parse.y revision 145840
1145840Smlaier/* $OpenBSD: parse.y,v 1.482 2005/03/07 13:20:03 henning Exp $ */ 2126353Smlaier 3126353Smlaier/* 4126353Smlaier * Copyright (c) 2001 Markus Friedl. All rights reserved. 5126353Smlaier * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6130617Smlaier * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7130617Smlaier * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8126353Smlaier * 9126353Smlaier * Redistribution and use in source and binary forms, with or without 10126353Smlaier * modification, are permitted provided that the following conditions 11126353Smlaier * are met: 12126353Smlaier * 1. Redistributions of source code must retain the above copyright 13126353Smlaier * notice, this list of conditions and the following disclaimer. 14126353Smlaier * 2. Redistributions in binary form must reproduce the above copyright 15126353Smlaier * notice, this list of conditions and the following disclaimer in the 16126353Smlaier * documentation and/or other materials provided with the distribution. 17126353Smlaier * 18126353Smlaier * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19126353Smlaier * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20126353Smlaier * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21126353Smlaier * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22126353Smlaier * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23126353Smlaier * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24126353Smlaier * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25126353Smlaier * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26126353Smlaier * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27126353Smlaier * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28126353Smlaier */ 29126353Smlaier%{ 30127082Sobrien#include <sys/cdefs.h> 31127082Sobrien__FBSDID("$FreeBSD: head/contrib/pf/pfctl/parse.y 145840 2005-05-03 16:55:20Z mlaier $"); 32127082Sobrien 33126353Smlaier#include <sys/types.h> 34126353Smlaier#include <sys/socket.h> 35126353Smlaier#include <net/if.h> 36126353Smlaier#include <netinet/in.h> 37126353Smlaier#include <netinet/in_systm.h> 38126353Smlaier#include <netinet/ip.h> 39126353Smlaier#include <netinet/ip_icmp.h> 40126353Smlaier#include <netinet/icmp6.h> 41126353Smlaier#include <net/pfvar.h> 42126353Smlaier#include <arpa/inet.h> 43126353Smlaier#include <altq/altq.h> 44126353Smlaier#include <altq/altq_cbq.h> 45126353Smlaier#include <altq/altq_priq.h> 46126353Smlaier#include <altq/altq_hfsc.h> 47126353Smlaier 48126353Smlaier#include <stdio.h> 49126353Smlaier#include <stdlib.h> 50126353Smlaier#include <netdb.h> 51126353Smlaier#include <stdarg.h> 52126353Smlaier#include <errno.h> 53126353Smlaier#include <string.h> 54126353Smlaier#include <ctype.h> 55145840Smlaier#include <math.h> 56126353Smlaier#include <err.h> 57127024Smlaier#include <limits.h> 58126353Smlaier#include <pwd.h> 59126353Smlaier#include <grp.h> 60126353Smlaier#include <md5.h> 61126353Smlaier 62126353Smlaier#include "pfctl_parser.h" 63126353Smlaier#include "pfctl.h" 64126353Smlaier 65127024Smlaier#ifdef __FreeBSD__ 66126361Smlaier#define HTONL(x) (x) = htonl((__uint32_t)(x)) 67126361Smlaier#endif 68126361Smlaier 69126353Smlaierstatic struct pfctl *pf = NULL; 70126353Smlaierstatic FILE *fin = NULL; 71126353Smlaierstatic int debug = 0; 72126353Smlaierstatic int lineno = 1; 73126353Smlaierstatic int errors = 0; 74126353Smlaierstatic int rulestate = 0; 75126353Smlaierstatic u_int16_t returnicmpdefault = 76126353Smlaier (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 77126353Smlaierstatic u_int16_t returnicmp6default = 78126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 79126353Smlaierstatic int blockpolicy = PFRULE_DROP; 80126353Smlaierstatic int require_order = 1; 81130617Smlaierstatic int default_statelock; 82126353Smlaier 83126353Smlaierenum { 84126353Smlaier PFCTL_STATE_NONE, 85126353Smlaier PFCTL_STATE_OPTION, 86126353Smlaier PFCTL_STATE_SCRUB, 87126353Smlaier PFCTL_STATE_QUEUE, 88126353Smlaier PFCTL_STATE_NAT, 89126353Smlaier PFCTL_STATE_FILTER 90126353Smlaier}; 91126353Smlaier 92126353Smlaierstruct node_proto { 93126353Smlaier u_int8_t proto; 94126353Smlaier struct node_proto *next; 95126353Smlaier struct node_proto *tail; 96126353Smlaier}; 97126353Smlaier 98126353Smlaierstruct node_port { 99126353Smlaier u_int16_t port[2]; 100126353Smlaier u_int8_t op; 101126353Smlaier struct node_port *next; 102126353Smlaier struct node_port *tail; 103126353Smlaier}; 104126353Smlaier 105126353Smlaierstruct node_uid { 106126353Smlaier uid_t uid[2]; 107126353Smlaier u_int8_t op; 108126353Smlaier struct node_uid *next; 109126353Smlaier struct node_uid *tail; 110126353Smlaier}; 111126353Smlaier 112126353Smlaierstruct node_gid { 113126353Smlaier gid_t gid[2]; 114126353Smlaier u_int8_t op; 115126353Smlaier struct node_gid *next; 116126353Smlaier struct node_gid *tail; 117126353Smlaier}; 118126353Smlaier 119126353Smlaierstruct node_icmp { 120126353Smlaier u_int8_t code; 121126353Smlaier u_int8_t type; 122126353Smlaier u_int8_t proto; 123126353Smlaier struct node_icmp *next; 124126353Smlaier struct node_icmp *tail; 125126353Smlaier}; 126126353Smlaier 127130617Smlaierenum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 128145840Smlaier PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 129145840Smlaier PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 130145840Smlaier PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 131145840Smlaier PF_STATE_OPT_TIMEOUT }; 132130617Smlaier 133130617Smlaierenum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 134130617Smlaier 135126353Smlaierstruct node_state_opt { 136126353Smlaier int type; 137126353Smlaier union { 138126353Smlaier u_int32_t max_states; 139130617Smlaier u_int32_t max_src_states; 140145840Smlaier u_int32_t max_src_conn; 141145840Smlaier struct { 142145840Smlaier u_int32_t limit; 143145840Smlaier u_int32_t seconds; 144145840Smlaier } max_src_conn_rate; 145145840Smlaier struct { 146145840Smlaier u_int8_t flush; 147145840Smlaier char tblname[PF_TABLE_NAME_SIZE]; 148145840Smlaier } overload; 149130617Smlaier u_int32_t max_src_nodes; 150130617Smlaier u_int8_t src_track; 151130617Smlaier u_int32_t statelock; 152126353Smlaier struct { 153126353Smlaier int number; 154126353Smlaier u_int32_t seconds; 155126353Smlaier } timeout; 156126353Smlaier } data; 157126353Smlaier struct node_state_opt *next; 158126353Smlaier struct node_state_opt *tail; 159126353Smlaier}; 160126353Smlaier 161126353Smlaierstruct peer { 162126353Smlaier struct node_host *host; 163126353Smlaier struct node_port *port; 164126353Smlaier}; 165126353Smlaier 166126353Smlaierstruct node_queue { 167126353Smlaier char queue[PF_QNAME_SIZE]; 168126353Smlaier char parent[PF_QNAME_SIZE]; 169126353Smlaier char ifname[IFNAMSIZ]; 170126353Smlaier int scheduler; 171126353Smlaier struct node_queue *next; 172126353Smlaier struct node_queue *tail; 173126353Smlaier} *queues = NULL; 174126353Smlaier 175126353Smlaierstruct node_qassign { 176126353Smlaier char *qname; 177126353Smlaier char *pqname; 178126353Smlaier}; 179126353Smlaier 180126353Smlaierstruct filter_opts { 181126353Smlaier int marker; 182126353Smlaier#define FOM_FLAGS 0x01 183126353Smlaier#define FOM_ICMP 0x02 184126353Smlaier#define FOM_TOS 0x04 185126353Smlaier#define FOM_KEEP 0x08 186130617Smlaier#define FOM_SRCTRACK 0x10 187126353Smlaier struct node_uid *uid; 188126353Smlaier struct node_gid *gid; 189126353Smlaier struct { 190126353Smlaier u_int8_t b1; 191126353Smlaier u_int8_t b2; 192126353Smlaier u_int16_t w; 193126353Smlaier u_int16_t w2; 194126353Smlaier } flags; 195126353Smlaier struct node_icmp *icmpspec; 196126353Smlaier u_int32_t tos; 197145840Smlaier u_int32_t prob; 198126353Smlaier struct { 199126353Smlaier int action; 200126353Smlaier struct node_state_opt *options; 201126353Smlaier } keep; 202126353Smlaier int fragment; 203126353Smlaier int allowopts; 204126353Smlaier char *label; 205126353Smlaier struct node_qassign queues; 206126353Smlaier char *tag; 207126353Smlaier char *match_tag; 208126353Smlaier u_int8_t match_tag_not; 209126353Smlaier} filter_opts; 210126353Smlaier 211126353Smlaierstruct antispoof_opts { 212126353Smlaier char *label; 213126353Smlaier} antispoof_opts; 214126353Smlaier 215126353Smlaierstruct scrub_opts { 216126353Smlaier int marker; 217126353Smlaier#define SOM_MINTTL 0x01 218126353Smlaier#define SOM_MAXMSS 0x02 219126353Smlaier#define SOM_FRAGCACHE 0x04 220126353Smlaier int nodf; 221126353Smlaier int minttl; 222126353Smlaier int maxmss; 223126353Smlaier int fragcache; 224126353Smlaier int randomid; 225126353Smlaier int reassemble_tcp; 226126353Smlaier} scrub_opts; 227126353Smlaier 228126353Smlaierstruct queue_opts { 229126353Smlaier int marker; 230126353Smlaier#define QOM_BWSPEC 0x01 231126353Smlaier#define QOM_SCHEDULER 0x02 232126353Smlaier#define QOM_PRIORITY 0x04 233126353Smlaier#define QOM_TBRSIZE 0x08 234126353Smlaier#define QOM_QLIMIT 0x10 235126353Smlaier struct node_queue_bw queue_bwspec; 236126353Smlaier struct node_queue_opt scheduler; 237126353Smlaier int priority; 238126353Smlaier int tbrsize; 239126353Smlaier int qlimit; 240126353Smlaier} queue_opts; 241126353Smlaier 242126353Smlaierstruct table_opts { 243126353Smlaier int flags; 244126353Smlaier int init_addr; 245126353Smlaier struct node_tinithead init_nodes; 246126353Smlaier} table_opts; 247126353Smlaier 248130617Smlaierstruct pool_opts { 249130617Smlaier int marker; 250130617Smlaier#define POM_TYPE 0x01 251130617Smlaier#define POM_STICKYADDRESS 0x02 252130617Smlaier u_int8_t opts; 253130617Smlaier int type; 254130617Smlaier int staticport; 255130617Smlaier struct pf_poolhashkey *key; 256130617Smlaier 257130617Smlaier} pool_opts; 258130617Smlaier 259130617Smlaier 260126353Smlaierstruct node_hfsc_opts hfsc_opts; 261126353Smlaier 262126353Smlaierint yyerror(const char *, ...); 263126353Smlaierint disallow_table(struct node_host *, const char *); 264130617Smlaierint disallow_alias(struct node_host *, const char *); 265126353Smlaierint rule_consistent(struct pf_rule *); 266126353Smlaierint filter_consistent(struct pf_rule *); 267126353Smlaierint nat_consistent(struct pf_rule *); 268126353Smlaierint rdr_consistent(struct pf_rule *); 269126353Smlaierint process_tabledef(char *, struct table_opts *); 270126353Smlaierint yyparse(void); 271130617Smlaiervoid expand_label_str(char *, size_t, const char *, const char *); 272130617Smlaiervoid expand_label_if(const char *, char *, size_t, const char *); 273130617Smlaiervoid expand_label_addr(const char *, char *, size_t, u_int8_t, 274130617Smlaier struct node_host *); 275130617Smlaiervoid expand_label_port(const char *, char *, size_t, struct node_port *); 276130617Smlaiervoid expand_label_proto(const char *, char *, size_t, u_int8_t); 277130617Smlaiervoid expand_label_nr(const char *, char *, size_t); 278130617Smlaiervoid expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 279126353Smlaier struct node_port *, struct node_host *, struct node_port *, 280126353Smlaier u_int8_t); 281126353Smlaiervoid expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 282126353Smlaier struct node_proto *, struct node_os*, struct node_host *, 283126353Smlaier struct node_port *, struct node_host *, struct node_port *, 284145840Smlaier struct node_uid *, struct node_gid *, struct node_icmp *, 285145840Smlaier const char *); 286126353Smlaierint expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 287126353Smlaier struct node_queue_bw bwspec, struct node_queue_opt *); 288126353Smlaierint expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 289126353Smlaier struct node_queue_bw, struct node_queue_opt *); 290145840Smlaierint expand_skip_interface(struct node_if *); 291126353Smlaier 292126353Smlaierint check_rulestate(int); 293126353Smlaierint kw_cmp(const void *, const void *); 294126353Smlaierint lookup(char *); 295126353Smlaierint lgetc(FILE *); 296126353Smlaierint lungetc(int); 297126353Smlaierint findeol(void); 298126353Smlaierint yylex(void); 299126353Smlaierint atoul(char *, u_long *); 300126353Smlaierint getservice(char *); 301126353Smlaierint rule_label(struct pf_rule *, char *); 302126353Smlaier 303126353SmlaierTAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 304126353Smlaierstruct sym { 305126353Smlaier TAILQ_ENTRY(sym) entries; 306126353Smlaier int used; 307126353Smlaier int persist; 308126353Smlaier char *nam; 309126353Smlaier char *val; 310126353Smlaier}; 311126353Smlaier 312126353Smlaier 313126353Smlaierint symset(const char *, const char *, int); 314126353Smlaierchar *symget(const char *); 315126353Smlaier 316126353Smlaiervoid decide_address_family(struct node_host *, sa_family_t *); 317126353Smlaiervoid remove_invalid_hosts(struct node_host **, sa_family_t *); 318126353Smlaierint invalid_redirect(struct node_host *, sa_family_t); 319126353Smlaieru_int16_t parseicmpspec(char *, sa_family_t); 320126353Smlaier 321130617SmlaierTAILQ_HEAD(loadanchorshead, loadanchors) 322130617Smlaier loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 323130617Smlaier 324126353Smlaierstruct loadanchors { 325126353Smlaier TAILQ_ENTRY(loadanchors) entries; 326126353Smlaier char *anchorname; 327126353Smlaier char *filename; 328126353Smlaier}; 329126353Smlaier 330126353Smlaiertypedef struct { 331126353Smlaier union { 332126353Smlaier u_int32_t number; 333126353Smlaier int i; 334126353Smlaier char *string; 335126353Smlaier struct { 336126353Smlaier u_int8_t b1; 337126353Smlaier u_int8_t b2; 338126353Smlaier u_int16_t w; 339126353Smlaier u_int16_t w2; 340126353Smlaier } b; 341126353Smlaier struct range { 342126353Smlaier int a; 343126353Smlaier int b; 344126353Smlaier int t; 345126353Smlaier } range; 346126353Smlaier struct node_if *interface; 347126353Smlaier struct node_proto *proto; 348126353Smlaier struct node_icmp *icmp; 349126353Smlaier struct node_host *host; 350126353Smlaier struct node_os *os; 351126353Smlaier struct node_port *port; 352126353Smlaier struct node_uid *uid; 353126353Smlaier struct node_gid *gid; 354126353Smlaier struct node_state_opt *state_opt; 355126353Smlaier struct peer peer; 356126353Smlaier struct { 357126353Smlaier struct peer src, dst; 358126353Smlaier struct node_os *src_os; 359126353Smlaier } fromto; 360126353Smlaier struct { 361126353Smlaier struct node_host *host; 362126353Smlaier u_int8_t rt; 363126353Smlaier u_int8_t pool_opts; 364126353Smlaier sa_family_t af; 365126353Smlaier struct pf_poolhashkey *key; 366126353Smlaier } route; 367126353Smlaier struct redirection { 368126353Smlaier struct node_host *host; 369126353Smlaier struct range rport; 370126353Smlaier } *redirection; 371126353Smlaier struct { 372126353Smlaier int action; 373126353Smlaier struct node_state_opt *options; 374126353Smlaier } keep_state; 375126353Smlaier struct { 376126353Smlaier u_int8_t log; 377126353Smlaier u_int8_t quick; 378126353Smlaier } logquick; 379145840Smlaier struct { 380145840Smlaier int neg; 381145840Smlaier char *name; 382145840Smlaier } tagged; 383130617Smlaier struct pf_poolhashkey *hashkey; 384126353Smlaier struct node_queue *queue; 385126353Smlaier struct node_queue_opt queue_options; 386126353Smlaier struct node_queue_bw queue_bwspec; 387126353Smlaier struct node_qassign qassign; 388126353Smlaier struct filter_opts filter_opts; 389126353Smlaier struct antispoof_opts antispoof_opts; 390126353Smlaier struct queue_opts queue_opts; 391126353Smlaier struct scrub_opts scrub_opts; 392126353Smlaier struct table_opts table_opts; 393130617Smlaier struct pool_opts pool_opts; 394126353Smlaier struct node_hfsc_opts hfsc_opts; 395126353Smlaier } v; 396126353Smlaier int lineno; 397126353Smlaier} YYSTYPE; 398126353Smlaier 399130617Smlaier#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 400130617Smlaier (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 401130617Smlaier !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 402130617Smlaier 403126353Smlaier%} 404126353Smlaier 405126353Smlaier%token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS 406126353Smlaier%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 407126353Smlaier%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 408126353Smlaier%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 409126353Smlaier%token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 410126353Smlaier%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 411126353Smlaier%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 412145840Smlaier%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 413126353Smlaier%token ANTISPOOF FOR 414145840Smlaier%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 415126353Smlaier%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 416126353Smlaier%token QUEUE PRIORITY QLIMIT 417126353Smlaier%token LOAD 418130617Smlaier%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 419145840Smlaier%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH 420145840Smlaier%token TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY ROUTE 421126353Smlaier%token <v.string> STRING 422126353Smlaier%token <v.i> PORTBINARY 423126353Smlaier%type <v.interface> interface if_list if_item_not if_item 424126353Smlaier%type <v.number> number icmptype icmp6type uid gid 425126353Smlaier%type <v.number> tos not yesno natpass 426145840Smlaier%type <v.i> no dir log af fragcache sourcetrack flush 427130617Smlaier%type <v.i> unaryop statelock 428145840Smlaier%type <v.b> action nataction scrubaction 429145840Smlaier%type <v.b> flags flag blockspec 430126353Smlaier%type <v.range> port rport 431126353Smlaier%type <v.hashkey> hashkey 432126353Smlaier%type <v.proto> proto proto_list proto_item 433126353Smlaier%type <v.icmp> icmpspec 434126353Smlaier%type <v.icmp> icmp_list icmp_item 435126353Smlaier%type <v.icmp> icmp6_list icmp6_item 436126353Smlaier%type <v.fromto> fromto 437126353Smlaier%type <v.peer> ipportspec from to 438126353Smlaier%type <v.host> ipspec xhost host dynaddr host_list 439126353Smlaier%type <v.host> redir_host_list redirspec 440126353Smlaier%type <v.host> route_host route_host_list routespec 441126353Smlaier%type <v.os> os xos os_list 442126353Smlaier%type <v.port> portspec port_list port_item 443126353Smlaier%type <v.uid> uids uid_list uid_item 444126353Smlaier%type <v.gid> gids gid_list gid_item 445126353Smlaier%type <v.route> route 446126353Smlaier%type <v.redirection> redirection redirpool 447126353Smlaier%type <v.string> label string tag 448126353Smlaier%type <v.keep_state> keep 449126353Smlaier%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 450126353Smlaier%type <v.logquick> logquick 451145840Smlaier%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 452126353Smlaier%type <v.qassign> qname 453126353Smlaier%type <v.queue> qassign qassign_list qassign_item 454126353Smlaier%type <v.queue_options> scheduler 455126353Smlaier%type <v.number> cbqflags_list cbqflags_item 456126353Smlaier%type <v.number> priqflags_list priqflags_item 457126353Smlaier%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 458126353Smlaier%type <v.queue_bwspec> bandwidth 459126353Smlaier%type <v.filter_opts> filter_opts filter_opt filter_opts_l 460126353Smlaier%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 461126353Smlaier%type <v.queue_opts> queue_opts queue_opt queue_opts_l 462126353Smlaier%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 463126353Smlaier%type <v.table_opts> table_opts table_opt table_opts_l 464130617Smlaier%type <v.pool_opts> pool_opts pool_opt pool_opts_l 465145840Smlaier%type <v.tagged> tagged 466126353Smlaier%% 467126353Smlaier 468126353Smlaierruleset : /* empty */ 469126353Smlaier | ruleset '\n' 470126353Smlaier | ruleset option '\n' 471126353Smlaier | ruleset scrubrule '\n' 472126353Smlaier | ruleset natrule '\n' 473126353Smlaier | ruleset binatrule '\n' 474126353Smlaier | ruleset pfrule '\n' 475126353Smlaier | ruleset anchorrule '\n' 476126353Smlaier | ruleset loadrule '\n' 477126353Smlaier | ruleset altqif '\n' 478126353Smlaier | ruleset queuespec '\n' 479126353Smlaier | ruleset varset '\n' 480126353Smlaier | ruleset antispoof '\n' 481126353Smlaier | ruleset tabledef '\n' 482126353Smlaier | ruleset error '\n' { errors++; } 483126353Smlaier ; 484126353Smlaier 485126353Smlaieroption : SET OPTIMIZATION STRING { 486130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 487130617Smlaier free($3); 488126353Smlaier YYERROR; 489130617Smlaier } 490126353Smlaier if (pfctl_set_optimization(pf, $3) != 0) { 491126353Smlaier yyerror("unknown optimization %s", $3); 492130617Smlaier free($3); 493126353Smlaier YYERROR; 494126353Smlaier } 495130617Smlaier free ($3); 496126353Smlaier } 497126353Smlaier | SET TIMEOUT timeout_spec 498126353Smlaier | SET TIMEOUT '{' timeout_list '}' 499126353Smlaier | SET LIMIT limit_spec 500126353Smlaier | SET LIMIT '{' limit_list '}' 501126353Smlaier | SET LOGINTERFACE STRING { 502130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 503130617Smlaier free($3); 504126353Smlaier YYERROR; 505130617Smlaier } 506126353Smlaier if (pfctl_set_logif(pf, $3) != 0) { 507126353Smlaier yyerror("error setting loginterface %s", $3); 508130617Smlaier free($3); 509126353Smlaier YYERROR; 510126353Smlaier } 511130617Smlaier free($3); 512126353Smlaier } 513130617Smlaier | SET HOSTID number { 514130617Smlaier if ($3 == 0) { 515130617Smlaier yyerror("hostid must be non-zero"); 516130617Smlaier YYERROR; 517130617Smlaier } 518130617Smlaier if (pfctl_set_hostid(pf, $3) != 0) { 519145840Smlaier yyerror("error setting hostid %08x", $3); 520130617Smlaier YYERROR; 521130617Smlaier } 522130617Smlaier } 523126353Smlaier | SET BLOCKPOLICY DROP { 524126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 525126353Smlaier printf("set block-policy drop\n"); 526126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 527126353Smlaier YYERROR; 528126353Smlaier blockpolicy = PFRULE_DROP; 529126353Smlaier } 530126353Smlaier | SET BLOCKPOLICY RETURN { 531126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 532126353Smlaier printf("set block-policy return\n"); 533126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 534126353Smlaier YYERROR; 535126353Smlaier blockpolicy = PFRULE_RETURN; 536126353Smlaier } 537126353Smlaier | SET REQUIREORDER yesno { 538126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 539126353Smlaier printf("set require-order %s\n", 540126353Smlaier $3 == 1 ? "yes" : "no"); 541126353Smlaier require_order = $3; 542126353Smlaier } 543126353Smlaier | SET FINGERPRINTS STRING { 544126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 545145840Smlaier printf("set fingerprints %s\n", $3); 546130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 547130617Smlaier free($3); 548126353Smlaier YYERROR; 549130617Smlaier } 550145840Smlaier if (!pf->anchor[0]) { 551145840Smlaier if (pfctl_file_fingerprints(pf->dev, 552145840Smlaier pf->opts, $3)) { 553145840Smlaier yyerror("error loading " 554145840Smlaier "fingerprints %s", $3); 555145840Smlaier free($3); 556145840Smlaier YYERROR; 557145840Smlaier } 558126353Smlaier } 559130617Smlaier free($3); 560126353Smlaier } 561130617Smlaier | SET STATEPOLICY statelock { 562130617Smlaier if (pf->opts & PF_OPT_VERBOSE) 563130617Smlaier switch ($3) { 564130617Smlaier case 0: 565130617Smlaier printf("set state-policy floating\n"); 566130617Smlaier break; 567130617Smlaier case PFRULE_IFBOUND: 568130617Smlaier printf("set state-policy if-bound\n"); 569130617Smlaier break; 570130617Smlaier case PFRULE_GRBOUND: 571130617Smlaier printf("set state-policy " 572130617Smlaier "group-bound\n"); 573130617Smlaier break; 574130617Smlaier } 575130617Smlaier default_statelock = $3; 576130617Smlaier } 577130617Smlaier | SET DEBUG STRING { 578130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 579130617Smlaier free($3); 580130617Smlaier YYERROR; 581130617Smlaier } 582130617Smlaier if (pfctl_set_debug(pf, $3) != 0) { 583130617Smlaier yyerror("error setting debuglevel %s", $3); 584130617Smlaier free($3); 585130617Smlaier YYERROR; 586130617Smlaier } 587130617Smlaier free($3); 588130617Smlaier } 589145840Smlaier | SET SKIP interface { 590145840Smlaier if (expand_skip_interface($3) != 0) { 591145840Smlaier yyerror("error setting skip interface(s)"); 592145840Smlaier YYERROR; 593145840Smlaier } 594145840Smlaier } 595126353Smlaier ; 596126353Smlaier 597126353Smlaierstring : string STRING { 598126353Smlaier if (asprintf(&$$, "%s %s", $1, $2) == -1) 599126353Smlaier err(1, "string: asprintf"); 600126353Smlaier