlaier if (queue_opts.marker & QOM_TBRSIZE) { 1581126353Smlaier yyerror("tbrsize cannot be respecified"); 1582126353Smlaier YYERROR; 1583126353Smlaier } 1584223637Sbz if ($2 < 0 || $2 > 65535) { 1585126353Smlaier yyerror("tbrsize too big: max 65535"); 1586126353Smlaier YYERROR; 1587126353Smlaier } 1588126353Smlaier queue_opts.marker |= QOM_TBRSIZE; 1589126353Smlaier queue_opts.tbrsize = $2; 1590126353Smlaier } 1591126353Smlaier ; 1592126353Smlaier 1593126353Smlaierbandwidth : STRING { 1594126353Smlaier double bps; 1595126353Smlaier char *cp; 1596126353Smlaier 1597126353Smlaier $$.bw_percent = 0; 1598126353Smlaier 1599126353Smlaier bps = strtod($1, &cp); 1600126353Smlaier if (cp != NULL) { 1601126353Smlaier if (!strcmp(cp, "b")) 1602126353Smlaier ; /* nothing */ 1603126353Smlaier else if (!strcmp(cp, "Kb")) 1604126353Smlaier bps *= 1000; 1605126353Smlaier else if (!strcmp(cp, "Mb")) 1606126353Smlaier bps *= 1000 * 1000; 1607126353Smlaier else if (!strcmp(cp, "Gb")) 1608126353Smlaier bps *= 1000 * 1000 * 1000; 1609126353Smlaier else if (!strcmp(cp, "%")) { 1610126353Smlaier if (bps < 0 || bps > 100) { 1611126353Smlaier yyerror("bandwidth spec " 1612126353Smlaier "out of range"); 1613130617Smlaier free($1); 1614126353Smlaier YYERROR; 1615126353Smlaier } 1616126353Smlaier $$.bw_percent = bps; 1617126353Smlaier bps = 0; 1618126353Smlaier } else { 1619126353Smlaier yyerror("unknown unit %s", cp); 1620130617Smlaier free($1); 1621126353Smlaier YYERROR; 1622126353Smlaier } 1623126353Smlaier } 1624130617Smlaier free($1); 1625126353Smlaier $$.bw_absolute = (u_int32_t)bps; 1626126353Smlaier } 1627223637Sbz | NUMBER { 1628223637Sbz if ($1 < 0 || $1 > UINT_MAX) { 1629223637Sbz yyerror("bandwidth number too big"); 1630223637Sbz YYERROR; 1631223637Sbz } 1632223637Sbz $$.bw_percent = 0; 1633223637Sbz $$.bw_absolute = $1; 1634223637Sbz } 1635130617Smlaier ; 1636126353Smlaier 1637126353Smlaierscheduler : CBQ { 1638126353Smlaier $$.qtype = ALTQT_CBQ; 1639126353Smlaier $$.data.cbq_opts.flags = 0; 1640126353Smlaier } 1641126353Smlaier | CBQ '(' cbqflags_list ')' { 1642126353Smlaier $$.qtype = ALTQT_CBQ; 1643126353Smlaier $$.data.cbq_opts.flags = $3; 1644126353Smlaier } 1645126353Smlaier | PRIQ { 1646126353Smlaier $$.qtype = ALTQT_PRIQ; 1647126353Smlaier $$.data.priq_opts.flags = 0; 1648126353Smlaier } 1649126353Smlaier | PRIQ '(' priqflags_list ')' { 1650126353Smlaier $$.qtype = ALTQT_PRIQ; 1651126353Smlaier $$.data.priq_opts.flags = $3; 1652126353Smlaier } 1653126353Smlaier | HFSC { 1654126353Smlaier $$.qtype = ALTQT_HFSC; 1655126353Smlaier bzero(&$$.data.hfsc_opts, 1656126353Smlaier sizeof(struct node_hfsc_opts)); 1657126353Smlaier } 1658126353Smlaier | HFSC '(' hfsc_opts ')' { 1659126353Smlaier $$.qtype = ALTQT_HFSC; 1660126353Smlaier $$.data.hfsc_opts = $3; 1661126353Smlaier } 1662126353Smlaier ; 1663126353Smlaier 1664126353Smlaiercbqflags_list : cbqflags_item { $$ |= $1; } 1665126353Smlaier | cbqflags_list comma cbqflags_item { $$ |= $3; } 1666126353Smlaier ; 1667126353Smlaier 1668126353Smlaiercbqflags_item : STRING { 1669126353Smlaier if (!strcmp($1, "default")) 1670126353Smlaier $$ = CBQCLF_DEFCLASS; 1671126353Smlaier else if (!strcmp($1, "borrow")) 1672126353Smlaier $$ = CBQCLF_BORROW; 1673126353Smlaier else if (!strcmp($1, "red")) 1674126353Smlaier $$ = CBQCLF_RED; 1675126353Smlaier else if (!strcmp($1, "ecn")) 1676126353Smlaier $$ = CBQCLF_RED|CBQCLF_ECN; 1677126353Smlaier else if (!strcmp($1, "rio")) 1678126353Smlaier $$ = CBQCLF_RIO; 1679126353Smlaier else { 1680126353Smlaier yyerror("unknown cbq flag \"%s\"", $1); 1681130617Smlaier free($1); 1682126353Smlaier YYERROR; 1683126353Smlaier } 1684130617Smlaier free($1); 1685126353Smlaier } 1686126353Smlaier ; 1687126353Smlaier 1688126353Smlaierpriqflags_list : priqflags_item { $$ |= $1; } 1689126353Smlaier | priqflags_list comma priqflags_item { $$ |= $3; } 1690126353Smlaier ; 1691126353Smlaier 1692126353Smlaierpriqflags_item : STRING { 1693126353Smlaier if (!strcmp($1, "default")) 1694126353Smlaier $$ = PRCF_DEFAULTCLASS; 1695126353Smlaier else if (!strcmp($1, "red")) 1696126353Smlaier $$ = PRCF_RED; 1697126353Smlaier else if (!strcmp($1, "ecn")) 1698126353Smlaier $$ = PRCF_RED|PRCF_ECN; 1699126353Smlaier else if (!strcmp($1, "rio")) 1700126353Smlaier $$ = PRCF_RIO; 1701126353Smlaier else { 1702126353Smlaier yyerror("unknown priq flag \"%s\"", $1); 1703130617Smlaier free($1); 1704126353Smlaier YYERROR; 1705126353Smlaier } 1706130617Smlaier free($1); 1707126353Smlaier } 1708126353Smlaier ; 1709126353Smlaier 1710126353Smlaierhfsc_opts : { 1711126353Smlaier bzero(&hfsc_opts, 1712126353Smlaier sizeof(struct node_hfsc_opts)); 1713126353Smlaier } 1714130617Smlaier hfscopts_list { 1715126353Smlaier $$ = hfsc_opts; 1716126353Smlaier } 1717126353Smlaier ; 1718126353Smlaier 1719126353Smlaierhfscopts_list : hfscopts_item 1720126353Smlaier | hfscopts_list comma hfscopts_item 1721126353Smlaier ; 1722126353Smlaier 1723126353Smlaierhfscopts_item : LINKSHARE bandwidth { 1724126353Smlaier if (hfsc_opts.linkshare.used) { 1725126353Smlaier yyerror("linkshare already specified"); 1726126353Smlaier YYERROR; 1727126353Smlaier } 1728126353Smlaier hfsc_opts.linkshare.m2 = $2; 1729126353Smlaier hfsc_opts.linkshare.used = 1; 1730126353Smlaier } 1731223637Sbz | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 1732145840Smlaier { 1733223637Sbz if ($5 < 0 || $5 > INT_MAX) { 1734223637Sbz yyerror("timing in curve out of range"); 1735223637Sbz YYERROR; 1736223637Sbz } 1737126353Smlaier if (hfsc_opts.linkshare.used) { 1738126353Smlaier yyerror("linkshare already specified"); 1739126353Smlaier YYERROR; 1740126353Smlaier } 1741126353Smlaier hfsc_opts.linkshare.m1 = $3; 1742145840Smlaier hfsc_opts.linkshare.d = $5; 1743145840Smlaier hfsc_opts.linkshare.m2 = $7; 1744126353Smlaier hfsc_opts.linkshare.used = 1; 1745126353Smlaier } 1746126353Smlaier | REALTIME bandwidth { 1747126353Smlaier if (hfsc_opts.realtime.used) { 1748126353Smlaier yyerror("realtime already specified"); 1749126353Smlaier YYERROR; 1750126353Smlaier } 1751126353Smlaier hfsc_opts.realtime.m2 = $2; 1752126353Smlaier hfsc_opts.realtime.used = 1; 1753126353Smlaier } 1754223637Sbz | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 1755145840Smlaier { 1756223637Sbz if ($5 < 0 || $5 > INT_MAX) { 1757223637Sbz yyerror("timing in curve out of range"); 1758223637Sbz YYERROR; 1759223637Sbz } 1760126353Smlaier if (hfsc_opts.realtime.used) { 1761126353Smlaier yyerror("realtime already specified"); 1762126353Smlaier YYERROR; 1763126353Smlaier } 1764126353Smlaier hfsc_opts.realtime.m1 = $3; 1765145840Smlaier hfsc_opts.realtime.d = $5; 1766145840Smlaier hfsc_opts.realtime.m2 = $7; 1767126353Smlaier hfsc_opts.realtime.used = 1; 1768126353Smlaier } 1769126353Smlaier | UPPERLIMIT bandwidth { 1770126353Smlaier if (hfsc_opts.upperlimit.used) { 1771126353Smlaier yyerror("upperlimit already specified"); 1772126353Smlaier YYERROR; 1773126353Smlaier } 1774126353Smlaier hfsc_opts.upperlimit.m2 = $2; 1775126353Smlaier hfsc_opts.upperlimit.used = 1; 1776126353Smlaier } 1777223637Sbz | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 1778145840Smlaier { 1779223637Sbz if ($5 < 0 || $5 > INT_MAX) { 1780223637Sbz yyerror("timing in curve out of range"); 1781223637Sbz YYERROR; 1782223637Sbz } 1783126353Smlaier if (hfsc_opts.upperlimit.used) { 1784126353Smlaier yyerror("upperlimit already specified"); 1785126353Smlaier YYERROR; 1786126353Smlaier } 1787126353Smlaier hfsc_opts.upperlimit.m1 = $3; 1788145840Smlaier hfsc_opts.upperlimit.d = $5; 1789145840Smlaier hfsc_opts.upperlimit.m2 = $7; 1790126353Smlaier hfsc_opts.upperlimit.used = 1; 1791126353Smlaier } 1792126353Smlaier | STRING { 1793126353Smlaier if (!strcmp($1, "default")) 1794126353Smlaier hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1795126353Smlaier else if (!strcmp($1, "red")) 1796126353Smlaier hfsc_opts.flags |= HFCF_RED; 1797126353Smlaier else if (!strcmp($1, "ecn")) 1798126353Smlaier hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1799126353Smlaier else if (!strcmp($1, "rio")) 1800126353Smlaier hfsc_opts.flags |= HFCF_RIO; 1801126353Smlaier else { 1802126353Smlaier yyerror("unknown hfsc flag \"%s\"", $1); 1803130617Smlaier free($1); 1804126353Smlaier YYERROR; 1805126353Smlaier } 1806130617Smlaier free($1); 1807126353Smlaier } 1808126353Smlaier ; 1809126353Smlaier 1810126353Smlaierqassign : /* empty */ { $$ = NULL; } 1811126353Smlaier | qassign_item { $$ = $1; } 1812223637Sbz | '{' optnl qassign_list '}' { $$ = $3; } 1813126353Smlaier ; 1814126353Smlaier 1815223637Sbzqassign_list : qassign_item optnl { $$ = $1; } 1816223637Sbz | qassign_list comma qassign_item optnl { 1817126353Smlaier $1->tail->next = $3; 1818126353Smlaier $1->tail = $3; 1819126353Smlaier $$ = $1; 1820126353Smlaier } 1821126353Smlaier ; 1822126353Smlaier 1823126353Smlaierqassign_item : STRING { 1824126353Smlaier $$ = calloc(1, sizeof(struct node_queue)); 1825126353Smlaier if ($$ == NULL) 1826126353Smlaier err(1, "qassign_item: calloc"); 1827126353Smlaier if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1828126353Smlaier sizeof($$->queue)) { 1829126353Smlaier yyerror("queue name '%s' too long (max " 1830126353Smlaier "%d chars)", $1, sizeof($$->queue)-1); 1831130617Smlaier free($1); 1832130617Smlaier free($$); 1833126353Smlaier YYERROR; 1834126353Smlaier } 1835130617Smlaier free($1); 1836126353Smlaier $$->next = NULL; 1837126353Smlaier $$->tail = $$; 1838126353Smlaier } 1839126353Smlaier ; 1840126353Smlaier 1841126353Smlaierpfrule : action dir logquick interface route af proto fromto 1842130617Smlaier filter_opts 1843126353Smlaier { 1844126353Smlaier struct pf_rule r; 1845126353Smlaier struct node_state_opt *o; 1846126353Smlaier struct node_proto *proto; 1847130617Smlaier int srctrack = 0; 1848130617Smlaier int statelock = 0; 1849171172Smlaier int adaptive = 0; 1850223637Sbz int defaults = 0; 1851126353Smlaier 1852126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 1853126353Smlaier YYERROR; 1854126353Smlaier 1855126353Smlaier memset(&r, 0, sizeof(r)); 1856126353Smlaier 1857126353Smlaier r.action = $1.b1; 1858126353Smlaier switch ($1.b2) { 1859126353Smlaier case PFRULE_RETURNRST: 1860126353Smlaier r.rule_flag |= PFRULE_RETURNRST; 1861126353Smlaier r.return_ttl = $1.w; 1862126353Smlaier break; 1863126353Smlaier case PFRULE_RETURNICMP: 1864126353Smlaier r.rule_flag |= PFRULE_RETURNICMP; 1865126353Smlaier r.return_icmp = $1.w; 1866126353Smlaier r.return_icmp6 = $1.w2; 1867126353Smlaier break; 1868126353Smlaier case PFRULE_RETURN: 1869126353Smlaier r.rule_flag |= PFRULE_RETURN; 1870126353Smlaier r.return_icmp = $1.w; 1871126353Smlaier r.return_icmp6 = $1.w2; 1872126353Smlaier break; 1873126353Smlaier } 1874126353Smlaier r.direction = $2; 1875126353Smlaier r.log = $3.log; 1876171172Smlaier r.logif = $3.logif; 1877126353Smlaier r.quick = $3.quick; 1878145840Smlaier r.prob = $9.prob; 1879171172Smlaier r.rtableid = $9.rtableid; 1880126353Smlaier 1881126353Smlaier r.af = $6; 1882126353Smlaier if ($9.tag) 1883126353Smlaier if (strlcpy(r.tagname, $9.tag, 1884130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1885126353Smlaier yyerror("tag too long, max %u chars", 1886126353Smlaier PF_TAG_NAME_SIZE - 1); 1887126353Smlaier YYERROR; 1888126353Smlaier } 1889126353Smlaier if ($9.match_tag) 1890126353Smlaier if (strlcpy(r.match_tagname, $9.match_tag, 1891130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1892126353Smlaier yyerror("tag too long, max %u chars", 1893126353Smlaier PF_TAG_NAME_SIZE - 1); 1894126353Smlaier YYERROR; 1895126353Smlaier } 1896126353Smlaier r.match_tag_not = $9.match_tag_not; 1897171172Smlaier if (rule_label(&r, $9.label)) 1898171172Smlaier YYERROR; 1899171172Smlaier free($9.label); 1900126353Smlaier r.flags = $9.flags.b1; 1901126353Smlaier r.flagset = $9.flags.b2; 1902171172Smlaier if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 1903171172Smlaier yyerror("flags always false"); 1904126353Smlaier YYERROR; 1905171172Smlaier } 1906126353Smlaier if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1907126353Smlaier for (proto = $7; proto != NULL && 1908126353Smlaier proto->proto != IPPROTO_TCP; 1909126353Smlaier proto = proto->next) 1910126353Smlaier ; /* nothing */ 1911126353Smlaier if (proto == NULL && $7 != NULL) { 1912126353Smlaier if ($9.flags.b1 || $9.flags.b2) 1913126353Smlaier yyerror( 1914126353Smlaier "flags only apply to tcp"); 1915126353Smlaier if ($8.src_os) 1916126353Smlaier yyerror( 1917126353Smlaier "OS fingerprinting only " 1918126353Smlaier "apply to tcp"); 1919126353Smlaier YYERROR; 1920126353Smlaier } 1921126353Smlaier#if 0 1922126353Smlaier if (($9.flags.b1 & parse_flags("S")) == 0 && 1923126353Smlaier $8.src_os) { 1924126353Smlaier yyerror("OS fingerprinting requires " 1925130617Smlaier "the SYN TCP flag (flags S/SA)"); 1926126353Smlaier YYERROR; 1927126353Smlaier } 1928126353Smlaier#endif 1929126353Smlaier } 1930126353Smlaier 1931126353Smlaier r.tos = $9.tos; 1932126353Smlaier r.keep_state = $9.keep.action; 1933223637Sbz o = $9.keep.options; 1934171172Smlaier 1935171172Smlaier /* 'keep state' by default on pass rules. */ 1936171172Smlaier if (!r.keep_state && !r.action && 1937223637Sbz !($9.marker & FOM_KEEP)) { 1938171172Smlaier r.keep_state = PF_STATE_NORMAL; 1939223637Sbz o = keep_state_defaults; 1940223637Sbz defaults = 1; 1941223637Sbz } 1942171172Smlaier 1943126353Smlaier while (o) { 1944126353Smlaier struct node_state_opt *p = o; 1945126353Smlaier 1946126353Smlaier switch (o->type) { 1947126353Smlaier case PF_STATE_OPT_MAX: 1948126353Smlaier if (r.max_states) { 1949126353Smlaier yyerror("state option 'max' " 1950126353Smlaier "multiple definitions"); 1951126353Smlaier YYERROR; 1952126353Smlaier } 1953126353Smlaier r.max_states = o->data.max_states; 1954126353Smlaier break; 1955130617Smlaier case PF_STATE_OPT_NOSYNC: 1956130617Smlaier if (r.rule_flag & PFRULE_NOSYNC) { 1957130617Smlaier yyerror("state option 'sync' " 1958130617Smlaier "multiple definitions"); 1959130617Smlaier YYERROR; 1960130617Smlaier } 1961130617Smlaier r.rule_flag |= PFRULE_NOSYNC; 1962130617Smlaier break; 1963130617Smlaier case PF_STATE_OPT_SRCTRACK: 1964130617Smlaier if (srctrack) { 1965130617Smlaier yyerror("state option " 1966130617Smlaier "'source-track' " 1967130617Smlaier "multiple definitions"); 1968130617Smlaier YYERROR; 1969130617Smlaier } 1970130617Smlaier srctrack = o->data.src_track; 1971145840Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1972130617Smlaier break; 1973130617Smlaier case PF_STATE_OPT_MAX_SRC_STATES: 1974130617Smlaier if (r.max_src_states) { 1975130617Smlaier yyerror("state option " 1976130617Smlaier "'max-src-states' " 1977130617Smlaier "multiple definitions"); 1978130617Smlaier YYERROR; 1979130617Smlaier } 1980145840Smlaier if (o->data.max_src_states == 0) { 1981130617Smlaier yyerror("'max-src-states' must " 1982130617Smlaier "be > 0"); 1983130617Smlaier YYERROR; 1984130617Smlaier } 1985130617Smlaier r.max_src_states = 1986130617Smlaier o->data.max_src_states; 1987130617Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1988130617Smlaier break; 1989145840Smlaier case PF_STATE_OPT_OVERLOAD: 1990145840Smlaier if (r.overload_tblname[0]) { 1991145840Smlaier yyerror("multiple 'overload' " 1992145840Smlaier "table definitions"); 1993145840Smlaier YYERROR; 1994145840Smlaier } 1995145840Smlaier if (strlcpy(r.overload_tblname, 1996145840Smlaier o->data.overload.tblname, 1997145840Smlaier PF_TABLE_NAME_SIZE) >= 1998145840Smlaier PF_TABLE_NAME_SIZE) { 1999145840Smlaier yyerror("state option: " 2000145840Smlaier "strlcpy"); 2001145840Smlaier YYERROR; 2002145840Smlaier } 2003145840Smlaier r.flush = o->data.overload.flush; 2004145840Smlaier break; 2005145840Smlaier case PF_STATE_OPT_MAX_SRC_CONN: 2006145840Smlaier if (r.max_src_conn) { 2007145840Smlaier yyerror("state option " 2008145840Smlaier "'max-src-conn' " 2009145840Smlaier "multiple definitions"); 2010145840Smlaier YYERROR; 2011145840Smlaier } 2012145840Smlaier if (o->data.max_src_conn == 0) { 2013145840Smlaier yyerror("'max-src-conn' " 2014145840Smlaier "must be > 0"); 2015145840Smlaier YYERROR; 2016145840Smlaier } 2017145840Smlaier r.max_src_conn = 2018145840Smlaier o->data.max_src_conn; 2019145840Smlaier r.rule_flag |= PFRULE_SRCTRACK | 2020145840Smlaier PFRULE_RULESRCTRACK; 2021145840Smlaier break; 2022145840Smlaier case PF_STATE_OPT_MAX_SRC_CONN_RATE: 2023145840Smlaier if (r.max_src_conn_rate.limit) { 2024145840Smlaier yyerror("state option " 2025145840Smlaier "'max-src-conn-rate' " 2026145840Smlaier "multiple definitions"); 2027145840Smlaier YYERROR; 2028145840Smlaier } 2029145840Smlaier if (!o->data.max_src_conn_rate.limit || 2030145840Smlaier !o->data.max_src_conn_rate.seconds) { 2031145840Smlaier yyerror("'max-src-conn-rate' " 2032145840Smlaier "values must be > 0"); 2033145840Smlaier YYERROR; 2034145840Smlaier } 2035145840Smlaier if (o->data.max_src_conn_rate.limit > 2036145840Smlaier PF_THRESHOLD_MAX) { 2037145840Smlaier yyerror("'max-src-conn-rate' " 2038171172Smlaier "maximum rate must be < %u", 2039171172Smlaier PF_THRESHOLD_MAX); 2040145840Smlaier YYERROR; 2041145840Smlaier } 2042145840Smlaier r.max_src_conn_rate.limit = 2043145840Smlaier o->data.max_src_conn_rate.limit; 2044145840Smlaier r.max_src_conn_rate.seconds = 2045145840Smlaier o->data.max_src_conn_rate.seconds; 2046145840Smlaier r.rule_flag |= PFRULE_SRCTRACK | 2047145840Smlaier PFRULE_RULESRCTRACK; 2048145840Smlaier break; 2049130617Smlaier case PF_STATE_OPT_MAX_SRC_NODES: 2050130617Smlaier if (r.max_src_nodes) { 2051130617Smlaier yyerror("state option " 2052130617Smlaier "'max-src-nodes' " 2053130617Smlaier "multiple definitions"); 2054130617Smlaier YYERROR; 2055130617Smlaier } 2056130617Smlaier if (o->data.max_src_nodes == 0) { 2057130617Smlaier yyerror("'max-src-nodes' must " 2058130617Smlaier "be > 0"); 2059130617Smlaier YYERROR; 2060130617Smlaier } 2061130617Smlaier r.max_src_nodes = 2062130617Smlaier o->data.max_src_nodes; 2063130617Smlaier r.rule_flag |= PFRULE_SRCTRACK | 2064130617Smlaier PFRULE_RULESRCTRACK; 2065130617Smlaier break; 2066130617Smlaier case PF_STATE_OPT_STATELOCK: 2067130617Smlaier if (statelock) { 2068130617Smlaier yyerror("state locking option: " 2069130617Smlaier "multiple definitions"); 2070130617Smlaier YYERROR; 2071130617Smlaier } 2072130617Smlaier statelock = 1; 2073130617Smlaier r.rule_flag |= o->data.statelock; 2074130617Smlaier break; 2075200930Sdelphij case PF_STATE_OPT_SLOPPY: 2076200930Sdelphij if (r.rule_flag & PFRULE_STATESLOPPY) { 2077200930Sdelphij yyerror("state sloppy option: " 2078200930Sdelphij "multiple definitions"); 2079200930Sdelphij YYERROR; 2080200930Sdelphij } 2081200930Sdelphij r.rule_flag |= PFRULE_STATESLOPPY; 2082200930Sdelphij break; 2083126353Smlaier case PF_STATE_OPT_TIMEOUT: 2084171172Smlaier if (o->data.timeout.number == 2085171172Smlaier PFTM_ADAPTIVE_START || 2086171172Smlaier o->data.timeout.number == 2087171172Smlaier PFTM_ADAPTIVE_END) 2088171172Smlaier adaptive = 1; 2089126353Smlaier if (r.timeout[o->data.timeout.number]) { 2090126353Smlaier yyerror("state timeout %s " 2091126353Smlaier "multiple definitions", 2092126353Smlaier pf_timeouts[o->data. 2093126353Smlaier timeout.number].name); 2094126353Smlaier YYERROR; 2095126353Smlaier } 2096126353Smlaier r.timeout[o->data.timeout.number] = 2097126353Smlaier o->data.timeout.seconds; 2098126353Smlaier } 2099126353Smlaier o = o->next; 2100223637Sbz if (!defaults) 2101223637Sbz free(p); 2102126353Smlaier } 2103171172Smlaier 2104171172Smlaier /* 'flags S/SA' by default on stateful rules */ 2105171172Smlaier if (!r.action && !r.flags && !r.flagset && 2106171172Smlaier !$9.fragment && !