parse.y revision 127024
1/* $FreeBSD: head/contrib/pf/pfctl/parse.y 127024 2004-03-15 13:41:17Z mlaier $ */ 2/* $OpenBSD: parse.y,v 1.415 2003/09/01 15:07:40 henning Exp $ */ 3 4/* 5 * Copyright (c) 2001 Markus Friedl. All rights reserved. 6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28%{ 29#include <sys/types.h> 30#include <sys/socket.h> 31#include <net/if.h> 32#include <netinet/in.h> 33#include <netinet/in_systm.h> 34#include <netinet/ip.h> 35#include <netinet/ip_icmp.h> 36#include <netinet/icmp6.h> 37#include <net/pfvar.h> 38#include <arpa/inet.h> 39#include <altq/altq.h> 40#include <altq/altq_cbq.h> 41#include <altq/altq_priq.h> 42#include <altq/altq_hfsc.h> 43 44#include <stdio.h> 45#include <stdlib.h> 46#include <netdb.h> 47#include <stdarg.h> 48#include <errno.h> 49#include <string.h> 50#include <ctype.h> 51#include <err.h> 52#include <limits.h> 53#include <pwd.h> 54#include <grp.h> 55#include <md5.h> 56 57#include "pfctl_parser.h" 58#include "pfctl.h" 59 60#ifdef __FreeBSD__ 61#define HTONL(x) (x) = htonl((__uint32_t)(x)) 62#endif 63 64static struct pfctl *pf = NULL; 65static FILE *fin = NULL; 66static int debug = 0; 67static int lineno = 1; 68static int errors = 0; 69static int rulestate = 0; 70static u_int16_t returnicmpdefault = 71 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 72static u_int16_t returnicmp6default = 73 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 74static int blockpolicy = PFRULE_DROP; 75static int require_order = 1; 76 77enum { 78 PFCTL_STATE_NONE, 79 PFCTL_STATE_OPTION, 80 PFCTL_STATE_SCRUB, 81 PFCTL_STATE_QUEUE, 82 PFCTL_STATE_NAT, 83 PFCTL_STATE_FILTER 84}; 85 86struct node_proto { 87 u_int8_t proto; 88 struct node_proto *next; 89 struct node_proto *tail; 90}; 91 92struct node_port { 93 u_int16_t port[2]; 94 u_int8_t op; 95 struct node_port *next; 96 struct node_port *tail; 97}; 98 99struct node_uid { 100 uid_t uid[2]; 101 u_int8_t op; 102 struct node_uid *next; 103 struct node_uid *tail; 104}; 105 106struct node_gid { 107 gid_t gid[2]; 108 u_int8_t op; 109 struct node_gid *next; 110 struct node_gid *tail; 111}; 112 113struct node_icmp { 114 u_int8_t code; 115 u_int8_t type; 116 u_int8_t proto; 117 struct node_icmp *next; 118 struct node_icmp *tail; 119}; 120 121enum { PF_STATE_OPT_MAX=0, PF_STATE_OPT_TIMEOUT=1 }; 122struct node_state_opt { 123 int type; 124 union { 125 u_int32_t max_states; 126 struct { 127 int number; 128 u_int32_t seconds; 129 } timeout; 130 } data; 131 struct node_state_opt *next; 132 struct node_state_opt *tail; 133}; 134 135struct peer { 136 struct node_host *host; 137 struct node_port *port; 138}; 139 140struct node_queue { 141 char queue[PF_QNAME_SIZE]; 142 char parent[PF_QNAME_SIZE]; 143 char ifname[IFNAMSIZ]; 144 int scheduler; 145 struct node_queue *next; 146 struct node_queue *tail; 147} *queues = NULL; 148 149struct node_qassign { 150 char *qname; 151 char *pqname; 152}; 153 154struct filter_opts { 155 int marker; 156#define FOM_FLAGS 0x01 157#define FOM_ICMP 0x02 158#define FOM_TOS 0x04 159#define FOM_KEEP 0x08 160 struct node_uid *uid; 161 struct node_gid *gid; 162 struct { 163 u_int8_t b1; 164 u_int8_t b2; 165 u_int16_t w; 166 u_int16_t w2; 167 } flags; 168 struct node_icmp *icmpspec; 169 u_int32_t tos; 170 struct { 171 int action; 172 struct node_state_opt *options; 173 } keep; 174 int fragment; 175 int allowopts; 176 char *label; 177 struct node_qassign queues; 178 char *tag; 179 char *match_tag; 180 u_int8_t match_tag_not; 181} filter_opts; 182 183struct antispoof_opts { 184 char *label; 185} antispoof_opts; 186 187struct scrub_opts { 188 int marker; 189#define SOM_MINTTL 0x01 190#define SOM_MAXMSS 0x02 191#define SOM_FRAGCACHE 0x04 192 int nodf; 193 int minttl; 194 int maxmss; 195 int fragcache; 196 int randomid; 197 int reassemble_tcp; 198} scrub_opts; 199 200struct queue_opts { 201 int marker; 202#define QOM_BWSPEC 0x01 203#define QOM_SCHEDULER 0x02 204#define QOM_PRIORITY 0x04 205#define QOM_TBRSIZE 0x08 206#define QOM_QLIMIT 0x10 207 struct node_queue_bw queue_bwspec; 208 struct node_queue_opt scheduler; 209 int priority; 210 int tbrsize; 211 int qlimit; 212} queue_opts; 213 214struct table_opts { 215 int flags; 216 int init_addr; 217 struct node_tinithead init_nodes; 218} table_opts; 219 220struct node_hfsc_opts hfsc_opts; 221 222int yyerror(const char *, ...); 223int disallow_table(struct node_host *, const char *); 224int rule_consistent(struct pf_rule *); 225int filter_consistent(struct pf_rule *); 226int nat_consistent(struct pf_rule *); 227int rdr_consistent(struct pf_rule *); 228int process_tabledef(char *, struct table_opts *); 229int yyparse(void); 230void expand_label_str(char *, const char *, const char *); 231void expand_label_if(const char *, char *, const char *); 232void expand_label_addr(const char *, char *, u_int8_t, struct node_host *); 233void expand_label_port(const char *, char *, struct node_port *); 234void expand_label_proto(const char *, char *, u_int8_t); 235void expand_label_nr(const char *, char *); 236void expand_label(char *, const char *, u_int8_t, struct node_host *, 237 struct node_port *, struct node_host *, struct node_port *, 238 u_int8_t); 239void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 240 struct node_proto *, struct node_os*, struct node_host *, 241 struct node_port *, struct node_host *, struct node_port *, 242 struct node_uid *, struct node_gid *, struct node_icmp *); 243int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 244 struct node_queue_bw bwspec, struct node_queue_opt *); 245int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 246 struct node_queue_bw, struct node_queue_opt *); 247 248int check_rulestate(int); 249int kw_cmp(const void *, const void *); 250int lookup(char *); 251int lgetc(FILE *); 252int lungetc(int); 253int findeol(void); 254int yylex(void); 255int atoul(char *, u_long *); 256int getservice(char *); 257int rule_label(struct pf_rule *, char *); 258 259TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 260struct sym { 261 TAILQ_ENTRY(sym) entries; 262 int used; 263 int persist; 264 char *nam; 265 char *val; 266}; 267 268 269int symset(const char *, const char *, int); 270char *symget(const char *); 271 272void decide_address_family(struct node_host *, sa_family_t *); 273void remove_invalid_hosts(struct node_host **, sa_family_t *); 274int invalid_redirect(struct node_host *, sa_family_t); 275u_int16_t parseicmpspec(char *, sa_family_t); 276 277TAILQ_HEAD(loadanchorshead, loadanchors) loadanchorshead = 278 TAILQ_HEAD_INITIALIZER(loadanchorshead); 279struct loadanchors { 280 TAILQ_ENTRY(loadanchors) entries; 281 char *anchorname; 282 char *rulesetname; 283 char *filename; 284}; 285 286typedef struct { 287 union { 288 u_int32_t number; 289 int i; 290 char *string; 291 struct { 292 u_int8_t b1; 293 u_int8_t b2; 294 u_int16_t w; 295 u_int16_t w2; 296 } b; 297 struct range { 298 int a; 299 int b; 300 int t; 301 } range; 302 struct node_if *interface; 303 struct node_proto *proto; 304 struct node_icmp *icmp; 305 struct node_host *host; 306 struct node_os *os; 307 struct node_port *port; 308 struct node_uid *uid; 309 struct node_gid *gid; 310 struct node_state_opt *state_opt; 311 struct peer peer; 312 struct { 313 struct peer src, dst; 314 struct node_os *src_os; 315 } fromto; 316 struct pf_poolhashkey *hashkey; 317 struct { 318 struct node_host *host; 319 u_int8_t rt; 320 u_int8_t pool_opts; 321 sa_family_t af; 322 struct pf_poolhashkey *key; 323 } route; 324 struct redirection { 325 struct node_host *host; 326 struct range rport; 327 } *redirection; 328 struct { 329 int type; 330 struct pf_poolhashkey *key; 331 } pooltype; 332 struct { 333 int action; 334 struct node_state_opt *options; 335 } keep_state; 336 struct { 337 u_int8_t log; 338 u_int8_t quick; 339 } logquick; 340 struct node_queue *queue; 341 struct node_queue_opt queue_options; 342 struct node_queue_bw queue_bwspec; 343 struct node_qassign qassign; 344 struct filter_opts filter_opts; 345 struct antispoof_opts antispoof_opts; 346 struct queue_opts queue_opts; 347 struct scrub_opts scrub_opts; 348 struct table_opts table_opts; 349 struct node_hfsc_opts hfsc_opts; 350 } v; 351 int lineno; 352} YYSTYPE; 353 354#define PREPARE_ANCHOR_RULE(r, a) \ 355 do { \ 356 memset(&(r), 0, sizeof(r)); \ 357 if (strlcpy(r.anchorname, (a), \ 358 sizeof(r.anchorname)) >= \ 359 sizeof(r.anchorname)) { \ 360 yyerror("anchor name '%s' too long", \ 361 (a)); \ 362 YYERROR; \ 363 } \ 364 } while (0) 365 366%} 367 368%token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS 369%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 370%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 371%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 372%token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 373%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 374%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 375%token REQUIREORDER SYNPROXY FINGERPRINTS 376%token ANTISPOOF FOR 377%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT 378%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 379%token QUEUE PRIORITY QLIMIT 380%token LOAD 381%token TAGGED TAG 382%token <v.string> STRING 383%token <v.i> PORTBINARY 384%type <v.interface> interface if_list if_item_not if_item 385%type <v.number> number icmptype icmp6type uid gid 386%type <v.number> tos not yesno natpass 387%type <v.i> no dir log af fragcache 388%type <v.i> staticport unaryop 389%type <v.b> action nataction flags flag blockspec 390%type <v.range> port rport 391%type <v.hashkey> hashkey 392%type <v.pooltype> pooltype 393%type <v.proto> proto proto_list proto_item 394%type <v.icmp> icmpspec 395%type <v.icmp> icmp_list icmp_item 396%type <v.icmp> icmp6_list icmp6_item 397%type <v.fromto> fromto 398%type <v.peer> ipportspec from to 399%type <v.host> ipspec xhost host dynaddr host_list 400%type <v.host> redir_host_list redirspec 401%type <v.host> route_host route_host_list routespec 402%type <v.os> os xos os_list 403%type <v.port> portspec port_list port_item 404%type <v.uid> uids uid_list uid_item 405%type <v.gid> gids gid_list gid_item 406%type <v.route> route 407%type <v.redirection> redirection redirpool 408%type <v.string> label string tag 409%type <v.keep_state> keep 410%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 411%type <v.logquick> logquick 412%type <v.interface> antispoof_ifspc antispoof_iflst 413%type <v.qassign> qname 414%type <v.queue> qassign qassign_list qassign_item 415%type <v.queue_options> scheduler 416%type <v.number> cbqflags_list cbqflags_item 417%type <v.number> priqflags_list priqflags_item 418%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 419%type <v.queue_bwspec> bandwidth 420%type <v.filter_opts> filter_opts filter_opt filter_opts_l 421%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 422%type <v.queue_opts> queue_opts queue_opt queue_opts_l 423%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 424%type <v.table_opts> table_opts table_opt table_opts_l 425%% 426 427ruleset : /* empty */ 428 | ruleset '\n' 429 | ruleset option '\n' 430 | ruleset scrubrule '\n' 431 | ruleset natrule '\n' 432 | ruleset binatrule '\n' 433 | ruleset pfrule '\n' 434 | ruleset anchorrule '\n' 435 | ruleset loadrule '\n' 436 | ruleset altqif '\n' 437 | ruleset queuespec '\n' 438 | ruleset varset '\n' 439 | ruleset antispoof '\n' 440 | ruleset tabledef '\n' 441 | ruleset error '\n' { errors++; } 442 ; 443 444option : SET OPTIMIZATION STRING { 445 if (check_rulestate(PFCTL_STATE_OPTION)) 446 YYERROR; 447 if (pfctl_set_optimization(pf, $3) != 0) { 448 yyerror("unknown optimization %s", $3); 449 YYERROR; 450 } 451 } 452 | SET TIMEOUT timeout_spec 453 | SET TIMEOUT '{' timeout_list '}' 454 | SET LIMIT limit_spec 455 | SET LIMIT '{' limit_list '}' 456 | SET LOGINTERFACE STRING { 457 if (check_rulestate(PFCTL_STATE_OPTION)) 458 YYERROR; 459 if ((ifa_exists($3) == NULL) && strcmp($3, "none")) { 460 yyerror("interface %s doesn't exist", $3); 461 YYERROR; 462 } 463 if (pfctl_set_logif(pf, $3) != 0) { 464 yyerror("error setting loginterface %s", $3); 465 YYERROR; 466 } 467 } 468 | SET BLOCKPOLICY DROP { 469 if (pf->opts & PF_OPT_VERBOSE) 470 printf("set block-policy drop\n"); 471 if (check_rulestate(PFCTL_STATE_OPTION)) 472 YYERROR; 473 blockpolicy = PFRULE_DROP; 474 } 475 | SET BLOCKPOLICY RETURN { 476 if (pf->opts & PF_OPT_VERBOSE) 477 printf("set block-policy return\n"); 478 if (check_rulestate(PFCTL_STATE_OPTION)) 479 YYERROR; 480 blockpolicy = PFRULE_RETURN; 481 } 482 | SET REQUIREORDER yesno { 483 if (pf->opts & PF_OPT_VERBOSE) 484 printf("set require-order %s\n", 485 $3 == 1 ? "yes" : "no"); 486 require_order = $3; 487 } 488 | SET FINGERPRINTS STRING { 489 if (pf->opts & PF_OPT_VERBOSE) 490 printf("fingerprints %s\n", $3); 491 if (check_rulestate(PFCTL_STATE_OPTION)) 492 YYERROR; 493 if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) { 494 yyerror("error loading fingerprints %s", $3); 495 YYERROR; 496 } 497 } 498 ; 499 500string : string STRING { 501 if (asprintf(&$$, "%s %s", $1, $2) == -1) 502 err(1, "string: asprintf"); 503 free($1); 504 free($2); 505 } 506 | STRING 507 ; 508 509varset : STRING '=' string { 510 if (pf->opts & PF_OPT_VERBOSE) 511 printf("%s = \"%s\"\n", $1, $3); 512 if (symset($1, $3, 0) == -1) 513 err(1, "cannot store variable %s", $1); 514 } 515 ; 516 517anchorrule : ANCHOR string dir interface af proto fromto { 518 struct pf_rule r; 519 520 if (check_rulestate(PFCTL_STATE_FILTER)) 521 YYERROR; 522 523 PREPARE_ANCHOR_RULE(r, $2); 524 r.direction = $3; 525 r.af = $5; 526 527 decide_address_family($7.src.host, &r.af); 528 decide_address_family($7.dst.host, &r.af); 529 530 expand_rule(&r, $4, NULL, $6, $7.src_os, 