free($1); 601126353Smlaier free($2); 602126353Smlaier } 603126353Smlaier | STRING 604126353Smlaier ; 605126353Smlaier 606126353Smlaiervarset : STRING '=' string { 607126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 608126353Smlaier printf("%s = \"%s\"\n", $1, $3); 609126353Smlaier if (symset($1, $3, 0) == -1) 610126353Smlaier err(1, "cannot store variable %s", $1); 611130617Smlaier free($1); 612130617Smlaier free($3); 613126353Smlaier } 614126353Smlaier ; 615126353Smlaier 616130617Smlaieranchorrule : ANCHOR string dir interface af proto fromto filter_opts { 617126353Smlaier struct pf_rule r; 618126353Smlaier 619130617Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) { 620130617Smlaier free($2); 621126353Smlaier YYERROR; 622130617Smlaier } 623126353Smlaier 624145840Smlaier memset(&r, 0, sizeof(r)); 625126353Smlaier r.direction = $3; 626126353Smlaier r.af = $5; 627145840Smlaier r.prob = $8.prob; 628126353Smlaier 629130617Smlaier if ($8.match_tag) 630130617Smlaier if (strlcpy(r.match_tagname, $8.match_tag, 631130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 632130617Smlaier yyerror("tag too long, max %u chars", 633130617Smlaier PF_TAG_NAME_SIZE - 1); 634130617Smlaier YYERROR; 635130617Smlaier } 636130617Smlaier r.match_tag_not = $8.match_tag_not; 637130617Smlaier 638126353Smlaier decide_address_family($7.src.host, &r.af); 639126353Smlaier decide_address_family($7.dst.host, &r.af); 640126353Smlaier 641126353Smlaier expand_rule(&r, $4, NULL, $6, $7.src_os, 642126353Smlaier $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 643145840Smlaier 0, 0, 0, $2); 644145840Smlaier free($2); 645126353Smlaier } 646126353Smlaier | NATANCHOR string interface af proto fromto { 647126353Smlaier struct pf_rule r; 648126353Smlaier 649130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 650130617Smlaier free($2); 651126353Smlaier YYERROR; 652130617Smlaier } 653126353Smlaier 654145840Smlaier memset(&r, 0, sizeof(r)); 655126353Smlaier r.action = PF_NAT; 656126353Smlaier r.af = $4; 657126353Smlaier 658126353Smlaier decide_address_family($6.src.host, &r.af); 659126353Smlaier decide_address_family($6.dst.host, &r.af); 660126353Smlaier 661126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 662126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 663145840Smlaier 0, 0, 0, $2); 664145840Smlaier free($2); 665126353Smlaier } 666126353Smlaier | RDRANCHOR string interface af proto fromto { 667126353Smlaier struct pf_rule r; 668126353Smlaier 669130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 670130617Smlaier free($2); 671126353Smlaier YYERROR; 672130617Smlaier } 673126353Smlaier 674145840Smlaier memset(&r, 0, sizeof(r)); 675126353Smlaier r.action = PF_RDR; 676126353Smlaier r.af = $4; 677126353Smlaier 678126353Smlaier decide_address_family($6.src.host, &r.af); 679126353Smlaier decide_address_family($6.dst.host, &r.af); 680126353Smlaier 681126353Smlaier if ($6.src.port != NULL) { 682126353Smlaier yyerror("source port parameter not supported" 683126353Smlaier " in rdr-anchor"); 684126353Smlaier YYERROR; 685126353Smlaier } 686126353Smlaier if ($6.dst.port != NULL) { 687126353Smlaier if ($6.dst.port->next != NULL) { 688126353Smlaier yyerror("destination port list " 689126353Smlaier "expansion not supported in " 690126353Smlaier "rdr-anchor"); 691126353Smlaier YYERROR; 692126353Smlaier } else if ($6.dst.port->op != PF_OP_EQ) { 693126353Smlaier yyerror("destination port operators" 694126353Smlaier " not supported in rdr-anchor"); 695126353Smlaier YYERROR; 696126353Smlaier } 697126353Smlaier r.dst.port[0] = $6.dst.port->port[0]; 698126353Smlaier r.dst.port[1] = $6.dst.port->port[1]; 699126353Smlaier r.dst.port_op = $6.dst.port->op; 700126353Smlaier } 701126353Smlaier 702126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 703126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 704145840Smlaier 0, 0, 0, $2); 705145840Smlaier free($2); 706126353Smlaier } 707126353Smlaier | BINATANCHOR string interface af proto fromto { 708126353Smlaier struct pf_rule r; 709126353Smlaier 710130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 711130617Smlaier free($2); 712126353Smlaier YYERROR; 713130617Smlaier } 714126353Smlaier 715145840Smlaier memset(&r, 0, sizeof(r)); 716126353Smlaier r.action = PF_BINAT; 717126353Smlaier r.af = $4; 718126353Smlaier if ($5 != NULL) { 719126353Smlaier if ($5->next != NULL) { 720126353Smlaier yyerror("proto list expansion" 721126353Smlaier " not supported in binat-anchor"); 722126353Smlaier YYERROR; 723126353Smlaier } 724126353Smlaier r.proto = $5->proto; 725126353Smlaier free($5); 726126353Smlaier } 727126353Smlaier 728126353Smlaier if ($6.src.host != NULL || $6.src.port != NULL || 729126353Smlaier $6.dst.host != NULL || $6.dst.port != NULL) { 730126353Smlaier yyerror("fromto parameter not supported" 731126353Smlaier " in binat-anchor"); 732126353Smlaier YYERROR; 733126353Smlaier } 734126353Smlaier 735126353Smlaier decide_address_family($6.src.host, &r.af); 736126353Smlaier decide_address_family($6.dst.host, &r.af); 737126353Smlaier 738145840Smlaier pfctl_add_rule(pf, &r, $2); 739145840Smlaier free($2); 740126353Smlaier } 741126353Smlaier ; 742126353Smlaier 743126353Smlaierloadrule : LOAD ANCHOR string FROM string { 744126353Smlaier struct loadanchors *loadanchor; 745126353Smlaier 746145840Smlaier if (strlen($3) >= MAXPATHLEN) { 747126353Smlaier yyerror("anchorname %s too long, max %u\n", 748145840Smlaier $3, MAXPATHLEN - 1); 749145840Smlaier free($3); 750126353Smlaier YYERROR; 751126353Smlaier } 752126353Smlaier loadanchor = calloc(1, sizeof(struct loadanchors)); 753126353Smlaier if (loadanchor == NULL) 754126353Smlaier err(1, "loadrule: calloc"); 755145840Smlaier if ((loadanchor->anchorname = strdup($3)) == NULL) 756126353Smlaier err(1, "loadrule: strdup"); 757126353Smlaier if ((loadanchor->filename = strdup($5)) == NULL) 758126353Smlaier err(1, "loadrule: strdup"); 759126353Smlaier 760126353Smlaier TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 761126353Smlaier entries); 762126353Smlaier 763145840Smlaier free($3); 764126353Smlaier free($5); 765126353Smlaier }; 766126353Smlaier 767145840Smlaierscrubaction : no SCRUB { 768145840Smlaier $$.b2 = $$.w = 0; 769145840Smlaier if ($1) 770145840Smlaier $$.b1 = PF_NOSCRUB; 771145840Smlaier else 772145840Smlaier $$.b1 = PF_SCRUB; 773145840Smlaier } 774145840Smlaier ; 775145840Smlaier 776145840Smlaierscrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 777126353Smlaier { 778126353Smlaier struct pf_rule r; 779126353Smlaier 780126353Smlaier if (check_rulestate(PFCTL_STATE_SCRUB)) 781126353Smlaier YYERROR; 782126353Smlaier 783126353Smlaier memset(&r, 0, sizeof(r)); 784126353Smlaier 785145840Smlaier r.action = $1.b1; 786126353Smlaier r.direction = $2; 787126353Smlaier 788126353Smlaier r.log = $3.log; 789126353Smlaier if ($3.quick) { 790126353Smlaier yyerror("scrub rules do not support 'quick'"); 791126353Smlaier YYERROR; 792126353Smlaier } 793126353Smlaier 794126353Smlaier r.af = $5; 795126353Smlaier if ($8.nodf) 796126353Smlaier r.rule_flag |= PFRULE_NODF; 797126353Smlaier if ($8.randomid) 798126353Smlaier r.rule_flag |= PFRULE_RANDOMID; 799126353Smlaier if ($8.reassemble_tcp) { 800126353Smlaier if (r.direction != PF_INOUT) { 801126353Smlaier yyerror("reassemble tcp rules can not " 802126353Smlaier "specify direction"); 803126353Smlaier YYERROR; 804126353Smlaier } 805126353Smlaier r.rule_flag |= PFRULE_REASSEMBLE_TCP; 806126353Smlaier } 807126353Smlaier if ($8.minttl) 808126353Smlaier r.min_ttl = $8.minttl; 809126353Smlaier if ($8.maxmss) 810126353Smlaier r.max_mss = $8.maxmss; 811126353Smlaier if ($8.fragcache) 812126353Smlaier r.rule_flag |= $8.fragcache; 813126353Smlaier 814126353Smlaier expand_rule(&r, $4, NULL, $6, $7.src_os, 815126353Smlaier $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 816145840Smlaier NULL, NULL, NULL, ""); 817126353Smlaier } 818126353Smlaier ; 819126353Smlaier 820126353Smlaierscrub_opts : { 821126353Smlaier bzero(&scrub_opts, sizeof scrub_opts); 822126353Smlaier } 823130617Smlaier scrub_opts_l 824126353Smlaier { $$ = scrub_opts; } 825126353Smlaier | /* empty */ { 826126353Smlaier bzero(&scrub_opts, sizeof scrub_opts); 827126353Smlaier $$ = scrub_opts; 828126353Smlaier } 829126353Smlaier ; 830126353Smlaier 831126353Smlaierscrub_opts_l : scrub_opts_l scrub_opt 832126353Smlaier | scrub_opt 833126353Smlaier ; 834126353Smlaier 835126353Smlaierscrub_opt : NODF { 836126353Smlaier if (scrub_opts.nodf) { 837126353Smlaier yyerror("no-df cannot be respecified"); 838126353Smlaier YYERROR; 839126353Smlaier } 840126353Smlaier scrub_opts.nodf = 1; 841126353Smlaier } 842126353Smlaier | MINTTL number { 843126353Smlaier if (scrub_opts.marker & SOM_MINTTL) { 844126353Smlaier yyerror("min-ttl cannot be respecified"); 845126353Smlaier YYERROR; 846126353Smlaier } 847126353Smlaier if ($2 > 255) { 848126353Smlaier yyerror("illegal min-ttl value %d", $2); 849126353Smlaier YYERROR; 850126353Smlaier } 851126353Smlaier scrub_opts.marker |= SOM_MINTTL; 852126353Smlaier scrub_opts.minttl = $2; 853126353Smlaier } 854126353Smlaier | MAXMSS number { 855126353Smlaier if (scrub_opts.marker & SOM_MAXMSS) { 856126353Smlaier yyerror("max-mss cannot be respecified"); 857126353Smlaier YYERROR; 858126353Smlaier } 859126353Smlaier if ($2 > 65535) { 860126353Smlaier yyerror("illegal max-mss value %d", $2); 861126353Smlaier YYERROR; 862126353Smlaier } 863126353Smlaier scrub_opts.marker |= SOM_MAXMSS; 864126353Smlaier scrub_opts.maxmss = $2; 865126353Smlaier } 866126353Smlaier | fragcache { 867126353Smlaier if (scrub_opts.marker & SOM_FRAGCACHE) { 868126353Smlaier yyerror("fragcache cannot be respecified"); 869126353Smlaier YYERROR; 870126353Smlaier } 871126353Smlaier scrub_opts.marker |= SOM_FRAGCACHE; 872126353Smlaier scrub_opts.fragcache = $1; 873126353Smlaier } 874126353Smlaier | REASSEMBLE STRING { 875130617Smlaier if (strcasecmp($2, "tcp") != 0) { 876145840Smlaier yyerror("scrub reassemble supports only tcp, " 877145840Smlaier "not '%s'", $2); 878130617Smlaier free($2); 879126353Smlaier YYERROR; 880130617Smlaier } 881130617Smlaier free($2); 882126353Smlaier if (scrub_opts.reassemble_tcp) { 883126353Smlaier yyerror("reassemble tcp cannot be respecified"); 884126353Smlaier YYERROR; 885126353Smlaier } 886126353Smlaier scrub_opts.reassemble_tcp = 1; 887126353Smlaier } 888126353Smlaier | RANDOMID { 889126353Smlaier if (scrub_opts.randomid) { 890126353Smlaier yyerror("random-id cannot be respecified"); 891126353Smlaier YYERROR; 892126353Smlaier } 893126353Smlaier scrub_opts.randomid = 1; 894126353Smlaier } 895126353Smlaier ; 896126353Smlaier 897126353Smlaierfragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 898126353Smlaier | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 899126353Smlaier | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 900126353Smlaier ; 901126353Smlaier 902126353Smlaierantispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 903126353Smlaier struct pf_rule r; 904145840Smlaier struct node_host *h = NULL, *hh; 905126353Smlaier struct node_if *i, *j; 906126353Smlaier 907126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 908126353Smlaier YYERROR; 909126353Smlaier 910126353Smlaier for (i = $3; i; i = i->next) { 911126353Smlaier bzero(&r, sizeof(r)); 912126353Smlaier 913126353Smlaier r.action = PF_DROP; 914126353Smlaier r.direction = PF_IN; 915126353Smlaier r.log = $2.log; 916126353Smlaier r.quick = $2.quick; 917126353Smlaier r.af = $4; 918126353Smlaier if (rule_label(&r, $5.label)) 919126353Smlaier YYERROR; 920126353Smlaier j = calloc(1, sizeof(struct node_if)); 921126353Smlaier if (j == NULL) 922126353Smlaier err(1, "antispoof: calloc"); 923126353Smlaier if (strlcpy(j->ifname, i->ifname, 924126353Smlaier sizeof(j->ifname)) >= sizeof(j->ifname)) { 925126353Smlaier free(j); 926126353Smlaier yyerror("interface name too long"); 927126353Smlaier YYERROR; 928126353Smlaier } 929126353Smlaier j->not = 1; 930145840Smlaier if (i->dynamic) { 931145840Smlaier h = calloc(1, sizeof(*h)); 932145840Smlaier if (h == NULL) 933145840Smlaier err(1, "address: calloc"); 934145840Smlaier h->addr.type = PF_ADDR_DYNIFTL; 935145840Smlaier set_ipmask(h, 128); 936145840Smlaier if (strlcpy(h->addr.v.ifname, i->ifname, 937145840Smlaier sizeof(h->addr.v.ifname)) >= 938145840Smlaier sizeof(h->addr.v.ifname)) { 939145840Smlaier free(h); 940145840Smlaier yyerror( 941145840Smlaier "interface name too long"); 942145840Smlaier YYERROR; 943145840Smlaier } 944145840Smlaier hh = malloc(sizeof(*hh)); 945145840Smlaier if (hh == NULL) 946145840Smlaier err(1, "address: malloc"); 947145840Smlaier bcopy(h, hh, sizeof(*hh)); 948145840Smlaier h->addr.iflags = PFI_AFLAG_NETWORK; 949145840Smlaier } else { 950145840Smlaier h = ifa_lookup(j->ifname, 951145840Smlaier PFI_AFLAG_NETWORK); 952145840Smlaier hh = NULL; 953145840Smlaier } 954126353Smlaier 955130617Smlaier if (h != NULL) 956130617Smlaier expand_rule(&r, j, NULL, NULL, NULL, h, 957145840Smlaier NULL, NULL, NULL, NULL, NULL, 958145840Smlaier NULL, ""); 959126353Smlaier 960126353Smlaier if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 961126353Smlaier bzero(&r, sizeof(r)); 962126353Smlaier 963126353Smlaier r.action = PF_DROP; 964126353Smlaier r.direction = PF_IN; 965126353Smlaier r.log = $2.log; 966126353Smlaier r.quick = $2.quick; 967126353Smlaier r.af = $4; 968126353Smlaier if (rule_label(&r, $5.label)) 969126353Smlaier YYERROR; 970145840Smlaier if (hh != NULL) 971145840Smlaier h = hh; 972145840Smlaier else 973145840Smlaier h = ifa_lookup(i->ifname, 0); 974130617Smlaier if (h != NULL) 975130617Smlaier expand_rule(&r, NULL, NULL, 976130617Smlaier NULL, NULL, h, NULL, NULL, 977145840Smlaier NULL, NULL, NULL, NULL, ""); 978145840Smlaier } else 979145840Smlaier free(hh); 980126353Smlaier } 981126353Smlaier free($5.label); 982126353Smlaier } 983126353Smlaier ; 984126353Smlaier 985145840Smlaierantispoof_ifspc : FOR antispoof_if { $$ = $2; } 986126353Smlaier | FOR '{' antispoof_iflst '}' { $$ = $3; } 987126353Smlaier ; 988126353Smlaier 989145840Smlaierantispoof_iflst : antispoof_if { $$ = $1; } 990145840Smlaier | antispoof_iflst comma antispoof_if { 991126353Smlaier $1->tail->next = $3; 992126353Smlaier $1->tail = $3; 993126353Smlaier $$ = $1; 994126353Smlaier } 995126353Smlaier ; 996126353Smlaier 997145840Smlaierantispoof_if : if_item { $$ = $1; } 998145840Smlaier | '(' if_item ')' { 999145840Smlaier $2->dynamic = 1; 1000145840Smlaier $$ = $2; 1001145840Smlaier } 1002145840Smlaier ; 1003145840Smlaier 1004126353Smlaierantispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 1005130617Smlaier antispoof_opts_l 1006126353Smlaier { $$ = antispoof_opts; } 1007126353Smlaier | /* empty */ { 1008126353Smlaier bzero(&antispoof_opts, sizeof antispoof_opts); 1009126353Smlaier $$ = antispoof_opts; 1010126353Smlaier } 1011126353Smlaier ; 1012126353Smlaier 1013126353Smlaierantispoof_opts_l : antispoof_opts_l antispoof_opt 1014126353Smlaier | antispoof_opt 1015126353Smlaier ; 1016126353Smlaier 1017126353Smlaierantispoof_opt : label { 1018126353Smlaier if (antispoof_opts.label) { 1019126353Smlaier yyerror("label cannot be redefined"); 1020126353Smlaier YYERROR; 1021126353Smlaier } 1022126353Smlaier antispoof_opts.label = $1; 1023126353Smlaier } 1024126353Smlaier ; 1025126353Smlaier 1026126353Smlaiernot : '!' { $$ = 1; } 1027126353Smlaier | /* empty */ { $$ = 0; } 1028130617Smlaier ; 1029126353Smlaier 1030126353Smlaiertabledef : TABLE '<' STRING '>' table_opts { 1031126353Smlaier struct node_host *h, *nh; 1032126353Smlaier struct node_tinit *ti, *nti; 1033126353Smlaier 1034126353Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1035126353Smlaier yyerror("table name too long, max %d chars", 1036126353Smlaier PF_TABLE_NAME_SIZE - 1); 1037130617Smlaier free($3); 1038126353Smlaier YYERROR; 1039126353Smlaier } 1040126353Smlaier if (pf->loadopt & PFCTL_FLAG_TABLE) 1041130617Smlaier if (process_tabledef($3, &$5)) { 1042130617Smlaier free($3); 1043126353Smlaier YYERROR; 1044130617Smlaier } 1045130617Smlaier free($3); 1046126353Smlaier for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1047126353Smlaier ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1048126353Smlaier if (ti->file) 1049126353Smlaier free(ti->file); 1050126353Smlaier for (h = ti->host; h != NULL; h = nh) { 1051126353Smlaier nh = h->next; 1052126353Smlaier free(h); 1053126353Smlaier } 1054126353Smlaier nti = SIMPLEQ_NEXT(ti, entries); 1055130617Smlaier free(ti); 1056126353Smlaier } 1057126353Smlaier } 1058126353Smlaier ; 1059126353Smlaier 1060126353Smlaiertable_opts : { 1061126353Smlaier bzero(&table_opts, sizeof table_opts); 1062126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 1063126353Smlaier } 1064130617Smlaier table_opts_l 1065126353Smlaier { $$ = table_opts; } 1066126353Smlaier | /* empty */ 1067126353Smlaier { 1068126353Smlaier bzero(&table_opts, sizeof table_opts); 1069126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 1070126353Smlaier $$ = table_opts; 1071126353Smlaier } 1072126353Smlaier ; 1073126353Smlaier 1074126353Smlaiertable_opts_l : table_opts_l table_opt 1075126353Smlaier | table_opt 1076126353Smlaier ; 1077126353Smlaier 1078126353Smlaiertable_opt : STRING { 1079126353Smlaier if (!strcmp($1, "const")) 1080126353Smlaier table_opts.flags |= PFR_TFLAG_CONST; 1081126353Smlaier else if (!strcmp($1, "persist")) 1082126353Smlaier table_opts.flags |= PFR_TFLAG_PERSIST; 1083130617Smlaier else { 1084145840Smlaier yyerror("invalid table option '%s'", $1); 1085130617Smlaier free($1); 1086126353Smlaier YYERROR; 1087130617Smlaier } 1088130617Smlaier free($1); 1089126353Smlaier } 1090126353Smlaier | '{' '}' { table_opts.init_addr = 1; } 1091126353Smlaier | '{' host_list '}' { 1092126353Smlaier struct node_host *n; 1093126353Smlaier struct node_tinit *ti; 1094126353Smlaier 1095126353Smlaier for (n = $2; n != NULL; n = n->next) { 1096130617Smlaier switch (n->addr.type) { 1097126353Smlaier case PF_ADDR_ADDRMASK: 1098126353Smlaier continue; /* ok */ 1099126353Smlaier case PF_ADDR_DYNIFTL: 1100126353Smlaier yyerror("dynamic addresses are not " 1101126353Smlaier "permitted inside tables"); 1102126353Smlaier break; 1103126353Smlaier case PF_ADDR_TABLE: 1104126353Smlaier yyerror("tables cannot contain tables"); 1105126353Smlaier break; 1106126353Smlaier case PF_ADDR_NOROUTE: 1107126353Smlaier yyerror("\"no-route\" is not permitted " 1108126353Smlaier "inside tables"); 1109126353Smlaier break; 1110126353Smlaier default: 1111126353Smlaier yyerror("unknown address type %d", 1112126353Smlaier n->addr.type); 1113126353Smlaier } 1114126353Smlaier YYERROR; 1115126353Smlaier } 1116126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 1117126353Smlaier err(1, "table_opt: calloc"); 1118126353Smlaier ti->host = $2; 1119126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1120126353Smlaier entries); 1121126353Smlaier table_opts.init_addr = 1; 1122126353Smlaier } 1123126353Smlaier | FILENAME STRING { 1124126353Smlaier struct node_tinit *ti; 1125126353Smlaier 1126126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 1127126353Smlaier err(1, "table_opt: calloc"); 1128126353Smlaier ti->file = $2; 1129126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1130126353Smlaier entries); 1131126353Smlaier table_opts.init_addr = 1; 1132126353Smlaier } 1133126353Smlaier ; 1134126353Smlaier 1135126353Smlaieraltqif : ALTQ interface queue_opts QUEUE qassign { 1136126353Smlaier struct pf_altq a; 1137126353Smlaier 1138126353Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) 1139126353Smlaier YYERROR; 1140126353Smlaier 1141126353Smlaier memset(&a, 0, sizeof(a)); 1142126353Smlaier if ($3.scheduler.qtype == ALTQT_NONE) { 1143126353Smlaier yyerror("no scheduler specified!"); 1144126353Smlaier YYERROR; 1145126353Smlaier } 1146126353Smlaier a.scheduler = $3.scheduler.qtype; 1147126353Smlaier a.qlimit = $3.qlimit; 1148126353Smlaier a.tbrsize = $3.tbrsize; 1149126353Smlaier if ($5 == NULL) { 1150126353Smlaier yyerror("no child queues specified"); 1151126353Smlaier YYERROR; 1152126353Smlaier } 1153126353Smlaier if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1154126353Smlaier &$3.scheduler)) 1155126353Smlaier YYERROR; 1156126353Smlaier } 1157126353Smlaier ; 1158126353Smlaier 1159126353Smlaierqueuespec : QUEUE STRING interface queue_opts qassign { 1160126353Smlaier struct pf_altq a; 1161126353Smlaier 1162130617Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) { 1163130617Smlaier free($2); 1164126353Smlaier YYERROR; 1165130617Smlaier } 1166126353Smlaier 1167126353Smlaier memset(&a, 0, sizeof(a)); 1168126353Smlaier 1169126353Smlaier if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1170126353Smlaier sizeof(a.qname)) { 1171126353Smlaier yyerror("queue name too long (max " 1172126353Smlaier "%d chars)", PF_QNAME_SIZE-1); 1173130617Smlaier free($2); 1174126353Smlaier YYERROR; 1175126353Smlaier } 1176130617Smlaier free($2); 1177126353Smlaier if ($4.tbrsize) { 1178126353Smlaier yyerror("cannot specify tbrsize for queue"); 1179126353Smlaier YYERROR; 1180126353Smlaier } 1181126353Smlaier if ($4.priority > 255) { 1182126353Smlaier yyerror("priority out of range: max 255"); 1183126353Smlaier YYERROR; 1184126353Smlaier } 1185126353Smlaier a.priority = $4.priority; 1186126353Smlaier a.qlimit = $4.qlimit; 1187126353Smlaier a.scheduler = $4.scheduler.qtype; 1188126353Smlaier if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1189126353Smlaier &$4.scheduler)) { 1190126353Smlaier yyerror("errors in queue definition"); 1191126353Smlaier YYERROR; 1192126353Smlaier } 1193126353Smlaier } 1194126353Smlaier ; 1195126353Smlaier 1196126353Smlaierqueue_opts : { 1197126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1198126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1199126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1200126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1201126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1202126353Smlaier } 1203130617Smlaier queue_opts_l 1204126353Smlaier { $$ = queue_opts; } 1205126353Smlaier | /* empty */ { 1206126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1207126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1208126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1209126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1210126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1211126353Smlaier $$ = queue_opts; 1212126353Smlaier } 1213126353Smlaier ; 1214126353Smlaier 1215126353Smlaierqueue_opts_l : queue_opts_l queue_opt 1216126353Smlaier | queue_opt 1217126353Smlaier ; 1218126353Smlaier 1219126353Smlaierqueue_opt : BANDWIDTH bandwidth { 1220126353Smlaier if (queue_opts.marker & QOM_BWSPEC) { 1221126353Smlaier yyerror("bandwidth cannot be respecified"); 1222126353Smlaier YYERROR; 1223126353Smlaier } 1224126353Smlaier queue_opts.marker |= QOM_BWSPEC; 1225126353Smlaier queue_opts.queue_bwspec = $2; 1226126353Smlaier } 1227126353Smlaier | PRIORITY number { 1228126353Smlaier if (queue_opts.marker & QOM_PRIORITY) { 1229126353Smlaier yyerror("priority cannot be respecified"); 1230126353Smlaier YYERROR; 1231126353Smlaier } 1232126353Smlaier if ($2 > 255) { 1233126353Smlaier yyerror("priority out of range: max 255"); 1234126353Smlaier YYERROR; 1235126353Smlaier } 1236126353Smlaier queue_opts.marker |= QOM_PRIORITY; 1237126353Smlaier queue_opts.priority = $2; 1238126353Smlaier } 1239126353Smlaier | QLIMIT number { 1240126353Smlaier if (queue_opts.marker & QOM_QLIMIT) { 1241126353Smlaier yyerror("qlimit cannot be respecified"); 1242126353Smlaier YYERROR; 1243126353Smlaier } 1244126353Smlaier if ($2 > 65535) { 1245126353Smlaier yyerror("qlimit out of range: max 65535"); 1246126353Smlaier YYERROR; 1247126353Smlaier } 1248126353Smlaier queue_opts.marker |= QOM_QLIMIT; 1249126353Smlaier queue_opts.qlimit = $2; 1250126353Smlaier } 1251126353Smlaier | scheduler { 1252126353Smlaier if (queue_opts.marker & QOM_SCHEDULER) { 1253126353Smlaier yyerror("scheduler cannot be respecified"); 1254126353Smlaier YYERROR; 1255126353Smlaier } 1256126353Smlaier queue_opts.marker |= QOM_SCHEDULER; 1257126353Smlaier queue_opts.scheduler = $1; 1258126353Smlaier } 1259126353Smlaier | TBRSIZE number { 1260126353Smlaier if (queue_opts.marker & QOM_TBRSIZE) { 1261126353Smlaier yyerror("tbrsize cannot be respecified"); 1262126353Smlaier YYERROR; 1263126353Smlaier } 1264126353Smlaier if ($2 > 65535) { 1265126353Smlaier yyerror("tbrsize too big: max 65535"); 1266126353Smlaier YYERROR; 