parse.y revision 1.501
1/* $OpenBSD: parse.y,v 1.501 2006/06/17 11:38:41 henning Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/types.h> 31#include <sys/socket.h> 32#include <net/if.h> 33#include <netinet/in.h> 34#include <netinet/in_systm.h> 35#include <netinet/ip.h> 36#include <netinet/ip_icmp.h> 37#include <netinet/icmp6.h> 38#include <net/pfvar.h> 39#include <arpa/inet.h> 40#include <altq/altq.h> 41#include <altq/altq_cbq.h> 42#include <altq/altq_priq.h> 43#include <altq/altq_hfsc.h> 44 45#include <stdio.h> 46#include <stdlib.h> 47#include <netdb.h> 48#include <stdarg.h> 49#include <errno.h> 50#include <string.h> 51#include <ctype.h> 52#include <math.h> 53#include <err.h> 54#include <limits.h> 55#include <pwd.h> 56#include <grp.h> 57#include <md5.h> 58 59#include "pfctl_parser.h" 60#include "pfctl.h" 61 62static struct pfctl *pf = NULL; 63static FILE *fin = NULL; 64static int debug = 0; 65static int lineno = 1; 66static int errors = 0; 67static int rulestate = 0; 68static u_int16_t returnicmpdefault = 69 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 70static u_int16_t returnicmp6default = 71 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 72static int blockpolicy = PFRULE_DROP; 73static int require_order = 1; 74static int default_statelock; 75 76enum { 77 PFCTL_STATE_NONE, 78 PFCTL_STATE_OPTION, 79 PFCTL_STATE_SCRUB, 80 PFCTL_STATE_QUEUE, 81 PFCTL_STATE_NAT, 82 PFCTL_STATE_FILTER 83}; 84 85struct node_proto { 86 u_int8_t proto; 87 struct node_proto *next; 88 struct node_proto *tail; 89}; 90 91struct node_port { 92 u_int16_t port[2]; 93 u_int8_t op; 94 struct node_port *next; 95 struct node_port *tail; 96}; 97 98struct node_uid { 99 uid_t uid[2]; 100 u_int8_t op; 101 struct node_uid *next; 102 struct node_uid *tail; 103}; 104 105struct node_gid { 106 gid_t gid[2]; 107 u_int8_t op; 108 struct node_gid *next; 109 struct node_gid *tail; 110}; 111 112struct node_icmp { 113 u_int8_t code; 114 u_int8_t type; 115 u_int8_t proto; 116 struct node_icmp *next; 117 struct node_icmp *tail; 118}; 119 120struct node_matchtag { 121 char tagname[PF_TAG_NAME_SIZE]; 122 struct node_matchtag *next; 123 struct node_matchtag *tail; 124}; 125 126enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 127 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 128 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 129 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 130 PF_STATE_OPT_TIMEOUT }; 131 132enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 133 134struct node_state_opt { 135 int type; 136 union { 137 u_int32_t max_states; 138 u_int32_t max_src_states; 139 u_int32_t max_src_conn; 140 struct { 141 u_int32_t limit; 142 u_int32_t seconds; 143 } max_src_conn_rate; 144 struct { 145 u_int8_t flush; 146 char tblname[PF_TABLE_NAME_SIZE]; 147 } overload; 148 u_int32_t max_src_nodes; 149 u_int8_t src_track; 150 u_int32_t statelock; 151 struct { 152 int number; 153 u_int32_t seconds; 154 } timeout; 155 } data; 156 struct node_state_opt *next; 157 struct node_state_opt *tail; 158}; 159 160struct peer { 161 struct node_host *host; 162 struct node_port *port; 163}; 164 165struct node_queue { 166 char queue[PF_QNAME_SIZE]; 167 char parent[PF_QNAME_SIZE]; 168 char ifname[IFNAMSIZ]; 169 int scheduler; 170 struct node_queue *next; 171 struct node_queue *tail; 172} *queues = NULL; 173 174struct node_qassign { 175 char *qname; 176 char *pqname; 177}; 178 179struct filter_opts { 180 int marker; 181#define FOM_FLAGS 0x01 182#define FOM_ICMP 0x02 183#define FOM_TOS 0x04 184#define FOM_KEEP 0x08 185#define FOM_SRCTRACK 0x10 186 struct node_uid *uid; 187 struct node_gid *gid; 188 struct { 189 u_int8_t b1; 190 u_int8_t b2; 191 u_int16_t w; 192 u_int16_t w2; 193 } flags; 194 struct node_icmp *icmpspec; 195 u_int32_t tos; 196 u_int32_t prob; 197 struct { 198 int action; 199 struct node_state_opt *options; 200 } keep; 201 int fragment; 202 int allowopts; 203 char *label; 204 struct node_qassign queues; 205 char *tag; 206 struct node_matchtag *match_tags; 207 u_int8_t match_tag_not; 208} filter_opts; 209 210struct antispoof_opts { 211 char *label; 212} antispoof_opts; 213 214struct scrub_opts { 215 int marker; 216#define SOM_MINTTL 0x01 217#define SOM_MAXMSS 0x02 218#define SOM_FRAGCACHE 0x04 219 int nodf; 220 int minttl; 221 int maxmss; 222 int fragcache; 223 int randomid; 224 int reassemble_tcp; 225} scrub_opts; 226 227struct queue_opts { 228 int marker; 229#define QOM_BWSPEC 0x01 230#define QOM_SCHEDULER 0x02 231#define QOM_PRIORITY 0x04 232#define QOM_TBRSIZE 0x08 233#define QOM_QLIMIT 0x10 234 struct node_queue_bw queue_bwspec; 235 struct node_queue_opt scheduler; 236 int priority; 237 int tbrsize; 238 int qlimit; 239} queue_opts; 240 241struct table_opts { 242 int flags; 243 int init_addr; 244 struct node_tinithead init_nodes; 245} table_opts; 246 247struct pool_opts { 248 int marker; 249#define POM_TYPE 0x01 250#define POM_STICKYADDRESS 0x02 251 u_int8_t opts; 252 int type; 253 int staticport; 254 struct pf_poolhashkey *key; 255 256} pool_opts; 257 258 259struct node_hfsc_opts hfsc_opts; 260 261int yyerror(const char *, ...); 262int disallow_table(struct node_host *, const char *); 263int disallow_urpf_failed(struct node_host *, const char *); 264int disallow_alias(struct node_host *, const char *); 265int rule_consistent(struct pf_rule *, int); 266int filter_consistent(struct pf_rule *, int); 267int nat_consistent(struct pf_rule *); 268int rdr_consistent(struct pf_rule *); 269int process_tabledef(char *, struct table_opts *); 270int yyparse(void); 271void expand_label_str(char *, size_t, const char *, const char *); 272void expand_label_if(const char *, char *, size_t, const char *); 273void expand_label_addr(const char *, char *, size_t, u_int8_t, 274 struct node_host *); 275void expand_label_port(const char *, char *, size_t, struct node_port *); 276void expand_label_proto(const char *, char *, size_t, u_int8_t); 277void expand_label_nr(const char *, char *, size_t); 278void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 279 struct node_port *, struct node_host *, struct node_port *, 280 u_int8_t); 281void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 282 struct node_proto *, struct node_os*, struct node_host *, 283 struct node_port *, struct node_host *, struct node_port *, 284 struct node_uid *, struct node_gid *, struct node_icmp *, 285 struct node_matchtag *, const char *); 286int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 287 struct node_queue_bw bwspec, struct node_queue_opt *); 288int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 289 struct node_queue_bw, struct node_queue_opt *); 290int expand_skip_interface(struct node_if *); 291 292int check_rulestate(int); 293int kw_cmp(const void *, const void *); 294int lookup(char *); 295int lgetc(FILE *); 296int lungetc(int); 297int findeol(void); 298int yylex(void); 299int atoul(char *, u_long *); 300int getservice(char *); 301int rule_label(struct pf_rule *, char *); 302 303TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 304struct sym { 305 TAILQ_ENTRY(sym) entries; 306 int used; 307 int persist; 308 char *nam; 309 char *val; 310}; 311 312 313int symset(const char *, const char *, int); 314char *symget(const char *); 315 316void decide_address_family(struct node_host *, sa_family_t *); 317void remove_invalid_hosts(struct node_host **, sa_family_t *); 318int invalid_redirect(struct node_host *, sa_family_t); 319u_int16_t parseicmpspec(char *, sa_family_t); 320 321TAILQ_HEAD(loadanchorshead, loadanchors) 322 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 323 324struct loadanchors { 325 TAILQ_ENTRY(loadanchors) entries; 326 char *anchorname; 327 char *filename; 328}; 329 330typedef struct { 331 union { 332 u_int32_t number; 333 int i; 334 char *string; 335 struct { 336 u_int8_t b1; 337 u_int8_t b2; 338 u_int16_t w; 339 u_int16_t w2; 340 } b; 341 struct range { 342 int a; 343 int b; 344 int t; 345 } range; 346 struct node_if *interface; 347 struct node_proto *proto; 348 struct node_icmp *icmp; 349 struct node_host *host; 350 struct node_os *os; 351 struct node_port *port; 352 struct node_uid *uid; 353 struct node_gid *gid; 354 struct node_state_opt *state_opt; 355 struct peer peer; 356 struct { 357 struct peer src, dst; 358 struct node_os *src_os; 359 } fromto; 360 struct { 361 struct node_host *host; 362 u_int8_t rt; 363 u_int8_t pool_opts; 364 sa_family_t af; 365 struct pf_poolhashkey *key; 366 } route; 367 struct redirection { 368 struct node_host *host; 369 struct range rport; 370 } *redirection; 371 struct { 372 int action; 373 struct node_state_opt *options; 374 } keep_state; 375 struct { 376 u_int8_t log; 377 u_int8_t quick; 378 } logquick; 379 struct { 380 int neg; 381 char *name; 382 } tagged; 383 struct pf_poolhashkey *hashkey; 384 struct node_queue *queue; 385 struct node_queue_opt queue_options; 386 struct node_queue_bw queue_bwspec; 387 struct node_qassign qassign; 388 struct filter_opts filter_opts; 389 struct antispoof_opts antispoof_opts; 390 struct queue_opts queue_opts; 391 struct scrub_opts scrub_opts; 392 struct table_opts table_opts; 393 struct pool_opts pool_opts; 394 struct node_hfsc_opts hfsc_opts; 395 struct node_matchtag *matchtag_opts; 396 } v; 397 int lineno; 398} YYSTYPE; 399 400#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 401 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 402 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 403 404%} 405 406%token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 407%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 408%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 409%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 410%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 411%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 412%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 413%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 414%token ANTISPOOF FOR 415%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 416%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 417%token QUEUE PRIORITY QLIMIT 418%token LOAD 419%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 420%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH 421%token TAGGED TAG IFBOUND FLOATING STATEPOLICY ROUTE 422%token <v.string> STRING 423%token <v.i> PORTBINARY 424%type <v.interface> interface if_list if_item_not if_item 425%type <v.number> number icmptype icmp6type uid gid 426%type <v.number> tos not yesno 427%type <v.i> no dir log logopts logopt af fragcache 428%type <v.i> sourcetrack flush unaryop statelock 429%type <v.b> action nataction natpass scrubaction 430%type <v.b> flags flag blockspec 431%type <v.range> port rport 432%type <v.hashkey> hashkey 433%type <v.proto> proto proto_list proto_item 434%type <v.icmp> icmpspec 435%type <v.icmp> icmp_list icmp_item 436%type <v.icmp> icmp6_list icmp6_item 437%type <v.fromto> fromto 438%type <v.peer> ipportspec from to 439%type <v.host> ipspec xhost host dynaddr host_list 440%type <v.host> redir_host_list redirspec 441%type <v.host> route_host route_host_list routespec 442%type <v.os> os xos os_list 443%type <v.port> portspec port_list port_item 444%type <v.uid> uids uid_list uid_item 445%type <v.gid> gids gid_list gid_item 446%type <v.route> route 447%type <v.redirection> redirection redirpool 448%type <v.string> label string tag 449%type <v.keep_state> keep 450%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 451%type <v.logquick> logquick 452%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 453%type <v.qassign> qname 454%type <v.queue> qassign qassign_list qassign_item 455%type <v.queue_options> scheduler 456%type <v.number> cbqflags_list cbqflags_item 457%type <v.number> priqflags_list priqflags_item 458%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 459%type <v.queue_bwspec> bandwidth 460%type <v.filter_opts> filter_opts filter_opt filter_opts_l 461%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 462%type <v.queue_opts> queue_opts queue_opt queue_opts_l 463%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 464%type <v.table_opts> table_opts table_opt table_opts_l 465%type <v.pool_opts> pool_opts pool_opt pool_opts_l 466%type <v.matchtag_opts> matchtag matchtag_list matchtag_item 467%type <v.tagged> tagged 468%% 469 470ruleset : /* empty */ 471 | ruleset '\n' 472 | ruleset option '\n' 473 | ruleset scrubrule '\n' 474 | ruleset natrule '\n' 475 | ruleset binatrule '\n' 476 | ruleset pfrule '\n' 477 | ruleset anchorrule '\n' 478 | ruleset loadrule '\n' 479 | ruleset altqif '\n' 480 | ruleset queuespec '\n' 481 | ruleset varset '\n' 482 | ruleset antispoof '\n' 483 | ruleset tabledef '\n' 484 | ruleset error '\n' { errors++; } 485 ; 486 487option : SET OPTIMIZATION STRING { 488 if (check_rulestate(PFCTL_STATE_OPTION)) { 489 free($3); 490 YYERROR; 491 } 492 if (pfctl_set_optimization(pf, $3) != 0) { 493 yyerror("unknown optimization %s", $3); 494 free($3); 495 YYERROR; 496 } 497 free($3); 498 } 499 | SET TIMEOUT timeout_spec 500 | SET TIMEOUT '{' timeout_list '}' 501 | SET LIMIT limit_spec 502 | SET LIMIT '{' limit_list '}' 503 | SET LOGINTERFACE STRING { 504 if (check_rulestate(PFCTL_STATE_OPTION)) { 505 free($3); 506 YYERROR; 507 } 508 if (pfctl_set_logif(pf, $3) != 0) { 509 yyerror("error setting loginterface %s", $3); 510 free($3); 511 YYERROR; 512 } 513 free($3); 514 } 515 | SET HOSTID number { 516 if ($3 == 0) { 517 yyerror("hostid must be non-zero"); 518 YYERROR; 519 } 520 if (pfctl_set_hostid(pf, $3) != 0) { 521 yyerror("error setting hostid %08x", $3); 522 YYERROR; 523 } 524 } 525 | SET BLOCKPOLICY DROP { 526 if (pf->opts & PF_OPT_VERBOSE) 527 printf("set block-policy drop\n"); 528 if (check_rulestate(PFCTL_STATE_OPTION)) 529 YYERROR; 530 blockpolicy = PFRULE_DROP; 531 } 532 | SET BLOCKPOLICY RETURN { 533 if (pf->opts & PF_OPT_VERBOSE) 534 printf("set block-policy return\n"); 535 if (check_rulestate(PFCTL_STATE_OPTION)) 536 YYERROR; 537 blockpolicy = PFRULE_RETURN; 538 } 539 | SET REQUIREORDER yesno { 540 if (pf->opts & PF_OPT_VERBOSE) 541 printf("set require-order %s\n", 542 $3 == 1 ? "yes" : "no"); 543 require_order = $3; 544 } 545 | SET FINGERPRINTS STRING { 546 if (pf->opts & PF_OPT_VERBOSE) 547 printf("set fingerprints %s\n", $3); 548 if (check_rulestate(PFCTL_STATE_OPTION)) { 549 free($3); 550 YYERROR; 551 } 552 if (!pf->anchor[0]) { 553 if (pfctl_file_fingerprints(pf->dev, 554 pf->opts, $3)) { 555 yyerror("error loading " 556 "fingerprints %s", $3); 557 free($3); 558 YYERROR; 559 } 560 } 561 free($3); 562 } 563 | SET STATEPOLICY statelock { 564 if (pf->opts & PF_OPT_VERBOSE) 565 switch ($3) { 566 case 0: 567 printf("set state-policy floating\n"); 568 break; 569 case PFRULE_IFBOUND: 570 printf("set state-policy if-bound\n"); 571 break; 572 } 573 default_statelock = $3; 574 } 575 | SET DEBUG STRING { 576 if (check_rulestate(PFCTL_STATE_OPTION)) { 577 free($3); 578 YYERROR; 579 } 580 if (pfctl_set_debug(pf, $3) != 0) { 581 yyerror("error setting debuglevel %s", $3); 582 free($3); 583 YYERROR; 584 } 585 free($3); 586 } 587 | SET SKIP interface { 588 if (expand_skip_interface($3) != 0) { 589 yyerror("error setting skip interface(s)"); 590 YYERROR; 591 } 592 } 593 ; 594 595string : string STRING { 596 if (asprintf(&$$, "%s %s", $1, $2) == -1) 597 err(1, "string: asprintf"); 598 free($1); 599 free($2); 600 } 601 | STRING 602 ; 603 604varset : STRING '=' string { 605 if (pf->opts & PF_OPT_VERBOSE) 606 printf("%s = \"%s\"\n", $1, $3); 607 if (symset($1, $3, 0) == -1) 608 err(1, "cannot store variable %s", $1); 609 free($1); 610 free($3); 611 } 612 ; 613 614anchorrule : ANCHOR string dir interface af proto fromto filter_opts { 615 struct pf_rule r; 616 617 if (check_rulestate(PFCTL_STATE_FILTER)) { 618 free($2); 619 YYERROR; 620 } 621 622 memset(&r, 0, sizeof(r)); 623 r.direction = $3; 624 r.af = $5; 625 r.prob = $8.prob; 626 627 r.match_tag_not = $8.match_tag_not; 628 629 decide_address_family($7.src.host, &r.af); 630 decide_address_family($7.dst.host, &r.af); 631 632 expand_rule(&r, $4, NULL, $6, $7.src_os, 633 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 