531 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 532 0, 0, 0); 533 } 534 | NATANCHOR string interface af proto fromto { 535 struct pf_rule r; 536 537 if (check_rulestate(PFCTL_STATE_NAT)) 538 YYERROR; 539 540 PREPARE_ANCHOR_RULE(r, $2); 541 r.action = PF_NAT; 542 r.af = $4; 543 544 decide_address_family($6.src.host, &r.af); 545 decide_address_family($6.dst.host, &r.af); 546 547 expand_rule(&r, $3, NULL, $5, $6.src_os, 548 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 549 0, 0, 0); 550 } 551 | RDRANCHOR string interface af proto fromto { 552 struct pf_rule r; 553 554 if (check_rulestate(PFCTL_STATE_NAT)) 555 YYERROR; 556 557 PREPARE_ANCHOR_RULE(r, $2); 558 r.action = PF_RDR; 559 r.af = $4; 560 561 decide_address_family($6.src.host, &r.af); 562 decide_address_family($6.dst.host, &r.af); 563 564 if ($6.src.port != NULL) { 565 yyerror("source port parameter not supported" 566 " in rdr-anchor"); 567 YYERROR; 568 } 569 if ($6.dst.port != NULL) { 570 if ($6.dst.port->next != NULL) { 571 yyerror("destination port list " 572 "expansion not supported in " 573 "rdr-anchor"); 574 YYERROR; 575 } else if ($6.dst.port->op != PF_OP_EQ) { 576 yyerror("destination port operators" 577 " not supported in rdr-anchor"); 578 YYERROR; 579 } 580 r.dst.port[0] = $6.dst.port->port[0]; 581 r.dst.port[1] = $6.dst.port->port[1]; 582 r.dst.port_op = $6.dst.port->op; 583 } 584 585 expand_rule(&r, $3, NULL, $5, $6.src_os, 586 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 587 0, 0, 0); 588 } 589 | BINATANCHOR string interface af proto fromto { 590 struct pf_rule r; 591 592 if (check_rulestate(PFCTL_STATE_NAT)) 593 YYERROR; 594 595 PREPARE_ANCHOR_RULE(r, $2); 596 r.action = PF_BINAT; 597 r.af = $4; 598 if ($5 != NULL) { 599 if ($5->next != NULL) { 600 yyerror("proto list expansion" 601 " not supported in binat-anchor"); 602 YYERROR; 603 } 604 r.proto = $5->proto; 605 free($5); 606 } 607 608 if ($6.src.host != NULL || $6.src.port != NULL || 609 $6.dst.host != NULL || $6.dst.port != NULL) { 610 yyerror("fromto parameter not supported" 611 " in binat-anchor"); 612 YYERROR; 613 } 614 615 decide_address_family($6.src.host, &r.af); 616 decide_address_family($6.dst.host, &r.af); 617 618 pfctl_add_rule(pf, &r); 619 } 620 ; 621 622loadrule : LOAD ANCHOR string FROM string { 623 char *t; 624 struct loadanchors *loadanchor; 625 626 t = strsep(&$3, ":"); 627 if (*t == '\0' || *$3 == '\0') { 628 yyerror("anchor '%s' invalid\n", $3); 629 YYERROR; 630 } 631 if (strlen(t) >= PF_ANCHOR_NAME_SIZE) { 632 yyerror("anchorname %s too long, max %u\n", 633 t, PF_ANCHOR_NAME_SIZE - 1); 634 YYERROR; 635 } 636 if (strlen($3) >= PF_RULESET_NAME_SIZE) { 637 yyerror("rulesetname %s too long, max %u\n", 638 $3, PF_RULESET_NAME_SIZE - 1); 639 YYERROR; 640 } 641 642 loadanchor = calloc(1, sizeof(struct loadanchors)); 643 if (loadanchor == NULL) 644 err(1, "loadrule: calloc"); 645 if ((loadanchor->anchorname = strdup(t)) == NULL) 646 err(1, "loadrule: strdup"); 647 if ((loadanchor->rulesetname = strdup($3)) == NULL) 648 err(1, "loadrule: strdup"); 649 if ((loadanchor->filename = strdup($5)) == NULL) 650 err(1, "loadrule: strdup"); 651 652 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 653 entries); 654 655 free(t); /* not $3 */ 656 free($5); 657 }; 658 659scrubrule : SCRUB dir logquick interface af proto fromto scrub_opts 660 { 661 struct pf_rule r; 662 663 if (check_rulestate(PFCTL_STATE_SCRUB)) 664 YYERROR; 665 666 memset(&r, 0, sizeof(r)); 667 668 r.action = PF_SCRUB; 669 r.direction = $2; 670 671 r.log = $3.log; 672 if ($3.quick) { 673 yyerror("scrub rules do not support 'quick'"); 674 YYERROR; 675 } 676 677 if ($4) { 678 if ($4->not) { 679 yyerror("scrub rules do not support " 680 "'! <if>'"); 681 YYERROR; 682 } 683 } 684 r.af = $5; 685 if ($8.nodf) 686 r.rule_flag |= PFRULE_NODF; 687 if ($8.randomid) 688 r.rule_flag |= PFRULE_RANDOMID; 689 if ($8.reassemble_tcp) { 690 if (r.direction != PF_INOUT) { 691 yyerror("reassemble tcp rules can not " 692 "specify direction"); 693 YYERROR; 694 } 695 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 696 } 697 if ($8.minttl) 698 r.min_ttl = $8.minttl; 699 if ($8.maxmss) 700 r.max_mss = $8.maxmss; 701 if ($8.fragcache) 702 r.rule_flag |= $8.fragcache; 703 704 expand_rule(&r, $4, NULL, $6, $7.src_os, 705 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 706 NULL, NULL, NULL); 707 } 708 ; 709 710scrub_opts : { 711 bzero(&scrub_opts, sizeof scrub_opts); 712 } 713 scrub_opts_l 714 { $$ = scrub_opts; } 715 | /* empty */ { 716 bzero(&scrub_opts, sizeof scrub_opts); 717 $$ = scrub_opts; 718 } 719 ; 720 721scrub_opts_l : scrub_opts_l scrub_opt 722 | scrub_opt 723 ; 724 725scrub_opt : NODF { 726 if (scrub_opts.nodf) { 727 yyerror("no-df cannot be respecified"); 728 YYERROR; 729 } 730 scrub_opts.nodf = 1; 731 } 732 | MINTTL number { 733 if (scrub_opts.marker & SOM_MINTTL) { 734 yyerror("min-ttl cannot be respecified"); 735 YYERROR; 736 } 737 if ($2 > 255) { 738 yyerror("illegal min-ttl value %d", $2); 739 YYERROR; 740 } 741 scrub_opts.marker |= SOM_MINTTL; 742 scrub_opts.minttl = $2; 743 } 744 | MAXMSS number { 745 if (scrub_opts.marker & SOM_MAXMSS) { 746 yyerror("max-mss cannot be respecified"); 747 YYERROR; 748 } 749 if ($2 > 65535) { 750 yyerror("illegal max-mss value %d", $2); 751 YYERROR; 752 } 753 scrub_opts.marker |= SOM_MAXMSS; 754 scrub_opts.maxmss = $2; 755 } 756 | fragcache { 757 if (scrub_opts.marker & SOM_FRAGCACHE) { 758 yyerror("fragcache cannot be respecified"); 759 YYERROR; 760 } 761 scrub_opts.marker |= SOM_FRAGCACHE; 762 scrub_opts.fragcache = $1; 763 } 764 | REASSEMBLE STRING { 765 if (strcasecmp($2, "tcp") != 0) 766 YYERROR; 767 if (scrub_opts.reassemble_tcp) { 768 yyerror("reassemble tcp cannot be respecified"); 769 YYERROR; 770 } 771 scrub_opts.reassemble_tcp = 1; 772 } 773 | RANDOMID { 774 if (scrub_opts.randomid) { 775 yyerror("random-id cannot be respecified"); 776 YYERROR; 777 } 778 scrub_opts.randomid = 1; 779 } 780 ; 781 782fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 783 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 784 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 785 ; 786 787antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 788 struct pf_rule r; 789 struct node_host *h = NULL; 790 struct node_if *i, *j; 791 792 if (check_rulestate(PFCTL_STATE_FILTER)) 793 YYERROR; 794 795 for (i = $3; i; i = i->next) { 796 bzero(&r, sizeof(r)); 797 798 r.action = PF_DROP; 799 r.direction = PF_IN; 800 r.log = $2.log; 801 r.quick = $2.quick; 802 r.af = $4; 803 if (rule_label(&r, $5.label)) 804 YYERROR; 805 j = calloc(1, sizeof(struct node_if)); 806 if (j == NULL) 807 err(1, "antispoof: calloc"); 808 if (strlcpy(j->ifname, i->ifname, 809 sizeof(j->ifname)) >= sizeof(j->ifname)) { 810 free(j); 811 yyerror("interface name too long"); 812 YYERROR; 813 } 814 j->not = 1; 815 h = ifa_lookup(j->ifname, PFCTL_IFLOOKUP_NET); 816 817 expand_rule(&r, j, NULL, NULL, NULL, h, NULL, 818 NULL, NULL, NULL, NULL, NULL); 819 820 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 821 bzero(&r, sizeof(r)); 822 823 r.action = PF_DROP; 824 r.direction = PF_IN; 825 r.log = $2.log; 826 r.quick = $2.quick; 827 r.af = $4; 828 if (rule_label(&r, $5.label)) 829 YYERROR; 830 h = ifa_lookup(i->ifname, 831 PFCTL_IFLOOKUP_HOST); 832 expand_rule(&r, NULL, NULL, NULL, NULL, 833 h, NULL, NULL, NULL, NULL, NULL, 834 NULL); 835 } 836 } 837 free($5.label); 838 } 839 ; 840 841antispoof_ifspc : FOR if_item { $$ = $2; } 842 | FOR '{' antispoof_iflst '}' { $$ = $3; } 843 ; 844 845antispoof_iflst : if_item { $$ = $1; } 846 | antispoof_iflst comma if_item { 847 $1->tail->next = $3; 848 $1->tail = $3; 849 $$ = $1; 850 } 851 ; 852 853antispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 854 antispoof_opts_l 855 { $$ = antispoof_opts; } 856 | /* empty */ { 857 bzero(&antispoof_opts, sizeof antispoof_opts); 858 $$ = antispoof_opts; 859 } 860 ; 861 862antispoof_opts_l : antispoof_opts_l antispoof_opt 863 | antispoof_opt 864 ; 865 866antispoof_opt : label { 867 if (antispoof_opts.label) { 868 yyerror("label cannot be redefined"); 869 YYERROR; 870 } 871 antispoof_opts.label = $1; 872 } 873 ; 874 875not : '!' { $$ = 1; } 876 | /* empty */ { $$ = 0; } 877 878tabledef : TABLE '<' STRING '>' table_opts { 879 struct node_host *h, *nh; 880 struct node_tinit *ti, *nti; 881 882 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 883 yyerror("table name too long, max %d chars", 884 PF_TABLE_NAME_SIZE - 1); 885 YYERROR; 886 } 887 if (pf->loadopt & PFCTL_FLAG_TABLE) 888 if (process_tabledef($3, &$5)) 889 YYERROR; 890 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 891 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 892 if (ti->file) 893 free(ti->file); 894 for (h = ti->host; h != NULL; h = nh) { 895 nh = h->next; 896 free(h); 897 } 898 nti = SIMPLEQ_NEXT(ti, entries); 899 free (ti); 900 } 901 } 902 ; 903 904table_opts : { 905 bzero(&table_opts, sizeof table_opts); 906 SIMPLEQ_INIT(&table_opts.init_nodes); 907 } 908 table_opts_l 909 { $$ = table_opts; } 910 | /* empty */ 911 { 912 bzero(&table_opts, sizeof table_opts); 913 SIMPLEQ_INIT(&table_opts.init_nodes); 914 $$ = table_opts; 915 } 916 ; 917 918table_opts_l : table_opts_l table_opt 919 | table_opt 920 ; 921 922table_opt : STRING { 923 if (!strcmp($1, "const")) 924 table_opts.flags |= PFR_TFLAG_CONST; 925 else if (!strcmp($1, "persist")) 926 table_opts.flags |= PFR_TFLAG_PERSIST; 927 else 928 YYERROR; 929 } 930 | '{' '}' { table_opts.init_addr = 1; } 931 | '{' host_list '}' { 932 struct node_host *n; 933 struct node_tinit *ti; 934 935 for (n = $2; n != NULL; n = n->next) { 936 switch(n->addr.type) { 937 case PF_ADDR_ADDRMASK: 938 continue; /* ok */ 939 case PF_ADDR_DYNIFTL: 940 yyerror("dynamic addresses are not " 941 "permitted inside tables"); 942 break; 943 case PF_ADDR_TABLE: 944 yyerror("tables cannot contain tables"); 945 break; 946 case PF_ADDR_NOROUTE: 947 yyerror("\"no-route\" is not permitted " 948 "inside tables"); 949 break; 950 default: 951 yyerror("unknown address type %d", 952 n->addr.type); 953 } 954 YYERROR; 955 } 956 if (!(ti = calloc(1, sizeof(*ti)))) 957 err(1, "table_opt: calloc"); 958 ti->host = $2; 959 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 960 entries); 961 table_opts.init_addr = 1; 962 } 963 | FILENAME STRING { 964 struct node_tinit *ti; 965 966 if (!(ti = calloc(1, sizeof(*ti)))) 967 err(1, "table_opt: calloc"); 968 ti->file = $2; 969 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 970 entries); 971 table_opts.init_addr = 1; 972 } 973 ; 974 975altqif : ALTQ interface queue_opts QUEUE qassign { 976 struct pf_altq a; 977 978 if (check_rulestate(PFCTL_STATE_QUEUE)) 979 YYERROR; 980 981 memset(&a, 0, sizeof(a)); 982 if ($3.scheduler.qtype == ALTQT_NONE) { 983 yyerror("no scheduler specified!"); 984 YYERROR; 985 } 986 a.scheduler = $3.scheduler.qtype; 987 a.qlimit = $3.qlimit; 988 a.tbrsize = $3.tbrsize; 989 if ($5 == NULL) { 990 yyerror("no child queues specified"); 991 YYERROR; 992 } 993 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 994 &$3.scheduler)) 995 YYERROR; 996 } 997 ; 998 999queuespec : QUEUE STRING interface queue_opts qassign { 1000 struct pf_altq a; 1001 1002 if (check_rulestate(PFCTL_STATE_QUEUE)) 1003 YYERROR; 1004 1005 memset(&a, 0, sizeof(a)); 1006 1007 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1008 sizeof(a.qname)) { 1009 yyerror("queue name too long (max " 1010 "%d chars)", PF_QNAME_SIZE-1); 1011 YYERROR; 1012 } 1013 if ($4.tbrsize) { 1014 yyerror("cannot specify tbrsize for queue"); 1015 YYERROR; 1016 } 1017 if ($4.priority > 255) { 1018 yyerror("priority out of range: max 255"); 1019 YYERROR; 1020 } 1021 a.priority = $4.priority; 1022 a.qlimit = $4.qlimit; 1023 a.scheduler = $4.scheduler.qtype; 1024 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1025 &$4.scheduler)) { 1026 yyerror("errors in queue definition"); 1027 YYERROR; 1028 } 1029 } 1030 ; 1031 1032queue_opts : { 1033 bzero(&queue_opts, sizeof queue_opts); 1034 queue_opts.priority = DEFAULT_PRIORITY; 1035 queue_opts.qlimit = DEFAULT_QLIMIT; 1036 queue_opts.scheduler.qtype = ALTQT_NONE; 1037 queue_opts.queue_bwspec.bw_percent = 100; 1038 } 1039 queue_opts_l 1040 { $$ = queue_opts; } 1041 | /* empty */ { 1042 bzero(&queue_opts, sizeof queue_opts); 1043 queue_opts.priority = DEFAULT_PRIORITY; 1044 queue_opts.qlimit = DEFAULT_QLIMIT; 1045 queue_opts.scheduler.qtype = ALTQT_NONE; 1046 queue_opts.queue_bwspec.bw_percent = 100; 1047 $$ = queue_opts; 1048 } 1049 ; 1050 1051queue_opts_l : queue_opts_l queue_opt 1052 | queue_opt 1053 ; 1054 1055queue_opt : BANDWIDTH bandwidth { 1056 if (queue_opts.marker & QOM_BWSPEC) { 1057 yyerror("bandwidth cannot be respecified"); 1058 YYERROR; 1059 } 1060 queue_opts.marker |= QOM_BWSPEC; 1061 queue_opts.queue_bwspec = $2; 1062 } 1063 | PRIORITY number { 1064 if (queue_opts.marker & QOM_PRIORITY) { 1065 yyerror("priority cannot be respecified"); 1066 YYERROR; 1067 } 1068 if ($2 > 255) { 1069 yyerror("priority out of range: max 255"); 1070 YYERROR; 1071 } 1072 queue_opts.marker |= QOM_PRIORITY; 1073 queue_opts.priority = $2; 1074 } 1075 | QLIMIT number { 1076 if (queue_opts.marker & QOM_QLIMIT) { 1077 yyerror("qlimit cannot be respecified"); 1078 YYERROR; 1079 } 1080 if ($2 > 65535) { 1081 yyerror("qlimit out of range: max 65535"); 1082 YYERROR; 1083 } 1084 queue_opts.marker |= QOM_QLIMIT; 1085 queue_opts.qlimit = $2; 1086 } 1087 | scheduler { 1088 if (queue_opts.marker & QOM_SCHEDULER) { 1089 yyerror("scheduler cannot be respecified"); 1090 YYERROR; 1091 } 1092 queue_opts.marker |= QOM_SCHEDULER; 1093 queue_opts.scheduler = $1; 1094 } 1095 | TBRSIZE number { 1096 if (queue_opts.marker & QOM_TBRSIZE) { 1097 yyerror("tbrsize cannot be respecified"); 1098 YYERROR; 1099 } 1100 if ($2 > 65535) { 1101 yyerror("tbrsize too big: max 65535"); 1102 YYERROR; 1103 } 1104 queue_opts.marker |= QOM_TBRSIZE; 1105 queue_opts.tbrsize = $2; 1106 } 1107 ; 1108 1109bandwidth : STRING { 1110 double bps; 1111 char *cp; 1112 1113 $$.bw_percent = 0; 1114 1115 bps = strtod($1, &cp); 1116 if (cp != NULL) { 1117 if (!strcmp(cp, "b")) 1118 ; /* nothing */ 1119 else if (!strcmp(cp, "Kb")) 1120 bps *= 1000; 1121 else if (!strcmp(cp, "Mb")) 1122 bps *= 1000 * 1000; 1123 else if (!strcmp(cp, "Gb")) 1124 bps *= 1000 * 1000 * 1000; 1125 else if (!strcmp(cp, "%")) { 1126 if (bps < 0 || bps > 100) { 1127 yyerror("bandwidth spec " 1128 "out of range"); 1129 YYERROR; 1130 } 1131 $$.bw_percent = bps; 1132 bps = 0; 1133 } else { 1134 yyerror("unknown unit %s", cp); 1135 YYERROR; 1136 } 1137 } 1138 $$.bw_absolute = (u_int32_t)bps; 1139 } 1140 1141scheduler : CBQ { 1142 $$.qtype = ALTQT_CBQ; 1143 $$.data.cbq_opts.flags = 0; 1144 } 1145 | CBQ '(' cbqflags_list ')' { 1146 $$.qtype = ALTQT_CBQ; 1147 $$.data.cbq_opts.flags = $3; 1148 } 1149 | PRIQ { 1150 $$.qtype = ALTQT_PRIQ; 1151 $$.data.priq_opts.flags = 0; 1152 } 1153 | PRIQ '(' priqflags_list ')' { 1154 $$.qtype = ALTQT_PRIQ; 1155 $$.data.priq_opts.flags = $3; 1156 } 1157 | HFSC { 1158 $$.qtype = ALTQT_HFSC; 1159 bzero(&$$.data.hfsc_opts, 1160 sizeof(struct node_hfsc_opts)); 1161 } 1162 | HFSC '(' hfsc_opts ')' { 1163 $$.qtype = ALTQT_HFSC; 1164 $$.data.hfsc_opts = $3; 1165 } 1166 ; 1167 1168cbqflags_list : cbqflags_item { $$ |= $1; } 1169 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1170 ; 1171 1172cbqflags_item : STRING { 1173 if (!strcmp($1, "default")) 1174 $$ = CBQCLF_DEFCLASS; 1175 else if (!strcmp($1, "borrow")) 1176 $$ = CBQCLF_BORROW; 1177 else if (!strcmp($1, "red")) 1178 $$ = CBQCLF_RED; 1179 else if (!strcmp($1, "ecn")) 1180 $$ = CBQCLF_RED|CBQCLF_ECN; 1181 else if (!strcmp($1, "rio")) 1182 $$ = CBQCLF_RIO; 1183 else { 1184 yyerror("unknown cbq flag \"%s\"", $1); 1185 YYERROR; 1186 } 1187 } 1188 ; 1189 1190priqflags_list : priqflags_item { $$ |= $1; } 1191 | priqflags_list comma priqflags_item { $$ |= $3; } 1192 ; 1193 1194priqflags_item : STRING { 1195 if (!strcmp($1, "default")) 1196 $$ = PRCF_DEFAULTCLASS; 1197 else if (!strcmp($1, "red")) 1198 $$ = PRCF_RED; 1199 else if (!strcmp($1, "ecn")) 1200 $$ = PRCF_RED|PRCF_ECN; 1201 else if (!strcmp($1, "rio")) 1202 $$ = PRCF_RIO; 1203 else { 1204 yyerror("unknown priq flag \"%s\"", $1); 1205 YYERROR; 1206 } 1207 } 1208 ; 1209 1210hfsc_opts : { 1211 bzero(&hfsc_opts, 1212 sizeof(struct node_hfsc_opts)); 1213 } 1214 hfscopts_list { 1215 $$ = hfsc_opts; 1216 } 1217 ; 1218 1219hfscopts_list : hfscopts_item 1220 | hfscopts_list comma hfscopts_item 1221 ; 1222 1223hfscopts_item : LINKSHARE bandwidth { 1224 if (hfsc_opts.linkshare.used) { 1225 yyerror("linkshare already specified"); 1226 YYERROR; 1227 } 1228 hfsc_opts.linkshare.m2 = $2; 1229 hfsc_opts.linkshare.used = 1; 1230 } 1231 | LINKSHARE '(' bandwidth number bandwidth ')' { 1232 if (hfsc_opts.linkshare.used) { 1233 yyerror("linkshare already specified"); 1234 YYERROR; 1235 } 1236 hfsc_opts.linkshare.m1 = $3; 1237 hfsc_opts.linkshare.d = $4; 1238 hfsc_opts.linkshare.m2 = $5; 1239 hfsc_opts.linkshare.used = 1; 1240 } 1241 | REALTIME bandwidth { 1242 if (hfsc_opts.realtime.used) { 1243 yyerror("realtime already specified"); 1244 YYERROR; 1245 } 1246 hfsc_opts.realtime.m2 = $2; 1247 hfsc_opts.realtime.used = 1; 1248 } 1249 | REALTIME '(' bandwidth number bandwidth ')' { 1250 if (hfsc_opts.realtime.used) { 1251 yyerror("realtime already specified"); 1252 YYERROR; 1253 } 1254 hfsc_opts.realtime.m1 = $3; 1255 hfsc_opts.realtime.d = $4; 1256 hfsc_opts.realtime.m2 = $5; 1257 hfsc_opts.realtime.used = 1; 1258 } 1259 | UPPERLIMIT bandwidth { 1260 if (hfsc_opts.upperlimit.used) { 1261 yyerror("upperlimit already specified"); 1262 YYERROR; 1263 } 1264 hfsc_opts.upperlimit.m2 = $2; 1265 hfsc_opts.upperlimit.used = 1; 1266 } 1267 | UPPERLIMIT '(' bandwidth number bandwidth ')' { 1268 if (hfsc_opts.upperlimit.used) { 1269 yyerror("upperlimit already specified"); 1270 YYERROR; 1271 } 1272 hfsc_opts.upperlimit.m1 = $3; 1273 hfsc_opts.upperlimit.d = $4; 1274 hfsc_opts.upperlimit.m2 = $5; 1275 hfsc_opts.upperlimit.used = 1; 1276 } 1277 | STRING { 1278 if (!strcmp($1, "default")) 1279 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1280 else if (!strcmp($1, "red")) 1281 hfsc_opts.flags |= HFCF_RED; 1282 else if (!strcmp($1, "ecn")) 1283 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1284 else if (!strcmp($1, "rio")) 1285 hfsc_opts.flags |= HFCF_RIO; 1286 else { 1287 yyerror("unknown hfsc flag \"%s\"", $1); 1288 YYERROR; 1289 } 1290 } 1291 ; 1292 1293qassign : /* empty */ { $$ = NULL; } 1294 | qassign_item { $$ = $1; } 1295 | '{' qassign_list '}' { $$ = $2; } 1296 ; 1297 1298qassign_list : qassign_item { $$ = $1; } 1299 | qassign_list comma qassign_item { 1300 $1->tail->next = $3; 1301 $1->tail = $3; 1302 $$ = $1; 1303 } 1304 ; 1305 1306qassign_item : STRING { 1307 $$ = calloc(1, sizeof(struct node_queue)); 1308 if ($$ == NULL) 1309 err(1, "qassign_item: calloc"); 1310 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1311 sizeof($$->queue)) { 1312 free($$); 1313 yyerror("queue name '%s' too long (max " 1314 "%d chars)", $1, sizeof($$->queue)-1); 1315 YYERROR; 1316 } 1317 $$->next = NULL; 1318 $$->tail = $$; 1319 } 1320 ; 1321 1322pfrule : action dir logquick interface route af proto fromto 1323 filter_opts 1324 { 1325 struct pf_rule r; 1326 struct node_state_opt *o; 1327 struct node_proto *proto; 1328 1329 if (check_rulestate(PFCTL_STATE_FILTER)) 1330 YYERROR; 1331 1332 memset(&r, 0, sizeof(r)); 1333 1334 r.action = $1.b1; 1335 switch ($1.b2) { 1336 case PFRULE_RETURNRST: 1337 r.rule_flag |= PFRULE_RETURNRST; 1338 r.return_ttl = $1.w; 1339 break; 1340 case PFRULE_RETURNICMP: 1341 r.rule_flag |= PFRULE_RETURNICMP; 1342 r.return_icmp = $1.w; 1343 r.return_icmp6 = $1.w2; 1344 break; 1345 case PFRULE_RETURN: 1346 r.rule_flag |= PFRULE_RETURN; 1347 r.return_icmp = $1.w; 1348 r.return_icmp6 = $1.w2; 1349 break; 1350 } 1351 r.direction = $2; 1352 r.log = $3.log; 1353 r.quick = $3.quick; 1354 1355 r.af = $6; 1356 if ($9.tag) 1357 if (strlcpy(r.tagname, $9.tag, 1358 PF_TAG_NAME_SIZE) > PF_TAG_NAME_SIZE) { 1359 yyerror("tag too long, max %u chars", 1360 PF_TAG_NAME_SIZE - 1); 1361 YYERROR; 1362 } 1363 if ($9.match_tag) 1364 if (strlcpy(r.match_tagname, $9.match_tag, 1365 PF_TAG_NAME_SIZE) > PF_TAG_NAME_SIZE) { 1366 yyerror("tag too long, max %u chars", 1367 PF_TAG_NAME_SIZE - 1); 1368 YYERROR; 1369 } 1370 r.match_tag_not = $9.match_tag_not; 1371 r.flags = $9.flags.b1; 1372 r.flagset = $9.flags.b2; 1373 if (rule_label(&r, $9.label)) 1374 YYERROR; 1375 free($9.label); 1376 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1377 for (proto = $7; proto != NULL && 1378 proto->proto != IPPROTO_TCP; 1379 proto = proto->next) 1380 ; /* nothing */ 1381 if (proto == NULL && $7 != NULL) { 1382 if ($9.flags.b1 || $9.flags.b2) 1383 yyerror( 1384 "flags only apply to tcp"); 1385 if ($8.src_os) 1386 yyerror( 1387 "OS fingerprinting only " 1388 "apply to tcp"); 1389 YYERROR; 1390 } 1391#if 0 1392 if (($9.flags.b1 & parse_flags("S")) == 0 && 1393 $8.src_os) { 1394 yyerror("OS fingerprinting requires " 1395 "the SYN TCP flag (flags S/SA)"); 1396 YYERROR; 1397 } 1398#endif 1399 } 1400 1401 r.tos = $9.tos; 1402 r.keep_state = $9.keep.action; 1403 o = $9.keep.options; 1404 while (o) { 1405 struct node_state_opt *p = o; 1406 1407 switch (o->type) { 1408 case PF_STATE_OPT_MAX: 1409 if (r.max_states) { 1410 yyerror("state option 'max' " 1411 "multiple definitions"); 1412 YYERROR; 1413 } 1414 r.max_states = o->data.max_states; 1415 break; 1416 case PF_STATE_OPT_TIMEOUT: 1417 if (r.timeout[o->data.timeout.number]) { 1418 yyerror("state timeout %s " 1419 "multiple definitions", 1420 pf_timeouts[o->data. 1421 timeout.number].name); 1422 YYERROR; 1423 } 1424 r.timeout[o->data.timeout.number] = 1425 o->data.timeout.seconds; 1426 } 1427 o = o->next; 1428 free(p); 1429 } 1430 1431 if ($9.fragment) 1432 r.rule_flag |= PFRULE_FRAGMENT; 1433 r.allow_opts = $9.allowopts; 1434 1435 decide_address_family($8.src.host, &r.af); 1436 decide_address_family($8.dst.host, &r.af); 1437 1438 if ($5.rt) { 1439 if (!r.direction) { 1440 yyerror("direction must be explicit " 1441 "with rules that specify routing"); 1442 YYERROR; 1443 } 1444 r.rt = $5.rt; 1445 r.rpool.opts = $5.pool_opts; 1446 if ($5.key != NULL) 1447 memcpy(&r.rpool.key, $5.key, 1448 sizeof(struct pf_poolhashkey)); 1449 } 1450 if (r.rt && r.rt != PF_FASTROUTE) { 1451 decide_address_family($5.host, &r.af); 1452 remove_invalid_hosts(&$5.host, &r.af); 1453 if ($5.host == NULL) { 1454 yyerror("no routing address with " 1455 "matching address family found."); 1456 YYERROR; 1457 } 1458 if (r.rpool.opts == PF_POOL_NONE && ( 1459 $5.host->next != NULL || 1460 $5.host->addr.type == PF_ADDR_TABLE)) 1461 r.rpool.opts = PF_POOL_ROUNDROBIN; 1462 if (r.rpool.opts != PF_POOL_ROUNDROBIN) 1463 if (disallow_table($5.host, "tables " 1464 "are only supported in round-robin " 1465 "routing pools")) 1466 YYERROR; 1467 if ($5.host->next != NULL) { 1468 if (r.rpool.opts != 1469 PF_POOL_ROUNDROBIN) { 1470 yyerror("r.rpool.opts must " 1471 "be PF_POOL_ROUNDROBIN"); 1472 YYERROR; 1473 } 1474 } 1475 } 1476 if ($9.queues.qname != NULL) { 1477 if (strlcpy(r.qname, $9.queues.qname, 1478 sizeof(r.qname)) >= sizeof(r.qname)) { 1479 yyerror("rule qname too long (max " 1480 "%d chars)", sizeof(r.qname)-1); 1481 YYERROR; 1482 } 1483 free($9.queues.qname); 1484 } 1485 if ($9.queues.pqname != NULL) { 1486 if (strlcpy(r.pqname, $9.queues.pqname, 1487 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1488 yyerror("rule pqname too long (max " 1489 "%d chars)", sizeof(r.pqname)-1); 1490 YYERROR; 1491 } 1492 free($9.queues.pqname); 1493 } 1494 1495 expand_rule(&r, $4, $5.host, $7, $8.src_os, 1496 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1497 $9.uid, $9.gid, $9.icmpspec); 1498 } 1499 ; 1500 1501filter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1502 filter_opts_l 1503 { $$ = filter_opts; } 1504 | /* empty */ { 1505 bzero(&filter_opts, sizeof filter_opts); 1506 $$ = filter_opts; 1507 } 1508 ; 1509 1510filter_opts_l : filter_opts_l filter_opt 1511 | filter_opt 1512 ; 1513 1514filter_opt : USER uids { 1515 if (filter_opts.uid) 1516 $2->tail->next = filter_opts.uid; 1517 filter_opts.uid = $2; 1518 } 1519 | GROUP gids { 1520 if (filter_opts.gid) 1521 $2->tail->next = filter_opts.gid; 1522 filter_opts.gid = $2; 1523 } 1524 | flags { 1525 if (filter_opts.marker & FOM_FLAGS) { 1526 yyerror("flags cannot be redefined"); 1527 YYERROR; 1528 } 1529 filter_opts.marker |= FOM_FLAGS; 1530 filter_opts.flags.b1 |= $1.b1; 1531 filter_opts.flags.b2 |= $1.b2; 1532 filter_opts.flags.w |= $1.w; 1533 filter_opts.flags.w2 |= $1.w2; 1534 } 1535 | icmpspec { 1536 if (filter_opts.marker & FOM_ICMP) { 1537 yyerror("icmp-type cannot be redefined"); 1538 YYERROR; 1539 } 1540 filter_opts.marker |= FOM_ICMP; 1541 filter_opts.icmpspec = $1; 1542 } 1543 | tos { 1544 if (filter_opts.marker & FOM_TOS) { 1545 yyerror("tos cannot be redefined"); 1546 YYERROR; 1547 } 1548 filter_opts.marker |= FOM_TOS; 1549 filter_opts.tos = $1; 1550 } 1551 | keep { 1552 if (filter_opts.marker & FOM_KEEP) { 1553 yyerror("modulate or keep cannot be redefined"); 1554 YYERROR; 1555 } 1556 filter_opts.marker |= FOM_KEEP; 1557 filter_opts.keep.action = $1.action; 1558 filter_opts.keep.options = $1.options; 1559 } 1560 | FRAGMENT { 1561 filter_opts.fragment = 1; 1562 } 1563 | ALLOWOPTS { 1564 filter_opts.allowopts = 1; 1565 } 1566 | label { 1567 if (filter_opts.label) { 1568 yyerror("label cannot be redefined"); 1569 YYERROR; 1570 } 1571 filter_opts.label = $1; 1572 } 1573 | qname { 1574 if (filter_opts.queues.qname) { 1575 yyerror("queue cannot be redefined"); 1576 YYERROR; 1577 } 1578 filter_opts.queues = $1; 1579 } 1580 | TAG string { 1581 filter_opts.tag = $2; 1582 } 1583 | not TAGGED string { 1584 filter_opts.match_tag = $3; 1585 filter_opts.match_tag_not = $1; 1586 } 1587 ; 1588 1589action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 1590 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 1591 ; 1592 1593blockspec : /* empty */ { 1594 $$.b2 = blockpolicy; 1595 $$.w = returnicmpdefault; 1596 $$.w2 = returnicmp6default; 1597 } 1598 | DROP { 1599 $$.b2 = PFRULE_DROP; 1600 $$.w = 0; 1601 $$.w2 = 0; 1602 } 1603 | RETURNRST { 1604 $$.b2 = PFRULE_RETURNRST; 1605 $$.w = 0; 1606 $$.w2 = 0; 1607 } 1608 | RETURNRST '(' TTL number ')' { 1609 if ($4 > 255) { 1610 yyerror("illegal ttl value %d", $4); 1611 YYERROR; 1612 } 1613 $$.b2 = PFRULE_RETURNRST; 1614 $$.w = $4; 1615 $$.w2 = 0; 1616 } 1617 | RETURNICMP { 1618 $$.b2 = PFRULE_RETURNICMP; 1619 $$.w = returnicmpdefault; 1620 $$.w2 = returnicmp6default; 1621 } 1622 | RETURNICMP6 { 1623 $$.b2 = PFRULE_RETURNICMP; 1624 $$.w = returnicmpdefault; 1625 $$.w2 = returnicmp6default; 1626 } 1627 | RETURNICMP '(' STRING ')' { 1628 $$.b2 = PFRULE_RETURNICMP; 1629 if (!($$.w = parseicmpspec($3, AF_INET))) 1630 YYERROR; 1631 $$.w2 = returnicmp6default; 1632 } 1633 | RETURNICMP6 '(' STRING ')' { 1634 $$.b2 = PFRULE_RETURNICMP; 1635 $$.w = returnicmpdefault; 1636 if (!($$.w2 = parseicmpspec($3, AF_INET6))) 1637 YYERROR; 1638 } 1639 | RETURNICMP '(' STRING comma STRING ')' { 1640 $$.b2 = PFRULE_RETURNICMP; 1641 if (!($$.w = parseicmpspec($3, AF_INET))) 1642 YYERROR; 1643 if (!