1267126353Smlaier } 1268126353Smlaier queue_opts.marker |= QOM_TBRSIZE; 1269126353Smlaier queue_opts.tbrsize = $2; 1270126353Smlaier } 1271126353Smlaier ; 1272126353Smlaier 1273126353Smlaierbandwidth : STRING { 1274126353Smlaier double bps; 1275126353Smlaier char *cp; 1276126353Smlaier 1277126353Smlaier $$.bw_percent = 0; 1278126353Smlaier 1279126353Smlaier bps = strtod($1, &cp); 1280126353Smlaier if (cp != NULL) { 1281126353Smlaier if (!strcmp(cp, "b")) 1282126353Smlaier ; /* nothing */ 1283126353Smlaier else if (!strcmp(cp, "Kb")) 1284126353Smlaier bps *= 1000; 1285126353Smlaier else if (!strcmp(cp, "Mb")) 1286126353Smlaier bps *= 1000 * 1000; 1287126353Smlaier else if (!strcmp(cp, "Gb")) 1288126353Smlaier bps *= 1000 * 1000 * 1000; 1289126353Smlaier else if (!strcmp(cp, "%")) { 1290126353Smlaier if (bps < 0 || bps > 100) { 1291126353Smlaier yyerror("bandwidth spec " 1292126353Smlaier "out of range"); 1293130617Smlaier free($1); 1294126353Smlaier YYERROR; 1295126353Smlaier } 1296126353Smlaier $$.bw_percent = bps; 1297126353Smlaier bps = 0; 1298126353Smlaier } else { 1299126353Smlaier yyerror("unknown unit %s", cp); 1300130617Smlaier free($1); 1301126353Smlaier YYERROR; 1302126353Smlaier } 1303126353Smlaier } 1304130617Smlaier free($1); 1305126353Smlaier $$.bw_absolute = (u_int32_t)bps; 1306126353Smlaier } 1307130617Smlaier ; 1308126353Smlaier 1309126353Smlaierscheduler : CBQ { 1310126353Smlaier $$.qtype = ALTQT_CBQ; 1311126353Smlaier $$.data.cbq_opts.flags = 0; 1312126353Smlaier } 1313126353Smlaier | CBQ '(' cbqflags_list ')' { 1314126353Smlaier $$.qtype = ALTQT_CBQ; 1315126353Smlaier $$.data.cbq_opts.flags = $3; 1316126353Smlaier } 1317126353Smlaier | PRIQ { 1318126353Smlaier $$.qtype = ALTQT_PRIQ; 1319126353Smlaier $$.data.priq_opts.flags = 0; 1320126353Smlaier } 1321126353Smlaier | PRIQ '(' priqflags_list ')' { 1322126353Smlaier $$.qtype = ALTQT_PRIQ; 1323126353Smlaier $$.data.priq_opts.flags = $3; 1324126353Smlaier } 1325126353Smlaier | HFSC { 1326126353Smlaier $$.qtype = ALTQT_HFSC; 1327126353Smlaier bzero(&$$.data.hfsc_opts, 1328126353Smlaier sizeof(struct node_hfsc_opts)); 1329126353Smlaier } 1330126353Smlaier | HFSC '(' hfsc_opts ')' { 1331126353Smlaier $$.qtype = ALTQT_HFSC; 1332126353Smlaier $$.data.hfsc_opts = $3; 1333126353Smlaier } 1334126353Smlaier ; 1335126353Smlaier 1336126353Smlaiercbqflags_list : cbqflags_item { $$ |= $1; } 1337126353Smlaier | cbqflags_list comma cbqflags_item { $$ |= $3; } 1338126353Smlaier ; 1339126353Smlaier 1340126353Smlaiercbqflags_item : STRING { 1341126353Smlaier if (!strcmp($1, "default")) 1342126353Smlaier $$ = CBQCLF_DEFCLASS; 1343126353Smlaier else if (!strcmp($1, "borrow")) 1344126353Smlaier $$ = CBQCLF_BORROW; 1345126353Smlaier else if (!strcmp($1, "red")) 1346126353Smlaier $$ = CBQCLF_RED; 1347126353Smlaier else if (!strcmp($1, "ecn")) 1348126353Smlaier $$ = CBQCLF_RED|CBQCLF_ECN; 1349126353Smlaier else if (!strcmp($1, "rio")) 1350126353Smlaier $$ = CBQCLF_RIO; 1351126353Smlaier else { 1352126353Smlaier yyerror("unknown cbq flag \"%s\"", $1); 1353130617Smlaier free($1); 1354126353Smlaier YYERROR; 1355126353Smlaier } 1356130617Smlaier free($1); 1357126353Smlaier } 1358126353Smlaier ; 1359126353Smlaier 1360126353Smlaierpriqflags_list : priqflags_item { $$ |= $1; } 1361126353Smlaier | priqflags_list comma priqflags_item { $$ |= $3; } 1362126353Smlaier ; 1363126353Smlaier 1364126353Smlaierpriqflags_item : STRING { 1365126353Smlaier if (!strcmp($1, "default")) 1366126353Smlaier $$ = PRCF_DEFAULTCLASS; 1367126353Smlaier else if (!strcmp($1, "red")) 1368126353Smlaier $$ = PRCF_RED; 1369126353Smlaier else if (!strcmp($1, "ecn")) 1370126353Smlaier $$ = PRCF_RED|PRCF_ECN; 1371126353Smlaier else if (!strcmp($1, "rio")) 1372126353Smlaier $$ = PRCF_RIO; 1373126353Smlaier else { 1374126353Smlaier yyerror("unknown priq flag \"%s\"", $1); 1375130617Smlaier free($1); 1376126353Smlaier YYERROR; 1377126353Smlaier } 1378130617Smlaier free($1); 1379126353Smlaier } 1380126353Smlaier ; 1381126353Smlaier 1382126353Smlaierhfsc_opts : { 1383126353Smlaier bzero(&hfsc_opts, 1384126353Smlaier sizeof(struct node_hfsc_opts)); 1385126353Smlaier } 1386130617Smlaier hfscopts_list { 1387126353Smlaier $$ = hfsc_opts; 1388126353Smlaier } 1389126353Smlaier ; 1390126353Smlaier 1391126353Smlaierhfscopts_list : hfscopts_item 1392126353Smlaier | hfscopts_list comma hfscopts_item 1393126353Smlaier ; 1394126353Smlaier 1395126353Smlaierhfscopts_item : LINKSHARE bandwidth { 1396126353Smlaier if (hfsc_opts.linkshare.used) { 1397126353Smlaier yyerror("linkshare already specified"); 1398126353Smlaier YYERROR; 1399126353Smlaier } 1400126353Smlaier hfsc_opts.linkshare.m2 = $2; 1401126353Smlaier hfsc_opts.linkshare.used = 1; 1402126353Smlaier } 1403145840Smlaier | LINKSHARE '(' bandwidth comma number comma bandwidth ')' 1404145840Smlaier { 1405126353Smlaier if (hfsc_opts.linkshare.used) { 1406126353Smlaier yyerror("linkshare already specified"); 1407126353Smlaier YYERROR; 1408126353Smlaier } 1409126353Smlaier hfsc_opts.linkshare.m1 = $3; 1410145840Smlaier hfsc_opts.linkshare.d = $5; 1411145840Smlaier hfsc_opts.linkshare.m2 = $7; 1412126353Smlaier hfsc_opts.linkshare.used = 1; 1413126353Smlaier } 1414126353Smlaier | REALTIME bandwidth { 1415126353Smlaier if (hfsc_opts.realtime.used) { 1416126353Smlaier yyerror("realtime already specified"); 1417126353Smlaier YYERROR; 1418126353Smlaier } 1419126353Smlaier hfsc_opts.realtime.m2 = $2; 1420126353Smlaier hfsc_opts.realtime.used = 1; 1421126353Smlaier } 1422145840Smlaier | REALTIME '(' bandwidth comma number comma bandwidth ')' 1423145840Smlaier { 1424126353Smlaier if (hfsc_opts.realtime.used) { 1425126353Smlaier yyerror("realtime already specified"); 1426126353Smlaier YYERROR; 1427126353Smlaier } 1428126353Smlaier hfsc_opts.realtime.m1 = $3; 1429145840Smlaier hfsc_opts.realtime.d = $5; 1430145840Smlaier hfsc_opts.realtime.m2 = $7; 1431126353Smlaier hfsc_opts.realtime.used = 1; 1432126353Smlaier } 1433126353Smlaier | UPPERLIMIT bandwidth { 1434126353Smlaier if (hfsc_opts.upperlimit.used) { 1435126353Smlaier yyerror("upperlimit already specified"); 1436126353Smlaier YYERROR; 1437126353Smlaier } 1438126353Smlaier hfsc_opts.upperlimit.m2 = $2; 1439126353Smlaier hfsc_opts.upperlimit.used = 1; 1440126353Smlaier } 1441145840Smlaier | UPPERLIMIT '(' bandwidth comma number comma bandwidth ')' 1442145840Smlaier { 1443126353Smlaier if (hfsc_opts.upperlimit.used) { 1444126353Smlaier yyerror("upperlimit already specified"); 1445126353Smlaier YYERROR; 1446126353Smlaier } 1447126353Smlaier hfsc_opts.upperlimit.m1 = $3; 1448145840Smlaier hfsc_opts.upperlimit.d = $5; 1449145840Smlaier hfsc_opts.upperlimit.m2 = $7; 1450126353Smlaier hfsc_opts.upperlimit.used = 1; 1451126353Smlaier } 1452126353Smlaier | STRING { 1453126353Smlaier if (!strcmp($1, "default")) 1454126353Smlaier hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1455126353Smlaier else if (!strcmp($1, "red")) 1456126353Smlaier hfsc_opts.flags |= HFCF_RED; 1457126353Smlaier else if (!strcmp($1, "ecn")) 1458126353Smlaier hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1459126353Smlaier else if (!strcmp($1, "rio")) 1460126353Smlaier hfsc_opts.flags |= HFCF_RIO; 1461126353Smlaier else { 1462126353Smlaier yyerror("unknown hfsc flag \"%s\"", $1); 1463130617Smlaier free($1); 1464126353Smlaier YYERROR; 1465126353Smlaier } 1466130617Smlaier free($1); 1467126353Smlaier } 1468126353Smlaier ; 1469126353Smlaier 1470126353Smlaierqassign : /* empty */ { $$ = NULL; } 1471126353Smlaier | qassign_item { $$ = $1; } 1472126353Smlaier | '{' qassign_list '}' { $$ = $2; } 1473126353Smlaier ; 1474126353Smlaier 1475126353Smlaierqassign_list : qassign_item { $$ = $1; } 1476126353Smlaier | qassign_list comma qassign_item { 1477126353Smlaier $1->tail->next = $3; 1478126353Smlaier $1->tail = $3; 1479126353Smlaier $$ = $1; 1480126353Smlaier } 1481126353Smlaier ; 1482126353Smlaier 1483126353Smlaierqassign_item : STRING { 1484126353Smlaier $$ = calloc(1, sizeof(struct node_queue)); 1485126353Smlaier if ($$ == NULL) 1486126353Smlaier err(1, "qassign_item: calloc"); 1487126353Smlaier if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1488126353Smlaier sizeof($$->queue)) { 1489126353Smlaier yyerror("queue name '%s' too long (max " 1490126353Smlaier "%d chars)", $1, sizeof($$->queue)-1); 1491130617Smlaier free($1); 1492130617Smlaier free($$); 1493126353Smlaier YYERROR; 1494126353Smlaier } 1495130617Smlaier free($1); 1496126353Smlaier $$->next = NULL; 1497126353Smlaier $$->tail = $$; 1498126353Smlaier } 1499126353Smlaier ; 1500126353Smlaier 1501126353Smlaierpfrule : action dir logquick interface route af proto fromto 1502130617Smlaier filter_opts 1503126353Smlaier { 1504126353Smlaier struct pf_rule r; 1505126353Smlaier struct node_state_opt *o; 1506126353Smlaier struct node_proto *proto; 1507130617Smlaier int srctrack = 0; 1508130617Smlaier int statelock = 0; 1509126353Smlaier 1510126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 1511126353Smlaier YYERROR; 1512126353Smlaier 1513126353Smlaier memset(&r, 0, sizeof(r)); 1514126353Smlaier 1515126353Smlaier r.action = $1.b1; 1516126353Smlaier switch ($1.b2) { 1517126353Smlaier case PFRULE_RETURNRST: 1518126353Smlaier r.rule_flag |= PFRULE_RETURNRST; 1519126353Smlaier r.return_ttl = $1.w; 1520126353Smlaier break; 1521126353Smlaier case PFRULE_RETURNICMP: 1522126353Smlaier r.rule_flag |= PFRULE_RETURNICMP; 1523126353Smlaier r.return_icmp = $1.w; 1524126353Smlaier r.return_icmp6 = $1.w2; 1525126353Smlaier break; 1526126353Smlaier case PFRULE_RETURN: 1527126353Smlaier r.rule_flag |= PFRULE_RETURN; 1528126353Smlaier r.return_icmp = $1.w; 1529126353Smlaier r.return_icmp6 = $1.w2; 1530126353Smlaier break; 1531126353Smlaier } 1532126353Smlaier r.direction = $2; 1533126353Smlaier r.log = $3.log; 1534126353Smlaier r.quick = $3.quick; 1535145840Smlaier r.prob = $9.prob; 1536126353Smlaier 1537126353Smlaier r.af = $6; 1538126353Smlaier if ($9.tag) 1539126353Smlaier if (strlcpy(r.tagname, $9.tag, 1540130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1541126353Smlaier yyerror("tag too long, max %u chars", 1542126353Smlaier PF_TAG_NAME_SIZE - 1); 1543126353Smlaier YYERROR; 1544126353Smlaier } 1545126353Smlaier if ($9.match_tag) 1546126353Smlaier if (strlcpy(r.match_tagname, $9.match_tag, 1547130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1548126353Smlaier yyerror("tag too long, max %u chars", 1549126353Smlaier PF_TAG_NAME_SIZE - 1); 1550126353Smlaier YYERROR; 1551126353Smlaier } 1552126353Smlaier r.match_tag_not = $9.match_tag_not; 1553126353Smlaier r.flags = $9.flags.b1; 1554126353Smlaier r.flagset = $9.flags.b2; 1555126353Smlaier if (rule_label(&r, $9.label)) 1556126353Smlaier YYERROR; 1557126353Smlaier free($9.label); 1558126353Smlaier if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1559126353Smlaier for (proto = $7; proto != NULL && 1560126353Smlaier proto->proto != IPPROTO_TCP; 1561126353Smlaier proto = proto->next) 1562126353Smlaier ; /* nothing */ 1563126353Smlaier if (proto == NULL && $7 != NULL) { 1564126353Smlaier if ($9.flags.b1 || $9.flags.b2) 1565126353Smlaier yyerror( 1566126353Smlaier "flags only apply to tcp"); 1567126353Smlaier if ($8.src_os) 1568126353Smlaier yyerror( 1569126353Smlaier "OS fingerprinting only " 1570126353Smlaier "apply to tcp"); 1571126353Smlaier YYERROR; 1572126353Smlaier } 1573126353Smlaier#if 0 1574126353Smlaier if (($9.flags.b1 & parse_flags("S")) == 0 && 1575126353Smlaier $8.src_os) { 1576126353Smlaier yyerror("OS fingerprinting requires " 1577130617Smlaier "the SYN TCP flag (flags S/SA)"); 1578126353Smlaier YYERROR; 1579126353Smlaier } 1580126353Smlaier#endif 1581126353Smlaier } 1582126353Smlaier 1583126353Smlaier r.tos = $9.tos; 1584126353Smlaier r.keep_state = $9.keep.action; 1585126353Smlaier o = $9.keep.options; 1586126353Smlaier while (o) { 1587126353Smlaier struct node_state_opt *p = o; 1588126353Smlaier 1589126353Smlaier switch (o->type) { 1590126353Smlaier case PF_STATE_OPT_MAX: 1591126353Smlaier if (r.max_states) { 1592126353Smlaier yyerror("state option 'max' " 1593126353Smlaier "multiple definitions"); 1594126353Smlaier YYERROR; 1595126353Smlaier } 1596126353Smlaier r.max_states = o->data.max_states; 1597126353Smlaier break; 1598130617Smlaier case PF_STATE_OPT_NOSYNC: 1599130617Smlaier if (r.rule_flag & PFRULE_NOSYNC) { 1600130617Smlaier yyerror("state option 'sync' " 1601130617Smlaier "multiple definitions"); 1602130617Smlaier YYERROR; 1603130617Smlaier } 1604130617Smlaier r.rule_flag |= PFRULE_NOSYNC; 1605130617Smlaier break; 1606130617Smlaier case PF_STATE_OPT_SRCTRACK: 1607130617Smlaier if (srctrack) { 1608130617Smlaier yyerror("state option " 1609130617Smlaier "'source-track' " 1610130617Smlaier "multiple definitions"); 1611130617Smlaier YYERROR; 1612130617Smlaier } 1613130617Smlaier srctrack = o->data.src_track; 1614145840Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1615130617Smlaier break; 1616130617Smlaier case PF_STATE_OPT_MAX_SRC_STATES: 1617130617Smlaier if (r.max_src_states) { 1618130617Smlaier yyerror("state option " 1619130617Smlaier "'max-src-states' " 1620130617Smlaier "multiple definitions"); 1621130617Smlaier YYERROR; 1622130617Smlaier } 1623145840Smlaier if (o->data.max_src_states == 0) { 1624130617Smlaier yyerror("'max-src-states' must " 1625130617Smlaier "be > 0"); 1626130617Smlaier YYERROR; 1627130617Smlaier } 1628130617Smlaier r.max_src_states = 1629130617Smlaier o->data.max_src_states; 1630130617Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1631130617Smlaier break; 1632145840Smlaier case PF_STATE_OPT_OVERLOAD: 1633145840Smlaier if (r.overload_tblname[0]) { 1634145840Smlaier yyerror("multiple 'overload' " 1635145840Smlaier "table definitions"); 1636145840Smlaier YYERROR; 1637145840Smlaier } 1638145840Smlaier if (strlcpy(r.overload_tblname, 1639145840Smlaier o->data.overload.tblname, 1640145840Smlaier PF_TABLE_NAME_SIZE) >= 1641145840Smlaier PF_TABLE_NAME_SIZE) { 1642145840Smlaier yyerror("state option: " 1643145840Smlaier "strlcpy"); 1644145840Smlaier YYERROR; 1645145840Smlaier } 1646145840Smlaier r.flush = o->data.overload.flush; 1647145840Smlaier break; 1648145840Smlaier case PF_STATE_OPT_MAX_SRC_CONN: 1649145840Smlaier if (r.max_src_conn) { 1650145840Smlaier yyerror("state option " 1651145840Smlaier "'max-src-conn' " 1652145840Smlaier "multiple definitions"); 1653145840Smlaier YYERROR; 1654145840Smlaier } 1655145840Smlaier if (o->data.max_src_conn == 0) { 1656145840Smlaier yyerror("'max-src-conn' " 1657145840Smlaier "must be > 0"); 1658145840Smlaier YYERROR; 1659145840Smlaier } 1660145840Smlaier r.max_src_conn = 1661145840Smlaier o->data.max_src_conn; 1662145840Smlaier r.rule_flag |= PFRULE_SRCTRACK | 1663145840Smlaier PFRULE_RULESRCTRACK; 1664145840Smlaier break; 1665145840Smlaier case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1666145840Smlaier if (r.max_src_conn_rate.limit) { 1667145840Smlaier yyerror("state option " 1668145840Smlaier "'max-src-conn-rate' " 1669145840Smlaier "multiple definitions"); 1670145840Smlaier YYERROR; 1671145840Smlaier } 1672145840Smlaier if (!o->data.max_src_conn_rate.limit || 1673145840Smlaier !o->data.max_src_conn_rate.seconds) { 1674145840Smlaier yyerror("'max-src-conn-rate' " 1675145840Smlaier "values must be > 0"); 1676145840Smlaier YYERROR; 1677145840Smlaier } 1678145840Smlaier if (o->data.max_src_conn_rate.limit > 1679145840Smlaier PF_THRESHOLD_MAX) { 1680145840Smlaier yyerror("'max-src-conn-rate' " 1681145840Smlaier "maximum rate must be < %u", 1682145840Smlaier PF_THRESHOLD_MAX); 1683145840Smlaier YYERROR; 1684145840Smlaier } 1685145840Smlaier r.max_src_conn_rate.limit = 1686145840Smlaier o->data.max_src_conn_rate.limit; 1687145840Smlaier r.max_src_conn_rate.seconds = 1688145840Smlaier o->data.max_src_conn_rate.seconds; 1689145840Smlaier r.rule_flag |= PFRULE_SRCTRACK | 1690145840Smlaier PFRULE_RULESRCTRACK; 1691145840Smlaier break; 1692130617Smlaier case PF_STATE_OPT_MAX_SRC_NODES: 1693130617Smlaier if (r.max_src_nodes) { 1694130617Smlaier yyerror("state option " 1695130617Smlaier "'max-src-nodes' " 1696130617Smlaier "multiple definitions"); 1697130617Smlaier YYERROR; 1698130617Smlaier } 1699130617Smlaier if (o->data.max_src_nodes == 0) { 1700130617Smlaier yyerror("'max-src-nodes' must " 1701130617Smlaier "be > 0"); 1702130617Smlaier YYERROR; 1703130617Smlaier } 1704130617Smlaier r.max_src_nodes = 1705130617Smlaier o->data.max_src_nodes; 1706130617Smlaier r.rule_flag |= PFRULE_SRCTRACK | 1707130617Smlaier PFRULE_RULESRCTRACK; 1708130617Smlaier break; 1709130617Smlaier case PF_STATE_OPT_STATELOCK: 1710130617Smlaier if (statelock) { 1711130617Smlaier yyerror("state locking option: " 1712130617Smlaier "multiple definitions"); 1713130617Smlaier YYERROR; 1714130617Smlaier } 1715130617Smlaier statelock = 1; 1716130617Smlaier r.rule_flag |= o->data.statelock; 1717130617Smlaier break; 1718126353Smlaier case PF_STATE_OPT_TIMEOUT: 1719126353Smlaier if (r.timeout[o->data.timeout.number]) { 1720126353Smlaier yyerror("state timeout %s " 1721126353Smlaier "multiple definitions", 1722126353Smlaier pf_timeouts[o->data. 1723126353Smlaier timeout.number].name); 1724126353Smlaier YYERROR; 1725126353Smlaier } 1726126353Smlaier r.timeout[o->data.timeout.number] = 1727126353Smlaier o->data.timeout.seconds; 1728126353Smlaier } 1729126353Smlaier o = o->next; 1730126353Smlaier free(p); 1731126353Smlaier } 1732145840Smlaier if (r.rule_flag & PFRULE_SRCTRACK) { 1733130617Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 1734130617Smlaier r.max_src_nodes) { 1735130617Smlaier yyerror("'max-src-nodes' is " 1736130617Smlaier "incompatible with " 1737130617Smlaier "'source-track global'"); 1738130617Smlaier YYERROR; 1739130617Smlaier } 1740145840Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 1741145840Smlaier r.max_src_conn) { 1742145840Smlaier yyerror("'max-src-conn' is " 1743145840Smlaier "incompatible with " 1744145840Smlaier "'source-track global'"); 1745145840Smlaier YYERROR; 1746145840Smlaier } 1747145840Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 1748145840Smlaier r.max_src_conn_rate.seconds) { 1749145840Smlaier yyerror("'max-src-conn-rate' is " 1750145840Smlaier "incompatible with " 1751145840Smlaier "'source-track global'"); 1752145840Smlaier YYERROR; 1753145840Smlaier } 1754145840Smlaier if (r.timeout[PFTM_SRC_NODE] < 1755145840Smlaier r.max_src_conn_rate.seconds) 1756145840Smlaier r.timeout[PFTM_SRC_NODE] = 1757145840Smlaier r.max_src_conn_rate.seconds; 1758130617Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1759130617Smlaier if (srctrack == PF_SRCTRACK_RULE) 1760130617Smlaier r.rule_flag |= PFRULE_RULESRCTRACK; 1761130617Smlaier } 1762130617Smlaier if (r.keep_state && !statelock) 1763130617Smlaier r.rule_flag |= default_statelock; 1764126353Smlaier 1765126353Smlaier if ($9.fragment) 1766126353Smlaier r.rule_flag |= PFRULE_FRAGMENT; 1767126353Smlaier r.allow_opts = $9.allowopts; 1768126353Smlaier 1769126353Smlaier decide_address_family($8.src.host, &r.af); 1770126353Smlaier decide_address_family($8.dst.host, &r.af); 1771126353Smlaier 1772126353Smlaier if ($5.rt) { 1773126353Smlaier if (!r.direction) { 1774126353Smlaier yyerror("direction must be explicit " 1775126353Smlaier "with rules that specify routing"); 1776126353Smlaier YYERROR; 1777126353Smlaier } 1778126353Smlaier r.rt = $5.rt; 1779126353Smlaier r.rpool.opts = $5.pool_opts; 1780126353Smlaier if ($5.key != NULL) 1781126353Smlaier memcpy(&r.rpool.key, $5.key, 1782126353Smlaier sizeof(struct pf_poolhashkey)); 1783126353Smlaier } 1784126353Smlaier if (r.rt && r.rt != PF_FASTROUTE) { 1785126353Smlaier decide_address_family($5.host, &r.af); 1786126353Smlaier remove_invalid_hosts(&$5.host, &r.af); 1787126353Smlaier if ($5.host == NULL) { 1788126353Smlaier yyerror("no routing address with " 1789126353Smlaier "matching address family found."); 1790126353Smlaier YYERROR; 1791126353Smlaier } 1792130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1793130617Smlaier PF_POOL_NONE && ($5.host->next != NULL || 1794130617Smlaier $5.host->addr.type == PF_ADDR_TABLE || 1795130617Smlaier DYNIF_MULTIADDR($5.host->addr))) 1796130617Smlaier r.rpool.opts |= PF_POOL_ROUNDROBIN; 1797130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1798130617Smlaier PF_POOL_ROUNDROBIN && 1799130617Smlaier disallow_table($5.host, "tables are only " 1800130617Smlaier "supported in round-robin routing pools")) 1801130617Smlaier YYERROR; 1802130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1803130617Smlaier PF_POOL_ROUNDROBIN && 1804130617Smlaier disallow_alias($5.host, "interface (%s) " 1805130617Smlaier "is only supported in round-robin " 1806130617Smlaier "routing pools")) 1807130617Smlaier YYERROR; 1808126353Smlaier if ($5.host->next != NULL) { 1809130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1810126353Smlaier PF_POOL_ROUNDROBIN) { 1811126353Smlaier yyerror("r.rpool.opts must " 1812126353Smlaier "be PF_POOL_ROUNDROBIN"); 1813126353Smlaier YYERROR; 1814126353Smlaier } 1815126353Smlaier } 1816126353Smlaier } 1817126353Smlaier if ($9.queues.qname != NULL) { 1818126353Smlaier if (strlcpy(r.qname, $9.queues.qname, 1819126353Smlaier sizeof(r.qname)) >= sizeof(r.qname)) { 1820126353Smlaier yyerror("rule qname too long (max " 1821126353Smlaier "%d chars)", sizeof(r.qname)-1); 1822126353Smlaier YYERROR; 1823126353Smlaier } 1824126353Smlaier free($9.queues.qname); 1825126353Smlaier } 1826126353Smlaier if ($9.queues.pqname != NULL) { 1827126353Smlaier if (strlcpy(r.pqname, $9.queues.pqname, 1828126353Smlaier sizeof(r.pqname)) >= sizeof(r.pqname)) { 1829126353Smlaier yyerror("rule pqname too long (max " 1830126353Smlaier "%d chars)", sizeof(r.pqname)-1); 1831126353Smlaier YYERROR; 1832126353Smlaier } 1833126353Smlaier free($9.queues.pqname); 1834126353Smlaier } 1835126353Smlaier 1836126353Smlaier expand_rule(&r, $4, $5.host, $7, $8.src_os, 1837126353Smlaier $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1838145840Smlaier $9.uid, $9.gid, $9.icmpspec, ""); 1839126353Smlaier } 1840126353Smlaier ; 1841126353Smlaier 1842126353Smlaierfilter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1843130617Smlaier filter_opts_l 1844126353Smlaier { $$ = filter_opts; } 1845126353Smlaier | /* empty */ { 1846126353Smlaier bzero(&filter_opts, sizeof filter_opts); 1847126353Smlaier $$ = filter_opts; 1848126353Smlaier } 1849126353Smlaier ; 1850126353Smlaier 1851126353Smlaierfilter_opts_l : filter_opts_l filter_opt 1852126353Smlaier | filter_opt 1853126353Smlaier ; 1854126353Smlaier 1855126353Smlaierfilter_opt : USER uids { 1856126353Smlaier if (filter_opts.uid) 1857126353Smlaier $2->tail->next = filter_opts.uid; 1858126353Smlaier filter_opts.uid = $2; 1859126353Smlaier } 1860126353Smlaier | GROUP gids { 1861126353Smlaier if (filter_opts.gid) 1862126353Smlaier $2->tail->next = filter_opts.gid; 1863126353Smlaier filter_opts.gid = $2; 1864126353Smlaier } 1865126353Smlaier | flags { 1866126353Smlaier if (filter_opts.marker & FOM_FLAGS) { 1867126353Smlaier yyerror("flags cannot be redefined"); 1868126353Smlaier YYERROR; 1869126353Smlaier } 1870126353Smlaier filter_opts.marker |= FOM_FLAGS; 1871126353Smlaier filter_opts.flags.b1 |= $1.b1; 1872126353Smlaier filter_opts.flags.b2 |= $1.b2; 1873126353Smlaier filter_opts.flags.w |= $1.w; 1874126353Smlaier filter_opts.flags.w2 |= $1.w2; 1875126353Smlaier } 1876126353Smlaier | icmpspec { 1877126353Smlaier if (filter_opts.marker & FOM_ICMP) { 1878126353Smlaier yyerror("icmp-type cannot be redefined"); 1879126353Smlaier YYERROR; 1880126353Smlaier } 1881126353Smlaier filter_opts.marker |= FOM_ICMP; 1882126353Smlaier filter_opts.icmpspec = $1; 1883126353Smlaier } 1884126353Smlaier | tos { 1885126353Smlaier if (filter_opts.marker & FOM_TOS) { 1886126353Smlaier yyerror("tos cannot be redefined"); 1887126353Smlaier YYERROR; 1888126353Smlaier } 1889126353Smlaier filter_opts.marker |= FOM_TOS; 1890126353Smlaier filter_opts.tos = $1; 1891126353Smlaier } 1892126353Smlaier | keep { 1893126353Smlaier if (filter_opts.marker & FOM_KEEP) { 1894126353Smlaier yyerror("modulate or keep cannot be redefined"); 1895126353Smlaier YYERROR; 1896126353Smlaier } 1897126353Smlaier filter_opts.marker |= FOM_KEEP; 1898126353Smlaier filter_opts.keep.action = $1.action; 1899126353Smlaier filter_opts.keep.options = $1.options; 1900126353Smlaier } 1901126353Smlaier | FRAGMENT { 1902126353Smlaier filter_opts.fragment = 1; 1903126353Smlaier } 1904126353Smlaier | ALLOWOPTS { 1905126353Smlaier filter_opts.allowopts = 1; 1906126353Smlaier } 1907126353Smlaier | label { 1908126353Smlaier if (filter_opts.label) { 1909126353Smlaier yyerror("label cannot be redefined"); 1910126353Smlaier YYERROR; 1911126353Smlaier } 1912126353Smlaier filter_opts.label = $1; 1913126353Smlaier } 1914126353Smlaier | qname { 1915126353Smlaier if (filter_opts.queues.qname) { 1916126353Smlaier yyerror("queue cannot be redefined"); 1917126353Smlaier YYERROR; 1918126353Smlaier } 1919126353Smlaier filter_opts.queues = $1; 1920126353Smlaier } 1921126353Smlaier | TAG string { 1922126353Smlaier filter_opts.tag = $2; 1923126353Smlaier } 1924126353Smlaier | not TAGGED string { 1925126353Smlaier filter_opts.match_tag = $3; 1926126353Smlaier filter_opts.match_tag_not = $1; 1927126353Smlaier } 1928145840Smlaier | PROBABILITY STRING { 1929145840Smlaier char *e; 1930145840Smlaier double p = strtod($2, &e); 1931145840Smlaier 1932145840Smlaier if (*e == '%') { 1933145840Smlaier p *= 0.01; 1934145840Smlaier e++; 1935145840Smlaier } 1936145840Smlaier if (*e) { 1937145840Smlaier yyerror("invalid probability: %s", $2); 1938145840Smlaier free($2); 1939145840Smlaier YYERROR; 1940145840Smlaier } 1941145840Smlaier p = floor(p * (UINT_MAX+1.0) + 0.5); 1942145840Smlaier if (p < 1.0 || p >= (UINT_MAX+1.0)) { 1943145840Smlaier yyerror("invalid probability: %s", $2); 1944145840Smlaier free($2); 1945145840Smlaier YYERROR; 1946145840Smlaier } 1947145840Smlaier filter_opts.prob = (u_int32_t)p; 1948145840Smlaier free($2); 1949145840Smlaier } 1950126353Smlaier ; 1951126353Smlaier 1952126353Smlaieraction : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 1953126353Smlaier | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 1954126353Smlaier ; 1955126353Smlaier 1956126353Smlaierblockspec : /* empty */ { 1957126353Smlaier $$.b2 = blockpolicy; 1958126353Smlaier $$.w = returnicmpdefault; 1959126353Smlaier $$.w2 = returnicmp6default; 1960126353Smlaier } 1961126353Smlaier | DROP { 1962126353Smlaier $$.b2 = PFRULE_DROP; 1963126353Smlaier $$.w = 0; 1964126353Smlaier $$.w2 = 0; 1965126353Smlaier } 1966126353Smlaier | RETURNRST { 1967126353Smlaier $$.b2 = PFRULE_RETURNRST; 1968126353Smlaier $$.w = 0; 1969126353Smlaier $$.w2 = 0; 1970126353Smlaier } 1971126353Smlaier | RETURNRST '(' TTL number ')' { 1972126353Smlaier if ($4 > 255) { 1973126353Smlaier yyerror("illegal ttl value %d", $4); 1974126353Smlaier YYERROR; 1975126353Smlaier } 1976126353Smlaier $$.b2 = PFRULE_RETURNRST; 1977126353Smlaier $$.w = $4; 1978126353Smlaier $$.w2 = 0; 1979126353Smlaier } 1980126353Smlaier | RETURNICMP { 1981126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1982126353Smlaier $$.w = returnicmpdefault; 1983126353Smlaier $$.w2 = returnicmp6default; 1984126353Smlaier } 1985126353Smlaier | RETURNICMP6 { 1986126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1987126353Smlaier $$.w = returnicmpdefault; 1988126353Smlaier $$.w2 = returnicmp6default; 1989126353Smlaier } 1990126353Smlaier | RETURNICMP '(' STRING ')' { 1991126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1992130617Smlaier if (!