parse.y revision 1.576
1/* $OpenBSD: parse.y,v 1.576 2009/12/10 15:57:20 deraadt Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/types.h> 31#include <sys/socket.h> 32#include <sys/stat.h> 33#include <net/if.h> 34#include <netinet/in.h> 35#include <netinet/in_systm.h> 36#include <netinet/ip.h> 37#include <netinet/ip_icmp.h> 38#include <netinet/icmp6.h> 39#include <net/pfvar.h> 40#include <arpa/inet.h> 41#include <altq/altq.h> 42#include <altq/altq_cbq.h> 43#include <altq/altq_priq.h> 44#include <altq/altq_hfsc.h> 45 46#include <stdio.h> 47#include <unistd.h> 48#include <stdlib.h> 49#include <netdb.h> 50#include <stdarg.h> 51#include <errno.h> 52#include <string.h> 53#include <ctype.h> 54#include <math.h> 55#include <err.h> 56#include <limits.h> 57#include <pwd.h> 58#include <grp.h> 59#include <md5.h> 60 61#include "pfctl_parser.h" 62#include "pfctl.h" 63 64static struct pfctl *pf = NULL; 65static int debug = 0; 66static int rulestate = 0; 67static u_int16_t returnicmpdefault = 68 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 69static u_int16_t returnicmp6default = 70 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 71static int blockpolicy = PFRULE_DROP; 72static int require_order = 0; 73static int default_statelock; 74 75TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 76static struct file { 77 TAILQ_ENTRY(file) entry; 78 FILE *stream; 79 char *name; 80 int lineno; 81 int errors; 82} *file; 83struct file *pushfile(const char *, int); 84int popfile(void); 85int check_file_secrecy(int, const char *); 86int yyparse(void); 87int yylex(void); 88int yyerror(const char *, ...); 89int kw_cmp(const void *, const void *); 90int lookup(char *); 91int lgetc(int); 92int lungetc(int); 93int findeol(void); 94 95TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 96struct sym { 97 TAILQ_ENTRY(sym) entry; 98 int used; 99 int persist; 100 char *nam; 101 char *val; 102}; 103int symset(const char *, const char *, int); 104char *symget(const char *); 105 106int atoul(char *, u_long *); 107 108enum { 109 PFCTL_STATE_NONE, 110 PFCTL_STATE_OPTION, 111 PFCTL_STATE_QUEUE, 112 PFCTL_STATE_NAT, 113 PFCTL_STATE_FILTER 114}; 115 116struct node_proto { 117 u_int8_t proto; 118 struct node_proto *next; 119 struct node_proto *tail; 120}; 121 122struct node_port { 123 u_int16_t port[2]; 124 u_int8_t op; 125 struct node_port *next; 126 struct node_port *tail; 127}; 128 129struct node_uid { 130 uid_t uid[2]; 131 u_int8_t op; 132 struct node_uid *next; 133 struct node_uid *tail; 134}; 135 136struct node_gid { 137 gid_t gid[2]; 138 u_int8_t op; 139 struct node_gid *next; 140 struct node_gid *tail; 141}; 142 143struct node_icmp { 144 u_int8_t code; 145 u_int8_t type; 146 u_int8_t proto; 147 struct node_icmp *next; 148 struct node_icmp *tail; 149}; 150 151enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 152 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 153 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 154 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 155 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, 156 PF_STATE_OPT_PFLOW }; 157 158enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 159 160struct node_state_opt { 161 int type; 162 union { 163 u_int32_t max_states; 164 u_int32_t max_src_states; 165 u_int32_t max_src_conn; 166 struct { 167 u_int32_t limit; 168 u_int32_t seconds; 169 } max_src_conn_rate; 170 struct { 171 u_int8_t flush; 172 char tblname[PF_TABLE_NAME_SIZE]; 173 } overload; 174 u_int32_t max_src_nodes; 175 u_int8_t src_track; 176 u_int32_t statelock; 177 struct { 178 int number; 179 u_int32_t seconds; 180 } timeout; 181 } data; 182 struct node_state_opt *next; 183 struct node_state_opt *tail; 184}; 185 186struct peer { 187 struct node_host *host; 188 struct node_port *port; 189}; 190 191struct node_queue { 192 char queue[PF_QNAME_SIZE]; 193 char parent[PF_QNAME_SIZE]; 194 char ifname[IFNAMSIZ]; 195 int scheduler; 196 struct node_queue *next; 197 struct node_queue *tail; 198} *queues = NULL; 199 200struct node_qassign { 201 char *qname; 202 char *pqname; 203}; 204 205struct range { 206 int a; 207 int b; 208 int t; 209}; 210struct redirection { 211 struct node_host *host; 212 struct range rport; 213}; 214 215struct pool_opts { 216 int marker; 217#define POM_TYPE 0x01 218#define POM_STICKYADDRESS 0x02 219 u_int8_t opts; 220 int type; 221 int staticport; 222 struct pf_poolhashkey *key; 223 224} pool_opts; 225 226struct redirspec { 227 struct redirection *rdr; 228 struct pool_opts pool_opts; 229 int binat; 230}; 231 232struct filter_opts { 233 int marker; 234#define FOM_FLAGS 0x0001 235#define FOM_ICMP 0x0002 236#define FOM_TOS 0x0004 237#define FOM_KEEP 0x0008 238#define FOM_SRCTRACK 0x0010 239#define FOM_MINTTL 0x0020 240#define FOM_MAXMSS 0x0040 241#define FOM_SETTOS 0x0100 242#define FOM_SCRUB_TCP 0x0200 243 struct node_uid *uid; 244 struct node_gid *gid; 245 struct { 246 u_int8_t b1; 247 u_int8_t b2; 248 u_int16_t w; 249 u_int16_t w2; 250 } flags; 251 struct node_icmp *icmpspec; 252 u_int32_t tos; 253 u_int32_t prob; 254 struct { 255 int action; 256 struct node_state_opt *options; 257 } keep; 258 int fragment; 259 int allowopts; 260 char *label; 261 struct node_qassign queues; 262 char *tag; 263 char *match_tag; 264 u_int8_t match_tag_not; 265 u_int rtableid; 266 struct { 267 struct node_host *addr; 268 u_int16_t port; 269 } divert, divert_packet; 270 struct redirspec nat; 271 struct redirspec rdr; 272 struct redirspec rroute; 273 274 /* scrub opts */ 275 int nodf; 276 int minttl; 277 int settos; 278 int randomid; 279 int max_mss; 280 281 /* route opts */ 282 struct { 283 struct node_host *host; 284 u_int8_t rt; 285 u_int8_t pool_opts; 286 sa_family_t af; 287 struct pf_poolhashkey *key; 288 } route; 289} filter_opts; 290 291struct antispoof_opts { 292 char *label; 293 u_int rtableid; 294} antispoof_opts; 295 296struct scrub_opts { 297 int marker; 298 int nodf; 299 int minttl; 300 int maxmss; 301 int settos; 302 int randomid; 303 int reassemble_tcp; 304} scrub_opts; 305 306struct queue_opts { 307 int marker; 308#define QOM_BWSPEC 0x01 309#define QOM_SCHEDULER 0x02 310#define QOM_PRIORITY 0x04 311#define QOM_TBRSIZE 0x08 312#define QOM_QLIMIT 0x10 313 struct node_queue_bw queue_bwspec; 314 struct node_queue_opt scheduler; 315 int priority; 316 int tbrsize; 317 int qlimit; 318} queue_opts; 319 320struct table_opts { 321 int flags; 322 int init_addr; 323 struct node_tinithead init_nodes; 324} table_opts; 325 326struct node_hfsc_opts hfsc_opts; 327struct node_state_opt *keep_state_defaults = NULL; 328 329int disallow_table(struct node_host *, const char *); 330int disallow_urpf_failed(struct node_host *, const char *); 331int disallow_alias(struct node_host *, const char *); 332int rule_consistent(struct pf_rule *, int); 333int process_tabledef(char *, struct table_opts *); 334void expand_label_str(char *, size_t, const char *, const char *); 335void expand_label_if(const char *, char *, size_t, const char *); 336void expand_label_addr(const char *, char *, size_t, u_int8_t, 337 struct node_host *); 338void expand_label_port(const char *, char *, size_t, 339 struct node_port *); 340void expand_label_proto(const char *, char *, size_t, u_int8_t); 341void expand_label_nr(const char *, char *, size_t); 342void expand_label(char *, size_t, const char *, u_int8_t, 343 struct node_host *, struct node_port *, struct node_host *, 344 struct node_port *, u_int8_t); 345int apply_redirspec(struct pf_pool *, struct pf_rule *, 346 struct redirspec *, int, struct node_port *); 347void expand_rule(struct pf_rule *, int, struct node_if *, 348 struct redirspec *, struct redirspec *, struct redirspec *, 349 struct node_proto *, 350 struct node_os *, struct node_host *, struct node_port *, 351 struct node_host *, struct node_port *, struct node_uid *, 352 struct node_gid *, struct node_icmp *, const char *); 353int expand_altq(struct pf_altq *, struct node_if *, 354 struct node_queue *, struct node_queue_bw bwspec, 355 struct node_queue_opt *); 356int expand_queue(struct pf_altq *, struct node_if *, 357 struct node_queue *, struct node_queue_bw, 358 struct node_queue_opt *); 359int expand_skip_interface(struct node_if *); 360 361int check_rulestate(int); 362int getservice(char *); 363int rule_label(struct pf_rule *, char *); 364 365void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 366void decide_address_family(struct node_host *, sa_family_t *); 367void remove_invalid_hosts(struct node_host **, sa_family_t *); 368int invalid_redirect(struct node_host *, sa_family_t); 369u_int16_t parseicmpspec(char *, sa_family_t); 370int kw_casecmp(const void *, const void *); 371int map_tos(char *string, int *); 372 373TAILQ_HEAD(loadanchorshead, loadanchors) 374 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 375 376struct loadanchors { 377 TAILQ_ENTRY(loadanchors) entries; 378 char *anchorname; 379 char *filename; 380}; 381 382typedef struct { 383 union { 384 int64_t number; 385 double probability; 386 int i; 387 char *string; 388 u_int rtableid; 389 struct { 390 u_int8_t b1; 391 u_int8_t b2; 392 u_int16_t w; 393 u_int16_t w2; 394 } b; 395 struct range range; 396 struct node_if *interface; 397 struct node_proto *proto; 398 struct node_icmp *icmp; 399 struct node_host *host; 400 struct node_os *os; 401 struct node_port *port; 402 struct node_uid *uid; 403 struct node_gid *gid; 404 struct node_state_opt *state_opt; 405 struct peer peer; 406 struct { 407 struct peer src, dst; 408 struct node_os *src_os; 409 } fromto; 410 struct redirection *redirection; 411 struct { 412 int action; 413 struct node_state_opt *options; 414 } keep_state; 415 struct { 416 u_int8_t log; 417 u_int8_t logif; 418 u_int8_t quick; 419 } logquick; 420 struct { 421 int neg; 422 char *name; 423 } tagged; 424 struct pf_poolhashkey *hashkey; 425 struct node_queue *queue; 426 struct node_queue_opt queue_options; 427 struct node_queue_bw queue_bwspec; 428 struct node_qassign qassign; 429 struct filter_opts filter_opts; 430 struct antispoof_opts antispoof_opts; 431 struct queue_opts queue_opts; 432 struct scrub_opts scrub_opts; 433 struct table_opts table_opts; 434 struct pool_opts pool_opts; 435 struct node_hfsc_opts hfsc_opts; 436 } v; 437 int lineno; 438} YYSTYPE; 439 440#define PPORT_RANGE 1 441#define PPORT_STAR 2 442int parseport(char *, struct range *r, int); 443 444#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 445 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 446 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 447 448%} 449 450%token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 451%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 452%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINATTO NODF 453%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 454%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 455%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 456%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 457%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 458%token ANTISPOOF FOR INCLUDE 459%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 460%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 461%token QUEUE PRIORITY QLIMIT RTABLE 462%token LOAD RULESET_OPTIMIZATION 463%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 464%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW 465%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 466%token DIVERTTO DIVERTREPLY DIVERTPACKET NATTO RDRTO 467%token <v.string> STRING 468%token <v.number> NUMBER 469%token <v.i> PORTBINARY 470%type <v.interface> interface if_list if_item_not if_item 471%type <v.number> number icmptype icmp6type uid gid 472%type <v.number> tos not yesno optnodf 473%type <v.probability> probability 474%type <v.i> dir af optimizer 475%type <v.i> sourcetrack flush unaryop statelock 476%type <v.b> action 477%type <v.b> flags flag blockspec 478%type <v.range> portplain portstar portrange 479%type <v.hashkey> hashkey 480%type <v.proto> proto proto_list proto_item 481%type <v.number> protoval 482%type <v.icmp> icmpspec 483%type <v.icmp> icmp_list icmp_item 484%type <v.icmp> icmp6_list icmp6_item 485%type <v.number> reticmpspec reticmp6spec 486%type <v.fromto> fromto 487%type <v.peer> ipportspec from to 488%type <v.host> ipspec xhost host dynaddr host_list 489%type <v.host> redir_host_list redirspec 490%type <v.host> route_host route_host_list routespec 491%type <v.os> os xos os_list 492%type <v.port> portspec port_list port_item 493%type <v.uid> uids uid_list uid_item 494%type <v.gid> gids gid_list gid_item 495%type <v.redirection> redirpool 496%type <v.string> label stringall anchorname 497%type <v.string> string varstring numberstring 498%type <v.keep_state> keep 499%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 500%type <v.logquick> logquick quick log logopts logopt 501%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 502%type <v.qassign> qname 503%type <v.queue> qassign qassign_list qassign_item 504%type <v.queue_options> scheduler 505%type <v.number> cbqflags_list cbqflags_item 506%type <v.number> priqflags_list priqflags_item 507%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 508%type <v.queue_bwspec> bandwidth 509%type <v.filter_opts> filter_opts filter_opt filter_opts_l 510%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 511%type <v.queue_opts> queue_opts queue_opt queue_opts_l 512%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 513%type <v.table_opts> table_opts table_opt table_opts_l 514%type <v.pool_opts> pool_opts pool_opt pool_opts_l 515%% 516 517ruleset : /* empty */ 518 | ruleset include '\n' 519 | ruleset '\n' 520 | ruleset option '\n' 521 | ruleset pfrule '\n' 522 | ruleset