($9.marker & FOM_FLAGS) && 2107171172Smlaier r.keep_state) { 2108171172Smlaier r.flags = parse_flags("S"); 2109171172Smlaier r.flagset = parse_flags("SA"); 2110171172Smlaier } 2111171172Smlaier if (!adaptive && r.max_states) { 2112171172Smlaier r.timeout[PFTM_ADAPTIVE_START] = 2113171172Smlaier (r.max_states / 10) * 6; 2114171172Smlaier r.timeout[PFTM_ADAPTIVE_END] = 2115171172Smlaier (r.max_states / 10) * 12; 2116171172Smlaier } 2117145840Smlaier if (r.rule_flag & PFRULE_SRCTRACK) { 2118130617Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 2119130617Smlaier r.max_src_nodes) { 2120130617Smlaier yyerror("'max-src-nodes' is " 2121130617Smlaier "incompatible with " 2122130617Smlaier "'source-track global'"); 2123130617Smlaier YYERROR; 2124130617Smlaier } 2125145840Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 2126145840Smlaier r.max_src_conn) { 2127145840Smlaier yyerror("'max-src-conn' is " 2128145840Smlaier "incompatible with " 2129145840Smlaier "'source-track global'"); 2130145840Smlaier YYERROR; 2131145840Smlaier } 2132145840Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 2133145840Smlaier r.max_src_conn_rate.seconds) { 2134145840Smlaier yyerror("'max-src-conn-rate' is " 2135145840Smlaier "incompatible with " 2136145840Smlaier "'source-track global'"); 2137145840Smlaier YYERROR; 2138145840Smlaier } 2139145840Smlaier if (r.timeout[PFTM_SRC_NODE] < 2140145840Smlaier r.max_src_conn_rate.seconds) 2141145840Smlaier r.timeout[PFTM_SRC_NODE] = 2142145840Smlaier r.max_src_conn_rate.seconds; 2143130617Smlaier r.rule_flag |= PFRULE_SRCTRACK; 2144130617Smlaier if (srctrack == PF_SRCTRACK_RULE) 2145130617Smlaier r.rule_flag |= PFRULE_RULESRCTRACK; 2146130617Smlaier } 2147130617Smlaier if (r.keep_state && !statelock) 2148130617Smlaier r.rule_flag |= default_statelock; 2149126353Smlaier 2150126353Smlaier if ($9.fragment) 2151126353Smlaier r.rule_flag |= PFRULE_FRAGMENT; 2152126353Smlaier r.allow_opts = $9.allowopts; 2153126353Smlaier 2154126353Smlaier decide_address_family($8.src.host, &r.af); 2155126353Smlaier decide_address_family($8.dst.host, &r.af); 2156126353Smlaier 2157126353Smlaier if ($5.rt) { 2158126353Smlaier if (!r.direction) { 2159126353Smlaier yyerror("direction must be explicit " 2160126353Smlaier "with rules that specify routing"); 2161126353Smlaier YYERROR; 2162126353Smlaier } 2163126353Smlaier r.rt = $5.rt; 2164126353Smlaier r.rpool.opts = $5.pool_opts; 2165126353Smlaier if ($5.key != NULL) 2166126353Smlaier memcpy(&r.rpool.key, $5.key, 2167126353Smlaier sizeof(struct pf_poolhashkey)); 2168126353Smlaier } 2169126353Smlaier if (r.rt && r.rt != PF_FASTROUTE) { 2170126353Smlaier decide_address_family($5.host, &r.af); 2171126353Smlaier remove_invalid_hosts(&$5.host, &r.af); 2172126353Smlaier if ($5.host == NULL) { 2173126353Smlaier yyerror("no routing address with " 2174126353Smlaier "matching address family found."); 2175126353Smlaier YYERROR; 2176126353Smlaier } 2177130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) == 2178130617Smlaier PF_POOL_NONE && ($5.host->next != NULL || 2179130617Smlaier $5.host->addr.type == PF_ADDR_TABLE || 2180130617Smlaier DYNIF_MULTIADDR($5.host->addr))) 2181130617Smlaier r.rpool.opts |= PF_POOL_ROUNDROBIN; 2182130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2183130617Smlaier PF_POOL_ROUNDROBIN && 2184130617Smlaier disallow_table($5.host, "tables are only " 2185130617Smlaier "supported in round-robin routing pools")) 2186130617Smlaier YYERROR; 2187130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2188130617Smlaier PF_POOL_ROUNDROBIN && 2189130617Smlaier disallow_alias($5.host, "interface (%s) " 2190130617Smlaier "is only supported in round-robin " 2191130617Smlaier "routing pools")) 2192130617Smlaier YYERROR; 2193126353Smlaier if ($5.host->next != NULL) { 2194130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2195126353Smlaier PF_POOL_ROUNDROBIN) { 2196126353Smlaier yyerror("r.rpool.opts must " 2197126353Smlaier "be PF_POOL_ROUNDROBIN"); 2198126353Smlaier YYERROR; 2199126353Smlaier } 2200126353Smlaier } 2201126353Smlaier } 2202126353Smlaier if ($9.queues.qname != NULL) { 2203126353Smlaier if (strlcpy(r.qname, $9.queues.qname, 2204126353Smlaier sizeof(r.qname)) >= sizeof(r.qname)) { 2205126353Smlaier yyerror("rule qname too long (max " 2206126353Smlaier "%d chars)", sizeof(r.qname)-1); 2207126353Smlaier YYERROR; 2208126353Smlaier } 2209126353Smlaier free($9.queues.qname); 2210126353Smlaier } 2211126353Smlaier if ($9.queues.pqname != NULL) { 2212126353Smlaier if (strlcpy(r.pqname, $9.queues.pqname, 2213126353Smlaier sizeof(r.pqname)) >= sizeof(r.pqname)) { 2214126353Smlaier yyerror("rule pqname too long (max " 2215126353Smlaier "%d chars)", sizeof(r.pqname)-1); 2216126353Smlaier YYERROR; 2217126353Smlaier } 2218126353Smlaier free($9.queues.pqname); 2219126353Smlaier } 2220223637Sbz#ifdef __FreeBSD__ 2221223637Sbz r.divert.port = $9.divert.port; 2222223637Sbz#else 2223223637Sbz if ((r.divert.port = $9.divert.port)) { 2224223637Sbz if (r.direction == PF_OUT) { 2225223637Sbz if ($9.divert.addr) { 2226223637Sbz yyerror("address specified " 2227223637Sbz "for outgoing divert"); 2228223637Sbz YYERROR; 2229223637Sbz } 2230223637Sbz bzero(&r.divert.addr, 2231223637Sbz sizeof(r.divert.addr)); 2232223637Sbz } else { 2233223637Sbz if (!$9.divert.addr) { 2234223637Sbz yyerror("no address specified " 2235223637Sbz "for incoming divert"); 2236223637Sbz YYERROR; 2237223637Sbz } 2238223637Sbz if ($9.divert.addr->af != r.af) { 2239223637Sbz yyerror("address family " 2240223637Sbz "mismatch for divert"); 2241223637Sbz YYERROR; 2242223637Sbz } 2243223637Sbz r.divert.addr = 2244223637Sbz $9.divert.addr->addr.v.a.addr; 2245223637Sbz } 2246223637Sbz } 2247223637Sbz#endif 2248126353Smlaier 2249126353Smlaier expand_rule(&r, $4, $5.host, $7, $8.src_os, 2250126353Smlaier $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 2251145840Smlaier $9.uid, $9.gid, $9.icmpspec, ""); 2252126353Smlaier } 2253126353Smlaier ; 2254126353Smlaier 2255171172Smlaierfilter_opts : { 2256171172Smlaier bzero(&filter_opts, sizeof filter_opts); 2257171172Smlaier filter_opts.rtableid = -1; 2258171172Smlaier } 2259130617Smlaier filter_opts_l 2260126353Smlaier { $$ = filter_opts; } 2261126353Smlaier | /* empty */ { 2262126353Smlaier bzero(&filter_opts, sizeof filter_opts); 2263171172Smlaier filter_opts.rtableid = -1; 2264126353Smlaier $$ = filter_opts; 2265126353Smlaier } 2266126353Smlaier ; 2267126353Smlaier 2268126353Smlaierfilter_opts_l : filter_opts_l filter_opt 2269126353Smlaier | filter_opt 2270126353Smlaier ; 2271126353Smlaier 2272126353Smlaierfilter_opt : USER uids { 2273126353Smlaier if (filter_opts.uid) 2274126353Smlaier $2->tail->next = filter_opts.uid; 2275126353Smlaier filter_opts.uid = $2; 2276126353Smlaier } 2277126353Smlaier | GROUP gids { 2278126353Smlaier if (filter_opts.gid) 2279126353Smlaier $2->tail->next = filter_opts.gid; 2280126353Smlaier filter_opts.gid = $2; 2281126353Smlaier } 2282126353Smlaier | flags { 2283126353Smlaier if (filter_opts.marker & FOM_FLAGS) { 2284126353Smlaier yyerror("flags cannot be redefined"); 2285126353Smlaier YYERROR; 2286126353Smlaier } 2287126353Smlaier filter_opts.marker |= FOM_FLAGS; 2288126353Smlaier filter_opts.flags.b1 |= $1.b1; 2289126353Smlaier filter_opts.flags.b2 |= $1.b2; 2290126353Smlaier filter_opts.flags.w |= $1.w; 2291126353Smlaier filter_opts.flags.w2 |= $1.w2; 2292126353Smlaier } 2293126353Smlaier | icmpspec { 2294126353Smlaier if (filter_opts.marker & FOM_ICMP) { 2295126353Smlaier yyerror("icmp-type cannot be redefined"); 2296126353Smlaier YYERROR; 2297126353Smlaier } 2298126353Smlaier filter_opts.marker |= FOM_ICMP; 2299126353Smlaier filter_opts.icmpspec = $1; 2300126353Smlaier } 2301223637Sbz | TOS tos { 2302126353Smlaier if (filter_opts.marker & FOM_TOS) { 2303126353Smlaier yyerror("tos cannot be redefined"); 2304126353Smlaier YYERROR; 2305126353Smlaier } 2306126353Smlaier filter_opts.marker |= FOM_TOS; 2307223637Sbz filter_opts.tos = $2; 2308126353Smlaier } 2309126353Smlaier | keep { 2310126353Smlaier if (filter_opts.marker & FOM_KEEP) { 2311126353Smlaier yyerror("modulate or keep cannot be redefined"); 2312126353Smlaier YYERROR; 2313126353Smlaier } 2314126353Smlaier filter_opts.marker |= FOM_KEEP; 2315126353Smlaier filter_opts.keep.action = $1.action; 2316126353Smlaier filter_opts.keep.options = $1.options; 2317126353Smlaier } 2318126353Smlaier | FRAGMENT { 2319126353Smlaier filter_opts.fragment = 1; 2320126353Smlaier } 2321126353Smlaier | ALLOWOPTS { 2322126353Smlaier filter_opts.allowopts = 1; 2323126353Smlaier } 2324126353Smlaier | label { 2325126353Smlaier if (filter_opts.label) { 2326126353Smlaier yyerror("label cannot be redefined"); 2327126353Smlaier YYERROR; 2328126353Smlaier } 2329126353Smlaier filter_opts.label = $1; 2330126353Smlaier } 2331126353Smlaier | qname { 2332126353Smlaier if (filter_opts.queues.qname) { 2333126353Smlaier yyerror("queue cannot be redefined"); 2334126353Smlaier YYERROR; 2335126353Smlaier } 2336126353Smlaier filter_opts.queues = $1; 2337126353Smlaier } 2338126353Smlaier | TAG string { 2339126353Smlaier filter_opts.tag = $2; 2340126353Smlaier } 2341126353Smlaier | not TAGGED string { 2342126353Smlaier filter_opts.match_tag = $3; 2343126353Smlaier filter_opts.match_tag_not = $1; 2344126353Smlaier } 2345223637Sbz | PROBABILITY probability { 2346223637Sbz double p; 2347145840Smlaier 2348223637Sbz p = floor($2 * UINT_MAX + 0.5); 2349223637Sbz if (p < 0.0 || p > UINT_MAX) { 2350223637Sbz yyerror("invalid probability: %lf", p); 2351223637Sbz YYERROR; 2352145840Smlaier } 2353223637Sbz filter_opts.prob = (u_int32_t)p; 2354223637Sbz if (filter_opts.prob == 0) 2355223637Sbz filter_opts.prob = 1; 2356223637Sbz } 2357223637Sbz | RTABLE NUMBER { 2358231852Sbz if ($2 < 0 || $2 > rt_tableid_max()) { 2359223637Sbz yyerror("invalid rtable id"); 2360145840Smlaier YYERROR; 2361145840Smlaier } 2362223637Sbz filter_opts.rtableid = $2; 2363223637Sbz } 2364223637Sbz | DIVERTTO portplain { 2365223637Sbz#ifdef __FreeBSD__ 2366223637Sbz filter_opts.divert.port = $2.a; 2367223637Sbz if (!filter_opts.divert.port) { 2368223637Sbz yyerror("invalid divert port: %u", ntohs($2.a)); 2369145840Smlaier YYERROR; 2370145840Smlaier } 2371223637Sbz#endif 2372145840Smlaier } 2373223637Sbz | DIVERTTO STRING PORT portplain { 2374178894Sjulian#ifndef __FreeBSD__ 2375223637Sbz if ((filter_opts.divert.addr = host($2)) == NULL) { 2376223637Sbz yyerror("could not parse divert address: %s", 2377223637Sbz $2); 2378223637Sbz free($2); 2379171172Smlaier YYERROR; 2380171172Smlaier } 2381223637Sbz#else 2382223637Sbz if ($2) 2383178894Sjulian#endif 2384223637Sbz free($2); 2385223637Sbz filter_opts.divert.port = $4.a; 2386223637Sbz if (!filter_opts.divert.port) { 2387223637Sbz yyerror("invalid divert port: %u", ntohs($4.a)); 2388223637Sbz YYERROR; 2389223637Sbz } 2390171172Smlaier } 2391223637Sbz | DIVERTREPLY { 2392223637Sbz#ifdef __FreeBSD__ 2393223637Sbz yyerror("divert-reply has no meaning in FreeBSD pf(4)"); 2394223637Sbz YYERROR; 2395223637Sbz#else 2396223637Sbz filter_opts.divert.port = 1; /* some random value */ 2397223637Sbz#endif 2398223637Sbz } 2399126353Smlaier ; 2400126353Smlaier 2401223637Sbzprobability : STRING { 2402223637Sbz char *e; 2403223637Sbz double p = strtod($1, &e); 2404223637Sbz 2405223637Sbz if (*e == '%') { 2406223637Sbz p *= 0.01; 2407223637Sbz e++; 2408223637Sbz } 2409223637Sbz if (*e) { 2410223637Sbz yyerror("invalid probability: %s", $1); 2411223637Sbz free($1); 2412223637Sbz YYERROR; 2413223637Sbz } 2414223637Sbz free($1); 2415223637Sbz $$ = p; 2416223637Sbz } 2417223637Sbz | NUMBER { 2418223637Sbz $$ = (double)$1; 2419223637Sbz } 2420223637Sbz ; 2421223637Sbz 2422223637Sbz 2423126353Smlaieraction : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2424126353Smlaier | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2425126353Smlaier ; 2426126353Smlaier 2427126353Smlaierblockspec : /* empty */ { 2428126353Smlaier $$.b2 = blockpolicy; 2429126353Smlaier $$.w = returnicmpdefault; 2430126353Smlaier $$.w2 = returnicmp6default; 2431126353Smlaier } 2432126353Smlaier | DROP { 2433126353Smlaier $$.b2 = PFRULE_DROP; 2434126353Smlaier $$.w = 0; 2435126353Smlaier $$.w2 = 0; 2436126353Smlaier } 2437126353Smlaier | RETURNRST { 2438126353Smlaier $$.b2 = PFRULE_RETURNRST; 2439126353Smlaier $$.w = 0; 2440126353Smlaier $$.w2 = 0; 2441126353Smlaier } 2442223637Sbz | RETURNRST '(' TTL NUMBER ')' { 2443223637Sbz if ($4 < 0 || $4 > 255) { 2444126353Smlaier yyerror("illegal ttl value %d", $4); 2445126353Smlaier YYERROR; 2446126353Smlaier } 2447126353Smlaier $$.b2 = PFRULE_RETURNRST; 2448126353Smlaier $$.w = $4; 2449126353Smlaier $$.w2 = 0; 2450126353Smlaier } 2451126353Smlaier | RETURNICMP { 2452126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2453126353Smlaier $$.w = returnicmpdefault; 2454126353Smlaier $$.w2 = returnicmp6default; 2455126353Smlaier } 2456126353Smlaier | RETURNICMP6 { 2457126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2458126353Smlaier $$.w = returnicmpdefault; 2459126353Smlaier $$.w2 = returnicmp6default; 2460126353Smlaier } 2461223637Sbz | RETURNICMP '(' reticmpspec ')' { 2462126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2463223637Sbz $$.w = $3; 2464223637Sbz $$.w2 = returnicmpdefault; 2465126353Smlaier } 2466223637Sbz | RETURNICMP6 '(' reticmp6spec ')' { 2467126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2468126353Smlaier $$.w = returnicmpdefault; 2469223637Sbz $$.w2 = $3; 2470126353Smlaier } 2471223637Sbz | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2472126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2473223637Sbz $$.w = $3; 2474223637Sbz $$.w2 = $5; 2475126353Smlaier } 2476126353Smlaier | RETURN { 2477126353Smlaier $$.b2 = PFRULE_RETURN; 2478126353Smlaier $$.w = returnicmpdefault; 2479126353Smlaier $$.w2 = returnicmp6default; 2480126353Smlaier } 2481126353Smlaier ; 2482126353Smlaier 2483223637Sbzreticmpspec : STRING { 2484223637Sbz if (!($$ = parseicmpspec($1, AF_INET))) { 2485223637Sbz free($1); 2486223637Sbz YYERROR; 2487223637Sbz } 2488223637Sbz free($1); 2489223637Sbz } 2490223637Sbz | NUMBER { 2491223637Sbz u_int8_t icmptype; 2492223637Sbz 2493223637Sbz if ($1 < 0 || $1 > 255) { 2494223637Sbz yyerror("invalid icmp code %lu", $1); 2495223637Sbz YYERROR; 2496223637Sbz } 2497223637Sbz icmptype = returnicmpdefault >> 8; 2498223637Sbz $$ = (icmptype << 8 | $1); 2499223637Sbz } 2500223637Sbz ; 2501223637Sbz 2502223637Sbzreticmp6spec : STRING { 2503223637Sbz if (!($$ = parseicmpspec($1, AF_INET6))) { 2504223637Sbz free($1); 2505223637Sbz YYERROR; 2506223637Sbz } 2507223637Sbz free($1); 2508223637Sbz } 2509223637Sbz | NUMBER { 2510223637Sbz u_int8_t icmptype; 2511223637Sbz 2512223637Sbz if ($1 < 0 || $1 > 255) { 2513223637Sbz yyerror("invalid icmp code %lu", $1); 2514223637Sbz YYERROR; 2515223637Sbz } 2516223637Sbz icmptype = returnicmp6default >> 8; 2517223637Sbz $$ = (icmptype << 8 | $1); 2518223637Sbz } 2519223637Sbz ; 2520223637Sbz 2521223637Sbzdir : /* empty */ { $$ = PF_INOUT; } 2522126353Smlaier | IN { $$ = PF_IN; } 2523126353Smlaier | OUT { $$ = PF_OUT; } 2524126353Smlaier ; 2525126353Smlaier 2526171172Smlaierquick : /* empty */ { $$.quick = 0; } 2527171172Smlaier | QUICK { $$.quick = 1; } 2528126353Smlaier ; 2529126353Smlaier 2530171172Smlaierlogquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2531171172Smlaier | log { $$ = $1; $$.quick = 0; } 2532171172Smlaier | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2533171172Smlaier | log QUICK { $$ = $1; $$.quick = 1; } 2534171172Smlaier | QUICK log { $$ = $2; $$.quick = 1; } 2535126353Smlaier ; 2536126353Smlaier 2537171172Smlaierlog : LOG { $$.log = PF_LOG; $$.logif = 0; } 2538171172Smlaier | LOG '(' logopts ')' { 2539171172Smlaier $$.log = PF_LOG | $3.log; 2540171172Smlaier $$.logif = $3.logif; 2541171172Smlaier } 2542171172Smlaier ; 2543171172Smlaier 2544171172Smlaierlogopts : logopt { $$ = $1; } 2545171172Smlaier | logopts comma logopt { 2546171172Smlaier $$.log = $1.log | $3.log; 2547171172Smlaier $$.logif = $3.logif; 2548171172Smlaier if ($$.logif == 0) 2549171172Smlaier $$.logif = $1.logif; 2550171172Smlaier } 2551171172Smlaier ; 2552171172Smlaier 2553171172Smlaierlogopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2554171172Smlaier | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2555171172Smlaier | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2556171172Smlaier | TO string { 2557171172Smlaier const char *errstr; 2558171172Smlaier u_int i; 2559171172Smlaier 2560171172Smlaier $$.log = 0; 2561171172Smlaier if (strncmp($2, "pflog", 5)) { 2562171172Smlaier yyerror("%s: should be a pflog interface", $2); 2563171172Smlaier free($2); 2564171172Smlaier YYERROR; 2565171172Smlaier } 2566171172Smlaier i = strtonum($2 + 5, 0, 255, &errstr); 2567171172Smlaier if (errstr) { 2568171172Smlaier yyerror("%s: %s", $2, errstr); 2569171172Smlaier free($2); 2570171172Smlaier YYERROR; 2571171172Smlaier } 2572171172Smlaier free($2); 2573171172Smlaier $$.logif = i; 2574171172Smlaier } 2575171172Smlaier ; 2576171172Smlaier 2577126353Smlaierinterface : /* empty */ { $$ = NULL; } 2578126353Smlaier | ON if_item_not { $$ = $2; } 2579223637Sbz | ON '{' optnl if_list '}' { $$ = $4; } 2580126353Smlaier ; 2581126353Smlaier 2582223637Sbzif_list : if_item_not optnl { $$ = $1; } 2583223637Sbz | if_list comma if_item_not optnl { 2584126353Smlaier $1->tail->next = $3; 2585126353Smlaier $1->tail = $3; 2586126353Smlaier $$ = $1; 2587126353Smlaier } 2588126353Smlaier ; 2589126353Smlaier 2590126353Smlaierif_item_not : not if_item { $$ = $2; $$->not = $1; } 2591126353Smlaier ; 2592126353Smlaier 2593126353Smlaierif_item : STRING { 2594126353Smlaier struct node_host *n; 2595126353Smlaier 2596126353Smlaier $$ = calloc(1, sizeof(struct node_if)); 2597126353Smlaier if ($$ == NULL) 2598126353Smlaier err(1, "if_item: calloc"); 2599126353Smlaier if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2600126353Smlaier sizeof($$->ifname)) { 2601130617Smlaier free($1); 2602126353Smlaier free($$); 2603126353Smlaier yyerror("interface name too long"); 2604126353Smlaier YYERROR; 2605126353Smlaier } 2606145840Smlaier 2607171172Smlaier if ((n = ifa_exists($1)) != NULL) 2608145840Smlaier $$->ifa_flags = n->ifa_flags; 2609145840Smlaier 2610130617Smlaier free($1); 2611126353Smlaier $$->not = 0; 2612126353Smlaier $$->next = NULL; 2613126353Smlaier $$->tail = $$; 2614126353Smlaier } 2615126353Smlaier ; 2616126353Smlaier 2617126353Smlaieraf : /* empty */ { $$ = 0; } 2618126353Smlaier | INET { $$ = AF_INET; } 2619126353Smlaier | INET6 { $$ = AF_INET6; } 2620130617Smlaier ; 2621126353Smlaier 2622223637Sbzproto : /* empty */ { $$ = NULL; } 2623223637Sbz | PROTO proto_item { $$ = $2; } 2624223637Sbz | PROTO '{' optnl proto_list '}' { $$ = $4; } 2625126353Smlaier ; 2626126353Smlaier 2627223637Sbzproto_list : proto_item optnl { $$ = $1; } 2628223637Sbz | proto_list comma proto_item optnl { 2629126353Smlaier $1->tail->next = $3; 2630126353Smlaier $1->tail = $3; 2631126353Smlaier $$ = $1; 2632126353Smlaier } 2633126353Smlaier ; 2634126353Smlaier 2635223637Sbzproto_item : protoval { 2636126353Smlaier u_int8_t pr; 2637126353Smlaier 2638223637Sbz pr = (u_int8_t)$1; 2639126353Smlaier if (pr == 0) { 2640126353Smlaier yyerror("proto 0 cannot be used"); 2641126353Smlaier YYERROR; 2642126353Smlaier } 2643126353Smlaier $$ = calloc(1, sizeof(struct node_proto)); 2644126353Smlaier if ($$ == NULL) 2645126353Smlaier err(1, "proto_item: calloc"); 2646126353Smlaier $$->proto = pr; 2647126353Smlaier $$->next = NULL; 2648126353Smlaier $$->tail = $$; 2649126353Smlaier } 2650126353Smlaier ; 2651126353Smlaier 2652223637Sbzprotoval : STRING { 2653223637Sbz struct protoent *p; 2654223637Sbz 2655223637Sbz p = getprotobyname($1); 2656223637Sbz if (p == NULL) { 2657223637Sbz yyerror("unknown protocol %s", $1); 2658223637Sbz free($1); 2659223637Sbz YYERROR; 2660223637Sbz } 2661223637Sbz $$ = p->p_proto; 2662223637Sbz free($1); 2663223637Sbz } 2664223637Sbz | NUMBER { 2665223637Sbz if ($1 < 0 || $1 > 255) { 2666223637Sbz yyerror("protocol outside range"); 2667223637Sbz YYERROR; 2668223637Sbz } 2669223637Sbz } 2670223637Sbz ; 2671223637Sbz 2672126353Smlaierfromto : ALL { 2673126353Smlaier $$.src.host = NULL; 2674126353Smlaier $$.src.port = NULL; 2675126353Smlaier $$.dst.host = NULL; 2676126353Smlaier $$.dst.port = NULL; 2677126353Smlaier $$.src_os = NULL; 2678126353Smlaier } 2679126353Smlaier | from os to { 2680126353Smlaier $$.src = $1; 2681126353Smlaier $$.src_os = $2; 2682126353Smlaier $$.dst = $3; 2683126353Smlaier } 2684126353Smlaier ; 2685126353Smlaier 2686126353Smlaieros : /* empty */ { $$ = NULL; } 2687126353Smlaier | OS xos { $$ = $2; } 2688223637Sbz | OS '{' optnl os_list '}' { $$ = $4; } 2689126353Smlaier ; 2690126353Smlaier 2691126353Smlaierxos : STRING { 2692126353Smlaier $$ = calloc(1, sizeof(struct node_os)); 2693126353Smlaier if ($$ == NULL) 2694126353Smlaier err(1, "os: calloc"); 2695126353Smlaier $$->os = $1; 2696126353Smlaier $$->tail = $$; 2697126353Smlaier } 2698126353Smlaier ; 2699126353Smlaier 2700223637Sbzos_list : xos optnl { $$ = $1; } 2701223637Sbz | os_list comma xos optnl { 2702126353Smlaier $1->tail->next = $3; 2703126353Smlaier $1->tail = $3; 2704126353Smlaier $$ = $1; 2705126353Smlaier } 2706126353Smlaier ; 2707126353Smlaier 2708126353Smlaierfrom : /* empty */ { 2709126353Smlaier $$.host = NULL; 2710126353Smlaier $$.port = NULL; 2711126353Smlaier } 2712126353Smlaier | FROM ipportspec { 