634 0, 0, 0, $8.match_tags, $2); 635 free($2); 636 } 637 | NATANCHOR string interface af proto fromto { 638 struct pf_rule r; 639 640 if (check_rulestate(PFCTL_STATE_NAT)) { 641 free($2); 642 YYERROR; 643 } 644 645 memset(&r, 0, sizeof(r)); 646 r.action = PF_NAT; 647 r.af = $4; 648 649 decide_address_family($6.src.host, &r.af); 650 decide_address_family($6.dst.host, &r.af); 651 652 expand_rule(&r, $3, NULL, $5, $6.src_os, 653 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 654 0, 0, 0, 0, $2); 655 free($2); 656 } 657 | RDRANCHOR string interface af proto fromto { 658 struct pf_rule r; 659 660 if (check_rulestate(PFCTL_STATE_NAT)) { 661 free($2); 662 YYERROR; 663 } 664 665 memset(&r, 0, sizeof(r)); 666 r.action = PF_RDR; 667 r.af = $4; 668 669 decide_address_family($6.src.host, &r.af); 670 decide_address_family($6.dst.host, &r.af); 671 672 if ($6.src.port != NULL) { 673 yyerror("source port parameter not supported" 674 " in rdr-anchor"); 675 YYERROR; 676 } 677 if ($6.dst.port != NULL) { 678 if ($6.dst.port->next != NULL) { 679 yyerror("destination port list " 680 "expansion not supported in " 681 "rdr-anchor"); 682 YYERROR; 683 } else if ($6.dst.port->op != PF_OP_EQ) { 684 yyerror("destination port operators" 685 " not supported in rdr-anchor"); 686 YYERROR; 687 } 688 r.dst.port[0] = $6.dst.port->port[0]; 689 r.dst.port[1] = $6.dst.port->port[1]; 690 r.dst.port_op = $6.dst.port->op; 691 } 692 693 expand_rule(&r, $3, NULL, $5, $6.src_os, 694 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 695 0, 0, 0, 0, $2); 696 free($2); 697 } 698 | BINATANCHOR string interface af proto fromto { 699 struct pf_rule r; 700 701 if (check_rulestate(PFCTL_STATE_NAT)) { 702 free($2); 703 YYERROR; 704 } 705 706 memset(&r, 0, sizeof(r)); 707 r.action = PF_BINAT; 708 r.af = $4; 709 if ($5 != NULL) { 710 if ($5->next != NULL) { 711 yyerror("proto list expansion" 712 " not supported in binat-anchor"); 713 YYERROR; 714 } 715 r.proto = $5->proto; 716 free($5); 717 } 718 719 if ($6.src.host != NULL || $6.src.port != NULL || 720 $6.dst.host != NULL || $6.dst.port != NULL) { 721 yyerror("fromto parameter not supported" 722 " in binat-anchor"); 723 YYERROR; 724 } 725 726 decide_address_family($6.src.host, &r.af); 727 decide_address_family($6.dst.host, &r.af); 728 729 pfctl_add_rule(pf, &r, $2); 730 free($2); 731 } 732 ; 733 734loadrule : LOAD ANCHOR string FROM string { 735 struct loadanchors *loadanchor; 736 737 if (strlen(pf->anchor) + 1 + strlen($3) >= MAXPATHLEN) { 738 yyerror("anchorname %s too long, max %u\n", 739 $3, MAXPATHLEN - 1); 740 free($3); 741 YYERROR; 742 } 743 loadanchor = calloc(1, sizeof(struct loadanchors)); 744 if (loadanchor == NULL) 745 err(1, "loadrule: calloc"); 746 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 747 NULL) 748 err(1, "loadrule: malloc"); 749 if (pf->anchor[0]) 750 snprintf(loadanchor->anchorname, MAXPATHLEN, 751 "%s/%s", pf->anchor, $3); 752 else 753 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 754 if ((loadanchor->filename = strdup($5)) == NULL) 755 err(1, "loadrule: strdup"); 756 757 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 758 entries); 759 760 free($3); 761 free($5); 762 }; 763 764scrubaction : no SCRUB { 765 $$.b2 = $$.w = 0; 766 if ($1) 767 $$.b1 = PF_NOSCRUB; 768 else 769 $$.b1 = PF_SCRUB; 770 } 771 ; 772 773scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 774 { 775 struct pf_rule r; 776 777 if (check_rulestate(PFCTL_STATE_SCRUB)) 778 YYERROR; 779 780 memset(&r, 0, sizeof(r)); 781 782 r.action = $1.b1; 783 r.direction = $2; 784 785 r.log = $3.log; 786 if ($3.quick) { 787 yyerror("scrub rules do not support 'quick'"); 788 YYERROR; 789 } 790 791 r.af = $5; 792 if ($8.nodf) 793 r.rule_flag |= PFRULE_NODF; 794 if ($8.randomid) 795 r.rule_flag |= PFRULE_RANDOMID; 796 if ($8.reassemble_tcp) { 797 if (r.direction != PF_INOUT) { 798 yyerror("reassemble tcp rules can not " 799 "specify direction"); 800 YYERROR; 801 } 802 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 803 } 804 if ($8.minttl) 805 r.min_ttl = $8.minttl; 806 if ($8.maxmss) 807 r.max_mss = $8.maxmss; 808 if ($8.fragcache) 809 r.rule_flag |= $8.fragcache; 810 811 expand_rule(&r, $4, NULL, $6, $7.src_os, 812 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 813 NULL, NULL, NULL, NULL, ""); 814 } 815 ; 816 817scrub_opts : { 818 bzero(&scrub_opts, sizeof scrub_opts); 819 } 820 scrub_opts_l 821 { $$ = scrub_opts; } 822 | /* empty */ { 823 bzero(&scrub_opts, sizeof scrub_opts); 824 $$ = scrub_opts; 825 } 826 ; 827 828scrub_opts_l : scrub_opts_l scrub_opt 829 | scrub_opt 830 ; 831 832scrub_opt : NODF { 833 if (scrub_opts.nodf) { 834 yyerror("no-df cannot be respecified"); 835 YYERROR; 836 } 837 scrub_opts.nodf = 1; 838 } 839 | MINTTL number { 840 if (scrub_opts.marker & SOM_MINTTL) { 841 yyerror("min-ttl cannot be respecified"); 842 YYERROR; 843 } 844 if ($2 > 255) { 845 yyerror("illegal min-ttl value %d", $2); 846 YYERROR; 847 } 848 scrub_opts.marker |= SOM_MINTTL; 849 scrub_opts.minttl = $2; 850 } 851 | MAXMSS number { 852 if (scrub_opts.marker & SOM_MAXMSS) { 853 yyerror("max-mss cannot be respecified"); 854 YYERROR; 855 } 856 if ($2 > 65535) { 857 yyerror("illegal max-mss value %d", $2); 858 YYERROR; 859 } 860 scrub_opts.marker |= SOM_MAXMSS; 861 scrub_opts.maxmss = $2; 862 } 863 | fragcache { 864 if (scrub_opts.marker & SOM_FRAGCACHE) { 865 yyerror("fragcache cannot be respecified"); 866 YYERROR; 867 } 868 scrub_opts.marker |= SOM_FRAGCACHE; 869 scrub_opts.fragcache = $1; 870 } 871 | REASSEMBLE STRING { 872 if (strcasecmp($2, "tcp") != 0) { 873 yyerror("scrub reassemble supports only tcp, " 874 "not '%s'", $2); 875 free($2); 876 YYERROR; 877 } 878 free($2); 879 if (scrub_opts.reassemble_tcp) { 880 yyerror("reassemble tcp cannot be respecified"); 881 YYERROR; 882 } 883 scrub_opts.reassemble_tcp = 1; 884 } 885 | RANDOMID { 886 if (scrub_opts.randomid) { 887 yyerror("random-id cannot be respecified"); 888 YYERROR; 889 } 890 scrub_opts.randomid = 1; 891 } 892 ; 893 894fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 895 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 896 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 897 ; 898 899antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 900 struct pf_rule r; 901 struct node_host *h = NULL, *hh; 902 struct node_if *i, *j; 903 904 if (check_rulestate(PFCTL_STATE_FILTER)) 905 YYERROR; 906 907 for (i = $3; i; i = i->next) { 908 bzero(&r, sizeof(r)); 909 910 r.action = PF_DROP; 911 r.direction = PF_IN; 912 r.log = $2.log; 913 r.quick = $2.quick; 914 r.af = $4; 915 if (rule_label(&r, $5.label)) 916 YYERROR; 917 j = calloc(1, sizeof(struct node_if)); 918 if (j == NULL) 919 err(1, "antispoof: calloc"); 920 if (strlcpy(j->ifname, i->ifname, 921 sizeof(j->ifname)) >= sizeof(j->ifname)) { 922 free(j); 923 yyerror("interface name too long"); 924 YYERROR; 925 } 926 j->not = 1; 927 if (i->dynamic) { 928 h = calloc(1, sizeof(*h)); 929 if (h == NULL) 930 err(1, "address: calloc"); 931 h->addr.type = PF_ADDR_DYNIFTL; 932 set_ipmask(h, 128); 933 if (strlcpy(h->addr.v.ifname, i->ifname, 934 sizeof(h->addr.v.ifname)) >= 935 sizeof(h->addr.v.ifname)) { 936 free(h); 937 yyerror( 938 "interface name too long"); 939 YYERROR; 940 } 941 hh = malloc(sizeof(*hh)); 942 if (hh == NULL) 943 err(1, "address: malloc"); 944 bcopy(h, hh, sizeof(*hh)); 945 h->addr.iflags = PFI_AFLAG_NETWORK; 946 } else { 947 h = ifa_lookup(j->ifname, 948 PFI_AFLAG_NETWORK); 949 hh = NULL; 950 } 951 952 if (h != NULL) 953 expand_rule(&r, j, NULL, NULL, NULL, h, 954 NULL, NULL, NULL, NULL, NULL, 955 NULL, NULL, ""); 956 957 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 958 bzero(&r, sizeof(r)); 959 960 r.action = PF_DROP; 961 r.direction = PF_IN; 962 r.log = $2.log; 963 r.quick = $2.quick; 964 r.af = $4; 965 if (rule_label(&r, $5.label)) 966 YYERROR; 967 if (hh != NULL) 968 h = hh; 969 else 970 h = ifa_lookup(i->ifname, 0); 971 if (h != NULL) 972 expand_rule(&r, NULL, NULL, 973 NULL, NULL, h, NULL, NULL, 974 NULL, NULL, NULL, NULL, 975 NULL, ""); 976 } else 977 free(hh); 978 } 979 free($5.label); 980 } 981 ; 982 983antispoof_ifspc : FOR antispoof_if { $$ = $2; } 984 | FOR '{' antispoof_iflst '}' { $$ = $3; } 985 ; 986 987antispoof_iflst : antispoof_if { $$ = $1; } 988 | antispoof_iflst comma antispoof_if { 989 $1->tail->next = $3; 990 $1->tail = $3; 991 $$ = $1; 992 } 993 ; 994 995antispoof_if : if_item { $$ = $1; } 996 | '(' if_item ')' { 997 $2->dynamic = 1; 998 $$ = $2; 999 } 1000 ; 1001 1002antispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 1003 antispoof_opts_l 1004 { $$ = antispoof_opts; } 1005 | /* empty */ { 1006 bzero(&antispoof_opts, sizeof antispoof_opts); 1007 $$ = antispoof_opts; 1008 } 1009 ; 1010 1011antispoof_opts_l : antispoof_opts_l antispoof_opt 1012 | antispoof_opt 1013 ; 1014 1015antispoof_opt : label { 1016 if (antispoof_opts.label) { 1017 yyerror("label cannot be redefined"); 1018 YYERROR; 1019 } 1020 antispoof_opts.label = $1; 1021 } 1022 ; 1023 1024not : '!' { $$ = 1; } 1025 | /* empty */ { $$ = 0; } 1026 ; 1027 1028tabledef : TABLE '<' STRING '>' table_opts { 1029 struct node_host *h, *nh; 1030 struct node_tinit *ti, *nti; 1031 1032 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1033 yyerror("table name too long, max %d chars", 1034 PF_TABLE_NAME_SIZE - 1); 1035 free($3); 1036 YYERROR; 1037 } 1038 if (pf->loadopt & PFCTL_FLAG_TABLE) 1039 if (process_tabledef($3, &$5)) { 1040 free($3); 1041 YYERROR; 1042 } 1043 free($3); 1044 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1045 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1046 if (ti->file) 1047 free(ti->file); 1048 for (h = ti->host; h != NULL; h = nh) { 1049 nh = h->next; 1050 free(h); 1051 } 1052 nti = SIMPLEQ_NEXT(ti, entries); 1053 free(ti); 1054 } 1055 } 1056 ; 1057 1058table_opts : { 1059 bzero(&table_opts, sizeof table_opts); 1060 SIMPLEQ_INIT(&table_opts.init_nodes); 1061 } 1062 table_opts_l 1063 { $$ = table_opts; } 1064 | /* empty */ 1065 { 1066 bzero(&table_opts, sizeof table_opts); 1067 SIMPLEQ_INIT(&table_opts.init_nodes); 1068 $$ = table_opts; 1069 } 1070 ; 1071 1072table_opts_l : table_opts_l table_opt 1073 | table_opt 1074 ; 1075 1076table_opt : STRING { 1077 if (!strcmp($1, "const")) 1078 table_opts.flags |= PFR_TFLAG_CONST; 1079 else if (!strcmp($1, "persist")) 1080 table_opts.flags |= PFR_TFLAG_PERSIST; 1081 else { 1082 yyerror("invalid table option '%s'", $1); 1083 free($1); 1084 YYERROR; 1085 } 1086 free($1); 1087 } 1088 | '{' '}' { table_opts.init_addr = 1; } 1089 | '{' host_list '}' { 1090 struct node_host *n; 1091 struct node_tinit *ti; 1092 1093 for (n = $2; n != NULL; n = n->next) { 1094 switch (n->addr.type) { 1095 case PF_ADDR_ADDRMASK: 1096 continue; /* ok */ 1097 case PF_ADDR_DYNIFTL: 1098 yyerror("dynamic addresses are not " 1099 "permitted inside tables"); 1100 break; 1101 case PF_ADDR_TABLE: 1102 yyerror("tables cannot contain tables"); 1103 break; 1104 case PF_ADDR_NOROUTE: 1105 yyerror("\"no-route\" is not permitted " 1106 "inside tables"); 1107 break; 1108 case PF_ADDR_URPFFAILED: 1109 yyerror("\"urpf-failed\" is not " 1110 "permitted inside tables"); 1111 break; 1112 default: 1113 yyerror("unknown address type %d", 1114 n->addr.type); 1115 } 1116 YYERROR; 1117 } 1118 if (!(ti = calloc(1, sizeof(*ti)))) 1119 err(1, "table_opt: calloc"); 1120 ti->host = $2; 1121 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1122 entries); 1123 table_opts.init_addr = 1; 1124 } 1125 | FILENAME STRING { 1126 struct node_tinit *ti; 1127 1128 if (!(ti = calloc(1, sizeof(*ti)))) 1129 err(1, "table_opt: calloc"); 1130 ti->file = $2; 1131 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1132 entries); 1133 table_opts.init_addr = 1; 1134 } 1135 ; 1136 1137altqif : ALTQ interface queue_opts QUEUE qassign { 1138 struct pf_altq a; 1139 1140 if (check_rulestate(PFCTL_STATE_QUEUE)) 1141 YYERROR; 1142 1143 memset(&a, 0, sizeof(a)); 1144 if ($3.scheduler.qtype == ALTQT_NONE) { 1145 yyerror("no scheduler specified!"); 1146 YYERROR; 1147 } 1148 a.scheduler = $3.scheduler.qtype; 1149 a.qlimit = $3.qlimit; 1150 a.tbrsize = $3.tbrsize; 1151 if ($5 == NULL) { 1152 yyerror("no child queues specified"); 1153 YYERROR; 1154 } 1155 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1156 &$3.scheduler)) 1157 YYERROR; 1158 } 1159 ; 1160 1161queuespec : QUEUE STRING interface queue_opts qassign { 1162 struct pf_altq a; 1163 1164 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1165 free($2); 1166 YYERROR; 1167 } 1168 1169 memset(&a, 0, sizeof(a)); 1170 1171 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1172 sizeof(a.qname)) { 1173 yyerror("queue name too long (max " 1174 "%d chars)", PF_QNAME_SIZE-1); 1175 free($2); 1176 YYERROR; 1177 } 1178 free($2); 1179 if ($4.tbrsize) { 1180 yyerror("cannot specify tbrsize for queue"); 1181 YYERROR; 1182 } 1183 if ($4.priority > 255) { 1184 yyerror("priority out of range: max 255"); 1185 YYERROR; 1186 } 1187 a.priority = $4.priority; 1188 a.qlimit = $4.qlimit; 1189 a.scheduler = $4.scheduler.qtype; 1190 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1191 &$4.scheduler)) { 1192 yyerror("errors in queue definition"); 1193 YYERROR; 1194 } 1195 } 1196 ; 1197 1198queue_opts : { 1199 bzero(&queue_opts, sizeof queue_opts); 1200 queue_opts.priority = DEFAULT_PRIORITY; 1201 queue_opts.qlimit = DEFAULT_QLIMIT; 1202 queue_opts.scheduler.qtype = ALTQT_NONE; 1203 queue_opts.queue_bwspec.bw_percent = 100; 1204 } 1205 queue_opts_l 1206 { $$ = queue_opts; } 1207 | /* empty */ { 1208 bzero(&queue_opts, sizeof queue_opts); 1209 queue_opts.priority = DEFAULT_PRIORITY; 1210 queue_opts.qlimit = DEFAULT_QLIMIT; 1211 queue_opts.scheduler.qtype = ALTQT_NONE; 1212 queue_opts.queue_bwspec.bw_percent = 100; 1213 $$ = queue_opts; 1214 } 1215 ; 1216 1217queue_opts_l : queue_opts_l queue_opt 1218 | queue_opt 1219 ; 1220 1221queue_opt : BANDWIDTH bandwidth { 1222 if (queue_opts.marker & QOM_BWSPEC) { 1223 yyerror("bandwidth cannot be respecified"); 1224 YYERROR; 1225 } 1226 queue_opts.marker |= QOM_BWSPEC; 1227 queue_opts.queue_bwspec = $2; 1228 } 1229 | PRIORITY number { 1230 if (queue_opts.marker & QOM_PRIORITY) { 1231 yyerror("priority cannot be respecified"); 1232 YYERROR; 1233 } 1234 if ($2 > 255) { 1235 yyerror("priority out of range: max 255"); 1236 YYERROR; 1237 } 1238 queue_opts.marker |= QOM_PRIORITY; 1239 queue_opts.priority = $2; 1240 } 1241 | QLIMIT number { 1242 if (queue_opts.marker & QOM_QLIMIT) { 1243 yyerror("qlimit cannot be respecified"); 1244 YYERROR; 1245 } 1246 if ($2 > 65535) { 1247 yyerror("qlimit out of range: max 65535"); 1248 YYERROR; 1249 } 1250 queue_opts.marker |= QOM_QLIMIT; 1251 queue_opts.qlimit = $2; 1252 } 1253 | scheduler { 1254 if (queue_opts.marker & QOM_SCHEDULER) { 1255 yyerror("scheduler cannot be respecified"); 1256 YYERROR; 1257 } 1258 queue_opts.marker |= QOM_SCHEDULER; 1259 queue_opts.scheduler = $1; 1260 } 1261 | TBRSIZE number { 1262 if (queue_opts.marker & QOM_TBRSIZE) { 1263 yyerror("tbrsize cannot be respecified"); 1264 YYERROR; 1265 } 1266 if ($2 > 65535) { 1267 yyerror("tbrsize too big: max 65535"); 1268 YYERROR; 1269 } 1270 queue_opts.marker |= QOM_TBRSIZE; 1271 queue_opts.tbrsize = $2; 1272 } 1273 ; 1274 1275bandwidth : STRING { 1276 double bps; 1277 char *cp; 1278 1279 $$.bw_percent = 0; 1280 1281 bps = strtod($1, &cp); 1282 if (cp != NULL) { 1283 if (!strcmp(cp, "b")) 1284 ; /* nothing */ 1285 else if (!strcmp(cp, "Kb")) 1286 bps *= 1000; 1287 else if (!strcmp(cp, "Mb")) 1288 bps *= 1000 * 1000; 1289 else if (!strcmp(cp, "Gb")) 1290 bps *= 1000 * 1000 * 1000; 1291 else if (!strcmp(cp, "%")) { 1292 if (bps < 0 || bps > 100) { 1293 yyerror("bandwidth spec " 1294 "out of range"); 1295 free($1); 1296 YYERROR; 1297 } 1298 $$.bw_percent = bps; 1299 bps = 0; 1300 } else { 1301 yyerror("unknown unit %s", cp); 1302 free($1); 1303 YYERROR; 1304 } 1305 } 1306 free($1); 1307 $$.bw_absolute = (u_int32_t)bps; 1308 } 1309 ; 1310 1311scheduler : CBQ { 1312 $$.qtype = ALTQT_CBQ; 1313 $$.data.cbq_opts.flags = 0; 1314 } 1315 | CBQ '(' cbqflags_list ')' { 1316 $$.qtype = ALTQT_CBQ; 1317 $$.data.cbq_opts.flags = $3; 