($$.w = parseicmpspec($3, AF_INET))) { 1993130617Smlaier free($3); 1994126353Smlaier YYERROR; 1995130617Smlaier } 1996130617Smlaier free($3); 1997126353Smlaier $$.w2 = returnicmp6default; 1998126353Smlaier } 1999126353Smlaier | RETURNICMP6 '(' STRING ')' { 2000126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2001126353Smlaier $$.w = returnicmpdefault; 2002130617Smlaier if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 2003130617Smlaier free($3); 2004126353Smlaier YYERROR; 2005130617Smlaier } 2006130617Smlaier free($3); 2007126353Smlaier } 2008126353Smlaier | RETURNICMP '(' STRING comma STRING ')' { 2009126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2010130617Smlaier if (!($$.w = parseicmpspec($3, AF_INET)) || 2011130617Smlaier !($$.w2 = parseicmpspec($5, AF_INET6))) { 2012130617Smlaier free($3); 2013130617Smlaier free($5); 2014126353Smlaier YYERROR; 2015130617Smlaier } 2016130617Smlaier free($3); 2017130617Smlaier free($5); 2018126353Smlaier } 2019126353Smlaier | RETURN { 2020126353Smlaier $$.b2 = PFRULE_RETURN; 2021126353Smlaier $$.w = returnicmpdefault; 2022126353Smlaier $$.w2 = returnicmp6default; 2023126353Smlaier } 2024126353Smlaier ; 2025126353Smlaier 2026126353Smlaierdir : /* empty */ { $$ = 0; } 2027126353Smlaier | IN { $$ = PF_IN; } 2028126353Smlaier | OUT { $$ = PF_OUT; } 2029126353Smlaier ; 2030126353Smlaier 2031126353Smlaierlogquick : /* empty */ { $$.log = 0; $$.quick = 0; } 2032126353Smlaier | log { $$.log = $1; $$.quick = 0; } 2033126353Smlaier | QUICK { $$.log = 0; $$.quick = 1; } 2034126353Smlaier | log QUICK { $$.log = $1; $$.quick = 1; } 2035126353Smlaier | QUICK log { $$.log = $2; $$.quick = 1; } 2036126353Smlaier ; 2037126353Smlaier 2038126353Smlaierlog : LOG { $$ = 1; } 2039126353Smlaier | LOGALL { $$ = 2; } 2040126353Smlaier ; 2041126353Smlaier 2042126353Smlaierinterface : /* empty */ { $$ = NULL; } 2043126353Smlaier | ON if_item_not { $$ = $2; } 2044126353Smlaier | ON '{' if_list '}' { $$ = $3; } 2045126353Smlaier ; 2046126353Smlaier 2047126353Smlaierif_list : if_item_not { $$ = $1; } 2048126353Smlaier | if_list comma if_item_not { 2049126353Smlaier $1->tail->next = $3; 2050126353Smlaier $1->tail = $3; 2051126353Smlaier $$ = $1; 2052126353Smlaier } 2053126353Smlaier ; 2054126353Smlaier 2055126353Smlaierif_item_not : not if_item { $$ = $2; $$->not = $1; } 2056126353Smlaier ; 2057126353Smlaier 2058126353Smlaierif_item : STRING { 2059126353Smlaier struct node_host *n; 2060126353Smlaier 2061126353Smlaier $$ = calloc(1, sizeof(struct node_if)); 2062126353Smlaier if ($$ == NULL) 2063126353Smlaier err(1, "if_item: calloc"); 2064126353Smlaier if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2065126353Smlaier sizeof($$->ifname)) { 2066130617Smlaier free($1); 2067126353Smlaier free($$); 2068126353Smlaier yyerror("interface name too long"); 2069126353Smlaier YYERROR; 2070126353Smlaier } 2071145840Smlaier 2072145840Smlaier if ((n = ifa_exists($1, 1)) != NULL) 2073145840Smlaier $$->ifa_flags = n->ifa_flags; 2074145840Smlaier 2075130617Smlaier free($1); 2076126353Smlaier $$->not = 0; 2077126353Smlaier $$->next = NULL; 2078126353Smlaier $$->tail = $$; 2079126353Smlaier } 2080126353Smlaier ; 2081126353Smlaier 2082126353Smlaieraf : /* empty */ { $$ = 0; } 2083126353Smlaier | INET { $$ = AF_INET; } 2084126353Smlaier | INET6 { $$ = AF_INET6; } 2085130617Smlaier ; 2086126353Smlaier 2087126353Smlaierproto : /* empty */ { $$ = NULL; } 2088126353Smlaier | PROTO proto_item { $$ = $2; } 2089126353Smlaier | PROTO '{' proto_list '}' { $$ = $3; } 2090126353Smlaier ; 2091126353Smlaier 2092126353Smlaierproto_list : proto_item { $$ = $1; } 2093126353Smlaier | proto_list comma proto_item { 2094126353Smlaier $1->tail->next = $3; 2095126353Smlaier $1->tail = $3; 2096126353Smlaier $$ = $1; 2097126353Smlaier } 2098126353Smlaier ; 2099126353Smlaier 2100126353Smlaierproto_item : STRING { 2101126353Smlaier u_int8_t pr; 2102126353Smlaier u_long ulval; 2103126353Smlaier 2104126353Smlaier if (atoul($1, &ulval) == 0) { 2105126353Smlaier if (ulval > 255) { 2106126353Smlaier yyerror("protocol outside range"); 2107130617Smlaier free($1); 2108126353Smlaier YYERROR; 2109126353Smlaier } 2110126353Smlaier pr = (u_int8_t)ulval; 2111126353Smlaier } else { 2112126353Smlaier struct protoent *p; 2113126353Smlaier 2114126353Smlaier p = getprotobyname($1); 2115126353Smlaier if (p == NULL) { 2116126353Smlaier yyerror("unknown protocol %s", $1); 2117130617Smlaier free($1); 2118126353Smlaier YYERROR; 2119126353Smlaier } 2120126353Smlaier pr = p->p_proto; 2121126353Smlaier } 2122130617Smlaier free($1); 2123126353Smlaier if (pr == 0) { 2124126353Smlaier yyerror("proto 0 cannot be used"); 2125126353Smlaier YYERROR; 2126126353Smlaier } 2127126353Smlaier $$ = calloc(1, sizeof(struct node_proto)); 2128126353Smlaier if ($$ == NULL) 2129126353Smlaier err(1, "proto_item: calloc"); 2130126353Smlaier $$->proto = pr; 2131126353Smlaier $$->next = NULL; 2132126353Smlaier $$->tail = $$; 2133126353Smlaier } 2134126353Smlaier ; 2135126353Smlaier 2136126353Smlaierfromto : ALL { 2137126353Smlaier $$.src.host = NULL; 2138126353Smlaier $$.src.port = NULL; 2139126353Smlaier $$.dst.host = NULL; 2140126353Smlaier $$.dst.port = NULL; 2141126353Smlaier $$.src_os = NULL; 2142126353Smlaier } 2143126353Smlaier | from os to { 2144126353Smlaier $$.src = $1; 2145126353Smlaier $$.src_os = $2; 2146126353Smlaier $$.dst = $3; 2147126353Smlaier } 2148126353Smlaier ; 2149126353Smlaier 2150126353Smlaieros : /* empty */ { $$ = NULL; } 2151126353Smlaier | OS xos { $$ = $2; } 2152126353Smlaier | OS '{' os_list '}' { $$ = $3; } 2153126353Smlaier ; 2154126353Smlaier 2155126353Smlaierxos : STRING { 2156126353Smlaier $$ = calloc(1, sizeof(struct node_os)); 2157126353Smlaier if ($$ == NULL) 2158126353Smlaier err(1, "os: calloc"); 2159126353Smlaier $$->os = $1; 2160126353Smlaier $$->tail = $$; 2161126353Smlaier } 2162126353Smlaier ; 2163126353Smlaier 2164126353Smlaieros_list : xos { $$ = $1; } 2165126353Smlaier | os_list comma xos { 2166126353Smlaier $1->tail->next = $3; 2167126353Smlaier $1->tail = $3; 2168126353Smlaier $$ = $1; 2169126353Smlaier } 2170126353Smlaier ; 2171126353Smlaier 2172126353Smlaierfrom : /* empty */ { 2173126353Smlaier $$.host = NULL; 2174126353Smlaier $$.port = NULL; 2175126353Smlaier } 2176126353Smlaier | FROM ipportspec { 2177126353Smlaier $$ = $2; 2178126353Smlaier } 2179126353Smlaier ; 2180126353Smlaier 2181126353Smlaierto : /* empty */ { 2182126353Smlaier $$.host = NULL; 2183126353Smlaier $$.port = NULL; 2184126353Smlaier } 2185126353Smlaier | TO ipportspec { 2186126353Smlaier $$ = $2; 2187126353Smlaier } 2188126353Smlaier ; 2189126353Smlaier 2190126353Smlaieripportspec : ipspec { 2191126353Smlaier $$.host = $1; 2192126353Smlaier $$.port = NULL; 2193126353Smlaier } 2194126353Smlaier | ipspec PORT portspec { 2195126353Smlaier $$.host = $1; 2196126353Smlaier $$.port = $3; 2197126353Smlaier } 2198126353Smlaier | PORT portspec { 2199126353Smlaier $$.host = NULL; 2200126353Smlaier $$.port = $2; 2201126353Smlaier } 2202126353Smlaier ; 2203126353Smlaier 2204126353Smlaieripspec : ANY { $$ = NULL; } 2205126353Smlaier | xhost { $$ = $1; } 2206126353Smlaier | '{' host_list '}' { $$ = $2; } 2207126353Smlaier ; 2208126353Smlaier 2209126353Smlaierhost_list : xhost { $$ = $1; } 2210126353Smlaier | host_list comma xhost { 2211126353Smlaier if ($3 == NULL) 2212126353Smlaier $$ = $1; 2213126353Smlaier else if ($1 == NULL) 2214126353Smlaier $$ = $3; 2215126353Smlaier else { 2216126353Smlaier $1->tail->next = $3; 2217126353Smlaier $1->tail = $3->tail; 2218126353Smlaier $$ = $1; 2219126353Smlaier } 2220126353Smlaier } 2221126353Smlaier ; 2222126353Smlaier 2223126353Smlaierxhost : not host { 2224126353Smlaier struct node_host *n; 2225126353Smlaier 2226126353Smlaier for (n = $2; n != NULL; n = n->next) 2227126353Smlaier n->not = $1; 2228126353Smlaier $$ = $2; 2229126353Smlaier } 2230126353Smlaier | NOROUTE { 2231126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2232126353Smlaier if ($$ == NULL) 2233126353Smlaier err(1, "xhost: calloc"); 2234126353Smlaier $$->addr.type = PF_ADDR_NOROUTE; 2235126353Smlaier $$->next = NULL; 2236126353Smlaier $$->tail = $$; 2237126353Smlaier } 2238126353Smlaier ; 2239126353Smlaier 2240126353Smlaierhost : STRING { 2241126353Smlaier if (($$ = host($1)) == NULL) { 2242126353Smlaier /* error. "any" is handled elsewhere */ 2243130617Smlaier free($1); 2244126353Smlaier yyerror("could not parse host specification"); 2245126353Smlaier YYERROR; 2246126353Smlaier } 2247130617Smlaier free($1); 2248126353Smlaier 2249126353Smlaier } 2250126353Smlaier | STRING '/' number { 2251126353Smlaier char *buf; 2252126353Smlaier 2253126353Smlaier if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2254126353Smlaier err(1, "host: asprintf"); 2255130617Smlaier free($1); 2256126353Smlaier if (($$ = host(buf)) == NULL) { 2257126353Smlaier /* error. "any" is handled elsewhere */ 2258126353Smlaier free(buf); 2259126353Smlaier yyerror("could not parse host specification"); 2260126353Smlaier YYERROR; 2261126353Smlaier } 2262126353Smlaier free(buf); 2263126353Smlaier } 2264126353Smlaier | dynaddr 2265126353Smlaier | dynaddr '/' number { 2266126353Smlaier struct node_host *n; 2267126353Smlaier 2268126353Smlaier $$ = $1; 2269126353Smlaier for (n = $1; n != NULL; n = n->next) 2270126353Smlaier set_ipmask(n, $3); 2271126353Smlaier } 2272126353Smlaier | '<' STRING '>' { 2273126353Smlaier if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2274130617Smlaier yyerror("table name '%s' too long", $2); 2275130617Smlaier free($2); 2276126353Smlaier YYERROR; 2277126353Smlaier } 2278126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2279126353Smlaier if ($$ == NULL) 2280126353Smlaier err(1, "host: calloc"); 2281126353Smlaier $$->addr.type = PF_ADDR_TABLE; 2282126353Smlaier if (strlcpy($$->addr.v.tblname, $2, 2283126353Smlaier sizeof($$->addr.v.tblname)) >= 2284126353Smlaier sizeof($$->addr.v.tblname)) 2285126353Smlaier errx(1, "host: strlcpy"); 2286130617Smlaier free($2); 2287126353Smlaier $$->next = NULL; 2288126353Smlaier $$->tail = $$; 2289126353Smlaier } 2290145840Smlaier | ROUTE STRING { 2291145840Smlaier $$ = calloc(1, sizeof(struct node_host)); 2292145840Smlaier if ($$ == NULL) { 2293145840Smlaier free($2); 2294145840Smlaier err(1, "host: calloc"); 2295145840Smlaier } 2296145840Smlaier $$->addr.type = PF_ADDR_RTLABEL; 2297145840Smlaier if (strlcpy($$->addr.v.rtlabelname, $2, 2298145840Smlaier sizeof($$->addr.v.rtlabelname)) >= 2299145840Smlaier sizeof($$->addr.v.rtlabelname)) { 2300145840Smlaier yyerror("route label too long, max %u chars", 2301145840Smlaier sizeof($$->addr.v.rtlabelname) - 1); 2302145840Smlaier free($2); 2303145840Smlaier free($$); 2304145840Smlaier YYERROR; 2305145840Smlaier } 2306145840Smlaier $$->next = NULL; 2307145840Smlaier $$->tail = $$; 2308145840Smlaier free($2); 2309145840Smlaier } 2310126353Smlaier ; 2311126353Smlaier 2312126353Smlaiernumber : STRING { 2313126353Smlaier u_long ulval; 2314126353Smlaier 2315126353Smlaier if (atoul($1, &ulval) == -1) { 2316126353Smlaier yyerror("%s is not a number", $1); 2317130617Smlaier free($1); 2318126353Smlaier YYERROR; 2319126353Smlaier } else 2320126353Smlaier $$ = ulval; 2321130617Smlaier free($1); 2322126353Smlaier } 2323126353Smlaier ; 2324126353Smlaier 2325126353Smlaierdynaddr : '(' STRING ')' { 2326130617Smlaier int flags = 0; 2327130617Smlaier char *p, *op; 2328130617Smlaier 2329130617Smlaier op = $2; 2330145840Smlaier if (!isalpha(op[0])) { 2331145840Smlaier yyerror("invalid interface name '%s'", op); 2332145840Smlaier free(op); 2333145840Smlaier YYERROR; 2334145840Smlaier } 2335130617Smlaier while ((p = strrchr($2, ':')) != NULL) { 2336130617Smlaier if (!strcmp(p+1, "network")) 2337130617Smlaier flags |= PFI_AFLAG_NETWORK; 2338130617Smlaier else if (!strcmp(p+1, "broadcast")) 2339130617Smlaier flags |= PFI_AFLAG_BROADCAST; 2340130617Smlaier else if (!strcmp(p+1, "peer")) 2341130617Smlaier flags |= PFI_AFLAG_PEER; 2342130617Smlaier else if (!strcmp(p+1, "0")) 2343130617Smlaier flags |= PFI_AFLAG_NOALIAS; 2344130617Smlaier else { 2345130617Smlaier yyerror("interface %s has bad modifier", 2346130617Smlaier $2); 2347130617Smlaier free(op); 2348130617Smlaier YYERROR; 2349130617Smlaier } 2350130617Smlaier *p = '\0'; 2351130617Smlaier } 2352130617Smlaier if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2353130617Smlaier free(op); 2354130617Smlaier yyerror("illegal combination of " 2355130617Smlaier "interface modifiers"); 2356130617Smlaier YYERROR; 2357130617Smlaier } 2358126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2359126353Smlaier if ($$ == NULL) 2360126353Smlaier err(1, "address: calloc"); 2361126353Smlaier $$->af = 0; 2362126353Smlaier set_ipmask($$, 128); 2363126353Smlaier $$->addr.type = PF_ADDR_DYNIFTL; 2364130617Smlaier $$->addr.iflags = flags; 2365126353Smlaier if (strlcpy($$->addr.v.ifname, $2, 2366126353Smlaier sizeof($$->addr.v.ifname)) >= 2367126353Smlaier sizeof($$->addr.v.ifname)) { 2368130617Smlaier free(op); 2369126353Smlaier free($$); 2370126353Smlaier yyerror("interface name too long"); 2371126353Smlaier YYERROR; 2372126353Smlaier } 2373130617Smlaier free(op); 2374126353Smlaier $$->next = NULL; 2375126353Smlaier $$->tail = $$; 2376126353Smlaier } 2377126353Smlaier ; 2378126353Smlaier 2379126353Smlaierportspec : port_item { $$ = $1; } 2380126353Smlaier | '{' port_list '}' { $$ = $2; } 2381126353Smlaier ; 2382126353Smlaier 2383126353Smlaierport_list : port_item { $$ = $1; } 2384126353Smlaier | port_list comma port_item { 2385126353Smlaier $1->tail->next = $3; 2386126353Smlaier $1->tail = $3; 2387126353Smlaier $$ = $1; 2388126353Smlaier } 2389126353Smlaier ; 2390126353Smlaier 2391126353Smlaierport_item : port { 2392126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2393126353Smlaier if ($$ == NULL) 2394126353Smlaier err(1, "port_item: calloc"); 2395126353Smlaier $$->port[0] = $1.a; 2396126353Smlaier $$->port[1] = $1.b; 2397126353Smlaier if ($1.t) 2398126353Smlaier $$->op = PF_OP_RRG; 2399126353Smlaier else 2400126353Smlaier $$->op = PF_OP_EQ; 2401126353Smlaier $$->next = NULL; 2402126353Smlaier $$->tail = $$; 2403126353Smlaier } 2404126353Smlaier | unaryop port { 2405126353Smlaier if ($2.t) { 2406126353Smlaier yyerror("':' cannot be used with an other " 2407126353Smlaier "port operator"); 2408126353Smlaier YYERROR; 2409126353Smlaier } 2410126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2411126353Smlaier if ($$ == NULL) 2412126353Smlaier err(1, "port_item: calloc"); 2413126353Smlaier $$->port[0] = $2.a; 2414126353Smlaier $$->port[1] = $2.b; 2415126353Smlaier $$->op = $1; 2416126353Smlaier $$->next = NULL; 2417126353Smlaier $$->tail = $$; 2418126353Smlaier } 2419126353Smlaier | port PORTBINARY port { 2420126353Smlaier if ($1.t || $3.t) { 2421126353Smlaier yyerror("':' cannot be used with an other " 2422126353Smlaier "port operator"); 2423126353Smlaier YYERROR; 2424126353Smlaier } 2425126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2426126353Smlaier if ($$ == NULL) 2427126353Smlaier err(1, "port_item: calloc"); 2428126353Smlaier $$->port[0] = $1.a; 2429126353Smlaier $$->port[1] = $3.a; 2430126353Smlaier $$->op = $2; 2431126353Smlaier $$->next = NULL; 2432126353Smlaier $$->tail = $$; 2433126353Smlaier } 2434126353Smlaier ; 2435126353Smlaier 2436126353Smlaierport : STRING { 2437126353Smlaier char *p = strchr($1, ':'); 2438126353Smlaier struct servent *s = NULL; 2439126353Smlaier u_long ulval; 2440126353Smlaier 2441126353Smlaier if (p == NULL) { 2442126353Smlaier if (atoul($1, &ulval) == 0) { 2443126353Smlaier if (ulval > 65535) { 2444130617Smlaier free($1); 2445145840Smlaier yyerror("illegal port value %lu", 2446126353Smlaier ulval); 2447126353Smlaier YYERROR; 2448126353Smlaier } 2449126353Smlaier $$.a = htons(ulval); 2450126353Smlaier } else { 2451126353Smlaier s = getservbyname($1, "tcp"); 2452126353Smlaier if (s == NULL) 2453126353Smlaier s = getservbyname($1, "udp"); 2454126353Smlaier if (s == NULL) { 2455126353Smlaier yyerror("unknown port %s", $1); 2456130617Smlaier free($1); 2457126353Smlaier YYERROR; 2458126353Smlaier } 2459126353Smlaier $$.a = s->s_port; 2460126353Smlaier } 2461126353Smlaier $$.b = 0; 2462126353Smlaier $$.t = 0; 2463126353Smlaier } else { 2464126353Smlaier int port[2]; 2465126353Smlaier 2466126353Smlaier *p++ = 0; 2467126353Smlaier if ((port[0] = getservice($1)) == -1 || 2468130617Smlaier (port[1] = getservice(p)) == -1) { 2469130617Smlaier free($1); 2470126353Smlaier YYERROR; 2471130617Smlaier } 2472126353Smlaier $$.a = port[0]; 2473126353Smlaier $$.b = port[1]; 2474126353Smlaier $$.t = PF_OP_RRG; 2475126353Smlaier } 2476130617Smlaier free($1); 2477126353Smlaier } 2478126353Smlaier ; 2479126353Smlaier 2480126353Smlaieruids : uid_item { $$ = $1; } 2481126353Smlaier | '{' uid_list '}' { $$ = $2; } 2482126353Smlaier ; 2483126353Smlaier 2484126353Smlaieruid_list : uid_item { $$ = $1; } 2485126353Smlaier | uid_list comma uid_item { 2486126353Smlaier $1->tail->next = $3; 2487126353Smlaier $1->tail = $3; 2488126353Smlaier $$ = $1; 2489126353Smlaier } 2490126353Smlaier ; 2491126353Smlaier 2492126353Smlaieruid_item : uid { 2493126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2494126353Smlaier if ($$ == NULL) 2495126353Smlaier err(1, "uid_item: calloc"); 2496126353Smlaier $$->uid[0] = $1; 2497126353Smlaier $$->uid[1] = $1; 2498126353Smlaier $$->op = PF_OP_EQ; 2499126353Smlaier $$->next = NULL; 2500126353Smlaier $$->tail = $$; 2501126353Smlaier } 2502126353Smlaier | unaryop uid { 2503126353Smlaier if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2504126353Smlaier yyerror("user unknown requires operator = or " 2505126353Smlaier "!="); 2506126353Smlaier YYERROR; 2507126353Smlaier } 2508126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2509126353Smlaier if ($$ == NULL) 2510126353Smlaier err(1, "uid_item: calloc"); 2511126353Smlaier $$->uid[0] = $2; 2512126353Smlaier $$->uid[1] = $2; 2513126353Smlaier $$->op = $1; 2514126353Smlaier $$->next = NULL; 2515126353Smlaier $$->tail = $$; 2516126353Smlaier } 2517126353Smlaier | uid PORTBINARY uid { 2518126353Smlaier if ($1 == UID_MAX || $3 == UID_MAX) { 2519126353Smlaier yyerror("user unknown requires operator = or " 2520126353Smlaier "!="); 2521126353Smlaier YYERROR; 2522126353Smlaier } 2523126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2524126353Smlaier if ($$ == NULL) 2525126353Smlaier err(1, "uid_item: calloc"); 2526126353Smlaier $$->uid[0] = $1; 2527126353Smlaier $$->uid[1] = $3; 2528126353Smlaier $$->op = $2; 2529126353Smlaier $$->next = NULL; 2530126353Smlaier $$->tail = $$; 2531126353Smlaier } 2532126353Smlaier ; 2533126353Smlaier 2534126353Smlaieruid : STRING { 2535126353Smlaier u_long ulval; 2536126353Smlaier 2537126353Smlaier if (atoul($1, &ulval) == -1) { 2538126353Smlaier if (!strcmp($1, "unknown")) 2539126353Smlaier $$ = UID_MAX; 2540126353Smlaier else { 2541126353Smlaier struct passwd *pw; 2542126353Smlaier 2543126353Smlaier if ((pw = getpwnam($1)) == NULL) { 2544126353Smlaier yyerror("unknown user %s", $1); 2545130617Smlaier free($1); 2546126353Smlaier YYERROR; 2547126353Smlaier } 2548126353Smlaier $$ = pw->pw_uid; 2549126353Smlaier } 2550126353Smlaier } else { 2551126353Smlaier if (ulval >= UID_MAX) { 2552130617Smlaier free($1); 2553126353Smlaier yyerror("illegal uid value %lu", ulval); 2554126353Smlaier YYERROR; 2555126353Smlaier } 2556126353Smlaier $$ = ulval; 2557126353Smlaier } 2558130617Smlaier free($1); 2559126353Smlaier } 2560126353Smlaier ; 2561126353Smlaier 2562126353Smlaiergids : gid_item { $$ = $1; } 2563126353Smlaier | '{' gid_list '}' { $$ = $2; } 2564126353Smlaier ; 2565126353Smlaier 2566126353Smlaiergid_list : gid_item { $$ = $1; } 2567126353Smlaier | gid_list comma gid_item { 2568126353Smlaier $1->tail->next = $3; 2569126353Smlaier $1->tail = $3; 2570126353Smlaier $$ = $1; 2571126353Smlaier } 2572126353Smlaier ; 2573126353Smlaier 2574126353Smlaiergid_item : gid { 2575126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2576126353Smlaier if ($$ == NULL) 2577126353Smlaier err(1, "gid_item: calloc"); 2578126353Smlaier $$->gid[0] = $1; 2579126353Smlaier $$->gid[1] = $1; 2580126353Smlaier $$->op = PF_OP_EQ; 2581126353Smlaier $$->next = NULL; 2582126353Smlaier $$->tail = $$; 2583126353Smlaier } 2584126353Smlaier | unaryop gid { 2585126353Smlaier if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2586126353Smlaier yyerror("group unknown requires operator = or " 2587126353Smlaier "!="); 2588126353Smlaier YYERROR; 2589126353Smlaier } 2590126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2591126353Smlaier if ($$ == NULL) 2592126353Smlaier err(1, "gid_item: calloc"); 2593126353Smlaier $$->gid[0] = $2; 2594126353Smlaier $$->gid[1] = $2; 2595126353Smlaier $$->op = $1; 2596126353Smlaier $$->next = NULL; 2597126353Smlaier $$->tail = $$; 2598126353Smlaier } 2599126353Smlaier | gid PORTBINARY gid { 2600126353Smlaier if ($1 == GID_MAX || $3 == GID_MAX) { 2601126353Smlaier yyerror("group unknown requires operator = or " 2602126353Smlaier "!