2713126353Smlaier $$ = $2; 2714126353Smlaier } 2715126353Smlaier ; 2716126353Smlaier 2717126353Smlaierto : /* empty */ { 2718126353Smlaier $$.host = NULL; 2719126353Smlaier $$.port = NULL; 2720126353Smlaier } 2721126353Smlaier | TO ipportspec { 2722171172Smlaier if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2723171172Smlaier "not permitted in a destination address")) 2724171172Smlaier YYERROR; 2725126353Smlaier $$ = $2; 2726126353Smlaier } 2727126353Smlaier ; 2728126353Smlaier 2729126353Smlaieripportspec : ipspec { 2730126353Smlaier $$.host = $1; 2731126353Smlaier $$.port = NULL; 2732126353Smlaier } 2733126353Smlaier | ipspec PORT portspec { 2734126353Smlaier $$.host = $1; 2735126353Smlaier $$.port = $3; 2736126353Smlaier } 2737126353Smlaier | PORT portspec { 2738126353Smlaier $$.host = NULL; 2739126353Smlaier $$.port = $2; 2740126353Smlaier } 2741126353Smlaier ; 2742126353Smlaier 2743223637Sbzoptnl : '\n' optnl 2744223637Sbz | 2745223637Sbz ; 2746223637Sbz 2747126353Smlaieripspec : ANY { $$ = NULL; } 2748126353Smlaier | xhost { $$ = $1; } 2749223637Sbz | '{' optnl host_list '}' { $$ = $3; } 2750126353Smlaier ; 2751126353Smlaier 2752223637Sbztoipspec : TO ipspec { $$ = $2; } 2753223637Sbz | /* empty */ { $$ = NULL; } 2754223637Sbz ; 2755223637Sbz 2756223637Sbzhost_list : ipspec optnl { $$ = $1; } 2757223637Sbz | host_list comma ipspec optnl { 2758126353Smlaier if ($3 == NULL) 2759126353Smlaier $$ = $1; 2760126353Smlaier else if ($1 == NULL) 2761126353Smlaier $$ = $3; 2762126353Smlaier else { 2763126353Smlaier $1->tail->next = $3; 2764126353Smlaier $1->tail = $3->tail; 2765126353Smlaier $$ = $1; 2766126353Smlaier } 2767126353Smlaier } 2768126353Smlaier ; 2769126353Smlaier 2770126353Smlaierxhost : not host { 2771126353Smlaier struct node_host *n; 2772126353Smlaier 2773126353Smlaier for (n = $2; n != NULL; n = n->next) 2774126353Smlaier n->not = $1; 2775126353Smlaier $$ = $2; 2776126353Smlaier } 2777171172Smlaier | not NOROUTE { 2778126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2779126353Smlaier if ($$ == NULL) 2780126353Smlaier err(1, "xhost: calloc"); 2781126353Smlaier $$->addr.type = PF_ADDR_NOROUTE; 2782126353Smlaier $$->next = NULL; 2783171172Smlaier $$->not = $1; 2784126353Smlaier $$->tail = $$; 2785126353Smlaier } 2786171172Smlaier | not URPFFAILED { 2787171172Smlaier $$ = calloc(1, sizeof(struct node_host)); 2788171172Smlaier if ($$ == NULL) 2789171172Smlaier err(1, "xhost: calloc"); 2790171172Smlaier $$->addr.type = PF_ADDR_URPFFAILED; 2791171172Smlaier $$->next = NULL; 2792171172Smlaier $$->not = $1; 2793171172Smlaier $$->tail = $$; 2794171172Smlaier } 2795126353Smlaier ; 2796126353Smlaier 2797126353Smlaierhost : STRING { 2798126353Smlaier if (($$ = host($1)) == NULL) { 2799126353Smlaier /* error. "any" is handled elsewhere */ 2800130617Smlaier free($1); 2801126353Smlaier yyerror("could not parse host specification"); 2802126353Smlaier YYERROR; 2803126353Smlaier } 2804130617Smlaier free($1); 2805126353Smlaier 2806126353Smlaier } 2807223637Sbz | STRING '-' STRING { 2808223637Sbz struct node_host *b, *e; 2809223637Sbz 2810223637Sbz if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 2811223637Sbz free($1); 2812223637Sbz free($3); 2813223637Sbz yyerror("could not parse host specification"); 2814223637Sbz YYERROR; 2815223637Sbz } 2816223637Sbz if (b->af != e->af || 2817223637Sbz b->addr.type != PF_ADDR_ADDRMASK || 2818223637Sbz e->addr.type != PF_ADDR_ADDRMASK || 2819223637Sbz unmask(&b->addr.v.a.mask, b->af) != 2820223637Sbz (b->af == AF_INET ? 32 : 128) || 2821223637Sbz unmask(&e->addr.v.a.mask, e->af) != 2822223637Sbz (e->af == AF_INET ? 32 : 128) || 2823223637Sbz b->next != NULL || b->not || 2824223637Sbz e->next != NULL || e->not) { 2825223637Sbz free(b); 2826223637Sbz free(e); 2827223637Sbz free($1); 2828223637Sbz free($3); 2829223637Sbz yyerror("invalid address range"); 2830223637Sbz YYERROR; 2831223637Sbz } 2832223637Sbz memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 2833223637Sbz sizeof(b->addr.v.a.mask)); 2834223637Sbz b->addr.type = PF_ADDR_RANGE; 2835223637Sbz $$ = b; 2836223637Sbz free(e); 2837223637Sbz free($1); 2838223637Sbz free($3); 2839223637Sbz } 2840223637Sbz | STRING '/' NUMBER { 2841126353Smlaier char *buf; 2842126353Smlaier 2843223637Sbz if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1) 2844126353Smlaier err(1, "host: asprintf"); 2845130617Smlaier free($1); 2846126353Smlaier if (($$ = host(buf)) == NULL) { 2847126353Smlaier /* error. "any" is handled elsewhere */ 2848126353Smlaier free(buf); 2849126353Smlaier yyerror("could not parse host specification"); 2850126353Smlaier YYERROR; 2851126353Smlaier } 2852126353Smlaier free(buf); 2853126353Smlaier } 2854223637Sbz | NUMBER '/' NUMBER { 2855223637Sbz char *buf; 2856223637Sbz 2857223637Sbz /* ie. for 10/8 parsing */ 2858223637Sbz#ifdef __FreeBSD__ 2859223637Sbz if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1) 2860223637Sbz#else 2861223637Sbz if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 2862223637Sbz#endif 2863223637Sbz err(1, "host: asprintf"); 2864223637Sbz if (($$ = host(buf)) == NULL) { 2865223637Sbz /* error. "any" is handled elsewhere */ 2866223637Sbz free(buf); 2867223637Sbz yyerror("could not parse host specification"); 2868223637Sbz YYERROR; 2869223637Sbz } 2870223637Sbz free(buf); 2871223637Sbz } 2872126353Smlaier | dynaddr 2873223637Sbz | dynaddr '/' NUMBER { 2874126353Smlaier struct node_host *n; 2875126353Smlaier 2876223637Sbz if ($3 < 0 || $3 > 128) { 2877223637Sbz yyerror("bit number too big"); 2878223637Sbz YYERROR; 2879223637Sbz } 2880126353Smlaier $$ = $1; 2881126353Smlaier for (n = $1; n != NULL; n = n->next) 2882126353Smlaier set_ipmask(n, $3); 2883126353Smlaier } 2884126353Smlaier | '<' STRING '>' { 2885126353Smlaier if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2886130617Smlaier yyerror("table name '%s' too long", $2); 2887130617Smlaier free($2); 2888126353Smlaier YYERROR; 2889126353Smlaier } 2890126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2891126353Smlaier if ($$ == NULL) 2892126353Smlaier err(1, "host: calloc"); 2893126353Smlaier $$->addr.type = PF_ADDR_TABLE; 2894126353Smlaier if (strlcpy($$->addr.v.tblname, $2, 2895126353Smlaier sizeof($$->addr.v.tblname)) >= 2896126353Smlaier sizeof($$->addr.v.tblname)) 2897126353Smlaier errx(1, "host: strlcpy"); 2898130617Smlaier free($2); 2899126353Smlaier $$->next = NULL; 2900126353Smlaier $$->tail = $$; 2901126353Smlaier } 2902126353Smlaier ; 2903126353Smlaier 2904223637Sbznumber : NUMBER 2905223637Sbz | STRING { 2906126353Smlaier u_long ulval; 2907126353Smlaier 2908126353Smlaier if (atoul($1, &ulval) == -1) { 2909126353Smlaier yyerror("%s is not a number", $1); 2910130617Smlaier free($1); 2911126353Smlaier YYERROR; 2912126353Smlaier } else 2913126353Smlaier $$ = ulval; 2914130617Smlaier free($1); 2915126353Smlaier } 2916126353Smlaier ; 2917126353Smlaier 2918126353Smlaierdynaddr : '(' STRING ')' { 2919130617Smlaier int flags = 0; 2920130617Smlaier char *p, *op; 2921130617Smlaier 2922130617Smlaier op = $2; 2923145840Smlaier if (!isalpha(op[0])) { 2924145840Smlaier yyerror("invalid interface name '%s'", op); 2925145840Smlaier free(op); 2926145840Smlaier YYERROR; 2927145840Smlaier } 2928130617Smlaier while ((p = strrchr($2, ':')) != NULL) { 2929130617Smlaier if (!strcmp(p+1, "network")) 2930130617Smlaier flags |= PFI_AFLAG_NETWORK; 2931130617Smlaier else if (!strcmp(p+1, "broadcast")) 2932130617Smlaier flags |= PFI_AFLAG_BROADCAST; 2933130617Smlaier else if (!strcmp(p+1, "peer")) 2934130617Smlaier flags |= PFI_AFLAG_PEER; 2935130617Smlaier else if (!strcmp(p+1, "0")) 2936130617Smlaier flags |= PFI_AFLAG_NOALIAS; 2937130617Smlaier else { 2938130617Smlaier yyerror("interface %s has bad modifier", 2939130617Smlaier $2); 2940130617Smlaier free(op); 2941130617Smlaier YYERROR; 2942130617Smlaier } 2943130617Smlaier *p = '\0'; 2944130617Smlaier } 2945130617Smlaier if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2946130617Smlaier free(op); 2947130617Smlaier yyerror("illegal combination of " 2948130617Smlaier "interface modifiers"); 2949130617Smlaier YYERROR; 2950130617Smlaier } 2951126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2952126353Smlaier if ($$ == NULL) 2953126353Smlaier err(1, "address: calloc"); 2954126353Smlaier $$->af = 0; 2955126353Smlaier set_ipmask($$, 128); 2956126353Smlaier $$->addr.type = PF_ADDR_DYNIFTL; 2957130617Smlaier $$->addr.iflags = flags; 2958126353Smlaier if (strlcpy($$->addr.v.ifname, $2, 2959126353Smlaier sizeof($$->addr.v.ifname)) >= 2960126353Smlaier sizeof($$->addr.v.ifname)) { 2961130617Smlaier free(op); 2962126353Smlaier free($$); 2963126353Smlaier yyerror("interface name too long"); 2964126353Smlaier YYERROR; 2965126353Smlaier } 2966130617Smlaier free(op); 2967126353Smlaier $$->next = NULL; 2968126353Smlaier $$->tail = $$; 2969126353Smlaier } 2970126353Smlaier ; 2971126353Smlaier 2972126353Smlaierportspec : port_item { $$ = $1; } 2973223637Sbz | '{' optnl port_list '}' { $$ = $3; } 2974126353Smlaier ; 2975126353Smlaier 2976223637Sbzport_list : port_item optnl { $$ = $1; } 2977223637Sbz | port_list comma port_item optnl { 2978126353Smlaier $1->tail->next = $3; 2979126353Smlaier $1->tail = $3; 2980126353Smlaier $$ = $1; 2981126353Smlaier } 2982126353Smlaier ; 2983126353Smlaier 2984223637Sbzport_item : portrange { 2985126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2986126353Smlaier if ($$ == NULL) 2987126353Smlaier err(1, "port_item: calloc"); 2988126353Smlaier $$->port[0] = $1.a; 2989126353Smlaier $$->port[1] = $1.b; 2990126353Smlaier if ($1.t) 2991126353Smlaier $$->op = PF_OP_RRG; 2992126353Smlaier else 2993126353Smlaier $$->op = PF_OP_EQ; 2994126353Smlaier $$->next = NULL; 2995126353Smlaier $$->tail = $$; 2996126353Smlaier } 2997223637Sbz | unaryop portrange { 2998126353Smlaier if ($2.t) { 2999126353Smlaier yyerror("':' cannot be used with an other " 3000126353Smlaier "port operator"); 3001126353Smlaier YYERROR; 3002126353Smlaier } 3003126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 3004126353Smlaier if ($$ == NULL) 3005126353Smlaier err(1, "port_item: calloc"); 3006126353Smlaier $$->port[0] = $2.a; 3007126353Smlaier $$->port[1] = $2.b; 3008126353Smlaier $$->op = $1; 3009126353Smlaier $$->next = NULL; 3010126353Smlaier $$->tail = $$; 3011126353Smlaier } 3012223637Sbz | portrange PORTBINARY portrange { 3013126353Smlaier if ($1.t || $3.t) { 3014126353Smlaier yyerror("':' cannot be used with an other " 3015126353Smlaier "port operator"); 3016126353Smlaier YYERROR; 3017126353Smlaier } 3018126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 3019126353Smlaier if ($$ == NULL) 3020126353Smlaier err(1, "port_item: calloc"); 3021126353Smlaier $$->port[0] = $1.a; 3022126353Smlaier $$->port[1] = $3.a; 3023126353Smlaier $$->op = $2; 3024126353Smlaier $$->next = NULL; 3025126353Smlaier $$->tail = $$; 3026126353Smlaier } 3027126353Smlaier ; 3028126353Smlaier 3029223637Sbzportplain : numberstring { 3030223637Sbz if (parseport($1, &$$, 0) == -1) { 3031223637Sbz free($1); 3032223637Sbz YYERROR; 3033223637Sbz } 3034223637Sbz free($1); 3035223637Sbz } 3036223637Sbz ; 3037126353Smlaier 3038223637Sbzportrange : numberstring { 3039223637Sbz if (parseport($1, &$$, PPORT_RANGE) == -1) { 3040223637Sbz free($1); 3041223637Sbz YYERROR; 3042126353Smlaier } 3043130617Smlaier free($1); 3044126353Smlaier } 3045126353Smlaier ; 3046126353Smlaier 3047126353Smlaieruids : uid_item { $$ = $1; } 3048223637Sbz | '{' optnl uid_list '}' { $$ = $3; } 3049126353Smlaier ; 3050126353Smlaier 3051223637Sbzuid_list : uid_item optnl { $$ = $1; } 3052223637Sbz | uid_list comma uid_item optnl { 3053126353Smlaier $1->tail->next = $3; 3054126353Smlaier $1->tail = $3; 3055126353Smlaier $$ = $1; 3056126353Smlaier } 3057126353Smlaier ; 3058126353Smlaier 3059126353Smlaieruid_item : uid { 3060126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 3061126353Smlaier if ($$ == NULL) 3062126353Smlaier err(1, "uid_item: calloc"); 3063126353Smlaier $$->uid[0] = $1; 3064126353Smlaier $$->uid[1] = $1; 3065126353Smlaier $$->op = PF_OP_EQ; 3066126353Smlaier $$->next = NULL; 3067126353Smlaier $$->tail = $$; 3068126353Smlaier } 3069126353Smlaier | unaryop uid { 3070126353Smlaier if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3071126353Smlaier yyerror("user unknown requires operator = or " 3072126353Smlaier "!="); 3073126353Smlaier YYERROR; 3074126353Smlaier } 3075126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 3076126353Smlaier if ($$ == NULL) 3077126353Smlaier err(1, "uid_item: calloc"); 3078126353Smlaier $$->uid[0] = $2; 3079126353Smlaier $$->uid[1] = $2; 3080126353Smlaier $$->op = $1; 3081126353Smlaier $$->next = NULL; 3082126353Smlaier $$->tail = $$; 3083126353Smlaier } 3084126353Smlaier | uid PORTBINARY uid { 3085126353Smlaier if ($1 == UID_MAX || $3 == UID_MAX) { 3086126353Smlaier yyerror("user unknown requires operator = or " 3087126353Smlaier "!="); 3088126353Smlaier YYERROR; 3089126353Smlaier } 3090126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 3091126353Smlaier if ($$ == NULL) 3092126353Smlaier err(1, "uid_item: calloc"); 3093126353Smlaier $$->uid[0] = $1; 3094126353Smlaier $$->uid[1] = $3; 3095126353Smlaier $$->op = $2; 3096126353Smlaier $$->next = NULL; 3097126353Smlaier $$->tail = $$; 3098126353Smlaier } 3099126353Smlaier ; 3100126353Smlaier 3101126353Smlaieruid : STRING { 3102223637Sbz if (!strcmp($1, "unknown")) 3103223637Sbz $$ = UID_MAX; 3104223637Sbz else { 3105223637Sbz struct passwd *pw; 3106126353Smlaier 3107223637Sbz if ((pw = getpwnam($1)) == NULL) { 3108223637Sbz yyerror("unknown user %s", $1); 3109130617Smlaier free($1); 3110126353Smlaier YYERROR; 3111126353Smlaier } 3112223637Sbz $$ = pw->pw_uid; 3113126353Smlaier } 3114130617Smlaier free($1); 3115126353Smlaier } 3116223637Sbz | NUMBER { 3117223637Sbz if ($1 < 0 || $1 >= UID_MAX) { 3118223637Sbz yyerror("illegal uid value %lu", $1); 3119223637Sbz YYERROR; 3120223637Sbz } 3121223637Sbz $$ = $1; 3122223637Sbz } 3123126353Smlaier ; 3124126353Smlaier 3125126353Smlaiergids : gid_item { $$ = $1; } 3126223637Sbz | '{' optnl gid_list '}' { $$ = $3; } 3127126353Smlaier ; 3128126353Smlaier 3129223637Sbzgid_list : gid_item optnl { $$ = $1; } 3130223637Sbz | gid_list comma gid_item optnl { 3131126353Smlaier $1->tail->next = $3; 3132126353Smlaier $1->tail = $3; 3133126353Smlaier $$ = $1; 3134126353Smlaier } 3135126353Smlaier ; 3136126353Smlaier 3137126353Smlaiergid_item : gid { 3138126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 3139126353Smlaier if ($$ == NULL) 3140126353Smlaier err(1, "gid_item: calloc"); 3141126353Smlaier $$->gid[0] = $1; 3142126353Smlaier $$->gid[1] = $1; 3143126353Smlaier $$->op = PF_OP_EQ; 3144126353Smlaier $$->next = NULL; 3145126353Smlaier $$->tail = $$; 3146126353Smlaier } 3147126353Smlaier | unaryop gid { 3148126353Smlaier if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3149126353Smlaier yyerror("group unknown requires operator = or " 3150126353Smlaier "!="); 3151126353Smlaier YYERROR; 3152126353Smlaier } 3153126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 3154126353Smlaier if ($$ == NULL) 3155126353Smlaier err(1, "gid_item: calloc"); 3156126353Smlaier $$->gid[0] = $2; 3157126353Smlaier $$->gid[1] = $2; 3158126353Smlaier $$->op = $1; 3159126353Smlaier $$->next = NULL; 3160126353Smlaier $$->tail = $$; 3161126353Smlaier } 3162126353Smlaier | gid PORTBINARY gid { 3163126353Smlaier if ($1 == GID_MAX || $3 == GID_MAX) { 3164126353Smlaier yyerror("group unknown requires operator = or " 3165126353Smlaier "!="); 3166126353Smlaier YYERROR; 3167126353Smlaier } 3168126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 3169126353Smlaier if ($$ == NULL) 3170126353Smlaier err(1, "gid_item: calloc"); 3171126353Smlaier $$->gid[0] = $1; 3172126353Smlaier $$->gid[1] = $3; 3173126353Smlaier $$->op = $2; 3174126353Smlaier $$->next = NULL; 3175126353Smlaier $$->tail = $$; 3176126353Smlaier } 3177126353Smlaier ; 3178126353Smlaier 3179126353Smlaiergid : STRING { 3180223637Sbz if (!strcmp($1, "unknown")) 3181223637Sbz $$ = GID_MAX; 3182223637Sbz else { 3183223637Sbz struct group *grp; 3184126353Smlaier 3185223637Sbz if ((grp = getgrnam($1)) == NULL) { 3186223637Sbz yyerror("unknown group %s", $1); 3187130617Smlaier free($1); 3188126353Smlaier YYERROR; 3189126353Smlaier } 3190223637Sbz $$ = grp->gr_gid; 3191126353Smlaier } 3192130617Smlaier free($1); 3193126353Smlaier } 3194223637Sbz | NUMBER { 3195223637Sbz if ($1 < 0 || $1 >= GID_MAX) { 3196223637Sbz yyerror("illegal gid value %lu", $1); 3197223637Sbz YYERROR; 3198223637Sbz } 3199223637Sbz $$ = $1; 3200223637Sbz } 3201126353Smlaier ; 3202126353Smlaier 3203126353Smlaierflag : STRING { 3204126353Smlaier int f; 3205126353Smlaier 3206126353Smlaier if ((f = parse_flags($1)) < 0) { 3207126353Smlaier yyerror("bad flags %s", $1); 3208130617Smlaier free($1); 3209126353Smlaier YYERROR; 3210126353Smlaier } 3211130617Smlaier free($1); 3212126353Smlaier $$.b1 = f; 3213126353Smlaier } 3214126353Smlaier ; 3215126353Smlaier 3216126353Smlaierflags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3217126353Smlaier | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3218171172Smlaier | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3219126353Smlaier ; 3220126353Smlaier 3221223637Sbzicmpspec : ICMPTYPE icmp_item { $$ = $2; } 3222223637Sbz | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3223223637Sbz | ICMP6TYPE icmp6_item { $$ = $2; } 3224223637Sbz | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3225126353Smlaier ; 3226126353Smlaier 3227223637Sbzicmp_list : icmp_item optnl { $$ = $1; } 3228223637Sbz | icmp_list comma icmp_item optnl { 3229126353Smlaier $1->tail->next = $3; 3230126353Smlaier $1->tail = $3; 3231126353Smlaier $$ = $1; 3232126353Smlaier } 3233126353Smlaier ; 3234126353Smlaier 3235223637Sbzicmp6_list : icmp6_item optnl { $$ = $1; } 3236223637Sbz | icmp6_list comma icmp6_item optnl { 3237126353Smlaier $1->tail->next = $3; 3238126353Smlaier $1->tail = $3; 3239126353Smlaier $$ = $1; 3240126353Smlaier } 3241126353Smlaier ; 3242126353Smlaier 3243126353Smlaiericmp_item : icmptype { 3244126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 3245126353Smlaier if ($$ == NULL) 3246126353Smlaier err(1, "icmp_item: calloc"); 3247126353Smlaier $$->type = $1; 3248126353Smlaier $$->code = 0; 3249126353Smlaier $$->proto = IPPROTO_ICMP; 3250126353Smlaier $$->next = NULL; 3251126353Smlaier $$->tail = $$; 3252126353Smlaier } 3253126353Smlaier | icmptype CODE STRING { 3254126353Smlaier const struct icmpcodeent *p; 3255126353Smlaier 3256223637Sbz if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3257223637Sbz yyerror("unknown icmp-code %s", $3); 3258223637Sbz free($3); 3259223637Sbz YYERROR; 3260126353Smlaier } 3261223637Sbz 3262130617Smlaier free($3); 3263126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 3264126353Smlaier if ($$ == NULL) 3265126353Smlaier err(1, "icmp_item: calloc"); 3266126353Smlaier $$->type = $1; 3267223637Sbz $$->code = p->code + 1; 3268126353Smlaier $$->proto = IPPROTO_ICMP; 3269126353Smlaier $$->next = NULL; 3270126353Smlaier $$->tail = $$; 3271126353Smlaier } 3272223637Sbz | icmptype CODE NUMBER { 3273223637Sbz if ($3 < 0 || $3 > 255) { 3274223637Sbz yyerror("illegal icmp-code %lu", $3); 3275223637Sbz YYERROR; 3276223637Sbz } 3277223637Sbz $$ = calloc(1, sizeof(struct node_icmp)); 3278223637Sbz if ($$ == NULL) 3279223637Sbz err(1, "icmp_item: calloc"); 3280223637Sbz $$->type = $1; 3281223637Sbz $$->code = $3 + 1; 3282223637Sbz $$->proto = IPPROTO_ICMP; 3283223637Sbz $$->next = NULL; 3284223637Sbz $$->tail = $$; 3285223637Sbz } 3286126353Smlaier ; 3287126353Smlaier 3288126353Smlaiericmp6_item : icmp6type { 3289126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 3290126353Smlaier if ($$ == NULL) 3291126353Smlaier err(1, "icmp_item: calloc"); 3292126353Smlaier $$->type = $1; 3293126353Smlaier $$->code = 0; 3294126353Smlaier $$->proto = IPPROTO_ICMPV6; 3295126353Smlaier $$->next = NULL; 3296126353Smlaier $$->tail = $$; 3297126353Smlaier } 3298126353Smlaier | icmp6type CODE STRING { 3299126353Smlaier const struct icmpcodeent *p; 3300126353Smlaier 3301223637Sbz if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3302223637Sbz yyerror("unknown icmp6-code %s", $3); 3303223637Sbz free($3); 3304223637Sbz YYERROR; 3305126353Smlaier } 3306130617Smlaier free($3); 3307223637Sbz 3308126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 3309126353Smlaier if ($$ == NULL) 3310126353Smlaier err(1, "icmp_item: calloc"); 3311126353Smlaier $$->type = $1; 3312223637Sbz $$->code = p->code + 1; 3313126353Smlaier $$->proto = IPPROTO_ICMPV6; 3314126353Smlaier $$->next = NULL; 3315126353Smlaier $$->tail = $$; 3316126353Smlaier } 3317223637Sbz | icmp6type CODE NUMBER { 3318223637Sbz if ($3 < 0 || $3 > 255) { 3319223637Sbz yyerror("illegal icmp-code %lu", $3); 3320223637Sbz YYERROR; 3321223637Sbz } 3322223637Sbz $$ = calloc(1, sizeof(struct node_icmp)); 3323223637Sbz if ($$ == NULL) 3324223637Sbz err(1, "icmp_item: calloc"); 3325223637Sbz $$->type = $1; 3326223637Sbz $$->code = $3 + 1; 3327223637Sbz $$->proto = IPPROTO_ICMPV6; 3328223637Sbz $$->next = NULL; 3329223637Sbz $$->tail = $$; 3330223637Sbz } 3331126353Smlaier ; 3332126353Smlaier 3333126353Smlaiericmptype : STRING { 3334126353Smlaier const struct icmptypeent *p; 3335126353Smlaier 3336223637Sbz if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3337223637Sbz yyerror("unknown icmp-type %s", $1); 3338223637Sbz free($1); 3339223637Sbz YYERROR; 3340126353Smlaier } 3341223637Sbz $$ = p->type + 1; 3342130617Smlaier free($1); 3343126353Smlaier } 3344223637Sbz | NUMBER { 3345223637Sbz if ($1 < 0 || $1 > 255) { 3346223637Sbz yyerror("illegal icmp-type %lu", $1); 3347223637Sbz YYERROR; 3348223637Sbz } 3349223637Sbz $$ = $1 + 1; 3350223637Sbz } 3351126353Smlaier ; 3352126353Smlaier 3353126353Smlaiericmp6type : STRING { 3354126353Smlaier const struct icmptypeent *p; 3355126353Smlaier 3356223637Sbz if ((p = geticmptypebyname($1, AF_INET6)) == 3357223637Sbz NULL) { 3358223637Sbz yyerror("unknown icmp6-type %s", $1); 3359223637Sbz free($1); 3360223637Sbz YYERROR; 3361126353Smlaier } 3362223637Sbz $$ = p->type + 1; 3363130617Smlaier free($1); 3364126353Smlaier } 3365223637Sbz | NUMBER { 3366223637Sbz if ($1 < 0 || $1 > 255) { 3367223637Sbz yyerror("illegal icmp6-type %lu", $1); 3368223637Sbz YYERROR; 3369223637Sbz } 3370223637Sbz $$ = $1 + 1; 3371223637Sbz } 3372126353Smlaier ; 3373126353Smlaier 3374223637Sbztos : STRING { 3375223637Sbz if (!strcmp($1, "lowdelay")) 3376126353Smlaier $$ = IPTOS_LOWDELAY; 3377223637Sbz else if (!strcmp($1, "throughput")) 3378126353Smlaier $$ = IPTOS_THROUGHPUT; 3379223637Sbz else if (!strcmp($1, "reliability")) 3380126353Smlaier $$ = IPTOS_RELIABILITY; 3381223637Sbz else if ($1[0] == '0' && $1[1] == 'x') 3382223637Sbz $$ = strtoul($1, NULL, 16); 3383126353Smlaier else 3384223637Sbz $$ = 0; /* flag bad argument */ 3385126353Smlaier if (!