1318 } 1319 | PRIQ { 1320 $$.qtype = ALTQT_PRIQ; 1321 $$.data.priq_opts.flags = 0; 1322 } 1323 | PRIQ '(' priqflags_list ')' { 1324 $$.qtype = ALTQT_PRIQ; 1325 $$.data.priq_opts.flags = $3; 1326 } 1327 | HFSC { 1328 $$.qtype = ALTQT_HFSC; 1329 bzero(&$$.data.hfsc_opts, 1330 sizeof(struct node_hfsc_opts)); 1331 } 1332 | HFSC '(' hfsc_opts ')' { 1333 $$.qtype = ALTQT_HFSC; 1334 $$.data.hfsc_opts = $3; 1335 } 1336 ; 1337 1338cbqflags_list : cbqflags_item { $$ |= $1; } 1339 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1340 ; 1341 1342cbqflags_item : STRING { 1343 if (!strcmp($1, "default")) 1344 $$ = CBQCLF_DEFCLASS; 1345 else if (!strcmp($1, "borrow")) 1346 $$ = CBQCLF_BORROW; 1347 else if (!strcmp($1, "red")) 1348 $$ = CBQCLF_RED; 1349 else if (!strcmp($1, "ecn")) 1350 $$ = CBQCLF_RED|CBQCLF_ECN; 1351 else if (!strcmp($1, "rio")) 1352 $$ = CBQCLF_RIO; 1353 else { 1354 yyerror("unknown cbq flag \"%s\"", $1); 1355 free($1); 1356 YYERROR; 1357 } 1358 free($1); 1359 } 1360 ; 1361 1362priqflags_list : priqflags_item { $$ |= $1; } 1363 | priqflags_list comma priqflags_item { $$ |= $3; } 1364 ; 1365 1366priqflags_item : STRING { 1367 if (!strcmp($1, "default")) 1368 $$ = PRCF_DEFAULTCLASS; 1369 else if (!strcmp($1, "red")) 1370 $$ = PRCF_RED; 1371 else if (!strcmp($1, "ecn")) 1372 $$ = PRCF_RED|PRCF_ECN; 1373 else if (!strcmp($1, "rio")) 1374 $$ = PRCF_RIO; 1375 else { 1376 yyerror("unknown priq flag \"%s\"", $1); 1377 free($1); 1378 YYERROR; 1379 } 1380 free($1); 1381 } 1382 ; 1383 1384hfsc_opts : { 1385 bzero(&hfsc_opts, 1386 sizeof(struct node_hfsc_opts)); 1387 } 1388 hfscopts_list { 1389 $$ = hfsc_opts; 1390 } 1391 ; 1392 1393hfscopts_list : hfscopts_item 1394 | hfscopts_list comma hfscopts_item 1395 ; 1396 1397hfscopts_item : LINKSHARE bandwidth { 1398 if (hfsc_opts.linkshare.used) { 1399 yyerror("linkshare already specified"); 1400 YYERROR; 1401 } 1402 hfsc_opts.linkshare.m2 = $2; 1403 hfsc_opts.linkshare.used = 1; 1404 } 1405 | LINKSHARE '(' bandwidth comma number comma bandwidth ')' 1406 { 1407 if (hfsc_opts.linkshare.used) { 1408 yyerror("linkshare already specified"); 1409 YYERROR; 1410 } 1411 hfsc_opts.linkshare.m1 = $3; 1412 hfsc_opts.linkshare.d = $5; 1413 hfsc_opts.linkshare.m2 = $7; 1414 hfsc_opts.linkshare.used = 1; 1415 } 1416 | REALTIME bandwidth { 1417 if (hfsc_opts.realtime.used) { 1418 yyerror("realtime already specified"); 1419 YYERROR; 1420 } 1421 hfsc_opts.realtime.m2 = $2; 1422 hfsc_opts.realtime.used = 1; 1423 } 1424 | REALTIME '(' bandwidth comma number comma bandwidth ')' 1425 { 1426 if (hfsc_opts.realtime.used) { 1427 yyerror("realtime already specified"); 1428 YYERROR; 1429 } 1430 hfsc_opts.realtime.m1 = $3; 1431 hfsc_opts.realtime.d = $5; 1432 hfsc_opts.realtime.m2 = $7; 1433 hfsc_opts.realtime.used = 1; 1434 } 1435 | UPPERLIMIT bandwidth { 1436 if (hfsc_opts.upperlimit.used) { 1437 yyerror("upperlimit already specified"); 1438 YYERROR; 1439 } 1440 hfsc_opts.upperlimit.m2 = $2; 1441 hfsc_opts.upperlimit.used = 1; 1442 } 1443 | UPPERLIMIT '(' bandwidth comma number comma bandwidth ')' 1444 { 1445 if (hfsc_opts.upperlimit.used) { 1446 yyerror("upperlimit already specified"); 1447 YYERROR; 1448 } 1449 hfsc_opts.upperlimit.m1 = $3; 1450 hfsc_opts.upperlimit.d = $5; 1451 hfsc_opts.upperlimit.m2 = $7; 1452 hfsc_opts.upperlimit.used = 1; 1453 } 1454 | STRING { 1455 if (!strcmp($1, "default")) 1456 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1457 else if (!strcmp($1, "red")) 1458 hfsc_opts.flags |= HFCF_RED; 1459 else if (!strcmp($1, "ecn")) 1460 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1461 else if (!strcmp($1, "rio")) 1462 hfsc_opts.flags |= HFCF_RIO; 1463 else { 1464 yyerror("unknown hfsc flag \"%s\"", $1); 1465 free($1); 1466 YYERROR; 1467 } 1468 free($1); 1469 } 1470 ; 1471 1472qassign : /* empty */ { $$ = NULL; } 1473 | qassign_item { $$ = $1; } 1474 | '{' qassign_list '}' { $$ = $2; } 1475 ; 1476 1477qassign_list : qassign_item { $$ = $1; } 1478 | qassign_list comma qassign_item { 1479 $1->tail->next = $3; 1480 $1->tail = $3; 1481 $$ = $1; 1482 } 1483 ; 1484 1485qassign_item : STRING { 1486 $$ = calloc(1, sizeof(struct node_queue)); 1487 if ($$ == NULL) 1488 err(1, "qassign_item: calloc"); 1489 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1490 sizeof($$->queue)) { 1491 yyerror("queue name '%s' too long (max " 1492 "%d chars)", $1, sizeof($$->queue)-1); 1493 free($1); 1494 free($$); 1495 YYERROR; 1496 } 1497 free($1); 1498 $$->next = NULL; 1499 $$->tail = $$; 1500 } 1501 ; 1502 1503pfrule : action dir logquick interface route af proto fromto 1504 filter_opts 1505 { 1506 struct pf_rule r; 1507 struct node_state_opt *o; 1508 struct node_proto *proto; 1509 int srctrack = 0; 1510 int statelock = 0; 1511 int adaptive = 0; 1512 1513 if (check_rulestate(PFCTL_STATE_FILTER)) 1514 YYERROR; 1515 1516 memset(&r, 0, sizeof(r)); 1517 1518 r.action = $1.b1; 1519 switch ($1.b2) { 1520 case PFRULE_RETURNRST: 1521 r.rule_flag |= PFRULE_RETURNRST; 1522 r.return_ttl = $1.w; 1523 break; 1524 case PFRULE_RETURNICMP: 1525 r.rule_flag |= PFRULE_RETURNICMP; 1526 r.return_icmp = $1.w; 1527 r.return_icmp6 = $1.w2; 1528 break; 1529 case PFRULE_RETURN: 1530 r.rule_flag |= PFRULE_RETURN; 1531 r.return_icmp = $1.w; 1532 r.return_icmp6 = $1.w2; 1533 break; 1534 } 1535 r.direction = $2; 1536 r.log = $3.log; 1537 r.quick = $3.quick; 1538 r.prob = $9.prob; 1539 1540 r.af = $6; 1541 if ($9.tag) 1542 if (strlcpy(r.tagname, $9.tag, 1543 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1544 yyerror("tag too long, max %u chars", 1545 PF_TAG_NAME_SIZE - 1); 1546 YYERROR; 1547 } 1548 r.match_tag_not = $9.match_tag_not; 1549 if (rule_label(&r, $9.label)) 1550 YYERROR; 1551 free($9.label); 1552 r.flags = $9.flags.b1; 1553 r.flagset = $9.flags.b2; 1554 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 1555 yyerror("flags always false"); 1556 YYERROR; 1557 } 1558 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1559 for (proto = $7; proto != NULL && 1560 proto->proto != IPPROTO_TCP; 1561 proto = proto->next) 1562 ; /* nothing */ 1563 if (proto == NULL && $7 != NULL) { 1564 if ($9.flags.b1 || $9.flags.b2) 1565 yyerror( 1566 "flags only apply to tcp"); 1567 if ($8.src_os) 1568 yyerror( 1569 "OS fingerprinting only " 1570 "apply to tcp"); 1571 YYERROR; 1572 } 1573#if 0 1574 if (($9.flags.b1 & parse_flags("S")) == 0 && 1575 $8.src_os) { 1576 yyerror("OS fingerprinting requires " 1577 "the SYN TCP flag (flags S/SA)"); 1578 YYERROR; 1579 } 1580#endif 1581 } 1582 1583 r.tos = $9.tos; 1584 r.keep_state = $9.keep.action; 1585 o = $9.keep.options; 1586 while (o) { 1587 struct node_state_opt *p = o; 1588 1589 switch (o->type) { 1590 case PF_STATE_OPT_MAX: 1591 if (r.max_states) { 1592 yyerror("state option 'max' " 1593 "multiple definitions"); 1594 YYERROR; 1595 } 1596 r.max_states = o->data.max_states; 1597 break; 1598 case PF_STATE_OPT_NOSYNC: 1599 if (r.rule_flag & PFRULE_NOSYNC) { 1600 yyerror("state option 'sync' " 1601 "multiple definitions"); 1602 YYERROR; 1603 } 1604 r.rule_flag |= PFRULE_NOSYNC; 1605 break; 1606 case PF_STATE_OPT_SRCTRACK: 1607 if (srctrack) { 1608 yyerror("state option " 1609 "'source-track' " 1610 "multiple definitions"); 1611 YYERROR; 1612 } 1613 srctrack = o->data.src_track; 1614 r.rule_flag |= PFRULE_SRCTRACK; 1615 break; 1616 case PF_STATE_OPT_MAX_SRC_STATES: 1617 if (r.max_src_states) { 1618 yyerror("state option " 1619 "'max-src-states' " 1620 "multiple definitions"); 1621 YYERROR; 1622 } 1623 if (o->data.max_src_states == 0) { 1624 yyerror("'max-src-states' must " 1625 "be > 0"); 1626 YYERROR; 1627 } 1628 r.max_src_states = 1629 o->data.max_src_states; 1630 r.rule_flag |= PFRULE_SRCTRACK; 1631 break; 1632 case PF_STATE_OPT_OVERLOAD: 1633 if (r.overload_tblname[0]) { 1634 yyerror("multiple 'overload' " 1635 "table definitions"); 1636 YYERROR; 1637 } 1638 if (strlcpy(r.overload_tblname, 1639 o->data.overload.tblname, 1640 PF_TABLE_NAME_SIZE) >= 1641 PF_TABLE_NAME_SIZE) { 1642 yyerror("state option: " 1643 "strlcpy"); 1644 YYERROR; 1645 } 1646 r.flush = o->data.overload.flush; 1647 break; 1648 case PF_STATE_OPT_MAX_SRC_CONN: 1649 if (r.max_src_conn) { 1650 yyerror("state option " 1651 "'max-src-conn' " 1652 "multiple definitions"); 1653 YYERROR; 1654 } 1655 if (o->data.max_src_conn == 0) { 1656 yyerror("'max-src-conn' " 1657 "must be > 0"); 1658 YYERROR; 1659 } 1660 r.max_src_conn = 1661 o->data.max_src_conn; 1662 r.rule_flag |= PFRULE_SRCTRACK | 1663 PFRULE_RULESRCTRACK; 1664 break; 1665 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1666 if (r.max_src_conn_rate.limit) { 1667 yyerror("state option " 1668 "'max-src-conn-rate' " 1669 "multiple definitions"); 1670 YYERROR; 1671 } 1672 if (!o->data.max_src_conn_rate.limit || 1673 !o->data.max_src_conn_rate.seconds) { 1674 yyerror("'max-src-conn-rate' " 1675 "values must be > 0"); 1676 YYERROR; 1677 } 1678 if (o->data.max_src_conn_rate.limit > 1679 PF_THRESHOLD_MAX) { 1680 yyerror("'max-src-conn-rate' " 1681 "maximum rate must be < %u", 1682 PF_THRESHOLD_MAX); 1683 YYERROR; 1684 } 1685 r.max_src_conn_rate.limit = 1686 o->data.max_src_conn_rate.limit; 1687 r.max_src_conn_rate.seconds = 1688 o->data.max_src_conn_rate.seconds; 1689 r.rule_flag |= PFRULE_SRCTRACK | 1690 PFRULE_RULESRCTRACK; 1691 break; 1692 case PF_STATE_OPT_MAX_SRC_NODES: 1693 if (r.max_src_nodes) { 1694 yyerror("state option " 1695 "'max-src-nodes' " 1696 "multiple definitions"); 1697 YYERROR; 1698 } 1699 if (o->data.max_src_nodes == 0) { 1700 yyerror("'max-src-nodes' must " 1701 "be > 0"); 1702 YYERROR; 1703 } 1704 r.max_src_nodes = 1705 o->data.max_src_nodes; 1706 r.rule_flag |= PFRULE_SRCTRACK | 1707 PFRULE_RULESRCTRACK; 1708 break; 1709 case PF_STATE_OPT_STATELOCK: 1710 if (statelock) { 1711 yyerror("state locking option: " 1712 "multiple definitions"); 1713 YYERROR; 1714 } 1715 statelock = 1; 1716 r.rule_flag |= o->data.statelock; 1717 break; 1718 case PF_STATE_OPT_TIMEOUT: 1719 if (o->data.timeout.number == 1720 PFTM_ADAPTIVE_START || 1721 o->data.timeout.number == 1722 PFTM_ADAPTIVE_END) 1723 adaptive = 1; 1724 if (r.timeout[o->data.timeout.number]) { 1725 yyerror("state timeout %s " 1726 "multiple definitions", 1727 pf_timeouts[o->data. 1728 timeout.number].name); 1729 YYERROR; 1730 } 1731 r.timeout[o->data.timeout.number] = 1732 o->data.timeout.seconds; 1733 } 1734 o = o->next; 1735 free(p); 1736 } 1737 if (!adaptive && r.max_states) { 1738 r.timeout[PFTM_ADAPTIVE_START] = 1739 (r.max_states / 10) * 6; 1740 r.timeout[PFTM_ADAPTIVE_END] = 1741 (r.max_states / 10) * 12; 1742 } 1743 if (r.rule_flag & PFRULE_SRCTRACK) { 1744 if (srctrack == PF_SRCTRACK_GLOBAL && 1745 r.max_src_nodes) { 1746 yyerror("'max-src-nodes' is " 1747 "incompatible with " 1748 "'source-track global'"); 1749 YYERROR; 1750 } 1751 if (srctrack == PF_SRCTRACK_GLOBAL && 1752 r.max_src_conn) { 1753 yyerror("'max-src-conn' is " 1754 "incompatible with " 1755 "'source-track global'"); 1756 YYERROR; 1757 } 1758 if (srctrack == PF_SRCTRACK_GLOBAL && 1759 r.max_src_conn_rate.seconds) { 1760 yyerror("'max-src-conn-rate' is " 1761 "incompatible with " 1762 "'source-track global'"); 1763 YYERROR; 1764 } 1765 if (r.timeout[PFTM_SRC_NODE] < 1766 r.max_src_conn_rate.seconds) 1767 r.timeout[PFTM_SRC_NODE] = 1768 r.max_src_conn_rate.seconds; 1769 r.rule_flag |= PFRULE_SRCTRACK; 1770 if (srctrack == PF_SRCTRACK_RULE) 1771 r.rule_flag |= PFRULE_RULESRCTRACK; 1772 } 1773 if (r.keep_state && !statelock) 1774 r.rule_flag |= default_statelock; 1775 1776 if ($9.fragment) 1777 r.rule_flag |= PFRULE_FRAGMENT; 1778 r.allow_opts = $9.allowopts; 1779 1780 decide_address_family($8.src.host, &r.af); 1781 decide_address_family($8.dst.host, &r.af); 1782 1783 if ($5.rt) { 1784 if (!r.direction) { 1785 yyerror("direction must be explicit " 1786 "with rules that specify routing"); 1787 YYERROR; 1788 } 1789 r.rt = $5.rt; 1790 r.rpool.opts = $5.pool_opts; 1791 if ($5.key != NULL) 1792 memcpy(&r.rpool.key, $5.key, 1793 sizeof(struct pf_poolhashkey)); 1794 } 1795 if (r.rt && r.rt != PF_FASTROUTE) { 1796 decide_address_family($5.host, &r.af); 1797 remove_invalid_hosts(&$5.host, &r.af); 1798 if ($5.host == NULL) { 1799 yyerror("no routing address with " 1800 "matching address family found."); 1801 YYERROR; 1802 } 1803 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1804 PF_POOL_NONE && ($5.host->next != NULL || 1805 $5.host->addr.type == PF_ADDR_TABLE || 1806 DYNIF_MULTIADDR($5.host->addr))) 1807 r.rpool.opts |= PF_POOL_ROUNDROBIN; 1808 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1809 PF_POOL_ROUNDROBIN && 1810 disallow_table($5.host, "tables are only " 1811 "supported in round-robin routing pools")) 1812 YYERROR; 1813 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1814 PF_POOL_ROUNDROBIN && 1815 disallow_alias($5.host, "interface (%s) " 1816 "is only supported in round-robin " 1817 "routing pools")) 1818 YYERROR; 1819 if ($5.host->next != NULL) { 1820 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1821 PF_POOL_ROUNDROBIN) { 1822 yyerror("r.rpool.opts must " 1823 "be PF_POOL_ROUNDROBIN"); 1824 YYERROR; 1825 } 1826 } 1827 } 1828 if ($9.queues.qname != NULL) { 1829 if (strlcpy(r.qname, $9.queues.qname, 1830 sizeof(r.qname)) >= sizeof(r.qname)) { 1831 yyerror("rule qname too long (max " 1832 "%d chars)", sizeof(r.qname)-1); 1833 YYERROR; 1834 } 1835 free($9.queues.qname); 1836 } 1837 if ($9.queues.pqname != NULL) { 1838 if (strlcpy(r.pqname, $9.queues.pqname, 1839 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1840 yyerror("rule pqname too long (max " 1841 "%d chars)", sizeof(r.pqname)-1); 1842 YYERROR; 1843 } 1844 free($9.queues.pqname); 1845 } 1846 1847 expand_rule(&r, $4, $5.host, $7, $8.src_os, 1848 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1849 $9.uid, $9.gid, $9.icmpspec, $9.match_tags, ""); 1850 } 1851 ; 1852 1853filter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1854 filter_opts_l 1855 { $$ = filter_opts; } 1856 | /* empty */ { 1857 bzero(&filter_opts, sizeof filter_opts); 1858 $$ = filter_opts; 1859 } 1860 ; 1861 1862filter_opts_l : filter_opts_l filter_opt 1863 | filter_opt 1864 ; 1865 1866filter_opt : USER uids { 1867 if (filter_opts.uid) 1868 $2->tail->next = filter_opts.uid; 1869 filter_opts.uid = $2; 1870 } 1871 | GROUP gids { 1872 if (filter_opts.gid) 1873 $2->tail->next = filter_opts.gid; 1874 filter_opts.gid = $2; 1875 } 1876 | flags { 1877 if (filter_opts.marker & FOM_FLAGS) { 1878 yyerror("flags cannot be redefined"); 1879 YYERROR; 1880 } 1881 filter_opts.marker |= FOM_FLAGS; 1882 filter_opts.flags.b1 |= $1.b1; 1883 filter_opts.flags.b2 |= $1.b2; 1884 filter_opts.flags.w |= $1.w; 1885 filter_opts.flags.w2 |= $1.w2; 1886 } 1887 | icmpspec { 1888 if (filter_opts.marker & FOM_ICMP) { 1889 yyerror("icmp-type cannot be redefined"); 1890 YYERROR; 1891 } 1892 filter_opts.marker |= FOM_ICMP; 1893 filter_opts.icmpspec = $1; 1894 } 1895 | tos { 1896 if (filter_opts.marker & FOM_TOS) { 1897 yyerror("tos cannot be redefined"); 1898 YYERROR; 1899 } 1900 filter_opts.marker |= FOM_TOS; 1901 filter_opts.tos = $1; 1902 } 1903 | keep { 1904 if (filter_opts.marker & FOM_KEEP) { 1905 yyerror("modulate or keep cannot be redefined"); 1906 YYERROR; 1907 } 1908 filter_opts.marker |= FOM_KEEP; 1909 filter_opts.keep.action = $1.action; 1910 filter_opts.keep.options = $1.options; 1911 } 1912 | FRAGMENT { 1913 filter_opts.fragment = 1; 1914 } 1915 | ALLOWOPTS { 1916 filter_opts.allowopts = 1; 1917 } 1918 | label { 1919 if (filter_opts.label) { 1920 yyerror("label cannot be redefined"); 1921 YYERROR; 1922 } 1923 filter_opts.label = $1; 1924 } 1925 | qname { 1926 if (filter_opts.queues.qname) { 1927 yyerror("queue cannot be redefined"); 1928 YYERROR; 1929 } 1930 filter_opts.queues = $1; 1931 } 1932 | TAG string { 1933 filter_opts.tag = $2; 1934 } 1935 | not matchtag { 1936 filter_opts.match_tags = $2; 1937 filter_opts.match_tag_not = $1; 1938 if ($1 && ($2 != $2->tail)) { 1939 yyerror("cannot negate tag list"); 1940 YYERROR; 1941 } 1942 } 1943 | PROBABILITY STRING { 1944 char *e; 1945 double p = strtod($2, &e); 1946 1947 if (*e == '%') { 1948 p *= 0.01; 1949 e++; 1950 } 1951 if (*e) { 1952 yyerror("invalid probability: %s", $2); 1953 free($2); 1954 YYERROR; 1955 } 1956 p = floor(p * (UINT_MAX+1.0) + 0.5); 1957 if (p < 1.0 || p >= (UINT_MAX+1.0)) { 1958 yyerror("invalid probability: %s", $2); 1959 free($2); 1960 YYERROR; 1961 } 1962 filter_opts.prob = (u_int32_t)p; 1963 free($2); 1964 } 1965 ; 1966 1967matchtag : TAGGED matchtag_item { 1968 $$ = $2; 1969 } 1970 | TAGGED '{' matchtag_list '}' { 1971 $$ = $3; 1972 } 1973 ; 1974 1975matchtag_list : matchtag_item { $$ = $1; } 1976 | matchtag_list comma matchtag_item { 1977 $1->tail->next = $3; 1978 $1->tail = $3; 1979 $$ = $1; 1980 } 1981 ; 1982 1983matchtag_item : STRING { 1984 $$ = calloc(1, sizeof (struct node_matchtag)); 1985 if ($$ == NULL) 1986 err(1, "matchtag_item: calloc"); 1987 if ((strlcpy($$->tagname,$1,PF_TAG_NAME_SIZE)) >= 1988 PF_TAG_NAME_SIZE) { 1989 yyerror("tag too long, max %u chars", 1990 PF_TAG_NAME_SIZE - 1); 1991 YYERROR; 1992 } 1993 free($1); 1994 $$->next = NULL; 1995 $$->tail = $$; 1996 } 1997 ; 1998 1999action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2000 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2001 ; 2002 2003blockspec : /* empty */ { 2004 $$.b2 = blockpolicy; 2005 $$.w = returnicmpdefault; 2006 $$.w2 = returnicmp6default; 2007 } 2008 | DROP { 2009 $$.b2 = PFRULE_DROP; 2010 $$.w = 0; 2011 $$.w2 = 0; 2012 } 2013 | RETURNRST { 2014 $$.b2 = PFRULE_RETURNRST; 2015 $$.w = 0; 2016 $$.w2 = 0; 2017 } 2018 | RETURNRST '(' TTL number ')' { 2019 if ($4 > 255) { 2020 yyerror("illegal ttl value %d", $4); 2021 YYERROR; 2022 } 2023 $$.b2 = PFRULE_RETURNRST; 2024 $$.w = $4; 2025 $$.w2 = 0; 2026 } 2027 | RETURNICMP { 2028 $$.b2 = PFRULE_RETURNICMP; 2029 $$.w = returnicmpdefault; 2030 $$.w2 = returnicmp6default; 2031 } 2032 | RETURNICMP6 { 2033 $$.b2 = PFRULE_RETURNICMP; 2034 $$.w = returnicmpdefault; 2035 $$.w2 = returnicmp6default; 2036 } 2037 | RETURNICMP '(' STRING ')' { 2038 $$.b2 = PFRULE_RETURNICMP; 2039 if (!