($$.w2 = parseicmpspec($5, AF_INET6))) 1644 YYERROR; 1645 } 1646 | RETURN { 1647 $$.b2 = PFRULE_RETURN; 1648 $$.w = returnicmpdefault; 1649 $$.w2 = returnicmp6default; 1650 } 1651 ; 1652 1653dir : /* empty */ { $$ = 0; } 1654 | IN { $$ = PF_IN; } 1655 | OUT { $$ = PF_OUT; } 1656 ; 1657 1658logquick : /* empty */ { $$.log = 0; $$.quick = 0; } 1659 | log { $$.log = $1; $$.quick = 0; } 1660 | QUICK { $$.log = 0; $$.quick = 1; } 1661 | log QUICK { $$.log = $1; $$.quick = 1; } 1662 | QUICK log { $$.log = $2; $$.quick = 1; } 1663 ; 1664 1665log : LOG { $$ = 1; } 1666 | LOGALL { $$ = 2; } 1667 ; 1668 1669interface : /* empty */ { $$ = NULL; } 1670 | ON if_item_not { $$ = $2; } 1671 | ON '{' if_list '}' { $$ = $3; } 1672 ; 1673 1674if_list : if_item_not { $$ = $1; } 1675 | if_list comma if_item_not { 1676 $1->tail->next = $3; 1677 $1->tail = $3; 1678 $$ = $1; 1679 } 1680 ; 1681 1682if_item_not : not if_item { $$ = $2; $$->not = $1; } 1683 ; 1684 1685if_item : STRING { 1686 struct node_host *n; 1687 1688 if ((n = ifa_exists($1)) == NULL) { 1689 yyerror("unknown interface %s", $1); 1690 YYERROR; 1691 } 1692 $$ = calloc(1, sizeof(struct node_if)); 1693 if ($$ == NULL) 1694 err(1, "if_item: calloc"); 1695 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 1696 sizeof($$->ifname)) { 1697 free($$); 1698 yyerror("interface name too long"); 1699 YYERROR; 1700 } 1701 $$->ifa_flags = n->ifa_flags; 1702 $$->not = 0; 1703 $$->next = NULL; 1704 $$->tail = $$; 1705 } 1706 ; 1707 1708af : /* empty */ { $$ = 0; } 1709 | INET { $$ = AF_INET; } 1710 | INET6 { $$ = AF_INET6; } 1711 1712proto : /* empty */ { $$ = NULL; } 1713 | PROTO proto_item { $$ = $2; } 1714 | PROTO '{' proto_list '}' { $$ = $3; } 1715 ; 1716 1717proto_list : proto_item { $$ = $1; } 1718 | proto_list comma proto_item { 1719 $1->tail->next = $3; 1720 $1->tail = $3; 1721 $$ = $1; 1722 } 1723 ; 1724 1725proto_item : STRING { 1726 u_int8_t pr; 1727 u_long ulval; 1728 1729 if (atoul($1, &ulval) == 0) { 1730 if (ulval > 255) { 1731 yyerror("protocol outside range"); 1732 YYERROR; 1733 } 1734 pr = (u_int8_t)ulval; 1735 } else { 1736 struct protoent *p; 1737 1738 p = getprotobyname($1); 1739 if (p == NULL) { 1740 yyerror("unknown protocol %s", $1); 1741 YYERROR; 1742 } 1743 pr = p->p_proto; 1744 } 1745 if (pr == 0) { 1746 yyerror("proto 0 cannot be used"); 1747 YYERROR; 1748 } 1749 $$ = calloc(1, sizeof(struct node_proto)); 1750 if ($$ == NULL) 1751 err(1, "proto_item: calloc"); 1752 $$->proto = pr; 1753 $$->next = NULL; 1754 $$->tail = $$; 1755 } 1756 ; 1757 1758fromto : ALL { 1759 $$.src.host = NULL; 1760 $$.src.port = NULL; 1761 $$.dst.host = NULL; 1762 $$.dst.port = NULL; 1763 $$.src_os = NULL; 1764 } 1765 | from os to { 1766 $$.src = $1; 1767 $$.src_os = $2; 1768 $$.dst = $3; 1769 } 1770 ; 1771 1772os : /* empty */ { $$ = NULL; } 1773 | OS xos { $$ = $2; } 1774 | OS '{' os_list '}' { $$ = $3; } 1775 ; 1776 1777xos : STRING { 1778 $$ = calloc(1, sizeof(struct node_os)); 1779 if ($$ == NULL) 1780 err(1, "os: calloc"); 1781 $$->os = $1; 1782 $$->tail = $$; 1783 } 1784 ; 1785 1786os_list : xos { $$ = $1; } 1787 | os_list comma xos { 1788 $1->tail->next = $3; 1789 $1->tail = $3; 1790 $$ = $1; 1791 } 1792 ; 1793 1794from : /* empty */ { 1795 $$.host = NULL; 1796 $$.port = NULL; 1797 } 1798 | FROM ipportspec { 1799 $$ = $2; 1800 } 1801 ; 1802 1803to : /* empty */ { 1804 $$.host = NULL; 1805 $$.port = NULL; 1806 } 1807 | TO ipportspec { 1808 $$ = $2; 1809 } 1810 ; 1811 1812ipportspec : ipspec { 1813 $$.host = $1; 1814 $$.port = NULL; 1815 } 1816 | ipspec PORT portspec { 1817 $$.host = $1; 1818 $$.port = $3; 1819 } 1820 | PORT portspec { 1821 $$.host = NULL; 1822 $$.port = $2; 1823 } 1824 ; 1825 1826ipspec : ANY { $$ = NULL; } 1827 | xhost { $$ = $1; } 1828 | '{' host_list '}' { $$ = $2; } 1829 ; 1830 1831host_list : xhost { $$ = $1; } 1832 | host_list comma xhost { 1833 if ($3 == NULL) 1834 $$ = $1; 1835 else if ($1 == NULL) 1836 $$ = $3; 1837 else { 1838 $1->tail->next = $3; 1839 $1->tail = $3->tail; 1840 $$ = $1; 1841 } 1842 } 1843 ; 1844 1845xhost : not host { 1846 struct node_host *n; 1847 1848 for (n = $2; n != NULL; n = n->next) 1849 n->not = $1; 1850 $$ = $2; 1851 } 1852 | NOROUTE { 1853 $$ = calloc(1, sizeof(struct node_host)); 1854 if ($$ == NULL) 1855 err(1, "xhost: calloc"); 1856 $$->addr.type = PF_ADDR_NOROUTE; 1857 $$->next = NULL; 1858 $$->tail = $$; 1859 } 1860 ; 1861 1862host : STRING { 1863 if (($$ = host($1)) == NULL) { 1864 /* error. "any" is handled elsewhere */ 1865 yyerror("could not parse host specification"); 1866 YYERROR; 1867 } 1868 1869 } 1870 | STRING '/' number { 1871 char *buf; 1872 1873 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 1874 err(1, "host: asprintf"); 1875 if (($$ = host(buf)) == NULL) { 1876 /* error. "any" is handled elsewhere */ 1877 free(buf); 1878 yyerror("could not parse host specification"); 1879 YYERROR; 1880 } 1881 free(buf); 1882 } 1883 | dynaddr 1884 | dynaddr '/' number { 1885 struct node_host *n; 1886 1887 $$ = $1; 1888 for (n = $1; n != NULL; n = n->next) 1889 set_ipmask(n, $3); 1890 } 1891 | '<' STRING '>' { 1892 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 1893 yyerror("table name '%s' too long"); 1894 YYERROR; 1895 } 1896 $$ = calloc(1, sizeof(struct node_host)); 1897 if ($$ == NULL) 1898 err(1, "host: calloc"); 1899 $$->addr.type = PF_ADDR_TABLE; 1900 if (strlcpy($$->addr.v.tblname, $2, 1901 sizeof($$->addr.v.tblname)) >= 1902 sizeof($$->addr.v.tblname)) 1903 errx(1, "host: strlcpy"); 1904 $$->next = NULL; 1905 $$->tail = $$; 1906 } 1907 ; 1908 1909number : STRING { 1910 u_long ulval; 1911 1912 if (atoul($1, &ulval) == -1) { 1913 yyerror("%s is not a number", $1); 1914 YYERROR; 1915 } else 1916 $$ = ulval; 1917 } 1918 ; 1919 1920dynaddr : '(' STRING ')' { 1921 if (ifa_exists($2) == NULL) { 1922 yyerror("interface %s does not exist", $2); 1923 YYERROR; 1924 } 1925 $$ = calloc(1, sizeof(struct node_host)); 1926 if ($$ == NULL) 1927 err(1, "address: calloc"); 1928 $$->af = 0; 1929 set_ipmask($$, 128); 1930 $$->addr.type = PF_ADDR_DYNIFTL; 1931 if (strlcpy($$->addr.v.ifname, $2, 1932 sizeof($$->addr.v.ifname)) >= 1933 sizeof($$->addr.v.ifname)) { 1934 free($$); 1935 yyerror("interface name too long"); 1936 YYERROR; 1937 } 1938 $$->next = NULL; 1939 $$->tail = $$; 1940 } 1941 ; 1942 1943portspec : port_item { $$ = $1; } 1944 | '{' port_list '}' { $$ = $2; } 1945 ; 1946 1947port_list : port_item { $$ = $1; } 1948 | port_list comma port_item { 1949 $1->tail->next = $3; 1950 $1->tail = $3; 1951 $$ = $1; 1952 } 1953 ; 1954 1955port_item : port { 1956 $$ = calloc(1, sizeof(struct node_port)); 1957 if ($$ == NULL) 1958 err(1, "port_item: calloc"); 1959 $$->port[0] = $1.a; 1960 $$->port[1] = $1.b; 1961 if ($1.t) 1962 $$->op = PF_OP_RRG; 1963 else 1964 $$->op = PF_OP_EQ; 1965 $$->next = NULL; 1966 $$->tail = $$; 1967 } 1968 | unaryop port { 1969 if ($2.t) { 1970 yyerror("':' cannot be used with an other " 1971 "port operator"); 1972 YYERROR; 1973 } 1974 $$ = calloc(1, sizeof(struct node_port)); 1975 if ($$ == NULL) 1976 err(1, "port_item: calloc"); 1977 $$->port[0] = $2.a; 1978 $$->port[1] = $2.b; 1979 $$->op = $1; 1980 $$->next = NULL; 1981 $$->tail = $$; 1982 } 1983 | port PORTBINARY port { 1984 if ($1.t || $3.t) { 1985 yyerror("':' cannot be used with an other " 1986 "port operator"); 1987 YYERROR; 1988 } 1989 $$ = calloc(1, sizeof(struct node_port)); 1990 if ($$ == NULL) 1991 err(1, "port_item: calloc"); 1992 $$->port[0] = $1.a; 1993 $$->port[1] = $3.a; 1994 $$->op = $2; 1995 $$->next = NULL; 1996 $$->tail = $$; 1997 } 1998 ; 1999 2000port : STRING { 2001 char *p = strchr($1, ':'); 2002 struct servent *s = NULL; 2003 u_long ulval; 2004 2005 if (p == NULL) { 2006 if (atoul($1, &ulval) == 0) { 2007 if (ulval > 65535) { 2008 yyerror("illegal port value %d", 2009 ulval); 2010 YYERROR; 2011 } 2012 $$.a = htons(ulval); 2013 } else { 2014 s = getservbyname($1, "tcp"); 2015 if (s == NULL) 2016 s = getservbyname($1, "udp"); 2017 if (s == NULL) { 2018 yyerror("unknown port %s", $1); 2019 YYERROR; 2020 } 2021 $$.a = s->s_port; 2022 } 2023 $$.b = 0; 2024 $$.t = 0; 2025 } else { 2026 int port[2]; 2027 2028 *p++ = 0; 2029 if ((port[0] = getservice($1)) == -1 || 2030 (port[1] = getservice(p)) == -1) 2031 YYERROR; 2032 $$.a = port[0]; 2033 $$.b = port[1]; 2034 $$.t = PF_OP_RRG; 2035 } 2036 } 2037 ; 2038 2039uids : uid_item { $$ = $1; } 2040 | '{' uid_list '}' { $$ = $2; } 2041 ; 2042 2043uid_list : uid_item { $$ = $1; } 2044 | uid_list comma uid_item { 2045 $1->tail->next = $3; 2046 $1->tail = $3; 2047 $$ = $1; 2048 } 2049 ; 2050 2051uid_item : uid { 2052 $$ = calloc(1, sizeof(struct node_uid)); 2053 if ($$ == NULL) 2054 err(1, "uid_item: calloc"); 2055 $$->uid[0] = $1; 2056 $$->uid[1] = $1; 2057 $$->op = PF_OP_EQ; 2058 $$->next = NULL; 2059 $$->tail = $$; 2060 } 2061 | unaryop uid { 2062 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2063 yyerror("user unknown requires operator = or " 2064 "!="); 2065 YYERROR; 2066 } 2067 $$ = calloc(1, sizeof(struct node_uid)); 2068 if ($$ == NULL) 2069 err(1, "uid_item: calloc"); 2070 $$->uid[0] = $2; 2071 $$->uid[1] = $2; 2072 $$->op = $1; 2073 $$->next = NULL; 2074 $$->tail = $$; 2075 } 2076 | uid PORTBINARY uid { 2077 if ($1 == UID_MAX || $3 == UID_MAX) { 2078 yyerror("user unknown requires operator = or " 2079 "!="); 2080 YYERROR; 2081 } 2082 $$ = calloc(1, sizeof(struct node_uid)); 2083 if ($$ == NULL) 2084 err(1, "uid_item: calloc"); 2085 $$->uid[0] = $1; 2086 $$->uid[1] = $3; 2087 $$->op = $2; 2088 $$->next = NULL; 2089 $$->tail = $$; 2090 } 2091 ; 2092 2093uid : STRING { 2094 u_long ulval; 2095 2096 if (atoul($1, &ulval) == -1) { 2097 if (!strcmp($1, "unknown")) 2098 $$ = UID_MAX; 2099 else { 2100 struct passwd *pw; 2101 2102 if ((pw = getpwnam($1)) == NULL) { 2103 yyerror("unknown user %s", $1); 2104 YYERROR; 2105 } 2106 $$ = pw->pw_uid; 2107 } 2108 } else { 2109 if (ulval >= UID_MAX) { 2110 yyerror("illegal uid value %lu", ulval); 2111 YYERROR; 2112 } 2113 $$ = ulval; 2114 } 2115 } 2116 ; 2117 2118gids : gid_item { $$ = $1; } 2119 | '{' gid_list '}' { $$ = $2; } 2120 ; 2121 2122gid_list : gid_item { $$ = $1; } 2123 | gid_list comma gid_item { 2124 $1->tail->next = $3; 2125 $1->tail = $3; 2126 $$ = $1; 2127 } 2128 ; 2129 2130gid_item : gid { 2131 $$ = calloc(1, sizeof(struct node_gid)); 2132 if ($$ == NULL) 2133 err(1, "gid_item: calloc"); 2134 $$->gid[0] = $1; 2135 $$->gid[1] = $1; 2136 $$->op = PF_OP_EQ; 2137 $$->next = NULL; 2138 $$->tail = $$; 2139 } 2140 | unaryop gid { 2141 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2142 yyerror("group unknown requires operator = or " 2143 "!="); 2144 YYERROR; 2145 } 2146 $$ = calloc(1, sizeof(struct node_gid)); 2147 if ($$ == NULL) 2148 err(1, "gid_item: calloc"); 2149 $$->gid[0] = $2; 2150 $$->gid[1] = $2; 2151 $$->op = $1; 2152 $$->next = NULL; 2153 $$->tail = $$; 2154 } 2155 | gid PORTBINARY gid { 2156 if ($1 == GID_MAX || $3 == GID_MAX) { 2157 yyerror("group unknown requires operator = or " 2158 "!="); 2159 YYERROR; 2160 } 2161 $$ = calloc(1, sizeof(struct node_gid)); 2162 if ($$ == NULL) 2163 err(1, "gid_item: calloc"); 2164 $$->gid[0] = $1; 2165 $$->gid[1] = $3; 2166 $$->op = $2; 2167 $$->next = NULL; 2168 $$->tail = $$; 2169 } 2170 ; 2171 2172gid : STRING { 2173 u_long ulval; 2174 2175 if (atoul($1, &ulval) == -1) { 2176 if (!strcmp($1, "unknown")) 2177 $$ = GID_MAX; 2178 else { 2179 struct group *grp; 2180 2181 if ((grp = getgrnam($1)) == NULL) { 2182 yyerror("unknown group %s", $1); 2183 YYERROR; 2184 } 2185 $$ = grp->gr_gid; 2186 } 2187 } else { 2188 if (ulval >= GID_MAX) { 2189 yyerror("illegal gid value %lu", ulval); 2190 YYERROR; 2191 } 2192 $$ = ulval; 2193 } 2194 } 2195 ; 2196 2197flag : STRING { 2198 int f; 2199 2200 if ((f = parse_flags($1)) < 0) { 2201 yyerror("bad flags %s", $1); 2202 YYERROR; 2203 } 2204 $$.b1 = f; 2205 } 2206 ; 2207 2208flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2209 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2210 ; 2211 2212icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2213 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2214 | ICMP6TYPE icmp6_item { $$ = $2; } 2215 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2216 ; 2217 2218icmp_list : icmp_item { $$ = $1; } 2219 | icmp_list comma icmp_item { 2220 $1->tail->next = $3; 2221 $1->tail = $3; 2222 $$ = $1; 2223 } 2224 ; 2225 2226icmp6_list : icmp6_item { $$ = $1; } 2227 | icmp6_list comma icmp6_item { 2228 $1->tail->next = $3; 2229 $1->tail = $3; 2230 $$ = $1; 2231 } 2232 ; 2233 2234icmp_item : icmptype { 2235 $$ = calloc(1, sizeof(struct node_icmp)); 2236 if ($$ == NULL) 2237 err(1, "icmp_item: calloc"); 2238 $$->type = $1; 2239 $$->code = 0; 2240 $$->proto = IPPROTO_ICMP; 2241 $$->next = NULL; 2242 $$->tail = $$; 2243 } 2244 | icmptype CODE STRING { 2245 const struct icmpcodeent *p; 2246 u_long ulval; 2247 2248 if (atoul($3, &ulval) == 0) { 2249 if (ulval > 255) { 2250 yyerror("illegal icmp-code %d", ulval); 2251 YYERROR; 2252 } 2253 } else { 2254 if ((p = geticmpcodebyname($1-1, $3, 2255 AF_INET)) == NULL) { 2256 yyerror("unknown icmp-code %s", $3); 2257 YYERROR; 2258 } 2259 ulval = p->code; 2260 } 2261 $$ = calloc(1, sizeof(struct node_icmp)); 2262 if ($$ == NULL) 2263 err(1, "icmp_item: calloc"); 2264 $$->type = $1; 2265 $$->code = ulval + 1; 2266 $$->proto = IPPROTO_ICMP; 2267 $$->next = NULL; 2268 $$->tail = $$; 2269 } 2270 ; 2271 2272icmp6_item : icmp6type { 2273 $$ = calloc(1, sizeof(struct node_icmp)); 2274 if ($$ == NULL) 2275 err(1, "icmp_item: calloc"); 2276 $$->type = $1; 2277 $$->code = 0; 2278 $$->proto = IPPROTO_ICMPV6; 2279 $$->next = NULL; 2280 $$->tail = $$; 2281 } 2282 | icmp6type CODE STRING { 2283 const struct icmpcodeent *p; 2284 u_long ulval; 2285 2286 if (atoul($3, &ulval) == 0) { 2287 if (ulval > 255) { 2288 yyerror("illegal icmp6-code %ld", 2289 ulval); 2290 YYERROR; 2291 } 2292 } else { 2293 if ((p = geticmpcodebyname($1-1, $3, 2294 AF_INET6)) == NULL) { 2295 yyerror("unknown icmp6-code %s", $3); 2296 YYERROR; 2297 } 2298 ulval = p->code; 2299 } 2300 $$ = calloc(1, sizeof(struct node_icmp)); 2301 if ($$ == NULL) 2302 err(1, "icmp_item: calloc"); 2303 $$->type = $1; 2304 $$->code = ulval + 1; 2305 $$->proto = IPPROTO_ICMPV6; 2306 $$->next = NULL; 2307 $$->tail = $$; 2308 } 2309 ; 2310 2311icmptype : STRING { 2312 const struct icmptypeent *p; 2313 u_long ulval; 2314 2315 if (atoul($1, &ulval) == 0) { 2316 if (ulval > 255) { 2317 yyerror("illegal icmp-type %d", ulval); 2318 YYERROR; 2319 } 2320 $$ = ulval + 1; 2321 } else { 2322 if ((p = geticmptypebyname($1, AF_INET)) == 2323 NULL) { 2324 yyerror("unknown icmp-type %s", $1); 2325 YYERROR; 2326 } 2327 $$ = p->type + 1; 2328 } 2329 } 2330 ; 2331 2332icmp6type : STRING { 2333 const struct icmptypeent *p; 2334 u_long ulval; 2335 2336 if (atoul($1, &ulval) == 0) { 2337 if (ulval > 255) { 2338 yyerror("illegal icmp6-type %d", ulval); 2339 YYERROR; 2340 } 2341 $$ = ulval + 1; 2342 } else { 2343 if ((p = geticmptypebyname($1, AF_INET6)) == 2344 NULL) { 2345 yyerror("unknown icmp6-type %s", $1); 2346 YYERROR; 2347 } 2348 $$ = p->type + 1; 2349 } 2350 } 2351 ; 2352 2353tos : TOS STRING { 2354 if (!strcmp($2, "lowdelay")) 2355 $$ = IPTOS_LOWDELAY; 2356 else if (!strcmp($2, "throughput")) 2357 $$ = IPTOS_THROUGHPUT; 2358 else if (!strcmp($2, "reliability")) 2359 $$ = IPTOS_RELIABILITY; 2360 else if ($2[0] == '0' && $2[1] == 'x') 2361 $$ = strtoul($2, NULL, 16); 2362 else 2363 $$ = strtoul($2, NULL, 10); 2364 if (!