$$ || $$ > 255) { 3386223637Sbz yyerror("illegal tos value %s", $1); 3387223637Sbz free($1); 3388126353Smlaier YYERROR; 3389126353Smlaier } 3390223637Sbz free($1); 3391126353Smlaier } 3392223637Sbz | NUMBER { 3393223637Sbz $$ = $1; 3394223637Sbz if (!$$ || $$ > 255) { 3395223637Sbz yyerror("illegal tos value %s", $1); 3396223637Sbz YYERROR; 3397223637Sbz } 3398223637Sbz } 3399126353Smlaier ; 3400126353Smlaier 3401130617Smlaiersourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3402130617Smlaier | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3403130617Smlaier | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3404130617Smlaier ; 3405130617Smlaier 3406130617Smlaierstatelock : IFBOUND { 3407130617Smlaier $$ = PFRULE_IFBOUND; 3408130617Smlaier } 3409130617Smlaier | FLOATING { 3410130617Smlaier $$ = 0; 3411130617Smlaier } 3412130617Smlaier ; 3413130617Smlaier 3414171172Smlaierkeep : NO STATE { 3415171172Smlaier $$.action = 0; 3416171172Smlaier $$.options = NULL; 3417171172Smlaier } 3418171172Smlaier | KEEP STATE state_opt_spec { 3419126353Smlaier $$.action = PF_STATE_NORMAL; 3420126353Smlaier $$.options = $3; 3421126353Smlaier } 3422130617Smlaier | MODULATE STATE state_opt_spec { 3423126353Smlaier $$.action = PF_STATE_MODULATE; 3424126353Smlaier $$.options = $3; 3425126353Smlaier } 3426126353Smlaier | SYNPROXY STATE state_opt_spec { 3427126353Smlaier $$.action = PF_STATE_SYNPROXY; 3428126353Smlaier $$.options = $3; 3429126353Smlaier } 3430126353Smlaier ; 3431126353Smlaier 3432145840Smlaierflush : /* empty */ { $$ = 0; } 3433145840Smlaier | FLUSH { $$ = PF_FLUSH; } 3434145840Smlaier | FLUSH GLOBAL { 3435145840Smlaier $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3436145840Smlaier } 3437145840Smlaier ; 3438145840Smlaier 3439126353Smlaierstate_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3440126353Smlaier | /* empty */ { $$ = NULL; } 3441126353Smlaier ; 3442126353Smlaier 3443126353Smlaierstate_opt_list : state_opt_item { $$ = $1; } 3444126353Smlaier | state_opt_list comma state_opt_item { 3445126353Smlaier $1->tail->next = $3; 3446126353Smlaier $1->tail = $3; 3447126353Smlaier $$ = $1; 3448126353Smlaier } 3449126353Smlaier ; 3450126353Smlaier 3451223637Sbzstate_opt_item : MAXIMUM NUMBER { 3452223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 3453223637Sbz yyerror("only positive values permitted"); 3454223637Sbz YYERROR; 3455223637Sbz } 3456126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3457126353Smlaier if ($$ == NULL) 3458126353Smlaier err(1, "state_opt_item: calloc"); 3459126353Smlaier $$->type = PF_STATE_OPT_MAX; 3460126353Smlaier $$->data.max_states = $2; 3461126353Smlaier $$->next = NULL; 3462126353Smlaier $$->tail = $$; 3463126353Smlaier } 3464130617Smlaier | NOSYNC { 3465130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3466130617Smlaier if ($$ == NULL) 3467130617Smlaier err(1, "state_opt_item: calloc"); 3468130617Smlaier $$->type = PF_STATE_OPT_NOSYNC; 3469130617Smlaier $$->next = NULL; 3470130617Smlaier $$->tail = $$; 3471130617Smlaier } 3472223637Sbz | MAXSRCSTATES NUMBER { 3473223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 3474223637Sbz yyerror("only positive values permitted"); 3475223637Sbz YYERROR; 3476223637Sbz } 3477130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3478130617Smlaier if ($$ == NULL) 3479130617Smlaier err(1, "state_opt_item: calloc"); 3480130617Smlaier $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3481130617Smlaier $$->data.max_src_states = $2; 3482130617Smlaier $$->next = NULL; 3483130617Smlaier $$->tail = $$; 3484130617Smlaier } 3485223637Sbz | MAXSRCCONN NUMBER { 3486223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 3487223637Sbz yyerror("only positive values permitted"); 3488223637Sbz YYERROR; 3489223637Sbz } 3490145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3491145840Smlaier if ($$ == NULL) 3492145840Smlaier err(1, "state_opt_item: calloc"); 3493145840Smlaier $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3494145840Smlaier $$->data.max_src_conn = $2; 3495145840Smlaier $$->next = NULL; 3496145840Smlaier $$->tail = $$; 3497145840Smlaier } 3498223637Sbz | MAXSRCCONNRATE NUMBER '/' NUMBER { 3499223637Sbz if ($2 < 0 || $2 > UINT_MAX || 3500223637Sbz $4 < 0 || $4 > UINT_MAX) { 3501223637Sbz yyerror("only positive values permitted"); 3502223637Sbz YYERROR; 3503223637Sbz } 3504145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3505145840Smlaier if ($$ == NULL) 3506145840Smlaier err(1, "state_opt_item: calloc"); 3507145840Smlaier $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3508145840Smlaier $$->data.max_src_conn_rate.limit = $2; 3509145840Smlaier $$->data.max_src_conn_rate.seconds = $4; 3510145840Smlaier $$->next = NULL; 3511145840Smlaier $$->tail = $$; 3512145840Smlaier } 3513145840Smlaier | OVERLOAD '<' STRING '>' flush { 3514145840Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3515145840Smlaier yyerror("table name '%s' too long", $3); 3516145840Smlaier free($3); 3517145840Smlaier YYERROR; 3518145840Smlaier } 3519145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3520145840Smlaier if ($$ == NULL) 3521145840Smlaier err(1, "state_opt_item: calloc"); 3522145840Smlaier if (strlcpy($$->data.overload.tblname, $3, 3523145840Smlaier PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3524145840Smlaier errx(1, "state_opt_item: strlcpy"); 3525145840Smlaier free($3); 3526145840Smlaier $$->type = PF_STATE_OPT_OVERLOAD; 3527145840Smlaier $$->data.overload.flush = $5; 3528145840Smlaier $$->next = NULL; 3529145840Smlaier $$->tail = $$; 3530145840Smlaier } 3531223637Sbz | MAXSRCNODES NUMBER { 3532223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 3533223637Sbz yyerror("only positive values permitted"); 3534223637Sbz YYERROR; 3535223637Sbz } 3536130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3537130617Smlaier if ($$ == NULL) 3538130617Smlaier err(1, "state_opt_item: calloc"); 3539130617Smlaier $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3540130617Smlaier $$->data.max_src_nodes = $2; 3541130617Smlaier $$->next = NULL; 3542130617Smlaier $$->tail = $$; 3543130617Smlaier } 3544130617Smlaier | sourcetrack { 3545130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3546130617Smlaier if ($$ == NULL) 3547130617Smlaier err(1, "state_opt_item: calloc"); 3548130617Smlaier $$->type = PF_STATE_OPT_SRCTRACK; 3549130617Smlaier $$->data.src_track = $1; 3550130617Smlaier $$->next = NULL; 3551130617Smlaier $$->tail = $$; 3552130617Smlaier } 3553130617Smlaier | statelock { 3554130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3555130617Smlaier if ($$ == NULL) 3556130617Smlaier err(1, "state_opt_item: calloc"); 3557130617Smlaier $$->type = PF_STATE_OPT_STATELOCK; 3558130617Smlaier $$->data.statelock = $1; 3559130617Smlaier $$->next = NULL; 3560130617Smlaier $$->tail = $$; 3561130617Smlaier } 3562200930Sdelphij | SLOPPY { 3563200930Sdelphij $$ = calloc(1, sizeof(struct node_state_opt)); 3564200930Sdelphij if ($$ == NULL) 3565200930Sdelphij err(1, "state_opt_item: calloc"); 3566200930Sdelphij $$->type = PF_STATE_OPT_SLOPPY; 3567200930Sdelphij $$->next = NULL; 3568200930Sdelphij $$->tail = $$; 3569200930Sdelphij } 3570223637Sbz | STRING NUMBER { 3571126353Smlaier int i; 3572126353Smlaier 3573223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 3574223637Sbz yyerror("only positive values permitted"); 3575223637Sbz YYERROR; 3576223637Sbz } 3577126353Smlaier for (i = 0; pf_timeouts[i].name && 3578126353Smlaier strcmp(pf_timeouts[i].name, $1); ++i) 3579126353Smlaier ; /* nothing */ 3580126353Smlaier if (!pf_timeouts[i].name) { 3581126353Smlaier yyerror("illegal timeout name %s", $1); 3582130617Smlaier free($1); 3583126353Smlaier YYERROR; 3584126353Smlaier } 3585126353Smlaier if (strchr(pf_timeouts[i].name, '.') == NULL) { 3586126353Smlaier yyerror("illegal state timeout %s", $1); 3587130617Smlaier free($1); 3588126353Smlaier YYERROR; 3589126353Smlaier } 3590130617Smlaier free($1); 3591126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3592126353Smlaier if ($$ == NULL) 3593126353Smlaier err(1, "state_opt_item: calloc"); 3594126353Smlaier $$->type = PF_STATE_OPT_TIMEOUT; 3595126353Smlaier $$->data.timeout.number = pf_timeouts[i].timeout; 3596126353Smlaier $$->data.timeout.seconds = $2; 3597126353Smlaier $$->next = NULL; 3598126353Smlaier $$->tail = $$; 3599126353Smlaier } 3600126353Smlaier ; 3601126353Smlaier 3602126353Smlaierlabel : LABEL STRING { 3603130617Smlaier $$ = $2; 3604126353Smlaier } 3605126353Smlaier ; 3606126353Smlaier 3607126353Smlaierqname : QUEUE STRING { 3608130617Smlaier $$.qname = $2; 3609223637Sbz $$.pqname = NULL; 3610126353Smlaier } 3611126353Smlaier | QUEUE '(' STRING ')' { 3612130617Smlaier $$.qname = $3; 3613223637Sbz $$.pqname = NULL; 3614126353Smlaier } 3615126353Smlaier | QUEUE '(' STRING comma STRING ')' { 3616130617Smlaier $$.qname = $3; 3617130617Smlaier $$.pqname = $5; 3618126353Smlaier } 3619126353Smlaier ; 3620126353Smlaier 3621126353Smlaierno : /* empty */ { $$ = 0; } 3622126353Smlaier | NO { $$ = 1; } 3623126353Smlaier ; 3624126353Smlaier 3625223637Sbzportstar : numberstring { 3626223637Sbz if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3627223637Sbz free($1); 3628223637Sbz YYERROR; 3629126353Smlaier } 3630130617Smlaier free($1); 3631126353Smlaier } 3632126353Smlaier ; 3633126353Smlaier 3634126353Smlaierredirspec : host { $$ = $1; } 3635223637Sbz | '{' optnl redir_host_list '}' { $$ = $3; } 3636126353Smlaier ; 3637126353Smlaier 3638223637Sbzredir_host_list : host optnl { $$ = $1; } 3639223637Sbz | redir_host_list comma host optnl { 3640126353Smlaier $1->tail->next = $3; 3641126353Smlaier $1->tail = $3->tail; 3642126353Smlaier $$ = $1; 3643126353Smlaier } 3644126353Smlaier ; 3645126353Smlaier 3646126353Smlaierredirpool : /* empty */ { $$ = NULL; } 3647126353Smlaier | ARROW redirspec { 3648126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3649126353Smlaier if ($$ == NULL) 3650126353Smlaier err(1, "redirection: calloc"); 3651126353Smlaier $$->host = $2; 3652126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 3653126353Smlaier } 3654223637Sbz | ARROW redirspec PORT portstar { 3655126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3656126353Smlaier if ($$ == NULL) 3657126353Smlaier err(1, "redirection: calloc"); 3658126353Smlaier $$->host = $2; 3659126353Smlaier $$->rport = $4; 3660126353Smlaier } 3661126353Smlaier ; 3662126353Smlaier 3663126353Smlaierhashkey : /* empty */ 3664126353Smlaier { 3665126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3666126353Smlaier if ($$ == NULL) 3667126353Smlaier err(1, "hashkey: calloc"); 3668126353Smlaier $$->key32[0] = arc4random(); 3669126353Smlaier $$->key32[1] = arc4random(); 3670126353Smlaier $$->key32[2] = arc4random(); 3671126353Smlaier $$->key32[3] = arc4random(); 3672126353Smlaier } 3673126353Smlaier | string 3674126353Smlaier { 3675126353Smlaier if (!strncmp($1, "0x", 2)) { 3676126353Smlaier if (strlen($1) != 34) { 3677130617Smlaier free($1); 3678126353Smlaier yyerror("hex key must be 128 bits " 3679126353Smlaier "(32 hex digits) long"); 3680126353Smlaier YYERROR; 3681126353Smlaier } 3682126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3683126353Smlaier if ($$ == NULL) 3684126353Smlaier err(1, "hashkey: calloc"); 3685126353Smlaier 3686126353Smlaier if (sscanf($1, "0x%8x%8x%8x%8x", 3687126353Smlaier &$$->key32[0], &$$->key32[1], 3688126353Smlaier &$$->key32[2], &$$->key32[3]) != 4) { 3689126353Smlaier free($$); 3690130617Smlaier free($1); 3691126353Smlaier yyerror("invalid hex key"); 3692126353Smlaier YYERROR; 3693126353Smlaier } 3694126353Smlaier } else { 3695126353Smlaier MD5_CTX context; 3696126353Smlaier 3697126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3698126353Smlaier if ($$ == NULL) 3699126353Smlaier err(1, "hashkey: calloc"); 3700126353Smlaier MD5Init(&context); 3701126353Smlaier MD5Update(&context, (unsigned char *)$1, 3702126353Smlaier strlen($1)); 3703126353Smlaier MD5Final((unsigned char *)$$, &context); 3704126353Smlaier HTONL($$->key32[0]); 3705126353Smlaier HTONL($$->key32[1]); 3706126353Smlaier HTONL($$->key32[2]); 3707126353Smlaier HTONL($$->key32[3]); 3708126353Smlaier } 3709130617Smlaier free($1); 3710126353Smlaier } 3711126353Smlaier ; 3712126353Smlaier 3713130617Smlaierpool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3714130617Smlaier pool_opts_l 3715130617Smlaier { $$ = pool_opts; } 3716130617Smlaier | /* empty */ { 3717130617Smlaier bzero(&pool_opts, sizeof pool_opts); 3718130617Smlaier $$ = pool_opts; 3719126353Smlaier } 3720130617Smlaier ; 3721130617Smlaier 3722130617Smlaierpool_opts_l : pool_opts_l pool_opt 3723130617Smlaier | pool_opt 3724130617Smlaier ; 3725130617Smlaier 3726130617Smlaierpool_opt : BITMASK { 3727130617Smlaier if (pool_opts.type) { 3728130617Smlaier yyerror("pool type cannot be redefined"); 3729130617Smlaier YYERROR; 3730130617Smlaier } 3731130617Smlaier pool_opts.type = PF_POOL_BITMASK; 3732126353Smlaier } 3733130617Smlaier | RANDOM { 3734130617Smlaier if (pool_opts.type) { 3735130617Smlaier yyerror("pool type cannot be redefined"); 3736130617Smlaier YYERROR; 3737130617Smlaier } 3738130617Smlaier pool_opts.type = PF_POOL_RANDOM; 3739126353Smlaier } 3740130617Smlaier | SOURCEHASH hashkey { 3741130617Smlaier if (pool_opts.type) { 3742130617Smlaier yyerror("pool type cannot be redefined"); 3743130617Smlaier YYERROR; 3744130617Smlaier } 3745130617Smlaier pool_opts.type = PF_POOL_SRCHASH; 3746130617Smlaier pool_opts.key = $2; 3747126353Smlaier } 3748130617Smlaier | ROUNDROBIN { 3749130617Smlaier if (pool_opts.type) { 3750130617Smlaier yyerror("pool type cannot be redefined"); 3751130617Smlaier YYERROR; 3752130617Smlaier } 3753130617Smlaier pool_opts.type = PF_POOL_ROUNDROBIN; 3754126353Smlaier } 3755130617Smlaier | STATICPORT { 3756130617Smlaier if (pool_opts.staticport) { 3757130617Smlaier yyerror("static-port cannot be redefined"); 3758130617Smlaier YYERROR; 3759130617Smlaier } 3760130617Smlaier pool_opts.staticport = 1; 3761130617Smlaier } 3762130617Smlaier | STICKYADDRESS { 3763130617Smlaier if (filter_opts.marker & POM_STICKYADDRESS) { 3764130617Smlaier yyerror("sticky-address cannot be redefined"); 3765130617Smlaier YYERROR; 3766130617Smlaier } 3767130617Smlaier pool_opts.marker |= POM_STICKYADDRESS; 3768130617Smlaier pool_opts.opts |= PF_POOL_STICKYADDR; 3769130617Smlaier } 3770126353Smlaier ; 3771126353Smlaier 3772126353Smlaierredirection : /* empty */ { $$ = NULL; } 3773126353Smlaier | ARROW host { 3774126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3775126353Smlaier if ($$ == NULL) 3776126353Smlaier err(1, "redirection: calloc"); 3777126353Smlaier $$->host = $2; 3778126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 3779126353Smlaier } 3780223637Sbz | ARROW host PORT portstar { 3781126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3782126353Smlaier if ($$ == NULL) 3783126353Smlaier err(1, "redirection: calloc"); 3784126353Smlaier $$->host = $2; 3785126353Smlaier $$->rport = $4; 3786126353Smlaier } 3787126353Smlaier ; 3788126353Smlaier 3789223637Sbznatpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 3790171172Smlaier | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 3791171172Smlaier | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 3792223637Sbz | log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; } 3793126353Smlaier ; 3794126353Smlaier 3795223637Sbznataction : no NAT natpasslog { 3796171172Smlaier if ($1 && $3.b1) { 3797171172Smlaier yyerror("\"pass\" not valid with \"no\""); 3798171172Smlaier YYERROR; 3799171172Smlaier } 3800126353Smlaier if ($1) 3801126353Smlaier $$.b1 = PF_NONAT; 3802126353Smlaier else 3803126353Smlaier $$.b1 = PF_NAT; 3804171172Smlaier $$.b2 = $3.b1; 3805171172Smlaier $$.w = $3.b2; 3806171172Smlaier $$.w2 = $3.w2; 3807126353Smlaier } 3808223637Sbz | no RDR natpasslog { 3809171172Smlaier if ($1 && $3.b1) { 3810171172Smlaier yyerror("\"pass\" not valid with \"no\""); 3811171172Smlaier YYERROR; 3812171172Smlaier } 3813126353Smlaier if ($1) 3814126353Smlaier $$.b1 = PF_NORDR; 3815126353Smlaier else 3816126353Smlaier $$.b1 = PF_RDR; 3817171172Smlaier $$.b2 = $3.b1; 3818171172Smlaier $$.w = $3.b2; 3819171172Smlaier $$.w2 = $3.w2; 3820126353Smlaier } 3821126353Smlaier ; 3822126353Smlaier 3823171172Smlaiernatrule : nataction interface af proto fromto tag tagged rtable 3824171172Smlaier redirpool pool_opts 3825126353Smlaier { 3826126353Smlaier struct pf_rule r; 3827126353Smlaier 3828126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 3829126353Smlaier YYERROR; 3830126353Smlaier 3831126353Smlaier memset(&r, 0, sizeof(r)); 3832126353Smlaier 3833126353Smlaier r.action = $1.b1; 3834126353Smlaier r.natpass = $1.b2; 3835171172Smlaier r.log = $1.w; 3836171172Smlaier r.logif = $1.w2; 3837126353Smlaier r.af = $3; 3838126353Smlaier 3839126353Smlaier if (!r.af) { 3840126353Smlaier if ($5.src.host && $5.src.host->af && 3841126353Smlaier !$5.src.host->ifindex) 3842126353Smlaier r.af = $5.src.host->af; 3843126353Smlaier else if ($5.dst.host && $5.dst.host->af && 3844126353Smlaier !$5.dst.host->ifindex) 3845126353Smlaier r.af = $5.dst.host->af; 3846126353Smlaier } 3847126353Smlaier 3848126353Smlaier if ($6 != NULL) 3849130617Smlaier if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3850126353Smlaier PF_TAG_NAME_SIZE) { 3851126353Smlaier yyerror("tag too long, max %u chars", 3852126353Smlaier PF_TAG_NAME_SIZE - 1); 3853126353Smlaier YYERROR; 3854126353Smlaier } 3855126353Smlaier 3856145840Smlaier if ($7.name) 3857145840Smlaier if (strlcpy(r.match_tagname, $7.name, 3858145840Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3859145840Smlaier yyerror("tag too long, max %u chars", 3860145840Smlaier PF_TAG_NAME_SIZE - 1); 3861145840Smlaier YYERROR; 3862145840Smlaier } 3863145840Smlaier r.match_tag_not = $7.neg; 3864171172Smlaier r.rtableid = $8; 3865145840Smlaier 3866126353Smlaier if (r.action == PF_NONAT || r.action == PF_NORDR) { 3867171172Smlaier if ($9 != NULL) { 3868126353Smlaier yyerror("translation rule with 'no' " 3869126353Smlaier "does not need '->'"); 3870126353Smlaier YYERROR; 3871126353Smlaier } 3872126353Smlaier } else { 3873171172Smlaier if ($9 == NULL || $9->host == NULL) { 3874126353Smlaier yyerror("translation rule requires '-> " 3875126353Smlaier "address'"); 3876126353Smlaier YYERROR; 3877126353Smlaier } 3878171172Smlaier if (!r.af && ! $9->host->ifindex) 3879171172Smlaier r.af = $9->host->af; 3880126353Smlaier 3881171172Smlaier remove_invalid_hosts(&$9->host, &r.af); 3882171172Smlaier if (invalid_redirect($9->host, r.af)) 3883126353Smlaier YYERROR; 3884171172Smlaier if (check_netmask($9->host, r.af)) 3885126353Smlaier YYERROR; 3886126353Smlaier 3887171172Smlaier r.rpool.proxy_port[0] = ntohs($9->rport.a); 3888126353Smlaier 3889126353Smlaier switch (r.action) { 3890126353Smlaier case PF_RDR: 3891171172Smlaier if (!