($$.w = parseicmpspec($3, AF_INET))) { 2040 free($3); 2041 YYERROR; 2042 } 2043 free($3); 2044 $$.w2 = returnicmp6default; 2045 } 2046 | RETURNICMP6 '(' STRING ')' { 2047 $$.b2 = PFRULE_RETURNICMP; 2048 $$.w = returnicmpdefault; 2049 if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 2050 free($3); 2051 YYERROR; 2052 } 2053 free($3); 2054 } 2055 | RETURNICMP '(' STRING comma STRING ')' { 2056 $$.b2 = PFRULE_RETURNICMP; 2057 if (!($$.w = parseicmpspec($3, AF_INET)) || 2058 !($$.w2 = parseicmpspec($5, AF_INET6))) { 2059 free($3); 2060 free($5); 2061 YYERROR; 2062 } 2063 free($3); 2064 free($5); 2065 } 2066 | RETURN { 2067 $$.b2 = PFRULE_RETURN; 2068 $$.w = returnicmpdefault; 2069 $$.w2 = returnicmp6default; 2070 } 2071 ; 2072 2073dir : /* empty */ { $$ = 0; } 2074 | IN { $$ = PF_IN; } 2075 | OUT { $$ = PF_OUT; } 2076 ; 2077 2078logquick : /* empty */ { $$.log = 0; $$.quick = 0; } 2079 | log { $$.log = $1; $$.quick = 0; } 2080 | QUICK { $$.log = 0; $$.quick = 1; } 2081 | log QUICK { $$.log = $1; $$.quick = 1; } 2082 | QUICK log { $$.log = $2; $$.quick = 1; } 2083 ; 2084 2085log : LOG { $$ = PF_LOG; } 2086 | LOG '(' logopts ')' { $$ = PF_LOG | $3; } 2087 ; 2088 2089logopts : logopt { $$ = $1; } 2090 | logopts comma logopt { $$ = $1 | $3; } 2091 2092logopt : ALL { $$ = PF_LOG_ALL; } 2093 | USER { $$ = PF_LOG_SOCKET_LOOKUP; } 2094 | GROUP { $$ = PF_LOG_SOCKET_LOOKUP; } 2095 2096interface : /* empty */ { $$ = NULL; } 2097 | ON if_item_not { $$ = $2; } 2098 | ON '{' if_list '}' { $$ = $3; } 2099 ; 2100 2101if_list : if_item_not { $$ = $1; } 2102 | if_list comma if_item_not { 2103 $1->tail->next = $3; 2104 $1->tail = $3; 2105 $$ = $1; 2106 } 2107 ; 2108 2109if_item_not : not if_item { $$ = $2; $$->not = $1; } 2110 ; 2111 2112if_item : STRING { 2113 struct node_host *n; 2114 2115 $$ = calloc(1, sizeof(struct node_if)); 2116 if ($$ == NULL) 2117 err(1, "if_item: calloc"); 2118 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2119 sizeof($$->ifname)) { 2120 free($1); 2121 free($$); 2122 yyerror("interface name too long"); 2123 YYERROR; 2124 } 2125 2126 if ((n = ifa_exists($1)) != NULL) 2127 $$->ifa_flags = n->ifa_flags; 2128 2129 free($1); 2130 $$->not = 0; 2131 $$->next = NULL; 2132 $$->tail = $$; 2133 } 2134 ; 2135 2136af : /* empty */ { $$ = 0; } 2137 | INET { $$ = AF_INET; } 2138 | INET6 { $$ = AF_INET6; } 2139 ; 2140 2141proto : /* empty */ { $$ = NULL; } 2142 | PROTO proto_item { $$ = $2; } 2143 | PROTO '{' proto_list '}' { $$ = $3; } 2144 ; 2145 2146proto_list : proto_item { $$ = $1; } 2147 | proto_list comma proto_item { 2148 $1->tail->next = $3; 2149 $1->tail = $3; 2150 $$ = $1; 2151 } 2152 ; 2153 2154proto_item : STRING { 2155 u_int8_t pr; 2156 u_long ulval; 2157 2158 if (atoul($1, &ulval) == 0) { 2159 if (ulval > 255) { 2160 yyerror("protocol outside range"); 2161 free($1); 2162 YYERROR; 2163 } 2164 pr = (u_int8_t)ulval; 2165 } else { 2166 struct protoent *p; 2167 2168 p = getprotobyname($1); 2169 if (p == NULL) { 2170 yyerror("unknown protocol %s", $1); 2171 free($1); 2172 YYERROR; 2173 } 2174 pr = p->p_proto; 2175 } 2176 free($1); 2177 if (pr == 0) { 2178 yyerror("proto 0 cannot be used"); 2179 YYERROR; 2180 } 2181 $$ = calloc(1, sizeof(struct node_proto)); 2182 if ($$ == NULL) 2183 err(1, "proto_item: calloc"); 2184 $$->proto = pr; 2185 $$->next = NULL; 2186 $$->tail = $$; 2187 } 2188 ; 2189 2190fromto : ALL { 2191 $$.src.host = NULL; 2192 $$.src.port = NULL; 2193 $$.dst.host = NULL; 2194 $$.dst.port = NULL; 2195 $$.src_os = NULL; 2196 } 2197 | from os to { 2198 $$.src = $1; 2199 $$.src_os = $2; 2200 $$.dst = $3; 2201 } 2202 ; 2203 2204os : /* empty */ { $$ = NULL; } 2205 | OS xos { $$ = $2; } 2206 | OS '{' os_list '}' { $$ = $3; } 2207 ; 2208 2209xos : STRING { 2210 $$ = calloc(1, sizeof(struct node_os)); 2211 if ($$ == NULL) 2212 err(1, "os: calloc"); 2213 $$->os = $1; 2214 $$->tail = $$; 2215 } 2216 ; 2217 2218os_list : xos { $$ = $1; } 2219 | os_list comma xos { 2220 $1->tail->next = $3; 2221 $1->tail = $3; 2222 $$ = $1; 2223 } 2224 ; 2225 2226from : /* empty */ { 2227 $$.host = NULL; 2228 $$.port = NULL; 2229 } 2230 | FROM ipportspec { 2231 $$ = $2; 2232 } 2233 ; 2234 2235to : /* empty */ { 2236 $$.host = NULL; 2237 $$.port = NULL; 2238 } 2239 | TO ipportspec { 2240 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2241 "not permitted in a destination address")) 2242 YYERROR; 2243 $$ = $2; 2244 } 2245 ; 2246 2247ipportspec : ipspec { 2248 $$.host = $1; 2249 $$.port = NULL; 2250 } 2251 | ipspec PORT portspec { 2252 $$.host = $1; 2253 $$.port = $3; 2254 } 2255 | PORT portspec { 2256 $$.host = NULL; 2257 $$.port = $2; 2258 } 2259 ; 2260 2261ipspec : ANY { $$ = NULL; } 2262 | xhost { $$ = $1; } 2263 | '{' host_list '}' { $$ = $2; } 2264 ; 2265 2266host_list : ipspec { $$ = $1; } 2267 | host_list comma ipspec { 2268 if ($3 == NULL) 2269 $$ = $1; 2270 else if ($1 == NULL) 2271 $$ = $3; 2272 else { 2273 $1->tail->next = $3; 2274 $1->tail = $3->tail; 2275 $$ = $1; 2276 } 2277 } 2278 ; 2279 2280xhost : not host { 2281 struct node_host *n; 2282 2283 for (n = $2; n != NULL; n = n->next) 2284 n->not = $1; 2285 $$ = $2; 2286 } 2287 | not NOROUTE { 2288 $$ = calloc(1, sizeof(struct node_host)); 2289 if ($$ == NULL) 2290 err(1, "xhost: calloc"); 2291 $$->addr.type = PF_ADDR_NOROUTE; 2292 $$->next = NULL; 2293 $$->not = $1; 2294 $$->tail = $$; 2295 } 2296 | not URPFFAILED { 2297 $$ = calloc(1, sizeof(struct node_host)); 2298 if ($$ == NULL) 2299 err(1, "xhost: calloc"); 2300 $$->addr.type = PF_ADDR_URPFFAILED; 2301 $$->next = NULL; 2302 $$->not = $1; 2303 $$->tail = $$; 2304 } 2305 ; 2306 2307host : STRING { 2308 if (($$ = host($1)) == NULL) { 2309 /* error. "any" is handled elsewhere */ 2310 free($1); 2311 yyerror("could not parse host specification"); 2312 YYERROR; 2313 } 2314 free($1); 2315 2316 } 2317 | STRING '/' number { 2318 char *buf; 2319 2320 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2321 err(1, "host: asprintf"); 2322 free($1); 2323 if (($$ = host(buf)) == NULL) { 2324 /* error. "any" is handled elsewhere */ 2325 free(buf); 2326 yyerror("could not parse host specification"); 2327 YYERROR; 2328 } 2329 free(buf); 2330 } 2331 | dynaddr 2332 | dynaddr '/' number { 2333 struct node_host *n; 2334 2335 $$ = $1; 2336 for (n = $1; n != NULL; n = n->next) 2337 set_ipmask(n, $3); 2338 } 2339 | '<' STRING '>' { 2340 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2341 yyerror("table name '%s' too long", $2); 2342 free($2); 2343 YYERROR; 2344 } 2345 $$ = calloc(1, sizeof(struct node_host)); 2346 if ($$ == NULL) 2347 err(1, "host: calloc"); 2348 $$->addr.type = PF_ADDR_TABLE; 2349 if (strlcpy($$->addr.v.tblname, $2, 2350 sizeof($$->addr.v.tblname)) >= 2351 sizeof($$->addr.v.tblname)) 2352 errx(1, "host: strlcpy"); 2353 free($2); 2354 $$->next = NULL; 2355 $$->tail = $$; 2356 } 2357 | ROUTE STRING { 2358 $$ = calloc(1, sizeof(struct node_host)); 2359 if ($$ == NULL) { 2360 free($2); 2361 err(1, "host: calloc"); 2362 } 2363 $$->addr.type = PF_ADDR_RTLABEL; 2364 if (strlcpy($$->addr.v.rtlabelname, $2, 2365 sizeof($$->addr.v.rtlabelname)) >= 2366 sizeof($$->addr.v.rtlabelname)) { 2367 yyerror("route label too long, max %u chars", 2368 sizeof($$->addr.v.rtlabelname) - 1); 2369 free($2); 2370 free($$); 2371 YYERROR; 2372 } 2373 $$->next = NULL; 2374 $$->tail = $$; 2375 free($2); 2376 } 2377 ; 2378 2379number : STRING { 2380 u_long ulval; 2381 2382 if (atoul($1, &ulval) == -1) { 2383 yyerror("%s is not a number", $1); 2384 free($1); 2385 YYERROR; 2386 } else 2387 $$ = ulval; 2388 free($1); 2389 } 2390 ; 2391 2392dynaddr : '(' STRING ')' { 2393 int flags = 0; 2394 char *p, *op; 2395 2396 op = $2; 2397 if (!isalpha(op[0])) { 2398 yyerror("invalid interface name '%s'", op); 2399 free(op); 2400 YYERROR; 2401 } 2402 while ((p = strrchr($2, ':')) != NULL) { 2403 if (!strcmp(p+1, "network")) 2404 flags |= PFI_AFLAG_NETWORK; 2405 else if (!strcmp(p+1, "broadcast")) 2406 flags |= PFI_AFLAG_BROADCAST; 2407 else if (!strcmp(p+1, "peer")) 2408 flags |= PFI_AFLAG_PEER; 2409 else if (!strcmp(p+1, "0")) 2410 flags |= PFI_AFLAG_NOALIAS; 2411 else { 2412 yyerror("interface %s has bad modifier", 2413 $2); 2414 free(op); 2415 YYERROR; 2416 } 2417 *p = '\0'; 2418 } 2419 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2420 free(op); 2421 yyerror("illegal combination of " 2422 "interface modifiers"); 2423 YYERROR; 2424 } 2425 $$ = calloc(1, sizeof(struct node_host)); 2426 if ($$ == NULL) 2427 err(1, "address: calloc"); 2428 $$->af = 0; 2429 set_ipmask($$, 128); 2430 $$->addr.type = PF_ADDR_DYNIFTL; 2431 $$->addr.iflags = flags; 2432 if (strlcpy($$->addr.v.ifname, $2, 2433 sizeof($$->addr.v.ifname)) >= 2434 sizeof($$->addr.v.ifname)) { 2435 free(op); 2436 free($$); 2437 yyerror("interface name too long"); 2438 YYERROR; 2439 } 2440 free(op); 2441 $$->next = NULL; 2442 $$->tail = $$; 2443 } 2444 ; 2445 2446portspec : port_item { $$ = $1; } 2447 | '{' port_list '}' { $$ = $2; } 2448 ; 2449 2450port_list : port_item { $$ = $1; } 2451 | port_list comma port_item { 2452 $1->tail->next = $3; 2453 $1->tail = $3; 2454 $$ = $1; 2455 } 2456 ; 2457 2458port_item : port { 2459 $$ = calloc(1, sizeof(struct node_port)); 2460 if ($$ == NULL) 2461 err(1, "port_item: calloc"); 2462 $$->port[0] = $1.a; 2463 $$->port[1] = $1.b; 2464 if ($1.t) 2465 $$->op = PF_OP_RRG; 2466 else 2467 $$->op = PF_OP_EQ; 2468 $$->next = NULL; 2469 $$->tail = $$; 2470 } 2471 | unaryop port { 2472 if ($2.t) { 2473 yyerror("':' cannot be used with an other " 2474 "port operator"); 2475 YYERROR; 2476 } 2477 $$ = calloc(1, sizeof(struct node_port)); 2478 if ($$ == NULL) 2479 err(1, "port_item: calloc"); 2480 $$->port[0] = $2.a; 2481 $$->port[1] = $2.b; 2482 $$->op = $1; 2483 $$->next = NULL; 2484 $$->tail = $$; 2485 } 2486 | port PORTBINARY port { 2487 if ($1.t || $3.t) { 2488 yyerror("':' cannot be used with an other " 2489 "port operator"); 2490 YYERROR; 2491 } 2492 $$ = calloc(1, sizeof(struct node_port)); 2493 if ($$ == NULL) 2494 err(1, "port_item: calloc"); 2495 $$->port[0] = $1.a; 2496 $$->port[1] = $3.a; 2497 $$->op = $2; 2498 $$->next = NULL; 2499 $$->tail = $$; 2500 } 2501 ; 2502 2503port : STRING { 2504 char *p = strchr($1, ':'); 2505 2506 if (p == NULL) { 2507 if (($$.a = getservice($1)) == -1) { 2508 free($1); 2509 YYERROR; 2510 } 2511 $$.b = $$.t = 0; 2512 } else { 2513 int port[2]; 2514 2515 *p++ = 0; 2516 if ((port[0] = getservice($1)) == -1 || 2517 (port[1] = getservice(p)) == -1) { 2518 free($1); 2519 YYERROR; 2520 } 2521 $$.a = port[0]; 2522 $$.b = port[1]; 2523 $$.t = PF_OP_RRG; 2524 } 2525 free($1); 2526 } 2527 ; 2528 2529uids : uid_item { $$ = $1; } 2530 | '{' uid_list '}' { $$ = $2; } 2531 ; 2532 2533uid_list : uid_item { $$ = $1; } 2534 | uid_list comma uid_item { 2535 $1->tail->next = $3; 2536 $1->tail = $3; 2537 $$ = $1; 2538 } 2539 ; 2540 2541uid_item : uid { 2542 $$ = calloc(1, sizeof(struct node_uid)); 2543 if ($$ == NULL) 2544 err(1, "uid_item: calloc"); 2545 $$->uid[0] = $1; 2546 $$->uid[1] = $1; 2547 $$->op = PF_OP_EQ; 2548 $$->next = NULL; 2549 $$->tail = $$; 2550 } 2551 | unaryop uid { 2552 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2553 yyerror("user unknown requires operator = or " 2554 "!="); 2555 YYERROR; 2556 } 2557 $$ = calloc(1, sizeof(struct node_uid)); 2558 if ($$ == NULL) 2559 err(1, "uid_item: calloc"); 2560 $$->uid[0] = $2; 2561 $$->uid[1] = $2; 2562 $$->op = $1; 2563 $$->next = NULL; 2564 $$->tail = $$; 2565 } 2566 | uid PORTBINARY uid { 2567 if ($1 == UID_MAX || $3 == UID_MAX) { 2568 yyerror("user unknown requires operator = or " 2569 "!="); 2570 YYERROR; 2571 } 2572 $$ = calloc(1, sizeof(struct node_uid)); 2573 if ($$ == NULL) 2574 err(1, "uid_item: calloc"); 2575 $$->uid[0] = $1; 2576 $$->uid[1] = $3; 2577 $$->op = $2; 2578 $$->next = NULL; 2579 $$->tail = $$; 2580 } 2581 ; 2582 2583uid : STRING { 2584 u_long ulval; 2585 2586 if (atoul($1, &ulval) == -1) { 2587 if (!strcmp($1, "unknown")) 2588 $$ = UID_MAX; 2589 else { 2590 struct passwd *pw; 2591 2592 if ((pw = getpwnam($1)) == NULL) { 2593 yyerror("unknown user %s", $1); 2594 free($1); 2595 YYERROR; 2596 } 2597 $$ = pw->pw_uid; 2598 } 2599 } else { 2600 if (ulval >= UID_MAX) { 2601 free($1); 2602 yyerror("illegal uid value %lu", ulval); 2603 YYERROR; 2604 } 2605 $$ = ulval; 2606 } 2607 free($1); 2608 } 2609 ; 2610 2611gids : gid_item { $$ = $1; } 2612 | '{' gid_list '}' { $$ = $2; } 2613 ; 2614 2615gid_list : gid_item { $$ = $1; } 2616 | gid_list comma gid_item { 2617 $1->tail->next = $3; 2618 $1->tail = $3; 2619 $$ = $1; 2620 } 2621 ; 2622 2623gid_item : gid { 2624 $$ = calloc(1, sizeof(struct node_gid)); 2625 if ($$ == NULL) 2626 err(1, "gid_item: calloc"); 2627 $$->gid[0] = $1; 2628 $$->gid[1] = $1; 2629 $$->op = PF_OP_EQ; 2630 $$->next = NULL; 2631 $$->tail = $$; 2632 } 2633 | unaryop gid { 2634 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2635 yyerror("group unknown requires operator = or " 2636 "!="); 2637 YYERROR; 2638 } 2639 $$ = calloc(1, sizeof(struct node_gid)); 2640 if ($$ == NULL) 2641 err(1, "gid_item: calloc"); 2642 $$->gid[0] = $2; 2643 $$->gid[1] = $2; 2644 $$->op = $1; 2645 $$->next = NULL; 2646 $$->tail = $$; 2647 } 2648 | gid PORTBINARY gid { 2649 if ($1 == GID_MAX || $3 == GID_MAX) { 2650 yyerror("group unknown requires operator = or " 2651 "!