$$ || $$ > 255) { 2365 yyerror("illegal tos value %s", $2); 2366 YYERROR; 2367 } 2368 } 2369 ; 2370 2371keep : KEEP STATE state_opt_spec { 2372 $$.action = PF_STATE_NORMAL; 2373 $$.options = $3; 2374 } 2375 | MODULATE STATE state_opt_spec { 2376 $$.action = PF_STATE_MODULATE; 2377 $$.options = $3; 2378 } 2379 | SYNPROXY STATE state_opt_spec { 2380 $$.action = PF_STATE_SYNPROXY; 2381 $$.options = $3; 2382 } 2383 ; 2384 2385state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2386 | /* empty */ { $$ = NULL; } 2387 ; 2388 2389state_opt_list : state_opt_item { $$ = $1; } 2390 | state_opt_list comma state_opt_item { 2391 $1->tail->next = $3; 2392 $1->tail = $3; 2393 $$ = $1; 2394 } 2395 ; 2396 2397state_opt_item : MAXIMUM number { 2398 $$ = calloc(1, sizeof(struct node_state_opt)); 2399 if ($$ == NULL) 2400 err(1, "state_opt_item: calloc"); 2401 $$->type = PF_STATE_OPT_MAX; 2402 $$->data.max_states = $2; 2403 $$->next = NULL; 2404 $$->tail = $$; 2405 } 2406 | STRING number { 2407 int i; 2408 2409 for (i = 0; pf_timeouts[i].name && 2410 strcmp(pf_timeouts[i].name, $1); ++i) 2411 ; /* nothing */ 2412 if (!pf_timeouts[i].name) { 2413 yyerror("illegal timeout name %s", $1); 2414 YYERROR; 2415 } 2416 if (strchr(pf_timeouts[i].name, '.') == NULL) { 2417 yyerror("illegal state timeout %s", $1); 2418 YYERROR; 2419 } 2420 $$ = calloc(1, sizeof(struct node_state_opt)); 2421 if ($$ == NULL) 2422 err(1, "state_opt_item: calloc"); 2423 $$->type = PF_STATE_OPT_TIMEOUT; 2424 $$->data.timeout.number = pf_timeouts[i].timeout; 2425 $$->data.timeout.seconds = $2; 2426 $$->next = NULL; 2427 $$->tail = $$; 2428 } 2429 ; 2430 2431label : LABEL STRING { 2432 if (($$ = strdup($2)) == NULL) 2433 err(1, "rule label strdup() failed"); 2434 } 2435 ; 2436 2437qname : QUEUE STRING { 2438 if (($$.qname = strdup($2)) == NULL) 2439 err(1, "qname strdup() failed"); 2440 } 2441 | QUEUE '(' STRING ')' { 2442 if (($$.qname = strdup($3)) == NULL) 2443 err(1, "qname strdup() failed"); 2444 } 2445 | QUEUE '(' STRING comma STRING ')' { 2446 if (($$.qname = strdup($3)) == NULL || 2447 ($$.pqname = strdup($5)) == NULL) 2448 err(1, "qname strdup() failed"); 2449 } 2450 ; 2451 2452no : /* empty */ { $$ = 0; } 2453 | NO { $$ = 1; } 2454 ; 2455 2456rport : STRING { 2457 char *p = strchr($1, ':'); 2458 2459 if (p == NULL) { 2460 if (($$.a = getservice($1)) == -1) 2461 YYERROR; 2462 $$.b = $$.t = 0; 2463 } else if (!strcmp(p+1, "*")) { 2464 *p = 0; 2465 if (($$.a = getservice($1)) == -1) 2466 YYERROR; 2467 $$.b = 0; 2468 $$.t = 1; 2469 } else { 2470 *p++ = 0; 2471 if (($$.a = getservice($1)) == -1 || 2472 ($$.b = getservice(p)) == -1) 2473 YYERROR; 2474 if ($$.a == $$.b) 2475 $$.b = 0; 2476 $$.t = 0; 2477 } 2478 } 2479 ; 2480 2481redirspec : host { $$ = $1; } 2482 | '{' redir_host_list '}' { $$ = $2; } 2483 ; 2484 2485redir_host_list : host { $$ = $1; } 2486 | redir_host_list comma host { 2487 $1->tail->next = $3; 2488 $1->tail = $3->tail; 2489 $$ = $1; 2490 } 2491 ; 2492 2493redirpool : /* empty */ { $$ = NULL; } 2494 | ARROW redirspec { 2495 $$ = calloc(1, sizeof(struct redirection)); 2496 if ($$ == NULL) 2497 err(1, "redirection: calloc"); 2498 $$->host = $2; 2499 $$->rport.a = $$->rport.b = $$->rport.t = 0; 2500 } 2501 | ARROW redirspec PORT rport { 2502 $$ = calloc(1, sizeof(struct redirection)); 2503 if ($$ == NULL) 2504 err(1, "redirection: calloc"); 2505 $$->host = $2; 2506 $$->rport = $4; 2507 } 2508 ; 2509 2510hashkey : /* empty */ 2511 { 2512 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2513 if ($$ == NULL) 2514 err(1, "hashkey: calloc"); 2515 $$->key32[0] = arc4random(); 2516 $$->key32[1] = arc4random(); 2517 $$->key32[2] = arc4random(); 2518 $$->key32[3] = arc4random(); 2519 } 2520 | string 2521 { 2522 if (!strncmp($1, "0x", 2)) { 2523 if (strlen($1) != 34) { 2524 yyerror("hex key must be 128 bits " 2525 "(32 hex digits) long"); 2526 YYERROR; 2527 } 2528 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2529 if ($$ == NULL) 2530 err(1, "hashkey: calloc"); 2531 2532 if (sscanf($1, "0x%8x%8x%8x%8x", 2533 &$$->key32[0], &$$->key32[1], 2534 &$$->key32[2], &$$->key32[3]) != 4) { 2535 free($$); 2536 yyerror("invalid hex key"); 2537 YYERROR; 2538 } 2539 } else { 2540 MD5_CTX context; 2541 2542 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2543 if ($$ == NULL) 2544 err(1, "hashkey: calloc"); 2545 MD5Init(&context); 2546 MD5Update(&context, (unsigned char *)$1, 2547 strlen($1)); 2548 MD5Final((unsigned char *)$$, &context); 2549 HTONL($$->key32[0]); 2550 HTONL($$->key32[1]); 2551 HTONL($$->key32[2]); 2552 HTONL($$->key32[3]); 2553 } 2554 } 2555 ; 2556 2557pooltype : /* empty */ 2558 { 2559 $$.type = PF_POOL_NONE; 2560 $$.key = NULL; 2561 } 2562 | BITMASK 2563 { 2564 $$.type = PF_POOL_BITMASK; 2565 $$.key = NULL; 2566 } 2567 | RANDOM 2568 { 2569 $$.type = PF_POOL_RANDOM; 2570 $$.key = NULL; 2571 } 2572 | SOURCEHASH hashkey 2573 { 2574 $$.type = PF_POOL_SRCHASH; 2575 $$.key = $2; 2576 } 2577 | ROUNDROBIN 2578 { 2579 $$.type = PF_POOL_ROUNDROBIN; 2580 $$.key = NULL; 2581 } 2582 ; 2583 2584staticport : /* empty */ { $$ = 0; } 2585 | STATICPORT { $$ = 1; } 2586 ; 2587 2588redirection : /* empty */ { $$ = NULL; } 2589 | ARROW host { 2590 $$ = calloc(1, sizeof(struct redirection)); 2591 if ($$ == NULL) 2592 err(1, "redirection: calloc"); 2593 $$->host = $2; 2594 $$->rport.a = $$->rport.b = $$->rport.t = 0; 2595 } 2596 | ARROW host PORT rport { 2597 $$ = calloc(1, sizeof(struct redirection)); 2598 if ($$ == NULL) 2599 err(1, "redirection: calloc"); 2600 $$->host = $2; 2601 $$->rport = $4; 2602 } 2603 ; 2604 2605natpass : /* empty */ { $$ = 0; } 2606 | PASS { $$ = 1; } 2607 ; 2608 2609nataction : no NAT natpass { 2610 $$.b2 = $$.w = 0; 2611 if ($1) 2612 $$.b1 = PF_NONAT; 2613 else 2614 $$.b1 = PF_NAT; 2615 $$.b2 = $3; 2616 } 2617 | no RDR natpass { 2618 $$.b2 = $$.w = 0; 2619 if ($1) 2620 $$.b1 = PF_NORDR; 2621 else 2622 $$.b1 = PF_RDR; 2623 $$.b2 = $3; 2624 } 2625 ; 2626 2627natrule : nataction interface af proto fromto tag redirpool pooltype 2628 staticport 2629 { 2630 struct pf_rule r; 2631 2632 if (check_rulestate(PFCTL_STATE_NAT)) 2633 YYERROR; 2634 2635 memset(&r, 0, sizeof(r)); 2636 2637 r.action = $1.b1; 2638 r.natpass = $1.b2; 2639 r.af = $3; 2640 2641 if (!r.af) { 2642 if ($5.src.host && $5.src.host->af && 2643 !$5.src.host->ifindex) 2644 r.af = $5.src.host->af; 2645 else if ($5.dst.host && $5.dst.host->af && 2646 !$5.dst.host->ifindex) 2647 r.af = $5.dst.host->af; 2648 } 2649 2650 if ($6 != NULL) 2651 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) > 2652 PF_TAG_NAME_SIZE) { 2653 yyerror("tag too long, max %u chars", 2654 PF_TAG_NAME_SIZE - 1); 2655 YYERROR; 2656 } 2657 2658 if (r.action == PF_NONAT || r.action == PF_NORDR) { 2659 if ($7 != NULL) { 2660 yyerror("translation rule with 'no' " 2661 "does not need '->'"); 2662 YYERROR; 2663 } 2664 } else { 2665 if ($7 == NULL || $7->host == NULL) { 2666 yyerror("translation rule requires '-> " 2667 "address'"); 2668 YYERROR; 2669 } 2670 if (!r.af && ! $7->host->ifindex) 2671 r.af = $7->host->af; 2672 2673 remove_invalid_hosts(&$7->host, &r.af); 2674 if (invalid_redirect($7->host, r.af)) 2675 YYERROR; 2676 if (check_netmask($7->host, r.af)) 2677 YYERROR; 2678 2679 r.rpool.proxy_port[0] = ntohs($7->rport.a); 2680 2681 switch (r.action) { 2682 case PF_RDR: 2683 if (!$7->rport.b && $7->rport.t && 2684 $5.dst.port != NULL) { 2685 r.rpool.proxy_port[1] = 2686 ntohs($7->rport.a) + 2687 (ntohs($5.dst.port->port[1]) - 2688 ntohs($5.dst.port->port[0])); 2689 } else 2690 r.rpool.proxy_port[1] = 2691 ntohs($7->rport.b); 2692 break; 2693 case PF_NAT: 2694 r.rpool.proxy_port[1] = ntohs($7->rport.b); 2695 if (!r.rpool.proxy_port[0] && 2696 !r.rpool.proxy_port[1]) { 2697 r.rpool.proxy_port[0] = 2698 PF_NAT_PROXY_PORT_LOW; 2699 r.rpool.proxy_port[1] = 2700 PF_NAT_PROXY_PORT_HIGH; 2701 } else if (!r.rpool.proxy_port[1]) 2702 r.rpool.proxy_port[1] = 2703 r.rpool.proxy_port[0]; 2704 break; 2705 default: 2706 break; 2707 } 2708 2709 r.rpool.opts = $8.type; 2710 if (r.rpool.opts == PF_POOL_NONE) 2711 r.rpool.opts = PF_POOL_ROUNDROBIN; 2712 if (r.rpool.opts != PF_POOL_ROUNDROBIN) 2713 if (disallow_table($7->host, "tables " 2714 "are only supported in round-robin " 2715 "redirection pools")) 2716 YYERROR; 2717 if ($7->host->next) { 2718 if (r.rpool.opts != 2719 PF_POOL_ROUNDROBIN) { 2720 yyerror("only round-robin " 2721 "valid for multiple " 2722 "redirection addresses"); 2723 YYERROR; 2724 } 2725 } else { 2726 if ((r.af == AF_INET && 2727 unmask(&$7->host->addr.v.a.mask, 2728 r.af) == 32) || 2729 (r.af == AF_INET6 && 2730 unmask(&$7->host->addr.v.a.mask, 2731 r.af) == 128)) { 2732 r.rpool.opts = PF_POOL_NONE; 2733 } 2734 } 2735 } 2736 2737 if ($8.key != NULL) 2738 memcpy(&r.rpool.key, $8.key, 2739 sizeof(struct pf_poolhashkey)); 2740 2741 if ($9 != 0) { 2742 if (r.action != PF_NAT) { 2743 yyerror("the 'static-port' option is " 2744 "only valid with nat rules"); 2745 YYERROR; 2746 } 2747 if (r.rpool.proxy_port[0] != 2748 PF_NAT_PROXY_PORT_LOW && 2749 r.rpool.proxy_port[1] != 2750 PF_NAT_PROXY_PORT_HIGH) { 2751 yyerror("the 'static-port' option can't" 2752 " be used when specifying a port" 2753 " range"); 2754 YYERROR; 2755 } 2756 r.rpool.proxy_port[0] = 0; 2757 r.rpool.proxy_port[1] = 0; 2758 } 2759 2760 expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4, 2761 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 2762 $5.dst.port, 0, 0, 0); 2763 free($7); 2764 } 2765 ; 2766 2767binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag 2768 redirection 2769 { 2770 struct pf_rule binat; 2771 struct pf_pooladdr *pa; 2772 2773 if (check_rulestate(PFCTL_STATE_NAT)) 2774 YYERROR; 2775 2776 memset(&binat, 0, sizeof(binat)); 2777 2778 if ($1) 2779 binat.action = PF_NOBINAT; 2780 else 2781 binat.action = PF_BINAT; 2782 binat.natpass = $3; 2783 binat.af = $5; 2784 if (!binat.af && $8 != NULL && $8->af) 2785 binat.af = $8->af; 2786 if (!binat.af && $10 != NULL && $10->af) 2787 binat.af = $10->af; 2788 if (!binat.af && $12 != NULL && $12->host) 2789 binat.af = $12->host->af; 2790 if (!binat.af) { 2791 yyerror("address family (inet/inet6) " 2792 "undefined"); 2793 YYERROR; 2794 } 2795 2796 if ($4 != NULL) { 2797 memcpy(binat.ifname, $4->ifname, 2798 sizeof(binat.ifname)); 2799 free($4); 2800 } 2801 if ($11 != NULL) 2802 if (strlcpy(binat.tagname, $11, 2803 PF_TAG_NAME_SIZE) > PF_TAG_NAME_SIZE) { 2804 yyerror("tag too long, max %u chars", 2805 PF_TAG_NAME_SIZE - 1); 2806 YYERROR; 2807 } 2808 2809 if ($6 != NULL) { 2810 binat.proto = $6->proto; 2811 free($6); 2812 } 2813 2814 if ($8 != NULL && disallow_table($8, "invalid use of " 2815 "table <%s> as the source address of a binat rule")) 2816 YYERROR; 2817 if ($12 != NULL && $12->host != NULL && disallow_table( 2818 $12->host, "invalid use of table <%s> as the " 2819 "redirect address of a binat rule")) 2820 YYERROR; 2821 2822 if ($8 != NULL) { 2823 if ($8->next) { 2824 yyerror("multiple binat ip addresses"); 2825 YYERROR; 2826 } 2827 if ($8->addr.type == PF_ADDR_DYNIFTL) 2828 $8->af = binat.af; 2829 if ($8->af != binat.af) { 2830 yyerror("binat ip versions must match"); 2831 YYERROR; 2832 } 2833 if (check_netmask($8, binat.af)) 2834 YYERROR; 2835 memcpy(&binat.src.addr, &$8->addr, 2836 sizeof(binat.src.addr)); 2837 free($8); 2838 } 2839 if ($10 != NULL) { 2840 if ($10->next) { 2841 yyerror("multiple binat ip addresses"); 2842 YYERROR; 2843 } 2844 if ($10->af != binat.af && $10->af) { 2845 yyerror("binat ip versions must match"); 2846 YYERROR; 2847 } 2848 if (check_netmask($10, binat.af)) 2849 YYERROR; 2850 memcpy(&binat.dst.addr, &$10->addr, 2851 sizeof(binat.dst.addr)); 2852 binat.dst.not = $10->not; 2853 free($10); 2854 } 2855 2856 if (binat.action == PF_NOBINAT) { 2857 if ($12 != NULL) { 2858 yyerror("'no binat' rule does not need" 2859 " '->'"); 2860 YYERROR; 2861 } 2862 } else { 2863 if ($12 == NULL || $12->host == NULL) { 2864 yyerror("'binat' rule requires" 2865 " '-> address'"); 2866 YYERROR; 2867 } 2868 2869 remove_invalid_hosts(&$12->host, &binat.af); 