$9->rport.b && $9->rport.t && 3892126353Smlaier $5.dst.port != NULL) { 3893126353Smlaier r.rpool.proxy_port[1] = 3894171172Smlaier ntohs($9->rport.a) + 3895130617Smlaier (ntohs( 3896130617Smlaier $5.dst.port->port[1]) - 3897130617Smlaier ntohs( 3898130617Smlaier $5.dst.port->port[0])); 3899126353Smlaier } else 3900126353Smlaier r.rpool.proxy_port[1] = 3901171172Smlaier ntohs($9->rport.b); 3902126353Smlaier break; 3903126353Smlaier case PF_NAT: 3904130617Smlaier r.rpool.proxy_port[1] = 3905171172Smlaier ntohs($9->rport.b); 3906126353Smlaier if (!r.rpool.proxy_port[0] && 3907126353Smlaier !r.rpool.proxy_port[1]) { 3908126353Smlaier r.rpool.proxy_port[0] = 3909126353Smlaier PF_NAT_PROXY_PORT_LOW; 3910126353Smlaier r.rpool.proxy_port[1] = 3911126353Smlaier PF_NAT_PROXY_PORT_HIGH; 3912126353Smlaier } else if (!r.rpool.proxy_port[1]) 3913126353Smlaier r.rpool.proxy_port[1] = 3914126353Smlaier r.rpool.proxy_port[0]; 3915126353Smlaier break; 3916126353Smlaier default: 3917126353Smlaier break; 3918126353Smlaier } 3919126353Smlaier 3920171172Smlaier r.rpool.opts = $10.type; 3921130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3922171172Smlaier PF_POOL_NONE && ($9->host->next != NULL || 3923171172Smlaier $9->host->addr.type == PF_ADDR_TABLE || 3924171172Smlaier DYNIF_MULTIADDR($9->host->addr))) 3925126353Smlaier r.rpool.opts = PF_POOL_ROUNDROBIN; 3926130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3927130617Smlaier PF_POOL_ROUNDROBIN && 3928171172Smlaier disallow_table($9->host, "tables are only " 3929130617Smlaier "supported in round-robin redirection " 3930130617Smlaier "pools")) 3931130617Smlaier YYERROR; 3932130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3933130617Smlaier PF_POOL_ROUNDROBIN && 3934171172Smlaier disallow_alias($9->host, "interface (%s) " 3935130617Smlaier "is only supported in round-robin " 3936130617Smlaier "redirection pools")) 3937130617Smlaier YYERROR; 3938171172Smlaier if ($9->host->next != NULL) { 3939130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3940126353Smlaier PF_POOL_ROUNDROBIN) { 3941126353Smlaier yyerror("only round-robin " 3942126353Smlaier "valid for multiple " 3943126353Smlaier "redirection addresses"); 3944126353Smlaier YYERROR; 3945126353Smlaier } 3946126353Smlaier } 3947126353Smlaier } 3948126353Smlaier 3949171172Smlaier if ($10.key != NULL) 3950171172Smlaier memcpy(&r.rpool.key, $10.key, 3951126353Smlaier sizeof(struct pf_poolhashkey)); 3952126353Smlaier 3953171172Smlaier if ($10.opts) 3954171172Smlaier r.rpool.opts |= $10.opts; 3955130617Smlaier 3956171172Smlaier if ($10.staticport) { 3957126353Smlaier if (r.action != PF_NAT) { 3958126353Smlaier yyerror("the 'static-port' option is " 3959126353Smlaier "only valid with nat rules"); 3960126353Smlaier YYERROR; 3961126353Smlaier } 3962126353Smlaier if (r.rpool.proxy_port[0] != 3963126353Smlaier PF_NAT_PROXY_PORT_LOW && 3964126353Smlaier r.rpool.proxy_port[1] != 3965126353Smlaier PF_NAT_PROXY_PORT_HIGH) { 3966126353Smlaier yyerror("the 'static-port' option can't" 3967126353Smlaier " be used when specifying a port" 3968126353Smlaier " range"); 3969126353Smlaier YYERROR; 3970126353Smlaier } 3971126353Smlaier r.rpool.proxy_port[0] = 0; 3972126353Smlaier r.rpool.proxy_port[1] = 0; 3973126353Smlaier } 3974126353Smlaier 3975171172Smlaier expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 3976126353Smlaier $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3977145840Smlaier $5.dst.port, 0, 0, 0, ""); 3978171172Smlaier free($9); 3979126353Smlaier } 3980126353Smlaier ; 3981126353Smlaier 3982223637Sbzbinatrule : no BINAT natpasslog interface af proto FROM host toipspec tag 3983171172Smlaier tagged rtable redirection 3984126353Smlaier { 3985126353Smlaier struct pf_rule binat; 3986126353Smlaier struct pf_pooladdr *pa; 3987126353Smlaier 3988126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 3989126353Smlaier YYERROR; 3990223637Sbz if (disallow_urpf_failed($9, "\"urpf-failed\" is not " 3991171172Smlaier "permitted as a binat destination")) 3992171172Smlaier YYERROR; 3993126353Smlaier 3994126353Smlaier memset(&binat, 0, sizeof(binat)); 3995126353Smlaier 3996171172Smlaier if ($1 && $3.b1) { 3997171172Smlaier yyerror("\"pass\" not valid with \"no\""); 3998171172Smlaier YYERROR; 3999171172Smlaier } 4000126353Smlaier if ($1) 4001126353Smlaier binat.action = PF_NOBINAT; 4002126353Smlaier else 4003126353Smlaier binat.action = PF_BINAT; 4004171172Smlaier binat.natpass = $3.b1; 4005171172Smlaier binat.log = $3.b2; 4006171172Smlaier binat.logif = $3.w2; 4007126353Smlaier binat.af = $5; 4008126353Smlaier if (!binat.af && $8 != NULL && $8->af) 4009126353Smlaier binat.af = $8->af; 4010223637Sbz if (!binat.af && $9 != NULL && $9->af) 4011223637Sbz binat.af = $9->af; 4012145840Smlaier 4013223637Sbz if (!binat.af && $13 != NULL && $13->host) 4014223637Sbz binat.af = $13->host->af; 4015126353Smlaier if (!binat.af) { 4016126353Smlaier yyerror("address family (inet/inet6) " 4017126353Smlaier "undefined"); 4018126353Smlaier YYERROR; 4019126353Smlaier } 4020126353Smlaier 4021126353Smlaier if ($4 != NULL) { 4022126353Smlaier memcpy(binat.ifname, $4->ifname, 4023126353Smlaier sizeof(binat.ifname)); 4024130617Smlaier binat.ifnot = $4->not; 4025126353Smlaier free($4); 4026126353Smlaier } 4027145840Smlaier 4028223637Sbz if ($10 != NULL) 4029223637Sbz if (strlcpy(binat.tagname, $10, 4030130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4031126353Smlaier yyerror("tag too long, max %u chars", 4032126353Smlaier PF_TAG_NAME_SIZE - 1); 4033126353Smlaier YYERROR; 4034126353Smlaier } 4035223637Sbz if ($11.name) 4036223637Sbz if (strlcpy(binat.match_tagname, $11.name, 4037145840Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4038145840Smlaier yyerror("tag too long, max %u chars", 4039145840Smlaier PF_TAG_NAME_SIZE - 1); 4040145840Smlaier YYERROR; 4041145840Smlaier } 4042223637Sbz binat.match_tag_not = $11.neg; 4043223637Sbz binat.rtableid = $12; 4044126353Smlaier 4045126353Smlaier if ($6 != NULL) { 4046126353Smlaier binat.proto = $6->proto; 4047126353Smlaier free($6); 4048126353Smlaier } 4049126353Smlaier 4050126353Smlaier if ($8 != NULL && disallow_table($8, "invalid use of " 4051126353Smlaier "table <%s> as the source address of a binat rule")) 4052126353Smlaier YYERROR; 4053130617Smlaier if ($8 != NULL && disallow_alias($8, "invalid use of " 4054130617Smlaier "interface (%s) as the source address of a binat " 4055130617Smlaier "rule")) 4056130617Smlaier YYERROR; 4057223637Sbz if ($13 != NULL && $13->host != NULL && disallow_table( 4058223637Sbz $13->host, "invalid use of table <%s> as the " 4059126353Smlaier "redirect address of a binat rule")) 4060126353Smlaier YYERROR; 4061223637Sbz if ($13 != NULL && $13->host != NULL && disallow_alias( 4062223637Sbz $13->host, "invalid use of interface (%s) as the " 4063130617Smlaier "redirect address of a binat rule")) 4064130617Smlaier YYERROR; 4065126353Smlaier 4066126353Smlaier if ($8 != NULL) { 4067126353Smlaier if ($8->next) { 4068126353Smlaier yyerror("multiple binat ip addresses"); 4069126353Smlaier YYERROR; 4070126353Smlaier } 4071126353Smlaier if ($8->addr.type == PF_ADDR_DYNIFTL) 4072126353Smlaier $8->af = binat.af; 4073126353Smlaier if ($8->af != binat.af) { 4074126353Smlaier yyerror("binat ip versions must match"); 4075126353Smlaier YYERROR; 4076126353Smlaier } 4077126353Smlaier if (check_netmask($8, binat.af)) 4078126353Smlaier YYERROR; 4079126353Smlaier memcpy(&binat.src.addr, &$8->addr, 4080126353Smlaier sizeof(binat.src.addr)); 4081126353Smlaier free($8); 4082126353Smlaier } 4083223637Sbz if ($9 != NULL) { 4084223637Sbz if ($9->next) { 4085126353Smlaier yyerror("multiple binat ip addresses"); 4086126353Smlaier YYERROR; 4087126353Smlaier } 4088223637Sbz if ($9->af != binat.af && $9->af) { 4089126353Smlaier yyerror("binat ip versions must match"); 4090126353Smlaier YYERROR; 4091126353Smlaier } 4092223637Sbz if (check_netmask($9, binat.af)) 4093126353Smlaier YYERROR; 4094223637Sbz memcpy(&binat.dst.addr, &$9->addr, 4095126353Smlaier sizeof(binat.dst.addr)); 4096223637Sbz binat.dst.neg = $9->not; 4097223637Sbz free($9); 4098126353Smlaier } 4099126353Smlaier 4100126353Smlaier if (binat.action == PF_NOBINAT) { 4101223637Sbz if ($13 != NULL) { 4102126353Smlaier yyerror("'no binat' rule does not need" 4103126353Smlaier " '->'"); 4104126353Smlaier YYERROR; 4105126353Smlaier } 4106126353Smlaier } else { 4107223637Sbz if ($13 == NULL || $13->host == NULL) { 4108126353Smlaier yyerror("'binat' rule requires" 4109126353Smlaier " '-> address'"); 4110126353Smlaier YYERROR; 4111126353Smlaier } 4112126353Smlaier 4113223637Sbz remove_invalid_hosts(&$13->host, &binat.af); 4114223637Sbz if (invalid_redirect($13->host, binat.af)) 4115126353Smlaier YYERROR; 4116223637Sbz if ($13->host->next != NULL) { 4117126353Smlaier yyerror("binat rule must redirect to " 4118126353Smlaier "a single address"); 4119126353Smlaier YYERROR; 4120126353Smlaier } 4121223637Sbz if (check_netmask($13->host, binat.af)) 4122126353Smlaier YYERROR; 4123126353Smlaier 4124126353Smlaier if (!PF_AZERO(&binat.src.addr.v.a.mask, 4125126353Smlaier binat.af) && 4126126353Smlaier !PF_AEQ(&binat.src.addr.v.a.mask, 4127223637Sbz &$13->host->addr.v.a.mask, binat.af)) { 4128126353Smlaier yyerror("'binat' source mask and " 4129126353Smlaier "redirect mask must be the same"); 4130126353Smlaier YYERROR; 4131126353Smlaier } 4132126353Smlaier 4133126353Smlaier TAILQ_INIT(&binat.rpool.list); 4134126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 4135126353Smlaier if (pa == NULL) 4136126353Smlaier err(1, "binat: calloc"); 4137223637Sbz pa->addr = $13->host->addr; 4138126353Smlaier pa->ifname[0] = 0; 4139126353Smlaier TAILQ_INSERT_TAIL(&binat.rpool.list, 4140126353Smlaier pa, entries); 4141126353Smlaier 4142223637Sbz free($13); 4143126353Smlaier } 4144126353Smlaier 4145145840Smlaier pfctl_add_rule(pf, &binat, ""); 4146126353Smlaier } 4147126353Smlaier ; 4148126353Smlaier 4149126353Smlaiertag : /* empty */ { $$ = NULL; } 4150126353Smlaier | TAG STRING { $$ = $2; } 4151130617Smlaier ; 4152126353Smlaier 4153145840Smlaiertagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 4154145840Smlaier | not TAGGED string { $$.neg = $1; $$.name = $3; } 4155145840Smlaier ; 4156145840Smlaier 4157171172Smlaierrtable : /* empty */ { $$ = -1; } 4158223637Sbz | RTABLE NUMBER { 4159231852Sbz if ($2 < 0 || $2 > rt_tableid_max()) { 4160171172Smlaier yyerror("invalid rtable id"); 4161171172Smlaier YYERROR; 4162171172Smlaier } 4163171172Smlaier $$ = $2; 4164171172Smlaier } 4165171172Smlaier ; 4166171172Smlaier 4167126353Smlaierroute_host : STRING { 4168126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 4169126353Smlaier if ($$ == NULL) 4170126353Smlaier err(1, "route_host: calloc"); 4171130617Smlaier $$->ifname = $1; 4172126353Smlaier set_ipmask($$, 128); 4173126353Smlaier $$->next = NULL; 4174126353Smlaier $$->tail = $$; 4175126353Smlaier } 4176126353Smlaier | '(' STRING host ')' { 4177126353Smlaier $$ = $3; 4178130617Smlaier $$->ifname = $2; 4179126353Smlaier } 4180126353Smlaier ; 4181126353Smlaier 4182223637Sbzroute_host_list : route_host optnl { $$ = $1; } 4183223637Sbz | route_host_list comma route_host optnl { 4184126353Smlaier if ($1->af == 0) 4185126353Smlaier $1->af = $3->af; 4186126353Smlaier if ($1->af != $3->af) { 4187126353Smlaier yyerror("all pool addresses must be in the " 4188126353Smlaier "same address family"); 4189126353Smlaier YYERROR; 4190126353Smlaier } 4191126353Smlaier $1->tail->next = $3; 4192126353Smlaier $1->tail = $3->tail; 4193126353Smlaier $$ = $1; 4194126353Smlaier } 4195126353Smlaier ; 4196126353Smlaier 4197126353Smlaierroutespec : route_host { $$ = $1; } 4198223637Sbz | '{' optnl route_host_list '}' { $$ = $3; } 4199126353Smlaier ; 4200126353Smlaier 4201126353Smlaierroute : /* empty */ { 4202126353Smlaier $$.host = NULL; 4203126353Smlaier $$.rt = 0; 4204126353Smlaier $$.pool_opts = 0; 4205126353Smlaier } 4206126353Smlaier | FASTROUTE { 4207126353Smlaier $$.host = NULL; 4208126353Smlaier $$.rt = PF_FASTROUTE; 4209126353Smlaier $$.pool_opts = 0; 4210126353Smlaier } 4211130617Smlaier | ROUTETO routespec pool_opts { 4212126353Smlaier $$.host = $2; 4213126353Smlaier $$.rt = PF_ROUTETO; 4214130617Smlaier $$.pool_opts = $3.type | $3.opts; 4215126353Smlaier if ($3.key != NULL) 4216126353Smlaier $$.key = $3.key; 4217126353Smlaier } 4218130617Smlaier | REPLYTO routespec pool_opts { 4219126353Smlaier $$.host = $2; 4220126353Smlaier $$.rt = PF_REPLYTO; 4221130617Smlaier $$.pool_opts = $3.type | $3.opts; 4222126353Smlaier if ($3.key != NULL) 4223126353Smlaier $$.key = $3.key; 4224126353Smlaier } 4225130617Smlaier | DUPTO routespec pool_opts { 4226126353Smlaier $$.host = $2; 4227126353Smlaier $$.rt = PF_DUPTO; 4228130617Smlaier $$.pool_opts = $3.type | $3.opts; 4229126353Smlaier if ($3.key != NULL) 4230126353Smlaier $$.key = $3.key; 4231126353Smlaier } 4232126353Smlaier ; 4233126353Smlaier 4234223637Sbztimeout_spec : STRING NUMBER 4235126353Smlaier { 4236130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 4237130617Smlaier free($1); 4238126353Smlaier YYERROR; 4239130617Smlaier } 4240223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 4241223637Sbz yyerror("only positive values permitted"); 4242223637Sbz YYERROR; 4243223637Sbz } 4244126353Smlaier if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 4245126353Smlaier yyerror("unknown timeout %s", $1); 4246130617Smlaier free($1); 4247126353Smlaier YYERROR; 4248126353Smlaier } 4249130617Smlaier free($1); 4250126353Smlaier } 4251126353Smlaier ; 4252126353Smlaier 4253223637Sbztimeout_list : timeout_list comma timeout_spec optnl 4254223637Sbz | timeout_spec optnl 4255126353Smlaier ; 4256126353Smlaier 4257223637Sbzlimit_spec : STRING NUMBER 4258126353Smlaier { 4259130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 4260130617Smlaier free($1); 4261126353Smlaier YYERROR; 4262130617Smlaier } 4263223637Sbz if ($2 < 0 || $2 > UINT_MAX) { 4264223637Sbz yyerror("only positive values permitted"); 4265223637Sbz YYERROR; 4266223637Sbz } 4267126353Smlaier if (pfctl_set_limit(pf, $1, $2) != 0) { 4268126353Smlaier yyerror("unable to set limit %s %u", $1, $2); 4269130617Smlaier free($1); 4270126353Smlaier YYERROR; 4271126353Smlaier } 4272130617Smlaier free($1); 4273126353Smlaier } 4274130617Smlaier ; 4275126353Smlaier 4276223637Sbzlimit_list : limit_list comma limit_spec optnl 4277223637Sbz | limit_spec optnl 4278126353Smlaier ; 4279126353Smlaier 4280126353Smlaiercomma : ',' 4281126353Smlaier | /* empty */ 4282126353Smlaier ; 4283126353Smlaier 4284126353Smlaieryesno : NO { $$ = 0; } 4285126353Smlaier | STRING { 4286126353Smlaier if (!strcmp($1, "yes")) 4287126353Smlaier $$ = 1; 4288130617Smlaier else { 4289145840Smlaier yyerror("invalid value '%s', expected 'yes' " 4290145840Smlaier "or 'no'", $1); 4291130617Smlaier free($1); 4292126353Smlaier YYERROR; 4293130617Smlaier } 4294130617Smlaier free($1); 4295126353Smlaier } 4296130617Smlaier ; 4297126353Smlaier 4298126353Smlaierunaryop : '=' { $$ = PF_OP_EQ; } 4299126353Smlaier | '!' '=' { $$ = PF_OP_NE; } 4300126353Smlaier | '<' '=' { $$ = PF_OP_LE; } 4301126353Smlaier | '<' { $$ = PF_OP_LT; } 4302126353Smlaier | '>' '=' { $$ = PF_OP_GE; } 4303126353Smlaier | '>' { $$ = PF_OP_GT; } 4304126353Smlaier ; 4305126353Smlaier 4306126353Smlaier%% 4307126353Smlaier 4308126353Smlaierint 4309126353Smlaieryyerror(const char *fmt, ...) 4310126353Smlaier{ 4311126353Smlaier va_list ap; 4312126353Smlaier 4313223637Sbz file->errors++; 4314126353Smlaier va_start(ap, fmt); 4315223637Sbz fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 4316126353Smlaier vfprintf(stderr, fmt, ap); 4317126353Smlaier fprintf(stderr, "\n"); 4318126353Smlaier va_end(ap); 4319126353Smlaier return (0); 4320126353Smlaier} 4321126353Smlaier 4322126353Smlaierint 4323126353Smlaierdisallow_table(struct node_host *h, const char *fmt) 4324126353Smlaier{ 4325126353Smlaier for (; h != NULL; h = h->next) 4326126353Smlaier if (h->addr.type == PF_ADDR_TABLE) { 4327126353Smlaier yyerror(fmt, h->addr.v.tblname); 4328126353Smlaier return (1); 4329126353Smlaier } 4330126353Smlaier return (0); 4331126353Smlaier} 4332126353Smlaier 4333126353Smlaierint 4334171172Smlaierdisallow_urpf_failed(struct node_host *h, const char *fmt) 4335171172Smlaier{ 4336171172Smlaier for (; h != NULL; h = h->next) 4337171172Smlaier if (h->addr.type == PF_ADDR_URPFFAILED) { 4338171172Smlaier yyerror(fmt); 4339171172Smlaier return (1); 4340171172Smlaier } 4341171172Smlaier return (0); 4342171172Smlaier} 4343171172Smlaier 4344171172Smlaierint 4345130617Smlaierdisallow_alias(struct node_host *h, const char *fmt) 4346130617Smlaier{ 4347130617Smlaier for (; h != NULL; h = h->next) 4348130617Smlaier if (DYNIF_MULTIADDR(h->addr)) { 4349130617Smlaier yyerror(fmt, h->addr.v.tblname); 4350130617Smlaier return (1); 4351130617Smlaier } 4352130617Smlaier return (0); 4353130617Smlaier} 4354130617Smlaier 4355130617Smlaierint 4356171172Smlaierrule_consistent(struct pf_rule *r, int anchor_call) 4357126353Smlaier{ 4358126353Smlaier int problems = 0; 4359126353Smlaier 4360126353Smlaier switch (r->action) { 4361126353Smlaier case PF_PASS: 4362126353Smlaier case PF_DROP: 4363126353Smlaier case PF_SCRUB: 4364145840Smlaier case PF_NOSCRUB: 4365171172Smlaier problems = filter_consistent(r, anchor_call); 4366126353Smlaier break; 4367126353Smlaier case PF_NAT: 4368126353Smlaier case PF_NONAT: 4369126353Smlaier problems = nat_consistent(r); 4370126353Smlaier break; 4371126353Smlaier case PF_RDR: 4372126353Smlaier case PF_NORDR: 4373126353Smlaier problems = rdr_consistent(r); 4374126353Smlaier break; 4375126353Smlaier case PF_BINAT: 4376126353Smlaier case PF_NOBINAT: 4377126353Smlaier default: 4378126353Smlaier break; 4379126353Smlaier } 4380126353Smlaier return (problems); 4381126353Smlaier} 4382126353Smlaier 4383126353Smlaierint 4384171172Smlaierfilter_consistent(struct pf_rule *r, int anchor_call) 4385126353Smlaier{ 4386126353Smlaier int problems = 0; 4387126353Smlaier 4388126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 4389126353Smlaier (r->src.port_op || r->dst.port_op)) { 4390126353Smlaier yyerror("port only applies to tcp/udp"); 4391126353Smlaier problems++; 4392126353Smlaier } 4393126353Smlaier if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 4394126353Smlaier (r->type || r->code)) { 4395126353Smlaier yyerror("icmp-type/code only applies to icmp"); 4396126353Smlaier problems++; 4397126353Smlaier } 4398126353Smlaier if (!r->af && (r->type || r->code)) { 4399126353Smlaier yyerror("must indicate address family with icmp-type/code"); 4400126353Smlaier problems++; 4401126353Smlaier } 4402145840Smlaier if (r->overload_tblname[0] && 4403145840Smlaier r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 4404145840Smlaier yyerror("'overload' requires 'max-src-conn' " 4405145840Smlaier "or 'max-src-conn-rate'"); 4406145840Smlaier problems++; 4407145840Smlaier } 4408126353Smlaier if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 4409126353Smlaier (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 4410126353Smlaier yyerror("proto %s doesn't match address family %s", 4411126353Smlaier r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 4412126353Smlaier r->af == AF_INET ? "inet" : "inet6"); 4413126353Smlaier problems++; 4414126353Smlaier } 4415126353Smlaier if (r->allow_opts && r->action != PF_PASS) { 4416126353Smlaier yyerror("allow-opts can only be specified for pass rules"); 4417126353Smlaier problems++; 4418126353Smlaier } 4419126353Smlaier if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 4420126353Smlaier r->dst.port_op || r->flagset || r->type || r->code)) { 4421126353Smlaier yyerror("fragments can be filtered only on IP header fields"); 4422126353Smlaier problems++; 4423126353Smlaier } 4424126353Smlaier if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 4425126353Smlaier yyerror("return-rst can only