="); 2652 YYERROR; 2653 } 2654 $$ = calloc(1, sizeof(struct node_gid)); 2655 if ($$ == NULL) 2656 err(1, "gid_item: calloc"); 2657 $$->gid[0] = $1; 2658 $$->gid[1] = $3; 2659 $$->op = $2; 2660 $$->next = NULL; 2661 $$->tail = $$; 2662 } 2663 ; 2664 2665gid : STRING { 2666 u_long ulval; 2667 2668 if (atoul($1, &ulval) == -1) { 2669 if (!strcmp($1, "unknown")) 2670 $$ = GID_MAX; 2671 else { 2672 struct group *grp; 2673 2674 if ((grp = getgrnam($1)) == NULL) { 2675 yyerror("unknown group %s", $1); 2676 free($1); 2677 YYERROR; 2678 } 2679 $$ = grp->gr_gid; 2680 } 2681 } else { 2682 if (ulval >= GID_MAX) { 2683 yyerror("illegal gid value %lu", ulval); 2684 free($1); 2685 YYERROR; 2686 } 2687 $$ = ulval; 2688 } 2689 free($1); 2690 } 2691 ; 2692 2693flag : STRING { 2694 int f; 2695 2696 if ((f = parse_flags($1)) < 0) { 2697 yyerror("bad flags %s", $1); 2698 free($1); 2699 YYERROR; 2700 } 2701 free($1); 2702 $$.b1 = f; 2703 } 2704 ; 2705 2706flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2707 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2708 ; 2709 2710icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2711 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2712 | ICMP6TYPE icmp6_item { $$ = $2; } 2713 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2714 ; 2715 2716icmp_list : icmp_item { $$ = $1; } 2717 | icmp_list comma icmp_item { 2718 $1->tail->next = $3; 2719 $1->tail = $3; 2720 $$ = $1; 2721 } 2722 ; 2723 2724icmp6_list : icmp6_item { $$ = $1; } 2725 | icmp6_list comma icmp6_item { 2726 $1->tail->next = $3; 2727 $1->tail = $3; 2728 $$ = $1; 2729 } 2730 ; 2731 2732icmp_item : icmptype { 2733 $$ = calloc(1, sizeof(struct node_icmp)); 2734 if ($$ == NULL) 2735 err(1, "icmp_item: calloc"); 2736 $$->type = $1; 2737 $$->code = 0; 2738 $$->proto = IPPROTO_ICMP; 2739 $$->next = NULL; 2740 $$->tail = $$; 2741 } 2742 | icmptype CODE STRING { 2743 const struct icmpcodeent *p; 2744 u_long ulval; 2745 2746 if (atoul($3, &ulval) == 0) { 2747 if (ulval > 255) { 2748 free($3); 2749 yyerror("illegal icmp-code %lu", ulval); 2750 YYERROR; 2751 } 2752 } else { 2753 if ((p = geticmpcodebyname($1-1, $3, 2754 AF_INET)) == NULL) { 2755 yyerror("unknown icmp-code %s", $3); 2756 free($3); 2757 YYERROR; 2758 } 2759 ulval = p->code; 2760 } 2761 free($3); 2762 $$ = calloc(1, sizeof(struct node_icmp)); 2763 if ($$ == NULL) 2764 err(1, "icmp_item: calloc"); 2765 $$->type = $1; 2766 $$->code = ulval + 1; 2767 $$->proto = IPPROTO_ICMP; 2768 $$->next = NULL; 2769 $$->tail = $$; 2770 } 2771 ; 2772 2773icmp6_item : icmp6type { 2774 $$ = calloc(1, sizeof(struct node_icmp)); 2775 if ($$ == NULL) 2776 err(1, "icmp_item: calloc"); 2777 $$->type = $1; 2778 $$->code = 0; 2779 $$->proto = IPPROTO_ICMPV6; 2780 $$->next = NULL; 2781 $$->tail = $$; 2782 } 2783 | icmp6type CODE STRING { 2784 const struct icmpcodeent *p; 2785 u_long ulval; 2786 2787 if (atoul($3, &ulval) == 0) { 2788 if (ulval > 255) { 2789 yyerror("illegal icmp6-code %lu", 2790 ulval); 2791 free($3); 2792 YYERROR; 2793 } 2794 } else { 2795 if ((p = geticmpcodebyname($1-1, $3, 2796 AF_INET6)) == NULL) { 2797 yyerror("unknown icmp6-code %s", $3); 2798 free($3); 2799 YYERROR; 2800 } 2801 ulval = p->code; 2802 } 2803 free($3); 2804 $$ = calloc(1, sizeof(struct node_icmp)); 2805 if ($$ == NULL) 2806 err(1, "icmp_item: calloc"); 2807 $$->type = $1; 2808 $$->code = ulval + 1; 2809 $$->proto = IPPROTO_ICMPV6; 2810 $$->next = NULL; 2811 $$->tail = $$; 2812 } 2813 ; 2814 2815icmptype : STRING { 2816 const struct icmptypeent *p; 2817 u_long ulval; 2818 2819 if (atoul($1, &ulval) == 0) { 2820 if (ulval > 255) { 2821 yyerror("illegal icmp-type %lu", ulval); 2822 free($1); 2823 YYERROR; 2824 } 2825 $$ = ulval + 1; 2826 } else { 2827 if ((p = geticmptypebyname($1, AF_INET)) == 2828 NULL) { 2829 yyerror("unknown icmp-type %s", $1); 2830 free($1); 2831 YYERROR; 2832 } 2833 $$ = p->type + 1; 2834 } 2835 free($1); 2836 } 2837 ; 2838 2839icmp6type : STRING { 2840 const struct icmptypeent *p; 2841 u_long ulval; 2842 2843 if (atoul($1, &ulval) == 0) { 2844 if (ulval > 255) { 2845 yyerror("illegal icmp6-type %lu", 2846 ulval); 2847 free($1); 2848 YYERROR; 2849 } 2850 $$ = ulval + 1; 2851 } else { 2852 if ((p = geticmptypebyname($1, AF_INET6)) == 2853 NULL) { 2854 yyerror("unknown icmp6-type %s", $1); 2855 free($1); 2856 YYERROR; 2857 } 2858 $$ = p->type + 1; 2859 } 2860 free($1); 2861 } 2862 ; 2863 2864tos : TOS STRING { 2865 if (!strcmp($2, "lowdelay")) 2866 $$ = IPTOS_LOWDELAY; 2867 else if (!strcmp($2, "throughput")) 2868 $$ = IPTOS_THROUGHPUT; 2869 else if (!strcmp($2, "reliability")) 2870 $$ = IPTOS_RELIABILITY; 2871 else if ($2[0] == '0' && $2[1] == 'x') 2872 $$ = strtoul($2, NULL, 16); 2873 else 2874 $$ = strtoul($2, NULL, 10); 2875 if (!$$ || $$ > 255) { 2876 yyerror("illegal tos value %s", $2); 2877 free($2); 2878 YYERROR; 2879 } 2880 free($2); 2881 } 2882 ; 2883 2884sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 2885 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 2886 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 2887 ; 2888 2889statelock : IFBOUND { 2890 $$ = PFRULE_IFBOUND; 2891 } 2892 | FLOATING { 2893 $$ = 0; 2894 } 2895 ; 2896 2897keep : KEEP STATE state_opt_spec { 2898 $$.action = PF_STATE_NORMAL; 2899 $$.options = $3; 2900 } 2901 | MODULATE STATE state_opt_spec { 2902 $$.action = PF_STATE_MODULATE; 2903 $$.options = $3; 2904 } 2905 | SYNPROXY STATE state_opt_spec { 2906 $$.action = PF_STATE_SYNPROXY; 2907 $$.options = $3; 2908 } 2909 ; 2910 2911flush : /* empty */ { $$ = 0; } 2912 | FLUSH { $$ = PF_FLUSH; } 2913 | FLUSH GLOBAL { 2914 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 2915 } 2916 ; 2917 2918state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2919 | /* empty */ { $$ = NULL; } 2920 ; 2921 2922state_opt_list : state_opt_item { $$ = $1; } 2923 | state_opt_list comma state_opt_item { 2924 $1->tail->next = $3; 2925 $1->tail = $3; 2926 $$ = $1; 2927 } 2928 ; 2929 2930state_opt_item : MAXIMUM number { 2931 $$ = calloc(1, sizeof(struct node_state_opt)); 2932 if ($$ == NULL) 2933 err(1, "state_opt_item: calloc"); 2934 $$->type = PF_STATE_OPT_MAX; 2935 $$->data.max_states = $2; 2936 $$->next = NULL; 2937 $$->tail = $$; 2938 } 2939 | NOSYNC { 2940 $$ = calloc(1, sizeof(struct node_state_opt)); 2941 if ($$ == NULL) 2942 err(1, "state_opt_item: calloc"); 2943 $$->type = PF_STATE_OPT_NOSYNC; 2944 $$->next = NULL; 2945 $$->tail = $$; 2946 } 2947 | MAXSRCSTATES number { 2948 $$ = calloc(1, sizeof(struct node_state_opt)); 2949 if ($$ == NULL) 2950 err(1, "state_opt_item: calloc"); 2951 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 2952 $$->data.max_src_states = $2; 2953 $$->next = NULL; 2954 $$->tail = $$; 2955 } 2956 | MAXSRCCONN number { 2957 $$ = calloc(1, sizeof(struct node_state_opt)); 2958 if ($$ == NULL) 2959 err(1, "state_opt_item: calloc"); 2960 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 2961 $$->data.max_src_conn = $2; 2962 $$->next = NULL; 2963 $$->tail = $$; 2964 } 2965 | MAXSRCCONNRATE number '/' number { 2966 $$ = calloc(1, sizeof(struct node_state_opt)); 2967 if ($$ == NULL) 2968 err(1, "state_opt_item: calloc"); 2969 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 2970 $$->data.max_src_conn_rate.limit = $2; 2971 $$->data.max_src_conn_rate.seconds = $4; 2972 $$->next = NULL; 2973 $$->tail = $$; 2974 } 2975 | OVERLOAD '<' STRING '>' flush { 2976 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 2977 yyerror("table name '%s' too long", $3); 2978 free($3); 2979 YYERROR; 2980 } 2981 $$ = calloc(1, sizeof(struct node_state_opt)); 2982 if ($$ == NULL) 2983 err(1, "state_opt_item: calloc"); 2984 if (strlcpy($$->data.overload.tblname, $3, 2985 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 2986 errx(1, "state_opt_item: strlcpy"); 2987 free($3); 2988 $$->type = PF_STATE_OPT_OVERLOAD; 2989 $$->data.overload.flush = $5; 2990 $$->next = NULL; 2991 $$->tail = $$; 2992 } 2993 | MAXSRCNODES number { 2994 $$ = calloc(1, sizeof(struct node_state_opt)); 2995 if ($$ == NULL) 2996 err(1, "state_opt_item: calloc"); 2997 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 2998 $$->data.max_src_nodes = $2; 2999 $$->next = NULL; 3000 $$->tail = $$; 3001 } 3002 | sourcetrack { 3003 $$ = calloc(1, sizeof(struct node_state_opt)); 3004 if ($$ == NULL) 3005 err(1, "state_opt_item: calloc"); 3006 $$->type = PF_STATE_OPT_SRCTRACK; 3007 $$->data.src_track = $1; 3008 $$->next = NULL; 3009 $$->tail = $$; 3010 } 3011 | statelock { 3012 $$ = calloc(1, sizeof(struct node_state_opt)); 3013 if ($$ == NULL) 3014 err(1, "state_opt_item: calloc"); 3015 $$->type = PF_STATE_OPT_STATELOCK; 3016 $$->data.statelock = $1; 3017 $$->next = NULL; 3018 $$->tail = $$; 3019 } 3020 | STRING number { 3021 int i; 3022 3023 for (i = 0; pf_timeouts[i].name && 3024 strcmp(pf_timeouts[i].name, $1); ++i) 3025 ; /* nothing */ 3026 if (!pf_timeouts[i].name) { 3027 yyerror("illegal timeout name %s", $1); 3028 free($1); 3029 YYERROR; 3030 } 3031 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3032 yyerror("illegal state timeout %s", $1); 3033 free($1); 3034 YYERROR; 3035 } 3036 free($1); 3037 $$ = calloc(1, sizeof(struct node_state_opt)); 3038 if ($$ == NULL) 3039 err(1, "state_opt_item: calloc"); 3040 $$->type = PF_STATE_OPT_TIMEOUT; 3041 $$->data.timeout.number = pf_timeouts[i].timeout; 3042 $$->data.timeout.seconds = $2; 3043 $$->next = NULL; 3044 $$->tail = $$; 3045 } 3046 ; 3047 3048label : LABEL STRING { 3049 $$ = $2; 3050 } 3051 ; 3052 3053qname : QUEUE STRING { 3054 $$.qname = $2; 3055 } 3056 | QUEUE '(' STRING ')' { 3057 $$.qname = $3; 3058 } 3059 | QUEUE '(' STRING comma STRING ')' { 3060 $$.qname = $3; 3061 $$.pqname = $5; 3062 } 3063 ; 3064 3065no : /* empty */ { $$ = 0; } 3066 | NO { $$ = 1; } 3067 ; 3068 3069rport : STRING { 3070 char *p = strchr($1, ':'); 3071 3072 if (p == NULL) { 3073 if (($$.a = getservice($1)) == -1) { 3074 free($1); 3075 YYERROR; 3076 } 3077 $$.b = $$.t = 0; 3078 } else if (!strcmp(p+1, "*")) { 3079 *p = 0; 3080 if (($$.a = getservice($1)) == -1) { 3081 free($1); 3082 YYERROR; 3083 } 3084 $$.b = 0; 3085 $$.t = 1; 3086 } else { 3087 *p++ = 0; 3088 if (($$.a = getservice($1)) == -1 || 3089 ($$.b = getservice(p)) == -1) { 3090 free($1); 3091 YYERROR; 3092 } 3093 if ($$.a == $$.b) 3094 $$.b = 0; 3095 $$.t = 0; 3096 } 3097 free($1); 3098 } 3099 ; 3100 3101redirspec : host { $$ = $1; } 3102 | '{' redir_host_list '}' { $$ = $2; } 3103 ; 3104 3105redir_host_list : host { $$ = $1; } 3106 | redir_host_list comma host { 3107 $1->tail->next = $3; 3108 $1->tail = $3->tail; 3109 $$ = $1; 3110 } 3111 ; 3112 3113redirpool : /* empty */ { $$ = NULL; } 3114 | ARROW redirspec { 3115 $$ = calloc(1, sizeof(struct redirection)); 3116 if ($$ == NULL) 3117 err(1, "redirection: calloc"); 3118 $$->host = $2; 3119 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3120 } 3121 | ARROW redirspec PORT rport { 3122 $$ = calloc(1, sizeof(struct redirection)); 3123 if ($$ == NULL) 3124 err(1, "redirection: calloc"); 3125 $$->host = $2; 3126 $$->rport = $4; 3127 } 3128 ; 3129 3130hashkey : /* empty */ 3131 { 3132 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3133 if ($$ == NULL) 3134 err(1, "hashkey: calloc"); 3135 $$->key32[0] = arc4random(); 3136 $$->key32[1] = arc4random(); 3137 $$->key32[2] = arc4random(); 3138 $$->key32[3] = arc4random(); 3139 } 3140 | string 3141 { 3142 if (!strncmp($1, "0x", 2)) { 3143 if (strlen($1) != 34) { 3144 free($1); 3145 yyerror("hex key must be 128 bits " 3146 "(32 hex digits) long"); 3147 YYERROR; 3148 } 3149 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3150 if ($$ == NULL) 3151 err(1, "hashkey: calloc"); 3152 3153 if (sscanf($1, "0x%8x%8x%8x%8x", 3154 &$$->key32[0], &$$->key32[1], 3155 &$$->key32[2], &$$->key32[3]) != 4) { 3156 free($$); 3157 free($1); 3158 yyerror("invalid hex key"); 3159 YYERROR; 3160 } 3161 } else { 3162 MD5_CTX context; 3163 3164 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3165 if ($$ == NULL) 3166 err(1, "hashkey: calloc"); 3167 MD5Init(&context); 3168 MD5Update(&context, (unsigned char *)$1, 3169 strlen($1)); 3170 MD5Final((unsigned char *)$$, &context); 3171 HTONL($$->key32[0]); 3172 HTONL($$->key32[1]); 3173 HTONL($$->key32[2]); 3174 HTONL($$->key32[3]); 3175 } 3176 free($1); 3177 } 3178 ; 3179 3180pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3181 pool_opts_l 3182 { $$ = pool_opts; } 3183 | /* empty */ { 3184 bzero(&pool_opts, sizeof pool_opts); 3185 $$ = pool_opts; 3186 } 3187 ; 3188 3189pool_opts_l : pool_opts_l pool_opt 3190 | pool_opt 3191 ; 3192 3193pool_opt : BITMASK { 3194 if (pool_opts.type) { 3195 yyerror("pool type cannot be redefined"); 3196 YYERROR; 3197 } 3198 pool_opts.type = PF_POOL_BITMASK; 3199 } 3200 | RANDOM { 3201 if (pool_opts.type) { 3202 yyerror("pool type cannot be redefined"); 3203 YYERROR; 3204 } 3205 pool_opts.type = PF_POOL_RANDOM; 3206 } 3207 | SOURCEHASH hashkey { 3208 if (pool_opts.type) { 3209 yyerror("pool type cannot be redefined"); 3210 YYERROR; 3211 } 3212 pool_opts.type = PF_POOL_SRCHASH; 3213 pool_opts.key = $2; 3214 } 3215 | ROUNDROBIN { 3216 if (pool_opts.type) { 3217 yyerror("pool type cannot be redefined"); 3218 YYERROR; 3219 } 3220 pool_opts.type = PF_POOL_ROUNDROBIN; 3221 } 3222 | STATICPORT { 3223 if (pool_opts.staticport) { 3224 yyerror("static-port cannot be redefined"); 3225 YYERROR; 3226 } 3227 pool_opts.staticport = 1; 3228 } 3229 | STICKYADDRESS { 3230 if (filter_opts.marker & POM_STICKYADDRESS) { 3231 yyerror("sticky-address cannot be redefined"); 3232 YYERROR; 3233 } 3234 pool_opts.marker |= POM_STICKYADDRESS; 3235 pool_opts.opts |= PF_POOL_STICKYADDR; 3236 } 3237 ; 3238 3239redirection : /* empty */ { $$ = NULL; } 3240 | ARROW host { 3241 $$ = calloc(1, sizeof(struct redirection)); 3242 if ($$ == NULL) 3243 err(1, "redirection: calloc"); 3244 $$->host = $2; 3245 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3246 } 3247 | ARROW host PORT rport { 3248 $$ = calloc(1, sizeof(struct redirection)); 3249 if ($$ == NULL) 3250 err(1, "redirection: calloc"); 3251 $$->host = $2; 3252 $$->rport = $4; 3253 } 3254 ; 3255 3256natpass : /* empty */ { $$.b1 = $$.b2 = 0; } 3257 | PASS { $$.b1 = 1; $$.b2 = 0; } 3258 | PASS log { $$.b1 = 1; $$.b2 = $2; } 3259 ; 3260 3261nataction : no NAT natpass { 3262 if ($1 && $3.b1) { 3263 yyerror("\"pass\" not valid with \"no\""); 3264 YYERROR; 3265 } 3266 if ($1) 3267 $$.b1 = PF_NONAT; 3268 else 3269 $$.b1 = PF_NAT; 3270 $$.b2 = $3.b1; 3271 $$.w = $3.b2; 3272 } 3273 | no RDR natpass { 3274 if ($1 && $3.b1) { 3275 yyerror("\"pass\" not valid with \"no\""); 3276 YYERROR; 3277 } 3278 if ($1) 3279 $$.b1 = PF_NORDR; 3280 else 3281 $$.b1 = PF_RDR; 3282 $$.b2 = $3.b1; 3283 $$.w = $3.b2; 3284 } 3285 ; 3286 3287natrule : nataction interface af proto fromto tag tagged redirpool pool_opts 3288 { 3289 struct pf_rule r; 3290 3291 if (check_rulestate(PFCTL_STATE_NAT)) 3292 YYERROR; 3293 3294 memset(&r, 0, sizeof(r)); 3295 3296 r.action = $1.b1; 3297 r.natpass = $1.b2; 3298 r.log = $1.w; 3299 r.af = $3; 3300 3301 if (!r.af) { 3302 if ($5.src.host && $5.src.host->af && 3303 !$5.src.host->ifindex) 3304 r.af = $5.src.host->af; 3305 else if ($5.dst.host && $5.dst.host->af && 3306 !$5.dst.host->ifindex) 3307 r.af = $5.dst.host->af; 3308 } 3309 3310 if ($6 != NULL) 3311 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3312 PF_TAG_NAME_SIZE) { 3313 yyerror("tag too long, max %u chars", 3314 PF_TAG_NAME_SIZE - 1); 3315 YYERROR; 3316 } 3317 3318 if ($7.name) 3319 if (strlcpy(r.match_tagname, $7.name, 3320 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3321 yyerror("tag too long, max %u chars", 3322 PF_TAG_NAME_SIZE - 1); 3323 YYERROR; 3324 } 3325 r.match_tag_not = $7.neg; 3326 3327 if (r.action == PF_NONAT || r.action == PF_NORDR) { 3328 if ($8 != NULL) { 3329 yyerror("translation rule with 'no' " 3330 "does not need '->'"); 3331 YYERROR; 3332 } 3333 } else { 3334 if ($8 == NULL || $8->host == NULL) { 3335 yyerror("translation rule requires '-> " 3336 "address'"); 3337 YYERROR; 3338 } 3339 if (!r.af && ! $8->host->ifindex) 3340 r.af = $8->host->af; 3341 3342 remove_invalid_hosts(&$8->host, &r.af); 3343 if (invalid_redirect($8->host, r.af)) 3344 YYERROR; 3345 if (check_netmask($8->host, r.af)) 3346 YYERROR; 3347 3348 r.rpool.proxy_port[0] = ntohs($8->rport.a); 3349 3350 switch (r.action) { 3351 case PF_RDR: 3352 if (!