anchorrule '\n' 523 | ruleset loadrule '\n' 524 | ruleset altqif '\n' 525 | ruleset queuespec '\n' 526 | ruleset varset '\n' 527 | ruleset antispoof '\n' 528 | ruleset tabledef '\n' 529 | '{' fakeanchor '}' '\n'; 530 | ruleset error '\n' { file->errors++; } 531 ; 532 533include : INCLUDE STRING { 534 struct file *nfile; 535 536 if ((nfile = pushfile($2, 0)) == NULL) { 537 yyerror("failed to include file %s", $2); 538 free($2); 539 YYERROR; 540 } 541 free($2); 542 543 file = nfile; 544 lungetc('\n'); 545 } 546 ; 547 548/* 549 * apply to previouslys specified rule: must be careful to note 550 * what that is: pf or nat or binat or rdr 551 */ 552fakeanchor : fakeanchor '\n' 553 | fakeanchor anchorrule '\n' 554 | fakeanchor pfrule '\n' 555 | fakeanchor error '\n' 556 ; 557 558optimizer : string { 559 if (!strcmp($1, "none")) 560 $$ = 0; 561 else if (!strcmp($1, "basic")) 562 $$ = PF_OPTIMIZE_BASIC; 563 else if (!strcmp($1, "profile")) 564 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 565 else { 566 yyerror("unknown ruleset-optimization %s", $1); 567 YYERROR; 568 } 569 } 570 ; 571 572optnodf : /* empty */ { $$ = 0; } 573 | NODF { $$ = 1; } 574 ; 575 576option : SET REASSEMBLE yesno optnodf { 577 if (check_rulestate(PFCTL_STATE_OPTION)) 578 YYERROR; 579 pfctl_set_reassembly(pf, $3, $4); 580 } 581 | SET OPTIMIZATION STRING { 582 if (check_rulestate(PFCTL_STATE_OPTION)) { 583 free($3); 584 YYERROR; 585 } 586 if (pfctl_set_optimization(pf, $3) != 0) { 587 yyerror("unknown optimization %s", $3); 588 free($3); 589 YYERROR; 590 } 591 free($3); 592 } 593 | SET RULESET_OPTIMIZATION optimizer { 594 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 595 pf->opts |= PF_OPT_OPTIMIZE; 596 pf->optimize = $3; 597 } 598 } 599 | SET TIMEOUT timeout_spec 600 | SET TIMEOUT '{' optnl timeout_list '}' 601 | SET LIMIT limit_spec 602 | SET LIMIT '{' optnl limit_list '}' 603 | SET LOGINTERFACE stringall { 604 if (check_rulestate(PFCTL_STATE_OPTION)) { 605 free($3); 606 YYERROR; 607 } 608 if (pfctl_set_logif(pf, $3) != 0) { 609 yyerror("error setting loginterface %s", $3); 610 free($3); 611 YYERROR; 612 } 613 free($3); 614 } 615 | SET HOSTID number { 616 if ($3 == 0 || $3 > UINT_MAX) { 617 yyerror("hostid must be non-zero"); 618 YYERROR; 619 } 620 if (pfctl_set_hostid(pf, $3) != 0) { 621 yyerror("error setting hostid %08x", $3); 622 YYERROR; 623 } 624 } 625 | SET BLOCKPOLICY DROP { 626 if (pf->opts & PF_OPT_VERBOSE) 627 printf("set block-policy drop\n"); 628 if (check_rulestate(PFCTL_STATE_OPTION)) 629 YYERROR; 630 blockpolicy = PFRULE_DROP; 631 } 632 | SET BLOCKPOLICY RETURN { 633 if (pf->opts & PF_OPT_VERBOSE) 634 printf("set block-policy return\n"); 635 if (check_rulestate(PFCTL_STATE_OPTION)) 636 YYERROR; 637 blockpolicy = PFRULE_RETURN; 638 } 639 | SET REQUIREORDER yesno { 640 if (pf->opts & PF_OPT_VERBOSE) 641 printf("set require-order %s\n", 642 $3 == 1 ? "yes" : "no"); 643 require_order = $3; 644 } 645 | SET FINGERPRINTS STRING { 646 if (pf->opts & PF_OPT_VERBOSE) 647 printf("set fingerprints \"%s\"\n", $3); 648 if (check_rulestate(PFCTL_STATE_OPTION)) { 649 free($3); 650 YYERROR; 651 } 652 if (!pf->anchor->name[0]) { 653 if (pfctl_file_fingerprints(pf->dev, 654 pf->opts, $3)) { 655 yyerror("error loading " 656 "fingerprints %s", $3); 657 free($3); 658 YYERROR; 659 } 660 } 661 free($3); 662 } 663 | SET STATEPOLICY statelock { 664 if (pf->opts & PF_OPT_VERBOSE) 665 switch ($3) { 666 case 0: 667 printf("set state-policy floating\n"); 668 break; 669 case PFRULE_IFBOUND: 670 printf("set state-policy if-bound\n"); 671 break; 672 } 673 default_statelock = $3; 674 } 675 | SET DEBUG STRING { 676 if (check_rulestate(PFCTL_STATE_OPTION)) { 677 free($3); 678 YYERROR; 679 } 680 if (pfctl_set_debug(pf, $3) != 0) { 681 yyerror("error setting debuglevel %s", $3); 682 free($3); 683 YYERROR; 684 } 685 free($3); 686 } 687 | SET SKIP interface { 688 if (expand_skip_interface($3) != 0) { 689 yyerror("error setting skip interface(s)"); 690 YYERROR; 691 } 692 } 693 | SET STATEDEFAULTS state_opt_list { 694 if (keep_state_defaults != NULL) { 695 yyerror("cannot redefine state-defaults"); 696 YYERROR; 697 } 698 keep_state_defaults = $3; 699 } 700 ; 701 702stringall : STRING { $$ = $1; } 703 | ALL { 704 if (($$ = strdup("all")) == NULL) { 705 err(1, "stringall: strdup"); 706 } 707 } 708 ; 709 710string : STRING string { 711 if (asprintf(&$$, "%s %s", $1, $2) == -1) 712 err(1, "string: asprintf"); 713 free($1); 714 free($2); 715 } 716 | STRING 717 ; 718 719varstring : numberstring varstring { 720 if (asprintf(&$$, "%s %s", $1, $2) == -1) 721 err(1, "string: asprintf"); 722 free($1); 723 free($2); 724 } 725 | numberstring 726 ; 727 728numberstring : NUMBER { 729 char *s; 730 if (asprintf(&s, "%lld", $1) == -1) { 731 yyerror("string: asprintf"); 732 YYERROR; 733 } 734 $$ = s; 735 } 736 | STRING 737 ; 738 739varset : STRING '=' varstring { 740 if (pf->opts & PF_OPT_VERBOSE) 741 printf("%s = \"%s\"\n", $1, $3); 742 if (symset($1, $3, 0) == -1) 743 err(1, "cannot store variable %s", $1); 744 free($1); 745 free($3); 746 } 747 ; 748 749anchorname : STRING { $$ = $1; } 750 | /* empty */ { $$ = NULL; } 751 ; 752 753pfa_anchorlist : /* empty */ 754 | pfa_anchorlist '\n' 755 | pfa_anchorlist pfrule '\n' 756 | pfa_anchorlist anchorrule '\n' 757 ; 758 759pfa_anchor : '{' 760 { 761 char ta[PF_ANCHOR_NAME_SIZE]; 762 struct pf_ruleset *rs; 763 764 /* steping into a brace anchor */ 765 pf->asd++; 766 pf->bn++; 767 pf->brace = 1; 768 769 /* create a holding ruleset in the root */ 770 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 771 rs = pf_find_or_create_ruleset(ta); 772 if (rs == NULL) 773 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 774 pf->astack[pf->asd] = rs->anchor; 775 pf->anchor = rs->anchor; 776 } '\n' pfa_anchorlist '}' 777 { 778 pf->alast = pf->anchor; 779 pf->asd--; 780 pf->anchor = pf->astack[pf->asd]; 781 } 782 | /* empty */ 783 ; 784 785anchorrule : ANCHOR anchorname dir quick interface af proto fromto 786 filter_opts pfa_anchor 787 { 788 struct pf_rule r; 789 struct node_proto *proto; 790 791 if (check_rulestate(PFCTL_STATE_FILTER)) { 792 if ($2) 793 free($2); 794 YYERROR; 795 } 796 797 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 798 free($2); 799 yyerror("anchor names beginning with '_' " 800 "are reserved for internal use"); 801 YYERROR; 802 } 803 804 memset(&r, 0, sizeof(r)); 805 if (pf->astack[pf->asd + 1]) { 806 /* move inline rules into relative location */ 807 pf_anchor_setup(&r, 808 &pf->astack[pf->asd]->ruleset, 809 $2 ? $2 : pf->alast->name); 810 811 if (r.anchor == NULL) 812 err(1, "anchorrule: unable to " 813 "create ruleset"); 814 815 if (pf->alast != r.anchor) { 816 if (r.anchor->match) { 817 yyerror("inline anchor '%s' " 818 "already exists", 819 r.anchor->name); 820 YYERROR; 821 } 822 mv_rules(&pf->alast->ruleset, 823 &r.anchor->ruleset); 824 } 825 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 826 pf->alast = r.anchor; 827 } else { 828 if (!$2) { 829 yyerror("anchors without explicit " 830 "rules must specify a name"); 831 YYERROR; 832 } 833 } 834 r.direction = $3; 835 r.quick = $4.quick; 836 r.af = $6; 837 r.prob = $9.prob; 838 r.rtableid = $9.rtableid; 839 840 if ($9.tag) 841 if (strlcpy(r.tagname, $9.tag, 842 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 843 yyerror("tag too long, max %u chars", 844 PF_TAG_NAME_SIZE - 1); 845 YYERROR; 846 } 847 if ($9.match_tag) 848 if (strlcpy(r.match_tagname, $9.match_tag, 849 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 850 yyerror("tag too long, max %u chars", 851 PF_TAG_NAME_SIZE - 1); 852 YYERROR; 853 } 854 r.match_tag_not = $9.match_tag_not; 855 if (rule_label(&r, $9.label)) 856 YYERROR; 857 free($9.label); 858 r.flags = $9.flags.b1; 859 r.flagset = $9.flags.b2; 860 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 861 yyerror("flags always false"); 862 YYERROR; 863 } 864 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 865 for (proto = $7; proto != NULL && 866 proto->proto != IPPROTO_TCP; 867 proto = proto->next) 868 ; /* nothing */ 869 if (proto == NULL && $7 != NULL) { 870 if ($9.flags.b1 || $9.flags.b2) 871 yyerror( 872 "flags only apply to tcp"); 873 if ($8.src_os) 874 yyerror( 875 "OS fingerprinting only " 876 "applies to tcp"); 877 YYERROR; 878 } 879 } 880 881 r.tos = $9.tos; 882 883 if ($9.keep.action) { 884 yyerror("cannot specify state handling " 885 "on anchors"); 886 YYERROR; 887 } 888 889 if ($9.route.rt) { 890 yyerror("cannot specify route handling " 891 "on anchors"); 892 YYERROR; 893 } 894 895 if ($9.match_tag) 896 if (strlcpy(r.match_tagname, $9.match_tag, 897 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 898 yyerror("tag too long, max %u chars", 899 PF_TAG_NAME_SIZE - 1); 900 YYERROR; 901 } 902 r.match_tag_not = $9.match_tag_not; 903 904 decide_address_family($8.src.host, &r.af); 905 decide_address_family($8.dst.host, &r.af); 906 907 expand_rule(&r, 0, $5, NULL, NULL, NULL, $7, $8.src_os, 908 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 909 $9.uid, $9.gid, $9.icmpspec, 910 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 911 free($2); 912 pf->astack[pf->asd + 1] = NULL; 913 } 914 ; 915 916loadrule : LOAD ANCHOR string FROM string { 917 struct loadanchors *loadanchor; 918 919 if (strlen(pf->anchor->name) + 1 + 920 strlen($3) >= MAXPATHLEN) { 921 yyerror("anchorname %s too long, max %u\n", 922 $3, MAXPATHLEN - 1); 923 free($3); 924 YYERROR; 925 } 926 loadanchor = calloc(1, sizeof(struct loadanchors)); 927 if (loadanchor == NULL) 928 err(1, "loadrule: calloc"); 929 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 930 NULL) 931 err(1, "loadrule: malloc"); 932 if (pf->anchor->name[0]) 933 snprintf(loadanchor->anchorname, MAXPATHLEN, 934 "%s/%s", pf->anchor->name, $3); 935 else 936 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 937 if ((loadanchor->filename = strdup($5)) == NULL) 938 err(1, "loadrule: strdup"); 939 940 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 941 entries); 942 943 free($3); 944 free($5); 945 }; 946 947scrub_opts : { 948 bzero(&scrub_opts, sizeof scrub_opts); 949 } 950 scrub_opts_l 951 { $$ = scrub_opts; } 952 ; 953 954scrub_opts_l : scrub_opts_l comma scrub_opt 955 | scrub_opt 956 ; 957 958scrub_opt : NODF { 959 if (scrub_opts.nodf) { 960 yyerror("no-df cannot be respecified"); 961 YYERROR; 962 } 963 scrub_opts.nodf = 1; 964 } 965 | MINTTL NUMBER { 966 if (scrub_opts.marker & FOM_MINTTL) { 967 yyerror("min-ttl cannot be respecified"); 968 YYERROR; 969 } 970 if ($2 < 0 || $2 > 255) { 971 yyerror("illegal min-ttl value %d", $2); 972 YYERROR; 973 } 974 scrub_opts.marker |= FOM_MINTTL; 975 scrub_opts.minttl = $2; 976 } 977 | MAXMSS NUMBER { 978 if (scrub_opts.marker & FOM_MAXMSS) { 979 yyerror("max-mss cannot be respecified"); 980 YYERROR; 981 } 982 if ($2 < 0 || $2 > 65535) { 983 yyerror("illegal max-mss value %d", $2); 984 YYERROR; 985 } 986 scrub_opts.marker |= FOM_MAXMSS; 987 scrub_opts.maxmss = $2; 988 } 989 | SETTOS tos { 990 if (scrub_opts.marker & FOM_SETTOS) { 991 yyerror("set-tos cannot be respecified"); 992 YYERROR; 993 } 994 scrub_opts.marker |= FOM_SETTOS; 995 scrub_opts.settos = $2; 996 } 997 | REASSEMBLE STRING { 998 if (strcasecmp($2, "tcp") != 0) { 999 yyerror("scrub reassemble supports only tcp, " 1000 "not '%s'", $2); 1001 free($2); 1002 YYERROR; 1003 } 1004 free($2); 1005 if (scrub_opts.reassemble_tcp) { 1006 yyerror("reassemble tcp cannot be respecified"); 1007 YYERROR; 1008 } 1009 scrub_opts.reassemble_tcp = 1; 1010 } 1011 | RANDOMID { 1012 if (scrub_opts.randomid) { 1013 yyerror("random-id cannot be respecified"); 1014 YYERROR; 1015 } 1016 scrub_opts.randomid = 1; 1017 } 1018 ; 1019 1020antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1021 struct pf_rule r; 1022 struct node_host *h = NULL, *hh; 1023 struct node_if *i, *j; 1024 1025 if (check_rulestate(PFCTL_STATE_FILTER)) 1026 YYERROR; 1027 1028 for (i = $3; i; i = i->next) { 1029 bzero(&r, sizeof(r)); 1030 1031 r.action = PF_DROP; 1032 r.direction = PF_IN; 1033 r.log = $2.log; 1034 r.logif = $2.logif; 1035 r.quick = $2.quick; 1036 r.af = $4; 1037 if (rule_label(&r, $5.label)) 1038 YYERROR; 1039 r.rtableid = $5.rtableid; 1040 j = calloc(1, sizeof(struct node_if)); 1041 if (j == NULL) 1042 err(1, "antispoof: calloc"); 1043 if (strlcpy(j->ifname, i->ifname, 1044 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1045 free(j); 1046 yyerror("interface name too long"); 1047 YYERROR; 1048 } 1049 j->not = 1; 1050 if (i->dynamic) { 1051 h = calloc(1, sizeof(*h)); 1052 if (h == NULL) 1053 err(1, "address: calloc"); 1054 h->addr.type = PF_ADDR_DYNIFTL; 1055 set_ipmask(h, 128); 1056 if (strlcpy(h->addr.v.ifname, i->ifname, 1057 sizeof(h->addr.v.ifname)) >= 1058 sizeof(h->addr.v.ifname)) { 1059 free(h); 1060 yyerror( 1061 "interface name too long"); 1062 YYERROR; 1063 } 1064 hh = malloc(sizeof(*hh)); 1065 if (hh == NULL) 1066 err(1, "address: malloc"); 1067 bcopy(h, hh, sizeof(*hh)); 1068 h->addr.iflags = PFI_AFLAG_NETWORK; 1069 } else { 1070 h = ifa_lookup(j->ifname, 1071 PFI_AFLAG_NETWORK); 1072 hh = NULL; 1073 } 1074 1075 if (h != NULL) 1076 expand_rule(&r, 0, j, NULL, NULL, NULL, 1077 NULL, NULL, h, NULL, NULL, NULL, 1078 NULL, NULL, NULL, ""); 1079 1080 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1081 bzero(&r, sizeof(r)); 1082 1083 r.action = PF_DROP; 1084 r.direction = PF_IN; 1085 r.log = $2.log; 1086 r.logif = $2.logif; 1087 r.quick = $2.quick; 1088 r.af = $4; 1089 if (rule_label(&r, $5.label)) 1090 YYERROR; 1091 r.rtableid = $5.rtableid; 1092 if (hh != NULL) 1093 h = hh; 1094 else 1095 h = ifa_lookup(i->ifname, 0); 1096 if (h != NULL) 1097 expand_rule(&r, 0, NULL, NULL, 1098 NULL, NULL, NULL, NULL, h, 1099 