2870 if (invalid_redirect($12->host, binat.af)) 2871 YYERROR; 2872 if ($12->host->next != NULL) { 2873 yyerror("binat rule must redirect to " 2874 "a single address"); 2875 YYERROR; 2876 } 2877 if (check_netmask($12->host, binat.af)) 2878 YYERROR; 2879 2880 if (!PF_AZERO(&binat.src.addr.v.a.mask, 2881 binat.af) && 2882 !PF_AEQ(&binat.src.addr.v.a.mask, 2883 &$12->host->addr.v.a.mask, binat.af)) { 2884 yyerror("'binat' source mask and " 2885 "redirect mask must be the same"); 2886 YYERROR; 2887 } 2888 2889 TAILQ_INIT(&binat.rpool.list); 2890 pa = calloc(1, sizeof(struct pf_pooladdr)); 2891 if (pa == NULL) 2892 err(1, "binat: calloc"); 2893 pa->addr = $12->host->addr; 2894 pa->ifname[0] = 0; 2895 TAILQ_INSERT_TAIL(&binat.rpool.list, 2896 pa, entries); 2897 2898 free($12); 2899 } 2900 2901 pfctl_add_rule(pf, &binat); 2902 } 2903 ; 2904 2905tag : /* empty */ { $$ = NULL; } 2906 | TAG STRING { $$ = $2; } 2907 2908route_host : STRING { 2909 struct node_host *n; 2910 2911 $$ = calloc(1, sizeof(struct node_host)); 2912 if ($$ == NULL) 2913 err(1, "route_host: calloc"); 2914 if (($$->ifname = strdup($1)) == NULL) 2915 err(1, "routeto: strdup"); 2916 if ((n = ifa_exists($$->ifname)) == NULL) { 2917 yyerror("routeto: unknown interface %s", 2918 $$->ifname); 2919 YYERROR; 2920 } 2921 set_ipmask($$, 128); 2922 $$->next = NULL; 2923 $$->tail = $$; 2924 } 2925 | '(' STRING host ')' { 2926 struct node_host *n; 2927 2928 $$ = $3; 2929 if (($$->ifname = strdup($2)) == NULL) 2930 err(1, "routeto: strdup"); 2931 if ((n = ifa_exists($$->ifname)) == NULL) { 2932 yyerror("routeto: unknown interface %s", 2933 $$->ifname); 2934 YYERROR; 2935 } 2936 } 2937 ; 2938 2939route_host_list : route_host { $$ = $1; } 2940 | route_host_list comma route_host { 2941 if ($1->af == 0) 2942 $1->af = $3->af; 2943 if ($1->af != $3->af) { 2944 yyerror("all pool addresses must be in the " 2945 "same address family"); 2946 YYERROR; 2947 } 2948 $1->tail->next = $3; 2949 $1->tail = $3->tail; 2950 $$ = $1; 2951 } 2952 ; 2953 2954routespec : route_host { $$ = $1; } 2955 | '{' route_host_list '}' { $$ = $2; } 2956 ; 2957 2958route : /* empty */ { 2959 $$.host = NULL; 2960 $$.rt = 0; 2961 $$.pool_opts = 0; 2962 } 2963 | FASTROUTE { 2964 $$.host = NULL; 2965 $$.rt = PF_FASTROUTE; 2966 $$.pool_opts = 0; 2967 } 2968 | ROUTETO routespec pooltype { 2969 $$.host = $2; 2970 $$.rt = PF_ROUTETO; 2971 $$.pool_opts = $3.type; 2972 if ($3.key != NULL) 2973 $$.key = $3.key; 2974 } 2975 | REPLYTO routespec pooltype { 2976 $$.host = $2; 2977 $$.rt = PF_REPLYTO; 2978 $$.pool_opts = $3.type; 2979 if ($3.key != NULL) 2980 $$.key = $3.key; 2981 } 2982 | DUPTO routespec pooltype { 2983 $$.host = $2; 2984 $$.rt = PF_DUPTO; 2985 $$.pool_opts = $3.type; 2986 if ($3.key != NULL) 2987 $$.key = $3.key; 2988 } 2989 ; 2990 2991timeout_spec : STRING number 2992 { 2993 if (check_rulestate(PFCTL_STATE_OPTION)) 2994 YYERROR; 2995 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 2996 yyerror("unknown timeout %s", $1); 2997 YYERROR; 2998 } 2999 } 3000 ; 3001 3002timeout_list : timeout_list comma timeout_spec 3003 | timeout_spec 3004 ; 3005 3006limit_spec : STRING number 3007 { 3008 if (check_rulestate(PFCTL_STATE_OPTION)) 3009 YYERROR; 3010 if (pfctl_set_limit(pf, $1, $2) != 0) { 3011 yyerror("unable to set limit %s %u", $1, $2); 3012 YYERROR; 3013 } 3014 } 3015 3016limit_list : limit_list comma limit_spec 3017 | limit_spec 3018 ; 3019 3020comma : ',' 3021 | /* empty */ 3022 ; 3023 3024yesno : NO { $$ = 0; } 3025 | STRING { 3026 if (!strcmp($1, "yes")) 3027 $$ = 1; 3028 else 3029 YYERROR; 3030 } 3031 3032unaryop : '=' { $$ = PF_OP_EQ; } 3033 | '!' '=' { $$ = PF_OP_NE; } 3034 | '<' '=' { $$ = PF_OP_LE; } 3035 | '<' { $$ = PF_OP_LT; } 3036 | '>' '=' { $$ = PF_OP_GE; } 3037 | '>' { $$ = PF_OP_GT; } 3038 ; 3039 3040%% 3041 3042int 3043yyerror(const char *fmt, ...) 3044{ 3045 va_list ap; 3046 extern char *infile; 3047 3048 errors = 1; 3049 va_start(ap, fmt); 3050 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3051 vfprintf(stderr, fmt, ap); 3052 fprintf(stderr, "\n"); 3053 va_end(ap); 3054 return (0); 3055} 3056 3057int 3058disallow_table(struct node_host *h, const char *fmt) 3059{ 3060 for (; h != NULL; h = h->next) 3061 if (h->addr.type == PF_ADDR_TABLE) { 3062 yyerror(fmt, h->addr.v.tblname); 3063 return (1); 3064 } 3065 return (0); 3066} 3067 3068int 3069rule_consistent(struct pf_rule *r) 3070{ 3071 int problems = 0; 3072 3073 switch (r->action) { 3074 case PF_PASS: 3075 case PF_DROP: 3076 case PF_SCRUB: 3077 problems = filter_consistent(r); 3078 break; 3079 case PF_NAT: 3080 case PF_NONAT: 3081 problems = nat_consistent(r); 3082 break; 3083 case PF_RDR: 3084 case PF_NORDR: 3085 problems = rdr_consistent(r); 3086 break; 3087 case PF_BINAT: 3088 case PF_NOBINAT: 3089 default: 3090 break; 3091 } 3092 return (problems); 3093} 3094 3095int 3096filter_consistent(struct pf_rule *r) 3097{ 3098 int problems = 0; 3099 3100 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3101 (r->src.port_op || r->dst.port_op)) { 3102 yyerror("port only applies to tcp/udp"); 3103 problems++; 3104 } 3105 if (r->src.port_op == PF_OP_RRG || r->dst.port_op == PF_OP_RRG) { 3106 yyerror("the ':' port operator only applies to rdr"); 3107 problems++; 3108 } 3109 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3110 (r->type || r->code)) { 3111 yyerror("icmp-type/code only applies to icmp"); 3112 problems++; 3113 } 3114 if (!r->af && (r->type || r->code)) { 3115 yyerror("must indicate address family with icmp-type/code"); 3116 problems++; 3117 } 3118 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3119 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3120 yyerror("proto %s doesn't match address family %s", 3121 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3122 r->af == AF_INET ? "inet" : "inet6"); 3123 problems++; 3124 } 3125 if ((r->keep_state == PF_STATE_MODULATE || r->keep_state == 3126 PF_STATE_SYNPROXY) && r->proto && r->proto != IPPROTO_TCP) { 3127 yyerror("modulate/synproxy state can only be applied to " 3128 "TCP rules"); 3129 problems++; 3130 } 3131 if (r->allow_opts && r->action != PF_PASS) { 3132 yyerror("allow-opts can only be specified for pass rules"); 3133 problems++; 3134 } 3135 if (!r->af && (r->src.addr.type == PF_ADDR_DYNIFTL || 3136 r->dst.addr.type == PF_ADDR_DYNIFTL)) { 3137 yyerror("dynamic addresses require address family " 3138 "(inet/inet6)"); 3139 problems++; 3140 } 3141 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3142 r->dst.port_op || r->flagset || r->type || r->code)) { 3143 yyerror("fragments can be filtered only on IP header fields"); 3144 problems++; 3145 } 3146 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3147 yyerror("return-rst can only be applied to TCP rules"); 3148 problems++; 3149 } 3150 if (r->action == PF_DROP && r->keep_state) { 3151 yyerror("keep state on block rules doesn't make sense"); 3152 problems++; 3153 } 3154 if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state && 3155 r->action == PF_PASS) { 3156 yyerror("tags cannot be used without keep state"); 3157 problems++; 3158 } 3159 return (-problems); 3160} 3161 3162int 3163nat_consistent(struct pf_rule *r) 3164{ 3165 int problems = 0; 3166 struct pf_pooladdr *pa; 3167 3168 if (r->src.port_op == PF_OP_RRG || r->dst.port_op == PF_OP_RRG) { 3169 yyerror("the ':' port operator only applies to rdr"); 3170 problems++; 3171 } 3172 if (!r->af) { 3173 TAILQ_FOREACH(pa, &r->rpool.list, entries) { 3174 if (pa->addr.type == PF_ADDR_DYNIFTL) { 3175 yyerror("dynamic addresses require " 3176 "address family (inet/inet6)"); 3177 problems++; 3178 break; 3179 } 3180 } 3181 } 3182 return (-problems); 3183} 3184 3185int 3186rdr_consistent(struct pf_rule *r) 3187{ 3188 int problems = 0; 3189 struct pf_pooladdr *pa; 3190 3191 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3192 if (r->src.port_op) { 3193 yyerror("src port only applies to tcp/udp"); 3194 problems++; 3195 } 3196 if (r->dst.port_op) { 3197 yyerror("dst port only applies to tcp/udp"); 3198 problems++; 3199 } 3200 if (r->rpool.proxy_port[0]) { 3201 yyerror("rpool port only applies to tcp/udp"); 3202 problems++; 3203 } 3204 } 3205 if (r->dst.port_op && 3206 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3207 yyerror("invalid port operator for rdr destination port"); 3208 problems++; 3209 } 3210 if (r->src.port_op == PF_OP_RRG) { 3211 yyerror("the ':' port operator only applies to rdr " 3212 "destination port"); 3213 problems++; 3214 } 3215 if (!r->af) { 3216 if (r->src.addr.type == PF_ADDR_DYNIFTL || 3217 r->dst.addr.type == PF_ADDR_DYNIFTL) { 3218 yyerror("dynamic addresses require address family " 3219 "(inet/inet6)"); 3220 problems++; 3221 } else { 3222 TAILQ_FOREACH(pa, &r->rpool.list, entries) { 3223 if (pa->addr.type == PF_ADDR_DYNIFTL) { 3224 yyerror("dynamic addresses require " 3225 "address family (inet/inet6)"); 3226 problems++; 3227 break; 3228 } 3229 } 3230 } 3231 } 3232 return (-problems); 3233} 3234 3235int 3236process_tabledef(char *name, struct table_opts *opts) 3237{ 3238 struct pfr_buffer ab; 3239 struct node_tinit *ti; 3240 3241 bzero(&ab, sizeof(ab)); 3242 ab.pfrb_type = PFRB_ADDRS; 3243 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3244 if (ti->file) 3245 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3246 if (errno) 3247 yyerror("cannot load \"%s\": %s", 3248 ti->file, strerror(errno)); 3249 else 3250 yyerror("file \"%s\" contains bad data", 3251 ti->file); 3252 goto _error; 3253 } 3254 if (ti->host) 3255 if (append_addr_host(&ab, ti->host, 0, 0)) { 3256 yyerror("cannot create address buffer: %s", 3257 strerror(errno)); 3258 goto _error; 3259 } 3260 } 3261 if (pf->opts & PF_OPT_VERBOSE) 3262 print_tabledef(name, opts->flags, opts->init_addr, 3263 &opts->init_nodes); 3264 if (!(pf->opts & PF_OPT_NOACTION) && 3265 pfctl_define_table(name, opts->flags, opts->init_addr, 3266 pf->anchor, pf->ruleset, &ab, pf->tticket)) { 3267 yyerror("cannot define table %s: %s", name, 3268 pfr_strerror(errno)); 3269 goto _error; 3270 } 3271 pf->tdirty = 1; 3272 pfr_buf_clear(&ab); 3273 return (0); 3274_error: 3275 pfr_buf_clear(&ab); 3276 return (-1); 3277} 3278 3279struct keywords { 3280 const char *k_name; 3281 int k_val; 3282}; 3283 3284/* macro gore, but you should've seen the prior indentation nightmare... */ 3285 3286#define FREE_LIST(T,r) \ 3287 do { \ 3288 T *p, *node = r; \ 3289 while (node != NULL) { \ 3290 p = node; \ 3291 node = node->next; \ 3292 free(p); \ 3293 } \ 3294 } while (0) 3295 3296#define LOOP_THROUGH(T,n,r,C) \ 3297 do { \ 3298 T *n; \ 3299 if (r == NULL) { \ 3300 r = calloc(1, sizeof(T)); \ 3301 if (r == NULL) \ 3302 err(1, "LOOP: calloc"); \ 3303 r->next = NULL; \ 3304 } \ 3305 n = r; \ 3306 while (n != NULL) { \ 3307 do { \ 3308 C; \ 3309 } while (0); \ 3310 n = n->next; \ 3311 } \ 3312 } while (0) 3313 3314void 3315expand_label_str(char *label, const char *srch, const char *repl) 3316{ 3317 char tmp[PF_RULE_LABEL_SIZE] = ""; 3318 char *p, *q; 3319 3320 p = q = label; 3321 while ((q = strstr(p, srch)) != NULL) { 3322 *q = '\0'; 3323 if ((strlcat(tmp, p, sizeof(tmp)) >= sizeof(tmp)) || 3324 (strlcat(tmp, repl, sizeof(tmp)) >= sizeof(tmp))) 3325 err(1, "expand_label: label too long"); 3326 q += strlen(srch); 3327 p = q; 3328 } 3329 if (strlcat(tmp, p, sizeof(tmp)) >= sizeof(tmp)) 3330 err(1, "expand_label: label too long"); 3331 strlcpy(label, tmp, PF_RULE_LABEL_SIZE); /* always fits */ 3332} 3333 3334void 3335expand_label_if(const char *name, char *label, const char *ifname) 3336{ 3337 if (strstr(label, name) != NULL) { 3338 if (!*ifname) 3339 expand_label_str(label, name, "any"); 3340 else 3341 expand_label_str(label, name, ifname); 3342 } 3343} 3344 3345void 3346expand_label_addr(const char *name, char *label, sa_family_t af, 3347 struct node_host *h) 3348{ 3349 char tmp[64], tmp_not[66]; 3350 3351 if (strstr(label, name) != NULL) { 3352 switch (h->addr.type) { 3353 case PF_ADDR_DYNIFTL: 3354 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 3355 break; 3356 case PF_ADDR_TABLE: 3357 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 3358 break; 3359 case PF_ADDR_NOROUTE: 3360 snprintf(tmp, sizeof(tmp), "no-route"); 3361 break; 3362 case PF_ADDR_ADDRMASK: 3363 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 3364 PF_AZERO(&h->addr.v.a.mask, af))) 3365 snprintf(tmp, sizeof(tmp), "any"); 3366 else { 3367 char a[48]; 3368 int bits; 3369 3370 if (inet_ntop(af, &h->addr.v.a.addr, a, 3371 sizeof(a)) == NULL) 3372 snprintf(tmp, sizeof(tmp), "?"); 3373 else { 3374 bits = unmask(&h->addr.v.a.mask, af); 3375 if ((af == AF_INET && bits < 32) || 3376 (af == AF_INET6 && bits < 128)) 3377 snprintf(tmp, sizeof(tmp), 3378 "%s/%d", a, bits); 3379 else 3380 snprintf(tmp, sizeof(tmp), 3381 "%s", a); 3382 } 3383 } 3384 break; 3385 default: 3386 snprintf(tmp, sizeof(tmp), "?"); 3387 break; 3388 } 3389 3390 if (h->not) { 3391 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 3392 expand_label_str(label, name, tmp_not); 3393 } else 3394 expand_label_str(label, name, tmp); 3395 } 3396} 3397 3398void 3399expand_label_port(const char *name, char *label, struct node_port *port) 3400{ 3401 char a1[6], a2[6], op[13] = ""; 3402 3403 if (strstr(label, name) != NULL) { 3404 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 3405 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 3406 if (!port->op) 3407 ; 3408 else if (port->op == PF_OP_IRG) 3409 snprintf(op, sizeof(op), "%s><%s", a1, a2); 3410 else if (port->op == PF_OP_XRG) 3411 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 3412 else if (port->op == PF_OP_EQ) 3413 snprintf(op, sizeof(op), "%s", a1); 3414 else if (port->op == PF_OP_NE) 3415 snprintf(op, sizeof(op), "!