="); 2603126353Smlaier YYERROR; 2604126353Smlaier } 2605126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2606126353Smlaier if ($$ == NULL) 2607126353Smlaier err(1, "gid_item: calloc"); 2608126353Smlaier $$->gid[0] = $1; 2609126353Smlaier $$->gid[1] = $3; 2610126353Smlaier $$->op = $2; 2611126353Smlaier $$->next = NULL; 2612126353Smlaier $$->tail = $$; 2613126353Smlaier } 2614126353Smlaier ; 2615126353Smlaier 2616126353Smlaiergid : STRING { 2617126353Smlaier u_long ulval; 2618126353Smlaier 2619126353Smlaier if (atoul($1, &ulval) == -1) { 2620126353Smlaier if (!strcmp($1, "unknown")) 2621126353Smlaier $$ = GID_MAX; 2622126353Smlaier else { 2623126353Smlaier struct group *grp; 2624126353Smlaier 2625126353Smlaier if ((grp = getgrnam($1)) == NULL) { 2626126353Smlaier yyerror("unknown group %s", $1); 2627130617Smlaier free($1); 2628126353Smlaier YYERROR; 2629126353Smlaier } 2630126353Smlaier $$ = grp->gr_gid; 2631126353Smlaier } 2632126353Smlaier } else { 2633126353Smlaier if (ulval >= GID_MAX) { 2634126353Smlaier yyerror("illegal gid value %lu", ulval); 2635130617Smlaier free($1); 2636126353Smlaier YYERROR; 2637126353Smlaier } 2638126353Smlaier $$ = ulval; 2639126353Smlaier } 2640130617Smlaier free($1); 2641126353Smlaier } 2642126353Smlaier ; 2643126353Smlaier 2644126353Smlaierflag : STRING { 2645126353Smlaier int f; 2646126353Smlaier 2647126353Smlaier if ((f = parse_flags($1)) < 0) { 2648126353Smlaier yyerror("bad flags %s", $1); 2649130617Smlaier free($1); 2650126353Smlaier YYERROR; 2651126353Smlaier } 2652130617Smlaier free($1); 2653126353Smlaier $$.b1 = f; 2654126353Smlaier } 2655126353Smlaier ; 2656126353Smlaier 2657126353Smlaierflags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2658126353Smlaier | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2659126353Smlaier ; 2660126353Smlaier 2661126353Smlaiericmpspec : ICMPTYPE icmp_item { $$ = $2; } 2662126353Smlaier | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2663126353Smlaier | ICMP6TYPE icmp6_item { $$ = $2; } 2664126353Smlaier | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2665126353Smlaier ; 2666126353Smlaier 2667126353Smlaiericmp_list : icmp_item { $$ = $1; } 2668126353Smlaier | icmp_list comma icmp_item { 2669126353Smlaier $1->tail->next = $3; 2670126353Smlaier $1->tail = $3; 2671126353Smlaier $$ = $1; 2672126353Smlaier } 2673126353Smlaier ; 2674126353Smlaier 2675126353Smlaiericmp6_list : icmp6_item { $$ = $1; } 2676126353Smlaier | icmp6_list comma icmp6_item { 2677126353Smlaier $1->tail->next = $3; 2678126353Smlaier $1->tail = $3; 2679126353Smlaier $$ = $1; 2680126353Smlaier } 2681126353Smlaier ; 2682126353Smlaier 2683126353Smlaiericmp_item : icmptype { 2684126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2685126353Smlaier if ($$ == NULL) 2686126353Smlaier err(1, "icmp_item: calloc"); 2687126353Smlaier $$->type = $1; 2688126353Smlaier $$->code = 0; 2689126353Smlaier $$->proto = IPPROTO_ICMP; 2690126353Smlaier $$->next = NULL; 2691126353Smlaier $$->tail = $$; 2692126353Smlaier } 2693126353Smlaier | icmptype CODE STRING { 2694126353Smlaier const struct icmpcodeent *p; 2695126353Smlaier u_long ulval; 2696126353Smlaier 2697126353Smlaier if (atoul($3, &ulval) == 0) { 2698126353Smlaier if (ulval > 255) { 2699130617Smlaier free($3); 2700145840Smlaier yyerror("illegal icmp-code %lu", ulval); 2701126353Smlaier YYERROR; 2702126353Smlaier } 2703126353Smlaier } else { 2704126353Smlaier if ((p = geticmpcodebyname($1-1, $3, 2705126353Smlaier AF_INET)) == NULL) { 2706126353Smlaier yyerror("unknown icmp-code %s", $3); 2707130617Smlaier free($3); 2708126353Smlaier YYERROR; 2709126353Smlaier } 2710126353Smlaier ulval = p->code; 2711126353Smlaier } 2712130617Smlaier free($3); 2713126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2714126353Smlaier if ($$ == NULL) 2715126353Smlaier err(1, "icmp_item: calloc"); 2716126353Smlaier $$->type = $1; 2717126353Smlaier $$->code = ulval + 1; 2718126353Smlaier $$->proto = IPPROTO_ICMP; 2719126353Smlaier $$->next = NULL; 2720126353Smlaier $$->tail = $$; 2721126353Smlaier } 2722126353Smlaier ; 2723126353Smlaier 2724126353Smlaiericmp6_item : icmp6type { 2725126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2726126353Smlaier if ($$ == NULL) 2727126353Smlaier err(1, "icmp_item: calloc"); 2728126353Smlaier $$->type = $1; 2729126353Smlaier $$->code = 0; 2730126353Smlaier $$->proto = IPPROTO_ICMPV6; 2731126353Smlaier $$->next = NULL; 2732126353Smlaier $$->tail = $$; 2733126353Smlaier } 2734126353Smlaier | icmp6type CODE STRING { 2735126353Smlaier const struct icmpcodeent *p; 2736126353Smlaier u_long ulval; 2737126353Smlaier 2738126353Smlaier if (atoul($3, &ulval) == 0) { 2739126353Smlaier if (ulval > 255) { 2740145840Smlaier yyerror("illegal icmp6-code %lu", 2741126353Smlaier ulval); 2742130617Smlaier free($3); 2743126353Smlaier YYERROR; 2744126353Smlaier } 2745126353Smlaier } else { 2746126353Smlaier if ((p = geticmpcodebyname($1-1, $3, 2747126353Smlaier AF_INET6)) == NULL) { 2748126353Smlaier yyerror("unknown icmp6-code %s", $3); 2749130617Smlaier free($3); 2750126353Smlaier YYERROR; 2751126353Smlaier } 2752126353Smlaier ulval = p->code; 2753126353Smlaier } 2754130617Smlaier free($3); 2755126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2756126353Smlaier if ($$ == NULL) 2757126353Smlaier err(1, "icmp_item: calloc"); 2758126353Smlaier $$->type = $1; 2759126353Smlaier $$->code = ulval + 1; 2760126353Smlaier $$->proto = IPPROTO_ICMPV6; 2761126353Smlaier $$->next = NULL; 2762126353Smlaier $$->tail = $$; 2763126353Smlaier } 2764126353Smlaier ; 2765126353Smlaier 2766126353Smlaiericmptype : STRING { 2767126353Smlaier const struct icmptypeent *p; 2768126353Smlaier u_long ulval; 2769126353Smlaier 2770126353Smlaier if (atoul($1, &ulval) == 0) { 2771126353Smlaier if (ulval > 255) { 2772145840Smlaier yyerror("illegal icmp-type %lu", ulval); 2773130617Smlaier free($1); 2774126353Smlaier YYERROR; 2775126353Smlaier } 2776126353Smlaier $$ = ulval + 1; 2777126353Smlaier } else { 2778126353Smlaier if ((p = geticmptypebyname($1, AF_INET)) == 2779126353Smlaier NULL) { 2780126353Smlaier yyerror("unknown icmp-type %s", $1); 2781130617Smlaier free($1); 2782126353Smlaier YYERROR; 2783126353Smlaier } 2784126353Smlaier $$ = p->type + 1; 2785126353Smlaier } 2786130617Smlaier free($1); 2787126353Smlaier } 2788126353Smlaier ; 2789126353Smlaier 2790126353Smlaiericmp6type : STRING { 2791126353Smlaier const struct icmptypeent *p; 2792126353Smlaier u_long ulval; 2793126353Smlaier 2794126353Smlaier if (atoul($1, &ulval) == 0) { 2795126353Smlaier if (ulval > 255) { 2796145840Smlaier yyerror("illegal icmp6-type %lu", ulval); 2797130617Smlaier free($1); 2798126353Smlaier YYERROR; 2799126353Smlaier } 2800126353Smlaier $$ = ulval + 1; 2801126353Smlaier } else { 2802126353Smlaier if ((p = geticmptypebyname($1, AF_INET6)) == 2803126353Smlaier NULL) { 2804126353Smlaier yyerror("unknown icmp6-type %s", $1); 2805130617Smlaier free($1); 2806126353Smlaier YYERROR; 2807126353Smlaier } 2808126353Smlaier $$ = p->type + 1; 2809126353Smlaier } 2810130617Smlaier free($1); 2811126353Smlaier } 2812126353Smlaier ; 2813126353Smlaier 2814126353Smlaiertos : TOS STRING { 2815126353Smlaier if (!strcmp($2, "lowdelay")) 2816126353Smlaier $$ = IPTOS_LOWDELAY; 2817126353Smlaier else if (!strcmp($2, "throughput")) 2818126353Smlaier $$ = IPTOS_THROUGHPUT; 2819126353Smlaier else if (!strcmp($2, "reliability")) 2820126353Smlaier $$ = IPTOS_RELIABILITY; 2821126353Smlaier else if ($2[0] == '0' && $2[1] == 'x') 2822126353Smlaier $$ = strtoul($2, NULL, 16); 2823126353Smlaier else 2824126353Smlaier $$ = strtoul($2, NULL, 10); 2825126353Smlaier if (!$$ || $$ > 255) { 2826126353Smlaier yyerror("illegal tos value %s", $2); 2827130617Smlaier free($2); 2828126353Smlaier YYERROR; 2829126353Smlaier } 2830130617Smlaier free($2); 2831126353Smlaier } 2832126353Smlaier ; 2833126353Smlaier 2834130617Smlaiersourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 2835130617Smlaier | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 2836130617Smlaier | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 2837130617Smlaier ; 2838130617Smlaier 2839130617Smlaierstatelock : IFBOUND { 2840130617Smlaier $$ = PFRULE_IFBOUND; 2841130617Smlaier } 2842130617Smlaier | GRBOUND { 2843130617Smlaier $$ = PFRULE_GRBOUND; 2844130617Smlaier } 2845130617Smlaier | FLOATING { 2846130617Smlaier $$ = 0; 2847130617Smlaier } 2848130617Smlaier ; 2849130617Smlaier 2850126353Smlaierkeep : KEEP STATE state_opt_spec { 2851126353Smlaier $$.action = PF_STATE_NORMAL; 2852126353Smlaier $$.options = $3; 2853126353Smlaier } 2854130617Smlaier | MODULATE STATE state_opt_spec { 2855126353Smlaier $$.action = PF_STATE_MODULATE; 2856126353Smlaier $$.options = $3; 2857126353Smlaier } 2858126353Smlaier | SYNPROXY STATE state_opt_spec { 2859126353Smlaier $$.action = PF_STATE_SYNPROXY; 2860126353Smlaier $$.options = $3; 2861126353Smlaier } 2862126353Smlaier ; 2863126353Smlaier 2864145840Smlaierflush : /* empty */ { $$ = 0; } 2865145840Smlaier | FLUSH { $$ = PF_FLUSH; } 2866145840Smlaier | FLUSH GLOBAL { 2867145840Smlaier $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 2868145840Smlaier } 2869145840Smlaier ; 2870145840Smlaier 2871126353Smlaierstate_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2872126353Smlaier | /* empty */ { $$ = NULL; } 2873126353Smlaier ; 2874126353Smlaier 2875126353Smlaierstate_opt_list : state_opt_item { $$ = $1; } 2876126353Smlaier | state_opt_list comma state_opt_item { 2877126353Smlaier $1->tail->next = $3; 2878126353Smlaier $1->tail = $3; 2879126353Smlaier $$ = $1; 2880126353Smlaier } 2881126353Smlaier ; 2882126353Smlaier 2883126353Smlaierstate_opt_item : MAXIMUM number { 2884126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2885126353Smlaier if ($$ == NULL) 2886126353Smlaier err(1, "state_opt_item: calloc"); 2887126353Smlaier $$->type = PF_STATE_OPT_MAX; 2888126353Smlaier $$->data.max_states = $2; 2889126353Smlaier $$->next = NULL; 2890126353Smlaier $$->tail = $$; 2891126353Smlaier } 2892130617Smlaier | NOSYNC { 2893130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2894130617Smlaier if ($$ == NULL) 2895130617Smlaier err(1, "state_opt_item: calloc"); 2896130617Smlaier $$->type = PF_STATE_OPT_NOSYNC; 2897130617Smlaier $$->next = NULL; 2898130617Smlaier $$->tail = $$; 2899130617Smlaier } 2900130617Smlaier | MAXSRCSTATES number { 2901130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2902130617Smlaier if ($$ == NULL) 2903130617Smlaier err(1, "state_opt_item: calloc"); 2904130617Smlaier $$->type = PF_STATE_OPT_MAX_SRC_STATES; 2905130617Smlaier $$->data.max_src_states = $2; 2906130617Smlaier $$->next = NULL; 2907130617Smlaier $$->tail = $$; 2908130617Smlaier } 2909145840Smlaier | MAXSRCCONN number { 2910145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2911145840Smlaier if ($$ == NULL) 2912145840Smlaier err(1, "state_opt_item: calloc"); 2913145840Smlaier $$->type = PF_STATE_OPT_MAX_SRC_CONN; 2914145840Smlaier $$->data.max_src_conn = $2; 2915145840Smlaier $$->next = NULL; 2916145840Smlaier $$->tail = $$; 2917145840Smlaier } 2918145840Smlaier | MAXSRCCONNRATE number '/' number { 2919145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2920145840Smlaier if ($$ == NULL) 2921145840Smlaier err(1, "state_opt_item: calloc"); 2922145840Smlaier $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 2923145840Smlaier $$->data.max_src_conn_rate.limit = $2; 2924145840Smlaier $$->data.max_src_conn_rate.seconds = $4; 2925145840Smlaier $$->next = NULL; 2926145840Smlaier $$->tail = $$; 2927145840Smlaier } 2928145840Smlaier | OVERLOAD '<' STRING '>' flush { 2929145840Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 2930145840Smlaier yyerror("table name '%s' too long", $3); 2931145840Smlaier free($3); 2932145840Smlaier YYERROR; 2933145840Smlaier } 2934145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2935145840Smlaier if ($$ == NULL) 2936145840Smlaier err(1, "state_opt_item: calloc"); 2937145840Smlaier if (strlcpy($$->data.overload.tblname, $3, 2938145840Smlaier PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 2939145840Smlaier errx(1, "state_opt_item: strlcpy"); 2940145840Smlaier free($3); 2941145840Smlaier $$->type = PF_STATE_OPT_OVERLOAD; 2942145840Smlaier $$->data.overload.flush = $5; 2943145840Smlaier $$->next = NULL; 2944145840Smlaier $$->tail = $$; 2945145840Smlaier } 2946130617Smlaier | MAXSRCNODES number { 2947130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2948130617Smlaier if ($$ == NULL) 2949130617Smlaier err(1, "state_opt_item: calloc"); 2950130617Smlaier $$->type = PF_STATE_OPT_MAX_SRC_NODES; 2951130617Smlaier $$->data.max_src_nodes = $2; 2952130617Smlaier $$->next = NULL; 2953130617Smlaier $$->tail = $$; 2954130617Smlaier } 2955130617Smlaier | sourcetrack { 2956130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2957130617Smlaier if ($$ == NULL) 2958130617Smlaier err(1, "state_opt_item: calloc"); 2959130617Smlaier $$->type = PF_STATE_OPT_SRCTRACK; 2960130617Smlaier $$->data.src_track = $1; 2961130617Smlaier $$->next = NULL; 2962130617Smlaier $$->tail = $$; 2963130617Smlaier } 2964130617Smlaier | statelock { 2965130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2966130617Smlaier if ($$ == NULL) 2967130617Smlaier err(1, "state_opt_item: calloc"); 2968130617Smlaier $$->type = PF_STATE_OPT_STATELOCK; 2969130617Smlaier $$->data.statelock = $1; 2970130617Smlaier $$->next = NULL; 2971130617Smlaier $$->tail = $$; 2972130617Smlaier } 2973126353Smlaier | STRING number { 2974126353Smlaier int i; 2975126353Smlaier 2976126353Smlaier for (i = 0; pf_timeouts[i].name && 2977126353Smlaier strcmp(pf_timeouts[i].name, $1); ++i) 2978126353Smlaier ; /* nothing */ 2979126353Smlaier if (!pf_timeouts[i].name) { 2980126353Smlaier yyerror("illegal timeout name %s", $1); 2981130617Smlaier free($1); 2982126353Smlaier YYERROR; 2983126353Smlaier } 2984126353Smlaier if (strchr(pf_timeouts[i].name, '.') == NULL) { 2985126353Smlaier yyerror("illegal state timeout %s", $1); 2986130617Smlaier free($1); 2987126353Smlaier YYERROR; 2988126353Smlaier } 2989130617Smlaier free($1); 2990126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2991126353Smlaier if ($$ == NULL) 2992126353Smlaier err(1, "state_opt_item: calloc"); 2993126353Smlaier $$->type = PF_STATE_OPT_TIMEOUT; 2994126353Smlaier $$->data.timeout.number = pf_timeouts[i].timeout; 2995126353Smlaier $$->data.timeout.seconds = $2; 2996126353Smlaier $$->next = NULL; 2997126353Smlaier $$->tail = $$; 2998126353Smlaier } 2999126353Smlaier ; 3000126353Smlaier 3001126353Smlaierlabel : LABEL STRING { 3002130617Smlaier $$ = $2; 3003126353Smlaier } 3004126353Smlaier ; 3005126353Smlaier 3006126353Smlaierqname : QUEUE STRING { 3007130617Smlaier $$.qname = $2; 3008126353Smlaier } 3009126353Smlaier | QUEUE '(' STRING ')' { 3010130617Smlaier $$.qname = $3; 3011126353Smlaier } 3012126353Smlaier | QUEUE '(' STRING comma STRING ')' { 3013130617Smlaier $$.qname = $3; 3014130617Smlaier $$.pqname = $5; 3015126353Smlaier } 3016126353Smlaier ; 3017126353Smlaier 3018126353Smlaierno : /* empty */ { $$ = 0; } 3019126353Smlaier | NO { $$ = 1; } 3020126353Smlaier ; 3021126353Smlaier 3022126353Smlaierrport : STRING { 3023126353Smlaier char *p = strchr($1, ':'); 3024126353Smlaier 3025126353Smlaier if (p == NULL) { 3026130617Smlaier if (($$.a = getservice($1)) == -1) { 3027130617Smlaier free($1); 3028126353Smlaier YYERROR; 3029130617Smlaier } 3030126353Smlaier $$.b = $$.t = 0; 3031126353Smlaier } else if (!strcmp(p+1, "*")) { 3032126353Smlaier *p = 0; 3033130617Smlaier if (($$.a = getservice($1)) == -1) { 3034130617Smlaier free($1); 3035126353Smlaier YYERROR; 3036130617Smlaier } 3037126353Smlaier $$.b = 0; 3038126353Smlaier $$.t = 1; 3039126353Smlaier } else { 3040126353Smlaier *p++ = 0; 3041126353Smlaier if (($$.a = getservice($1)) == -1 || 3042130617Smlaier ($$.b = getservice(p)) == -1) { 3043130617Smlaier free($1); 3044126353Smlaier YYERROR; 3045130617Smlaier } 3046126353Smlaier if ($$.a == $$.b) 3047126353Smlaier $$.b = 0; 3048126353Smlaier $$.t = 0; 3049126353Smlaier } 3050130617Smlaier free($1); 3051126353Smlaier } 3052126353Smlaier ; 3053126353Smlaier 3054126353Smlaierredirspec : host { $$ = $1; } 3055126353Smlaier | '{' redir_host_list '}' { $$ = $2; } 3056126353Smlaier ; 3057126353Smlaier 3058126353Smlaierredir_host_list : host { $$ = $1; } 3059126353Smlaier | redir_host_list comma host { 3060126353Smlaier $1->tail->next = $3; 3061126353Smlaier $1->tail = $3->tail; 3062126353Smlaier $$ = $1; 3063126353Smlaier } 3064126353Smlaier ; 3065126353Smlaier 3066126353Smlaierredirpool : /* empty */ { $$ = NULL; } 3067126353Smlaier | ARROW redirspec { 3068126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3069126353Smlaier if ($$ == NULL) 3070126353Smlaier err(1, "redirection: calloc"); 3071126353Smlaier $$->host = $2; 3072126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 3073126353Smlaier } 3074126353Smlaier | ARROW redirspec PORT rport { 3075126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3076126353Smlaier if ($$ == NULL) 3077126353Smlaier err(1, "redirection: calloc"); 3078126353Smlaier $$->host = $2; 3079126353Smlaier $$->rport = $4; 3080126353Smlaier } 3081126353Smlaier ; 3082126353Smlaier 3083126353Smlaierhashkey : /* empty */ 3084126353Smlaier { 3085126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3086126353Smlaier if ($$ == NULL) 3087126353Smlaier err(1, "hashkey: calloc"); 3088126353Smlaier $$->key32[0] = arc4random(); 3089126353Smlaier $$->key32[1] = arc4random(); 3090126353Smlaier $$->key32[2] = arc4random(); 3091126353Smlaier $$->key32[3] = arc4random(); 3092126353Smlaier } 3093126353Smlaier | string 3094126353Smlaier { 3095126353Smlaier if (!strncmp($1, "0x", 2)) { 3096126353Smlaier if (strlen($1) != 34) { 3097130617Smlaier free($1); 3098126353Smlaier yyerror("hex key must be 128 bits " 3099126353Smlaier "(32 hex digits) long"); 3100126353Smlaier YYERROR; 3101126353Smlaier } 3102126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3103126353Smlaier if ($$ == NULL) 3104126353Smlaier err(1, "hashkey: calloc"); 3105126353Smlaier 3106126353Smlaier if (sscanf($1, "0x%8x%8x%8x%8x", 3107126353Smlaier &$$->key32[0], &$$->key32[1], 3108126353Smlaier &$$->key32[2], &$$->key32[3]) != 4) { 3109126353Smlaier free($$); 3110130617Smlaier free($1); 3111126353Smlaier yyerror("invalid hex key"); 3112126353Smlaier YYERROR; 3113126353Smlaier } 3114126353Smlaier } else { 3115126353Smlaier MD5_CTX context; 3116126353Smlaier 3117126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3118126353Smlaier if ($$ == NULL) 3119126353Smlaier err(1, "hashkey: calloc"); 3120126353Smlaier MD5Init(&context); 3121126353Smlaier MD5Update(&context, (unsigned char *)$1, 3122126353Smlaier strlen($1)); 3123126353Smlaier MD5Final((unsigned char *)$$, &context); 3124126353Smlaier HTONL($$->key32[0]); 3125126353Smlaier HTONL($$->key32[1]); 3126126353Smlaier HTONL($$->key32[2]); 3127126353Smlaier HTONL($$->key32[3]); 3128126353Smlaier } 3129130617Smlaier free($1); 3130126353Smlaier } 3131126353Smlaier ; 3132126353Smlaier 3133130617Smlaierpool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3134130617Smlaier pool_opts_l 3135130617Smlaier { $$ = pool_opts; } 3136130617Smlaier | /* empty */ { 3137130617Smlaier bzero(&pool_opts, sizeof pool_opts); 3138130617Smlaier $$ = pool_opts; 3139126353Smlaier } 3140130617Smlaier ; 3141130617Smlaier 3142130617Smlaierpool_opts_l : pool_opts_l pool_opt 3143130617Smlaier | pool_opt 3144130617Smlaier ; 3145130617Smlaier 3146130617Smlaierpool_opt : BITMASK { 3147130617Smlaier if (pool_opts.type) { 3148130617Smlaier yyerror("pool type cannot be redefined"); 3149130617Smlaier YYERROR; 3150130617Smlaier } 3151130617Smlaier pool_opts.type = PF_POOL_BITMASK; 3152126353Smlaier } 3153130617Smlaier | RANDOM { 3154130617Smlaier if (pool_opts.type) { 3155130617Smlaier yyerror("pool type cannot be redefined"); 3156130617Smlaier YYERROR; 3157130617Smlaier } 3158130617Smlaier pool_opts.type = PF_POOL_RANDOM; 3159126353Smlaier } 3160130617Smlaier | SOURCEHASH hashkey { 3161130617Smlaier if (pool_opts.type) { 3162130617Smlaier yyerror("pool type cannot be redefined"); 3163130617Smlaier YYERROR; 3164130617Smlaier } 3165130617Smlaier pool_opts.type = PF_POOL_SRCHASH; 3166130617Smlaier pool_opts.key = $2; 3167126353Smlaier } 3168130617Smlaier | ROUNDROBIN { 3169130617Smlaier if (pool_opts.type) { 3170130617Smlaier yyerror("pool type cannot be redefined"); 3171130617Smlaier YYERROR; 3172130617Smlaier } 3173130617Smlaier pool_opts.type = PF_POOL_ROUNDROBIN; 3174126353Smlaier } 3175130617Smlaier | STATICPORT { 3176130617Smlaier if (pool_opts.staticport) { 3177130617Smlaier yyerror("static-port cannot be redefined"); 3178130617Smlaier YYERROR; 3179130617Smlaier } 3180130617Smlaier pool_opts.staticport = 1; 3181130617Smlaier } 3182130617Smlaier | STICKYADDRESS { 3183130617Smlaier if (filter_opts.marker & POM_STICKYADDRESS) { 3184130617Smlaier yyerror("sticky-address cannot be redefined"); 3185130617Smlaier YYERROR; 3186130617Smlaier } 3187130617Smlaier pool_opts.marker |= POM_STICKYADDRESS; 3188130617Smlaier pool_opts.opts |= PF_POOL_STICKYADDR; 3189130617Smlaier } 3190126353Smlaier ; 3191126353Smlaier 3192126353Smlaierredirection : /* empty */ { $$ = NULL; } 3193126353Smlaier | ARROW host { 3194126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3195126353Smlaier if ($$ == NULL) 3196126353Smlaier err(1, "redirection: calloc"); 3197126353Smlaier $$->host = $2; 3198126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 3199126353Smlaier } 3200126353Smlaier | ARROW host PORT rport { 3201126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3202126353Smlaier if ($$ == NULL) 3203126353Smlaier err(1, "redirection: calloc"); 3204126353Smlaier $$->host = $2; 3205126353Smlaier $$->rport = $4; 3206126353Smlaier } 3207126353Smlaier ; 3208126353Smlaier 3209126353Smlaiernatpass : /* empty */ { $$ = 0; } 3210126353Smlaier | PASS { $$ = 1; } 3211126353Smlaier ; 3212126353Smlaier 3213126353Smlaiernataction : no NAT natpass { 3214126353Smlaier $$.b2 = $$.w = 0; 3215126353Smlaier if ($1) 3216126353Smlaier $$.b1 = PF_NONAT; 3217126353Smlaier else 3218126353Smlaier $$.b1 = PF_NAT; 3219126353Smlaier $$.b2 = $3; 3220126353Smlaier } 3221126353Smlaier | no RDR natpass { 3222126353Smlaier $$.b2 = $$.w = 0; 3223126353Smlaier if ($1) 3224126353Smlaier $$.b1 = PF_NORDR; 3225126353Smlaier else 3226126353Smlaier $$.b1 = PF_RDR; 3227126353Smlaier $$.b2 = $3; 3228126353Smlaier } 3229126353Smlaier ; 3230126353Smlaier 3231145840Smlaiernatrule : nataction interface af proto fromto tag tagged redirpool pool_opts 3232126353Smlaier { 3233126353Smlaier struct pf_rule r; 3234126353Smlaier 3235126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 3236126353Smlaier YYERROR; 3237126353Smlaier 3238126353Smlaier memset(&r, 0, sizeof(r)); 3239126353Smlaier 3240126353Smlaier r.action = $1.b1; 3241126353Smlaier r.natpass = $1.b2; 3242126353Smlaier r.af = $3; 3243126353Smlaier 3244126353Smlaier if (!r.af) { 3245126353Smlaier if ($5.src.host && $5.src.host->af && 3246126353Smlaier !$5.src.host->ifindex) 3247126353Smlaier r.af = $5.src.host->af; 3248126353Smlaier else if ($5.dst.host && $5.dst.host->af && 3249126353Smlaier !$5.dst.host->ifindex) 3250126353Smlaier r.af = $5.dst.host->af; 3251126353Smlaier } 3252126353Smlaier 3253126353Smlaier if ($6 != NULL) 3254130617Smlaier if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3255126353Smlaier PF_TAG_NAME_SIZE) { 3256126353Smlaier yyerror("tag too long, max %u chars", 3257126353Smlaier PF_TAG_NAME_SIZE - 1); 3258126353Smlaier YYERROR; 3259126353Smlaier } 3260126353Smlaier 3261145840Smlaier if ($7.name) 3262145840Smlaier if (strlcpy(r.match_tagname, $7.name, 3263145840Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3264145840Smlaier yyerror("tag too long, max %u chars", 3265145840Smlaier PF_TAG_NAME_SIZE - 1); 3266145840Smlaier YYERROR; 3267145840Smlaier } 3268145840Smlaier r.match_tag_not = $7.neg; 3269145840Smlaier 3270126353Smlaier if (r.action == PF_NONAT || r.action == PF_NORDR) { 3271145840Smlaier if ($8 != NULL) { 3272126353Smlaier yyerror("translation rule with 'no' " 3273126353Smlaier "does not need '->'"); 3274126353Smlaier YYERROR; 3275126353Smlaier } 3276126353Smlaier } else { 3277145840Smlaier if ($8 == NULL || $8->host == NULL) { 3278126353Smlaier yyerror("translation rule requires '-> " 3279126353Smlaier "address'"); 3280126353Smlaier YYERROR; 3281126353Smlaier } 3282145840Smlaier if (!r.af && ! $8->host->ifindex) 3283145840Smlaier r.af = $8->host->af; 3284126353Smlaier 3285145840Smlaier remove_invalid_hosts(&$8->host, &r.af); 3286145840Smlaier if (invalid_redirect($8->host, r.af)) 3287126353Smlaier YYERROR; 3288145840Smlaier if (check_netmask($8->host, r.af)) 3289126353Smlaier YYERROR; 3290126353Smlaier 3291145840Smlaier r.rpool.proxy_port[0] = ntohs($8->rport.a); 3292126353Smlaier 3293126353Smlaier switch (r.action) { 3294126353Smlaier case PF_RDR: 3295145840Smlaier if (!