NULL, NULL, NULL, NULL, 1100 NULL, NULL, ""); 1101 } else 1102 free(hh); 1103 } 1104 free($5.label); 1105 } 1106 ; 1107 1108antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1109 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1110 ; 1111 1112antispoof_iflst : antispoof_if optnl { $$ = $1; } 1113 | antispoof_iflst comma antispoof_if optnl { 1114 $1->tail->next = $3; 1115 $1->tail = $3; 1116 $$ = $1; 1117 } 1118 ; 1119 1120antispoof_if : if_item { $$ = $1; } 1121 | '(' if_item ')' { 1122 $2->dynamic = 1; 1123 $$ = $2; 1124 } 1125 ; 1126 1127antispoof_opts : { 1128 bzero(&antispoof_opts, sizeof antispoof_opts); 1129 antispoof_opts.rtableid = -1; 1130 } 1131 antispoof_opts_l 1132 { $$ = antispoof_opts; } 1133 | /* empty */ { 1134 bzero(&antispoof_opts, sizeof antispoof_opts); 1135 antispoof_opts.rtableid = -1; 1136 $$ = antispoof_opts; 1137 } 1138 ; 1139 1140antispoof_opts_l : antispoof_opts_l antispoof_opt 1141 | antispoof_opt 1142 ; 1143 1144antispoof_opt : label { 1145 if (antispoof_opts.label) { 1146 yyerror("label cannot be redefined"); 1147 YYERROR; 1148 } 1149 antispoof_opts.label = $1; 1150 } 1151 | RTABLE NUMBER { 1152 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 1153 yyerror("invalid rtable id"); 1154 YYERROR; 1155 } 1156 antispoof_opts.rtableid = $2; 1157 } 1158 ; 1159 1160not : '!' { $$ = 1; } 1161 | /* empty */ { $$ = 0; } 1162 ; 1163 1164tabledef : TABLE '<' STRING '>' table_opts { 1165 struct node_host *h, *nh; 1166 struct node_tinit *ti, *nti; 1167 1168 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1169 yyerror("table name too long, max %d chars", 1170 PF_TABLE_NAME_SIZE - 1); 1171 free($3); 1172 YYERROR; 1173 } 1174 if (pf->loadopt & PFCTL_FLAG_TABLE) 1175 if (process_tabledef($3, &$5)) { 1176 free($3); 1177 YYERROR; 1178 } 1179 free($3); 1180 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1181 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1182 if (ti->file) 1183 free(ti->file); 1184 for (h = ti->host; h != NULL; h = nh) { 1185 nh = h->next; 1186 free(h); 1187 } 1188 nti = SIMPLEQ_NEXT(ti, entries); 1189 free(ti); 1190 } 1191 } 1192 ; 1193 1194table_opts : { 1195 bzero(&table_opts, sizeof table_opts); 1196 SIMPLEQ_INIT(&table_opts.init_nodes); 1197 } 1198 table_opts_l 1199 { $$ = table_opts; } 1200 | /* empty */ 1201 { 1202 bzero(&table_opts, sizeof table_opts); 1203 SIMPLEQ_INIT(&table_opts.init_nodes); 1204 $$ = table_opts; 1205 } 1206 ; 1207 1208table_opts_l : table_opts_l table_opt 1209 | table_opt 1210 ; 1211 1212table_opt : STRING { 1213 if (!strcmp($1, "const")) 1214 table_opts.flags |= PFR_TFLAG_CONST; 1215 else if (!strcmp($1, "persist")) 1216 table_opts.flags |= PFR_TFLAG_PERSIST; 1217 else if (!strcmp($1, "counters")) 1218 table_opts.flags |= PFR_TFLAG_COUNTERS; 1219 else { 1220 yyerror("invalid table option '%s'", $1); 1221 free($1); 1222 YYERROR; 1223 } 1224 free($1); 1225 } 1226 | '{' optnl '}' { table_opts.init_addr = 1; } 1227 | '{' optnl host_list '}' { 1228 struct node_host *n; 1229 struct node_tinit *ti; 1230 1231 for (n = $3; n != NULL; n = n->next) { 1232 switch (n->addr.type) { 1233 case PF_ADDR_ADDRMASK: 1234 continue; /* ok */ 1235 case PF_ADDR_RANGE: 1236 yyerror("address ranges are not " 1237 "permitted inside tables"); 1238 break; 1239 case PF_ADDR_DYNIFTL: 1240 yyerror("dynamic addresses are not " 1241 "permitted inside tables"); 1242 break; 1243 case PF_ADDR_TABLE: 1244 yyerror("tables cannot contain tables"); 1245 break; 1246 case PF_ADDR_NOROUTE: 1247 yyerror("\"no-route\" is not permitted " 1248 "inside tables"); 1249 break; 1250 case PF_ADDR_URPFFAILED: 1251 yyerror("\"urpf-failed\" is not " 1252 "permitted inside tables"); 1253 break; 1254 default: 1255 yyerror("unknown address type %d", 1256 n->addr.type); 1257 } 1258 YYERROR; 1259 } 1260 if (!(ti = calloc(1, sizeof(*ti)))) 1261 err(1, "table_opt: calloc"); 1262 ti->host = $3; 1263 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1264 entries); 1265 table_opts.init_addr = 1; 1266 } 1267 | FILENAME STRING { 1268 struct node_tinit *ti; 1269 1270 if (!(ti = calloc(1, sizeof(*ti)))) 1271 err(1, "table_opt: calloc"); 1272 ti->file = $2; 1273 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1274 entries); 1275 table_opts.init_addr = 1; 1276 } 1277 ; 1278 1279altqif : ALTQ interface queue_opts QUEUE qassign { 1280 struct pf_altq a; 1281 1282 if (check_rulestate(PFCTL_STATE_QUEUE)) 1283 YYERROR; 1284 1285 memset(&a, 0, sizeof(a)); 1286 if ($3.scheduler.qtype == ALTQT_NONE) { 1287 yyerror("no scheduler specified!"); 1288 YYERROR; 1289 } 1290 a.scheduler = $3.scheduler.qtype; 1291 a.qlimit = $3.qlimit; 1292 a.tbrsize = $3.tbrsize; 1293 if ($5 == NULL) { 1294 yyerror("no child queues specified"); 1295 YYERROR; 1296 } 1297 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1298 &$3.scheduler)) 1299 YYERROR; 1300 } 1301 ; 1302 1303queuespec : QUEUE STRING interface queue_opts qassign { 1304 struct pf_altq a; 1305 1306 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1307 free($2); 1308 YYERROR; 1309 } 1310 1311 memset(&a, 0, sizeof(a)); 1312 1313 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1314 sizeof(a.qname)) { 1315 yyerror("queue name too long (max " 1316 "%d chars)", PF_QNAME_SIZE-1); 1317 free($2); 1318 YYERROR; 1319 } 1320 free($2); 1321 if ($4.tbrsize) { 1322 yyerror("cannot specify tbrsize for queue"); 1323 YYERROR; 1324 } 1325 if ($4.priority > 255) { 1326 yyerror("priority out of range: max 255"); 1327 YYERROR; 1328 } 1329 a.priority = $4.priority; 1330 a.qlimit = $4.qlimit; 1331 a.scheduler = $4.scheduler.qtype; 1332 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1333 &$4.scheduler)) { 1334 yyerror("errors in queue definition"); 1335 YYERROR; 1336 } 1337 } 1338 ; 1339 1340queue_opts : { 1341 bzero(&queue_opts, sizeof queue_opts); 1342 queue_opts.priority = DEFAULT_PRIORITY; 1343 queue_opts.qlimit = DEFAULT_QLIMIT; 1344 queue_opts.scheduler.qtype = ALTQT_NONE; 1345 queue_opts.queue_bwspec.bw_percent = 100; 1346 } 1347 queue_opts_l 1348 { $$ = queue_opts; } 1349 | /* empty */ { 1350 bzero(&queue_opts, sizeof queue_opts); 1351 queue_opts.priority = DEFAULT_PRIORITY; 1352 queue_opts.qlimit = DEFAULT_QLIMIT; 1353 queue_opts.scheduler.qtype = ALTQT_NONE; 1354 queue_opts.queue_bwspec.bw_percent = 100; 1355 $$ = queue_opts; 1356 } 1357 ; 1358 1359queue_opts_l : queue_opts_l queue_opt 1360 | queue_opt 1361 ; 1362 1363queue_opt : BANDWIDTH bandwidth { 1364 if (queue_opts.marker & QOM_BWSPEC) { 1365 yyerror("bandwidth cannot be respecified"); 1366 YYERROR; 1367 } 1368 queue_opts.marker |= QOM_BWSPEC; 1369 queue_opts.queue_bwspec = $2; 1370 } 1371 | PRIORITY NUMBER { 1372 if (queue_opts.marker & QOM_PRIORITY) { 1373 yyerror("priority cannot be respecified"); 1374 YYERROR; 1375 } 1376 if ($2 < 0 || $2 > 255) { 1377 yyerror("priority out of range: max 255"); 1378 YYERROR; 1379 } 1380 queue_opts.marker |= QOM_PRIORITY; 1381 queue_opts.priority = $2; 1382 } 1383 | QLIMIT NUMBER { 1384 if (queue_opts.marker & QOM_QLIMIT) { 1385 yyerror("qlimit cannot be respecified"); 1386 YYERROR; 1387 } 1388 if ($2 < 0 || $2 > 65535) { 1389 yyerror("qlimit out of range: max 65535"); 1390 YYERROR; 1391 } 1392 queue_opts.marker |= QOM_QLIMIT; 1393 queue_opts.qlimit = $2; 1394 } 1395 | scheduler { 1396 if (queue_opts.marker & QOM_SCHEDULER) { 1397 yyerror("scheduler cannot be respecified"); 1398 YYERROR; 1399 } 1400 queue_opts.marker |= QOM_SCHEDULER; 1401 queue_opts.scheduler = $1; 1402 } 1403 | TBRSIZE NUMBER { 1404 if (queue_opts.marker & QOM_TBRSIZE) { 1405 yyerror("tbrsize cannot be respecified"); 1406 YYERROR; 1407 } 1408 if ($2 < 0 || $2 > 65535) { 1409 yyerror("tbrsize too big: max 65535"); 1410 YYERROR; 1411 } 1412 queue_opts.marker |= QOM_TBRSIZE; 1413 queue_opts.tbrsize = $2; 1414 } 1415 ; 1416 1417bandwidth : STRING { 1418 double bps; 1419 char *cp; 1420 1421 $$.bw_percent = 0; 1422 1423 bps = strtod($1, &cp); 1424 if (cp != NULL) { 1425 if (!strcmp(cp, "b")) 1426 ; /* nothing */ 1427 else if (!strcmp(cp, "Kb")) 1428 bps *= 1000; 1429 else if (!strcmp(cp, "Mb")) 1430 bps *= 1000 * 1000; 1431 else if (!strcmp(cp, "Gb")) 1432 bps *= 1000 * 1000 * 1000; 1433 else if (!strcmp(cp, "%")) { 1434 if (bps < 0 || bps > 100) { 1435 yyerror("bandwidth spec " 1436 "out of range"); 1437 free($1); 1438 YYERROR; 1439 } 1440 $$.bw_percent = bps; 1441 bps = 0; 1442 } else { 1443 yyerror("unknown unit %s", cp); 1444 free($1); 1445 YYERROR; 1446 } 1447 } 1448 free($1); 1449 $$.bw_absolute = (u_int32_t)bps; 1450 } 1451 | NUMBER { 1452 if ($1 < 0 || $1 > UINT_MAX) { 1453 yyerror("bandwidth number too big"); 1454 YYERROR; 1455 } 1456 $$.bw_percent = 0; 1457 $$.bw_absolute = $1; 1458 } 1459 ; 1460 1461scheduler : CBQ { 1462 $$.qtype = ALTQT_CBQ; 1463 $$.data.cbq_opts.flags = 0; 1464 } 1465 | CBQ '(' cbqflags_list ')' { 1466 $$.qtype = ALTQT_CBQ; 1467 $$.data.cbq_opts.flags = $3; 1468 } 1469 | PRIQ { 1470 $$.qtype = ALTQT_PRIQ; 1471 $$.data.priq_opts.flags = 0; 1472 } 1473 | PRIQ '(' priqflags_list ')' { 1474 $$.qtype = ALTQT_PRIQ; 1475 $$.data.priq_opts.flags = $3; 1476 } 1477 | HFSC { 1478 $$.qtype = ALTQT_HFSC; 1479 bzero(&$$.data.hfsc_opts, 1480 sizeof(struct node_hfsc_opts)); 1481 } 1482 | HFSC '(' hfsc_opts ')' { 1483 $$.qtype = ALTQT_HFSC; 1484 $$.data.hfsc_opts = $3; 1485 } 1486 ; 1487 1488cbqflags_list : cbqflags_item { $$ |= $1; } 1489 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1490 ; 1491 1492cbqflags_item : STRING { 1493 if (!strcmp($1, "default")) 1494 $$ = CBQCLF_DEFCLASS; 1495 else if (!strcmp($1, "borrow")) 1496 $$ = CBQCLF_BORROW; 1497 else if (!strcmp($1, "red")) 1498 $$ = CBQCLF_RED; 1499 else if (!strcmp($1, "ecn")) 1500 $$ = CBQCLF_RED|CBQCLF_ECN; 1501 else if (!strcmp($1, "rio")) 1502 $$ = CBQCLF_RIO; 1503 else { 1504 yyerror("unknown cbq flag \"%s\"", $1); 1505 free($1); 1506 YYERROR; 1507 } 1508 free($1); 1509 } 1510 ; 1511 1512priqflags_list : priqflags_item { $$ |= $1; } 1513 | priqflags_list comma priqflags_item { $$ |= $3; } 1514 ; 1515 1516priqflags_item : STRING { 1517 if (!strcmp($1, "default")) 1518 $$ = PRCF_DEFAULTCLASS; 1519 else if (!strcmp($1, "red")) 1520 $$ = PRCF_RED; 1521 else if (!strcmp($1, "ecn")) 1522 $$ = PRCF_RED|PRCF_ECN; 1523 else if (!strcmp($1, "rio")) 1524 $$ = PRCF_RIO; 1525 else { 1526 yyerror("unknown priq flag \"%s\"", $1); 1527 free($1); 1528 YYERROR; 1529 } 1530 free($1); 1531 } 1532 ; 1533 1534hfsc_opts : { 1535 bzero(&hfsc_opts, 1536 sizeof(struct node_hfsc_opts)); 1537 } 1538 hfscopts_list { 1539 $$ = hfsc_opts; 1540 } 1541 ; 1542 1543hfscopts_list : hfscopts_item 1544 | hfscopts_list comma hfscopts_item 1545 ; 1546 1547hfscopts_item : LINKSHARE bandwidth { 1548 if (hfsc_opts.linkshare.used) { 1549 yyerror("linkshare already specified"); 1550 YYERROR; 1551 } 1552 hfsc_opts.linkshare.m2 = $2; 1553 hfsc_opts.linkshare.used = 1; 1554 } 1555 | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 1556 { 1557 if ($5 < 0 || $5 > INT_MAX) { 1558 yyerror("timing in curve out of range"); 1559 YYERROR; 1560 } 1561 if (hfsc_opts.linkshare.used) { 1562 yyerror("linkshare already specified"); 1563 YYERROR; 1564 } 1565 hfsc_opts.linkshare.m1 = $3; 1566 hfsc_opts.linkshare.d = $5; 1567 hfsc_opts.linkshare.m2 = $7; 1568 hfsc_opts.linkshare.used = 1; 1569 } 1570 | REALTIME bandwidth { 1571 if (hfsc_opts.realtime.used) { 1572 yyerror("realtime already specified"); 1573 YYERROR; 1574 } 1575 hfsc_opts.realtime.m2 = $2; 1576 hfsc_opts.realtime.used = 1; 1577 } 1578 | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 1579 { 1580 if ($5 < 0 || $5 > INT_MAX) { 1581 yyerror("timing in curve out of range"); 1582 YYERROR; 1583 } 1584 if (hfsc_opts.realtime.used) { 1585 yyerror("realtime already specified"); 1586 YYERROR; 1587 } 1588 hfsc_opts.realtime.m1 = $3; 1589 hfsc_opts.realtime.d = $5; 1590 hfsc_opts.realtime.m2 = $7; 1591 hfsc_opts.realtime.used = 1; 1592 } 1593 | UPPERLIMIT bandwidth { 1594 if (hfsc_opts.upperlimit.used) { 1595 yyerror("upperlimit already specified"); 1596 YYERROR; 1597 } 1598 hfsc_opts.upperlimit.m2 = $2; 1599 hfsc_opts.upperlimit.used = 1; 1600 } 1601 | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 1602 { 1603 if ($5 < 0 || $5 > INT_MAX) { 1604 yyerror("timing in curve out of range"); 1605 YYERROR; 1606 } 1607 if (hfsc_opts.upperlimit.used) { 1608 yyerror("upperlimit already specified"); 1609 YYERROR; 1610 } 1611 hfsc_opts.upperlimit.m1 = $3; 1612 hfsc_opts.upperlimit.d = $5; 1613 hfsc_opts.upperlimit.m2 = $7; 1614 hfsc_opts.upperlimit.used = 1; 1615 } 1616 | STRING { 1617 if (!strcmp($1, "default")) 1618 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1619 else if (!strcmp($1, "red")) 1620 hfsc_opts.flags |= HFCF_RED; 1621 else if (!strcmp($1, "ecn")) 1622 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1623 else if (!strcmp($1, "rio")) 1624 hfsc_opts.flags |= HFCF_RIO; 1625 else { 1626 yyerror("unknown hfsc flag \"%s\"", $1); 1627 free($1); 1628 YYERROR; 1629 } 1630 free($1); 1631 } 1632 ; 1633 1634qassign : /* empty */ { $$ = NULL; } 1635 | qassign_item { $$ = $1; } 1636 | '{' optnl qassign_list '}' { $$ = $3; } 1637 ; 1638 1639qassign_list : qassign_item optnl { $$ = $1; } 1640 | qassign_list comma qassign_item optnl { 1641 $1->tail->next = $3; 1642 $1->tail = $3; 1643 $$ = $1; 1644 } 1645 ; 1646 1647qassign_item : STRING { 1648 $$ = calloc(1, sizeof(struct node_queue)); 1649 if ($$ == NULL) 1650 err(1, "qassign_item: calloc"); 1651 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1652 sizeof($$->queue)) { 1653 yyerror("queue name '%s' too long (max " 1654 "%d chars)", $1, sizeof($$->queue)-1); 1655 free($1); 1656 free($$); 1657 YYERROR; 1658 } 1659 free($1); 1660 $$->next = NULL; 1661 $$->tail = $$; 1662 } 1663 ; 1664 1665pfrule : action