=%s", a1); 3416 else if (port->op == PF_OP_LT) 3417 snprintf(op, sizeof(op), "<%s", a1); 3418 else if (port->op == PF_OP_LE) 3419 snprintf(op, sizeof(op), "<=%s", a1); 3420 else if (port->op == PF_OP_GT) 3421 snprintf(op, sizeof(op), ">%s", a1); 3422 else if (port->op == PF_OP_GE) 3423 snprintf(op, sizeof(op), ">=%s", a1); 3424 expand_label_str(label, name, op); 3425 } 3426} 3427 3428void 3429expand_label_proto(const char *name, char *label, u_int8_t proto) 3430{ 3431 struct protoent *pe; 3432 char n[4]; 3433 3434 if (strstr(label, name) != NULL) { 3435 pe = getprotobynumber(proto); 3436 if (pe != NULL) 3437 expand_label_str(label, name, pe->p_name); 3438 else { 3439 snprintf(n, sizeof(n), "%u", proto); 3440 expand_label_str(label, name, n); 3441 } 3442 } 3443} 3444 3445void 3446expand_label_nr(const char *name, char *label) 3447{ 3448 char n[11]; 3449 3450 if (strstr(label, name) != NULL) { 3451 snprintf(n, sizeof(n), "%u", pf->rule_nr); 3452 expand_label_str(label, name, n); 3453 } 3454} 3455 3456void 3457expand_label(char *label, const char *ifname, sa_family_t af, 3458 struct node_host *src_host, struct node_port *src_port, 3459 struct node_host *dst_host, struct node_port *dst_port, 3460 u_int8_t proto) 3461{ 3462 expand_label_if("$if", label, ifname); 3463 expand_label_addr("$srcaddr", label, af, src_host); 3464 expand_label_addr("$dstaddr", label, af, dst_host); 3465 expand_label_port("$srcport", label, src_port); 3466 expand_label_port("$dstport", label, dst_port); 3467 expand_label_proto("$proto", label, proto); 3468 expand_label_nr("$nr", label); 3469} 3470 3471int 3472expand_altq(struct pf_altq *a, struct node_if *interfaces, 3473 struct node_queue *nqueues, struct node_queue_bw bwspec, 3474 struct node_queue_opt *opts) 3475{ 3476 struct pf_altq pa, pb; 3477 char qname[PF_QNAME_SIZE]; 3478 struct node_queue *n; 3479 struct node_queue_bw bw; 3480 int errs = 0; 3481 3482 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3483 FREE_LIST(struct node_if, interfaces); 3484 FREE_LIST(struct node_queue, nqueues); 3485 return (0); 3486 } 3487 3488 LOOP_THROUGH(struct node_if, interface, interfaces, 3489 memcpy(&pa, a, sizeof(struct pf_altq)); 3490 if (strlcpy(pa.ifname, interface->ifname, 3491 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 3492 errx(1, "expand_altq: strlcpy"); 3493 3494 if (interface->not) { 3495 yyerror("altq on ! <interface> is not supported"); 3496 errs++; 3497 } else { 3498 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 3499 errs++; 3500 else 3501 if (pfctl_add_altq(pf, &pa)) 3502 errs++; 3503 3504 if (pf->opts & PF_OPT_VERBOSE) { 3505 print_altq(&pf->paltq->altq, 0, 3506 &bwspec, opts); 3507 if (nqueues && nqueues->tail) { 3508 printf("queue { "); 3509 LOOP_THROUGH(struct node_queue, queue, 3510 nqueues, 3511 printf("%s ", 3512 queue->queue); 3513 ); 3514 printf("}"); 3515 } 3516 printf("\n"); 3517 } 3518 3519 if (pa.scheduler == ALTQT_CBQ || 3520 pa.scheduler == ALTQT_HFSC) { 3521 /* now create a root queue */ 3522 memset(&pb, 0, sizeof(struct pf_altq)); 3523 if (strlcpy(qname, "root_", sizeof(qname)) >= 3524 sizeof(qname)) 3525 errx(1, "expand_altq: strlcpy"); 3526 if (strlcat(qname, interface->ifname, 3527 sizeof(qname)) >= sizeof(qname)) 3528 errx(1, "expand_altq: strlcat"); 3529 if (strlcpy(pb.qname, qname, 3530 sizeof(pb.qname)) >= sizeof(pb.qname)) 3531 errx(1, "expand_altq: strlcpy"); 3532 if (strlcpy(pb.ifname, interface->ifname, 3533 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 3534 errx(1, "expand_altq: strlcpy"); 3535 pb.qlimit = pa.qlimit; 3536 pb.scheduler = pa.scheduler; 3537 bw.bw_absolute = pa.ifbandwidth; 3538 bw.bw_percent = 0; 3539 if (eval_pfqueue(pf, &pb, &bw, opts)) 3540 errs++; 3541 else 3542 if (pfctl_add_altq(pf, &pb)) 3543 errs++; 3544 } 3545 3546 LOOP_THROUGH(struct node_queue, queue, nqueues, 3547 n = calloc(1, sizeof(struct node_queue)); 3548 if (n == NULL) 3549 err(1, "expand_altq: calloc"); 3550 if (pa.scheduler == ALTQT_CBQ || 3551 pa.scheduler == ALTQT_HFSC) 3552 if (strlcpy(n->parent, qname, 3553 sizeof(n->parent)) >= 3554 sizeof(n->parent)) 3555 errx(1, "expand_altq: strlcpy"); 3556 if (strlcpy(n->queue, queue->queue, 3557 sizeof(n->queue)) >= sizeof(n->queue)) 3558 errx(1, "expand_altq: strlcpy"); 3559 if (strlcpy(n->ifname, interface->ifname, 3560 sizeof(n->ifname)) >= sizeof(n->ifname)) 3561 errx(1, "expand_altq: strlcpy"); 3562 n->scheduler = pa.scheduler; 3563 n->next = NULL; 3564 n->tail = n; 3565 if (queues == NULL) 3566 queues = n; 3567 else { 3568 queues->tail->next = n; 3569 queues->tail = n; 3570 } 3571 ); 3572 } 3573 ); 3574 FREE_LIST(struct node_if, interfaces); 3575 FREE_LIST(struct node_queue, nqueues); 3576 3577 return (errs); 3578} 3579 3580int 3581expand_queue(struct pf_altq *a, struct node_if *interfaces, 3582 struct node_queue *nqueues, struct node_queue_bw bwspec, 3583 struct node_queue_opt *opts) 3584{ 3585 struct node_queue *n, *nq; 3586 struct pf_altq pa; 3587 u_int8_t found = 0; 3588 u_int8_t errs = 0; 3589 3590 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3591 FREE_LIST(struct node_queue, nqueues); 3592 return (0); 3593 } 3594 3595 if (queues == NULL) { 3596 yyerror("queue %s has no parent", a->qname); 3597 FREE_LIST(struct node_queue, nqueues); 3598 return (1); 3599 } 3600 3601 LOOP_THROUGH(struct node_if, interface, interfaces, 3602 LOOP_THROUGH(struct node_queue, tqueue, queues, 3603 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 3604 (interface->ifname[0] == 0 || 3605 (!interface->not && !strncmp(interface->ifname, 3606 tqueue->ifname, IFNAMSIZ)) || 3607 (interface->not && strncmp(interface->ifname, 3608 tqueue->ifname, IFNAMSIZ)))) { 3609 /* found ourself in queues */ 3610 found++; 3611 3612 memcpy(&pa, a, sizeof(struct pf_altq)); 3613 3614 if (pa.scheduler != ALTQT_NONE && 3615 pa.scheduler != tqueue->scheduler) { 3616 yyerror("exactly one scheduler type " 3617 "per interface allowed"); 3618 return (1); 3619 } 3620 pa.scheduler = tqueue->scheduler; 3621 3622 /* scheduler dependent error checking */ 3623 switch (pa.scheduler) { 3624 case ALTQT_PRIQ: 3625 if (nqueues != NULL) { 3626 yyerror("priq queues cannot " 3627 "have child queues"); 3628 return (1); 3629 } 3630 if (bwspec.bw_absolute > 0 || 3631 bwspec.bw_percent < 100) { 3632 yyerror("priq doesn't take " 3633 "bandwidth"); 3634 return (1); 3635 } 3636 break; 3637 default: 3638 break; 3639 } 3640 3641 if (strlcpy(pa.ifname, tqueue->ifname, 3642 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 3643 errx(1, "expand_queue: strlcpy"); 3644 if (strlcpy(pa.parent, tqueue->parent, 3645 sizeof(pa.parent)) >= sizeof(pa.parent)) 3646 errx(1, "expand_queue: strlcpy"); 3647 3648 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 3649 errs++; 3650 else 3651 if (pfctl_add_altq(pf, &pa)) 3652 errs++; 3653 3654 for (nq = nqueues; nq != NULL; nq = nq->next) { 3655 if (!strcmp(a->qname, nq->queue)) { 3656 yyerror("queue cannot have " 3657 "itself as child"); 3658 errs++; 3659 continue; 3660 } 3661 n = calloc(1, 3662 sizeof(struct node_queue)); 3663 if (n == NULL) 3664 err(1, "expand_queue: calloc"); 3665 if (strlcpy(n->parent, a->qname, 3666 sizeof(n->parent)) >= 3667 sizeof(n->parent)) 3668 errx(1, "expand_queue strlcpy"); 3669 if (strlcpy(n->queue, nq->queue, 3670 sizeof(n->queue)) >= 3671 sizeof(n->queue)) 3672 errx(1, "expand_queue strlcpy"); 3673 if (strlcpy(n->ifname, tqueue->ifname, 3674 sizeof(n->ifname)) >= 3675 sizeof(n->ifname)) 3676 errx(1, "expand_queue strlcpy"); 3677 n->scheduler = tqueue->scheduler; 3678 n->next = NULL; 3679 n->tail = n; 3680 if (queues == NULL) 3681 queues = n; 3682 else { 3683 queues->tail->next = n; 3684 queues->tail = n; 3685 } 3686 } 3687 if ((pf->opts & PF_OPT_VERBOSE) && ( 3688 (found == 1 && interface->ifname[0] == 0) || 3689 (found > 0 && interface->ifname[0] != 0))) { 3690 print_queue(&pf->paltq->altq, 0, 3691 &bwspec, interface->ifname[0] != 0, 3692 opts); 3693 if (nqueues && nqueues->tail) { 3694 printf("{ "); 3695 LOOP_THROUGH(struct node_queue, 3696 queue, nqueues, 3697 printf("%s ", 3698 queue->queue); 3699 ); 3700 printf("}"); 3701 } 3702 printf("\n"); 3703 } 3704 } 3705 ); 3706 ); 3707 3708 FREE_LIST(struct node_queue, nqueues); 3709 FREE_LIST(struct node_if, interfaces); 3710 3711 if (!found) { 3712 yyerror("queue %s has no parent", a->qname); 3713 errs++; 3714 } 3715 3716 if (errs) 3717 return (1); 3718 else 3719 return (0); 3720} 3721 3722void 3723expand_rule(struct pf_rule *r, 3724 struct node_if *interfaces, struct node_host *rpool_hosts, 3725 struct node_proto *protos, struct node_os *src_oses, 3726 struct node_host *src_hosts, struct node_port *src_ports, 3727 struct node_host *dst_hosts, struct node_port *dst_ports, 3728 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types) 3729{ 3730 sa_family_t af = r->af; 3731 int added = 0, error = 0; 3732 char ifname[IF_NAMESIZE]; 3733 char label[PF_RULE_LABEL_SIZE]; 3734 struct pf_pooladdr *pa; 3735 struct node_host *h; 3736 u_int8_t flags, flagset; 3737 3738 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 3739 errx(1, "expand_rule: strlcpy"); 3740 flags = r->flags; 3741 flagset = r->flagset; 3742 3743 LOOP_THROUGH(struct node_if, interface, interfaces, 3744 LOOP_THROUGH(struct node_proto, proto, protos, 3745 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 3746 LOOP_THROUGH(struct node_host, src_host, src_hosts, 3747 LOOP_THROUGH(struct node_port, src_port, src_ports, 3748 LOOP_THROUGH(struct node_os, src_os, src_oses, 3749 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 3750 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 3751 LOOP_THROUGH(struct node_uid, uid, uids, 3752 LOOP_THROUGH(struct node_gid, gid, gids, 3753 3754 r->af = af; 3755 /* for link-local IPv6 address, interface must match up */ 3756 if ((r->af && src_host->af && r->af != src_host->af) || 3757 (r->af && dst_host->af && r->af != dst_host->af) || 3758 (src_host->af && dst_host->af && 3759 src_host->af != dst_host->af) || 3760 (src_host->ifindex && dst_host->ifindex && 3761 src_host->ifindex != dst_host->ifindex) || 3762 (src_host->ifindex && if_nametoindex(interface->ifname) && 3763 src_host->ifindex != if_nametoindex(interface->ifname)) || 3764 (dst_host->ifindex && if_nametoindex(interface->ifname) && 3765 dst_host->ifindex != if_nametoindex(interface->ifname))) 3766 continue; 3767 if (!r->af && src_host->af) 3768 r->af = src_host->af; 3769 else if (!r->af && dst_host->af) 3770 r->af = dst_host->af; 3771 3772 if (if_indextoname(src_host->ifindex, ifname)) 3773 memcpy(r->ifname, ifname, sizeof(r->ifname)); 3774 else if (if_indextoname(dst_host->ifindex, ifname)) 3775 memcpy(r->ifname, ifname, sizeof(r->ifname)); 3776 else 3777 memcpy(r->ifname, interface->ifname, sizeof(r->ifname)); 3778 3779 if (strlcpy(r->label, label, sizeof(r->label)) >= 3780 sizeof(r->label)) 3781 errx(1, "expand_rule: strlcpy"); 3782 expand_label(r->label, r->ifname, r->af, src_host, src_port, 3783 dst_host, dst_port, proto->proto); 3784 3785 error += check_netmask(src_host, r->af); 3786 error += check_netmask(dst_host, r->af); 3787 3788 r->ifnot = interface->not; 3789 r->proto = proto->proto; 3790 r->src.addr = src_host->addr; 3791 r->src.not = src_host->not; 3792 r->src.port[0] = src_port->port[0]; 3793 r->src.port[1] = src_port->port[1]; 3794 r->src.port_op = src_port->op; 3795 r->dst.addr = dst_host->addr; 3796 r->dst.not = dst_host->not; 3797 r->dst.port[0] = dst_port->port[0]; 3798 r->dst.port[1] = dst_port->port[1]; 3799 r->dst.port_op = dst_port->op; 3800 r->uid.op = uid->op; 3801 r->uid.uid[0] = uid->uid[0]; 3802 r->uid.uid[1] = uid->uid[1]; 3803 r->gid.op = gid->op; 3804 r->gid.gid[0] = gid->gid[0]; 3805 r->gid.gid[1] = gid->gid[1]; 3806 r->type = icmp_type->type; 3807 r->code = icmp_type->code; 3808 3809 if (r->proto && r->proto != IPPROTO_TCP) { 3810 r->flags = 0; 3811 r->flagset = 0; 3812 } else { 3813 r->flags = flags; 3814 r->flagset = flagset; 3815 } 3816 if (icmp_type->proto && r->proto != icmp_type->proto) { 3817 yyerror("icmp-type mismatch"); 3818 error++; 3819 } 3820 3821 if (src_os && src_os->os) { 3822 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 3823 if ((pf->opts & PF_OPT_VERBOSE2) && 3824 r->os_fingerprint == PF_OSFP_NOMATCH) 3825 fprintf(stderr, 3826 "warning: unknown '%s' OS fingerprint\n", 3827 src_os->os); 3828 } else { 3829 r->os_fingerprint = PF_OSFP_ANY; 3830 } 3831 3832 TAILQ_INIT(&r->rpool.list); 3833 for (h = rpool_hosts; h != NULL; h = h->next) { 3834 pa = calloc(1, sizeof(struct pf_pooladdr)); 3835 if (pa == NULL) 3836 err(1, "expand_rule: calloc"); 3837 pa->addr = h->addr; 3838 if (h->ifname != NULL) { 3839 if (strlcpy(pa->ifname, h->ifname, 3840 sizeof(pa->ifname)) >= 3841 sizeof(pa->ifname)) 3842 errx(1, "expand_rule: strlcpy"); 3843 } else 3844 pa->ifname[0] = 0; 3845 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 3846 } 3847 3848 if (rule_consistent(r) < 0 || error) 3849 yyerror("skipping rule due to errors"); 3850 else { 3851 r->nr = pf->rule_nr++; 3852 pfctl_add_rule(pf, r); 3853 added++; 3854 } 3855 3856 )))))))))); 3857 3858 FREE_LIST(struct node_if, interfaces); 3859 FREE_LIST(struct node_proto, protos); 3860 FREE_LIST(struct node_host, src_hosts); 3861 FREE_LIST(struct node_port, src_ports); 3862 FREE_LIST(struct node_os, src_oses); 3863 FREE_LIST(struct node_host, dst_hosts); 3864 FREE_LIST(struct node_port, dst_ports); 3865 FREE_LIST(struct node_uid, uids); 3866 FREE_LIST(struct node_gid, gids); 3867 FREE_LIST(struct node_icmp, icmp_types); 3868 FREE_LIST(struct node_host, rpool_hosts); 3869 3870 if (!added) 3871 yyerror("rule expands to no valid combination"); 3872} 3873 3874#undef FREE_LIST 3875#undef