$8->rport.b && $8->rport.t && 3296126353Smlaier $5.dst.port != NULL) { 3297126353Smlaier r.rpool.proxy_port[1] = 3298145840Smlaier ntohs($8->rport.a) + 3299130617Smlaier (ntohs( 3300130617Smlaier $5.dst.port->port[1]) - 3301130617Smlaier ntohs( 3302130617Smlaier $5.dst.port->port[0])); 3303126353Smlaier } else 3304126353Smlaier r.rpool.proxy_port[1] = 3305145840Smlaier ntohs($8->rport.b); 3306126353Smlaier break; 3307126353Smlaier case PF_NAT: 3308130617Smlaier r.rpool.proxy_port[1] = 3309145840Smlaier ntohs($8->rport.b); 3310126353Smlaier if (!r.rpool.proxy_port[0] && 3311126353Smlaier !r.rpool.proxy_port[1]) { 3312126353Smlaier r.rpool.proxy_port[0] = 3313126353Smlaier PF_NAT_PROXY_PORT_LOW; 3314126353Smlaier r.rpool.proxy_port[1] = 3315126353Smlaier PF_NAT_PROXY_PORT_HIGH; 3316126353Smlaier } else if (!r.rpool.proxy_port[1]) 3317126353Smlaier r.rpool.proxy_port[1] = 3318126353Smlaier r.rpool.proxy_port[0]; 3319126353Smlaier break; 3320126353Smlaier default: 3321126353Smlaier break; 3322126353Smlaier } 3323126353Smlaier 3324145840Smlaier r.rpool.opts = $9.type; 3325130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3326145840Smlaier PF_POOL_NONE && ($8->host->next != NULL || 3327145840Smlaier $8->host->addr.type == PF_ADDR_TABLE || 3328145840Smlaier DYNIF_MULTIADDR($8->host->addr))) 3329126353Smlaier r.rpool.opts = PF_POOL_ROUNDROBIN; 3330130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3331130617Smlaier PF_POOL_ROUNDROBIN && 3332145840Smlaier disallow_table($8->host, "tables are only " 3333130617Smlaier "supported in round-robin redirection " 3334130617Smlaier "pools")) 3335130617Smlaier YYERROR; 3336130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3337130617Smlaier PF_POOL_ROUNDROBIN && 3338145840Smlaier disallow_alias($8->host, "interface (%s) " 3339130617Smlaier "is only supported in round-robin " 3340130617Smlaier "redirection pools")) 3341130617Smlaier YYERROR; 3342145840Smlaier if ($8->host->next != NULL) { 3343130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3344126353Smlaier PF_POOL_ROUNDROBIN) { 3345126353Smlaier yyerror("only round-robin " 3346126353Smlaier "valid for multiple " 3347126353Smlaier "redirection addresses"); 3348126353Smlaier YYERROR; 3349126353Smlaier } 3350126353Smlaier } 3351126353Smlaier } 3352126353Smlaier 3353145840Smlaier if ($9.key != NULL) 3354145840Smlaier memcpy(&r.rpool.key, $9.key, 3355126353Smlaier sizeof(struct pf_poolhashkey)); 3356126353Smlaier 3357145840Smlaier if ($9.opts) 3358145840Smlaier r.rpool.opts |= $9.opts; 3359130617Smlaier 3360145840Smlaier if ($9.staticport) { 3361126353Smlaier if (r.action != PF_NAT) { 3362126353Smlaier yyerror("the 'static-port' option is " 3363126353Smlaier "only valid with nat rules"); 3364126353Smlaier YYERROR; 3365126353Smlaier } 3366126353Smlaier if (r.rpool.proxy_port[0] != 3367126353Smlaier PF_NAT_PROXY_PORT_LOW && 3368126353Smlaier r.rpool.proxy_port[1] != 3369126353Smlaier PF_NAT_PROXY_PORT_HIGH) { 3370126353Smlaier yyerror("the 'static-port' option can't" 3371126353Smlaier " be used when specifying a port" 3372126353Smlaier " range"); 3373126353Smlaier YYERROR; 3374126353Smlaier } 3375126353Smlaier r.rpool.proxy_port[0] = 0; 3376126353Smlaier r.rpool.proxy_port[1] = 0; 3377126353Smlaier } 3378126353Smlaier 3379145840Smlaier expand_rule(&r, $2, $8 == NULL ? NULL : $8->host, $4, 3380126353Smlaier $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3381145840Smlaier $5.dst.port, 0, 0, 0, ""); 3382145840Smlaier free($8); 3383126353Smlaier } 3384126353Smlaier ; 3385126353Smlaier 3386145840Smlaierbinatrule : no BINAT natpass interface af proto FROM host TO ipspec tag tagged 3387130617Smlaier redirection 3388126353Smlaier { 3389126353Smlaier struct pf_rule binat; 3390126353Smlaier struct pf_pooladdr *pa; 3391126353Smlaier 3392126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 3393126353Smlaier YYERROR; 3394126353Smlaier 3395126353Smlaier memset(&binat, 0, sizeof(binat)); 3396126353Smlaier 3397126353Smlaier if ($1) 3398126353Smlaier binat.action = PF_NOBINAT; 3399126353Smlaier else 3400126353Smlaier binat.action = PF_BINAT; 3401126353Smlaier binat.natpass = $3; 3402126353Smlaier binat.af = $5; 3403126353Smlaier if (!binat.af && $8 != NULL && $8->af) 3404126353Smlaier binat.af = $8->af; 3405126353Smlaier if (!binat.af && $10 != NULL && $10->af) 3406126353Smlaier binat.af = $10->af; 3407145840Smlaier 3408145840Smlaier if (!binat.af && $13 != NULL && $13->host) 3409145840Smlaier binat.af = $13->host->af; 3410126353Smlaier if (!binat.af) { 3411126353Smlaier yyerror("address family (inet/inet6) " 3412126353Smlaier "undefined"); 3413126353Smlaier YYERROR; 3414126353Smlaier } 3415126353Smlaier 3416126353Smlaier if ($4 != NULL) { 3417126353Smlaier memcpy(binat.ifname, $4->ifname, 3418126353Smlaier sizeof(binat.ifname)); 3419130617Smlaier binat.ifnot = $4->not; 3420126353Smlaier free($4); 3421126353Smlaier } 3422145840Smlaier 3423126353Smlaier if ($11 != NULL) 3424126353Smlaier if (strlcpy(binat.tagname, $11, 3425130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3426126353Smlaier yyerror("tag too long, max %u chars", 3427126353Smlaier PF_TAG_NAME_SIZE - 1); 3428126353Smlaier YYERROR; 3429126353Smlaier } 3430145840Smlaier if ($12.name) 3431145840Smlaier if (strlcpy(binat.match_tagname, $12.name, 3432145840Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3433145840Smlaier yyerror("tag too long, max %u chars", 3434145840Smlaier PF_TAG_NAME_SIZE - 1); 3435145840Smlaier YYERROR; 3436145840Smlaier } 3437145840Smlaier binat.match_tag_not = $12.neg; 3438126353Smlaier 3439126353Smlaier if ($6 != NULL) { 3440126353Smlaier binat.proto = $6->proto; 3441126353Smlaier free($6); 3442126353Smlaier } 3443126353Smlaier 3444126353Smlaier if ($8 != NULL && disallow_table($8, "invalid use of " 3445126353Smlaier "table <%s> as the source address of a binat rule")) 3446126353Smlaier YYERROR; 3447130617Smlaier if ($8 != NULL && disallow_alias($8, "invalid use of " 3448130617Smlaier "interface (%s) as the source address of a binat " 3449130617Smlaier "rule")) 3450130617Smlaier YYERROR; 3451145840Smlaier if ($13 != NULL && $13->host != NULL && disallow_table( 3452145840Smlaier $13->host, "invalid use of table <%s> as the " 3453126353Smlaier "redirect address of a binat rule")) 3454126353Smlaier YYERROR; 3455145840Smlaier if ($13 != NULL && $13->host != NULL && disallow_alias( 3456145840Smlaier $13->host, "invalid use of interface (%s) as the " 3457130617Smlaier "redirect address of a binat rule")) 3458130617Smlaier YYERROR; 3459126353Smlaier 3460126353Smlaier if ($8 != NULL) { 3461126353Smlaier if ($8->next) { 3462126353Smlaier yyerror("multiple binat ip addresses"); 3463126353Smlaier YYERROR; 3464126353Smlaier } 3465126353Smlaier if ($8->addr.type == PF_ADDR_DYNIFTL) 3466126353Smlaier $8->af = binat.af; 3467126353Smlaier if ($8->af != binat.af) { 3468126353Smlaier yyerror("binat ip versions must match"); 3469126353Smlaier YYERROR; 3470126353Smlaier } 3471126353Smlaier if (check_netmask($8, binat.af)) 3472126353Smlaier YYERROR; 3473126353Smlaier memcpy(&binat.src.addr, &$8->addr, 3474126353Smlaier sizeof(binat.src.addr)); 3475126353Smlaier free($8); 3476126353Smlaier } 3477126353Smlaier if ($10 != NULL) { 3478126353Smlaier if ($10->next) { 3479126353Smlaier yyerror("multiple binat ip addresses"); 3480126353Smlaier YYERROR; 3481126353Smlaier } 3482126353Smlaier if ($10->af != binat.af && $10->af) { 3483126353Smlaier yyerror("binat ip versions must match"); 3484126353Smlaier YYERROR; 3485126353Smlaier } 3486126353Smlaier if (check_netmask($10, binat.af)) 3487126353Smlaier YYERROR; 3488126353Smlaier memcpy(&binat.dst.addr, &$10->addr, 3489126353Smlaier sizeof(binat.dst.addr)); 3490145840Smlaier binat.dst.neg = $10->not; 3491126353Smlaier free($10); 3492126353Smlaier } 3493126353Smlaier 3494126353Smlaier if (binat.action == PF_NOBINAT) { 3495145840Smlaier if ($13 != NULL) { 3496126353Smlaier yyerror("'no binat' rule does not need" 3497126353Smlaier " '->'"); 3498126353Smlaier YYERROR; 3499126353Smlaier } 3500126353Smlaier } else { 3501145840Smlaier if ($13 == NULL || $13->host == NULL) { 3502126353Smlaier yyerror("'binat' rule requires" 3503126353Smlaier " '-> address'"); 3504126353Smlaier YYERROR; 3505126353Smlaier } 3506126353Smlaier 3507145840Smlaier remove_invalid_hosts(&$13->host, &binat.af); 3508145840Smlaier if (invalid_redirect($13->host, binat.af)) 3509126353Smlaier YYERROR; 3510145840Smlaier if ($13->host->next != NULL) { 3511126353Smlaier yyerror("binat rule must redirect to " 3512126353Smlaier "a single address"); 3513126353Smlaier YYERROR; 3514126353Smlaier } 3515145840Smlaier if (check_netmask($13->host, binat.af)) 3516126353Smlaier YYERROR; 3517126353Smlaier 3518126353Smlaier if (!PF_AZERO(&binat.src.addr.v.a.mask, 3519126353Smlaier binat.af) && 3520126353Smlaier !PF_AEQ(&binat.src.addr.v.a.mask, 3521145840Smlaier &$13->host->addr.v.a.mask, binat.af)) { 3522126353Smlaier yyerror("'binat' source mask and " 3523126353Smlaier "redirect mask must be the same"); 3524126353Smlaier YYERROR; 3525126353Smlaier } 3526126353Smlaier 3527126353Smlaier TAILQ_INIT(&binat.rpool.list); 3528126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 3529126353Smlaier if (pa == NULL) 3530126353Smlaier err(1, "binat: calloc"); 3531145840Smlaier pa->addr = $13->host->addr; 3532126353Smlaier pa->ifname[0] = 0; 3533126353Smlaier TAILQ_INSERT_TAIL(&binat.rpool.list, 3534126353Smlaier pa, entries); 3535126353Smlaier 3536145840Smlaier free($13); 3537126353Smlaier } 3538126353Smlaier 3539145840Smlaier pfctl_add_rule(pf, &binat, ""); 3540126353Smlaier } 3541126353Smlaier ; 3542126353Smlaier 3543126353Smlaiertag : /* empty */ { $$ = NULL; } 3544126353Smlaier | TAG STRING { $$ = $2; } 3545130617Smlaier ; 3546126353Smlaier 3547145840Smlaiertagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 3548145840Smlaier | not TAGGED string { $$.neg = $1; $$.name = $3; } 3549145840Smlaier ; 3550145840Smlaier 3551126353Smlaierroute_host : STRING { 3552126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 3553126353Smlaier if ($$ == NULL) 3554126353Smlaier err(1, "route_host: calloc"); 3555130617Smlaier $$->ifname = $1; 3556126353Smlaier set_ipmask($$, 128); 3557126353Smlaier $$->next = NULL; 3558126353Smlaier $$->tail = $$; 3559126353Smlaier } 3560126353Smlaier | '(' STRING host ')' { 3561126353Smlaier $$ = $3; 3562130617Smlaier $$->ifname = $2; 3563126353Smlaier } 3564126353Smlaier ; 3565126353Smlaier 3566126353Smlaierroute_host_list : route_host { $$ = $1; } 3567126353Smlaier | route_host_list comma route_host { 3568126353Smlaier if ($1->af == 0) 3569126353Smlaier $1->af = $3->af; 3570126353Smlaier if ($1->af != $3->af) { 3571126353Smlaier yyerror("all pool addresses must be in the " 3572126353Smlaier "same address family"); 3573126353Smlaier YYERROR; 3574126353Smlaier } 3575126353Smlaier $1->tail->next = $3; 3576126353Smlaier $1->tail = $3->tail; 3577126353Smlaier $$ = $1; 3578126353Smlaier } 3579126353Smlaier ; 3580126353Smlaier 3581126353Smlaierroutespec : route_host { $$ = $1; } 3582126353Smlaier | '{' route_host_list '}' { $$ = $2; } 3583126353Smlaier ; 3584126353Smlaier 3585126353Smlaierroute : /* empty */ { 3586126353Smlaier $$.host = NULL; 3587126353Smlaier $$.rt = 0; 3588126353Smlaier $$.pool_opts = 0; 3589126353Smlaier } 3590126353Smlaier | FASTROUTE { 3591126353Smlaier $$.host = NULL; 3592126353Smlaier $$.rt = PF_FASTROUTE; 3593126353Smlaier $$.pool_opts = 0; 3594126353Smlaier } 3595130617Smlaier | ROUTETO routespec pool_opts { 3596126353Smlaier $$.host = $2; 3597126353Smlaier $$.rt = PF_ROUTETO; 3598130617Smlaier $$.pool_opts = $3.type | $3.opts; 3599126353Smlaier if ($3.key != NULL) 3600126353Smlaier $$.key = $3.key; 3601126353Smlaier } 3602130617Smlaier | REPLYTO routespec pool_opts { 3603126353Smlaier $$.host = $2; 3604126353Smlaier $$.rt = PF_REPLYTO; 3605130617Smlaier $$.pool_opts = $3.type | $3.opts; 3606126353Smlaier if ($3.key != NULL) 3607126353Smlaier $$.key = $3.key; 3608126353Smlaier } 3609130617Smlaier | DUPTO routespec pool_opts { 3610126353Smlaier $$.host = $2; 3611126353Smlaier $$.rt = PF_DUPTO; 3612130617Smlaier $$.pool_opts = $3.type | $3.opts; 3613126353Smlaier if ($3.key != NULL) 3614126353Smlaier $$.key = $3.key; 3615126353Smlaier } 3616126353Smlaier ; 3617126353Smlaier 3618126353Smlaiertimeout_spec : STRING number 3619126353Smlaier { 3620130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 3621130617Smlaier free($1); 3622126353Smlaier YYERROR; 3623130617Smlaier } 3624126353Smlaier if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3625126353Smlaier yyerror("unknown timeout %s", $1); 3626130617Smlaier free($1); 3627126353Smlaier YYERROR; 3628126353Smlaier } 3629130617Smlaier free($1); 3630126353Smlaier } 3631126353Smlaier ; 3632126353Smlaier 3633126353Smlaiertimeout_list : timeout_list comma timeout_spec 3634126353Smlaier | timeout_spec 3635126353Smlaier ; 3636126353Smlaier 3637126353Smlaierlimit_spec : STRING number 3638126353Smlaier { 3639130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 3640130617Smlaier free($1); 3641126353Smlaier YYERROR; 3642130617Smlaier } 3643126353Smlaier if (pfctl_set_limit(pf, $1, $2) != 0) { 3644126353Smlaier yyerror("unable to set limit %s %u", $1, $2); 3645130617Smlaier free($1); 3646126353Smlaier YYERROR; 3647126353Smlaier } 3648130617Smlaier free($1); 3649126353Smlaier } 3650130617Smlaier ; 3651126353Smlaier 3652126353Smlaierlimit_list : limit_list comma limit_spec 3653126353Smlaier | limit_spec 3654126353Smlaier ; 3655126353Smlaier 3656126353Smlaiercomma : ',' 3657126353Smlaier | /* empty */ 3658126353Smlaier ; 3659126353Smlaier 3660126353Smlaieryesno : NO { $$ = 0; } 3661126353Smlaier | STRING { 3662126353Smlaier if (!strcmp($1, "yes")) 3663126353Smlaier $$ = 1; 3664130617Smlaier else { 3665145840Smlaier yyerror("invalid value '%s', expected 'yes' " 3666145840Smlaier "or 'no'", $1); 3667130617Smlaier free($1); 3668126353Smlaier YYERROR; 3669130617Smlaier } 3670130617Smlaier free($1); 3671126353Smlaier } 3672130617Smlaier ; 3673126353Smlaier 3674126353Smlaierunaryop : '=' { $$ = PF_OP_EQ; } 3675126353Smlaier | '!' '=' { $$ = PF_OP_NE; } 3676126353Smlaier | '<' '=' { $$ = PF_OP_LE; } 3677126353Smlaier | '<' { $$ = PF_OP_LT; } 3678126353Smlaier | '>' '=' { $$ = PF_OP_GE; } 3679126353Smlaier | '>' { $$ = PF_OP_GT; } 3680126353Smlaier ; 3681126353Smlaier 3682126353Smlaier%% 3683126353Smlaier 3684126353Smlaierint 3685126353Smlaieryyerror(const char *fmt, ...) 3686126353Smlaier{ 3687126353Smlaier va_list ap; 3688126353Smlaier extern char *infile; 3689126353Smlaier 3690126353Smlaier errors = 1; 3691126353Smlaier va_start(ap, fmt); 3692126353Smlaier fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3693126353Smlaier vfprintf(stderr, fmt, ap); 3694126353Smlaier fprintf(stderr, "\n"); 3695126353Smlaier va_end(ap); 3696126353Smlaier return (0); 3697126353Smlaier} 3698126353Smlaier 3699126353Smlaierint 3700126353Smlaierdisallow_table(struct node_host *h, const char *fmt) 3701126353Smlaier{ 3702126353Smlaier for (; h != NULL; h = h->next) 3703126353Smlaier if (h->addr.type == PF_ADDR_TABLE) { 3704126353Smlaier yyerror(fmt, h->addr.v.tblname); 3705126353Smlaier return (1); 3706126353Smlaier } 3707126353Smlaier return (0); 3708126353Smlaier} 3709126353Smlaier 3710126353Smlaierint 3711130617Smlaierdisallow_alias(struct node_host *h, const char *fmt) 3712130617Smlaier{ 3713130617Smlaier for (; h != NULL; h = h->next) 3714130617Smlaier if (DYNIF_MULTIADDR(h->addr)) { 3715130617Smlaier yyerror(fmt, h->addr.v.tblname); 3716130617Smlaier return (1); 3717130617Smlaier } 3718130617Smlaier return (0); 3719130617Smlaier} 3720130617Smlaier 3721130617Smlaierint 3722126353Smlaierrule_consistent(struct pf_rule *r) 3723126353Smlaier{ 3724126353Smlaier int problems = 0; 3725126353Smlaier 3726126353Smlaier switch (r->action) { 3727126353Smlaier case PF_PASS: 3728126353Smlaier case PF_DROP: 3729126353Smlaier case PF_SCRUB: 3730145840Smlaier case PF_NOSCRUB: 3731126353Smlaier problems = filter_consistent(r); 3732126353Smlaier break; 3733126353Smlaier case PF_NAT: 3734126353Smlaier case PF_NONAT: 3735126353Smlaier problems = nat_consistent(r); 3736126353Smlaier break; 3737126353Smlaier case PF_RDR: 3738126353Smlaier case PF_NORDR: 3739126353Smlaier problems = rdr_consistent(r); 3740126353Smlaier break; 3741126353Smlaier case PF_BINAT: 3742126353Smlaier case PF_NOBINAT: 3743126353Smlaier default: 3744126353Smlaier break; 3745126353Smlaier } 3746126353Smlaier return (problems); 3747126353Smlaier} 3748126353Smlaier 3749126353Smlaierint 3750126353Smlaierfilter_consistent(struct pf_rule *r) 3751126353Smlaier{ 3752126353Smlaier int problems = 0; 3753126353Smlaier 3754126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3755126353Smlaier (r->src.port_op || r->dst.port_op)) { 3756126353Smlaier yyerror("port only applies to tcp/udp"); 3757126353Smlaier problems++; 3758126353Smlaier } 3759126353Smlaier if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3760126353Smlaier (r->type || r->code)) { 3761126353Smlaier yyerror("icmp-type/code only applies to icmp"); 3762126353Smlaier problems++; 3763126353Smlaier } 3764126353Smlaier if (!r->af && (r->type || r->code)) { 3765126353Smlaier yyerror("must indicate address family with icmp-type/code"); 3766126353Smlaier problems++; 3767126353Smlaier } 3768145840Smlaier if (r->overload_tblname[0] && 3769145840Smlaier r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3770145840Smlaier yyerror("'overload' requires 'max-src-conn' " 3771145840Smlaier "or 'max-src-conn-rate'"); 3772145840Smlaier problems++; 3773145840Smlaier } 3774126353Smlaier if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3775126353Smlaier (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3776126353Smlaier yyerror("proto %s doesn't match address family %s", 3777126353Smlaier r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3778126353Smlaier r->af == AF_INET ? "inet" : "inet6"); 3779126353Smlaier problems++; 3780126353Smlaier } 3781126353Smlaier if (r->allow_opts && r->action != PF_PASS) { 3782126353Smlaier yyerror("allow-opts can only be specified for pass rules"); 3783126353Smlaier problems++; 3784126353Smlaier } 3785126353Smlaier if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3786126353Smlaier r->dst.port_op || r->flagset || r->type || r->code)) { 3787126353Smlaier yyerror("fragments can be filtered only on IP header fields"); 3788126353Smlaier problems++; 3789126353Smlaier } 3790126353Smlaier if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3791126353Smlaier yyerror("return-rst can only be applied to TCP rules"); 3792126353Smlaier problems++; 3793126353Smlaier } 3794130617Smlaier if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3795130617Smlaier yyerror("max-src-nodes requires 'source-track rule'"); 3796130617Smlaier problems++; 3797130617Smlaier } 3798126353Smlaier if (r->action == PF_DROP && r->keep_state) { 3799126353Smlaier yyerror("keep state on block rules doesn't make sense"); 3800126353Smlaier problems++; 3801126353Smlaier } 3802126353Smlaier if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state && 3803145840Smlaier r->action == PF_PASS) { 3804126353Smlaier yyerror("tags cannot be used without keep state"); 3805126353Smlaier problems++; 3806126353Smlaier } 3807126353Smlaier return (-problems); 3808126353Smlaier} 3809126353Smlaier 3810126353Smlaierint 3811126353Smlaiernat_consistent(struct pf_rule *r) 3812126353Smlaier{ 3813130617Smlaier return (0); /* yeah! */ 3814126353Smlaier} 3815126353Smlaier 3816126353Smlaierint 3817126353Smlaierrdr_consistent(struct pf_rule *r) 3818126353Smlaier{ 3819126353Smlaier int problems = 0; 3820126353Smlaier 3821126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3822126353Smlaier if (r->src.port_op) { 3823126353Smlaier yyerror("src port only applies to tcp/udp"); 3824126353Smlaier problems++; 3825126353Smlaier } 3826126353Smlaier if (r->dst.port_op) { 3827126353Smlaier yyerror("dst port only applies to tcp/udp"); 3828126353Smlaier problems++; 3829126353Smlaier } 3830126353Smlaier if (r->rpool.proxy_port[0]) { 3831126353Smlaier yyerror("rpool port only applies to tcp/udp"); 3832126353Smlaier problems++; 3833126353Smlaier } 3834126353Smlaier } 3835126353Smlaier if (r->dst.port_op && 3836126353Smlaier r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3837126353Smlaier yyerror("invalid port operator for rdr destination port"); 3838126353Smlaier problems++; 3839126353Smlaier } 3840126353Smlaier return (-problems); 3841126353Smlaier} 3842126353Smlaier 3843126353Smlaierint 3844126353Smlaierprocess_tabledef(char *name, struct table_opts *opts) 3845126353Smlaier{ 3846126353Smlaier struct pfr_buffer ab; 3847126353Smlaier struct node_tinit *ti; 3848126353Smlaier 3849126353Smlaier bzero(&ab, sizeof(ab)); 3850126353Smlaier ab.pfrb_type = PFRB_ADDRS; 3851126353Smlaier SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3852126353Smlaier if (ti->file) 3853126353Smlaier if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3854126353Smlaier if (errno) 3855126353Smlaier yyerror("cannot load \"%s\": %s", 3856126353Smlaier ti->file, strerror(errno)); 3857126353Smlaier else 3858126353Smlaier yyerror("file \"%s\" contains bad data", 3859126353Smlaier ti->file); 3860126353Smlaier goto _error; 3861126353Smlaier } 3862126353Smlaier if (ti->host) 3863126353Smlaier if (append_addr_host(&ab, ti->host, 0, 0)) { 3864126353Smlaier yyerror("cannot create address buffer: %s", 3865126353Smlaier strerror(errno)); 3866126353Smlaier goto _error; 3867126353Smlaier } 3868126353Smlaier } 3869126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 3870126353Smlaier print_tabledef(name, opts->flags, opts->init_addr, 3871126353Smlaier &opts->init_nodes); 3872126353Smlaier if (!(pf->opts & PF_OPT_NOACTION) && 3873126353Smlaier pfctl_define_table(name, opts->flags, opts->init_addr, 3874145840Smlaier pf->anchor, &ab, pf->tticket)) { 3875126353Smlaier yyerror("cannot define table %s: %s", name, 3876126353Smlaier pfr_strerror(errno)); 3877126353Smlaier goto _error; 3878126353Smlaier } 3879126353Smlaier pf->tdirty = 1; 3880126353Smlaier pfr_buf_clear(&ab); 3881126353Smlaier return (0); 3882126353Smlaier_error: 3883126353Smlaier pfr_buf_clear(&ab); 3884126353Smlaier return (-1); 3885126353Smlaier} 3886126353Smlaier 3887126353Smlaierstruct keywords { 3888126353Smlaier const char *k_name; 3889126353Smlaier int k_val; 3890126353Smlaier}; 3891126353Smlaier 3892126353Smlaier/* macro gore, but you should've seen the prior indentation nightmare... */ 3893126353Smlaier 3894126353Smlaier#define FREE_LIST(T,r) \ 3895126353Smlaier do { \ 3896126353Smlaier T *p, *node = r; \ 3897126353Smlaier while (node != NULL) { \ 3898126353Smlaier p = node; \ 3899126353Smlaier node = node->next; \ 3900126353Smlaier free(p); \ 3901126353Smlaier } \ 3902126353Smlaier } while (0) 3903126353Smlaier 3904126353Smlaier#define LOOP_THROUGH(T,n,r,C) \ 3905126353Smlaier do { \ 3906126353Smlaier T *n; \ 3907126353Smlaier if (r == NULL) { \ 3908126353Smlaier r = calloc(1, sizeof(T)); \ 3909126353Smlaier if (r == NULL) \ 3910126353Smlaier err(1, "LOOP: calloc"); \ 3911126353Smlaier r->next = NULL; \ 3912126353Smlaier } \ 3913126353Smlaier n = r; \ 3914126353Smlaier while (n != NULL) { \ 3915126353Smlaier do { \ 3916126353Smlaier C; \ 3917126353Smlaier } while (0); \ 3918126353Smlaier n = n->next; \ 3919126353Smlaier } \ 3920126353Smlaier } while (0) 3921126353Smlaier 3922126353Smlaiervoid 3923130617Smlaierexpand_label_str(char *label, size_t len, const char *srch, const char *repl) 3924126353Smlaier{ 3925130617Smlaier char *tmp; 3926126353Smlaier char *p, *q; 3927126353Smlaier 3928130617Smlaier if ((tmp = calloc(1, len)) == NULL) 3929130617Smlaier err(1, "expand_label_str: calloc"); 3930126353Smlaier p = q = label; 3931126353Smlaier while ((q = strstr(p, srch)) != NULL) { 3932126353Smlaier *q = '\0'; 3933130617Smlaier if ((strlcat(tmp, p, len) >= len) || 3934130617Smlaier (strlcat(tmp, repl, len) >= len)) 3935130617Smlaier errx(1, "expand_label: label too long"); 3936126353Smlaier q += strlen(srch); 3937126353Smlaier p = q; 3938126353Smlaier } 3939130617Smlaier if (strlcat(tmp, p, len) >= len) 3940130617Smlaier errx(1, "expand_label: label too long"); 3941130617Smlaier strlcpy(label, tmp, len); /* always fits */ 3942130617Smlaier free(tmp); 3943126353Smlaier} 3944126353Smlaier 3945126353Smlaiervoid 3946130617Smlaierexpand_label_if(const char *name, char *label, size_t len, const char *ifname) 3947126353Smlaier{ 3948126353Smlaier if (strstr(label, name) != NULL) { 3949126353Smlaier if (!