dir logquick interface af proto fromto 1666 filter_opts 1667 { 1668 struct pf_rule r; 1669 struct node_state_opt *o; 1670 struct node_proto *proto; 1671 int srctrack = 0; 1672 int statelock = 0; 1673 int adaptive = 0; 1674 int defaults = 0; 1675 1676 if (check_rulestate(PFCTL_STATE_FILTER)) 1677 YYERROR; 1678 1679 memset(&r, 0, sizeof(r)); 1680 1681 r.action = $1.b1; 1682 switch ($1.b2) { 1683 case PFRULE_RETURNRST: 1684 r.rule_flag |= PFRULE_RETURNRST; 1685 r.return_ttl = $1.w; 1686 break; 1687 case PFRULE_RETURNICMP: 1688 r.rule_flag |= PFRULE_RETURNICMP; 1689 r.return_icmp = $1.w; 1690 r.return_icmp6 = $1.w2; 1691 break; 1692 case PFRULE_RETURN: 1693 r.rule_flag |= PFRULE_RETURN; 1694 r.return_icmp = $1.w; 1695 r.return_icmp6 = $1.w2; 1696 break; 1697 } 1698 r.direction = $2; 1699 r.log = $3.log; 1700 r.logif = $3.logif; 1701 r.quick = $3.quick; 1702 r.prob = $8.prob; 1703 r.rtableid = $8.rtableid; 1704 1705 if ($8.nodf) 1706 r.scrub_flags |= PFSTATE_NODF; 1707 if ($8.randomid) 1708 r.scrub_flags |= PFSTATE_RANDOMID; 1709 if ($8.minttl) 1710 r.min_ttl = $8.minttl; 1711 if ($8.max_mss) 1712 r.max_mss = $8.max_mss; 1713 if ($8.marker & FOM_SETTOS) { 1714 r.scrub_flags |= PFSTATE_SETTOS; 1715 r.set_tos = $8.settos; 1716 } 1717 if ($8.marker & FOM_SCRUB_TCP) 1718 r.scrub_flags |= PFSTATE_SCRUB_TCP; 1719 1720 r.af = $5; 1721 if ($8.tag) 1722 if (strlcpy(r.tagname, $8.tag, 1723 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1724 yyerror("tag too long, max %u chars", 1725 PF_TAG_NAME_SIZE - 1); 1726 YYERROR; 1727 } 1728 if ($8.match_tag) 1729 if (strlcpy(r.match_tagname, $8.match_tag, 1730 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1731 yyerror("tag too long, max %u chars", 1732 PF_TAG_NAME_SIZE - 1); 1733 YYERROR; 1734 } 1735 r.match_tag_not = $8.match_tag_not; 1736 if (rule_label(&r, $8.label)) 1737 YYERROR; 1738 free($8.label); 1739 r.flags = $8.flags.b1; 1740 r.flagset = $8.flags.b2; 1741 if (($8.flags.b1 & $8.flags.b2) != $8.flags.b1) { 1742 yyerror("flags always false"); 1743 YYERROR; 1744 } 1745 if ($8.flags.b1 || $8.flags.b2 || $7.src_os) { 1746 for (proto = $6; proto != NULL && 1747 proto->proto != IPPROTO_TCP; 1748 proto = proto->next) 1749 ; /* nothing */ 1750 if (proto == NULL && $6 != NULL) { 1751 if ($8.flags.b1 || $8.flags.b2) 1752 yyerror( 1753 "flags only apply to tcp"); 1754 if ($7.src_os) 1755 yyerror( 1756 "OS fingerprinting only " 1757 "apply to tcp"); 1758 YYERROR; 1759 } 1760#if 0 1761 if (($8.flags.b1 & parse_flags("S")) == 0 && 1762 $7.src_os) { 1763 yyerror("OS fingerprinting requires " 1764 "the SYN TCP flag (flags S/SA)"); 1765 YYERROR; 1766 } 1767#endif 1768 } 1769 1770 r.tos = $8.tos; 1771 r.keep_state = $8.keep.action; 1772 o = $8.keep.options; 1773 1774 /* 'keep state' by default on pass rules. */ 1775 if (!r.keep_state && !r.action && 1776 !($8.marker & FOM_KEEP)) { 1777 r.keep_state = PF_STATE_NORMAL; 1778 o = keep_state_defaults; 1779 defaults = 1; 1780 } 1781 1782 while (o) { 1783 struct node_state_opt *p = o; 1784 1785 switch (o->type) { 1786 case PF_STATE_OPT_MAX: 1787 if (r.max_states) { 1788 yyerror("state option 'max' " 1789 "multiple definitions"); 1790 YYERROR; 1791 } 1792 r.max_states = o->data.max_states; 1793 break; 1794 case PF_STATE_OPT_NOSYNC: 1795 if (r.rule_flag & PFRULE_NOSYNC) { 1796 yyerror("state option 'sync' " 1797 "multiple definitions"); 1798 YYERROR; 1799 } 1800 r.rule_flag |= PFRULE_NOSYNC; 1801 break; 1802 case PF_STATE_OPT_SRCTRACK: 1803 if (srctrack) { 1804 yyerror("state option " 1805 "'source-track' " 1806 "multiple definitions"); 1807 YYERROR; 1808 } 1809 srctrack = o->data.src_track; 1810 r.rule_flag |= PFRULE_SRCTRACK; 1811 break; 1812 case PF_STATE_OPT_MAX_SRC_STATES: 1813 if (r.max_src_states) { 1814 yyerror("state option " 1815 "'max-src-states' " 1816 "multiple definitions"); 1817 YYERROR; 1818 } 1819 if (o->data.max_src_states == 0) { 1820 yyerror("'max-src-states' must " 1821 "be > 0"); 1822 YYERROR; 1823 } 1824 r.max_src_states = 1825 o->data.max_src_states; 1826 r.rule_flag |= PFRULE_SRCTRACK; 1827 break; 1828 case PF_STATE_OPT_OVERLOAD: 1829 if (r.overload_tblname[0]) { 1830 yyerror("multiple 'overload' " 1831 "table definitions"); 1832 YYERROR; 1833 } 1834 if (strlcpy(r.overload_tblname, 1835 o->data.overload.tblname, 1836 PF_TABLE_NAME_SIZE) >= 1837 PF_TABLE_NAME_SIZE) { 1838 yyerror("state option: " 1839 "strlcpy"); 1840 YYERROR; 1841 } 1842 r.flush = o->data.overload.flush; 1843 break; 1844 case PF_STATE_OPT_MAX_SRC_CONN: 1845 if (r.max_src_conn) { 1846 yyerror("state option " 1847 "'max-src-conn' " 1848 "multiple definitions"); 1849 YYERROR; 1850 } 1851 if (o->data.max_src_conn == 0) { 1852 yyerror("'max-src-conn' " 1853 "must be > 0"); 1854 YYERROR; 1855 } 1856 r.max_src_conn = 1857 o->data.max_src_conn; 1858 r.rule_flag |= PFRULE_SRCTRACK | 1859 PFRULE_RULESRCTRACK; 1860 break; 1861 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1862 if (r.max_src_conn_rate.limit) { 1863 yyerror("state option " 1864 "'max-src-conn-rate' " 1865 "multiple definitions"); 1866 YYERROR; 1867 } 1868 if (!o->data.max_src_conn_rate.limit || 1869 !o->data.max_src_conn_rate.seconds) { 1870 yyerror("'max-src-conn-rate' " 1871 "values must be > 0"); 1872 YYERROR; 1873 } 1874 if (o->data.max_src_conn_rate.limit > 1875 PF_THRESHOLD_MAX) { 1876 yyerror("'max-src-conn-rate' " 1877 "maximum rate must be < %u", 1878 PF_THRESHOLD_MAX); 1879 YYERROR; 1880 } 1881 r.max_src_conn_rate.limit = 1882 o->data.max_src_conn_rate.limit; 1883 r.max_src_conn_rate.seconds = 1884 o->data.max_src_conn_rate.seconds; 1885 r.rule_flag |= PFRULE_SRCTRACK | 1886 PFRULE_RULESRCTRACK; 1887 break; 1888 case PF_STATE_OPT_MAX_SRC_NODES: 1889 if (r.max_src_nodes) { 1890 yyerror("state option " 1891 "'max-src-nodes' " 1892 "multiple definitions"); 1893 YYERROR; 1894 } 1895 if (o->data.max_src_nodes == 0) { 1896 yyerror("'max-src-nodes' must " 1897 "be > 0"); 1898 YYERROR; 1899 } 1900 r.max_src_nodes = 1901 o->data.max_src_nodes; 1902 r.rule_flag |= PFRULE_SRCTRACK | 1903 PFRULE_RULESRCTRACK; 1904 break; 1905 case PF_STATE_OPT_STATELOCK: 1906 if (statelock) { 1907 yyerror("state locking option: " 1908 "multiple definitions"); 1909 YYERROR; 1910 } 1911 statelock = 1; 1912 r.rule_flag |= o->data.statelock; 1913 break; 1914 case PF_STATE_OPT_SLOPPY: 1915 if (r.rule_flag & PFRULE_STATESLOPPY) { 1916 yyerror("state sloppy option: " 1917 "multiple definitions"); 1918 YYERROR; 1919 } 1920 r.rule_flag |= PFRULE_STATESLOPPY; 1921 break; 1922 case PF_STATE_OPT_PFLOW: 1923 if (r.rule_flag & PFRULE_PFLOW) { 1924 yyerror("state pflow " 1925 "option: multiple " 1926 "definitions"); 1927 YYERROR; 1928 } 1929 r.rule_flag |= PFRULE_PFLOW; 1930 break; 1931 case PF_STATE_OPT_TIMEOUT: 1932 if (o->data.timeout.number == 1933 PFTM_ADAPTIVE_START || 1934 o->data.timeout.number == 1935 PFTM_ADAPTIVE_END) 1936 adaptive = 1; 1937 if (r.timeout[o->data.timeout.number]) { 1938 yyerror("state timeout %s " 1939 "multiple definitions", 1940 pf_timeouts[o->data. 1941 timeout.number].name); 1942 YYERROR; 1943 } 1944 r.timeout[o->data.timeout.number] = 1945 o->data.timeout.seconds; 1946 } 1947 o = o->next; 1948 if (!defaults) 1949 free(p); 1950 } 1951 1952 /* 'flags S/SA' by default on stateful rules */ 1953 if (!r.action && !r.flags && !r.flagset && 1954 !$8.fragment && !($8.marker & FOM_FLAGS) && 1955 r.keep_state) { 1956 r.flags = parse_flags("S"); 1957 r.flagset = parse_flags("SA"); 1958 } 1959 if (!adaptive && r.max_states) { 1960 r.timeout[PFTM_ADAPTIVE_START] = 1961 (r.max_states / 10) * 6; 1962 r.timeout[PFTM_ADAPTIVE_END] = 1963 (r.max_states / 10) * 12; 1964 } 1965 if (r.rule_flag & PFRULE_SRCTRACK) { 1966 if (srctrack == PF_SRCTRACK_GLOBAL && 1967 r.max_src_nodes) { 1968 yyerror("'max-src-nodes' is " 1969 "incompatible with " 1970 "'source-track global'"); 1971 YYERROR; 1972 } 1973 if (srctrack == PF_SRCTRACK_GLOBAL && 1974 r.max_src_conn) { 1975 yyerror("'max-src-conn' is " 1976 "incompatible with " 1977 "'source-track global'"); 1978 YYERROR; 1979 } 1980 if (srctrack == PF_SRCTRACK_GLOBAL && 1981 r.max_src_conn_rate.seconds) { 1982 yyerror("'max-src-conn-rate' is " 1983 "incompatible with " 1984 "'source-track global'"); 1985 YYERROR; 1986 } 1987 if (r.timeout[PFTM_SRC_NODE] < 1988 r.max_src_conn_rate.seconds) 1989 r.timeout[PFTM_SRC_NODE] = 1990 r.max_src_conn_rate.seconds; 1991 r.rule_flag |= PFRULE_SRCTRACK; 1992 if (srctrack == PF_SRCTRACK_RULE) 1993 r.rule_flag |= PFRULE_RULESRCTRACK; 1994 } 1995 if (r.keep_state && !statelock) 1996 r.rule_flag |= default_statelock; 1997 1998 if ($8.fragment) 1999 r.rule_flag |= PFRULE_FRAGMENT; 2000 r.allow_opts = $8.allowopts; 2001 2002 decide_address_family($7.src.host, &r.af); 2003 decide_address_family($7.dst.host, &r.af); 2004 2005 if ($8.route.rt) { 2006 if (!r.direction) { 2007 yyerror("direction must be explicit " 2008 "with rules that specify routing"); 2009 YYERROR; 2010 } 2011 r.rt = $8.route.rt; 2012 r.route.opts = $8.route.pool_opts; 2013 if ($8.route.key != NULL) 2014 memcpy(&r.route.key, $8.route.key, 2015 sizeof(struct pf_poolhashkey)); 2016 } 2017 if (r.rt && r.rt != PF_FASTROUTE) { 2018 decide_address_family($8.route.host, &r.af); 2019 remove_invalid_hosts(&$8.route.host, &r.af); 2020 if ($8.route.host == NULL) { 2021 yyerror("no routing address with " 2022 "matching address family found."); 2023 YYERROR; 2024 } 2025 if ((r.route.opts & PF_POOL_TYPEMASK) == 2026 PF_POOL_NONE && ($8.route.host->next != NULL || 2027 $8.route.host->addr.type == PF_ADDR_TABLE || 2028 DYNIF_MULTIADDR($8.route.host->addr))) 2029 r.route.opts |= PF_POOL_ROUNDROBIN; 2030 if ((r.route.opts & PF_POOL_TYPEMASK) != 2031 PF_POOL_ROUNDROBIN && 2032 disallow_table($8.route.host, 2033 "tables are only " 2034 "supported in round-robin routing pools")) 2035 YYERROR; 2036 if ((r.route.opts & PF_POOL_TYPEMASK) != 2037 PF_POOL_ROUNDROBIN && 2038 disallow_alias($8.route.host, 2039 "interface (%s) " 2040 "is only supported in round-robin " 2041 "routing pools")) 2042 YYERROR; 2043 if ($8.route.host->next != NULL) { 2044 if ((r.route.opts & PF_POOL_TYPEMASK) != 2045 PF_POOL_ROUNDROBIN) { 2046 yyerror("r.route.opts must " 2047 "be PF_POOL_ROUNDROBIN"); 2048 YYERROR; 2049 } 2050 } 2051 /* fake redirspec */ 2052 if (($8.rroute.rdr = calloc(1, 2053 sizeof(*$8.rroute.rdr))) == NULL) 2054 err(1, "$8.rroute.rdr"); 2055 $8.rroute.rdr->host = $8.route.host; 2056 } 2057 if ($8.queues.qname != NULL) { 2058 if (strlcpy(r.qname, $8.queues.qname, 2059 sizeof(r.qname)) >= sizeof(r.qname)) { 2060 yyerror("rule qname too long (max " 2061 "%d chars)", sizeof(r.qname)-1); 2062 YYERROR; 2063 } 2064 free($8.queues.qname); 2065 } 2066 if ($8.queues.pqname != NULL) { 2067 if (strlcpy(r.pqname, $8.queues.pqname, 2068 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2069 yyerror("rule pqname too long (max " 2070 "%d chars)", sizeof(r.pqname)-1); 2071 YYERROR; 2072 } 2073 free($8.queues.pqname); 2074 } 2075 if ((r.divert.port = $8.divert.port)) { 2076 if (r.direction == PF_OUT) { 2077 if ($8.divert.addr) { 2078 yyerror("address specified " 2079 "for outgoing divert"); 2080 YYERROR; 2081 } 2082 bzero(&r.divert.addr, 2083 sizeof(r.divert.addr)); 2084 } else { 2085 if (!$8.divert.addr) { 2086 yyerror("no address specified " 2087 "for incoming divert"); 2088 YYERROR; 2089 } 2090 if ($8.divert.addr->af != r.af) { 2091 yyerror("address family " 2092 "mismatch for divert"); 2093 YYERROR; 2094 } 2095 r.divert.addr = 2096 $8.divert.addr->addr.v.a.addr; 2097 } 2098 } 2099 r.divert_packet.port = $8.divert_packet.port; 2100 2101 expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, &$8.rroute, $6, 2102 $7.src_os, 2103 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 2104 $8.uid, $8.gid, $8.icmpspec, ""); 2105 } 2106 ; 2107 2108filter_opts : { 2109 bzero(&filter_opts, sizeof filter_opts); 2110 filter_opts.rtableid = -1; 2111 } 2112 filter_opts_l 2113 { $$ = filter_opts; } 2114 | /* empty */ { 2115 bzero(&filter_opts, sizeof filter_opts); 2116 filter_opts.rtableid = -1; 2117 $$ = filter_opts; 2118 } 2119 ; 2120 2121filter_opts_l : filter_opts_l filter_opt 2122 | filter_opt 2123 ; 2124 2125filter_opt : USER uids { 2126 if (filter_opts.uid) 2127 $2->tail->next = filter_opts.uid; 2128 filter_opts.uid = $2; 2129 } 2130 | GROUP gids { 2131 if (filter_opts.gid) 2132 $2->tail->next = filter_opts.gid; 2133 filter_opts.gid = $2; 2134 } 2135 | flags { 2136 if (filter_opts.marker & FOM_FLAGS) { 2137 yyerror("flags cannot be redefined"); 2138 YYERROR; 2139 } 2140 filter_opts.marker |= FOM_FLAGS; 2141 filter_opts.flags.b1 |= $1.b1; 2142 filter_opts.flags.b2 |= $1.b2; 2143 filter_opts.flags.w |= $1.w; 2144 filter_opts.flags.w2 |= $1.w2; 2145 } 2146 | icmpspec { 2147 if (filter_opts.marker & FOM_ICMP) { 2148 yyerror("icmp-type cannot be redefined"); 2149 YYERROR; 2150 } 2151 filter_opts.marker |= FOM_ICMP; 2152 filter_opts.icmpspec = $1; 2153 } 2154 | TOS tos { 2155 if (filter_opts.marker & FOM_TOS) { 2156 yyerror("tos cannot be redefined"); 2157 YYERROR; 2158 } 2159 filter_opts.marker |= FOM_TOS; 2160 filter_opts.tos = $2; 2161 } 2162 | keep { 2163 if (filter_opts.marker & FOM_KEEP) { 2164 yyerror("modulate or keep cannot be redefined"); 2165 YYERROR; 2166 } 2167 filter_opts.marker |= FOM_KEEP; 2168 filter_opts.keep.action = $1.action; 2169 filter_opts.keep.options = $1.options; 2170 } 2171 | FRAGMENT { 2172 filter_opts.fragment = 1; 2173 } 2174 | ALLOWOPTS { 2175 filter_opts.allowopts = 1; 2176 } 2177 | label { 2178 if (filter_opts.label) { 2179 yyerror("label cannot be redefined"); 2180 YYERROR; 2181 } 2182 filter_opts.label = $1; 2183 } 2184 | qname { 2185 if (filter_opts.queues.qname) { 2186 yyerror("queue cannot be redefined"); 2187 YYERROR; 2188 } 2189 filter_opts.queues = $1; 2190 } 2191 | TAG string { 2192 filter_opts.tag = $2; 2193 } 2194 | not TAGGED string { 2195 filter_opts.match_tag = $3; 2196 filter_opts.match_tag_not = $1; 2197 } 2198 | PROBABILITY probability { 2199 double p; 2200 2201 p = floor($2 * UINT_MAX + 0.5); 2202 if (p < 0.0 || p > UINT_MAX) { 2203 yyerror("invalid probability: %lf", p); 2204 YYERROR; 2205 } 2206 filter_opts.prob = (u_int32_t)p; 2207 if (filter_opts.prob == 0) 2208 filter_opts.prob = 1; 2209 } 2210 | RTABLE NUMBER { 2211 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 2212 yyerror("invalid rtable id"); 2213 YYERROR; 2214 } 2215 filter_opts.rtableid = $2; 2216 } 2217 | DIVERTTO STRING PORT portplain { 2218 if ((filter_opts.divert.addr = host($2)) == NULL) { 2219 yyerror("could not parse divert address: %s", 2220 $2); 2221 free($2); 2222 YYERROR; 2223 } 2224 free($2); 2225 filter_opts.divert.port = $4.a; 2226 if (!filter_opts.divert.port) { 2227 yyerror("invalid divert port: %u", ntohs($4.a)); 2228 YYERROR; 2229 } 2230 } 2231 | DIVERTREPLY { 2232 filter_opts.divert.port = 1; /* some random value */ 2233 } 2234 | DIVERTPACKET PORT number { 2235 /* 2236 * If IP reassembly was not turned off, also 2237 * forcibly enable TCP reassembly by default. 