be applied to TCP rules"); 4426126353Smlaier problems++; 4427126353Smlaier } 4428130617Smlaier if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 4429130617Smlaier yyerror("max-src-nodes requires 'source-track rule'"); 4430130617Smlaier problems++; 4431130617Smlaier } 4432126353Smlaier if (r->action == PF_DROP && r->keep_state) { 4433126353Smlaier yyerror("keep state on block rules doesn't make sense"); 4434126353Smlaier problems++; 4435126353Smlaier } 4436200930Sdelphij if (r->rule_flag & PFRULE_STATESLOPPY && 4437200930Sdelphij (r->keep_state == PF_STATE_MODULATE || 4438200930Sdelphij r->keep_state == PF_STATE_SYNPROXY)) { 4439200930Sdelphij yyerror("sloppy state matching cannot be used with " 4440200930Sdelphij "synproxy state or modulate state"); 4441200930Sdelphij problems++; 4442200930Sdelphij } 4443126353Smlaier return (-problems); 4444126353Smlaier} 4445126353Smlaier 4446126353Smlaierint 4447126353Smlaiernat_consistent(struct pf_rule *r) 4448126353Smlaier{ 4449130617Smlaier return (0); /* yeah! */ 4450126353Smlaier} 4451126353Smlaier 4452126353Smlaierint 4453126353Smlaierrdr_consistent(struct pf_rule *r) 4454126353Smlaier{ 4455126353Smlaier int problems = 0; 4456126353Smlaier 4457126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 4458126353Smlaier if (r->src.port_op) { 4459126353Smlaier yyerror("src port only applies to tcp/udp"); 4460126353Smlaier problems++; 4461126353Smlaier } 4462126353Smlaier if (r->dst.port_op) { 4463126353Smlaier yyerror("dst port only applies to tcp/udp"); 4464126353Smlaier problems++; 4465126353Smlaier } 4466126353Smlaier if (r->rpool.proxy_port[0]) { 4467126353Smlaier yyerror("rpool port only applies to tcp/udp"); 4468126353Smlaier problems++; 4469126353Smlaier } 4470126353Smlaier } 4471126353Smlaier if (r->dst.port_op && 4472126353Smlaier r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 4473126353Smlaier yyerror("invalid port operator for rdr destination port"); 4474126353Smlaier problems++; 4475126353Smlaier } 4476126353Smlaier return (-problems); 4477126353Smlaier} 4478126353Smlaier 4479126353Smlaierint 4480126353Smlaierprocess_tabledef(char *name, struct table_opts *opts) 4481126353Smlaier{ 4482126353Smlaier struct pfr_buffer ab; 4483126353Smlaier struct node_tinit *ti; 4484126353Smlaier 4485126353Smlaier bzero(&ab, sizeof(ab)); 4486126353Smlaier ab.pfrb_type = PFRB_ADDRS; 4487126353Smlaier SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4488126353Smlaier if (ti->file) 4489126353Smlaier if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 4490126353Smlaier if (errno) 4491126353Smlaier yyerror("cannot load \"%s\": %s", 4492126353Smlaier ti->file, strerror(errno)); 4493126353Smlaier else 4494126353Smlaier yyerror("file \"%s\" contains bad data", 4495126353Smlaier ti->file); 4496126353Smlaier goto _error; 4497126353Smlaier } 4498126353Smlaier if (ti->host) 4499126353Smlaier if (append_addr_host(&ab, ti->host, 0, 0)) { 4500126353Smlaier yyerror("cannot create address buffer: %s", 4501126353Smlaier strerror(errno)); 4502126353Smlaier goto _error; 4503126353Smlaier } 4504126353Smlaier } 4505126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 4506126353Smlaier print_tabledef(name, opts->flags, opts->init_addr, 4507126353Smlaier &opts->init_nodes); 4508126353Smlaier if (!(pf->opts & PF_OPT_NOACTION) && 4509126353Smlaier pfctl_define_table(name, opts->flags, opts->init_addr, 4510171172Smlaier pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4511126353Smlaier yyerror("cannot define table %s: %s", name, 4512126353Smlaier pfr_strerror(errno)); 4513126353Smlaier goto _error; 4514126353Smlaier } 4515126353Smlaier pf->tdirty = 1; 4516126353Smlaier pfr_buf_clear(&ab); 4517126353Smlaier return (0); 4518126353Smlaier_error: 4519126353Smlaier pfr_buf_clear(&ab); 4520126353Smlaier return (-1); 4521126353Smlaier} 4522126353Smlaier 4523126353Smlaierstruct keywords { 4524126353Smlaier const char *k_name; 4525126353Smlaier int k_val; 4526126353Smlaier}; 4527126353Smlaier 4528126353Smlaier/* macro gore, but you should've seen the prior indentation nightmare... */ 4529126353Smlaier 4530126353Smlaier#define FREE_LIST(T,r) \ 4531126353Smlaier do { \ 4532126353Smlaier T *p, *node = r; \ 4533126353Smlaier while (node != NULL) { \ 4534126353Smlaier p = node; \ 4535126353Smlaier node = node->next; \ 4536126353Smlaier free(p); \ 4537126353Smlaier } \ 4538126353Smlaier } while (0) 4539126353Smlaier 4540126353Smlaier#define LOOP_THROUGH(T,n,r,C) \ 4541126353Smlaier do { \ 4542126353Smlaier T *n; \ 4543126353Smlaier if (r == NULL) { \ 4544126353Smlaier r = calloc(1, sizeof(T)); \ 4545126353Smlaier if (r == NULL) \ 4546126353Smlaier err(1, "LOOP: calloc"); \ 4547126353Smlaier r->next = NULL; \ 4548126353Smlaier } \ 4549126353Smlaier n = r; \ 4550126353Smlaier while (n != NULL) { \ 4551126353Smlaier do { \ 4552126353Smlaier C; \ 4553126353Smlaier } while (0); \ 4554126353Smlaier n = n->next; \ 4555126353Smlaier } \ 4556126353Smlaier } while (0) 4557126353Smlaier 4558126353Smlaiervoid 4559130617Smlaierexpand_label_str(char *label, size_t len, const char *srch, const char *repl) 4560126353Smlaier{ 4561130617Smlaier char *tmp; 4562126353Smlaier char *p, *q; 4563126353Smlaier 4564130617Smlaier if ((tmp = calloc(1, len)) == NULL) 4565130617Smlaier err(1, "expand_label_str: calloc"); 4566126353Smlaier p = q = label; 4567126353Smlaier while ((q = strstr(p, srch)) != NULL) { 4568126353Smlaier *q = '\0'; 4569130617Smlaier if ((strlcat(tmp, p, len) >= len) || 4570130617Smlaier (strlcat(tmp, repl, len) >= len)) 4571130617Smlaier errx(1, "expand_label: label too long"); 4572126353Smlaier q += strlen(srch); 4573126353Smlaier p = q; 4574126353Smlaier } 4575130617Smlaier if (strlcat(tmp, p, len) >= len) 4576130617Smlaier errx(1, "expand_label: label too long"); 4577130617Smlaier strlcpy(label, tmp, len); /* always fits */ 4578130617Smlaier free(tmp); 4579126353Smlaier} 4580126353Smlaier 4581126353Smlaiervoid 4582130617Smlaierexpand_label_if(const char *name, char *label, size_t len, const char *ifname) 4583126353Smlaier{ 4584126353Smlaier if (strstr(label, name) != NULL) { 4585126353Smlaier if (!*ifname) 4586130617Smlaier expand_label_str(label, len, name, "any"); 4587126353Smlaier else 4588130617Smlaier expand_label_str(label, len, name, ifname); 4589126353Smlaier } 4590126353Smlaier} 4591126353Smlaier 4592126353Smlaiervoid 4593130617Smlaierexpand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4594126353Smlaier struct node_host *h) 4595126353Smlaier{ 4596126353Smlaier char tmp[64], tmp_not[66]; 4597126353Smlaier 4598126353Smlaier if (strstr(label, name) != NULL) { 4599126353Smlaier switch (h->addr.type) { 4600126353Smlaier case PF_ADDR_DYNIFTL: 4601126353Smlaier snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4602126353Smlaier break; 4603126353Smlaier case PF_ADDR_TABLE: 4604126353Smlaier snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4605126353Smlaier break; 4606126353Smlaier case PF_ADDR_NOROUTE: 4607126353Smlaier snprintf(tmp, sizeof(tmp), "no-route"); 4608126353Smlaier break; 4609171172Smlaier case PF_ADDR_URPFFAILED: 4610171172Smlaier snprintf(tmp, sizeof(tmp), "urpf-failed"); 4611171172Smlaier break; 4612126353Smlaier case PF_ADDR_ADDRMASK: 4613126353Smlaier if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4614126353Smlaier PF_AZERO(&h->addr.v.a.mask, af))) 4615126353Smlaier snprintf(tmp, sizeof(tmp), "any"); 4616126353Smlaier else { 4617126353Smlaier char a[48]; 4618126353Smlaier int bits; 4619126353Smlaier 4620126353Smlaier if (inet_ntop(af, &h->addr.v.a.addr, a, 4621126353Smlaier sizeof(a)) == NULL) 4622126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 4623126353Smlaier else { 4624126353Smlaier bits = unmask(&h->addr.v.a.mask, af); 4625126353Smlaier if ((af == AF_INET && bits < 32) || 4626126353Smlaier (af == AF_INET6 && bits < 128)) 4627126353Smlaier snprintf(tmp, sizeof(tmp), 4628130617Smlaier "%s/%d", a, bits); 4629126353Smlaier else 4630126353Smlaier snprintf(tmp, sizeof(tmp), 4631126353Smlaier "%s", a); 4632126353Smlaier } 4633126353Smlaier } 4634126353Smlaier break; 4635126353Smlaier default: 4636126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 4637126353Smlaier break; 4638126353Smlaier } 4639126353Smlaier 4640126353Smlaier if (h->not) { 4641126353Smlaier snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4642130617Smlaier expand_label_str(label, len, name, tmp_not); 4643126353Smlaier } else 4644130617Smlaier expand_label_str(label, len, name, tmp); 4645126353Smlaier } 4646126353Smlaier} 4647126353Smlaier 4648126353Smlaiervoid 4649130617Smlaierexpand_label_port(const char *name, char *label, size_t len, 4650130617Smlaier struct node_port *port) 4651126353Smlaier{ 4652126353Smlaier char a1[6], a2[6], op[13] = ""; 4653126353Smlaier 4654126353Smlaier if (strstr(label, name) != NULL) { 4655126353Smlaier snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4656126353Smlaier snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4657126353Smlaier if (!port->op) 4658126353Smlaier ; 4659126353Smlaier else if (port->op == PF_OP_IRG) 4660126353Smlaier snprintf(op, sizeof(op), "%s><%s", a1, a2); 4661126353Smlaier else if (port->op == PF_OP_XRG) 4662126353Smlaier snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4663126353Smlaier else if (port->op == PF_OP_EQ) 4664126353Smlaier snprintf(op, sizeof(op), "%s", a1); 4665126353Smlaier else if (port->op == PF_OP_NE) 4666126353Smlaier snprintf(op, sizeof(op), "!=%s", a1); 4667126353Smlaier else if (port->op == PF_OP_LT) 4668126353Smlaier snprintf(op, sizeof(op), "<%s", a1); 4669126353Smlaier else if (port->op == PF_OP_LE) 4670126353Smlaier snprintf(op, sizeof(op), "<=%s", a1); 4671126353Smlaier else if (port->op == PF_OP_GT) 4672126353Smlaier snprintf(op, sizeof(op), ">%s", a1); 4673126353Smlaier else if (port->op == PF_OP_GE) 4674126353Smlaier snprintf(op, sizeof(op), ">=%s", a1); 4675130617Smlaier expand_label_str(label, len, name, op); 4676126353Smlaier } 4677126353Smlaier} 4678126353Smlaier 4679126353Smlaiervoid 4680130617Smlaierexpand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4681126353Smlaier{ 4682126353Smlaier struct protoent *pe; 4683126353Smlaier char n[4]; 4684126353Smlaier 4685126353Smlaier if (strstr(label, name) != NULL) { 4686126353Smlaier pe = getprotobynumber(proto); 4687126353Smlaier if (pe != NULL) 4688130617Smlaier expand_label_str(label, len, name, pe->p_name); 4689126353Smlaier else { 4690126353Smlaier snprintf(n, sizeof(n), "%u", proto); 4691130617Smlaier expand_label_str(label, len, name, n); 4692126353Smlaier } 4693126353Smlaier } 4694126353Smlaier} 4695126353Smlaier 4696126353Smlaiervoid 4697130617Smlaierexpand_label_nr(const char *name, char *label, size_t len) 4698126353Smlaier{ 4699126353Smlaier char n[11]; 4700126353Smlaier 4701126353Smlaier if (strstr(label, name) != NULL) { 4702171172Smlaier snprintf(n, sizeof(n), "%u", pf->anchor->match); 4703130617Smlaier expand_label_str(label, len, name, n); 4704126353Smlaier } 4705126353Smlaier} 4706126353Smlaier 4707126353Smlaiervoid 4708130617Smlaierexpand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4709126353Smlaier struct node_host *src_host, struct node_port *src_port, 4710126353Smlaier struct node_host *dst_host, struct node_port *dst_port, 4711126353Smlaier u_int8_t proto) 4712126353Smlaier{ 4713130617Smlaier expand_label_if("$if", label, len, ifname); 4714130617Smlaier expand_label_addr("$srcaddr", label, len, af, src_host); 4715130617Smlaier expand_label_addr("$dstaddr", label, len, af, dst_host); 4716130617Smlaier expand_label_port("$srcport", label, len, src_port); 4717130617Smlaier expand_label_port("$dstport", label, len, dst_port); 4718130617Smlaier expand_label_proto("$proto", label, len, proto); 4719130617Smlaier expand_label_nr("$nr", label, len); 4720126353Smlaier} 4721126353Smlaier 4722126353Smlaierint 4723126353Smlaierexpand_altq(struct pf_altq *a, struct node_if *interfaces, 4724126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 4725126353Smlaier struct node_queue_opt *opts) 4726126353Smlaier{ 4727126353Smlaier struct pf_altq pa, pb; 4728126353Smlaier char qname[PF_QNAME_SIZE]; 4729126353Smlaier struct node_queue *n; 4730126353Smlaier struct node_queue_bw bw; 4731126353Smlaier int errs = 0; 4732126353Smlaier 4733126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4734126353Smlaier FREE_LIST(struct node_if, interfaces); 4735126353Smlaier FREE_LIST(struct node_queue, nqueues); 4736126353Smlaier return (0); 4737126353Smlaier } 4738126353Smlaier 4739126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4740126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 4741126353Smlaier if (strlcpy(pa.ifname, interface->ifname, 4742126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4743126353Smlaier errx(1, "expand_altq: strlcpy"); 4744126353Smlaier 4745126353Smlaier if (interface->not) { 4746126353Smlaier yyerror("altq on ! <interface> is not supported"); 4747126353Smlaier errs++; 4748126353Smlaier } else { 4749126353Smlaier if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4750126353Smlaier errs++; 4751126353Smlaier else 4752126353Smlaier if (pfctl_add_altq(pf, &pa)) 4753126353Smlaier errs++; 4754126353Smlaier 4755126353Smlaier if (pf->opts & PF_OPT_VERBOSE) { 4756126353Smlaier print_altq(&pf->paltq->altq, 0, 4757126353Smlaier &bwspec, opts); 4758126353Smlaier if (nqueues && nqueues->tail) { 4759126353Smlaier printf("queue { "); 4760126353Smlaier LOOP_THROUGH(struct node_queue, queue, 4761126353Smlaier nqueues, 4762126353Smlaier printf("%s ", 4763126353Smlaier queue->queue); 4764126353Smlaier ); 4765126353Smlaier printf("}"); 4766126353Smlaier } 4767126353Smlaier printf("\n"); 4768126353Smlaier } 4769126353Smlaier 4770126353Smlaier if (pa.scheduler == ALTQT_CBQ || 4771126353Smlaier pa.scheduler == ALTQT_HFSC) { 4772126353Smlaier /* now create a root queue */ 4773126353Smlaier memset(&pb, 0, sizeof(struct pf_altq)); 4774126353Smlaier if (strlcpy(qname, "root_", sizeof(qname)) >= 4775126353Smlaier sizeof(qname)) 4776126353Smlaier errx(1, "expand_altq: strlcpy"); 4777126353Smlaier if (strlcat(qname, interface->ifname, 4778126353Smlaier sizeof(qname)) >= sizeof(qname)) 4779126353Smlaier errx(1, "expand_altq: strlcat"); 4780126353Smlaier if (strlcpy(pb.qname, qname, 4781126353Smlaier sizeof(pb.qname)) >= sizeof(pb.qname)) 4782126353Smlaier errx(1, "expand_altq: strlcpy"); 4783126353Smlaier if (strlcpy(pb.ifname, interface->ifname, 4784126353Smlaier sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4785126353Smlaier errx(1, "expand_altq: strlcpy"); 4786126353Smlaier pb.qlimit = pa.qlimit; 4787126353Smlaier pb.scheduler = pa.scheduler; 4788126353Smlaier bw.bw_absolute = pa.ifbandwidth; 4789126353Smlaier bw.bw_percent = 0; 4790126353Smlaier if (eval_pfqueue(pf, &pb, &bw, opts)) 4791126353Smlaier errs++; 4792126353Smlaier else 4793126353Smlaier if (pfctl_add_altq(pf, &pb)) 4794126353Smlaier errs++; 4795126353Smlaier } 4796126353Smlaier 4797126353Smlaier LOOP_THROUGH(struct node_queue, queue, nqueues, 4798126353Smlaier n = calloc(1, sizeof(struct node_queue)); 4799126353Smlaier if (n == NULL) 4800126353Smlaier err(1, "expand_altq: calloc"); 4801126353Smlaier if (pa.scheduler == ALTQT_CBQ || 4802126353Smlaier pa.scheduler == ALTQT_HFSC) 4803126353Smlaier if (strlcpy(n->parent, qname, 4804126353Smlaier sizeof(n->parent)) >= 4805126353Smlaier sizeof(n->parent)) 4806126353Smlaier errx(1, "expand_altq: strlcpy"); 4807126353Smlaier if (strlcpy(n->queue, queue->queue, 4808126353Smlaier sizeof(n->queue)) >= sizeof(n->queue)) 4809126353Smlaier errx(1, "expand_altq: strlcpy"); 4810126353Smlaier if (strlcpy(n->ifname, interface->ifname, 4811126353Smlaier sizeof(n->ifname)) >= sizeof(n->ifname)) 4812126353Smlaier errx(1, "expand_altq: strlcpy"); 4813126353Smlaier n->scheduler = pa.scheduler; 4814126353Smlaier n->next = NULL; 4815126353Smlaier n->tail = n; 4816126353Smlaier if (queues == NULL) 4817126353Smlaier queues = n; 4818126353Smlaier else { 4819126353Smlaier queues->tail->next = n; 4820126353Smlaier queues->tail = n; 4821126353Smlaier } 4822126353Smlaier ); 4823126353Smlaier } 4824126353Smlaier ); 4825126353Smlaier FREE_LIST(struct node_if, interfaces); 4826126353Smlaier FREE_LIST(struct node_queue, nqueues); 4827126353Smlaier 4828126353Smlaier return (errs); 4829126353Smlaier} 4830126353Smlaier 4831126353Smlaierint 4832126353Smlaierexpand_queue(struct pf_altq *a, struct node_if *interfaces, 4833126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 4834126353Smlaier struct node_queue_opt *opts) 4835126353Smlaier{ 4836126353Smlaier struct node_queue *n, *nq; 4837126353Smlaier struct pf_altq pa; 4838126353Smlaier u_int8_t found = 0; 4839126353Smlaier u_int8_t errs = 0; 4840126353Smlaier 4841126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4842126353Smlaier FREE_LIST(struct node_queue, nqueues); 4843126353Smlaier return (0); 4844126353Smlaier } 4845126353Smlaier 4846126353Smlaier if (queues == NULL) { 4847126353Smlaier yyerror("queue %s has no parent", a->qname); 4848126353Smlaier FREE_LIST(struct node_queue, nqueues); 4849126353Smlaier return (1); 4850126353Smlaier } 4851126353Smlaier 4852126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4853126353Smlaier LOOP_THROUGH(struct node_queue, tqueue, queues, 4854126353Smlaier if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4855126353Smlaier (interface->ifname[0] == 0 || 4856126353Smlaier (!interface->not && !strncmp(interface->ifname, 4857126353Smlaier tqueue->ifname, IFNAMSIZ)) || 4858126353Smlaier (interface->not && strncmp(interface->ifname, 4859126353Smlaier tqueue->ifname, IFNAMSIZ)))) { 4860126353Smlaier /* found ourself in queues */ 4861126353Smlaier found++; 4862126353Smlaier 4863126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 4864126353Smlaier 4865126353Smlaier if (pa.scheduler != ALTQT_NONE && 4866126353Smlaier pa.scheduler != tqueue->scheduler) { 4867126353Smlaier yyerror("exactly one scheduler type " 4868126353Smlaier "per interface allowed"); 4869126353Smlaier return (1); 4870126353Smlaier } 4871126353Smlaier pa.scheduler = tqueue->scheduler; 4872126353Smlaier 4873126353Smlaier /* scheduler dependent error checking */ 4874126353Smlaier switch (pa.scheduler) { 4875126353Smlaier case ALTQT_PRIQ: 4876126353Smlaier if (nqueues != NULL) { 4877126353Smlaier yyerror("priq queues cannot " 4878126353Smlaier "have child queues"); 4879126353Smlaier return (1); 4880126353Smlaier } 4881126353Smlaier if (bwspec.bw_absolute > 0 || 4882126353Smlaier bwspec.bw_percent < 100) { 4883126353Smlaier yyerror("priq doesn't take " 4884126353Smlaier "bandwidth"); 4885126353Smlaier return (1); 4886126353Smlaier } 4887126353Smlaier break; 4888126353Smlaier default: 4889126353Smlaier break; 4890126353Smlaier } 4891126353Smlaier 4892126353Smlaier if (strlcpy(pa.ifname, tqueue->ifname, 4893126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4894126353Smlaier errx(1, "expand_queue: strlcpy"); 4895126353Smlaier if (strlcpy(pa.parent, tqueue->parent, 4896126353Smlaier sizeof(pa.parent)) >= sizeof(pa.parent)) 4897126353Smlaier errx(1, "expand_queue: strlcpy"); 4898126353Smlaier 4899126353Smlaier if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4900126353Smlaier errs++; 4901126353Smlaier else 4902126353Smlaier if (pfctl_add_altq(pf, &pa)) 4903126353Smlaier errs++; 4904126353Smlaier 4905126353Smlaier for (nq = nqueues; nq != NULL; nq = nq->next) { 4906126353Smlaier if (!strcmp(a->qname, nq->queue)) { 4907126353Smlaier yyerror("queue cannot have " 4908126353Smlaier "itself as child"); 4909126353Smlaier errs++; 4910126353Smlaier continue; 4911126353Smlaier } 4912126353Smlaier n = calloc(1, 4913126353Smlaier sizeof(struct node_queue)); 4914126353Smlaier if (n == NULL) 4915126353Smlaier err(1, "expand_queue: calloc"); 4916126353Smlaier if (strlcpy(n->parent, a->qname, 4917126353Smlaier sizeof(n->parent)) >= 4918126353Smlaier sizeof(n->parent)) 4919126353Smlaier errx(1, "expand_queue strlcpy"); 4920126353Smlaier if (strlcpy(n->queue, nq->queue, 4921126353Smlaier sizeof(n->queue)) >= 4922126353Smlaier sizeof(n->queue)) 4923126353Smlaier errx(1, "expand_queue strlcpy"); 4924126353Smlaier if (strlcpy(n->ifname, tqueue->ifname, 4925126353Smlaier sizeof(n->ifname)) >= 4926126353Smlaier sizeof(n->ifname)) 4927126353Smlaier errx(1, "expand_queue strlcpy"); 4928126353Smlaier n->scheduler = tqueue->scheduler; 4929126353Smlaier n->next = NULL; 4930126353Smlaier n->tail = n; 4931126353Smlaier if (queues == NULL) 4932126353Smlaier queues = n; 4933126353Smlaier else { 4934126353Smlaier queues->tail->next = n; 4935126353Smlaier queues->tail = n; 4936126353Smlaier } 4937126353Smlaier } 4938126353Smlaier if ((pf->opts & PF_OPT_VERBOSE) && ( 4939126353Smlaier (found == 1 && interface->ifname[0] == 0) || 4940126353Smlaier (found > 0 && interface->ifname[0] != 0))) { 4941126353Smlaier print_queue(&pf->paltq->altq, 0, 4942126353Smlaier &bwspec, interface->ifname[0] != 0, 4943126353Smlaier opts); 4944126353Smlaier if (nqueues && nqueues->tail) { 4945126353Smlaier printf("{ "); 4946126353Smlaier LOOP_THROUGH(struct node_queue, 4947126353Smlaier queue, nqueues, 4948126353Smlaier printf("%s ", 4949126353Smlaier queue->queue); 4950126353Smlaier ); 4951126353Smlaier printf("}"); 4952126353Smlaier } 4953126353Smlaier printf("\n"); 4954126353Smlaier } 4955126353Smlaier } 4956126353Smlaier ); 4957126353Smlaier ); 4958126353Smlaier 4959126353Smlaier FREE_LIST(struct node_queue, nqueues); 4960126353Smlaier FREE_LIST(struct node_if, interfaces); 4961126353Smlaier 4962126353Smlaier if (!found) { 4963126353Smlaier yyerror("queue %s has no parent", a->qname); 4964126353Smlaier errs++; 4965126353Smlaier } 4966126353Smlaier 4967126353Smlaier if (errs) 4968126353Smlaier return (1); 4969126353Smlaier else 4970126353Smlaier return (0); 4971126353Smlaier} 4972126353Smlaier 4973126353Smlaiervoid 4974126353Smlaierexpand_rule(struct pf_rule *r, 4975126353Smlaier struct node_if *interfaces, struct node_host *rpool_hosts, 4976126353Smlaier struct node_proto *protos, struct node_os *src_oses, 4977126353Smlaier struct node_host *src_hosts, struct node_port *src_ports, 4978126353Smlaier struct node_host *dst_hosts, struct node_port *dst_ports, 4979145840Smlaier struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4980145840Smlaier const char *anchor_call) 4981126353Smlaier{ 4982126353Smlaier sa_family_t af = r->af; 4983126353Smlaier int added = 0, error = 0; 4984126353Smlaier char ifname[IF_NAMESIZE]; 4985126353Smlaier char label[PF_RULE_LABEL_SIZE]; 4986130617Smlaier char tagname[PF_TAG_NAME_SIZE]; 4987130617Smlaier char match_tagname[PF_TAG_NAME_SIZE]; 4988126353Smlaier struct pf_pooladdr *pa; 4989126353Smlaier struct node_host *h; 4990130617Smlaier u_int8_t flags, flagset, keep_state; 4991126353Smlaier 4992126353Smlaier if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4993126353Smlaier errx(1, "expand_rule: strlcpy"); 4994130617Smlaier if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4995130617Smlaier errx(1, "expand_rule: strlcpy"); 4996130617Smlaier if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4997130617Smlaier sizeof(match_tagname)) 4998130617Smlaier errx(1, "expand_rule: strlcpy"); 4999126353Smlaier flags = r->flags; 5000126353Smlaier flagset = r->flagset; 5001130617Smlaier keep_state = r->keep_state; 5002126353Smlaier 5003126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 5004126353Smlaier LOOP_THROUGH(struct node_proto, proto, protos, 5005126353Smlaier LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 5006126353Smlaier LOOP_THROUGH(struct node_host, src_host, src_hosts, 5007126353Smlaier LOOP_THROUGH(struct node_port, src_port, src_ports, 5008126353Smlaier LOOP_THROUGH(struct node_os, src_os, src_oses, 5009126353Smlaier LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 5010126353Smlaier LOOP_THROUGH(struct node_port, dst_port, dst_ports, 5011126353Smlaier LOOP_THROUGH(struct node_uid, uid, uids, 5012126353Smlaier LOOP_THROUGH(struct node_gid, gid, gids, 5013126353Smlaier 5014126353Smlaier r->af = af; 5015126353Smlaier /* for link-local IPv6 address, interface must match up */ 5016126353Smlaier if ((r->af && src_host->af && r->af != src_host->af) || 5017126353Smlaier (r->af && dst_host->af && r->af != dst_host->af) || 5018126353Smlaier (src_host->af && dst_host->af && 5019126353Smlaier src_host->af != dst_host->af) || 5020126353Smlaier (src_host->ifindex && dst_host->ifindex && 5021126353Smlaier src_host->ifindex != dst_host->ifindex) || 5022130617Smlaier (src_host->ifindex && *interface->ifname && 5023126353Smlaier src_host->ifindex != if_nametoindex(interface->ifname)) || 5024130617Smlaier (dst_host->ifindex && *interface->ifname && 5025126353Smlaier dst_host->ifindex != if_nametoindex(interface->ifname))) 5026126353Smlaier continue; 5027126353Smlaier if (!r->af && src_host->af) 5028126353Smlaier r->af = src_host->af; 5029126353Smlaier else if (!r->af && dst_host->af) 5030126353Smlaier r->af = dst_host->af; 5031126353Smlaier 5032130617Smlaier if (*interface->ifname) 5033145840Smlaier strlcpy(r->ifname, interface->ifname, 5034145840Smlaier sizeof(r->ifname)); 5035130617Smlaier else if (if_indextoname(src_host->ifindex, ifname)) 5036145840Smlaier strlcpy(r->ifname, ifname, sizeof(r->ifname)); 5037126353Smlaier else if (if_indextoname(dst_host->ifindex, ifname)) 5038145840Smlaier strlcpy(r->ifname, ifname, sizeof(r->ifname)); 5039126353Smlaier else 5040130617Smlaier memset(r->ifname, '\0', sizeof(r->ifname)); 5041126353Smlaier 5042126353Smlaier if (strlcpy(r->label, label, sizeof(r->label)) >= 5043126353Smlaier sizeof(r->label)) 5044126353Smlaier errx(1, "expand_rule: strlcpy"); 5045130617Smlaier if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 5046130617Smlaier sizeof(r->tagname)) 5047130617Smlaier errx(1, "expand_rule: strlcpy"); 5048130617Smlaier if (strlcpy(r->match_tagname, match_tagname, 5049130617Smlaier sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 5050130617Smlaier errx(1, "expand_rule: strlcpy"); 5051130617Smlaier expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 5052130617Smlaier src_host, src_port, dst_host, dst_port, proto->proto); 5053130617Smlaier expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 5054130617Smlaier src_host, src_port, dst_host, dst_port, proto->proto); 5055130617Smlaier expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 5056130617Smlaier r->af, src_host, src_port, dst_host, dst_port, 5057130617Smlaier proto->proto); 5058126353Smlaier 5059126353Smlaier error += check_netmask(src_host, r->af); 5060126353Smlaier error += check_netmask(dst_host, r->af); 5061126353Smlaier 5062126353Smlaier r->ifnot = interface->not; 5063126353Smlaier r->proto = proto->proto; 5064126353Smlaier r->src.addr = src_host->addr; 5065145840Smlaier r->src.neg = src_host->not; 5066126353Smlaier r->src.port[0] = src_port->port[0]; 5067126353Smlaier r->src.port[1] = src_port->port[1]; 5068126353Smlaier r->src.port_op = src_port->op; 5069126353Smlaier r->dst.addr = dst_host->addr; 5070145840Smlaier r->dst.neg = dst_host->not; 5071126353Smlaier r->dst.port[0] = dst_port->port[0]; 5072126353Smlaier r->dst.port[1] = dst_port->port[1]; 5073126353Smlaier r->dst.port_op = dst_port->op; 5074126353Smlaier r->uid.op = uid->op; 5075126353Smlaier r->uid.uid[0] = uid->uid[0]; 5076126353Smlaier r->uid.uid[1] = uid->uid[1]; 5077126353Smlaier r->gid.op = gid->op; 5078126353Smlaier r->gid.gid[0] = gid->gid[0]; 5079126353Smlaier r->gid.gid[1] = gid->gid[1]; 5080126353Smlaier r->type = icmp_type->type; 5081126353Smlaier r->code = icmp_type->code; 5082126353Smlaier 5083130617Smlaier if ((keep_state == PF_STATE_MODULATE || 5084130617Smlaier keep_state == PF_STATE_SYNPROXY) && 5085130617Smlaier r->proto && r->proto != IPPROTO_TCP) 5086130617Smlaier r->keep_state = PF_STATE_NORMAL; 5087130617Smlaier else 5088130617Smlaier r->keep_state = keep_state; 5089130617Smlaier 5090126353Smlaier if (r->proto && r->proto != IPPROTO_TCP) { 5091126353Smlaier r->flags = 0; 5092126353Smlaier r->flagset = 0; 5093126353Smlaier } else { 5094126353Smlaier r->flags = flags; 5095126353Smlaier r->flagset = flagset; 5096126353Smlaier } 5097126353Smlaier if (icmp_type->proto && r->proto != icmp_type->proto) { 5098126353Smlaier yyerror("icmp-type mismatch"); 5099126353Smlaier error++; 5100126353Smlaier } 5101126353Smlaier 5102126353Smlaier if (src_os && src_os->os) { 5103126353Smlaier r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 5104126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && 5105126353Smlaier r->os_fingerprint == PF_OSFP_NOMATCH) 5106126353Smlaier fprintf(stderr, 5107126353Smlaier "warning: unknown '%s' OS fingerprint\n", 5108126353Smlaier src_os->os); 5109126353Smlaier } else { 5110126353Smlaier r->os_fingerprint = PF_OSFP_ANY; 5111126353Smlaier } 5112126353Smlaier 5113126353Smlaier TAILQ_INIT(&r->rpool.list); 5114126353Smlaier for (h = rpool_hosts; h != NULL; h = h->next) { 5115126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 5116126353Smlaier if (pa == NULL) 5117126353Smlaier err(1, "expand_rule: calloc"); 5118126353Smlaier pa->addr = h->addr; 5119126353Smlaier if (h->ifname != NULL) { 5120126353Smlaier if (strlcpy(pa->ifname, h->ifname, 5121126353Smlaier sizeof(pa->ifname)) >= 5122126353Smlaier sizeof(pa->ifname)) 5123126353Smlaier errx(1, "expand_rule: strlcpy"); 5124126353Smlaier } else 5125126353Smlaier pa->ifname[0] = 0; 5126126353Smlaier TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 5127126353Smlaier } 5128126353Smlaier 5129171172Smlaier if (rule_consistent(r, anchor_call[0]) < 0 || error) 5130126353Smlaier yyerror("skipping rule due to errors"); 5131126353Smlaier else { 5132171172Smlaier r->nr = pf->astack[pf->asd]->match++; 5133145840Smlaier pfctl_add_rule(pf, r, anchor_call); 5134126353Smlaier added++; 5135126353Smlaier } 5136126353Smlaier 5137126353Smlaier )))))))))); 5138126353Smlaier 5139126353Smlaier FREE_LIST(struct node_if, interfaces); 5140126353Smlaier FREE_LIST(struct node_proto, protos); 5141126353Smlaier FREE_LIST(struct node_host, src_hosts); 5142126353Smlaier FREE_LIST(struct node_port, src_ports); 5143126353Smlaier FREE_LIST(struct node_os, src_oses); 5144126353Smlaier FREE_LIST(struct node_host, dst_hosts); 5145126353Smlaier FREE_LIST(struct node_port, dst_ports); 5146126353Smlaier FREE_LIST(struct node_uid, uids); 5147126353Smlaier FREE_LIST(struct node_gid, gids); 5148126353Smlaier FREE_LIST(struct node_icmp, icmp_types); 5149126353Smlaier FREE_LIST(struct node_host, rpool_hosts); 5150126353Smlaier 5151126353Smlaier if (!added) 5152126353Smlaier yyerror("rule expands to no valid combination"); 5153126353Smlaier} 5154126353Smlaier 5155145840Smlaierint 5156145840Smlaierexpand_skip_interface(struct node_if *interfaces) 5157145840Smlaier{ 5158145840Smlaier int errs = 0; 5159145840Smlaier 5160145840Smlaier if (!interfaces || (!interfaces->next && !interfaces->not && 5161145840Smlaier !strcmp(interfaces->ifname, "none"))) { 5162145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 5163145840Smlaier printf("set skip on none\n"); 5164145840Smlaier errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 5165145840Smlaier return (errs); 5166145840Smlaier } 5167145840Smlaier 5168145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 5169145840Smlaier printf("set skip on {"); 5170145840Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 5171145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 5172145840Smlaier printf(" %s", interface->ifname); 5173145840Smlaier if (interface->not) { 5174145840Smlaier yyerror("skip on ! <interface> is not supported"); 5175145840Smlaier errs++; 5176145840Smlaier } else 5177145840Smlaier errs += pfctl_set_interface_flags(pf, 5178145840Smlaier interface->ifname, PFI_IFLAG_SKIP, 1); 5179145840Smlaier ); 5180145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 5181145840Smlaier printf(" }\n"); 5182145840Smlaier 5183145840Smlaier FREE_LIST(struct node_if, interfaces); 5184145840Smlaier 5185145840Smlaier if (errs) 5186145840Smlaier return (1); 5187145840Smlaier else 5188145840Smlaier return (0); 5189145840Smlaier} 5190145840Smlaier 5191126353Smlaier#undef FREE_LIST 5192126353Smlaier#undef LOOP_THROUGH 5193126353Smlaier 5194126353Smlaierint 5195126353Smlaiercheck_rulestate(int desired_state) 5196126353Smlaier{ 5197126353Smlaier if (require_order && (rulestate > desired_state)) { 5198126353Smlaier yyerror("Rules must be in order: options, normalization, " 5199126353Smlaier "queueing, translation, filtering"); 5200126353Smlaier return (1); 5201126353Smlaier } 5202126353Smlaier rulestate = desired_state; 5203126353Smlaier return (0); 5204126353Smlaier} 5205126353Smlaier 5206126353Smlaierint 5207126353Smlaierkw_cmp(const void *k, const void *e) 5208126353Smlaier{ 5209126353Smlaier return (strcmp(k, ((const struct keywords *)e)->k_name)); 5210126353Smlaier} 5211126353Smlaier 5212126353Smlaierint 5213126353Smlaierlookup(char *s) 5214126353Smlaier{ 5215126353Smlaier /* this has to be sorted always */ 5216126353Smlaier static const struct keywords keywords[] = { 5217126353Smlaier { "all", ALL}, 5218126353Smlaier { "allow-opts", ALLOWOPTS}, 5219126353Smlaier { "altq", ALTQ}, 5220126353Smlaier { "anchor", ANCHOR}, 5221126353Smlaier { "antispoof", ANTISPOOF}, 5222126353Smlaier { "any", ANY}, 5223126353Smlaier { "bandwidth", BANDWIDTH}, 5224126353Smlaier { "binat", BINAT}, 5225126353Smlaier { "binat-anchor", BINATANCHOR}, 5226126353Smlaier { "bitmask", BITMASK}, 5227126353Smlaier { "block", BLOCK}, 5228126353Smlaier { "block-policy", BLOCKPOLICY}, 5229126353Smlaier { "cbq", CBQ}, 5230126353Smlaier { "code", CODE}, 5231126353Smlaier { "crop", FRAGCROP}, 5232130617Smlaier { "debug", DEBUG}, 5233223637Sbz { "divert-reply", DIVERTREPLY}, 5234223637Sbz { "divert-to", DIVERTTO}, 5235126353Smlaier { "drop", DROP}, 5236126353Smlaier { "drop-ovl", FRAGDROP}, 5237126353Smlaier { "dup-to", DUPTO}, 5238126353Smlaier { "fastroute", FASTROUTE}, 5239126353Smlaier { "file", FILENAME}, 5240126353Smlaier { "fingerprints", FINGERPRINTS}, 5241126353Smlaier { "flags", FLAGS}, 5242130617Smlaier { "floating", FLOATING}, 5243145840Smlaier { "flush", FLUSH}, 5244126353Smlaier { "for", FOR}, 5245126353Smlaier { "fragment", FRAGMENT}, 5246126353Smlaier { "from", FROM}, 5247130617Smlaier { "global", GLOBAL}, 5248126353Smlaier { "group", GROUP}, 5249126353Smlaier { "hfsc", HFSC}, 5250130617Smlaier { "hostid", HOSTID}, 5251126353Smlaier { "icmp-type", ICMPTYPE}, 5252126353Smlaier { "icmp6-type", ICMP6TYPE}, 5253130617Smlaier { "if-bound", IFBOUND}, 5254126353Smlaier { "in", IN}, 5255223637Sbz { "include", INCLUDE}, 5256126353Smlaier { "inet", INET}, 5257126353Smlaier { "inet6", INET6}, 5258126353Smlaier { "keep", KEEP}, 5259126353Smlaier { "label", LABEL}, 5260126353Smlaier { "limit", LIMIT}, 5261126353Smlaier { "linkshare", LINKSHARE}, 5262126353Smlaier { "load", LOAD}, 5263126353Smlaier { "log", LOG}, 5264126353Smlaier { "loginterface", LOGINTERFACE}, 5265126353Smlaier { "max", MAXIMUM}, 5266126353Smlaier { "max-mss", MAXMSS}, 5267145840Smlaier { "max-src-conn", MAXSRCCONN}, 5268145840Smlaier { "max-src-conn-rate", MAXSRCCONNRATE}, 5269130617Smlaier { "max-src-nodes", MAXSRCNODES}, 5270130617Smlaier { "max-src-states", MAXSRCSTATES}, 5271126353Smlaier { "min-ttl", MINTTL}, 5272126353Smlaier { "modulate", MODULATE}, 5273126353Smlaier { "nat", NAT}, 5274126353Smlaier { "nat-anchor", NATANCHOR}, 5275126353Smlaier { "no", NO}, 5276126353Smlaier { "no-df", NODF}, 5277126353Smlaier { "no-route", NOROUTE}, 5278130617Smlaier { "no-sync", NOSYNC}, 5279126353Smlaier { "on", ON}, 5280126353Smlaier { "optimization", OPTIMIZATION}, 5281126353Smlaier { "os", OS}, 5282126353Smlaier { "out", OUT}, 5283145840Smlaier { "overload", OVERLOAD}, 5284126353Smlaier { "pass", PASS}, 5285126353Smlaier { "port", PORT}, 5286126353Smlaier { "priority", PRIORITY}, 5287126353Smlaier { "priq", PRIQ}, 5288145840Smlaier { "probability", PROBABILITY}, 5289126353Smlaier { "proto", PROTO}, 5290126353Smlaier { "qlimit", QLIMIT}, 5291126353Smlaier { "queue", QUEUE}, 5292126353Smlaier { "quick", QUICK}, 5293126353Smlaier { "random", RANDOM}, 5294126353Smlaier { "random-id", RANDOMID}, 5295126353Smlaier { "rdr", RDR}, 5296126353Smlaier { "rdr-anchor", RDRANCHOR}, 5297126353Smlaier { "realtime", REALTIME}, 5298126353Smlaier { "reassemble", REASSEMBLE}, 5299126353Smlaier { "reply-to", REPLYTO}, 5300126353Smlaier { "require-order", REQUIREORDER}, 5301126353Smlaier { "return", RETURN}, 5302126353Smlaier { "return-icmp", RETURNICMP}, 5303126353Smlaier { "return-icmp6", RETURNICMP6}, 5304126353Smlaier { "return-rst", RETURNRST}, 5305126353Smlaier { "round-robin", ROUNDROBIN}, 5306145840Smlaier { "route", ROUTE}, 5307126353Smlaier { "route-to", ROUTETO}, 5308171172Smlaier { "rtable", RTABLE}, 5309130617Smlaier { "rule", RULE}, 5310171172Smlaier { "ruleset-optimization", RULESET_OPTIMIZATION}, 5311126353Smlaier { "scrub", SCRUB}, 5312126353Smlaier { "set", SET}, 5313223637Sbz { "set-tos", SETTOS}, 5314145840Smlaier { "skip", SKIP}, 5315200930Sdelphij { "sloppy", SLOPPY}, 5316126353Smlaier { "source-hash", SOURCEHASH}, 5317130617Smlaier { "source-track", SOURCETRACK}, 5318126353Smlaier { "state", STATE}, 5319223637Sbz { "state-defaults", STATEDEFAULTS}, 5320130617Smlaier { "state-policy", STATEPOLICY}, 5321126353Smlaier { "static-port", STATICPORT}, 5322130617Smlaier { "sticky-address", STICKYADDRESS}, 5323126353Smlaier { "synproxy", SYNPROXY}, 5324126353Smlaier { "table", TABLE}, 5325126353Smlaier { "tag", TAG}, 5326126353Smlaier { "tagged", TAGGED}, 5327126353Smlaier { "tbrsize", TBRSIZE}, 5328126353Smlaier { "timeout", TIMEOUT}, 5329126353Smlaier { "to", TO}, 5330126353Smlaier { "tos", TOS}, 5331126353Smlaier { "ttl", TTL}, 5332126353Smlaier { "upperlimit", UPPERLIMIT}, 5333171172Smlaier { "urpf-failed", URPFFAILED}, 5334126353Smlaier { "user", USER}, 5335126353Smlaier }; 5336126353Smlaier const struct keywords *p; 5337126353Smlaier 5338126353Smlaier p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5339126353Smlaier sizeof(keywords[0]), kw_cmp); 5340126353Smlaier 5341126353Smlaier if (p) { 5342126353Smlaier if (debug > 1) 5343126353Smlaier fprintf(stderr, "%s: %d\n", s, p->k_val); 5344126353Smlaier return (p->k_val); 5345126353Smlaier } else { 5346126353Smlaier if (debug > 1) 5347126353Smlaier fprintf(stderr, "string: %s\n", s); 5348126353Smlaier return (STRING); 5349126353Smlaier } 5350126353Smlaier} 5351126353Smlaier 5352126353Smlaier#define MAXPUSHBACK 128 5353126353Smlaier 5354126353Smlaierchar *parsebuf; 5355126353Smlaierint parseindex; 5356126353Smlaierchar pushback_buffer[MAXPUSHBACK]; 5357126353Smlaierint pushback_index = 0; 5358126353Smlaier 5359126353Smlaierint 5360223637Sbzlgetc(int quotec) 5361126353Smlaier{ 5362223637Sbz int c, next; 5363126353Smlaier 5364126353Smlaier if (parsebuf) { 5365126353Smlaier /* Read character from the parsebuffer instead of input. */ 5366126353Smlaier if (parseindex >= 0) { 5367126353Smlaier c = parsebuf[parseindex++]; 5368126353Smlaier if (c != '\0') 5369126353Smlaier return (c); 5370126353Smlaier parsebuf = NULL; 5371126353Smlaier } else 5372126353Smlaier parseindex++; 5373126353Smlaier } 5374126353Smlaier 5375126353Smlaier if (pushback_index) 5376126353Smlaier return (pushback_buffer[--pushback_index]); 5377126353Smlaier 5378223637Sbz if (quotec) { 5379223637Sbz if ((c = getc(file->stream)) == EOF) { 5380223637Sbz yyerror("reached end of file while parsing quoted string"); 5381223637Sbz if (popfile() == EOF) 5382223637Sbz return (EOF); 5383223637Sbz return (quotec); 5384223637Sbz } 5385223637Sbz return (c); 5386223637Sbz } 5387223637Sbz 5388223637Sbz while ((c = getc(file->stream)) == '\\') { 5389223637Sbz next = getc(file->stream); 5390126353Smlaier if (next != '\n') { 5391171172Smlaier c = next; 5392126353Smlaier break; 5393126353Smlaier } 5394223637Sbz yylval.lineno = file->lineno; 5395223637Sbz file->lineno++; 5396126353Smlaier } 5397223637Sbz 5398223637Sbz while (c == EOF) { 5399223637Sbz if (popfile() == EOF) 5400223637Sbz return (EOF); 5401223637Sbz c = getc(file->stream); 5402126353Smlaier } 5403126353Smlaier return (c); 5404126353Smlaier} 5405126353Smlaier 5406126353Smlaierint 5407126353Smlaierlungetc(int c) 5408126353Smlaier{ 5409126353Smlaier if (c == EOF) 5410126353Smlaier return (EOF); 5411126353Smlaier if (parsebuf) { 5412126353Smlaier parseindex--; 5413126353Smlaier if (parseindex >= 0) 5414126353Smlaier return (c); 5415126353Smlaier } 5416126353Smlaier if (pushback_index < MAXPUSHBACK-1) 5417126353Smlaier return (pushback_buffer[pushback_index++] = c); 5418126353Smlaier else 5419126353Smlaier return (EOF); 5420126353Smlaier} 5421126353Smlaier 5422126353Smlaierint 5423126353Smlaierfindeol(void) 5424126353Smlaier{ 5425126353Smlaier int c; 5426126353Smlaier 5427126353Smlaier parsebuf = NULL; 5428126353Smlaier 5429126353Smlaier /* skip to either EOF or the first real EOL */ 5430126353Smlaier while (1) { 5431223637Sbz if (pushback_index) 5432223637Sbz c = pushback_buffer[--pushback_index]; 5433223637Sbz else 5434223637Sbz c = lgetc(0); 5435126353Smlaier if (c == '\n') { 5436223637Sbz file->lineno++; 