*ifname) 3950130617Smlaier expand_label_str(label, len, name, "any"); 3951126353Smlaier else 3952130617Smlaier expand_label_str(label, len, name, ifname); 3953126353Smlaier } 3954126353Smlaier} 3955126353Smlaier 3956126353Smlaiervoid 3957130617Smlaierexpand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 3958126353Smlaier struct node_host *h) 3959126353Smlaier{ 3960126353Smlaier char tmp[64], tmp_not[66]; 3961126353Smlaier 3962126353Smlaier if (strstr(label, name) != NULL) { 3963126353Smlaier switch (h->addr.type) { 3964126353Smlaier case PF_ADDR_DYNIFTL: 3965126353Smlaier snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 3966126353Smlaier break; 3967126353Smlaier case PF_ADDR_TABLE: 3968126353Smlaier snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 3969126353Smlaier break; 3970126353Smlaier case PF_ADDR_NOROUTE: 3971126353Smlaier snprintf(tmp, sizeof(tmp), "no-route"); 3972126353Smlaier break; 3973126353Smlaier case PF_ADDR_ADDRMASK: 3974126353Smlaier if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 3975126353Smlaier PF_AZERO(&h->addr.v.a.mask, af))) 3976126353Smlaier snprintf(tmp, sizeof(tmp), "any"); 3977126353Smlaier else { 3978126353Smlaier char a[48]; 3979126353Smlaier int bits; 3980126353Smlaier 3981126353Smlaier if (inet_ntop(af, &h->addr.v.a.addr, a, 3982126353Smlaier sizeof(a)) == NULL) 3983126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 3984126353Smlaier else { 3985126353Smlaier bits = unmask(&h->addr.v.a.mask, af); 3986126353Smlaier if ((af == AF_INET && bits < 32) || 3987126353Smlaier (af == AF_INET6 && bits < 128)) 3988126353Smlaier snprintf(tmp, sizeof(tmp), 3989130617Smlaier "%s/%d", a, bits); 3990126353Smlaier else 3991126353Smlaier snprintf(tmp, sizeof(tmp), 3992126353Smlaier "%s", a); 3993126353Smlaier } 3994126353Smlaier } 3995126353Smlaier break; 3996126353Smlaier default: 3997126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 3998126353Smlaier break; 3999126353Smlaier } 4000126353Smlaier 4001126353Smlaier if (h->not) { 4002126353Smlaier snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4003130617Smlaier expand_label_str(label, len, name, tmp_not); 4004126353Smlaier } else 4005130617Smlaier expand_label_str(label, len, name, tmp); 4006126353Smlaier } 4007126353Smlaier} 4008126353Smlaier 4009126353Smlaiervoid 4010130617Smlaierexpand_label_port(const char *name, char *label, size_t len, 4011130617Smlaier struct node_port *port) 4012126353Smlaier{ 4013126353Smlaier char a1[6], a2[6], op[13] = ""; 4014126353Smlaier 4015126353Smlaier if (strstr(label, name) != NULL) { 4016126353Smlaier snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4017126353Smlaier snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4018126353Smlaier if (!port->op) 4019126353Smlaier ; 4020126353Smlaier else if (port->op == PF_OP_IRG) 4021126353Smlaier snprintf(op, sizeof(op), "%s><%s", a1, a2); 4022126353Smlaier else if (port->op == PF_OP_XRG) 4023126353Smlaier snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4024126353Smlaier else if (port->op == PF_OP_EQ) 4025126353Smlaier snprintf(op, sizeof(op), "%s", a1); 4026126353Smlaier else if (port->op == PF_OP_NE) 4027126353Smlaier snprintf(op, sizeof(op), "!=%s", a1); 4028126353Smlaier else if (port->op == PF_OP_LT) 4029126353Smlaier snprintf(op, sizeof(op), "<%s", a1); 4030126353Smlaier else if (port->op == PF_OP_LE) 4031126353Smlaier snprintf(op, sizeof(op), "<=%s", a1); 4032126353Smlaier else if (port->op == PF_OP_GT) 4033126353Smlaier snprintf(op, sizeof(op), ">%s", a1); 4034126353Smlaier else if (port->op == PF_OP_GE) 4035126353Smlaier snprintf(op, sizeof(op), ">=%s", a1); 4036130617Smlaier expand_label_str(label, len, name, op); 4037126353Smlaier } 4038126353Smlaier} 4039126353Smlaier 4040126353Smlaiervoid 4041130617Smlaierexpand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4042126353Smlaier{ 4043126353Smlaier struct protoent *pe; 4044126353Smlaier char n[4]; 4045126353Smlaier 4046126353Smlaier if (strstr(label, name) != NULL) { 4047126353Smlaier pe = getprotobynumber(proto); 4048126353Smlaier if (pe != NULL) 4049130617Smlaier expand_label_str(label, len, name, pe->p_name); 4050126353Smlaier else { 4051126353Smlaier snprintf(n, sizeof(n), "%u", proto); 4052130617Smlaier expand_label_str(label, len, name, n); 4053126353Smlaier } 4054126353Smlaier } 4055126353Smlaier} 4056126353Smlaier 4057126353Smlaiervoid 4058130617Smlaierexpand_label_nr(const char *name, char *label, size_t len) 4059126353Smlaier{ 4060126353Smlaier char n[11]; 4061126353Smlaier 4062126353Smlaier if (strstr(label, name) != NULL) { 4063126353Smlaier snprintf(n, sizeof(n), "%u", pf->rule_nr); 4064130617Smlaier expand_label_str(label, len, name, n); 4065126353Smlaier } 4066126353Smlaier} 4067126353Smlaier 4068126353Smlaiervoid 4069130617Smlaierexpand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4070126353Smlaier struct node_host *src_host, struct node_port *src_port, 4071126353Smlaier struct node_host *dst_host, struct node_port *dst_port, 4072126353Smlaier u_int8_t proto) 4073126353Smlaier{ 4074130617Smlaier expand_label_if("$if", label, len, ifname); 4075130617Smlaier expand_label_addr("$srcaddr", label, len, af, src_host); 4076130617Smlaier expand_label_addr("$dstaddr", label, len, af, dst_host); 4077130617Smlaier expand_label_port("$srcport", label, len, src_port); 4078130617Smlaier expand_label_port("$dstport", label, len, dst_port); 4079130617Smlaier expand_label_proto("$proto", label, len, proto); 4080130617Smlaier expand_label_nr("$nr", label, len); 4081126353Smlaier} 4082126353Smlaier 4083126353Smlaierint 4084126353Smlaierexpand_altq(struct pf_altq *a, struct node_if *interfaces, 4085126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 4086126353Smlaier struct node_queue_opt *opts) 4087126353Smlaier{ 4088126353Smlaier struct pf_altq pa, pb; 4089126353Smlaier char qname[PF_QNAME_SIZE]; 4090126353Smlaier struct node_queue *n; 4091126353Smlaier struct node_queue_bw bw; 4092126353Smlaier int errs = 0; 4093126353Smlaier 4094126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4095126353Smlaier FREE_LIST(struct node_if, interfaces); 4096126353Smlaier FREE_LIST(struct node_queue, nqueues); 4097126353Smlaier return (0); 4098126353Smlaier } 4099126353Smlaier 4100126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4101126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 4102126353Smlaier if (strlcpy(pa.ifname, interface->ifname, 4103126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4104126353Smlaier errx(1, "expand_altq: strlcpy"); 4105126353Smlaier 4106126353Smlaier if (interface->not) { 4107126353Smlaier yyerror("altq on ! <interface> is not supported"); 4108126353Smlaier errs++; 4109126353Smlaier } else { 4110126353Smlaier if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4111126353Smlaier errs++; 4112126353Smlaier else 4113126353Smlaier if (pfctl_add_altq(pf, &pa)) 4114126353Smlaier errs++; 4115126353Smlaier 4116126353Smlaier if (pf->opts & PF_OPT_VERBOSE) { 4117126353Smlaier print_altq(&pf->paltq->altq, 0, 4118126353Smlaier &bwspec, opts); 4119126353Smlaier if (nqueues && nqueues->tail) { 4120126353Smlaier printf("queue { "); 4121126353Smlaier LOOP_THROUGH(struct node_queue, queue, 4122126353Smlaier nqueues, 4123126353Smlaier printf("%s ", 4124126353Smlaier queue->queue); 4125126353Smlaier ); 4126126353Smlaier printf("}"); 4127126353Smlaier } 4128126353Smlaier printf("\n"); 4129126353Smlaier } 4130126353Smlaier 4131126353Smlaier if (pa.scheduler == ALTQT_CBQ || 4132126353Smlaier pa.scheduler == ALTQT_HFSC) { 4133126353Smlaier /* now create a root queue */ 4134126353Smlaier memset(&pb, 0, sizeof(struct pf_altq)); 4135126353Smlaier if (strlcpy(qname, "root_", sizeof(qname)) >= 4136126353Smlaier sizeof(qname)) 4137126353Smlaier errx(1, "expand_altq: strlcpy"); 4138126353Smlaier if (strlcat(qname, interface->ifname, 4139126353Smlaier sizeof(qname)) >= sizeof(qname)) 4140126353Smlaier errx(1, "expand_altq: strlcat"); 4141126353Smlaier if (strlcpy(pb.qname, qname, 4142126353Smlaier sizeof(pb.qname)) >= sizeof(pb.qname)) 4143126353Smlaier errx(1, "expand_altq: strlcpy"); 4144126353Smlaier if (strlcpy(pb.ifname, interface->ifname, 4145126353Smlaier sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4146126353Smlaier errx(1, "expand_altq: strlcpy"); 4147126353Smlaier pb.qlimit = pa.qlimit; 4148126353Smlaier pb.scheduler = pa.scheduler; 4149126353Smlaier bw.bw_absolute = pa.ifbandwidth; 4150126353Smlaier bw.bw_percent = 0; 4151126353Smlaier if (eval_pfqueue(pf, &pb, &bw, opts)) 4152126353Smlaier errs++; 4153126353Smlaier else 4154126353Smlaier if (pfctl_add_altq(pf, &pb)) 4155126353Smlaier errs++; 4156126353Smlaier } 4157126353Smlaier 4158126353Smlaier LOOP_THROUGH(struct node_queue, queue, nqueues, 4159126353Smlaier n = calloc(1, sizeof(struct node_queue)); 4160126353Smlaier if (n == NULL) 4161126353Smlaier err(1, "expand_altq: calloc"); 4162126353Smlaier if (pa.scheduler == ALTQT_CBQ || 4163126353Smlaier pa.scheduler == ALTQT_HFSC) 4164126353Smlaier if (strlcpy(n->parent, qname, 4165126353Smlaier sizeof(n->parent)) >= 4166126353Smlaier sizeof(n->parent)) 4167126353Smlaier errx(1, "expand_altq: strlcpy"); 4168126353Smlaier if (strlcpy(n->queue, queue->queue, 4169126353Smlaier sizeof(n->queue)) >= sizeof(n->queue)) 4170126353Smlaier errx(1, "expand_altq: strlcpy"); 4171126353Smlaier if (strlcpy(n->ifname, interface->ifname, 4172126353Smlaier sizeof(n->ifname)) >= sizeof(n->ifname)) 4173126353Smlaier errx(1, "expand_altq: strlcpy"); 4174126353Smlaier n->scheduler = pa.scheduler; 4175126353Smlaier n->next = NULL; 4176126353Smlaier n->tail = n; 4177126353Smlaier if (queues == NULL) 4178126353Smlaier queues = n; 4179126353Smlaier else { 4180126353Smlaier queues->tail->next = n; 4181126353Smlaier queues->tail = n; 4182126353Smlaier } 4183126353Smlaier ); 4184126353Smlaier } 4185126353Smlaier ); 4186126353Smlaier FREE_LIST(struct node_if, interfaces); 4187126353Smlaier FREE_LIST(struct node_queue, nqueues); 4188126353Smlaier 4189126353Smlaier return (errs); 4190126353Smlaier} 4191126353Smlaier 4192126353Smlaierint 4193126353Smlaierexpand_queue(struct pf_altq *a, struct node_if *interfaces, 4194126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 4195126353Smlaier struct node_queue_opt *opts) 4196126353Smlaier{ 4197126353Smlaier struct node_queue *n, *nq; 4198126353Smlaier struct pf_altq pa; 4199126353Smlaier u_int8_t found = 0; 4200126353Smlaier u_int8_t errs = 0; 4201126353Smlaier 4202126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4203126353Smlaier FREE_LIST(struct node_queue, nqueues); 4204126353Smlaier return (0); 4205126353Smlaier } 4206126353Smlaier 4207126353Smlaier if (queues == NULL) { 4208126353Smlaier yyerror("queue %s has no parent", a->qname); 4209126353Smlaier FREE_LIST(struct node_queue, nqueues); 4210126353Smlaier return (1); 4211126353Smlaier } 4212126353Smlaier 4213126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4214126353Smlaier LOOP_THROUGH(struct node_queue, tqueue, queues, 4215126353Smlaier if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4216126353Smlaier (interface->ifname[0] == 0 || 4217126353Smlaier (!interface->not && !strncmp(interface->ifname, 4218126353Smlaier tqueue->ifname, IFNAMSIZ)) || 4219126353Smlaier (interface->not && strncmp(interface->ifname, 4220126353Smlaier tqueue->ifname, IFNAMSIZ)))) { 4221126353Smlaier /* found ourself in queues */ 4222126353Smlaier found++; 4223126353Smlaier 4224126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 4225126353Smlaier 4226126353Smlaier if (pa.scheduler != ALTQT_NONE && 4227126353Smlaier pa.scheduler != tqueue->scheduler) { 4228126353Smlaier yyerror("exactly one scheduler type " 4229126353Smlaier "per interface allowed"); 4230126353Smlaier return (1); 4231126353Smlaier } 4232126353Smlaier pa.scheduler = tqueue->scheduler; 4233126353Smlaier 4234126353Smlaier /* scheduler dependent error checking */ 4235126353Smlaier switch (pa.scheduler) { 4236126353Smlaier case ALTQT_PRIQ: 4237126353Smlaier if (nqueues != NULL) { 4238126353Smlaier yyerror("priq queues cannot " 4239126353Smlaier "have child queues"); 4240126353Smlaier return (1); 4241126353Smlaier } 4242126353Smlaier if (bwspec.bw_absolute > 0 || 4243126353Smlaier bwspec.bw_percent < 100) { 4244126353Smlaier yyerror("priq doesn't take " 4245126353Smlaier "bandwidth"); 4246126353Smlaier return (1); 4247126353Smlaier } 4248126353Smlaier break; 4249126353Smlaier default: 4250126353Smlaier break; 4251126353Smlaier } 4252126353Smlaier 4253126353Smlaier if (strlcpy(pa.ifname, tqueue->ifname, 4254126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4255126353Smlaier errx(1, "expand_queue: strlcpy"); 4256126353Smlaier if (strlcpy(pa.parent, tqueue->parent, 4257126353Smlaier sizeof(pa.parent)) >= sizeof(pa.parent)) 4258126353Smlaier errx(1, "expand_queue: strlcpy"); 4259126353Smlaier 4260126353Smlaier if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4261126353Smlaier errs++; 4262126353Smlaier else 4263126353Smlaier if (pfctl_add_altq(pf, &pa)) 4264126353Smlaier errs++; 4265126353Smlaier 4266126353Smlaier for (nq = nqueues; nq != NULL; nq = nq->next) { 4267126353Smlaier if (!strcmp(a->qname, nq->queue)) { 4268126353Smlaier yyerror("queue cannot have " 4269126353Smlaier "itself as child"); 4270126353Smlaier errs++; 4271126353Smlaier continue; 4272126353Smlaier } 4273126353Smlaier n = calloc(1, 4274126353Smlaier sizeof(struct node_queue)); 4275126353Smlaier if (n == NULL) 4276126353Smlaier err(1, "expand_queue: calloc"); 4277126353Smlaier if (strlcpy(n->parent, a->qname, 4278126353Smlaier sizeof(n->parent)) >= 4279126353Smlaier sizeof(n->parent)) 4280126353Smlaier errx(1, "expand_queue strlcpy"); 4281126353Smlaier if (strlcpy(n->queue, nq->queue, 4282126353Smlaier sizeof(n->queue)) >= 4283126353Smlaier sizeof(n->queue)) 4284126353Smlaier errx(1, "expand_queue strlcpy"); 4285126353Smlaier if (strlcpy(n->ifname, tqueue->ifname, 4286126353Smlaier sizeof(n->ifname)) >= 4287126353Smlaier sizeof(n->ifname)) 4288126353Smlaier errx(1, "expand_queue strlcpy"); 4289126353Smlaier n->scheduler = tqueue->scheduler; 4290126353Smlaier n->next = NULL; 4291126353Smlaier n->tail = n; 4292126353Smlaier if (queues == NULL) 4293126353Smlaier queues = n; 4294126353Smlaier else { 4295126353Smlaier queues->tail->next = n; 4296126353Smlaier queues->tail = n; 4297126353Smlaier } 4298126353Smlaier } 4299126353Smlaier if ((pf->opts & PF_OPT_VERBOSE) && ( 4300126353Smlaier (found == 1 && interface->ifname[0] == 0) || 4301126353Smlaier (found > 0 && interface->ifname[0] != 0))) { 4302126353Smlaier print_queue(&pf->paltq->altq, 0, 4303126353Smlaier &bwspec, interface->ifname[0] != 0, 4304126353Smlaier opts); 4305126353Smlaier if (nqueues && nqueues->tail) { 4306126353Smlaier printf("{ "); 4307126353Smlaier LOOP_THROUGH(struct node_queue, 4308126353Smlaier queue, nqueues, 4309126353Smlaier printf("%s ", 4310126353Smlaier queue->queue); 4311126353Smlaier ); 4312126353Smlaier printf("}"); 4313126353Smlaier } 4314126353Smlaier printf("\n"); 4315126353Smlaier } 4316126353Smlaier } 4317126353Smlaier ); 4318126353Smlaier ); 4319126353Smlaier 4320126353Smlaier FREE_LIST(struct node_queue, nqueues); 4321126353Smlaier FREE_LIST(struct node_if, interfaces); 4322126353Smlaier 4323126353Smlaier if (!found) { 4324126353Smlaier yyerror("queue %s has no parent", a->qname); 4325126353Smlaier errs++; 4326126353Smlaier } 4327126353Smlaier 4328126353Smlaier if (errs) 4329126353Smlaier return (1); 4330126353Smlaier else 4331126353Smlaier return (0); 4332126353Smlaier} 4333126353Smlaier 4334126353Smlaiervoid 4335126353Smlaierexpand_rule(struct pf_rule *r, 4336126353Smlaier struct node_if *interfaces, struct node_host *rpool_hosts, 4337126353Smlaier struct node_proto *protos, struct node_os *src_oses, 4338126353Smlaier struct node_host *src_hosts, struct node_port *src_ports, 4339126353Smlaier struct node_host *dst_hosts, struct node_port *dst_ports, 4340145840Smlaier struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4341145840Smlaier const char *anchor_call) 4342126353Smlaier{ 4343126353Smlaier sa_family_t af = r->af; 4344126353Smlaier int added = 0, error = 0; 4345126353Smlaier char ifname[IF_NAMESIZE]; 4346126353Smlaier char label[PF_RULE_LABEL_SIZE]; 4347130617Smlaier char tagname[PF_TAG_NAME_SIZE]; 4348130617Smlaier char match_tagname[PF_TAG_NAME_SIZE]; 4349126353Smlaier struct pf_pooladdr *pa; 4350126353Smlaier struct node_host *h; 4351130617Smlaier u_int8_t flags, flagset, keep_state; 4352126353Smlaier 4353126353Smlaier if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4354126353Smlaier errx(1, "expand_rule: strlcpy"); 4355130617Smlaier if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4356130617Smlaier errx(1, "expand_rule: strlcpy"); 4357130617Smlaier if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4358130617Smlaier sizeof(match_tagname)) 4359130617Smlaier errx(1, "expand_rule: strlcpy"); 4360126353Smlaier flags = r->flags; 4361126353Smlaier flagset = r->flagset; 4362130617Smlaier keep_state = r->keep_state; 4363126353Smlaier 4364126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4365126353Smlaier LOOP_THROUGH(struct node_proto, proto, protos, 4366126353Smlaier LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4367126353Smlaier LOOP_THROUGH(struct node_host, src_host, src_hosts, 4368126353Smlaier LOOP_THROUGH(struct node_port, src_port, src_ports, 4369126353Smlaier LOOP_THROUGH(struct node_os, src_os, src_oses, 4370126353Smlaier LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4371126353Smlaier LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4372126353Smlaier LOOP_THROUGH(struct node_uid, uid, uids, 4373126353Smlaier LOOP_THROUGH(struct node_gid, gid, gids, 4374126353Smlaier 4375126353Smlaier r->af = af; 4376126353Smlaier /* for link-local IPv6 address, interface must match up */ 4377126353Smlaier if ((r->af && src_host->af && r->af != src_host->af) || 4378126353Smlaier (r->af && dst_host->af && r->af != dst_host->af) || 4379126353Smlaier (src_host->af && dst_host->af && 4380126353Smlaier src_host->af != dst_host->af) || 4381126353Smlaier (src_host->ifindex && dst_host->ifindex && 4382126353Smlaier src_host->ifindex != dst_host->ifindex) || 4383130617Smlaier (src_host->ifindex && *interface->ifname && 4384126353Smlaier src_host->ifindex != if_nametoindex(interface->ifname)) || 4385130617Smlaier (dst_host->ifindex && *interface->ifname && 4386126353Smlaier dst_host->ifindex != if_nametoindex(interface->ifname))) 4387126353Smlaier continue; 4388126353Smlaier if (!r->af && src_host->af) 4389126353Smlaier r->af = src_host->af; 4390126353Smlaier else if (!r->af && dst_host->af) 4391126353Smlaier r->af = dst_host->af; 4392126353Smlaier 4393130617Smlaier if (*interface->ifname) 4394145840Smlaier strlcpy(r->ifname, interface->ifname, 4395145840Smlaier sizeof(r->ifname)); 4396130617Smlaier else if (if_indextoname(src_host->ifindex, ifname)) 4397145840Smlaier strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4398126353Smlaier else if (if_indextoname(dst_host->ifindex, ifname)) 4399145840Smlaier strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4400126353Smlaier else 4401130617Smlaier memset(r->ifname, '\0', sizeof(r->ifname)); 4402126353Smlaier 4403126353Smlaier if (strlcpy(r->label, label, sizeof(r->label)) >= 4404126353Smlaier sizeof(r->label)) 4405126353Smlaier errx(1, "expand_rule: strlcpy"); 4406130617Smlaier if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4407130617Smlaier sizeof(r->tagname)) 4408130617Smlaier errx(1, "expand_rule: strlcpy"); 4409130617Smlaier if (strlcpy(r->match_tagname, match_tagname, 4410130617Smlaier sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4411130617Smlaier errx(1, "expand_rule: strlcpy"); 4412130617Smlaier expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4413130617Smlaier src_host, src_port, dst_host, dst_port, proto->proto); 4414130617Smlaier expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4415130617Smlaier src_host, src_port, dst_host, dst_port, proto->proto); 4416130617Smlaier expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4417130617Smlaier r->af, src_host, src_port, dst_host, dst_port, 4418130617Smlaier proto->proto); 4419126353Smlaier 4420126353Smlaier error += check_netmask(src_host, r->af); 4421126353Smlaier error += check_netmask(dst_host, r->af); 4422126353Smlaier 4423126353Smlaier r->ifnot = interface->not; 4424126353Smlaier r->proto = proto->proto; 4425126353Smlaier r->src.addr = src_host->addr; 4426145840Smlaier r->src.neg = src_host->not; 4427126353Smlaier r->src.port[0] = src_port->port[0]; 4428126353Smlaier r->src.port[1] = src_port->port[1]; 4429126353Smlaier r->src.port_op = src_port->op; 4430126353Smlaier r->dst.addr = dst_host->addr; 4431145840Smlaier r->dst.neg = dst_host->not; 4432126353Smlaier r->dst.port[0] = dst_port->port[0]; 4433126353Smlaier r->dst.port[1] = dst_port->port[1]; 4434126353Smlaier r->dst.port_op = dst_port->op; 4435126353Smlaier r->uid.op = uid->op; 4436126353Smlaier r->uid.uid[0] = uid->uid[0]; 4437126353Smlaier r->uid.uid[1] = uid->uid[1]; 4438126353Smlaier r->gid.op = gid->op; 4439126353Smlaier r->gid.gid[0] = gid->gid[0]; 4440126353Smlaier r->gid.gid[1] = gid->gid[1]; 4441126353Smlaier r->type = icmp_type->type; 4442126353Smlaier r->code = icmp_type->code; 4443126353Smlaier 4444130617Smlaier if ((keep_state == PF_STATE_MODULATE || 4445130617Smlaier keep_state == PF_STATE_SYNPROXY) && 4446130617Smlaier r->proto && r->proto != IPPROTO_TCP) 4447130617Smlaier r->keep_state = PF_STATE_NORMAL; 4448130617Smlaier else 4449130617Smlaier r->keep_state = keep_state; 4450130617Smlaier 4451126353Smlaier if (r->proto && r->proto != IPPROTO_TCP) { 4452126353Smlaier r->flags = 0; 4453126353Smlaier r->flagset = 0; 4454126353Smlaier } else { 4455126353Smlaier r->flags = flags; 4456126353Smlaier r->flagset = flagset; 4457126353Smlaier } 4458126353Smlaier if (icmp_type->proto && r->proto != icmp_type->proto) { 4459126353Smlaier yyerror("icmp-type mismatch"); 4460126353Smlaier error++; 4461126353Smlaier } 4462126353Smlaier 4463126353Smlaier if (src_os && src_os->os) { 4464126353Smlaier r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4465126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && 4466126353Smlaier r->os_fingerprint == PF_OSFP_NOMATCH) 4467126353Smlaier fprintf(stderr, 4468126353Smlaier "warning: unknown '%s' OS fingerprint\n", 4469126353Smlaier src_os->os); 4470126353Smlaier } else { 4471126353Smlaier r->os_fingerprint = PF_OSFP_ANY; 4472126353Smlaier } 4473126353Smlaier 4474126353Smlaier TAILQ_INIT(&r->rpool.list); 4475126353Smlaier for (h = rpool_hosts; h != NULL; h = h->next) { 4476126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 4477126353Smlaier if (pa == NULL) 4478126353Smlaier err(1, "expand_rule: calloc"); 4479126353Smlaier pa->addr = h->addr; 4480126353Smlaier if (h->ifname != NULL) { 4481126353Smlaier if (strlcpy(pa->ifname, h->ifname, 4482126353Smlaier sizeof(pa->ifname)) >= 4483126353Smlaier sizeof(pa->ifname)) 4484126353Smlaier errx(1, "expand_rule: strlcpy"); 4485126353Smlaier } else 4486126353Smlaier pa->ifname[0] = 0; 4487126353Smlaier TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4488126353Smlaier } 4489126353Smlaier 4490126353Smlaier if (rule_consistent(r) < 0 || error) 4491126353Smlaier yyerror("skipping rule due to errors"); 4492126353Smlaier else { 4493126353Smlaier r->nr = pf->rule_nr++; 4494145840Smlaier pfctl_add_rule(pf, r, anchor_call); 4495126353Smlaier added++; 4496126353Smlaier } 4497126353Smlaier 4498126353Smlaier )))))))))); 4499126353Smlaier 4500126353Smlaier FREE_LIST(struct node_if, interfaces); 4501126353Smlaier FREE_LIST(struct node_proto, protos); 4502126353Smlaier FREE_LIST(struct node_host, src_hosts); 4503126353Smlaier FREE_LIST(struct node_port, src_ports); 4504126353Smlaier FREE_LIST(struct node_os, src_oses); 4505126353Smlaier FREE_LIST(struct node_host, dst_hosts); 4506126353Smlaier FREE_LIST(struct node_port, dst_ports); 4507126353Smlaier FREE_LIST(struct node_uid, uids); 4508126353Smlaier FREE_LIST(struct node_gid, gids); 4509126353Smlaier FREE_LIST(struct node_icmp, icmp_types); 4510126353Smlaier FREE_LIST(struct