2238 */ 2239 if (pf->reassemble & PF_REASS_ENABLED) 2240 filter_opts.marker |= FOM_SCRUB_TCP; 2241 2242 if ($3 < 1 || $3 > 65535) { 2243 yyerror("invalid divert port"); 2244 YYERROR; 2245 } 2246 2247 filter_opts.divert_packet.port = htons($3); 2248 } 2249 | SCRUB '(' scrub_opts ')' { 2250 filter_opts.nodf = $3.nodf; 2251 filter_opts.minttl = $3.minttl; 2252 filter_opts.settos = $3.settos; 2253 filter_opts.randomid = $3.randomid; 2254 filter_opts.max_mss = $3.maxmss; 2255 if ($3.reassemble_tcp) 2256 filter_opts.marker |= FOM_SCRUB_TCP; 2257 filter_opts.marker |= $3.marker; 2258 } 2259 | NATTO redirpool pool_opts { 2260 if (filter_opts.nat.rdr) { 2261 yyerror("cannot respecify nat-to/binat-to"); 2262 YYERROR; 2263 } 2264 filter_opts.nat.rdr = $2; 2265 memcpy(&filter_opts.nat.pool_opts, &$3, 2266 sizeof(filter_opts.nat.pool_opts)); 2267 } 2268 | RDRTO redirpool pool_opts { 2269 if (filter_opts.rdr.rdr) { 2270 yyerror("cannot respecify rdr-to"); 2271 YYERROR; 2272 } 2273 filter_opts.rdr.rdr = $2; 2274 memcpy(&filter_opts.rdr.pool_opts, &$3, 2275 sizeof(filter_opts.rdr.pool_opts)); 2276 } 2277 | BINATTO redirpool pool_opts { 2278 if (filter_opts.nat.rdr) { 2279 yyerror("cannot respecify nat-to/binat-to"); 2280 YYERROR; 2281 } 2282 filter_opts.nat.rdr = $2; 2283 filter_opts.nat.binat = 1; 2284 memcpy(&filter_opts.nat.pool_opts, &$3, 2285 sizeof(filter_opts.nat.pool_opts)); 2286 filter_opts.nat.pool_opts.staticport = 1; 2287 } 2288 | FASTROUTE { 2289 filter_opts.route.host = NULL; 2290 filter_opts.route.rt = PF_FASTROUTE; 2291 filter_opts.route.pool_opts = 0; 2292 } 2293 | ROUTETO routespec pool_opts { 2294 filter_opts.route.host = $2; 2295 filter_opts.route.rt = PF_ROUTETO; 2296 filter_opts.route.pool_opts = $3.type | $3.opts; 2297 if ($3.key != NULL) 2298 filter_opts.route.key = $3.key; 2299 } 2300 | REPLYTO routespec pool_opts { 2301 filter_opts.route.host = $2; 2302 filter_opts.route.rt = PF_REPLYTO; 2303 filter_opts.route.pool_opts = $3.type | $3.opts; 2304 if ($3.key != NULL) 2305 filter_opts.route.key = $3.key; 2306 } 2307 | DUPTO routespec pool_opts { 2308 filter_opts.route.host = $2; 2309 filter_opts.route.rt = PF_DUPTO; 2310 filter_opts.route.pool_opts = $3.type | $3.opts; 2311 if ($3.key != NULL) 2312 filter_opts.route.key = $3.key; 2313 } 2314 ; 2315 2316probability : STRING { 2317 char *e; 2318 double p = strtod($1, &e); 2319 2320 if (*e == '%') { 2321 p *= 0.01; 2322 e++; 2323 } 2324 if (*e) { 2325 yyerror("invalid probability: %s", $1); 2326 free($1); 2327 YYERROR; 2328 } 2329 free($1); 2330 $$ = p; 2331 } 2332 | NUMBER { 2333 $$ = (double)$1; 2334 } 2335 ; 2336 2337 2338action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2339 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 2340 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2341 ; 2342 2343blockspec : /* empty */ { 2344 $$.b2 = blockpolicy; 2345 $$.w = returnicmpdefault; 2346 $$.w2 = returnicmp6default; 2347 } 2348 | DROP { 2349 $$.b2 = PFRULE_DROP; 2350 $$.w = 0; 2351 $$.w2 = 0; 2352 } 2353 | RETURNRST { 2354 $$.b2 = PFRULE_RETURNRST; 2355 $$.w = 0; 2356 $$.w2 = 0; 2357 } 2358 | RETURNRST '(' TTL NUMBER ')' { 2359 if ($4 < 0 || $4 > 255) { 2360 yyerror("illegal ttl value %d", $4); 2361 YYERROR; 2362 } 2363 $$.b2 = PFRULE_RETURNRST; 2364 $$.w = $4; 2365 $$.w2 = 0; 2366 } 2367 | RETURNICMP { 2368 $$.b2 = PFRULE_RETURNICMP; 2369 $$.w = returnicmpdefault; 2370 $$.w2 = returnicmp6default; 2371 } 2372 | RETURNICMP6 { 2373 $$.b2 = PFRULE_RETURNICMP; 2374 $$.w = returnicmpdefault; 2375 $$.w2 = returnicmp6default; 2376 } 2377 | RETURNICMP '(' reticmpspec ')' { 2378 $$.b2 = PFRULE_RETURNICMP; 2379 $$.w = $3; 2380 $$.w2 = returnicmpdefault; 2381 } 2382 | RETURNICMP6 '(' reticmp6spec ')' { 2383 $$.b2 = PFRULE_RETURNICMP; 2384 $$.w = returnicmpdefault; 2385 $$.w2 = $3; 2386 } 2387 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2388 $$.b2 = PFRULE_RETURNICMP; 2389 $$.w = $3; 2390 $$.w2 = $5; 2391 } 2392 | RETURN { 2393 $$.b2 = PFRULE_RETURN; 2394 $$.w = returnicmpdefault; 2395 $$.w2 = returnicmp6default; 2396 } 2397 ; 2398 2399reticmpspec : STRING { 2400 if (!($$ = parseicmpspec($1, AF_INET))) { 2401 free($1); 2402 YYERROR; 2403 } 2404 free($1); 2405 } 2406 | NUMBER { 2407 u_int8_t icmptype; 2408 2409 if ($1 < 0 || $1 > 255) { 2410 yyerror("invalid icmp code %lu", $1); 2411 YYERROR; 2412 } 2413 icmptype = returnicmpdefault >> 8; 2414 $$ = (icmptype << 8 | $1); 2415 } 2416 ; 2417 2418reticmp6spec : STRING { 2419 if (!($$ = parseicmpspec($1, AF_INET6))) { 2420 free($1); 2421 YYERROR; 2422 } 2423 free($1); 2424 } 2425 | NUMBER { 2426 u_int8_t icmptype; 2427 2428 if ($1 < 0 || $1 > 255) { 2429 yyerror("invalid icmp code %lu", $1); 2430 YYERROR; 2431 } 2432 icmptype = returnicmp6default >> 8; 2433 $$ = (icmptype << 8 | $1); 2434 } 2435 ; 2436 2437dir : /* empty */ { $$ = PF_INOUT; } 2438 | IN { $$ = PF_IN; } 2439 | OUT { $$ = PF_OUT; } 2440 ; 2441 2442quick : /* empty */ { $$.quick = 0; } 2443 | QUICK { $$.quick = 1; } 2444 ; 2445 2446logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2447 | log { $$ = $1; $$.quick = 0; } 2448 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2449 | log QUICK { $$ = $1; $$.quick = 1; } 2450 | QUICK log { $$ = $2; $$.quick = 1; } 2451 ; 2452 2453log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2454 | LOG '(' logopts ')' { 2455 $$.log = PF_LOG | $3.log; 2456 $$.logif = $3.logif; 2457 } 2458 ; 2459 2460logopts : logopt { $$ = $1; } 2461 | logopts comma logopt { 2462 $$.log = $1.log | $3.log; 2463 $$.logif = $3.logif; 2464 if ($$.logif == 0) 2465 $$.logif = $1.logif; 2466 } 2467 ; 2468 2469logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2470 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2471 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2472 | TO string { 2473 const char *errstr; 2474 u_int i; 2475 2476 $$.log = 0; 2477 if (strncmp($2, "pflog", 5)) { 2478 yyerror("%s: should be a pflog interface", $2); 2479 free($2); 2480 YYERROR; 2481 } 2482 i = strtonum($2 + 5, 0, 255, &errstr); 2483 if (errstr) { 2484 yyerror("%s: %s", $2, errstr); 2485 free($2); 2486 YYERROR; 2487 } 2488 free($2); 2489 $$.logif = i; 2490 } 2491 ; 2492 2493interface : /* empty */ { $$ = NULL; } 2494 | ON if_item_not { $$ = $2; } 2495 | ON '{' optnl if_list '}' { $$ = $4; } 2496 ; 2497 2498if_list : if_item_not optnl { $$ = $1; } 2499 | if_list comma if_item_not optnl { 2500 $1->tail->next = $3; 2501 $1->tail = $3; 2502 $$ = $1; 2503 } 2504 ; 2505 2506if_item_not : not if_item { $$ = $2; $$->not = $1; } 2507 ; 2508 2509if_item : STRING { 2510 struct node_host *n; 2511 2512 $$ = calloc(1, sizeof(struct node_if)); 2513 if ($$ == NULL) 2514 err(1, "if_item: calloc"); 2515 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2516 sizeof($$->ifname)) { 2517 free($1); 2518 free($$); 2519 yyerror("interface name too long"); 2520 YYERROR; 2521 } 2522 2523 if ((n = ifa_exists($1)) != NULL) 2524 $$->ifa_flags = n->ifa_flags; 2525 2526 free($1); 2527 $$->not = 0; 2528 $$->next = NULL; 2529 $$->tail = $$; 2530 } 2531 ; 2532 2533af : /* empty */ { $$ = 0; } 2534 | INET { $$ = AF_INET; } 2535 | INET6 { $$ = AF_INET6; } 2536 ; 2537 2538proto : /* empty */ { $$ = NULL; } 2539 | PROTO proto_item { $$ = $2; } 2540 | PROTO '{' optnl proto_list '}' { $$ = $4; } 2541 ; 2542 2543proto_list : proto_item optnl { $$ = $1; } 2544 | proto_list comma proto_item optnl { 2545 $1->tail->next = $3; 2546 $1->tail = $3; 2547 $$ = $1; 2548 } 2549 ; 2550 2551proto_item : protoval { 2552 u_int8_t pr; 2553 2554 pr = (u_int8_t)$1; 2555 if (pr == 0) { 2556 yyerror("proto 0 cannot be used"); 2557 YYERROR; 2558 } 2559 $$ = calloc(1, sizeof(struct node_proto)); 2560 if ($$ == NULL) 2561 err(1, "proto_item: calloc"); 2562 $$->proto = pr; 2563 $$->next = NULL; 2564 $$->tail = $$; 2565 } 2566 ; 2567 2568protoval : STRING { 2569 struct protoent *p; 2570 2571 p = getprotobyname($1); 2572 if (p == NULL) { 2573 yyerror("unknown protocol %s", $1); 2574 free($1); 2575 YYERROR; 2576 } 2577 $$ = p->p_proto; 2578 free($1); 2579 } 2580 | NUMBER { 2581 if ($1 < 0 || $1 > 255) { 2582 yyerror("protocol outside range"); 2583 YYERROR; 2584 } 2585 } 2586 ; 2587 2588fromto : ALL { 2589 $$.src.host = NULL; 2590 $$.src.port = NULL; 2591 $$.dst.host = NULL; 2592 $$.dst.port = NULL; 2593 $$.src_os = NULL; 2594 } 2595 | from os to { 2596 $$.src = $1; 2597 $$.src_os = $2; 2598 $$.dst = $3; 2599 } 2600 ; 2601 2602os : /* empty */ { $$ = NULL; } 2603 | OS xos { $$ = $2; } 2604 | OS '{' optnl os_list '}' { $$ = $4; } 2605 ; 2606 2607xos : STRING { 2608 $$ = calloc(1, sizeof(struct node_os)); 2609 if ($$ == NULL) 2610 err(1, "os: calloc"); 2611 $$->os = $1; 2612 $$->tail = $$; 2613 } 2614 ; 2615 2616os_list : xos optnl { $$ = $1; } 2617 | os_list comma xos optnl { 2618 $1->tail->next = $3; 2619 $1->tail = $3; 2620 $$ = $1; 2621 } 2622 ; 2623 2624from : /* empty */ { 2625 $$.host = NULL; 2626 $$.port = NULL; 2627 } 2628 | FROM ipportspec { 2629 $$ = $2; 2630 } 2631 ; 2632 2633to : /* empty */ { 2634 $$.host = NULL; 2635 $$.port = NULL; 2636 } 2637 | TO ipportspec { 2638 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2639 "not permitted in a destination address")) 2640 YYERROR; 2641 $$ = $2; 2642 } 2643 ; 2644 2645ipportspec : ipspec { 2646 $$.host = $1; 2647 $$.port = NULL; 2648 } 2649 | ipspec PORT portspec { 2650 $$.host = $1; 2651 $$.port = $3; 2652 } 2653 | PORT portspec { 2654 $$.host = NULL; 2655 $$.port = $2; 2656 } 2657 ; 2658 2659optnl : '\n' optnl 2660 | 2661 ; 2662 2663ipspec : ANY { $$ = NULL; } 2664 | xhost { $$ = $1; } 2665 | '{' optnl host_list '}' { $$ = $3; } 2666 ; 2667 2668host_list : ipspec optnl { $$ = $1; } 2669 | host_list comma ipspec optnl { 2670 if ($3 == NULL) 2671 $$ = $1; 2672 else if ($1 == NULL) 2673 $$ = $3; 2674 else { 2675 $1->tail->next = $3; 2676 $1->tail = $3->tail; 2677 $$ = $1; 2678 } 2679 } 2680 ; 2681 2682xhost : not host { 2683 struct node_host *n; 2684 2685 for (n = $2; n != NULL; n = n->next) 2686 n->not = $1; 2687 $$ = $2; 2688 } 2689 | not NOROUTE { 2690 $$ = calloc(1, sizeof(struct node_host)); 2691 if ($$ == NULL) 2692 err(1, "xhost: calloc"); 2693 $$->addr.type = PF_ADDR_NOROUTE; 2694 $$->next = NULL; 2695 $$->not = $1; 2696 $$->tail = $$; 2697 } 2698 | not URPFFAILED { 2699 $$ = calloc(1, sizeof(struct node_host)); 2700 if ($$ == NULL) 2701 err(1, "xhost: calloc"); 2702 $$->addr.type = PF_ADDR_URPFFAILED; 2703 $$->next = NULL; 2704 $$->not = $1; 2705 $$->tail = $$; 2706 } 2707 ; 2708 2709host : STRING { 2710 if (($$ = host($1)) == NULL) { 2711 /* error. "any" is handled elsewhere */ 2712 free($1); 2713 yyerror("could not parse host specification"); 2714 YYERROR; 2715 } 2716 free($1); 2717 2718 } 2719 | STRING '-' STRING { 2720 struct node_host *b, *e; 2721 2722 if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 2723 free($1); 2724 free($3); 2725 yyerror("could not parse host specification"); 2726 YYERROR; 2727 } 2728 if (b->af != e->af || 2729 b->addr.type != PF_ADDR_ADDRMASK || 2730 e->addr.type != PF_ADDR_ADDRMASK || 2731 unmask(&b->addr.v.a.mask, b->af) != 2732 (b->af == AF_INET ? 32 : 128) || 2733 unmask(&e->addr.v.a.mask, e->af) != 2734 (e->af == AF_INET ? 