5437126353Smlaier break; 5438126353Smlaier } 5439126353Smlaier if (c == EOF) 5440126353Smlaier break; 5441126353Smlaier } 5442126353Smlaier return (ERROR); 5443126353Smlaier} 5444126353Smlaier 5445126353Smlaierint 5446126353Smlaieryylex(void) 5447126353Smlaier{ 5448126353Smlaier char buf[8096]; 5449126353Smlaier char *p, *val; 5450223637Sbz int quotec, next, c; 5451126353Smlaier int token; 5452126353Smlaier 5453126353Smlaiertop: 5454126353Smlaier p = buf; 5455223637Sbz while ((c = lgetc(0)) == ' ' || c == '\t') 5456126353Smlaier ; /* nothing */ 5457126353Smlaier 5458223637Sbz yylval.lineno = file->lineno; 5459126353Smlaier if (c == '#') 5460223637Sbz while ((c = lgetc(0)) != '\n' && c != EOF) 5461126353Smlaier ; /* nothing */ 5462126353Smlaier if (c == '$' && parsebuf == NULL) { 5463126353Smlaier while (1) { 5464223637Sbz if ((c = lgetc(0)) == EOF) 5465126353Smlaier return (0); 5466126353Smlaier 5467126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 5468126353Smlaier yyerror("string too long"); 5469126353Smlaier return (findeol()); 5470126353Smlaier } 5471126353Smlaier if (isalnum(c) || c == '_') { 5472126353Smlaier *p++ = (char)c; 5473126353Smlaier continue; 5474126353Smlaier } 5475126353Smlaier *p = '\0'; 5476126353Smlaier lungetc(c); 5477126353Smlaier break; 5478126353Smlaier } 5479126353Smlaier val = symget(buf); 5480126353Smlaier if (val == NULL) { 5481126353Smlaier yyerror("macro '%s' not defined", buf); 5482126353Smlaier return (findeol()); 5483126353Smlaier } 5484126353Smlaier parsebuf = val; 5485126353Smlaier parseindex = 0; 5486126353Smlaier goto top; 5487126353Smlaier } 5488126353Smlaier 5489126353Smlaier switch (c) { 5490126353Smlaier case '\'': 5491126353Smlaier case '"': 5492223637Sbz quotec = c; 5493126353Smlaier while (1) { 5494223637Sbz if ((c = lgetc(quotec)) == EOF) 5495126353Smlaier return (0); 5496223637Sbz if (c == '\n') { 5497223637Sbz file->lineno++; 5498223637Sbz continue; 5499223637Sbz } else if (c == '\\') { 5500223637Sbz if ((next = lgetc(quotec)) == EOF) 5501223637Sbz return (0); 5502223637Sbz if (next == quotec || c == ' ' || c == '\t') 5503223637Sbz c = next; 5504223637Sbz else if (next == '\n') 5505223637Sbz continue; 5506223637Sbz else 5507223637Sbz lungetc(next); 5508223637Sbz } else if (c == quotec) { 5509126353Smlaier *p = '\0'; 5510126353Smlaier break; 5511126353Smlaier } 5512126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 5513126353Smlaier yyerror("string too long"); 5514126353Smlaier return (findeol()); 5515126353Smlaier } 5516126353Smlaier *p++ = (char)c; 5517126353Smlaier } 5518126353Smlaier yylval.v.string = strdup(buf); 5519126353Smlaier if (yylval.v.string == NULL) 5520126353Smlaier err(1, "yylex: strdup"); 5521126353Smlaier return (STRING); 5522126353Smlaier case '<': 5523223637Sbz next = lgetc(0); 5524126353Smlaier if (next == '>') { 5525126353Smlaier yylval.v.i = PF_OP_XRG; 5526126353Smlaier return (PORTBINARY); 5527126353Smlaier } 5528126353Smlaier lungetc(next); 5529126353Smlaier break; 5530126353Smlaier case '>': 5531223637Sbz next = lgetc(0); 5532126353Smlaier if (next == '<') { 5533126353Smlaier yylval.v.i = PF_OP_IRG; 5534126353Smlaier return (PORTBINARY); 5535126353Smlaier } 5536126353Smlaier lungetc(next); 5537126353Smlaier break; 5538126353Smlaier case '-': 5539223637Sbz next = lgetc(0); 5540126353Smlaier if (next == '>') 5541126353Smlaier return (ARROW); 5542126353Smlaier lungetc(next); 5543126353Smlaier break; 5544126353Smlaier } 5545126353Smlaier 5546223637Sbz#define allowed_to_end_number(x) \ 5547223637Sbz (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5548223637Sbz 5549223637Sbz if (c == '-' || isdigit(c)) { 5550223637Sbz do { 5551223637Sbz *p++ = c; 5552223637Sbz if ((unsigned)(p-buf) >= sizeof(buf)) { 5553223637Sbz yyerror("string too long"); 5554223637Sbz return (findeol()); 5555223637Sbz } 5556223637Sbz } while ((c = lgetc(0)) != EOF && isdigit(c)); 5557223637Sbz lungetc(c); 5558223637Sbz if (p == buf + 1 && buf[0] == '-') 5559223637Sbz goto nodigits; 5560223637Sbz if (c == EOF || allowed_to_end_number(c)) { 5561223637Sbz const char *errstr = NULL; 5562223637Sbz 5563223637Sbz *p = '\0'; 5564223637Sbz yylval.v.number = strtonum(buf, LLONG_MIN, 5565223637Sbz LLONG_MAX, &errstr); 5566223637Sbz if (errstr) { 5567223637Sbz yyerror("\"%s\" invalid number: %s", 5568223637Sbz buf, errstr); 5569223637Sbz return (findeol()); 5570223637Sbz } 5571223637Sbz return (NUMBER); 5572223637Sbz } else { 5573223637Sbznodigits: 5574223637Sbz while (p > buf + 1) 5575223637Sbz lungetc(*--p); 5576223637Sbz c = *--p; 5577223637Sbz if (c == '-') 5578223637Sbz return (c); 5579223637Sbz } 5580223637Sbz } 5581223637Sbz 5582126353Smlaier#define allowed_in_string(x) \ 5583126353Smlaier (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5584126353Smlaier x != '{' && x != '}' && x != '<' && x != '>' && \ 5585126353Smlaier x != '!' && x != '=' && x != '/' && x != '#' && \ 5586126353Smlaier x != ',')) 5587126353Smlaier 5588126353Smlaier if (isalnum(c) || c == ':' || c == '_') { 5589126353Smlaier do { 5590126353Smlaier *p++ = c; 5591126353Smlaier if ((unsigned)(p-buf) >= sizeof(buf)) { 5592126353Smlaier yyerror("string too long"); 5593126353Smlaier return (findeol()); 5594126353Smlaier } 5595223637Sbz } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 5596126353Smlaier lungetc(c); 5597126353Smlaier *p = '\0'; 5598130617Smlaier if ((token = lookup(buf)) == STRING) 5599130617Smlaier if ((yylval.v.string = strdup(buf)) == NULL) 5600130617Smlaier err(1, "yylex: strdup"); 5601126353Smlaier return (token); 5602126353Smlaier } 5603126353Smlaier if (c == '\n') { 5604223637Sbz yylval.lineno = file->lineno; 5605223637Sbz file->lineno++; 5606126353Smlaier } 5607126353Smlaier if (c == EOF) 5608126353Smlaier return (0); 5609126353Smlaier return (c); 5610126353Smlaier} 5611126353Smlaier 5612126353Smlaierint 5613223637Sbzcheck_file_secrecy(int fd, const char *fname) 5614126353Smlaier{ 5615223637Sbz struct stat st; 5616126353Smlaier 5617223637Sbz if (fstat(fd, &st)) { 5618223637Sbz warn("cannot stat %s", fname); 5619223637Sbz return (-1); 5620223637Sbz } 5621223637Sbz if (st.st_uid != 0 && st.st_uid != getuid()) { 5622223637Sbz warnx("%s: owner not root or current user", fname); 5623223637Sbz return (-1); 5624223637Sbz } 5625223637Sbz if (st.st_mode & (S_IRWXG | S_IRWXO)) { 5626223637Sbz warnx("%s: group/world readable/writeable", fname); 5627223637Sbz return (-1); 5628223637Sbz } 5629223637Sbz return (0); 5630223637Sbz} 5631223637Sbz 5632223637Sbzstruct file * 5633223637Sbzpushfile(const char *name, int secret) 5634223637Sbz{ 5635223637Sbz struct file *nfile; 5636223637Sbz 5637223637Sbz if ((nfile = calloc(1, sizeof(struct file))) == NULL || 5638223637Sbz (nfile->name = strdup(name)) == NULL) { 5639223637Sbz warn("malloc"); 5640223637Sbz return (NULL); 5641223637Sbz } 5642223637Sbz if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 5643223637Sbz nfile->stream = stdin; 5644223637Sbz free(nfile->name); 5645223637Sbz if ((nfile->name = strdup("stdin")) == NULL) { 5646223637Sbz warn("strdup"); 5647223637Sbz free(nfile); 5648223637Sbz return (NULL); 5649223637Sbz } 5650223637Sbz } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 5651223637Sbz warn("%s", nfile->name); 5652223637Sbz free(nfile->name); 5653223637Sbz free(nfile); 5654223637Sbz return (NULL); 5655223637Sbz } else if (secret && 5656223637Sbz check_file_secrecy(fileno(nfile->stream), nfile->name)) { 5657223637Sbz fclose(nfile->stream); 5658223637Sbz free(nfile->name); 5659223637Sbz free(nfile); 5660223637Sbz return (NULL); 5661223637Sbz } 5662223637Sbz nfile->lineno = 1; 5663223637Sbz TAILQ_INSERT_TAIL(&files, nfile, entry); 5664223637Sbz return (nfile); 5665223637Sbz} 5666223637Sbz 5667223637Sbzint 5668223637Sbzpopfile(void) 5669223637Sbz{ 5670223637Sbz struct file *prev; 5671223637Sbz 5672223637Sbz if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 5673223637Sbz prev->errors += file->errors; 5674223637Sbz TAILQ_REMOVE(&files, file, entry); 5675223637Sbz fclose(file->stream); 5676223637Sbz free(file->name); 5677223637Sbz free(file); 5678223637Sbz file = prev; 5679223637Sbz return (0); 5680223637Sbz } 5681223637Sbz return (EOF); 5682223637Sbz} 5683223637Sbz 5684223637Sbzint 5685223637Sbzparse_config(char *filename, struct pfctl *xpf) 5686223637Sbz{ 5687223637Sbz int errors = 0; 5688223637Sbz struct sym *sym; 5689223637Sbz 5690126353Smlaier pf = xpf; 5691126353Smlaier errors = 0; 5692126353Smlaier rulestate = PFCTL_STATE_NONE; 5693126353Smlaier returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5694126353Smlaier returnicmp6default = 5695126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5696126353Smlaier blockpolicy = PFRULE_DROP; 5697126353Smlaier require_order = 1; 5698126353Smlaier 5699223637Sbz if ((file = pushfile(filename, 0)) == NULL) { 5700223637Sbz warn("cannot open the main config file!"); 5701223637Sbz return (-1); 5702223637Sbz } 5703223637Sbz 5704126353Smlaier yyparse(); 5705223637Sbz errors = file->errors; 5706223637Sbz popfile(); 5707126353Smlaier 5708126353Smlaier /* Free macros and check which have not been used. */ 5709223637Sbz while ((sym = TAILQ_FIRST(&symhead))) { 5710126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5711126353Smlaier fprintf(stderr, "warning: macro '%s' not " 5712126353Smlaier "used\n", sym->nam); 5713126353Smlaier free(sym->nam); 5714126353Smlaier free(sym->val); 5715223637Sbz TAILQ_REMOVE(&symhead, sym, entry); 5716130617Smlaier free(sym); 5717126353Smlaier } 5718126353Smlaier 5719126353Smlaier return (errors ? -1 : 0); 5720126353Smlaier} 5721126353Smlaier 5722126353Smlaierint 5723126353Smlaiersymset(const char *nam, const char *val, int persist) 5724126353Smlaier{ 5725126353Smlaier struct sym *sym; 5726126353Smlaier 5727126353Smlaier for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5728223637Sbz sym = TAILQ_NEXT(sym, entry)) 5729126353Smlaier ; /* nothing */ 5730126353Smlaier 5731126353Smlaier if (sym != NULL) { 5732126353Smlaier if (sym->persist == 1) 5733126353Smlaier return (0); 5734126353Smlaier else { 5735126353Smlaier free(sym->nam); 5736126353Smlaier free(sym->val); 5737223637Sbz TAILQ_REMOVE(&symhead, sym, entry); 5738126353Smlaier free(sym); 5739126353Smlaier } 5740126353Smlaier } 5741126353Smlaier if ((sym = calloc(1, sizeof(*sym))) == NULL) 5742126353Smlaier return (-1); 5743126353Smlaier 5744126353Smlaier sym->nam = strdup(nam); 5745126353Smlaier if (sym->nam == NULL) { 5746126353Smlaier free(sym); 5747126353Smlaier return (-1); 5748126353Smlaier } 5749126353Smlaier sym->val = strdup(val); 5750126353Smlaier if (sym->val == NULL) { 5751126353Smlaier free(sym->nam); 5752126353Smlaier free(sym); 5753126353Smlaier return (-1); 5754126353Smlaier } 5755126353Smlaier sym->used = 0; 5756126353Smlaier sym->persist = persist; 5757223637Sbz TAILQ_INSERT_TAIL(&symhead, sym, entry); 5758126353Smlaier return (0); 5759126353Smlaier} 5760126353Smlaier 5761126353Smlaierint 5762126353Smlaierpfctl_cmdline_symset(char *s) 5763126353Smlaier{ 5764126353Smlaier char *sym, *val; 5765126353Smlaier int ret; 5766126353Smlaier 5767126353Smlaier if ((val = strrchr(s, '=')) == NULL) 5768126353Smlaier return (-1); 5769126353Smlaier 5770126353Smlaier if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5771126353Smlaier err(1, "pfctl_cmdline_symset: malloc"); 5772126353Smlaier 5773126353Smlaier strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5774126353Smlaier 5775126353Smlaier ret = symset(sym, val + 1, 1); 5776126353Smlaier free(sym); 5777126353Smlaier 5778126353Smlaier return (ret); 5779126353Smlaier} 5780126353Smlaier 5781126353Smlaierchar * 5782126353Smlaiersymget(const char *nam) 5783126353Smlaier{ 5784126353Smlaier struct sym *sym; 5785126353Smlaier 5786223637Sbz TAILQ_FOREACH(sym, &symhead, entry) 5787126353Smlaier if (strcmp(nam, sym->nam) == 0) { 5788126353Smlaier sym->used = 1; 5789126353Smlaier return (sym->val); 5790126353Smlaier } 5791126353Smlaier return (NULL); 5792126353Smlaier} 5793126353Smlaier 5794126353Smlaiervoid 5795171172Smlaiermv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5796126353Smlaier{ 5797171172Smlaier int i; 5798171172Smlaier struct pf_rule *r; 5799126353Smlaier 5800171172Smlaier for (i = 0; i < PF_RULESET_MAX; ++i) { 5801171172Smlaier while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 5802171172Smlaier != NULL) { 5803171172Smlaier TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 5804171172Smlaier TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 5805171172Smlaier dst->anchor->match++; 5806126353Smlaier } 5807171172Smlaier src->anchor->match = 0; 5808171172Smlaier while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 5809171172Smlaier != NULL) { 5810171172Smlaier TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 5811171172Smlaier TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 5812171172Smlaier r, entries); 5813171172Smlaier } 5814126353Smlaier } 5815126353Smlaier} 5816126353Smlaier 5817126353Smlaiervoid 5818171172Smlaierdecide_address_family(struct node_host *n, sa_family_t *af) 5819171172Smlaier{ 5820171172Smlaier if (*af != 0 || n == NULL) 5821171172Smlaier return; 5822171172Smlaier *af = n->af; 5823171172Smlaier while ((n = n->next) != NULL) { 5824171172Smlaier if (n->af != *af) { 5825171172Smlaier *af = 0; 5826171172Smlaier return; 5827171172Smlaier } 5828171172Smlaier } 5829171172Smlaier} 5830171172Smlaier 5831171172Smlaiervoid 5832126353Smlaierremove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5833126353Smlaier{ 5834126353Smlaier struct node_host *n = *nh, *prev = NULL; 5835126353Smlaier 5836126353Smlaier while (n != NULL) { 5837126353Smlaier if (*af && n->af && n->af != *af) { 5838126353Smlaier /* unlink and free n */ 5839126353Smlaier struct node_host *next = n->next; 5840126353Smlaier 5841126353Smlaier /* adjust tail pointer */ 5842126353Smlaier if (n == (*nh)->tail) 5843126353Smlaier (*nh)->tail = prev; 5844126353Smlaier /* adjust previous node's next pointer */ 5845126353Smlaier if (prev == NULL) 5846126353Smlaier *nh = next; 5847126353Smlaier else 5848126353Smlaier prev->next = next; 5849126353Smlaier /* free node */ 5850126353Smlaier if (n->ifname != NULL) 5851126353Smlaier free(n->ifname); 5852126353Smlaier free(n); 5853126353Smlaier n = next; 5854126353Smlaier } else { 5855126353Smlaier if (n->af && !*af) 5856126353Smlaier *af = n->af; 5857126353Smlaier prev = n; 5858126353Smlaier n = n->next; 5859126353Smlaier } 5860126353Smlaier } 5861126353Smlaier} 5862126353Smlaier 5863126353Smlaierint 5864126353Smlaierinvalid_redirect(struct node_host *nh, sa_family_t af) 5865126353Smlaier{ 5866126353Smlaier if (!af) { 5867126353Smlaier struct node_host *n; 5868126353Smlaier 5869130617Smlaier /* tables and dyniftl are ok without an address family */ 5870126353Smlaier for (n = nh; n != NULL; n = n->next) { 5871130617Smlaier if (n->addr.type != PF_ADDR_TABLE && 5872130617Smlaier n->addr.type != PF_ADDR_DYNIFTL) { 5873126353Smlaier yyerror("address family not given and " 5874126353Smlaier "translation address expands to multiple " 5875126353Smlaier "address families"); 5876126353Smlaier return (1); 5877126353Smlaier } 5878126353Smlaier } 5879126353Smlaier } 5880126353Smlaier if (nh == NULL) { 5881126353Smlaier yyerror("no translation address with matching address family " 5882126353Smlaier "found."); 5883126353Smlaier return (1); 5884126353Smlaier } 5885126353Smlaier return (0); 5886126353Smlaier} 5887126353Smlaier 5888126353Smlaierint 5889126353Smlaieratoul(char *s, u_long *ulvalp) 5890126353Smlaier{ 5891126353Smlaier u_long ulval; 5892126353Smlaier char *ep; 5893126353Smlaier 5894126353Smlaier errno = 0; 5895126353Smlaier ulval = strtoul(s, &ep, 0); 5896126353Smlaier if (s[0] == '\0' || *ep != '\0') 5897126353Smlaier return (-1); 5898126353Smlaier if (errno == ERANGE && ulval == ULONG_MAX) 5899126353Smlaier return (-1); 5900126353Smlaier *ulvalp = ulval; 5901126353Smlaier return (0); 5902126353Smlaier} 5903126353Smlaier 5904126353Smlaierint 5905126353Smlaiergetservice(char *n) 5906126353Smlaier{ 5907126353Smlaier struct servent *s; 5908126353Smlaier u_long ulval; 5909126353Smlaier 5910126353Smlaier if (atoul(n, &ulval) == 0) { 5911126353Smlaier if (ulval > 65535) { 5912145840Smlaier yyerror("illegal port value %lu", ulval); 5913126353Smlaier return (-1); 5914126353Smlaier } 5915126353Smlaier return (htons(ulval)); 5916126353Smlaier } else { 5917126353Smlaier s = getservbyname(n, "tcp"); 5918126353Smlaier if (s == NULL) 5919126353Smlaier s = getservbyname(n, "udp"); 5920126353Smlaier if (s == NULL) { 5921126353Smlaier yyerror("unknown port %s", n); 5922126353Smlaier return (-1); 5923126353Smlaier } 5924126353Smlaier return (s->s_port); 5925126353Smlaier } 5926126353Smlaier} 5927126353Smlaier 5928126353Smlaierint 5929126353Smlaierrule_label(struct pf_rule *r, char *s) 5930126353Smlaier{ 5931126353Smlaier if (s) { 5932126353Smlaier if (strlcpy(r->label, s, sizeof(r->label)) >= 5933126353Smlaier sizeof(r->label)) { 5934126353Smlaier yyerror("rule label too long (max %d chars)", 5935126353Smlaier sizeof(r->label)-1); 5936126353Smlaier return (-1); 5937126353Smlaier } 5938126353Smlaier } 5939126353Smlaier return (0); 5940126353Smlaier} 5941126353Smlaier 5942126353Smlaieru_int16_t 5943126353Smlaierparseicmpspec(char *w, sa_family_t af) 5944126353Smlaier{ 5945126353Smlaier const struct icmpcodeent *p; 5946126353Smlaier u_long ulval; 5947126353Smlaier u_int8_t icmptype; 5948126353Smlaier 5949126353Smlaier if (af == AF_INET) 5950126353Smlaier icmptype = returnicmpdefault >> 8; 5951126353Smlaier else 5952126353Smlaier icmptype = returnicmp6default >> 8; 5953126353Smlaier 5954126353Smlaier if (atoul(w, &ulval) == -1) { 5955126353Smlaier if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5956126353Smlaier yyerror("unknown icmp code %s", w); 5957126353Smlaier return (0); 5958126353Smlaier } 5959126353Smlaier ulval = p->code; 5960126353Smlaier } 5961126353Smlaier if (ulval > 255) { 5962145840Smlaier yyerror("invalid icmp code %lu", ulval); 5963126353Smlaier return (0); 5964126353Smlaier } 5965126353Smlaier return (icmptype << 8 | ulval); 5966126353Smlaier} 5967126353Smlaier 5968126353Smlaierint 5969223637Sbzparseport(char *port, struct range *r, int extensions) 5970223637Sbz{ 5971223637Sbz char *p = strchr(port, ':'); 5972223637Sbz 5973223637Sbz if (p == NULL) { 5974223637Sbz if ((r->a = getservice(port)) == -1) 5975223637Sbz return (-1); 5976223637Sbz r->b = 0; 5977223637Sbz r->t = PF_OP_NONE; 5978223637Sbz return (0); 5979223637Sbz } 5980223637Sbz if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 5981223637Sbz *p = 0; 5982223637Sbz if ((r->a = getservice(port)) == -1) 5983223637Sbz return (-1); 5984223637Sbz r->b = 0; 5985223637Sbz r->t = PF_OP_IRG; 5986223637Sbz return (0); 5987223637Sbz } 5988223637Sbz if ((extensions & PPORT_RANGE)) { 5989223637Sbz *p++ = 0; 5990223637Sbz if ((r->a = getservice(port)) == -1 || 5991223637Sbz (r->b = getservice(p)) == -1) 5992223637Sbz return (-1); 5993223637Sbz if (r->a == r->b) { 5994223637Sbz r->b = 0; 5995223637Sbz r->t = PF_OP_NONE; 5996223637Sbz } else 5997223637Sbz r->t = PF_OP_RRG; 5998223637Sbz return (0); 5999223637Sbz } 6000223637Sbz return (-1); 6001223637Sbz} 6002223637Sbz 6003223637Sbzint 6004171172Smlaierpfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 6005126353Smlaier{ 6006126353Smlaier struct loadanchors *la; 6007126353Smlaier 6008126353Smlaier TAILQ_FOREACH(la, &loadanchorshead, entries) { 6009171172Smlaier if (pf->opts & PF_OPT_VERBOSE) 6010145840Smlaier fprintf(stderr, "\nLoading anchor %s from %s\n", 6011145840Smlaier la->anchorname, la->filename); 6012223637Sbz if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 6013171172Smlaier la->anchorname, trans) == -1) 6014126353Smlaier return (-1); 6015126353Smlaier } 6016126353Smlaier 6017126353Smlaier return (0); 6018126353Smlaier} 6019231852Sbz 6020231852Sbzint 6021231852Sbzrt_tableid_max(void) 6022231852Sbz{ 6023231852Sbz#ifdef __FreeBSD__ 6024231852Sbz int fibs; 6025231852Sbz size_t l = sizeof(fibs); 6026231852Sbz 6027231852Sbz if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1) 6028231852Sbz fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */ 6029231852Sbz /* 6030231852Sbz * As the OpenBSD code only compares > and not >= we need to adjust 6031231852Sbz * here given we only accept values of 0..n and want to avoid #ifdefs 6032231852Sbz * in the grammer. 6033231852Sbz */ 6034231852Sbz return (fibs - 1); 6035231852Sbz#else 6036231852Sbz return (RT_TABLEID_MAX); 6037231852Sbz#endif 6038231852Sbz} 6039