$8->rport.b && $8->rport.t && 3353 $5.dst.port != NULL) { 3354 r.rpool.proxy_port[1] = 3355 ntohs($8->rport.a) + 3356 (ntohs( 3357 $5.dst.port->port[1]) - 3358 ntohs( 3359 $5.dst.port->port[0])); 3360 } else 3361 r.rpool.proxy_port[1] = 3362 ntohs($8->rport.b); 3363 break; 3364 case PF_NAT: 3365 r.rpool.proxy_port[1] = 3366 ntohs($8->rport.b); 3367 if (!r.rpool.proxy_port[0] && 3368 !r.rpool.proxy_port[1]) { 3369 r.rpool.proxy_port[0] = 3370 PF_NAT_PROXY_PORT_LOW; 3371 r.rpool.proxy_port[1] = 3372 PF_NAT_PROXY_PORT_HIGH; 3373 } else if (!r.rpool.proxy_port[1]) 3374 r.rpool.proxy_port[1] = 3375 r.rpool.proxy_port[0]; 3376 break; 3377 default: 3378 break; 3379 } 3380 3381 r.rpool.opts = $9.type; 3382 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3383 PF_POOL_NONE && ($8->host->next != NULL || 3384 $8->host->addr.type == PF_ADDR_TABLE || 3385 DYNIF_MULTIADDR($8->host->addr))) 3386 r.rpool.opts = PF_POOL_ROUNDROBIN; 3387 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3388 PF_POOL_ROUNDROBIN && 3389 disallow_table($8->host, "tables are only " 3390 "supported in round-robin redirection " 3391 "pools")) 3392 YYERROR; 3393 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3394 PF_POOL_ROUNDROBIN && 3395 disallow_alias($8->host, "interface (%s) " 3396 "is only supported in round-robin " 3397 "redirection pools")) 3398 YYERROR; 3399 if ($8->host->next != NULL) { 3400 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3401 PF_POOL_ROUNDROBIN) { 3402 yyerror("only round-robin " 3403 "valid for multiple " 3404 "redirection addresses"); 3405 YYERROR; 3406 } 3407 } 3408 } 3409 3410 if ($9.key != NULL) 3411 memcpy(&r.rpool.key, $9.key, 3412 sizeof(struct pf_poolhashkey)); 3413 3414 if ($9.opts) 3415 r.rpool.opts |= $9.opts; 3416 3417 if ($9.staticport) { 3418 if (r.action != PF_NAT) { 3419 yyerror("the 'static-port' option is " 3420 "only valid with nat rules"); 3421 YYERROR; 3422 } 3423 if (r.rpool.proxy_port[0] != 3424 PF_NAT_PROXY_PORT_LOW && 3425 r.rpool.proxy_port[1] != 3426 PF_NAT_PROXY_PORT_HIGH) { 3427 yyerror("the 'static-port' option can't" 3428 " be used when specifying a port" 3429 " range"); 3430 YYERROR; 3431 } 3432 r.rpool.proxy_port[0] = 0; 3433 r.rpool.proxy_port[1] = 0; 3434 } 3435 3436 expand_rule(&r, $2, $8 == NULL ? NULL : $8->host, $4, 3437 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3438 $5.dst.port, 0, 0, 0, 0, ""); 3439 free($8); 3440 } 3441 ; 3442 3443binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag tagged 3444 redirection 3445 { 3446 struct pf_rule binat; 3447 struct pf_pooladdr *pa; 3448 3449 if (check_rulestate(PFCTL_STATE_NAT)) 3450 YYERROR; 3451 if (disallow_urpf_failed($10, "\"urpf-failed\" is not " 3452 "permitted as a binat destination")) 3453 YYERROR; 3454 3455 memset(&binat, 0, sizeof(binat)); 3456 3457 if ($1 && $3.b1) { 3458 yyerror("\"pass\" not valid with \"no\""); 3459 YYERROR; 3460 } 3461 if ($1) 3462 binat.action = PF_NOBINAT; 3463 else 3464 binat.action = PF_BINAT; 3465 binat.natpass = $3.b1; 3466 binat.log = $3.b2; 3467 binat.af = $5; 3468 if (!binat.af && $8 != NULL && $8->af) 3469 binat.af = $8->af; 3470 if (!binat.af && $10 != NULL && $10->af) 3471 binat.af = $10->af; 3472 3473 if (!binat.af && $13 != NULL && $13->host) 3474 binat.af = $13->host->af; 3475 if (!binat.af) { 3476 yyerror("address family (inet/inet6) " 3477 "undefined"); 3478 YYERROR; 3479 } 3480 3481 if ($4 != NULL) { 3482 memcpy(binat.ifname, $4->ifname, 3483 sizeof(binat.ifname)); 3484 binat.ifnot = $4->not; 3485 free($4); 3486 } 3487 3488 if ($11 != NULL) 3489 if (strlcpy(binat.tagname, $11, 3490 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3491 yyerror("tag too long, max %u chars", 3492 PF_TAG_NAME_SIZE - 1); 3493 YYERROR; 3494 } 3495 if ($12.name) 3496 if (strlcpy(binat.match_tagname, $12.name, 3497 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3498 yyerror("tag too long, max %u chars", 3499 PF_TAG_NAME_SIZE - 1); 3500 YYERROR; 3501 } 3502 binat.match_tag_not = $12.neg; 3503 3504 if ($6 != NULL) { 3505 binat.proto = $6->proto; 3506 free($6); 3507 } 3508 3509 if ($8 != NULL && disallow_table($8, "invalid use of " 3510 "table <%s> as the source address of a binat rule")) 3511 YYERROR; 3512 if ($8 != NULL && disallow_alias($8, "invalid use of " 3513 "interface (%s) as the source address of a binat " 3514 "rule")) 3515 YYERROR; 3516 if ($13 != NULL && $13->host != NULL && disallow_table( 3517 $13->host, "invalid use of table <%s> as the " 3518 "redirect address of a binat rule")) 3519 YYERROR; 3520 if ($13 != NULL && $13->host != NULL && disallow_alias( 3521 $13->host, "invalid use of interface (%s) as the " 3522 "redirect address of a binat rule")) 3523 YYERROR; 3524 3525 if ($8 != NULL) { 3526 if ($8->next) { 3527 yyerror("multiple binat ip addresses"); 3528 YYERROR; 3529 } 3530 if ($8->addr.type == PF_ADDR_DYNIFTL) 3531 $8->af = binat.af; 3532 if ($8->af != binat.af) { 3533 yyerror("binat ip versions must match"); 3534 YYERROR; 3535 } 3536 if (check_netmask($8, binat.af)) 3537 YYERROR; 3538 memcpy(&binat.src.addr, &$8->addr, 3539 sizeof(binat.src.addr)); 3540 free($8); 3541 } 3542 if ($10 != NULL) { 3543 if ($10->next) { 3544 yyerror("multiple binat ip addresses"); 3545 YYERROR; 3546 } 3547 if ($10->af != binat.af && $10->af) { 3548 yyerror("binat ip versions must match"); 3549 YYERROR; 3550 } 3551 if (check_netmask($10, binat.af)) 3552 YYERROR; 3553 memcpy(&binat.dst.addr, &$10->addr, 3554 sizeof(binat.dst.addr)); 3555 binat.dst.neg = $10->not; 3556 free($10); 3557 } 3558 3559 if (binat.action == PF_NOBINAT) { 3560 if ($13 != NULL) { 3561 yyerror("'no binat' rule does not need" 3562 " '->'"); 3563 YYERROR; 3564 } 3565 } else { 3566 if ($13 == NULL || $13->host == NULL) { 3567 yyerror("'binat' rule requires" 3568 " '-> address'"); 3569 YYERROR; 3570 } 3571 3572 remove_invalid_hosts(&$13->host, &binat.af); 3573 if (invalid_redirect($13->host, binat.af)) 3574 YYERROR; 3575 if ($13->host->next != NULL) { 3576 yyerror("binat rule must redirect to " 3577 "a single address"); 3578 YYERROR; 3579 } 3580 if (check_netmask($13->host, binat.af)) 3581 YYERROR; 3582 3583 if (!PF_AZERO(&binat.src.addr.v.a.mask, 3584 binat.af) && 3585 !PF_AEQ(&binat.src.addr.v.a.mask, 3586 &$13->host->addr.v.a.mask, binat.af)) { 3587 yyerror("'binat' source mask and " 3588 "redirect mask must be the same"); 3589 YYERROR; 3590 } 3591 3592 TAILQ_INIT(&binat.rpool.list); 3593 pa = calloc(1, sizeof(struct pf_pooladdr)); 3594 if (pa == NULL) 3595 err(1, "binat: calloc"); 3596 pa->addr = $13->host->addr; 3597 pa->ifname[0] = 0; 3598 TAILQ_INSERT_TAIL(&binat.rpool.list, 3599 pa, entries); 3600 3601 free($13); 3602 } 3603 3604 pfctl_add_rule(pf, &binat, ""); 3605 } 3606 ; 3607 3608tag : /* empty */ { $$ = NULL; } 3609 | TAG STRING { $$ = $2; } 3610 ; 3611 3612tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 3613 | not TAGGED string { $$.neg = $1; $$.name = $3; } 3614 ; 3615 3616route_host : STRING { 3617 $$ = calloc(1, sizeof(struct node_host)); 3618 if ($$ == NULL) 3619 err(1, "route_host: calloc"); 3620 $$->ifname = $1; 3621 set_ipmask($$, 128); 3622 $$->next = NULL; 3623 $$->tail = $$; 3624 } 3625 | '(' STRING host ')' { 3626 $$ = $3; 3627 $$->ifname = $2; 3628 } 3629 ; 3630 3631route_host_list : route_host { $$ = $1; } 3632 | route_host_list comma route_host { 3633 if ($1->af == 0) 3634 $1->af = $3->af; 3635 if ($1->af != $3->af) { 3636 yyerror("all pool addresses must be in the " 3637 "same address family"); 3638 YYERROR; 3639 } 3640 $1->tail->next = $3; 3641 $1->tail = $3->tail; 3642 $$ = $1; 3643 } 3644 ; 3645 3646routespec : route_host { $$ = $1; } 3647 | '{' route_host_list '}' { $$ = $2; } 3648 ; 3649 3650route : /* empty */ { 3651 $$.host = NULL; 3652 $$.rt = 0; 3653 $$.pool_opts = 0; 3654 } 3655 | FASTROUTE { 3656 $$.host = NULL; 3657 $$.rt = PF_FASTROUTE; 3658 $$.pool_opts = 0; 3659 } 3660 | ROUTETO routespec pool_opts { 3661 $$.host = $2; 3662 $$.rt = PF_ROUTETO; 3663 $$.pool_opts = $3.type | $3.opts; 3664 if ($3.key != NULL) 3665 $$.key = $3.key; 3666 } 3667 | REPLYTO routespec pool_opts { 3668 $$.host = $2; 3669 $$.rt = PF_REPLYTO; 3670 $$.pool_opts = $3.type | $3.opts; 3671 if ($3.key != NULL) 3672 $$.key = $3.key; 3673 } 3674 | DUPTO routespec pool_opts { 3675 $$.host = $2; 3676 $$.rt = PF_DUPTO; 3677 $$.pool_opts = $3.type | $3.opts; 3678 if ($3.key != NULL) 3679 $$.key = $3.key; 3680 } 3681 ; 3682 3683timeout_spec : STRING number 3684 { 3685 if (check_rulestate(PFCTL_STATE_OPTION)) { 3686 free($1); 3687 YYERROR; 3688 } 3689 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3690 yyerror("unknown timeout %s", $1); 3691 free($1); 3692 YYERROR; 3693 } 3694 free($1); 3695 } 3696 ; 3697 3698timeout_list : timeout_list comma timeout_spec 3699 | timeout_spec 3700 ; 3701 3702limit_spec : STRING number 3703 { 3704 if (check_rulestate(PFCTL_STATE_OPTION)) { 3705 free($1); 3706 YYERROR; 3707 } 3708 if (pfctl_set_limit(pf, $1, $2) != 0) { 3709 yyerror("unable to set limit %s %u", $1, $2); 3710 free($1); 3711 YYERROR; 3712 } 3713 free($1); 3714 } 3715 ; 3716 3717limit_list : limit_list comma limit_spec 3718 | limit_spec 3719 ; 3720 3721comma : ',' 3722 | /* empty */ 3723 ; 3724 3725yesno : NO { $$ = 0; } 3726 | STRING { 3727 if (!strcmp($1, "yes")) 3728 $$ = 1; 3729 else { 3730 yyerror("invalid value '%s', expected 'yes' " 3731 "or 'no'", $1); 3732 free($1); 3733 YYERROR; 3734 } 3735 free($1); 3736 } 3737 ; 3738 3739unaryop : '=' { $$ = PF_OP_EQ; } 3740 | '!' '=' { $$ = PF_OP_NE; } 3741 | '<' '=' { $$ = PF_OP_LE; } 3742 | '<' { $$ = PF_OP_LT; } 3743 | '>' '=' { $$ = PF_OP_GE; } 3744 | '>' { $$ = PF_OP_GT; } 3745 ; 3746 3747%% 3748 3749int 3750yyerror(const char *fmt, ...) 3751{ 3752 va_list ap; 3753 extern char *infile; 3754 3755 errors = 1; 3756 va_start(ap, fmt); 3757 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3758 vfprintf(stderr, fmt, ap); 3759 fprintf(stderr, "\n"); 3760 va_end(ap); 3761 return (0); 3762} 3763 3764int 3765disallow_table(struct node_host *h, const char *fmt) 3766{ 3767 for (; h != NULL; h = h->next) 3768 if (h->addr.type == PF_ADDR_TABLE) { 3769 yyerror(fmt, h->addr.v.tblname); 3770 return (1); 3771 } 3772 return (0); 3773} 3774 3775int 3776disallow_urpf_failed(struct node_host *h, const char *fmt) 3777{ 3778 for (; h != NULL; h = h->next) 3779 if (h->addr.type == PF_ADDR_URPFFAILED) { 3780 yyerror(fmt); 3781 return (1); 3782 } 3783 return (0); 3784} 3785 3786int 3787disallow_alias(struct node_host *h, const char *fmt) 3788{ 3789 for (; h != NULL; h = h->next) 3790 if (DYNIF_MULTIADDR(h->addr)) { 3791 yyerror(fmt, h->addr.v.tblname); 3792 return (1); 3793 } 3794 return (0); 3795} 3796 3797int 3798rule_consistent(struct pf_rule *r, int anchor_call) 3799{ 3800 int problems = 0; 3801 3802 switch (r->action) { 3803 case PF_PASS: 3804 case PF_DROP: 3805 case PF_SCRUB: 3806 case PF_NOSCRUB: 3807 problems = filter_consistent(r, anchor_call); 3808 break; 3809 case PF_NAT: 3810 case PF_NONAT: 3811 problems = nat_consistent(r); 3812 break; 3813 case PF_RDR: 3814 case PF_NORDR: 3815 problems = rdr_consistent(r); 3816 break; 3817 case PF_BINAT: 3818 case PF_NOBINAT: 3819 default: 3820 break; 3821 } 3822 return (problems); 3823} 3824 3825int 3826filter_consistent(struct pf_rule *r, int anchor_call) 3827{ 3828 int problems = 0; 3829 3830 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3831 (r->src.port_op || r->dst.port_op)) { 3832 yyerror("port only applies to tcp/udp"); 3833 problems++; 3834 } 3835 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3836 (r->type || r->code)) { 3837 yyerror("icmp-type/code only applies to icmp"); 3838 problems++; 3839 } 3840 if (!r->af && (r->type || r->code)) { 3841 yyerror("must indicate address family with icmp-type/code"); 3842 problems++; 3843 } 3844 if (r->overload_tblname[0] && 3845 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3846 yyerror("'overload' requires 'max-src-conn' " 3847 "or 'max-src-conn-rate'"); 3848 problems++; 3849 } 3850 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3851 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3852 yyerror("proto %s doesn't match address family %s", 3853 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3854 r->af == AF_INET ? "inet" : "inet6"); 3855 problems++; 3856 } 3857 if (r->allow_opts && r->action != PF_PASS) { 3858 yyerror("allow-opts can only be specified for pass rules"); 3859 problems++; 3860 } 3861 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3862 r->dst.port_op || r->flagset || r->type || r->code)) { 3863 yyerror("fragments can be filtered only on IP header fields"); 3864 problems++; 3865 } 3866 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3867 yyerror("return-rst can only be applied to TCP rules"); 3868 problems++; 3869 } 3870 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3871 yyerror("max-src-nodes requires 'source-track rule'"); 3872 problems++; 3873 } 3874 if (r->action == PF_DROP && r->keep_state) { 3875 yyerror("keep state on block rules doesn't make sense"); 3876 problems++; 3877 } 3878 return (-problems); 3879} 3880 3881int 3882nat_consistent(struct pf_rule *r) 3883{ 3884 return (0); /* yeah! */ 3885} 3886 3887int 3888rdr_consistent(struct pf_rule *r) 3889{ 3890 int problems = 0; 3891 3892 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3893 if (r->src.port_op) { 3894 yyerror("src port only applies to tcp/udp"); 3895 problems++; 3896 } 3897 if (r->dst.port_op) { 3898 yyerror("dst port only applies to tcp/udp"); 3899 problems++; 3900 } 3901 if (r->rpool.proxy_port[0]) { 3902 yyerror("rpool port only applies to tcp/udp"); 3903 problems++; 3904 } 3905 } 3906 if (r->dst.port_op && 3907 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3908 yyerror("invalid port operator for rdr destination port"); 3909 problems++; 3910 } 3911 return (-problems); 3912} 3913 3914int 3915process_tabledef(char *name, struct table_opts *opts) 3916{ 3917 struct pfr_buffer ab; 3918 struct node_tinit *ti; 3919 3920 bzero(&ab, sizeof(ab)); 3921 ab.pfrb_type = PFRB_ADDRS; 3922 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3923 if (ti->file) 3924 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3925 if (errno) 3926 yyerror("cannot load \"%s\": %s", 3927 ti->file, strerror(errno)); 3928 else 3929 yyerror("file \"%s\" contains bad data", 3930 ti->file); 3931 goto _error; 3932 } 3933 if (ti->host) 3934 if (append_addr_host(&ab, ti->host, 0, 0)) { 3935 yyerror("cannot create address buffer: %s", 3936 strerror(errno)); 3937 goto _error; 3938 } 3939 } 3940 if (pf->opts & PF_OPT_VERBOSE) 3941 print_tabledef(name, opts->flags, opts->init_addr, 3942 &opts->init_nodes); 3943 if (!(pf->opts & PF_OPT_NOACTION) && 3944 pfctl_define_table(name, opts->flags, opts->init_addr, 3945 pf->anchor, &ab, pf->tticket)) { 3946 yyerror("cannot define table %s: %s", name, 3947 pfr_strerror(errno)); 3948 goto _error; 3949 } 3950 pf->tdirty = 1; 3951 pfr_buf_clear(&ab); 3952 return (0); 3953_error: 3954 pfr_buf_clear(&ab); 3955 return (-1); 3956} 3957 3958struct keywords { 3959 const char *k_name; 3960 int k_val; 3961}; 3962 3963/* macro gore, but you should've seen the prior indentation nightmare... */ 3964 3965#define FREE_LIST(T,r) \ 3966 do { \ 3967 T *p, *node = r; \ 3968 while (node != NULL) { \ 3969 p = node; \ 3970 node = node->next; \ 3971 free(p); \ 3972 } \ 3973 } while (0) 3974 3975#define LOOP_THROUGH(T,n,r,C) \ 3976 do { \ 3977 T *n; \ 3978 if (r == NULL) { \ 3979 r = calloc(1, sizeof(T)); \ 3980 if (r == NULL) \ 3981 err(1, "LOOP: calloc"); \ 3982 r->next = NULL; \ 3983 } \ 3984 n = r; \ 3985 while (n != NULL) { \ 3986 do { \ 3987 C; \ 3988 } while (0); \ 3989 n = n->next; \ 3990 } \ 3991 } while (0) 3992 3993void 3994expand_label_str(char *label, size_t len, const char *srch, const char *repl) 3995{ 3996 char *tmp; 3997 char *p, *q; 3998 3999 if ((tmp = calloc(1, len)) == NULL) 4000 err(1, "expand_label_str: calloc"); 4001 p = q = label; 4002 while ((q = strstr(p, srch)) != NULL) { 4003 *q = '\0'; 4004 if ((strlcat(tmp, p, len) >= len) || 4005 (strlcat(tmp, repl, len) >= len)) 4006 errx(1, "expand_label: label too long"); 4007 q += strlen(srch); 4008 p = q; 4009 } 4010 if (strlcat(tmp, p, len) >= len) 4011 errx(1, "expand_label: label too long"); 4012 strlcpy(label, tmp, len); /* always fits */ 4013 free(tmp); 4014} 4015 4016void 4017expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4018{ 4019 if (strstr(label, name) != NULL) { 4020 if (!