32 : 128) || 2735 b->next != NULL || b->not || 2736 e->next != NULL || e->not) { 2737 free(b); 2738 free(e); 2739 free($1); 2740 free($3); 2741 yyerror("invalid address range"); 2742 YYERROR; 2743 } 2744 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 2745 sizeof(b->addr.v.a.mask)); 2746 b->addr.type = PF_ADDR_RANGE; 2747 $$ = b; 2748 free(e); 2749 free($1); 2750 free($3); 2751 } 2752 | STRING '/' NUMBER { 2753 char *buf; 2754 2755 if (asprintf(&buf, "%s/%lld", $1, $3) == -1) 2756 err(1, "host: asprintf"); 2757 free($1); 2758 if (($$ = host(buf)) == NULL) { 2759 /* error. "any" is handled elsewhere */ 2760 free(buf); 2761 yyerror("could not parse host specification"); 2762 YYERROR; 2763 } 2764 free(buf); 2765 } 2766 | NUMBER '/' NUMBER { 2767 char *buf; 2768 2769 /* ie. for 10/8 parsing */ 2770 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 2771 err(1, "host: asprintf"); 2772 if (($$ = host(buf)) == NULL) { 2773 /* error. "any" is handled elsewhere */ 2774 free(buf); 2775 yyerror("could not parse host specification"); 2776 YYERROR; 2777 } 2778 free(buf); 2779 } 2780 | dynaddr 2781 | dynaddr '/' NUMBER { 2782 struct node_host *n; 2783 2784 if ($3 < 0 || $3 > 128) { 2785 yyerror("bit number too big"); 2786 YYERROR; 2787 } 2788 $$ = $1; 2789 for (n = $1; n != NULL; n = n->next) 2790 set_ipmask(n, $3); 2791 } 2792 | '<' STRING '>' { 2793 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2794 yyerror("table name '%s' too long", $2); 2795 free($2); 2796 YYERROR; 2797 } 2798 $$ = calloc(1, sizeof(struct node_host)); 2799 if ($$ == NULL) 2800 err(1, "host: calloc"); 2801 $$->addr.type = PF_ADDR_TABLE; 2802 if (strlcpy($$->addr.v.tblname, $2, 2803 sizeof($$->addr.v.tblname)) >= 2804 sizeof($$->addr.v.tblname)) 2805 errx(1, "host: strlcpy"); 2806 free($2); 2807 $$->next = NULL; 2808 $$->tail = $$; 2809 } 2810 | ROUTE STRING { 2811 $$ = calloc(1, sizeof(struct node_host)); 2812 if ($$ == NULL) { 2813 free($2); 2814 err(1, "host: calloc"); 2815 } 2816 $$->addr.type = PF_ADDR_RTLABEL; 2817 if (strlcpy($$->addr.v.rtlabelname, $2, 2818 sizeof($$->addr.v.rtlabelname)) >= 2819 sizeof($$->addr.v.rtlabelname)) { 2820 yyerror("route label too long, max %u chars", 2821 sizeof($$->addr.v.rtlabelname) - 1); 2822 free($2); 2823 free($$); 2824 YYERROR; 2825 } 2826 $$->next = NULL; 2827 $$->tail = $$; 2828 free($2); 2829 } 2830 ; 2831 2832number : NUMBER 2833 | STRING { 2834 u_long ulval; 2835 2836 if (atoul($1, &ulval) == -1) { 2837 yyerror("%s is not a number", $1); 2838 free($1); 2839 YYERROR; 2840 } else 2841 $$ = ulval; 2842 free($1); 2843 } 2844 ; 2845 2846dynaddr : '(' STRING ')' { 2847 int flags = 0; 2848 char *p, *op; 2849 2850 op = $2; 2851 if (!isalpha(op[0])) { 2852 yyerror("invalid interface name '%s'", op); 2853 free(op); 2854 YYERROR; 2855 } 2856 while ((p = strrchr($2, ':')) != NULL) { 2857 if (!strcmp(p+1, "network")) 2858 flags |= PFI_AFLAG_NETWORK; 2859 else if (!strcmp(p+1, "broadcast")) 2860 flags |= PFI_AFLAG_BROADCAST; 2861 else if (!strcmp(p+1, "peer")) 2862 flags |= PFI_AFLAG_PEER; 2863 else if (!strcmp(p+1, "0")) 2864 flags |= PFI_AFLAG_NOALIAS; 2865 else { 2866 yyerror("interface %s has bad modifier", 2867 $2); 2868 free(op); 2869 YYERROR; 2870 } 2871 *p = '\0'; 2872 } 2873 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2874 free(op); 2875 yyerror("illegal combination of " 2876 "interface modifiers"); 2877 YYERROR; 2878 } 2879 $$ = calloc(1, sizeof(struct node_host)); 2880 if ($$ == NULL) 2881 err(1, "address: calloc"); 2882 $$->af = 0; 2883 set_ipmask($$, 128); 2884 $$->addr.type = PF_ADDR_DYNIFTL; 2885 $$->addr.iflags = flags; 2886 if (strlcpy($$->addr.v.ifname, $2, 2887 sizeof($$->addr.v.ifname)) >= 2888 sizeof($$->addr.v.ifname)) { 2889 free(op); 2890 free($$); 2891 yyerror("interface name too long"); 2892 YYERROR; 2893 } 2894 free(op); 2895 $$->next = NULL; 2896 $$->tail = $$; 2897 } 2898 ; 2899 2900portspec : port_item { $$ = $1; } 2901 | '{' optnl port_list '}' { $$ = $3; } 2902 ; 2903 2904port_list : port_item optnl { $$ = $1; } 2905 | port_list comma port_item optnl { 2906 $1->tail->next = $3; 2907 $1->tail = $3; 2908 $$ = $1; 2909 } 2910 ; 2911 2912port_item : portrange { 2913 $$ = calloc(1, sizeof(struct node_port)); 2914 if ($$ == NULL) 2915 err(1, "port_item: calloc"); 2916 $$->port[0] = $1.a; 2917 $$->port[1] = $1.b; 2918 if ($1.t) 2919 $$->op = PF_OP_RRG; 2920 else 2921 $$->op = PF_OP_EQ; 2922 $$->next = NULL; 2923 $$->tail = $$; 2924 } 2925 | unaryop portrange { 2926 if ($2.t) { 2927 yyerror("':' cannot be used with an other " 2928 "port operator"); 2929 YYERROR; 2930 } 2931 $$ = calloc(1, sizeof(struct node_port)); 2932 if ($$ == NULL) 2933 err(1, "port_item: calloc"); 2934 $$->port[0] = $2.a; 2935 $$->port[1] = $2.b; 2936 $$->op = $1; 2937 $$->next = NULL; 2938 $$->tail = $$; 2939 } 2940 | portrange PORTBINARY portrange { 2941 if ($1.t || $3.t) { 2942 yyerror("':' cannot be used with an other " 2943 "port operator"); 2944 YYERROR; 2945 } 2946 $$ = calloc(1, sizeof(struct node_port)); 2947 if ($$ == NULL) 2948 err(1, "port_item: calloc"); 2949 $$->port[0] = $1.a; 2950 $$->port[1] = $3.a; 2951 $$->op = $2; 2952 $$->next = NULL; 2953 $$->tail = $$; 2954 } 2955 ; 2956 2957portplain : numberstring { 2958 if (parseport($1, &$$, 0) == -1) { 2959 free($1); 2960 YYERROR; 2961 } 2962 free($1); 2963 } 2964 ; 2965 2966portrange : numberstring { 2967 if (parseport($1, &$$, PPORT_RANGE) == -1) { 2968 free($1); 2969 YYERROR; 2970 } 2971 free($1); 2972 } 2973 ; 2974 2975uids : uid_item { $$ = $1; } 2976 | '{' optnl uid_list '}' { $$ = $3; } 2977 ; 2978 2979uid_list : uid_item optnl { $$ = $1; } 2980 | uid_list comma uid_item optnl { 2981 $1->tail->next = $3; 2982 $1->tail = $3; 2983 $$ = $1; 2984 } 2985 ; 2986 2987uid_item : uid { 2988 $$ = calloc(1, sizeof(struct node_uid)); 2989 if ($$ == NULL) 2990 err(1, "uid_item: calloc"); 2991 $$->uid[0] = $1; 2992 $$->uid[1] = $1; 2993 $$->op = PF_OP_EQ; 2994 $$->next = NULL; 2995 $$->tail = $$; 2996 } 2997 | unaryop uid { 2998 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2999 yyerror("user unknown requires operator = or " 3000 "!="); 3001 YYERROR; 3002 } 3003 $$ = calloc(1, sizeof(struct node_uid)); 3004 if ($$ == NULL) 3005 err(1, "uid_item: calloc"); 3006 $$->uid[0] = $2; 3007 $$->uid[1] = $2; 3008 $$->op = $1; 3009 $$->next = NULL; 3010 $$->tail = $$; 3011 } 3012 | uid PORTBINARY uid { 3013 if ($1 == UID_MAX || $3 == UID_MAX) { 3014 yyerror("user unknown requires operator = or " 3015 "!="); 3016 YYERROR; 3017 } 3018 $$ = calloc(1, sizeof(struct node_uid)); 3019 if ($$ == NULL) 3020 err(1, "uid_item: calloc"); 3021 $$->uid[0] = $1; 3022 $$->uid[1] = $3; 3023 $$->op = $2; 3024 $$->next = NULL; 3025 $$->tail = $$; 3026 } 3027 ; 3028 3029uid : STRING { 3030 if (!strcmp($1, "unknown")) 3031 $$ = UID_MAX; 3032 else { 3033 struct passwd *pw; 3034 3035 if ((pw = getpwnam($1)) == NULL) { 3036 yyerror("unknown user %s", $1); 3037 free($1); 3038 YYERROR; 3039 } 3040 $$ = pw->pw_uid; 3041 } 3042 free($1); 3043 } 3044 | NUMBER { 3045 if ($1 < 0 || $1 >= UID_MAX) { 3046 yyerror("illegal uid value %lu", $1); 3047 YYERROR; 3048 } 3049 $$ = $1; 3050 } 3051 ; 3052 3053gids : gid_item { $$ = $1; } 3054 | '{' optnl gid_list '}' { $$ = $3; } 3055 ; 3056 3057gid_list : gid_item optnl { $$ = $1; } 3058 | gid_list comma gid_item optnl { 3059 $1->tail->next = $3; 3060 $1->tail = $3; 3061 $$ = $1; 3062 } 3063 ; 3064 3065gid_item : gid { 3066 $$ = calloc(1, sizeof(struct node_gid)); 3067 if ($$ == NULL) 3068 err(1, "gid_item: calloc"); 3069 $$->gid[0] = $1; 3070 $$->gid[1] = $1; 3071 $$->op = PF_OP_EQ; 3072 $$->next = NULL; 3073 $$->tail = $$; 3074 } 3075 | unaryop gid { 3076 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3077 yyerror("group unknown requires operator = or " 3078 "!="); 3079 YYERROR; 3080 } 3081 $$ = calloc(1, sizeof(struct node_gid)); 3082 if ($$ == NULL) 3083 err(1, "gid_item: calloc"); 3084 $$->gid[0] = $2; 3085 $$->gid[1] = $2; 3086 $$->op = $1; 3087 $$->next = NULL; 3088 $$->tail = $$; 3089 } 3090 | gid PORTBINARY gid { 3091 if ($1 == GID_MAX || $3 == GID_MAX) { 3092 yyerror("group unknown requires operator = or " 3093 "!="); 3094 YYERROR; 3095 } 3096 $$ = calloc(1, sizeof(struct node_gid)); 3097 if ($$ == NULL) 3098 err(1, "gid_item: calloc"); 3099 $$->gid[0] = $1; 3100 $$->gid[1] = $3; 3101 $$->op = $2; 3102 $$->next = NULL; 3103 $$->tail = $$; 3104 } 3105 ; 3106 3107gid : STRING { 3108 if (!strcmp($1, "unknown")) 3109 $$ = GID_MAX; 3110 else { 3111 struct group *grp; 3112 3113 if ((grp = getgrnam($1)) == NULL) { 3114 yyerror("unknown group %s", $1); 3115 free($1); 3116 YYERROR; 3117 } 3118 $$ = grp->gr_gid; 3119 } 3120 free($1); 3121 } 3122 | NUMBER { 3123 if ($1 < 0 || $1 >= GID_MAX) { 3124 yyerror("illegal gid value %lu", $1); 3125 YYERROR; 3126 } 3127 $$ = $1; 3128 } 3129 ; 3130 3131flag : STRING { 3132 int f; 3133 3134 if ((f = parse_flags($1)) < 0) { 3135 yyerror("bad flags %s", $1); 3136 free($1); 3137 YYERROR; 3138 } 3139 free($1); 3140 $$.b1 = f; 3141 } 3142 ; 3143 3144flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3145 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3146 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3147 ; 3148 3149icmpspec : ICMPTYPE icmp_item { $$ = $2; } 3150 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3151 | ICMP6TYPE icmp6_item { $$ = $2; } 3152 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3153 ; 3154 3155icmp_list : icmp_item optnl { $$ = $1; } 3156 | icmp_list comma icmp_item optnl { 3157 $1->tail->next = $3; 3158 $1->tail = $3; 3159 $$ = $1; 3160 } 3161 ; 3162 3163icmp6_list : icmp6_item optnl { $$ = $1; } 3164 | icmp6_list comma icmp6_item optnl { 3165 $1->tail->next = $3; 3166 $1->tail = $3; 3167 $$ = $1; 3168 } 3169 ; 3170 3171icmp_item : icmptype { 3172 $$ = calloc(1, sizeof(struct node_icmp)); 3173 if ($$ == NULL) 3174 err(1, "icmp_item: calloc"); 3175 $$->type = $1; 3176 $$->code = 0; 3177 $$->proto = IPPROTO_ICMP; 3178 $$->next = NULL; 3179 $$->tail = $$; 3180 } 3181 | icmptype CODE STRING { 3182 const struct icmpcodeent *p; 3183 3184 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3185 yyerror("unknown icmp-code %s", $3); 3186 free($3); 3187 YYERROR; 3188 } 3189 3190 free($3); 3191 $$ = calloc(1, sizeof(struct node_icmp)); 3192 if ($$ == NULL) 3193 err(1, "icmp_item: calloc"); 3194 $$->type = $1; 3195 $$->code = p->code + 1; 3196 $$->proto = IPPROTO_ICMP; 3197 $$->next = NULL; 3198 $$->tail = $$; 3199 } 3200 | icmptype CODE NUMBER { 3201 if ($3 < 0 || $3 > 255) { 3202 yyerror("illegal icmp-code %lu", $3); 3203 YYERROR; 3204 } 3205 $$ = calloc(1, sizeof(struct node_icmp)); 3206 if ($$ == NULL) 3207 err(1, "icmp_item: calloc"); 3208 $$->type = $1; 3209 $$->code = $3 + 1; 3210 $$->proto = IPPROTO_ICMP; 3211 $$->next = NULL; 3212 $$->tail = $$; 3213 } 3214 ; 3215 3216icmp6_item : icmp6type { 3217 $$ = calloc(1, sizeof(struct node_icmp)); 3218 if ($$ == NULL) 3219 err(1, "icmp_item: calloc"); 3220 $$->type = $1; 3221 $$->code = 0; 3222 $$->proto = IPPROTO_ICMPV6; 3223 $$->next = NULL; 3224 $$->tail = $$; 3225 } 3226 | icmp6type CODE STRING { 3227 const struct icmpcodeent *p; 3228 3229 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3230 yyerror("unknown icmp6-code %s", $3); 3231 free($3); 3232 YYERROR; 3233 } 3234 free($3); 3235 3236 $$ = calloc(1, sizeof(struct node_icmp)); 3237 if ($$ == NULL) 3238 err(1, "icmp_item: calloc"); 3239 $$->type = $1; 3240 $$->code = p->code + 1; 3241 $$->proto = IPPROTO_ICMPV6; 3242 $$->next = NULL; 3243 $$->tail = $$; 3244 } 3245 | icmp6type CODE NUMBER { 3246 if ($3 < 0 || $3 > 255) { 3247 yyerror("illegal icmp-code %lu", $3); 3248 YYERROR; 3249 } 3250 $$ = calloc(1, sizeof(struct node_icmp)); 3251 if ($$ == NULL) 3252 err(1, "icmp_item: calloc"); 3253 $$->type = $1; 3254 $$->code = $3 + 1; 3255 $$->proto = IPPROTO_ICMPV6; 3256 $$->next = NULL; 3257 $$->tail = $$; 3258 } 3259 ; 3260 3261icmptype : STRING { 3262 const struct icmptypeent *p; 3263 3264 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3265 yyerror("unknown icmp-type %s", $1); 3266 free($1); 3267 YYERROR; 3268 } 3269 $$ = p->type + 1; 3270 free($1); 3271 } 3272 | NUMBER { 3273 if ($1 < 0 || $1 > 255) { 3274 yyerror("illegal icmp-type %lu", $1); 3275 YYERROR; 3276 } 3277 $$ = $1 + 1; 3278 } 3279 ; 3280 3281icmp6type : STRING { 3282 const struct icmptypeent *p; 3283 3284 if ((p = geticmptypebyname($1, AF_INET6)) == 3285 NULL) { 3286 yyerror("unknown icmp6-type %s", $1); 3287 free($1); 3288 YYERROR; 3289 } 3290 $$ = p->type + 1; 3291 free($1); 3292 } 3293 | NUMBER { 3294 if ($1 < 0 || $1 > 255) { 3295 yyerror("illegal icmp6-type %lu", $1); 3296 YYERROR; 3297 } 3298 $$ = $1 + 1; 3299 } 3300 ; 3301 3302tos : STRING { 3303 int val; 3304 if (map_tos($1, &val)) 3305 $$ = val; 3306 else if ($1[0] == '0' && $1[1] == 'x') 3307 $$ = strtoul($1, NULL, 16); 3308 else 3309 $$ = 256; /* flag bad argument */ 3310 if ($$ > 255) { 3311 yyerror("illegal tos value %s", $1); 3312 free($1); 3313 YYERROR; 3314 } 3315 free($1); 3316 } 3317 | NUMBER { 3318 $$ = $1; 3319 if ($$ > 255) { 3320 yyerror("illegal tos value %s", $1); 3321 YYERROR; 3322 } 3323 } 3324 ; 3325 3326sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3327 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3328 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3329 ; 3330 3331statelock : IFBOUND { 3332 $$ = PFRULE_IFBOUND; 3333 } 3334 | FLOATING { 3335 $$ = 0; 3336 } 3337 ; 3338 3339keep : NO STATE { 3340 $$.action = 0; 3341 $$.options = NULL; 3342 } 3343 | KEEP STATE state_opt_spec { 3344 $$.action = PF_STATE_NORMAL; 3345 $$.options = $3; 3346 } 3347 | MODULATE STATE state_opt_spec { 3348 $$.action = PF_STATE_MODULATE; 3349 $$.options = $3; 3350 } 3351 | SYNPROXY STATE state_opt_spec { 3352 $$.action = PF_STATE_SYNPROXY; 3353 $$.options = $3; 3354 } 3355 ; 3356 3357flush : /* empty */ { $$ = 0; } 3358 | FLUSH { $$ = PF_FLUSH; } 3359 | FLUSH GLOBAL { 3360 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3361 } 3362 ; 3363 3364state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3365 | /* empty */ { $$ = NULL; } 3366 ; 3367 3368state_opt_list : state_opt_item { $$ = $1; } 3369 | state_opt_list comma state_opt_item { 3370 $1->tail->next = $3; 3371 $1->tail = $3; 3372 $$ = $1; 3373 } 3374 ; 3375 3376state_opt_item : MAXIMUM NUMBER { 3377 if ($2 < 0 || $2 > UINT_MAX) { 3378 yyerror("only positive values permitted"); 3379 YYERROR; 3380 } 3381 $$ = calloc(1, sizeof(struct node_state_opt)); 3382 if ($$ == NULL) 3383 err(1, "state_opt_item: calloc"); 3384 $$->type = PF_STATE_OPT_MAX; 3385 $$->data.max_states = $2; 3386 $$->next = NULL; 3387 $$->tail = $$; 3388 } 3389 | NOSYNC { 3390 $$ = calloc(1, sizeof(struct node_state_opt)); 3391 if ($$ == NULL) 3392 err(1, "state_opt_item: calloc"); 3393 $$->type = PF_STATE_OPT_NOSYNC; 3394 $$->next = NULL; 3395 $$->tail = $$; 3396 } 3397 | MAXSRCSTATES NUMBER { 3398 if ($2 < 0 || $2 > UINT_MAX) { 3399 yyerror("only positive values permitted"); 3400 