node_host, rpool_hosts); 4511126353Smlaier 4512126353Smlaier if (!added) 4513126353Smlaier yyerror("rule expands to no valid combination"); 4514126353Smlaier} 4515126353Smlaier 4516145840Smlaierint 4517145840Smlaierexpand_skip_interface(struct node_if *interfaces) 4518145840Smlaier{ 4519145840Smlaier int errs = 0; 4520145840Smlaier 4521145840Smlaier if (!interfaces || (!interfaces->next && !interfaces->not && 4522145840Smlaier !strcmp(interfaces->ifname, "none"))) { 4523145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4524145840Smlaier printf("set skip on none\n"); 4525145840Smlaier errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4526145840Smlaier return (errs); 4527145840Smlaier } 4528145840Smlaier 4529145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4530145840Smlaier printf("set skip on {"); 4531145840Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4532145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4533145840Smlaier printf(" %s", interface->ifname); 4534145840Smlaier if (interface->not) { 4535145840Smlaier yyerror("skip on ! <interface> is not supported"); 4536145840Smlaier errs++; 4537145840Smlaier } else 4538145840Smlaier errs += pfctl_set_interface_flags(pf, 4539145840Smlaier interface->ifname, PFI_IFLAG_SKIP, 1); 4540145840Smlaier ); 4541145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4542145840Smlaier printf(" }\n"); 4543145840Smlaier 4544145840Smlaier FREE_LIST(struct node_if, interfaces); 4545145840Smlaier 4546145840Smlaier if (errs) 4547145840Smlaier return (1); 4548145840Smlaier else 4549145840Smlaier return (0); 4550145840Smlaier} 4551145840Smlaier 4552126353Smlaier#undef FREE_LIST 4553126353Smlaier#undef LOOP_THROUGH 4554126353Smlaier 4555126353Smlaierint 4556126353Smlaiercheck_rulestate(int desired_state) 4557126353Smlaier{ 4558126353Smlaier if (require_order && (rulestate > desired_state)) { 4559126353Smlaier yyerror("Rules must be in order: options, normalization, " 4560126353Smlaier "queueing, translation, filtering"); 4561126353Smlaier return (1); 4562126353Smlaier } 4563126353Smlaier rulestate = desired_state; 4564126353Smlaier return (0); 4565126353Smlaier} 4566126353Smlaier 4567126353Smlaierint 4568126353Smlaierkw_cmp(const void *k, const void *e) 4569126353Smlaier{ 4570126353Smlaier return (strcmp(k, ((const struct keywords *)e)->k_name)); 4571126353Smlaier} 4572126353Smlaier 4573126353Smlaierint 4574126353Smlaierlookup(char *s) 4575126353Smlaier{ 4576126353Smlaier /* this has to be sorted always */ 4577126353Smlaier static const struct keywords keywords[] = { 4578126353Smlaier { "all", ALL}, 4579126353Smlaier { "allow-opts", ALLOWOPTS}, 4580126353Smlaier { "altq", ALTQ}, 4581126353Smlaier { "anchor", ANCHOR}, 4582126353Smlaier { "antispoof", ANTISPOOF}, 4583126353Smlaier { "any", ANY}, 4584126353Smlaier { "bandwidth", BANDWIDTH}, 4585126353Smlaier { "binat", BINAT}, 4586126353Smlaier { "binat-anchor", BINATANCHOR}, 4587126353Smlaier { "bitmask", BITMASK}, 4588126353Smlaier { "block", BLOCK}, 4589126353Smlaier { "block-policy", BLOCKPOLICY}, 4590126353Smlaier { "cbq", CBQ}, 4591126353Smlaier { "code", CODE}, 4592126353Smlaier { "crop", FRAGCROP}, 4593130617Smlaier { "debug", DEBUG}, 4594126353Smlaier { "drop", DROP}, 4595126353Smlaier { "drop-ovl", FRAGDROP}, 4596126353Smlaier { "dup-to", DUPTO}, 4597126353Smlaier { "fastroute", FASTROUTE}, 4598126353Smlaier { "file", FILENAME}, 4599126353Smlaier { "fingerprints", FINGERPRINTS}, 4600126353Smlaier { "flags", FLAGS}, 4601130617Smlaier { "floating", FLOATING}, 4602145840Smlaier { "flush", FLUSH}, 4603126353Smlaier { "for", FOR}, 4604126353Smlaier { "fragment", FRAGMENT}, 4605126353Smlaier { "from", FROM}, 4606130617Smlaier { "global", GLOBAL}, 4607126353Smlaier { "group", GROUP}, 4608130617Smlaier { "group-bound", GRBOUND}, 4609126353Smlaier { "hfsc", HFSC}, 4610130617Smlaier { "hostid", HOSTID}, 4611126353Smlaier { "icmp-type", ICMPTYPE}, 4612126353Smlaier { "icmp6-type", ICMP6TYPE}, 4613130617Smlaier { "if-bound", IFBOUND}, 4614126353Smlaier { "in", IN}, 4615126353Smlaier { "inet", INET}, 4616126353Smlaier { "inet6", INET6}, 4617126353Smlaier { "keep", KEEP}, 4618126353Smlaier { "label", LABEL}, 4619126353Smlaier { "limit", LIMIT}, 4620126353Smlaier { "linkshare", LINKSHARE}, 4621126353Smlaier { "load", LOAD}, 4622126353Smlaier { "log", LOG}, 4623126353Smlaier { "log-all", LOGALL}, 4624126353Smlaier { "loginterface", LOGINTERFACE}, 4625126353Smlaier { "max", MAXIMUM}, 4626126353Smlaier { "max-mss", MAXMSS}, 4627145840Smlaier { "max-src-conn", MAXSRCCONN}, 4628145840Smlaier { "max-src-conn-rate", MAXSRCCONNRATE}, 4629130617Smlaier { "max-src-nodes", MAXSRCNODES}, 4630130617Smlaier { "max-src-states", MAXSRCSTATES}, 4631126353Smlaier { "min-ttl", MINTTL}, 4632126353Smlaier { "modulate", MODULATE}, 4633126353Smlaier { "nat", NAT}, 4634126353Smlaier { "nat-anchor", NATANCHOR}, 4635126353Smlaier { "no", NO}, 4636126353Smlaier { "no-df", NODF}, 4637126353Smlaier { "no-route", NOROUTE}, 4638130617Smlaier { "no-sync", NOSYNC}, 4639126353Smlaier { "on", ON}, 4640126353Smlaier { "optimization", OPTIMIZATION}, 4641126353Smlaier { "os", OS}, 4642126353Smlaier { "out", OUT}, 4643145840Smlaier { "overload", OVERLOAD}, 4644126353Smlaier { "pass", PASS}, 4645126353Smlaier { "port", PORT}, 4646126353Smlaier { "priority", PRIORITY}, 4647126353Smlaier { "priq", PRIQ}, 4648145840Smlaier { "probability", PROBABILITY}, 4649126353Smlaier { "proto", PROTO}, 4650126353Smlaier { "qlimit", QLIMIT}, 4651126353Smlaier { "queue", QUEUE}, 4652126353Smlaier { "quick", QUICK}, 4653126353Smlaier { "random", RANDOM}, 4654126353Smlaier { "random-id", RANDOMID}, 4655126353Smlaier { "rdr", RDR}, 4656126353Smlaier { "rdr-anchor", RDRANCHOR}, 4657126353Smlaier { "realtime", REALTIME}, 4658126353Smlaier { "reassemble", REASSEMBLE}, 4659126353Smlaier { "reply-to", REPLYTO}, 4660126353Smlaier { "require-order", REQUIREORDER}, 4661126353Smlaier { "return", RETURN}, 4662126353Smlaier { "return-icmp", RETURNICMP}, 4663126353Smlaier { "return-icmp6", RETURNICMP6}, 4664126353Smlaier { "return-rst", RETURNRST}, 4665126353Smlaier { "round-robin", ROUNDROBIN}, 4666145840Smlaier { "route", ROUTE}, 4667126353Smlaier { "route-to", ROUTETO}, 4668130617Smlaier { "rule", RULE}, 4669126353Smlaier { "scrub", SCRUB}, 4670126353Smlaier { "set", SET}, 4671145840Smlaier { "skip", SKIP}, 4672126353Smlaier { "source-hash", SOURCEHASH}, 4673130617Smlaier { "source-track", SOURCETRACK}, 4674126353Smlaier { "state", STATE}, 4675130617Smlaier { "state-policy", STATEPOLICY}, 4676126353Smlaier { "static-port", STATICPORT}, 4677130617Smlaier { "sticky-address", STICKYADDRESS}, 4678126353Smlaier { "synproxy", SYNPROXY}, 4679126353Smlaier { "table", TABLE}, 4680126353Smlaier { "tag", TAG}, 4681126353Smlaier { "tagged", TAGGED}, 4682126353Smlaier { "tbrsize", TBRSIZE}, 4683126353Smlaier { "timeout", TIMEOUT}, 4684126353Smlaier { "to", TO}, 4685126353Smlaier { "tos", TOS}, 4686126353Smlaier { "ttl", TTL}, 4687126353Smlaier { "upperlimit", UPPERLIMIT}, 4688126353Smlaier { "user", USER}, 4689126353Smlaier }; 4690126353Smlaier const struct keywords *p; 4691126353Smlaier 4692126353Smlaier p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4693126353Smlaier sizeof(keywords[0]), kw_cmp); 4694126353Smlaier 4695126353Smlaier if (p) { 4696126353Smlaier if (debug > 1) 4697126353Smlaier fprintf(stderr, "%s: %d\n", s, p->k_val); 4698126353Smlaier return (p->k_val); 4699126353Smlaier } else { 4700126353Smlaier if (debug > 1) 4701126353Smlaier fprintf(stderr, "string: %s\n", s); 4702126353Smlaier return (STRING); 4703126353Smlaier } 4704126353Smlaier} 4705126353Smlaier 4706126353Smlaier#define MAXPUSHBACK 128 4707126353Smlaier 4708126353Smlaierchar *parsebuf; 4709126353Smlaierint parseindex; 4710126353Smlaierchar pushback_buffer[MAXPUSHBACK]; 4711126353Smlaierint pushback_index = 0; 4712126353Smlaier 4713126353Smlaierint 4714126353Smlaierlgetc(FILE *f) 4715126353Smlaier{ 4716126353Smlaier int c, next; 4717126353Smlaier 4718126353Smlaier if (parsebuf) { 4719126353Smlaier /* Read character from the parsebuffer instead of input. */ 4720126353Smlaier if (parseindex >= 0) { 4721126353Smlaier c = parsebuf[parseindex++]; 4722126353Smlaier if (c != '\0') 4723126353Smlaier return (c); 4724126353Smlaier parsebuf = NULL; 4725126353Smlaier } else 4726126353Smlaier parseindex++; 4727126353Smlaier } 4728126353Smlaier 4729126353Smlaier if (pushback_index) 4730126353Smlaier return (pushback_buffer[--pushback_index]); 4731126353Smlaier 4732126353Smlaier while ((c = getc(f)) == '\\') { 4733126353Smlaier next = getc(f); 4734126353Smlaier if (next != '\n') { 4735126353Smlaier if (isspace(next)) 4736126353Smlaier yyerror("whitespace after \\"); 4737126353Smlaier ungetc(next, f); 4738126353Smlaier break; 4739126353Smlaier } 4740126353Smlaier yylval.lineno = lineno; 4741126353Smlaier lineno++; 4742126353Smlaier } 4743126353Smlaier if (c == '\t' || c == ' ') { 4744126353Smlaier /* Compress blanks to a single space. */ 4745126353Smlaier do { 4746126353Smlaier c = getc(f); 4747126353Smlaier } while (c == '\t' || c == ' '); 4748126353Smlaier ungetc(c, f); 4749126353Smlaier c = ' '; 4750126353Smlaier } 4751126353Smlaier 4752126353Smlaier return (c); 4753126353Smlaier} 4754126353Smlaier 4755126353Smlaierint 4756126353Smlaierlungetc(int c) 4757126353Smlaier{ 4758126353Smlaier if (c == EOF) 4759126353Smlaier return (EOF); 4760126353Smlaier if (parsebuf) { 4761126353Smlaier parseindex--; 4762126353Smlaier if (parseindex >= 0) 4763126353Smlaier return (c); 4764126353Smlaier } 4765126353Smlaier if (pushback_index < MAXPUSHBACK-1) 4766126353Smlaier return (pushback_buffer[pushback_index++] = c); 4767126353Smlaier else 4768126353Smlaier return (EOF); 4769126353Smlaier} 4770126353Smlaier 4771126353Smlaierint 4772126353Smlaierfindeol(void) 4773126353Smlaier{ 4774126353Smlaier int c; 4775126353Smlaier 4776126353Smlaier parsebuf = NULL; 4777126353Smlaier pushback_index = 0; 4778126353Smlaier 4779126353Smlaier /* skip to either EOF or the first real EOL */ 4780126353Smlaier while (1) { 4781126353Smlaier c = lgetc(fin); 4782126353Smlaier if (c == '\n') { 4783126353Smlaier lineno++; 4784126353Smlaier break; 4785126353Smlaier } 4786126353Smlaier if (c == EOF) 4787126353Smlaier break; 4788126353Smlaier } 4789126353Smlaier return (ERROR); 4790126353Smlaier} 4791126353Smlaier 4792126353Smlaierint 4793126353Smlaieryylex(void) 4794126353Smlaier{ 4795126353Smlaier char buf[8096]; 4796126353Smlaier char *p, *val; 4797126353Smlaier int endc, c, next; 4798126353Smlaier int token; 4799126353Smlaier 4800126353Smlaiertop: 4801126353Smlaier p = buf; 4802126353Smlaier while ((c = lgetc(fin)) == ' ') 4803126353Smlaier ; /* nothing */ 4804126353Smlaier 4805126353Smlaier yylval.lineno = lineno; 4806126353Smlaier if (c == '#') 4807126353Smlaier while ((c = lgetc(fin)) != '\n' && c != EOF) 4808126353Smlaier ; /* nothing */ 4809126353Smlaier if (c == '$' && parsebuf == NULL) { 4810126353Smlaier while (1) { 4811126353Smlaier if ((c = lgetc(fin)) == EOF) 4812126353Smlaier return (0); 4813126353Smlaier 4814126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 4815126353Smlaier yyerror("string too long"); 4816126353Smlaier return (findeol()); 4817126353Smlaier } 4818126353Smlaier if (isalnum(c) || c == '_') { 4819126353Smlaier *p++ = (char)c; 4820126353Smlaier continue; 4821126353Smlaier } 4822126353Smlaier *p = '\0'; 4823126353Smlaier lungetc(c); 4824126353Smlaier break; 4825126353Smlaier } 4826126353Smlaier val = symget(buf); 4827126353Smlaier if (val == NULL) { 4828126353Smlaier yyerror("macro '%s' not defined", buf); 4829126353Smlaier return (findeol()); 4830126353Smlaier } 4831126353Smlaier parsebuf = val; 4832126353Smlaier parseindex = 0; 4833126353Smlaier goto top; 4834126353Smlaier } 4835126353Smlaier 4836126353Smlaier switch (c) { 4837126353Smlaier case '\'': 4838126353Smlaier case '"': 4839126353Smlaier endc = c; 4840126353Smlaier while (1) { 4841126353Smlaier if ((c = lgetc(fin)) == EOF) 4842126353Smlaier return (0); 4843126353Smlaier if (c == endc) { 4844126353Smlaier *p = '\0'; 4845126353Smlaier break; 4846126353Smlaier } 4847126353Smlaier if (c == '\n') { 4848126353Smlaier lineno++; 4849126353Smlaier continue; 4850126353Smlaier } 4851126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 4852126353Smlaier yyerror("string too long"); 4853126353Smlaier return (findeol()); 4854126353Smlaier } 4855126353Smlaier *p++ = (char)c; 4856126353Smlaier } 4857126353Smlaier yylval.v.string = strdup(buf); 4858126353Smlaier if (yylval.v.string == NULL) 4859126353Smlaier err(1, "yylex: strdup"); 4860126353Smlaier return (STRING); 4861126353Smlaier case '<': 4862126353Smlaier next = lgetc(fin); 4863126353Smlaier if (next == '>') { 4864126353Smlaier yylval.v.i = PF_OP_XRG; 4865126353Smlaier return (PORTBINARY); 4866126353Smlaier } 4867126353Smlaier lungetc(next); 4868126353Smlaier break; 4869126353Smlaier case '>': 4870126353Smlaier next = lgetc(fin); 4871126353Smlaier if (next == '<') { 4872126353Smlaier yylval.v.i = PF_OP_IRG; 4873126353Smlaier return (PORTBINARY); 4874126353Smlaier } 4875126353Smlaier lungetc(next); 4876126353Smlaier break; 4877126353Smlaier case '-': 4878126353Smlaier next = lgetc(fin); 4879126353Smlaier if (next == '>') 4880126353Smlaier return (ARROW); 4881126353Smlaier lungetc(next); 4882126353Smlaier break; 4883126353Smlaier } 4884126353Smlaier 4885126353Smlaier#define allowed_in_string(x) \ 4886126353Smlaier (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4887126353Smlaier x != '{' && x != '}' && x != '<' && x != '>' && \ 4888126353Smlaier x != '!' && x != '=' && x != '/' && x != '#' && \ 4889126353Smlaier x != ',')) 4890126353Smlaier 4891126353Smlaier if (isalnum(c) || c == ':' || c == '_') { 4892126353Smlaier do { 4893126353Smlaier *p++ = c; 4894126353Smlaier if ((unsigned)(p-buf) >= sizeof(buf)) { 4895126353Smlaier yyerror("string too long"); 4896126353Smlaier return (findeol()); 4897126353Smlaier } 4898126353Smlaier } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4899126353Smlaier lungetc(c); 4900126353Smlaier *p = '\0'; 4901130617Smlaier if ((token = lookup(buf)) == STRING) 4902130617Smlaier if ((yylval.v.string = strdup(buf)) == NULL) 4903130617Smlaier err(1, "yylex: strdup"); 4904126353Smlaier return (token); 4905126353Smlaier } 4906126353Smlaier if (c == '\n') { 4907126353Smlaier yylval.lineno = lineno; 4908126353Smlaier lineno++; 4909126353Smlaier } 4910126353Smlaier if (c == EOF) 4911126353Smlaier return (0); 4912126353Smlaier return (c); 4913126353Smlaier} 4914126353Smlaier 4915126353Smlaierint 4916126353Smlaierparse_rules(FILE *input, struct pfctl *xpf) 4917126353Smlaier{ 4918130617Smlaier struct sym *sym, *next; 4919126353Smlaier 4920126353Smlaier fin = input; 4921126353Smlaier pf = xpf; 4922126353Smlaier lineno = 1; 4923126353Smlaier errors = 0; 4924126353Smlaier rulestate = PFCTL_STATE_NONE; 4925126353Smlaier returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4926126353Smlaier returnicmp6default = 4927126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4928126353Smlaier blockpolicy = PFRULE_DROP; 4929126353Smlaier require_order = 1; 4930126353Smlaier 4931126353Smlaier yyparse(); 4932126353Smlaier 4933126353Smlaier /* Free macros and check which have not been used. */ 4934130617Smlaier for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 4935130617Smlaier next = TAILQ_NEXT(sym, entries); 4936126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 4937126353Smlaier fprintf(stderr, "warning: macro '%s' not " 4938126353Smlaier "used\n", sym->nam); 4939126353Smlaier free(sym->nam); 4940126353Smlaier free(sym->val); 4941126353Smlaier TAILQ_REMOVE(&symhead, sym, entries); 4942130617Smlaier free(sym); 4943126353Smlaier } 4944126353Smlaier 4945126353Smlaier return (errors ? -1 : 0); 4946126353Smlaier} 4947126353Smlaier 4948126353Smlaier/* 4949126353Smlaier * Over-designed efficiency is a French and German concept, so how about 4950126353Smlaier * we wait until they discover this ugliness and make it all fancy. 4951126353Smlaier */ 4952126353Smlaierint 4953126353Smlaiersymset(const char *nam, const char *val, int persist) 4954126353Smlaier{ 4955126353Smlaier struct sym *sym; 4956126353Smlaier 4957126353Smlaier for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 4958126353Smlaier sym = TAILQ_NEXT(sym, entries)) 4959126353Smlaier ; /* nothing */ 4960126353Smlaier 4961126353Smlaier if (sym != NULL) { 4962126353Smlaier if (sym->persist == 1) 4963126353Smlaier return (0); 4964126353Smlaier else { 4965126353Smlaier free(sym->nam); 4966126353Smlaier free(sym->val); 4967126353Smlaier TAILQ_REMOVE(&symhead, sym, entries); 4968126353Smlaier free(sym); 4969126353Smlaier } 4970126353Smlaier } 4971126353Smlaier if ((sym = calloc(1, sizeof(*sym))) == NULL) 4972126353Smlaier return (-1); 4973126353Smlaier 4974126353Smlaier sym->nam = strdup(nam); 4975126353Smlaier if (sym->nam == NULL) { 4976126353Smlaier free(sym); 4977126353Smlaier return (-1); 4978126353Smlaier } 4979126353Smlaier sym->val = strdup(val); 4980126353Smlaier if (sym->val == NULL) { 4981126353Smlaier free(sym->nam); 4982126353Smlaier free(sym); 4983126353Smlaier return (-1); 4984126353Smlaier } 4985126353Smlaier sym->used = 0; 4986126353Smlaier sym->persist = persist; 4987126353Smlaier TAILQ_INSERT_TAIL(&symhead, sym, entries); 4988126353Smlaier return (0); 4989126353Smlaier} 4990126353Smlaier 4991126353Smlaierint 4992126353Smlaierpfctl_cmdline_symset(char *s) 4993126353Smlaier{ 4994126353Smlaier char *sym, *val; 4995126353Smlaier int ret; 4996126353Smlaier 4997126353Smlaier if ((val = strrchr(s, '=')) == NULL) 4998126353Smlaier return (-1); 4999126353Smlaier 5000126353Smlaier if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5001126353Smlaier err(1, "pfctl_cmdline_symset: malloc"); 5002126353Smlaier 5003126353Smlaier strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5004126353Smlaier 5005126353Smlaier ret = symset(sym, val + 1, 1); 5006126353Smlaier free(sym); 5007126353Smlaier 5008126353Smlaier return (ret); 5009126353Smlaier} 5010126353Smlaier 5011126353Smlaierchar * 5012126353Smlaiersymget(const char *nam) 5013126353Smlaier{ 5014126353Smlaier struct sym *sym; 5015126353Smlaier 5016126353Smlaier TAILQ_FOREACH(sym, &symhead, entries) 5017126353Smlaier if (strcmp(nam, sym->nam) == 0) { 5018126353Smlaier sym->used = 1; 5019126353Smlaier return (sym->val); 5020126353Smlaier } 5021126353Smlaier return (NULL); 5022126353Smlaier} 5023126353Smlaier 5024126353Smlaiervoid 5025126353Smlaierdecide_address_family(struct node_host *n, sa_family_t *af) 5026126353Smlaier{ 5027126353Smlaier sa_family_t target_af = 0; 5028126353Smlaier 5029126353Smlaier while (!*af && n != NULL) { 5030126353Smlaier if (n->af) { 5031126353Smlaier if (target_af == 0) 5032126353Smlaier target_af = n->af; 5033126353Smlaier if (target_af != n->af) 5034126353Smlaier return; 5035126353Smlaier } 5036126353Smlaier n = n->next; 5037126353Smlaier } 5038126353Smlaier if (!*af && target_af) 5039126353Smlaier *af = target_af; 5040126353Smlaier} 5041126353Smlaier 5042126353Smlaiervoid 5043126353Smlaierremove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5044126353Smlaier{ 5045126353Smlaier struct node_host *n = *nh, *prev = NULL; 5046126353Smlaier 5047126353Smlaier while (n != NULL) { 5048126353Smlaier if (*af && n->af && n->af != *af) { 5049126353Smlaier /* unlink and free n */ 5050126353Smlaier struct node_host *next = n->next; 5051126353Smlaier 5052126353Smlaier /* adjust tail pointer */ 5053126353Smlaier if (n == (*nh)->tail) 5054126353Smlaier (*nh)->tail = prev; 5055126353Smlaier /* adjust previous node's next pointer */ 5056126353Smlaier if (prev == NULL) 5057126353Smlaier *nh = next; 5058126353Smlaier else 5059126353Smlaier prev->next = next; 5060126353Smlaier /* free node */ 5061126353Smlaier if (n->ifname != NULL) 5062126353Smlaier free(n->ifname); 5063126353Smlaier free(n); 5064126353Smlaier n = next; 5065126353Smlaier } else { 5066126353Smlaier if (n->af && !*af) 5067126353Smlaier *af = n->af; 5068126353Smlaier prev = n; 5069126353Smlaier n = n->next; 5070126353Smlaier } 5071126353Smlaier } 5072126353Smlaier} 5073126353Smlaier 5074126353Smlaierint 5075126353Smlaierinvalid_redirect(struct node_host *nh, sa_family_t af) 5076126353Smlaier{ 5077126353Smlaier if (!af) { 5078126353Smlaier struct node_host *n; 5079126353Smlaier 5080130617Smlaier /* tables and dyniftl are ok without an address family */ 5081126353Smlaier for (n = nh; n != NULL; n = n->next) { 5082130617Smlaier if (n->addr.type != PF_ADDR_TABLE && 5083130617Smlaier n->addr.type != PF_ADDR_DYNIFTL) { 5084126353Smlaier yyerror("address family not given and " 5085126353Smlaier "translation address expands to multiple " 5086126353Smlaier "address families"); 5087126353Smlaier return (1); 5088126353Smlaier } 5089126353Smlaier } 5090126353Smlaier } 5091126353Smlaier if (nh == NULL) { 5092126353Smlaier yyerror("no translation address with matching address family " 5093126353Smlaier "found."); 5094126353Smlaier return (1); 5095126353Smlaier } 5096126353Smlaier return (0); 5097126353Smlaier} 5098126353Smlaier 5099126353Smlaierint 5100126353Smlaieratoul(char *s, u_long *ulvalp) 5101126353Smlaier{ 5102126353Smlaier u_long ulval; 5103126353Smlaier char *ep; 5104126353Smlaier 5105126353Smlaier errno = 0; 5106126353Smlaier ulval = strtoul(s, &ep, 0); 5107126353Smlaier if (s[0] == '\0' || *ep != '\0') 5108126353Smlaier return (-1); 5109126353Smlaier if (errno == ERANGE && ulval == ULONG_MAX) 5110126353Smlaier return (-1); 5111126353Smlaier *ulvalp = ulval; 5112126353Smlaier return (0); 5113126353Smlaier} 5114126353Smlaier 5115126353Smlaierint 5116126353Smlaiergetservice(char *n) 5117126353Smlaier{ 5118126353Smlaier struct servent *s; 5119126353Smlaier u_long ulval; 5120126353Smlaier 5121126353Smlaier if (atoul(n, &ulval) == 0) { 5122126353Smlaier if (ulval > 65535) { 5123145840Smlaier yyerror("illegal port value %lu", ulval); 5124126353Smlaier return (-1); 5125126353Smlaier } 5126126353Smlaier return (htons(ulval)); 5127126353Smlaier } else { 5128126353Smlaier s = getservbyname(n, "tcp"); 5129126353Smlaier if (s == NULL) 5130126353Smlaier s = getservbyname(n, "udp"); 5131126353Smlaier if (s == NULL) { 5132126353Smlaier yyerror("unknown port %s", n); 5133126353Smlaier return (-1); 5134126353Smlaier } 5135126353Smlaier return (s->s_port); 5136126353Smlaier } 5137126353Smlaier} 5138126353Smlaier 5139126353Smlaierint 5140126353Smlaierrule_label(struct pf_rule *r, char *s) 5141126353Smlaier{ 5142126353Smlaier if (s) { 5143126353Smlaier if (strlcpy(r->label, s, sizeof(r->label)) >= 5144126353Smlaier sizeof(r->label)) { 5145126353Smlaier yyerror("rule label too long (max %d chars)", 5146126353Smlaier sizeof(r->label)-1); 5147126353Smlaier return (-1); 5148126353Smlaier } 5149126353Smlaier } 5150126353Smlaier return (0); 5151126353Smlaier} 5152126353Smlaier 5153126353Smlaieru_int16_t 5154126353Smlaierparseicmpspec(char *w, sa_family_t af) 5155126353Smlaier{ 5156126353Smlaier const struct icmpcodeent *p; 5157126353Smlaier u_long ulval; 5158126353Smlaier u_int8_t icmptype; 5159126353Smlaier 5160126353Smlaier if (af == AF_INET) 5161126353Smlaier icmptype = returnicmpdefault >> 8; 5162126353Smlaier else 5163126353Smlaier icmptype = returnicmp6default >> 8; 5164126353Smlaier 5165126353Smlaier if (atoul(w, &ulval) == -1) { 5166126353Smlaier if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5167126353Smlaier yyerror("unknown icmp code %s", w); 5168126353Smlaier return (0); 5169126353Smlaier } 5170126353Smlaier ulval = p->code; 5171126353Smlaier } 5172126353Smlaier if (ulval > 255) { 5173145840Smlaier yyerror("invalid icmp code %lu", ulval); 5174126353Smlaier return (0); 5175126353Smlaier } 5176126353Smlaier return (icmptype << 8 | ulval); 5177126353Smlaier} 5178126353Smlaier 5179126353Smlaierint 5180130617Smlaierpfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans) 5181126353Smlaier{ 5182126353Smlaier struct loadanchors *la; 5183126353Smlaier 5184126353Smlaier TAILQ_FOREACH(la, &loadanchorshead, entries) { 5185126353Smlaier if (opts & PF_OPT_VERBOSE) 5186145840Smlaier fprintf(stderr, "\nLoading anchor %s from %s\n", 5187145840Smlaier la->anchorname, la->filename); 5188126353Smlaier if (pfctl_rules(dev, la->filename, opts, la->anchorname, 5189145840Smlaier trans) == -1) 5190126353Smlaier return (-1); 5191126353Smlaier } 5192126353Smlaier 5193126353Smlaier return (0); 5194126353Smlaier} 5195126353Smlaier 5196