*ifname) 4021 expand_label_str(label, len, name, "any"); 4022 else 4023 expand_label_str(label, len, name, ifname); 4024 } 4025} 4026 4027void 4028expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4029 struct node_host *h) 4030{ 4031 char tmp[64], tmp_not[66]; 4032 4033 if (strstr(label, name) != NULL) { 4034 switch (h->addr.type) { 4035 case PF_ADDR_DYNIFTL: 4036 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4037 break; 4038 case PF_ADDR_TABLE: 4039 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4040 break; 4041 case PF_ADDR_NOROUTE: 4042 snprintf(tmp, sizeof(tmp), "no-route"); 4043 break; 4044 case PF_ADDR_URPFFAILED: 4045 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4046 break; 4047 case PF_ADDR_ADDRMASK: 4048 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4049 PF_AZERO(&h->addr.v.a.mask, af))) 4050 snprintf(tmp, sizeof(tmp), "any"); 4051 else { 4052 char a[48]; 4053 int bits; 4054 4055 if (inet_ntop(af, &h->addr.v.a.addr, a, 4056 sizeof(a)) == NULL) 4057 snprintf(tmp, sizeof(tmp), "?"); 4058 else { 4059 bits = unmask(&h->addr.v.a.mask, af); 4060 if ((af == AF_INET && bits < 32) || 4061 (af == AF_INET6 && bits < 128)) 4062 snprintf(tmp, sizeof(tmp), 4063 "%s/%d", a, bits); 4064 else 4065 snprintf(tmp, sizeof(tmp), 4066 "%s", a); 4067 } 4068 } 4069 break; 4070 default: 4071 snprintf(tmp, sizeof(tmp), "?"); 4072 break; 4073 } 4074 4075 if (h->not) { 4076 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4077 expand_label_str(label, len, name, tmp_not); 4078 } else 4079 expand_label_str(label, len, name, tmp); 4080 } 4081} 4082 4083void 4084expand_label_port(const char *name, char *label, size_t len, 4085 struct node_port *port) 4086{ 4087 char a1[6], a2[6], op[13] = ""; 4088 4089 if (strstr(label, name) != NULL) { 4090 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4091 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4092 if (!port->op) 4093 ; 4094 else if (port->op == PF_OP_IRG) 4095 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4096 else if (port->op == PF_OP_XRG) 4097 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4098 else if (port->op == PF_OP_EQ) 4099 snprintf(op, sizeof(op), "%s", a1); 4100 else if (port->op == PF_OP_NE) 4101 snprintf(op, sizeof(op), "!=%s", a1); 4102 else if (port->op == PF_OP_LT) 4103 snprintf(op, sizeof(op), "<%s", a1); 4104 else if (port->op == PF_OP_LE) 4105 snprintf(op, sizeof(op), "<=%s", a1); 4106 else if (port->op == PF_OP_GT) 4107 snprintf(op, sizeof(op), ">%s", a1); 4108 else if (port->op == PF_OP_GE) 4109 snprintf(op, sizeof(op), ">=%s", a1); 4110 expand_label_str(label, len, name, op); 4111 } 4112} 4113 4114void 4115expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4116{ 4117 struct protoent *pe; 4118 char n[4]; 4119 4120 if (strstr(label, name) != NULL) { 4121 pe = getprotobynumber(proto); 4122 if (pe != NULL) 4123 expand_label_str(label, len, name, pe->p_name); 4124 else { 4125 snprintf(n, sizeof(n), "%u", proto); 4126 expand_label_str(label, len, name, n); 4127 } 4128 } 4129} 4130 4131void 4132expand_label_nr(const char *name, char *label, size_t len) 4133{ 4134 char n[11]; 4135 4136 if (strstr(label, name) != NULL) { 4137 snprintf(n, sizeof(n), "%u", pf->rule_nr); 4138 expand_label_str(label, len, name, n); 4139 } 4140} 4141 4142void 4143expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4144 struct node_host *src_host, struct node_port *src_port, 4145 struct node_host *dst_host, struct node_port *dst_port, 4146 u_int8_t proto) 4147{ 4148 expand_label_if("$if", label, len, ifname); 4149 expand_label_addr("$srcaddr", label, len, af, src_host); 4150 expand_label_addr("$dstaddr", label, len, af, dst_host); 4151 expand_label_port("$srcport", label, len, src_port); 4152 expand_label_port("$dstport", label, len, dst_port); 4153 expand_label_proto("$proto", label, len, proto); 4154 expand_label_nr("$nr", label, len); 4155} 4156 4157int 4158expand_altq(struct pf_altq *a, struct node_if *interfaces, 4159 struct node_queue *nqueues, struct node_queue_bw bwspec, 4160 struct node_queue_opt *opts) 4161{ 4162 struct pf_altq pa, pb; 4163 char qname[PF_QNAME_SIZE]; 4164 struct node_queue *n; 4165 struct node_queue_bw bw; 4166 int errs = 0; 4167 4168 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4169 FREE_LIST(struct node_if, interfaces); 4170 FREE_LIST(struct node_queue, nqueues); 4171 return (0); 4172 } 4173 4174 LOOP_THROUGH(struct node_if, interface, interfaces, 4175 memcpy(&pa, a, sizeof(struct pf_altq)); 4176 if (strlcpy(pa.ifname, interface->ifname, 4177 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4178 errx(1, "expand_altq: strlcpy"); 4179 4180 if (interface->not) { 4181 yyerror("altq on ! <interface> is not supported"); 4182 errs++; 4183 } else { 4184 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4185 errs++; 4186 else 4187 if (pfctl_add_altq(pf, &pa)) 4188 errs++; 4189 4190 if (pf->opts & PF_OPT_VERBOSE) { 4191 print_altq(&pf->paltq->altq, 0, 4192 &bwspec, opts); 4193 if (nqueues && nqueues->tail) { 4194 printf("queue { "); 4195 LOOP_THROUGH(struct node_queue, queue, 4196 nqueues, 4197 printf("%s ", 4198 queue->queue); 4199 ); 4200 printf("}"); 4201 } 4202 printf("\n"); 4203 } 4204 4205 if (pa.scheduler == ALTQT_CBQ || 4206 pa.scheduler == ALTQT_HFSC) { 4207 /* now create a root queue */ 4208 memset(&pb, 0, sizeof(struct pf_altq)); 4209 if (strlcpy(qname, "root_", sizeof(qname)) >= 4210 sizeof(qname)) 4211 errx(1, "expand_altq: strlcpy"); 4212 if (strlcat(qname, interface->ifname, 4213 sizeof(qname)) >= sizeof(qname)) 4214 errx(1, "expand_altq: strlcat"); 4215 if (strlcpy(pb.qname, qname, 4216 sizeof(pb.qname)) >= sizeof(pb.qname)) 4217 errx(1, "expand_altq: strlcpy"); 4218 if (strlcpy(pb.ifname, interface->ifname, 4219 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4220 errx(1, "expand_altq: strlcpy"); 4221 pb.qlimit = pa.qlimit; 4222 pb.scheduler = pa.scheduler; 4223 bw.bw_absolute = pa.ifbandwidth; 4224 bw.bw_percent = 0; 4225 if (eval_pfqueue(pf, &pb, &bw, opts)) 4226 errs++; 4227 else 4228 if (pfctl_add_altq(pf, &pb)) 4229 errs++; 4230 } 4231 4232 LOOP_THROUGH(struct node_queue, queue, nqueues, 4233 n = calloc(1, sizeof(struct node_queue)); 4234 if (n == NULL) 4235 err(1, "expand_altq: calloc"); 4236 if (pa.scheduler == ALTQT_CBQ || 4237 pa.scheduler == ALTQT_HFSC) 4238 if (strlcpy(n->parent, qname, 4239 sizeof(n->parent)) >= 4240 sizeof(n->parent)) 4241 errx(1, "expand_altq: strlcpy"); 4242 if (strlcpy(n->queue, queue->queue, 4243 sizeof(n->queue)) >= sizeof(n->queue)) 4244 errx(1, "expand_altq: strlcpy"); 4245 if (strlcpy(n->ifname, interface->ifname, 4246 sizeof(n->ifname)) >= sizeof(n->ifname)) 4247 errx(1, "expand_altq: strlcpy"); 4248 n->scheduler = pa.scheduler; 4249 n->next = NULL; 4250 n->tail = n; 4251 if (queues == NULL) 4252 queues = n; 4253 else { 4254 queues->tail->next = n; 4255 queues->tail = n; 4256 } 4257 ); 4258 } 4259 ); 4260 FREE_LIST(struct node_if, interfaces); 4261 FREE_LIST(struct node_queue, nqueues); 4262 4263 return (errs); 4264} 4265 4266int 4267expand_queue(struct pf_altq *a, struct node_if *interfaces, 4268 struct node_queue *nqueues, struct node_queue_bw bwspec, 4269 struct node_queue_opt *opts) 4270{ 4271 struct node_queue *n, *nq; 4272 struct pf_altq pa; 4273 u_int8_t found = 0; 4274 u_int8_t errs = 0; 4275 4276 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4277 FREE_LIST(struct node_queue, nqueues); 4278 return (0); 4279 } 4280 4281 if (queues == NULL) { 4282 yyerror("queue %s has no parent", a->qname); 4283 FREE_LIST(struct node_queue, nqueues); 4284 return (1); 4285 } 4286 4287 LOOP_THROUGH(struct node_if, interface, interfaces, 4288 LOOP_THROUGH(struct node_queue, tqueue, queues, 4289 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4290 (interface->ifname[0] == 0 || 4291 (!interface->not && !strncmp(interface->ifname, 4292 tqueue->ifname, IFNAMSIZ)) || 4293 (interface->not && strncmp(interface->ifname, 4294 tqueue->ifname, IFNAMSIZ)))) { 4295 /* found ourself in queues */ 4296 found++; 4297 4298 memcpy(&pa, a, sizeof(struct pf_altq)); 4299 4300 if (pa.scheduler != ALTQT_NONE && 4301 pa.scheduler != tqueue->scheduler) { 4302 yyerror("exactly one scheduler type " 4303 "per interface allowed"); 4304 return (1); 4305 } 4306 pa.scheduler = tqueue->scheduler; 4307 4308 /* scheduler dependent error checking */ 4309 switch (pa.scheduler) { 4310 case ALTQT_PRIQ: 4311 if (nqueues != NULL) { 4312 yyerror("priq queues cannot " 4313 "have child queues"); 4314 return (1); 4315 } 4316 if (bwspec.bw_absolute > 0 || 4317 bwspec.bw_percent < 100) { 4318 yyerror("priq doesn't take " 4319 "bandwidth"); 4320 return (1); 4321 } 4322 break; 4323 default: 4324 break; 4325 } 4326 4327 if (strlcpy(pa.ifname, tqueue->ifname, 4328 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4329 errx(1, "expand_queue: strlcpy"); 4330 if (strlcpy(pa.parent, tqueue->parent, 4331 sizeof(pa.parent)) >= sizeof(pa.parent)) 4332 errx(1, "expand_queue: strlcpy"); 4333 4334 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4335 errs++; 4336 else 4337 if (pfctl_add_altq(pf, &pa)) 4338 errs++; 4339 4340 for (nq = nqueues; nq != NULL; nq = nq->next) { 4341 if (!strcmp(a->qname, nq->queue)) { 4342 yyerror("queue cannot have " 4343 "itself as child"); 4344 errs++; 4345 continue; 4346 } 4347 n = calloc(1, 4348 sizeof(struct node_queue)); 4349 if (n == NULL) 4350 err(1, "expand_queue: calloc"); 4351 if (strlcpy(n->parent, a->qname, 4352 sizeof(n->parent)) >= 4353 sizeof(n->parent)) 4354 errx(1, "expand_queue strlcpy"); 4355 if (strlcpy(n->queue, nq->queue, 4356 sizeof(n->queue)) >= 4357 sizeof(n->queue)) 4358 errx(1, "expand_queue strlcpy"); 4359 if (strlcpy(n->ifname, tqueue->ifname, 4360 sizeof(n->ifname)) >= 4361 sizeof(n->ifname)) 4362 errx(1, "expand_queue strlcpy"); 4363 n->scheduler = tqueue->scheduler; 4364 n->next = NULL; 4365 n->tail = n; 4366 if (queues == NULL) 4367 queues = n; 4368 else { 4369 queues->tail->next = n; 4370 queues->tail = n; 4371 } 4372 } 4373 if ((pf->opts & PF_OPT_VERBOSE) && ( 4374 (found == 1 && interface->ifname[0] == 0) || 4375 (found > 0 && interface->ifname[0] != 0))) { 4376 print_queue(&pf->paltq->altq, 0, 4377 &bwspec, interface->ifname[0] != 0, 4378 opts); 4379 if (nqueues && nqueues->tail) { 4380 printf("{ "); 4381 LOOP_THROUGH(struct node_queue, 4382 queue, nqueues, 4383 printf("%s ", 4384 queue->queue); 4385 ); 4386 printf("}"); 4387 } 4388 printf("\n"); 4389 } 4390 } 4391 ); 4392 ); 4393 4394 FREE_LIST(struct node_queue, nqueues); 4395 FREE_LIST(struct node_if, interfaces); 4396 4397 if (!found) { 4398 yyerror("queue %s has no parent", a->qname); 4399 errs++; 4400 } 4401 4402 if (errs) 4403 return (1); 4404 else 4405 return (0); 4406} 4407 4408void 4409expand_rule(struct pf_rule *r, 4410 struct node_if *interfaces, struct node_host *rpool_hosts, 4411 struct node_proto *protos, struct node_os *src_oses, 4412 struct node_host *src_hosts, struct node_port *src_ports, 4413 struct node_host *dst_hosts, struct node_port *dst_ports, 4414 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4415 struct node_matchtag *match_tags, const char *anchor_call) 4416{ 4417 sa_family_t af = r->af; 4418 int added = 0, error = 0; 4419 char ifname[IF_NAMESIZE]; 4420 char label[PF_RULE_LABEL_SIZE]; 4421 char tagname[PF_TAG_NAME_SIZE]; 4422 struct pf_pooladdr *pa; 4423 struct node_host *h; 4424 u_int8_t flags, flagset, keep_state; 4425 4426 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4427 errx(1, "expand_rule: strlcpy"); 4428 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4429 errx(1, "expand_rule: strlcpy"); 4430 flags = r->flags; 4431 flagset = r->flagset; 4432 keep_state = r->keep_state; 4433 4434 LOOP_THROUGH(struct node_if, interface, interfaces, 4435 LOOP_THROUGH(struct node_proto, proto, protos, 4436 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4437 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4438 LOOP_THROUGH(struct node_port, src_port, src_ports, 4439 LOOP_THROUGH(struct node_os, src_os, src_oses, 4440 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4441 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4442 LOOP_THROUGH(struct node_uid, uid, uids, 4443 LOOP_THROUGH(struct node_gid, gid, gids, 4444 LOOP_THROUGH(struct node_matchtag, match_tag, match_tags, 4445 4446 r->af = af; 4447 /* for link-local IPv6 address, interface must match up */ 4448 if ((r->af && src_host->af && r->af != src_host->af) || 4449 (r->af && dst_host->af && r->af != dst_host->af) || 4450 (src_host->af && dst_host->af && 4451 src_host->af != dst_host->af) || 4452 (src_host->ifindex && dst_host->ifindex && 4453 src_host->ifindex != dst_host->ifindex) || 4454 (src_host->ifindex && *interface->ifname && 4455 src_host->ifindex != if_nametoindex(interface->ifname)) || 4456 (dst_host->ifindex && *interface->ifname && 4457 dst_host->ifindex != if_nametoindex(interface->ifname))) 4458 continue; 4459 if (!r->af && src_host->af) 4460 r->af = src_host->af; 4461 else if (!r->af && dst_host->af) 4462 r->af = dst_host->af; 4463 4464 if (*interface->ifname) 4465 strlcpy(r->ifname, interface->ifname, 4466 sizeof(r->ifname)); 4467 else if (if_indextoname(src_host->ifindex, ifname)) 4468 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4469 else if (if_indextoname(dst_host->ifindex, ifname)) 4470 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4471 else 4472 memset(r->ifname, '\0', sizeof(r->ifname)); 4473 4474 if (strlcpy(r->label, label, sizeof(r->label)) >= 4475 sizeof(r->label)) 4476 errx(1, "expand_rule: strlcpy"); 4477 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4478 sizeof(r->tagname)) 4479 errx(1, "expand_rule: strlcpy"); 4480 if (!match_tag->tagname) 4481 errx(1, "expand_rule: no tagname"); 4482 if (strlcpy(r->match_tagname, match_tag->tagname, 4483 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4484 errx(1, "expand_rule: strlcpy"); 4485 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4486 src_host, src_port, dst_host, dst_port, proto->proto); 4487 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4488 src_host, src_port, dst_host, dst_port, proto->proto); 4489 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4490 r->af, src_host, src_port, dst_host, dst_port, 4491 proto->proto); 4492 4493 error += check_netmask(src_host, r->af); 4494 error += check_netmask(dst_host, r->af); 4495 4496 r->ifnot = interface->not; 4497 r->proto = proto->proto; 4498 r->src.addr = src_host->addr; 4499 r->src.neg = src_host->not; 4500 r->src.port[0] = src_port->port[0]; 4501 r->src.port[1] = src_port->port[1]; 4502 r->src.port_op = src_port->op; 4503 r->dst.addr = dst_host->addr; 4504 r->dst.neg = dst_host->not; 4505 r->dst.port[0] = dst_port->port[0]; 4506 r->dst.port[1] = dst_port->port[1]; 4507 r->dst.port_op = dst_port->op; 4508 r->uid.op = uid->op; 4509 r->uid.uid[0] = uid->uid[0]; 4510 r->uid.uid[1] = uid->uid[1]; 4511 r->gid.op = gid->op; 4512 r->gid.gid[0] = gid->gid[0]; 4513 r->gid.gid[1] = gid->gid[1]; 4514 r->type = icmp_type->type; 4515 r->code = icmp_type->code; 4516 4517 if ((keep_state == PF_STATE_MODULATE || 4518 keep_state == PF_STATE_SYNPROXY) && 4519 r->proto && r->proto != IPPROTO_TCP) 4520 r->keep_state = PF_STATE_NORMAL; 4521 else 4522 r->keep_state = keep_state; 4523 4524 if (r->proto && r->proto != IPPROTO_TCP) { 4525 r->flags = 0; 4526 r->flagset = 0; 4527 } else { 4528 r->flags = flags; 4529 r->flagset = flagset; 4530 } 4531 if (icmp_type->proto && r->proto != icmp_type->proto) { 4532 yyerror("icmp-type mismatch"); 4533 error++; 4534 } 4535 4536 if (src_os && src_os->os) { 4537 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4538 if ((pf->opts & PF_OPT_VERBOSE2) && 4539 r->os_fingerprint == PF_OSFP_NOMATCH) 4540 fprintf(stderr, 4541 "warning: unknown '%s' OS fingerprint\n", 4542 src_os->os); 4543 } else { 4544 r->os_fingerprint = PF_OSFP_ANY; 4545 } 4546 4547 TAILQ_INIT(&r->rpool.list); 4548 for (h = rpool_hosts; h != NULL; h = h->next) { 4549 pa = calloc(1, sizeof(struct pf_pooladdr)); 4550 if (pa == NULL) 4551 err(1, "expand_rule: calloc"); 4552 pa->addr = h->addr; 4553 if (h->ifname != NULL) { 4554 if (strlcpy(pa->ifname, h->ifname, 4555 sizeof(pa->ifname)) >= 4556 sizeof(pa->ifname)) 4557 errx(1, "expand_rule: strlcpy"); 4558 } else 4559 pa->ifname[0] = 0; 4560 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4561 } 4562 4563 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4564 yyerror("skipping rule due to errors"); 4565 else { 4566 r->nr = pf->rule_nr++; 4567 pfctl_add_rule(pf, r, anchor_call); 