LOOP_THROUGH 3876 3877int 3878check_rulestate(int desired_state) 3879{ 3880 if (require_order && (rulestate > desired_state)) { 3881 yyerror("Rules must be in order: options, normalization, " 3882 "queueing, translation, filtering"); 3883 return (1); 3884 } 3885 rulestate = desired_state; 3886 return (0); 3887} 3888 3889int 3890kw_cmp(const void *k, const void *e) 3891{ 3892 return (strcmp(k, ((const struct keywords *)e)->k_name)); 3893} 3894 3895int 3896lookup(char *s) 3897{ 3898 /* this has to be sorted always */ 3899 static const struct keywords keywords[] = { 3900 { "all", ALL}, 3901 { "allow-opts", ALLOWOPTS}, 3902 { "altq", ALTQ}, 3903 { "anchor", ANCHOR}, 3904 { "antispoof", ANTISPOOF}, 3905 { "any", ANY}, 3906 { "bandwidth", BANDWIDTH}, 3907 { "binat", BINAT}, 3908 { "binat-anchor", BINATANCHOR}, 3909 { "bitmask", BITMASK}, 3910 { "block", BLOCK}, 3911 { "block-policy", BLOCKPOLICY}, 3912 { "cbq", CBQ}, 3913 { "code", CODE}, 3914 { "crop", FRAGCROP}, 3915 { "drop", DROP}, 3916 { "drop-ovl", FRAGDROP}, 3917 { "dup-to", DUPTO}, 3918 { "fastroute", FASTROUTE}, 3919 { "file", FILENAME}, 3920 { "fingerprints", FINGERPRINTS}, 3921 { "flags", FLAGS}, 3922 { "for", FOR}, 3923 { "fragment", FRAGMENT}, 3924 { "from", FROM}, 3925 { "group", GROUP}, 3926 { "hfsc", HFSC}, 3927 { "icmp-type", ICMPTYPE}, 3928 { "icmp6-type", ICMP6TYPE}, 3929 { "in", IN}, 3930 { "inet", INET}, 3931 { "inet6", INET6}, 3932 { "keep", KEEP}, 3933 { "label", LABEL}, 3934 { "limit", LIMIT}, 3935 { "linkshare", LINKSHARE}, 3936 { "load", LOAD}, 3937 { "log", LOG}, 3938 { "log-all", LOGALL}, 3939 { "loginterface", LOGINTERFACE}, 3940 { "max", MAXIMUM}, 3941 { "max-mss", MAXMSS}, 3942 { "min-ttl", MINTTL}, 3943 { "modulate", MODULATE}, 3944 { "nat", NAT}, 3945 { "nat-anchor", NATANCHOR}, 3946 { "no", NO}, 3947 { "no-df", NODF}, 3948 { "no-route", NOROUTE}, 3949 { "on", ON}, 3950 { "optimization", OPTIMIZATION}, 3951 { "os", OS}, 3952 { "out", OUT}, 3953 { "pass", PASS}, 3954 { "port", PORT}, 3955 { "priority", PRIORITY}, 3956 { "priq", PRIQ}, 3957 { "proto", PROTO}, 3958 { "qlimit", QLIMIT}, 3959 { "queue", QUEUE}, 3960 { "quick", QUICK}, 3961 { "random", RANDOM}, 3962 { "random-id", RANDOMID}, 3963 { "rdr", RDR}, 3964 { "rdr-anchor", RDRANCHOR}, 3965 { "realtime", REALTIME}, 3966 { "reassemble", REASSEMBLE}, 3967 { "reply-to", REPLYTO}, 3968 { "require-order", REQUIREORDER}, 3969 { "return", RETURN}, 3970 { "return-icmp", RETURNICMP}, 3971 { "return-icmp6", RETURNICMP6}, 3972 { "return-rst", RETURNRST}, 3973 { "round-robin", ROUNDROBIN}, 3974 { "route-to", ROUTETO}, 3975 { "scrub", SCRUB}, 3976 { "set", SET}, 3977 { "source-hash", SOURCEHASH}, 3978 { "state", STATE}, 3979 { "static-port", STATICPORT}, 3980 { "synproxy", SYNPROXY}, 3981 { "table", TABLE}, 3982 { "tag", TAG}, 3983 { "tagged", TAGGED}, 3984 { "tbrsize", TBRSIZE}, 3985 { "timeout", TIMEOUT}, 3986 { "to", TO}, 3987 { "tos", TOS}, 3988 { "ttl", TTL}, 3989 { "upperlimit", UPPERLIMIT}, 3990 { "user", USER}, 3991 }; 3992 const struct keywords *p; 3993 3994 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 3995 sizeof(keywords[0]), kw_cmp); 3996 3997 if (p) { 3998 if (debug > 1) 3999 fprintf(stderr, "%s: %d\n", s, p->k_val); 4000 return (p->k_val); 4001 } else { 4002 if (debug > 1) 4003 fprintf(stderr, "string: %s\n", s); 4004 return (STRING); 4005 } 4006} 4007 4008#define MAXPUSHBACK 128 4009 4010char *parsebuf; 4011int parseindex; 4012char pushback_buffer[MAXPUSHBACK]; 4013int pushback_index = 0; 4014 4015int 4016lgetc(FILE *f) 4017{ 4018 int c, next; 4019 4020 if (parsebuf) { 4021 /* Read character from the parsebuffer instead of input. */ 4022 if (parseindex >= 0) { 4023 c = parsebuf[parseindex++]; 4024 if (c != '\0') 4025 return (c); 4026 parsebuf = NULL; 4027 } else 4028 parseindex++; 4029 } 4030 4031 if (pushback_index) 4032 return (pushback_buffer[--pushback_index]); 4033 4034 while ((c = getc(f)) == '\\') { 4035 next = getc(f); 4036 if (next != '\n') { 4037 if (isspace(next)) 4038 yyerror("whitespace after \\"); 4039 ungetc(next, f); 4040 break; 4041 } 4042 yylval.lineno = lineno; 4043 lineno++; 4044 } 4045 if (c == '\t' || c == ' ') { 4046 /* Compress blanks to a single space. */ 4047 do { 4048 c = getc(f); 4049 } while (c == '\t' || c == ' '); 4050 ungetc(c, f); 4051 c = ' '; 4052 } 4053 4054 return (c); 4055} 4056 4057int 4058lungetc(int c) 4059{ 4060 if (c == EOF) 4061 return (EOF); 4062 if (parsebuf) { 4063 parseindex--; 4064 if (parseindex >= 0) 4065 return (c); 4066 } 4067 if (pushback_index < MAXPUSHBACK-1) 4068 return (pushback_buffer[pushback_index++] = c); 4069 else 4070 return (EOF); 4071} 4072 4073int 4074findeol(void) 4075{ 4076 int c; 4077 4078 parsebuf = NULL; 4079 pushback_index = 0; 4080 4081 /* skip to either EOF or the first real EOL */ 4082 while (1) { 4083 c = lgetc(fin); 4084 if (c == '\n') { 4085 lineno++; 4086 break; 4087 } 4088 if (c == EOF) 4089 break; 4090 } 4091 return (ERROR); 4092} 4093 4094int 4095yylex(void) 4096{ 4097 char buf[8096]; 4098 char *p, *val; 4099 int endc, c, next; 4100 int token; 4101 4102top: 4103 p = buf; 4104 while ((c = lgetc(fin)) == ' ') 4105 ; /* nothing */ 4106 4107 yylval.lineno = lineno; 4108 if (c == '#') 4109 while ((c = lgetc(fin)) != '\n' && c != EOF) 4110 ; /* nothing */ 4111 if (c == '$' && parsebuf == NULL) { 4112 while (1) { 4113 if ((c = lgetc(fin)) == EOF) 4114 return (0); 4115 4116 if (p + 1 >= buf + sizeof(buf) - 1) { 4117 yyerror("string too long"); 4118 return (findeol()); 4119 } 4120 if (isalnum(c) || c == '_') { 4121 *p++ = (char)c; 4122 continue; 4123 } 4124 *p = '\0'; 4125 lungetc(c); 4126 break; 4127 } 4128 val = symget(buf); 4129 if (val == NULL) { 4130 yyerror("macro '%s' not defined", buf); 4131 return (findeol()); 4132 } 4133 parsebuf = val; 4134 parseindex = 0; 4135 goto top; 4136 } 4137 4138 switch (c) { 4139 case '\'': 4140 case '"': 4141 endc = c; 4142 while (1) { 4143 if ((c = lgetc(fin)) == EOF) 4144 return (0); 4145 if (c == endc) { 4146 *p = '\0'; 4147 break; 4148 } 4149 if (c == '\n') { 4150 lineno++; 4151 continue; 4152 } 4153 if (p + 1 >= buf + sizeof(buf) - 1) { 4154 yyerror("string too long"); 4155 return (findeol()); 4156 } 4157 *p++ = (char)c; 4158 } 4159 yylval.v.string = strdup(buf); 4160 if (yylval.v.string == NULL) 4161 err(1, "yylex: strdup"); 4162 return (STRING); 4163 case '<': 4164 next = lgetc(fin); 4165 if (next == '>') { 4166 yylval.v.i = PF_OP_XRG; 4167 return (PORTBINARY); 4168 } 4169 lungetc(next); 4170 break; 4171 case '>': 4172 next = lgetc(fin); 4173 if (next == '<') { 4174 yylval.v.i = PF_OP_IRG; 4175 return (PORTBINARY); 4176 } 4177 lungetc(next); 4178 break; 4179 case '-': 4180 next = lgetc(fin); 4181 if (next == '>') 4182 return (ARROW); 4183 lungetc(next); 4184 break; 4185 } 4186 4187#define allowed_in_string(x) \ 4188 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4189 x != '{' && x != '}' && x != '<' && x != '>' && \ 4190 x != '!' && x != '=' && x != '/' && x != '#' && \ 4191 x != ',')) 4192 4193 if (isalnum(c) || c == ':' || c == '_') { 4194 do { 4195 *p++ = c; 4196 if ((unsigned)(p-buf) >= sizeof(buf)) { 4197 yyerror("string too long"); 4198 return (findeol()); 4199 } 4200 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4201 lungetc(c); 4202 *p = '\0'; 4203 token = lookup(buf); 4204 yylval.v.string = strdup(buf); 4205 if (yylval.v.string == NULL) 4206 err(1, "yylex: strdup"); 4207 return (token); 4208 } 4209 if (c == '\n') { 4210 yylval.lineno = lineno; 4211 lineno++; 4212 } 4213 if (c == EOF) 4214 return (0); 4215 return (c); 4216} 4217 4218int 4219parse_rules(FILE *input, struct pfctl *xpf) 4220{ 4221 struct sym *sym; 4222 4223 fin = input; 4224 pf = xpf; 4225 lineno = 1; 4226 errors = 0; 4227 rulestate = PFCTL_STATE_NONE; 4228 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4229 returnicmp6default = 4230 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4231 blockpolicy = PFRULE_DROP; 4232 require_order = 1; 4233 4234 yyparse(); 4235 4236 /* Free macros and check which have not been used. */ 4237 TAILQ_FOREACH(sym, &symhead, entries) { 4238 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 4239 fprintf(stderr, "warning: macro '%s' not " 4240 "used\n", sym->nam); 4241 free(sym->nam); 4242 free(sym->val); 4243 TAILQ_REMOVE(&symhead, sym, entries); 4244 } 4245 4246 return (errors ? -1 : 0); 4247} 4248 4249/* 4250 * Over-designed efficiency is a French and German concept, so how about 4251 * we wait until they discover this ugliness and make it all fancy. 4252 */ 4253int 4254symset(const char *nam, const char *val, int persist) 4255{ 4256 struct sym *sym; 4257 4258 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 4259 sym = TAILQ_NEXT(sym, entries)) 4260 ; /* nothing */ 4261 4262 if (sym != NULL) { 4263 if (sym->persist == 1) 4264 return (0); 4265 else { 4266 free(sym->nam); 4267 free(sym->val); 4268 TAILQ_REMOVE(&symhead, sym, entries); 4269 free(sym); 4270 } 4271 } 4272 if ((sym = calloc(1, sizeof(*sym))) == NULL) 4273 return (-1); 4274 4275 sym->nam = strdup(nam); 4276 if (sym->nam == NULL) { 4277 free(sym); 4278 return (-1); 4279 } 4280 sym->val = strdup(val); 4281 if (sym->val == NULL) { 4282 free(sym->nam); 4283 free(sym); 4284 return (-1); 4285 } 4286 sym->used = 0; 4287 sym->persist = persist; 4288 TAILQ_INSERT_TAIL(&symhead, sym, entries); 4289 return (0); 4290} 4291 4292int 4293pfctl_cmdline_symset(char *s) 4294{ 4295 char *sym, *val; 4296 int ret; 4297 4298 if ((val = strrchr(s, '=')) == NULL) 4299 return (-1); 4300 4301 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 4302 err(1, "pfctl_cmdline_symset: malloc"); 4303 4304 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 4305 4306 ret = symset(sym, val + 1, 1); 4307 free(sym); 4308 4309 return (ret); 4310} 4311 4312char * 4313symget(const char *nam) 4314{ 4315 struct sym *sym; 4316 4317 TAILQ_FOREACH(sym, &symhead, entries) 4318 if (strcmp(nam, sym->nam) == 0) { 4319 sym->used = 1; 4320 return (sym->val); 4321 } 4322 return (NULL); 4323} 4324 4325void 4326decide_address_family(struct node_host *n, sa_family_t *af) 4327{ 4328 sa_family_t target_af = 0; 4329 4330 while (!*af && n != NULL) { 4331 if (n->af) { 4332 if (target_af == 0) 4333 target_af = n->af; 4334 if (target_af != n->af) 4335 return; 4336 } 4337 n = n->next; 4338 } 4339 if (!*af && target_af) 4340 *af = target_af; 4341} 4342 4343void 4344remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 4345{ 4346 struct node_host *n = *nh, *prev = NULL; 4347 4348 while (n != NULL) { 4349 if (*af && n->af && n->af != *af) { 4350 /* unlink and free n */ 4351 struct node_host *next = n->next; 4352 4353 /* adjust tail pointer */ 4354 if (n == (*nh)->tail) 4355 (*nh)->tail = prev; 4356 /* adjust previous node's next pointer */ 4357 if (prev == NULL) 4358 *nh = next; 4359 else 4360 prev->next = next; 4361 /* free node */ 4362 if (n->ifname != NULL) 4363 free(n->ifname); 4364 free(n); 4365 n = next; 4366 } else { 4367 if (n->af && !*af) 4368 *af = n->af; 4369 prev = n; 4370 n = n->next; 4371 } 4372 } 4373} 4374 4375int 4376invalid_redirect(struct node_host *nh, sa_family_t af) 4377{ 4378 if (!af) { 4379 struct node_host *n; 4380 4381 /* only tables are ok without an address family */ 4382 for (n = nh; n != NULL; n = n->next) { 4383 if (n->addr.type != PF_ADDR_TABLE) { 4384 yyerror("address family not given and " 4385 "translation address expands to multiple " 4386 "address families"); 4387 return (1); 4388 } 4389 } 4390 } 4391 if (nh == NULL) { 4392 yyerror("no translation address with matching address family " 4393 "found."); 4394 return (1); 4395 } 4396 return (0); 4397} 4398 4399int 4400atoul(char *s, u_long *ulvalp) 4401{ 4402 u_long ulval; 4403 char *ep; 4404 4405 errno = 0; 4406 ulval = strtoul(s, &ep, 0); 4407 if (s[0] == '\0' || *ep != '\0') 4408 return (-1); 4409 if (errno == ERANGE && ulval == ULONG_MAX) 4410 return (-1); 4411 *ulvalp = ulval; 4412 return (0); 4413} 4414 4415int 4416getservice(char *n) 4417{ 4418 struct servent *s; 4419 u_long ulval; 4420 4421 if (atoul(n, &ulval) == 0) { 4422 if (ulval > 65535) { 4423 yyerror("illegal port value %d", ulval); 4424 return (-1); 4425 } 4426 return (htons(ulval)); 4427 } else { 4428 s = getservbyname(n, "tcp"); 4429 if (s == NULL) 4430 s = getservbyname(n, "udp"); 4431 if (s == NULL) { 4432 yyerror("unknown port %s", n); 4433 return (-1); 4434 } 4435 return (s->s_port); 4436 } 4437} 4438 4439int 4440rule_label(struct pf_rule *r, char *s) 4441{ 4442 if (s) { 4443 if (strlcpy(r->label, s, sizeof(r->label)) >= 4444 sizeof(r->label)) { 4445 yyerror("rule label too long (max %d chars)", 4446 sizeof(r->label)-1); 4447 return (-1); 4448 } 4449 } 4450 return (0); 4451} 4452 4453u_int16_t 4454parseicmpspec(char *w, sa_family_t af) 4455{ 4456 const struct icmpcodeent *p; 4457 u_long ulval; 4458 u_int8_t icmptype; 4459 4460 if (af == AF_INET) 4461 icmptype = returnicmpdefault >> 8; 4462 else 4463 icmptype = returnicmp6default >> 8; 4464 4465 if (atoul(w, &ulval) == -1) { 4466 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 4467 yyerror("unknown icmp code %s", w); 4468 return (0); 4469 } 4470 ulval = p->code; 4471 } 4472 if (ulval > 255) { 4473 yyerror("invalid icmp code %ld", ulval); 4474 return (0); 4475 } 4476 return (icmptype << 8 | ulval); 4477} 4478 4479int 4480pfctl_load_anchors(int dev, int opts) 4481{ 4482 struct loadanchors *la; 4483 4484 TAILQ_FOREACH(la, &loadanchorshead, entries) { 4485 if (opts & PF_OPT_VERBOSE) 4486 fprintf(stderr, "\nLoading anchor %s:%s from %s\n", 4487 la->anchorname, la->rulesetname, la->filename); 4488 if (pfctl_rules(dev, la->filename, opts, la->anchorname, 4489 la->rulesetname) == -1) 4490 return (-1); 4491 } 4492 4493 return (0); 4494} 4495 4496