YYERROR; 3401 } 3402 $$ = calloc(1, sizeof(struct node_state_opt)); 3403 if ($$ == NULL) 3404 err(1, "state_opt_item: calloc"); 3405 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3406 $$->data.max_src_states = $2; 3407 $$->next = NULL; 3408 $$->tail = $$; 3409 } 3410 | MAXSRCCONN NUMBER { 3411 if ($2 < 0 || $2 > UINT_MAX) { 3412 yyerror("only positive values permitted"); 3413 YYERROR; 3414 } 3415 $$ = calloc(1, sizeof(struct node_state_opt)); 3416 if ($$ == NULL) 3417 err(1, "state_opt_item: calloc"); 3418 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3419 $$->data.max_src_conn = $2; 3420 $$->next = NULL; 3421 $$->tail = $$; 3422 } 3423 | MAXSRCCONNRATE NUMBER '/' NUMBER { 3424 if ($2 < 0 || $2 > UINT_MAX || 3425 $4 < 0 || $4 > UINT_MAX) { 3426 yyerror("only positive values permitted"); 3427 YYERROR; 3428 } 3429 $$ = calloc(1, sizeof(struct node_state_opt)); 3430 if ($$ == NULL) 3431 err(1, "state_opt_item: calloc"); 3432 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3433 $$->data.max_src_conn_rate.limit = $2; 3434 $$->data.max_src_conn_rate.seconds = $4; 3435 $$->next = NULL; 3436 $$->tail = $$; 3437 } 3438 | OVERLOAD '<' STRING '>' flush { 3439 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3440 yyerror("table name '%s' too long", $3); 3441 free($3); 3442 YYERROR; 3443 } 3444 $$ = calloc(1, sizeof(struct node_state_opt)); 3445 if ($$ == NULL) 3446 err(1, "state_opt_item: calloc"); 3447 if (strlcpy($$->data.overload.tblname, $3, 3448 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3449 errx(1, "state_opt_item: strlcpy"); 3450 free($3); 3451 $$->type = PF_STATE_OPT_OVERLOAD; 3452 $$->data.overload.flush = $5; 3453 $$->next = NULL; 3454 $$->tail = $$; 3455 } 3456 | MAXSRCNODES NUMBER { 3457 if ($2 < 0 || $2 > UINT_MAX) { 3458 yyerror("only positive values permitted"); 3459 YYERROR; 3460 } 3461 $$ = calloc(1, sizeof(struct node_state_opt)); 3462 if ($$ == NULL) 3463 err(1, "state_opt_item: calloc"); 3464 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3465 $$->data.max_src_nodes = $2; 3466 $$->next = NULL; 3467 $$->tail = $$; 3468 } 3469 | sourcetrack { 3470 $$ = calloc(1, sizeof(struct node_state_opt)); 3471 if ($$ == NULL) 3472 err(1, "state_opt_item: calloc"); 3473 $$->type = PF_STATE_OPT_SRCTRACK; 3474 $$->data.src_track = $1; 3475 $$->next = NULL; 3476 $$->tail = $$; 3477 } 3478 | statelock { 3479 $$ = calloc(1, sizeof(struct node_state_opt)); 3480 if ($$ == NULL) 3481 err(1, "state_opt_item: calloc"); 3482 $$->type = PF_STATE_OPT_STATELOCK; 3483 $$->data.statelock = $1; 3484 $$->next = NULL; 3485 $$->tail = $$; 3486 } 3487 | SLOPPY { 3488 $$ = calloc(1, sizeof(struct node_state_opt)); 3489 if ($$ == NULL) 3490 err(1, "state_opt_item: calloc"); 3491 $$->type = PF_STATE_OPT_SLOPPY; 3492 $$->next = NULL; 3493 $$->tail = $$; 3494 } 3495 | PFLOW { 3496 $$ = calloc(1, sizeof(struct node_state_opt)); 3497 if ($$ == NULL) 3498 err(1, "state_opt_item: calloc"); 3499 $$->type = PF_STATE_OPT_PFLOW; 3500 $$->next = NULL; 3501 $$->tail = $$; 3502 } 3503 | STRING NUMBER { 3504 int i; 3505 3506 if ($2 < 0 || $2 > UINT_MAX) { 3507 yyerror("only positive values permitted"); 3508 YYERROR; 3509 } 3510 for (i = 0; pf_timeouts[i].name && 3511 strcmp(pf_timeouts[i].name, $1); ++i) 3512 ; /* nothing */ 3513 if (!pf_timeouts[i].name) { 3514 yyerror("illegal timeout name %s", $1); 3515 free($1); 3516 YYERROR; 3517 } 3518 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3519 yyerror("illegal state timeout %s", $1); 3520 free($1); 3521 YYERROR; 3522 } 3523 free($1); 3524 $$ = calloc(1, sizeof(struct node_state_opt)); 3525 if ($$ == NULL) 3526 err(1, "state_opt_item: calloc"); 3527 $$->type = PF_STATE_OPT_TIMEOUT; 3528 $$->data.timeout.number = pf_timeouts[i].timeout; 3529 $$->data.timeout.seconds = $2; 3530 $$->next = NULL; 3531 $$->tail = $$; 3532 } 3533 ; 3534 3535label : LABEL STRING { 3536 $$ = $2; 3537 } 3538 ; 3539 3540qname : QUEUE STRING { 3541 $$.qname = $2; 3542 $$.pqname = NULL; 3543 } 3544 | QUEUE '(' STRING ')' { 3545 $$.qname = $3; 3546 $$.pqname = NULL; 3547 } 3548 | QUEUE '(' STRING comma STRING ')' { 3549 $$.qname = $3; 3550 $$.pqname = $5; 3551 } 3552 ; 3553 3554portstar : numberstring { 3555 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3556 free($1); 3557 YYERROR; 3558 } 3559 free($1); 3560 } 3561 ; 3562 3563redirspec : host { $$ = $1; } 3564 | '{' optnl redir_host_list '}' { $$ = $3; } 3565 ; 3566 3567redir_host_list : host optnl { $$ = $1; } 3568 | redir_host_list comma host optnl { 3569 $1->tail->next = $3; 3570 $1->tail = $3->tail; 3571 $$ = $1; 3572 } 3573 ; 3574 3575redirpool : redirspec { 3576 $$ = calloc(1, sizeof(struct redirection)); 3577 if ($$ == NULL) 3578 err(1, "redirection: calloc"); 3579 $$->host = $1; 3580 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3581 } 3582 | redirspec PORT portstar { 3583 $$ = calloc(1, sizeof(struct redirection)); 3584 if ($$ == NULL) 3585 err(1, "redirection: calloc"); 3586 $$->host = $1; 3587 $$->rport = $3; 3588 } 3589 ; 3590 3591hashkey : /* empty */ 3592 { 3593 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3594 if ($$ == NULL) 3595 err(1, "hashkey: calloc"); 3596 $$->key32[0] = arc4random(); 3597 $$->key32[1] = arc4random(); 3598 $$->key32[2] = arc4random(); 3599 $$->key32[3] = arc4random(); 3600 } 3601 | string 3602 { 3603 if (!strncmp($1, "0x", 2)) { 3604 if (strlen($1) != 34) { 3605 free($1); 3606 yyerror("hex key must be 128 bits " 3607 "(32 hex digits) long"); 3608 YYERROR; 3609 } 3610 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3611 if ($$ == NULL) 3612 err(1, "hashkey: calloc"); 3613 3614 if (sscanf($1, "0x%8x%8x%8x%8x", 3615 &$$->key32[0], &$$->key32[1], 3616 &$$->key32[2], &$$->key32[3]) != 4) { 3617 free($$); 3618 free($1); 3619 yyerror("invalid hex key"); 3620 YYERROR; 3621 } 3622 } else { 3623 MD5_CTX context; 3624 3625 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3626 if ($$ == NULL) 3627 err(1, "hashkey: calloc"); 3628 MD5Init(&context); 3629 MD5Update(&context, (unsigned char *)$1, 3630 strlen($1)); 3631 MD5Final((unsigned char *)$$, &context); 3632 HTONL($$->key32[0]); 3633 HTONL($$->key32[1]); 3634 HTONL($$->key32[2]); 3635 HTONL($$->key32[3]); 3636 } 3637 free($1); 3638 } 3639 ; 3640 3641pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3642 pool_opts_l 3643 { $$ = pool_opts; } 3644 | /* empty */ { 3645 bzero(&pool_opts, sizeof pool_opts); 3646 $$ = pool_opts; 3647 } 3648 ; 3649 3650pool_opts_l : pool_opts_l pool_opt 3651 | pool_opt 3652 ; 3653 3654pool_opt : BITMASK { 3655 if (pool_opts.type) { 3656 yyerror("pool type cannot be redefined"); 3657 YYERROR; 3658 } 3659 pool_opts.type = PF_POOL_BITMASK; 3660 } 3661 | RANDOM { 3662 if (pool_opts.type) { 3663 yyerror("pool type cannot be redefined"); 3664 YYERROR; 3665 } 3666 pool_opts.type = PF_POOL_RANDOM; 3667 } 3668 | SOURCEHASH hashkey { 3669 if (pool_opts.type) { 3670 yyerror("pool type cannot be redefined"); 3671 YYERROR; 3672 } 3673 pool_opts.type = PF_POOL_SRCHASH; 3674 pool_opts.key = $2; 3675 } 3676 | ROUNDROBIN { 3677 if (pool_opts.type) { 3678 yyerror("pool type cannot be redefined"); 3679 YYERROR; 3680 } 3681 pool_opts.type = PF_POOL_ROUNDROBIN; 3682 } 3683 | STATICPORT { 3684 if (pool_opts.staticport) { 3685 yyerror("static-port cannot be redefined"); 3686 YYERROR; 3687 } 3688 pool_opts.staticport = 1; 3689 } 3690 | STICKYADDRESS { 3691 if (filter_opts.marker & POM_STICKYADDRESS) { 3692 yyerror("sticky-address cannot be redefined"); 3693 YYERROR; 3694 } 3695 pool_opts.marker |= POM_STICKYADDRESS; 3696 pool_opts.opts |= PF_POOL_STICKYADDR; 3697 } 3698 ; 3699 3700route_host : STRING { 3701 $$ = calloc(1, sizeof(struct node_host)); 3702 if ($$ == NULL) 3703 err(1, "route_host: calloc"); 3704 $$->ifname = $1; 3705 $$->addr.type = PF_ADDR_DYNIFTL; 3706 set_ipmask($$, 128); 3707 $$->next = NULL; 3708 $$->tail = $$; 3709 } 3710 | '(' STRING host ')' { 3711 $$ = $3; 3712 $$->ifname = $2; 3713 } 3714 ; 3715 3716route_host_list : route_host optnl { $$ = $1; } 3717 | route_host_list comma route_host optnl { 3718 if ($1->af == 0) 3719 $1->af = $3->af; 3720 if ($1->af != $3->af) { 3721 yyerror("all pool addresses must be in the " 3722 "same address family"); 3723 YYERROR; 3724 } 3725 $1->tail->next = $3; 3726 $1->tail = $3->tail; 3727 $$ = $1; 3728 } 3729 ; 3730 3731routespec : route_host { $$ = $1; } 3732 | '{' optnl route_host_list '}' { $$ = $3; } 3733 ; 3734 3735timeout_spec : STRING NUMBER 3736 { 3737 if (check_rulestate(PFCTL_STATE_OPTION)) { 3738 free($1); 3739 YYERROR; 3740 } 3741 if ($2 < 0 || $2 > UINT_MAX) { 3742 yyerror("only positive values permitted"); 3743 YYERROR; 3744 } 3745 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3746 yyerror("unknown timeout %s", $1); 3747 free($1); 3748 YYERROR; 3749 } 3750 free($1); 3751 } 3752 ; 3753 3754timeout_list : timeout_list comma timeout_spec optnl 3755 | timeout_spec optnl 3756 ; 3757 3758limit_spec : STRING NUMBER 3759 { 3760 if (check_rulestate(PFCTL_STATE_OPTION)) { 3761 free($1); 3762 YYERROR; 3763 } 3764 if ($2 < 0 || $2 > UINT_MAX) { 3765 yyerror("only positive values permitted"); 3766 YYERROR; 3767 } 3768 if (pfctl_set_limit(pf, $1, $2) != 0) { 3769 yyerror("unable to set limit %s %u", $1, $2); 3770 free($1); 3771 YYERROR; 3772 } 3773 free($1); 3774 } 3775 ; 3776 3777limit_list : limit_list comma limit_spec optnl 3778 | limit_spec optnl 3779 ; 3780 3781comma : ',' 3782 | /* empty */ 3783 ; 3784 3785yesno : NO { $$ = 0; } 3786 | STRING { 3787 if (!strcmp($1, "yes")) 3788 $$ = 1; 3789 else { 3790 yyerror("invalid value '%s', expected 'yes' " 3791 "or 'no'", $1); 3792 free($1); 3793 YYERROR; 3794 } 3795 free($1); 3796 } 3797 ; 3798 3799unaryop : '=' { $$ = PF_OP_EQ; } 3800 | '!' '=' { $$ = PF_OP_NE; } 3801 | '<' '=' { $$ = PF_OP_LE; } 3802 | '<' { $$ = PF_OP_LT; } 3803 | '>' '=' { $$ = PF_OP_GE; } 3804 | '>' { $$ = PF_OP_GT; } 3805 ; 3806 3807%% 3808 3809int 3810yyerror(const char *fmt, ...) 3811{ 3812 va_list ap; 3813 3814 file->errors++; 3815 va_start(ap, fmt); 3816 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 3817 vfprintf(stderr, fmt, ap); 3818 fprintf(stderr, "\n"); 3819 va_end(ap); 3820 return (0); 3821} 3822 3823int 3824disallow_table(struct node_host *h, const char *fmt) 3825{ 3826 for (; h != NULL; h = h->next) 3827 if (h->addr.type == PF_ADDR_TABLE) { 3828 yyerror(fmt, h->addr.v.tblname); 3829 return (1); 3830 } 3831 return (0); 3832} 3833 3834int 3835disallow_urpf_failed(struct node_host *h, const char *fmt) 3836{ 3837 for (; h != NULL; h = h->next) 3838 if (h->addr.type == PF_ADDR_URPFFAILED) { 3839 yyerror(fmt); 3840 return (1); 3841 } 3842 return (0); 3843} 3844 3845int 3846disallow_alias(struct node_host *h, const char *fmt) 3847{ 3848 for (; h != NULL; h = h->next) 3849 if (DYNIF_MULTIADDR(h->addr)) { 3850 yyerror(fmt, h->addr.v.tblname); 3851 return (1); 3852 } 3853 return (0); 3854} 3855 3856int 3857rule_consistent(struct pf_rule *r, int anchor_call) 3858{ 3859 int problems = 0; 3860 3861 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3862 (r->src.port_op || r->dst.port_op)) { 3863 yyerror("port only applies to tcp/udp"); 3864 problems++; 3865 } 3866 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3867 (r->type || r->code)) { 3868 yyerror("icmp-type/code only applies to icmp"); 3869 problems++; 3870 } 3871 if (!r->af && (r->type || r->code)) { 3872 yyerror("must indicate address family with icmp-type/code"); 3873 problems++; 3874 } 3875 if (r->overload_tblname[0] && 3876 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3877 yyerror("'overload' requires 'max-src-conn' " 3878 "or 'max-src-conn-rate'"); 3879 problems++; 3880 } 3881 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3882 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3883 yyerror("proto %s doesn't match address family %s", 3884 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3885 r->af == AF_INET ? "inet" : "inet6"); 3886 problems++; 3887 } 3888 if (r->allow_opts && r->action != PF_PASS) { 3889 yyerror("allow-opts can only be specified for pass rules"); 3890 problems++; 3891 } 3892 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3893 r->dst.port_op || r->flagset || r->type || r->code)) { 3894 yyerror("fragments can be filtered only on IP header fields"); 3895 problems++; 3896 } 3897 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3898 yyerror("return-rst can only be applied to TCP rules"); 3899 problems++; 3900 } 3901 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3902 yyerror("max-src-nodes requires 'source-track rule'"); 3903 problems++; 3904 } 3905 if (r->action != PF_PASS && r->keep_state) { 3906 yyerror("keep state is great, but only for pass rules"); 3907 problems++; 3908 } 3909 if (r->rule_flag & PFRULE_STATESLOPPY && 3910 (r->keep_state == PF_STATE_MODULATE || 3911 r->keep_state == PF_STATE_SYNPROXY)) { 3912 yyerror("sloppy state matching cannot be used with " 3913 "synproxy state or modulate state"); 3914 problems++; 3915 } 3916 if ((!TAILQ_EMPTY(&r->nat.list) || 3917 (!r->rt && !TAILQ_EMPTY(&r->rdr.list))) && 3918 r->action != PF_MATCH && !r->keep_state) { 3919 yyerror("nat-to and rdr-to require keep state"); 3920 problems++; 3921 } 3922 if (!TAILQ_EMPTY(&r->nat.list) && r->direction != PF_OUT) { 3923 yyerror("nat-to can only be used outbound"); 3924 problems++; 3925 } 3926 if (!r->rt && !TAILQ_EMPTY(&r->rdr.list) && r->direction != PF_IN) { 3927 yyerror("rdr-to can only be used inbound"); 3928 problems++; 3929 } 3930 3931 /* match rules rules */ 3932 if (r->action == PF_MATCH) { 3933 if (r->divert.port) { 3934 yyerror("divert is not supported on match rules"); 3935 problems++; 3936 } 3937 if (r->divert_packet.port) { 3938 yyerror("divert is not supported on match rules"); 3939 problems++; 3940 } 3941 if (r->rt) { 3942 yyerror("route-to, reply-to, dup-to and fastroute " 3943 "must not be used on match rules"); 3944 problems++; 3945 } 3946 } 3947 return (-problems); 3948} 3949 3950int 3951process_tabledef(char *name, struct table_opts *opts) 3952{ 3953 struct pfr_buffer ab; 3954 struct node_tinit *ti; 3955 3956 bzero(&ab, sizeof(ab)); 3957 ab.pfrb_type = PFRB_ADDRS; 3958 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3959 if (ti->file) 3960 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3961 if (errno) 3962 yyerror("cannot load \"%s\": %s", 3963 ti->file, strerror(errno)); 3964 else 3965 yyerror("file \"%s\" contains bad data", 3966 ti->file); 3967 goto _error; 3968 } 3969 if (ti->host) 3970 if (append_addr_host(&ab, ti->host, 0, 0)) { 3971 yyerror("cannot create address buffer: %s", 3972 strerror(errno)); 3973 goto _error; 3974 } 3975 } 3976 if (pf->opts & PF_OPT_VERBOSE) 3977 print_tabledef(name, opts->flags, opts->init_addr, 3978 &opts->init_nodes); 3979 if (!