4568 added++; 4569 } 4570 4571 ))))))))))); 4572 4573 FREE_LIST(struct node_if, interfaces); 4574 FREE_LIST(struct node_proto, protos); 4575 FREE_LIST(struct node_host, src_hosts); 4576 FREE_LIST(struct node_port, src_ports); 4577 FREE_LIST(struct node_os, src_oses); 4578 FREE_LIST(struct node_host, dst_hosts); 4579 FREE_LIST(struct node_port, dst_ports); 4580 FREE_LIST(struct node_uid, uids); 4581 FREE_LIST(struct node_gid, gids); 4582 FREE_LIST(struct node_icmp, icmp_types); 4583 FREE_LIST(struct node_host, rpool_hosts); 4584 FREE_LIST(struct node_matchtag, match_tags); 4585 4586 if (!added) 4587 yyerror("rule expands to no valid combination"); 4588} 4589 4590int 4591expand_skip_interface(struct node_if *interfaces) 4592{ 4593 int errs = 0; 4594 4595 if (!interfaces || (!interfaces->next && !interfaces->not && 4596 !strcmp(interfaces->ifname, "none"))) { 4597 if (pf->opts & PF_OPT_VERBOSE) 4598 printf("set skip on none\n"); 4599 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4600 return (errs); 4601 } 4602 4603 if (pf->opts & PF_OPT_VERBOSE) 4604 printf("set skip on {"); 4605 LOOP_THROUGH(struct node_if, interface, interfaces, 4606 if (pf->opts & PF_OPT_VERBOSE) 4607 printf(" %s", interface->ifname); 4608 if (interface->not) { 4609 yyerror("skip on ! <interface> is not supported"); 4610 errs++; 4611 } else 4612 errs += pfctl_set_interface_flags(pf, 4613 interface->ifname, PFI_IFLAG_SKIP, 1); 4614 ); 4615 if (pf->opts & PF_OPT_VERBOSE) 4616 printf(" }\n"); 4617 4618 FREE_LIST(struct node_if, interfaces); 4619 4620 if (errs) 4621 return (1); 4622 else 4623 return (0); 4624} 4625 4626#undef FREE_LIST 4627#undef LOOP_THROUGH 4628 4629int 4630check_rulestate(int desired_state) 4631{ 4632 if (require_order && (rulestate > desired_state)) { 4633 yyerror("Rules must be in order: options, normalization, " 4634 "queueing, translation, filtering"); 4635 return (1); 4636 } 4637 rulestate = desired_state; 4638 return (0); 4639} 4640 4641int 4642kw_cmp(const void *k, const void *e) 4643{ 4644 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4645} 4646 4647int 4648lookup(char *s) 4649{ 4650 /* this has to be sorted always */ 4651 static const struct keywords keywords[] = { 4652 { "all", ALL}, 4653 { "allow-opts", ALLOWOPTS}, 4654 { "altq", ALTQ}, 4655 { "anchor", ANCHOR}, 4656 { "antispoof", ANTISPOOF}, 4657 { "any", ANY}, 4658 { "bandwidth", BANDWIDTH}, 4659 { "binat", BINAT}, 4660 { "binat-anchor", BINATANCHOR}, 4661 { "bitmask", BITMASK}, 4662 { "block", BLOCK}, 4663 { "block-policy", BLOCKPOLICY}, 4664 { "cbq", CBQ}, 4665 { "code", CODE}, 4666 { "crop", FRAGCROP}, 4667 { "debug", DEBUG}, 4668 { "drop", DROP}, 4669 { "drop-ovl", FRAGDROP}, 4670 { "dup-to", DUPTO}, 4671 { "fastroute", FASTROUTE}, 4672 { "file", FILENAME}, 4673 { "fingerprints", FINGERPRINTS}, 4674 { "flags", FLAGS}, 4675 { "floating", FLOATING}, 4676 { "flush", FLUSH}, 4677 { "for", FOR}, 4678 { "fragment", FRAGMENT}, 4679 { "from", FROM}, 4680 { "global", GLOBAL}, 4681 { "group", GROUP}, 4682 { "hfsc", HFSC}, 4683 { "hostid", HOSTID}, 4684 { "icmp-type", ICMPTYPE}, 4685 { "icmp6-type", ICMP6TYPE}, 4686 { "if-bound", IFBOUND}, 4687 { "in", IN}, 4688 { "inet", INET}, 4689 { "inet6", INET6}, 4690 { "keep", KEEP}, 4691 { "label", LABEL}, 4692 { "limit", LIMIT}, 4693 { "linkshare", LINKSHARE}, 4694 { "load", LOAD}, 4695 { "log", LOG}, 4696 { "loginterface", LOGINTERFACE}, 4697 { "max", MAXIMUM}, 4698 { "max-mss", MAXMSS}, 4699 { "max-src-conn", MAXSRCCONN}, 4700 { "max-src-conn-rate", MAXSRCCONNRATE}, 4701 { "max-src-nodes", MAXSRCNODES}, 4702 { "max-src-states", MAXSRCSTATES}, 4703 { "min-ttl", MINTTL}, 4704 { "modulate", MODULATE}, 4705 { "nat", NAT}, 4706 { "nat-anchor", NATANCHOR}, 4707 { "no", NO}, 4708 { "no-df", NODF}, 4709 { "no-route", NOROUTE}, 4710 { "no-sync", NOSYNC}, 4711 { "on", ON}, 4712 { "optimization", OPTIMIZATION}, 4713 { "os", OS}, 4714 { "out", OUT}, 4715 { "overload", OVERLOAD}, 4716 { "pass", PASS}, 4717 { "port", PORT}, 4718 { "priority", PRIORITY}, 4719 { "priq", PRIQ}, 4720 { "probability", PROBABILITY}, 4721 { "proto", PROTO}, 4722 { "qlimit", QLIMIT}, 4723 { "queue", QUEUE}, 4724 { "quick", QUICK}, 4725 { "random", RANDOM}, 4726 { "random-id", RANDOMID}, 4727 { "rdr", RDR}, 4728 { "rdr-anchor", RDRANCHOR}, 4729 { "realtime", REALTIME}, 4730 { "reassemble", REASSEMBLE}, 4731 { "reply-to", REPLYTO}, 4732 { "require-order", REQUIREORDER}, 4733 { "return", RETURN}, 4734 { "return-icmp", RETURNICMP}, 4735 { "return-icmp6", RETURNICMP6}, 4736 { "return-rst", RETURNRST}, 4737 { "round-robin", ROUNDROBIN}, 4738 { "route", ROUTE}, 4739 { "route-to", ROUTETO}, 4740 { "rule", RULE}, 4741 { "scrub", SCRUB}, 4742 { "set", SET}, 4743 { "skip", SKIP}, 4744 { "source-hash", SOURCEHASH}, 4745 { "source-track", SOURCETRACK}, 4746 { "state", STATE}, 4747 { "state-policy", STATEPOLICY}, 4748 { "static-port", STATICPORT}, 4749 { "sticky-address", STICKYADDRESS}, 4750 { "synproxy", SYNPROXY}, 4751 { "table", TABLE}, 4752 { "tag", TAG}, 4753 { "tagged", TAGGED}, 4754 { "tbrsize", TBRSIZE}, 4755 { "timeout", TIMEOUT}, 4756 { "to", TO}, 4757 { "tos", TOS}, 4758 { "ttl", TTL}, 4759 { "upperlimit", UPPERLIMIT}, 4760 { "urpf-failed", URPFFAILED}, 4761 { "user", USER}, 4762 }; 4763 const struct keywords *p; 4764 4765 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4766 sizeof(keywords[0]), kw_cmp); 4767 4768 if (p) { 4769 if (debug > 1) 4770 fprintf(stderr, "%s: %d\n", s, p->k_val); 4771 return (p->k_val); 4772 } else { 4773 if (debug > 1) 4774 fprintf(stderr, "string: %s\n", s); 4775 return (STRING); 4776 } 4777} 4778 4779#define MAXPUSHBACK 128 4780 4781char *parsebuf; 4782int parseindex; 4783char pushback_buffer[MAXPUSHBACK]; 4784int pushback_index = 0; 4785 4786int 4787lgetc(FILE *f) 4788{ 4789 int c, next; 4790 4791 if (parsebuf) { 4792 /* Read character from the parsebuffer instead of input. */ 4793 if (parseindex >= 0) { 4794 c = parsebuf[parseindex++]; 4795 if (c != '\0') 4796 return (c); 4797 parsebuf = NULL; 4798 } else 4799 parseindex++; 4800 } 4801 4802 if (pushback_index) 4803 return (pushback_buffer[--pushback_index]); 4804 4805 while ((c = getc(f)) == '\\') { 4806 next = getc(f); 4807 if (next != '\n') { 4808 c = next; 4809 break; 4810 } 4811 yylval.lineno = lineno; 4812 lineno++; 4813 } 4814 if (c == '\t' || c == ' ') { 4815 /* Compress blanks to a single space. */ 4816 do { 4817 c = getc(f); 4818 } while (c == '\t' || c == ' '); 4819 ungetc(c, f); 4820 c = ' '; 4821 } 4822 4823 return (c); 4824} 4825 4826int 4827lungetc(int c) 4828{ 4829 if (c == EOF) 4830 return (EOF); 4831 if (parsebuf) { 4832 parseindex--; 4833 if (parseindex >= 0) 4834 return (c); 4835 } 4836 if (pushback_index < MAXPUSHBACK-1) 4837 return (pushback_buffer[pushback_index++] = c); 4838 else 4839 return (EOF); 4840} 4841 4842int 4843findeol(void) 4844{ 4845 int c; 4846 4847 parsebuf = NULL; 4848 pushback_index = 0; 4849 4850 /* skip to either EOF or the first real EOL */ 4851 while (1) { 4852 c = lgetc(fin); 4853 if (c == '\n') { 4854 lineno++; 4855 break; 4856 } 4857 if (c == EOF) 4858 break; 4859 } 4860 return (ERROR); 4861} 4862 4863int 4864yylex(void) 4865{ 4866 char buf[8096]; 4867 char *p, *val; 4868 int endc, c, next; 4869 int token; 4870 4871top: 4872 p = buf; 4873 while ((c = lgetc(fin)) == ' ') 4874 ; /* nothing */ 4875 4876 yylval.lineno = lineno; 4877 if (c == '#') 4878 while ((c = lgetc(fin)) != '\n' && c != EOF) 4879 ; /* nothing */ 4880 if (c == '$' && parsebuf == NULL) { 4881 while (1) { 4882 if ((c = lgetc(fin)) == EOF) 4883 return (0); 4884 4885 if (p + 1 >= buf + sizeof(buf) - 1) { 4886 yyerror("string too long"); 4887 return (findeol()); 4888 } 4889 if (isalnum(c) || c == '_') { 4890 *p++ = (char)c; 4891 continue; 4892 } 4893 *p = '\0'; 4894 lungetc(c); 4895 break; 4896 } 4897 val = symget(buf); 4898 if (val == NULL) { 4899 yyerror("macro '%s' not defined", buf); 4900 return (findeol()); 4901 } 4902 parsebuf = val; 4903 parseindex = 0; 4904 goto top; 4905 } 4906 4907 switch (c) { 4908 case '\'': 4909 case '"': 4910 endc = c; 4911 while (1) { 4912 if ((c = lgetc(fin)) == EOF) 4913 return (0); 4914 if (c == endc) { 4915 *p = '\0'; 4916 break; 4917 } 4918 if (c == '\n') { 4919 lineno++; 4920 continue; 4921 } 4922 if (p + 1 >= buf + sizeof(buf) - 1) { 4923 yyerror("string too long"); 4924 return (findeol()); 4925 } 4926 *p++ = (char)c; 4927 } 4928 yylval.v.string = strdup(buf); 4929 if (yylval.v.string == NULL) 4930 err(1, "yylex: strdup"); 4931 return (STRING); 4932 case '<': 4933 next = lgetc(fin); 4934 if (next == '>') { 4935 yylval.v.i = PF_OP_XRG; 4936 return (PORTBINARY); 4937 } 4938 lungetc(next); 4939 break; 4940 case '>': 4941 next = lgetc(fin); 4942 if (next == '<') { 4943 yylval.v.i = PF_OP_IRG; 4944 return (PORTBINARY); 4945 } 4946 lungetc(next); 4947 break; 4948 case '-': 4949 next = lgetc(fin); 4950 if (next == '>') 4951 return (ARROW); 4952 lungetc(next); 4953 break; 4954 } 4955 4956#define allowed_in_string(x) \ 4957 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4958 x != '{' && x != '}' && x != '<' && x != '>' && \ 4959 x != '!' && x != '=' && x != '/' && x != '#' && \ 4960 x != ',')) 4961 4962 if (isalnum(c) || c == ':' || c == '_') { 4963 do { 4964 *p++ = c; 4965 if ((unsigned)(p-buf) >= sizeof(buf)) { 4966 yyerror("string too long"); 4967 return (findeol()); 4968 } 4969 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4970 lungetc(c); 4971 *p = '\0'; 4972 if ((token = lookup(buf)) == STRING) 4973 if ((yylval.v.string = strdup(buf)) == NULL) 4974 err(1, "yylex: strdup"); 4975 return (token); 4976 } 4977 if (c == '\n') { 4978 yylval.lineno = lineno; 4979 lineno++; 4980 } 4981 if (c == EOF) 4982 return (0); 4983 return (c); 4984} 4985 4986int 4987parse_rules(FILE *input, struct pfctl *xpf) 4988{ 4989 struct sym *sym, *next; 4990 4991 fin = input; 4992 pf = xpf; 4993 lineno = 1; 4994 errors = 0; 4995 rulestate = PFCTL_STATE_NONE; 4996 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4997 returnicmp6default = 4998 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4999 blockpolicy = PFRULE_DROP; 5000 require_order = 1; 5001 5002 yyparse(); 5003 5004 /* Free macros and check which have not been used. */ 5005 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 5006 next = TAILQ_NEXT(sym, entries); 5007 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5008 fprintf(stderr, "warning: macro '%s' not " 5009 "used\n", sym->nam); 5010 free(sym->nam); 5011 free(sym->val); 5012 TAILQ_REMOVE(&symhead, sym, entries); 5013 free(sym); 5014 } 5015 5016 return (errors ? -1 : 0); 5017} 5018 5019/* 5020 * Over-designed efficiency is a French and German concept, so how about 5021 * we wait until they discover this ugliness and make it all fancy. 5022 */ 5023int 5024symset(const char *nam, const char *val, int persist) 5025{ 5026 struct sym *sym; 5027 5028 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5029 sym = TAILQ_NEXT(sym, entries)) 5030 ; /* nothing */ 5031 5032 if (sym != NULL) { 5033 if (sym->persist == 1) 5034 return (0); 5035 else { 5036 free(sym->nam); 5037 free(sym->val); 5038 TAILQ_REMOVE(&symhead, sym, entries); 5039 free(sym); 5040 } 5041 } 5042 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5043 return (-1); 5044 5045 sym->nam = strdup(nam); 5046 if (sym->nam == NULL) { 5047 free(sym); 5048 return (-1); 5049 } 5050 sym->val = strdup(val); 5051 if (sym->val == NULL) { 5052 free(sym->nam); 5053 free(sym); 5054 return (-1); 5055 } 5056 sym->used = 0; 5057 sym->persist = persist; 5058 TAILQ_INSERT_TAIL(&symhead, sym, entries); 5059 return (0); 5060} 5061 5062int 5063pfctl_cmdline_symset(char *s) 5064{ 5065 char *sym, *val; 5066 int ret; 5067 5068 if ((val = strrchr(s, '=')) == NULL) 5069 return (-1); 5070 5071 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5072 err(1, "pfctl_cmdline_symset: malloc"); 5073 5074 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5075 5076 ret = symset(sym, val + 1, 1); 5077 free(sym); 5078 5079 return (ret); 5080} 5081 5082char * 5083symget(const char *nam) 5084{ 5085 struct sym *sym; 5086 5087 TAILQ_FOREACH(sym, &symhead, entries) 5088 if (strcmp(nam, sym->nam) == 0) { 5089 sym->used = 1; 5090 return (sym->val); 5091 } 5092 return (NULL); 5093} 5094 5095void 5096decide_address_family(struct node_host *n, sa_family_t *af) 5097{ 5098 sa_family_t target_af = 0; 5099 5100 while (!*af && n != NULL) { 5101 if (n->af) { 5102 if (target_af == 0) 5103 target_af = n->af; 5104 if (target_af != n->af) 5105 return; 5106 } 5107 n = n->next; 5108 } 5109 if (!*af && target_af) 5110 *af = target_af; 5111} 5112 5113void 5114remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5115{ 5116 struct node_host *n = *nh, *prev = NULL; 5117 5118 while (n != NULL) { 5119 if (*af && n->af && n->af != *af) { 5120 /* unlink and free n */ 5121 struct node_host *next = n->next; 5122 5123 /* adjust tail pointer */ 5124 if (n == (*nh)->tail) 5125 (*nh)->tail = prev; 5126 /* adjust previous node's next pointer */ 5127 if (prev == NULL) 5128 *nh = next; 5129 else 5130 prev->next = next; 5131 /* free node */ 5132 if (n->ifname != NULL) 5133 free(n->ifname); 5134 free(n); 5135 n = next; 5136 } else { 5137 if (n->af && !*af) 5138 *af = n->af; 5139 prev = n; 5140 n = n->next; 5141 } 5142 } 5143} 5144 5145int 5146invalid_redirect(struct node_host *nh, sa_family_t af) 5147{ 5148 if (!af) { 5149 struct node_host *n; 5150 5151 /* tables and dyniftl are ok without an address family */ 5152 for (n = nh; n != NULL; n = n->next) { 5153 if (n->addr.type != PF_ADDR_TABLE && 5154 n->addr.type != PF_ADDR_DYNIFTL) { 5155 yyerror("address family not given and " 5156 "translation address expands to multiple " 5157 "address families"); 5158 return (1); 5159 } 5160 } 5161 } 5162 if (nh == NULL) { 5163 yyerror("no translation address with matching address family " 5164 "found."); 5165 return (1); 5166 } 5167 return (0); 5168} 5169 5170int 5171atoul(char *s, u_long *ulvalp) 5172{ 5173 u_long ulval; 5174 char *ep; 5175 5176 errno = 0; 5177 ulval = strtoul(s, &ep, 0); 5178 if (s[0] == '\0' || *ep != '\0') 5179 return (-1); 5180 if (errno == ERANGE && ulval == ULONG_MAX) 5181 return (-1); 5182 *ulvalp = ulval; 5183 return (0); 5184} 5185 5186int 5187getservice(char *n) 5188{ 5189 struct servent *s; 5190 u_long ulval; 5191 5192 if (atoul(n, &ulval) == 0) { 5193 if (ulval > 65535) { 5194 yyerror("illegal port value %lu", ulval); 5195 return (-1); 5196 } 5197 return (htons(ulval)); 5198 } else { 5199 s = getservbyname(n, "tcp"); 5200 if (s == NULL) 5201 s = getservbyname(n, "udp"); 5202 if (s == NULL) { 5203 yyerror("unknown port %s", n); 5204 return (-1); 5205 } 5206 return (s->s_port); 5207 } 5208} 5209 5210int 5211rule_label(struct pf_rule *r, char *s) 5212{ 5213 if (s) { 5214 if (strlcpy(r->label, s, sizeof(r->label)) >= 5215 sizeof(r->label)) { 5216 yyerror("rule label too long (max %d chars)", 5217 sizeof(r->label)-1); 5218 return (-1); 5219 } 5220 } 5221 return (0); 5222} 5223 5224u_int16_t 5225parseicmpspec(char *w, sa_family_t af) 5226{ 5227 const struct icmpcodeent *p; 5228 u_long ulval; 5229 u_int8_t icmptype; 5230 5231 if (af == AF_INET) 5232 icmptype = returnicmpdefault >> 8; 5233 else 5234 icmptype = returnicmp6default >> 8; 5235 5236 if (atoul(w, &ulval) == -1) { 5237 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5238 yyerror("unknown icmp code %s", w); 5239 return (0); 5240 } 5241 ulval = p->code; 5242 } 5243 if (ulval > 255) { 5244 yyerror("invalid icmp code %lu", ulval); 5245 return (0); 5246 } 5247 return (icmptype << 8 | ulval); 5248} 5249 5250int 5251pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans) 5252{ 5253 struct loadanchors *la; 5254 FILE *fin; 5255 5256 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5257 if (opts & PF_OPT_VERBOSE) 5258 fprintf(stderr, "\nLoading anchor %s from %s\n", 5259 la->anchorname, la->filename); 5260 if ((fin = pfctl_fopen(la->filename, "r")) == NULL) { 5261 warn("%s", la->filename); 5262 continue; 5263 } 5264 if (pfctl_rules(dev, la->filename, fin, opts, la->anchorname, 5265 trans) == -1) 5266 return (-1); 5267 } 5268 5269 return (0); 5270} 5271 5272