(pf->opts & PF_OPT_NOACTION) && 3980 pfctl_define_table(name, opts->flags, opts->init_addr, 3981 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 3982 yyerror("cannot define table %s: %s", name, 3983 pfr_strerror(errno)); 3984 goto _error; 3985 } 3986 pf->tdirty = 1; 3987 pfr_buf_clear(&ab); 3988 return (0); 3989_error: 3990 pfr_buf_clear(&ab); 3991 return (-1); 3992} 3993 3994struct keywords { 3995 const char *k_name; 3996 int k_val; 3997}; 3998 3999/* macro gore, but you should've seen the prior indentation nightmare... */ 4000 4001#define FREE_LIST(T,r) \ 4002 do { \ 4003 T *p, *node = r; \ 4004 while (node != NULL) { \ 4005 p = node; \ 4006 node = node->next; \ 4007 free(p); \ 4008 } \ 4009 } while (0) 4010 4011#define LOOP_THROUGH(T,n,r,C) \ 4012 do { \ 4013 T *n; \ 4014 if (r == NULL) { \ 4015 r = calloc(1, sizeof(T)); \ 4016 if (r == NULL) \ 4017 err(1, "LOOP: calloc"); \ 4018 r->next = NULL; \ 4019 } \ 4020 n = r; \ 4021 while (n != NULL) { \ 4022 do { \ 4023 C; \ 4024 } while (0); \ 4025 n = n->next; \ 4026 } \ 4027 } while (0) 4028 4029void 4030expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4031{ 4032 char *tmp; 4033 char *p, *q; 4034 4035 if ((tmp = calloc(1, len)) == NULL) 4036 err(1, "expand_label_str: calloc"); 4037 p = q = label; 4038 while ((q = strstr(p, srch)) != NULL) { 4039 *q = '\0'; 4040 if ((strlcat(tmp, p, len) >= len) || 4041 (strlcat(tmp, repl, len) >= len)) 4042 errx(1, "expand_label: label too long"); 4043 q += strlen(srch); 4044 p = q; 4045 } 4046 if (strlcat(tmp, p, len) >= len) 4047 errx(1, "expand_label: label too long"); 4048 strlcpy(label, tmp, len); /* always fits */ 4049 free(tmp); 4050} 4051 4052void 4053expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4054{ 4055 if (strstr(label, name) != NULL) { 4056 if (!*ifname) 4057 expand_label_str(label, len, name, "any"); 4058 else 4059 expand_label_str(label, len, name, ifname); 4060 } 4061} 4062 4063void 4064expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4065 struct node_host *h) 4066{ 4067 char tmp[64], tmp_not[66]; 4068 4069 if (strstr(label, name) != NULL) { 4070 switch (h->addr.type) { 4071 case PF_ADDR_DYNIFTL: 4072 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4073 break; 4074 case PF_ADDR_TABLE: 4075 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4076 break; 4077 case PF_ADDR_NOROUTE: 4078 snprintf(tmp, sizeof(tmp), "no-route"); 4079 break; 4080 case PF_ADDR_URPFFAILED: 4081 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4082 break; 4083 case PF_ADDR_ADDRMASK: 4084 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4085 PF_AZERO(&h->addr.v.a.mask, af))) 4086 snprintf(tmp, sizeof(tmp), "any"); 4087 else { 4088 char a[48]; 4089 int bits; 4090 4091 if (inet_ntop(af, &h->addr.v.a.addr, a, 4092 sizeof(a)) == NULL) 4093 snprintf(tmp, sizeof(tmp), "?"); 4094 else { 4095 bits = unmask(&h->addr.v.a.mask, af); 4096 if ((af == AF_INET && bits < 32) || 4097 (af == AF_INET6 && bits < 128)) 4098 snprintf(tmp, sizeof(tmp), 4099 "%s/%d", a, bits); 4100 else 4101 snprintf(tmp, sizeof(tmp), 4102 "%s", a); 4103 } 4104 } 4105 break; 4106 default: 4107 snprintf(tmp, sizeof(tmp), "?"); 4108 break; 4109 } 4110 4111 if (h->not) { 4112 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4113 expand_label_str(label, len, name, tmp_not); 4114 } else 4115 expand_label_str(label, len, name, tmp); 4116 } 4117} 4118 4119void 4120expand_label_port(const char *name, char *label, size_t len, 4121 struct node_port *port) 4122{ 4123 char a1[6], a2[6], op[13] = ""; 4124 4125 if (strstr(label, name) != NULL) { 4126 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4127 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4128 if (!port->op) 4129 ; 4130 else if (port->op == PF_OP_IRG) 4131 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4132 else if (port->op == PF_OP_XRG) 4133 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4134 else if (port->op == PF_OP_EQ) 4135 snprintf(op, sizeof(op), "%s", a1); 4136 else if (port->op == PF_OP_NE) 4137 snprintf(op, sizeof(op), "!=%s", a1); 4138 else if (port->op == PF_OP_LT) 4139 snprintf(op, sizeof(op), "<%s", a1); 4140 else if (port->op == PF_OP_LE) 4141 snprintf(op, sizeof(op), "<=%s", a1); 4142 else if (port->op == PF_OP_GT) 4143 snprintf(op, sizeof(op), ">%s", a1); 4144 else if (port->op == PF_OP_GE) 4145 snprintf(op, sizeof(op), ">=%s", a1); 4146 expand_label_str(label, len, name, op); 4147 } 4148} 4149 4150void 4151expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4152{ 4153 struct protoent *pe; 4154 char n[4]; 4155 4156 if (strstr(label, name) != NULL) { 4157 pe = getprotobynumber(proto); 4158 if (pe != NULL) 4159 expand_label_str(label, len, name, pe->p_name); 4160 else { 4161 snprintf(n, sizeof(n), "%u", proto); 4162 expand_label_str(label, len, name, n); 4163 } 4164 } 4165} 4166 4167void 4168expand_label_nr(const char *name, char *label, size_t len) 4169{ 4170 char n[11]; 4171 4172 if (strstr(label, name) != NULL) { 4173 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4174 expand_label_str(label, len, name, n); 4175 } 4176} 4177 4178void 4179expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4180 struct node_host *src_host, struct node_port *src_port, 4181 struct node_host *dst_host, struct node_port *dst_port, 4182 u_int8_t proto) 4183{ 4184 expand_label_if("$if", label, len, ifname); 4185 expand_label_addr("$srcaddr", label, len, af, src_host); 4186 expand_label_addr("$dstaddr", label, len, af, dst_host); 4187 expand_label_port("$srcport", label, len, src_port); 4188 expand_label_port("$dstport", label, len, dst_port); 4189 expand_label_proto("$proto", label, len, proto); 4190 expand_label_nr("$nr", label, len); 4191} 4192 4193int 4194expand_altq(struct pf_altq *a, struct node_if *interfaces, 4195 struct node_queue *nqueues, struct node_queue_bw bwspec, 4196 struct node_queue_opt *opts) 4197{ 4198 struct pf_altq pa, pb; 4199 char qname[PF_QNAME_SIZE]; 4200 struct node_queue *n; 4201 struct node_queue_bw bw; 4202 int errs = 0; 4203 4204 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4205 FREE_LIST(struct node_if, interfaces); 4206 FREE_LIST(struct node_queue, nqueues); 4207 return (0); 4208 } 4209 4210 LOOP_THROUGH(struct node_if, interface, interfaces, 4211 memcpy(&pa, a, sizeof(struct pf_altq)); 4212 if (strlcpy(pa.ifname, interface->ifname, 4213 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4214 errx(1, "expand_altq: strlcpy"); 4215 4216 if (interface->not) { 4217 yyerror("altq on ! <interface> is not supported"); 4218 errs++; 4219 } else { 4220 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4221 errs++; 4222 else 4223 if (pfctl_add_altq(pf, &pa)) 4224 errs++; 4225 4226 if (pf->opts & PF_OPT_VERBOSE) { 4227 print_altq(&pf->paltq->altq, 0, 4228 &bwspec, opts); 4229 if (nqueues && nqueues->tail) { 4230 printf("queue { "); 4231 LOOP_THROUGH(struct node_queue, queue, 4232 nqueues, 4233 printf("%s ", 4234 queue->queue); 4235 ); 4236 printf("}"); 4237 } 4238 printf("\n"); 4239 } 4240 4241 if (pa.scheduler == ALTQT_CBQ || 4242 pa.scheduler == ALTQT_HFSC) { 4243 /* now create a root queue */ 4244 memset(&pb, 0, sizeof(struct pf_altq)); 4245 if (strlcpy(qname, "root_", sizeof(qname)) >= 4246 sizeof(qname)) 4247 errx(1, "expand_altq: strlcpy"); 4248 if (strlcat(qname, interface->ifname, 4249 sizeof(qname)) >= sizeof(qname)) 4250 errx(1, "expand_altq: strlcat"); 4251 if (strlcpy(pb.qname, qname, 4252 sizeof(pb.qname)) >= sizeof(pb.qname)) 4253 errx(1, "expand_altq: strlcpy"); 4254 if (strlcpy(pb.ifname, interface->ifname, 4255 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4256 errx(1, "expand_altq: strlcpy"); 4257 pb.qlimit = pa.qlimit; 4258 pb.scheduler = pa.scheduler; 4259 bw.bw_absolute = pa.ifbandwidth; 4260 bw.bw_percent = 0; 4261 if (eval_pfqueue(pf, &pb, &bw, opts)) 4262 errs++; 4263 else 4264 if (pfctl_add_altq(pf, &pb)) 4265 errs++; 4266 } 4267 4268 LOOP_THROUGH(struct node_queue, queue, nqueues, 4269 n = calloc(1, sizeof(struct node_queue)); 4270 if (n == NULL) 4271 err(1, "expand_altq: calloc"); 4272 if (pa.scheduler == ALTQT_CBQ || 4273 pa.scheduler == ALTQT_HFSC) 4274 if (strlcpy(n->parent, qname, 4275 sizeof(n->parent)) >= 4276 sizeof(n->parent)) 4277 errx(1, "expand_altq: strlcpy"); 4278 if (strlcpy(n->queue, queue->queue, 4279 sizeof(n->queue)) >= sizeof(n->queue)) 4280 errx(1, "expand_altq: strlcpy"); 4281 if (strlcpy(n->ifname, interface->ifname, 4282 sizeof(n->ifname)) >= sizeof(n->ifname)) 4283 errx(1, "expand_altq: strlcpy"); 4284 n->scheduler = pa.scheduler; 4285 n->next = NULL; 4286 n->tail = n; 4287 if (queues == NULL) 4288 queues = n; 4289 else { 4290 queues->tail->next = n; 4291 queues->tail = n; 4292 } 4293 ); 4294 } 4295 ); 4296 FREE_LIST(struct node_if, interfaces); 4297 FREE_LIST(struct node_queue, nqueues); 4298 4299 return (errs); 4300} 4301 4302int 4303expand_queue(struct pf_altq *a, struct node_if *interfaces, 4304 struct node_queue *nqueues, struct node_queue_bw bwspec, 4305 struct node_queue_opt *opts) 4306{ 4307 struct node_queue *n, *nq; 4308 struct pf_altq pa; 4309 u_int8_t found = 0; 4310 u_int8_t errs = 0; 4311 4312 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4313 FREE_LIST(struct node_queue, nqueues); 4314 return (0); 4315 } 4316 4317 if (queues == NULL) { 4318 yyerror("queue %s has no parent", a->qname); 4319 FREE_LIST(struct node_queue, nqueues); 4320 return (1); 4321 } 4322 4323 LOOP_THROUGH(struct node_if, interface, interfaces, 4324 LOOP_THROUGH(struct node_queue, tqueue, queues, 4325 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4326 (interface->ifname[0] == 0 || 4327 (!interface->not && !strncmp(interface->ifname, 4328 tqueue->ifname, IFNAMSIZ)) || 4329 (interface->not && strncmp(interface->ifname, 4330 tqueue->ifname, IFNAMSIZ)))) { 4331 /* found ourself in queues */ 4332 found++; 4333 4334 memcpy(&pa, a, sizeof(struct pf_altq)); 4335 4336 if (pa.scheduler != ALTQT_NONE && 4337 pa.scheduler != tqueue->scheduler) { 4338 yyerror("exactly one scheduler type " 4339 "per interface allowed"); 4340 return (1); 4341 } 4342 pa.scheduler = tqueue->scheduler; 4343 4344 /* scheduler dependent error checking */ 4345 switch (pa.scheduler) { 4346 case ALTQT_PRIQ: 4347 if (nqueues != NULL) { 4348 yyerror("priq queues cannot " 4349 "have child queues"); 4350 return (1); 4351 } 4352 if (bwspec.bw_absolute > 0 || 4353 bwspec.bw_percent < 100) { 4354 yyerror("priq doesn't take " 4355 "bandwidth"); 4356 return (1); 4357 } 4358 break; 4359 default: 4360 break; 4361 } 4362 4363 if (strlcpy(pa.ifname, tqueue->ifname, 4364 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4365 errx(1, "expand_queue: strlcpy"); 4366 if (strlcpy(pa.parent, tqueue->parent, 4367 sizeof(pa.parent)) >= sizeof(pa.parent)) 4368 errx(1, "expand_queue: strlcpy"); 4369 4370 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4371 errs++; 4372 else 4373 if (pfctl_add_altq(pf, &pa)) 4374 errs++; 4375 4376 for (nq = nqueues; nq != NULL; nq = nq->next) { 4377 if (!strcmp(a->qname, nq->queue)) { 4378 yyerror("queue cannot have " 4379 "itself as child"); 4380 errs++; 4381 continue; 4382 } 4383 n = calloc(1, 4384 sizeof(struct node_queue)); 4385 if (n == NULL) 4386 err(1, "expand_queue: calloc"); 4387 if (strlcpy(n->parent, a->qname, 4388 sizeof(n->parent)) >= 4389 sizeof(n->parent)) 4390 errx(1, "expand_queue strlcpy"); 4391 if (strlcpy(n->queue, nq->queue, 4392 sizeof(n->queue)) >= 4393 sizeof(n->queue)) 4394 errx(1, "expand_queue strlcpy"); 4395 if (strlcpy(n->ifname, tqueue->ifname, 4396 sizeof(n->ifname)) >= 4397 sizeof(n->ifname)) 4398 errx(1, "expand_queue strlcpy"); 4399 n->scheduler = tqueue->scheduler; 4400 n->next = NULL; 4401 n->tail = n; 4402 if (queues == NULL) 4403 queues = n; 4404 else { 4405 queues->tail->next = n; 4406 queues->tail = n; 4407 } 4408 } 4409 if ((pf->opts & PF_OPT_VERBOSE) && ( 4410 (found == 1 && interface->ifname[0] == 0) || 4411 (found > 0 && interface->ifname[0] != 0))) { 4412 print_queue(&pf->paltq->altq, 0, 4413 &bwspec, interface->ifname[0] != 0, 4414 opts); 4415 if (nqueues && nqueues->tail) { 4416 printf("{ "); 4417 LOOP_THROUGH(struct node_queue, 4418 queue, nqueues, 4419 printf("%s ", 4420 queue->queue); 4421 ); 4422 printf("}"); 4423 } 4424 printf("\n"); 4425 } 4426 } 4427 ); 4428 ); 4429 4430 FREE_LIST(struct node_queue, nqueues); 4431 FREE_LIST(struct node_if, interfaces); 4432 4433 if (!found) { 4434 yyerror("queue %s has no parent", a->qname); 4435 errs++; 4436 } 4437 4438 if (errs) 4439 return (1); 4440 else 4441 return (0); 4442} 4443 4444int 4445apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, 4446 int isrdr, struct node_port *np) 4447{ 4448 struct node_host *h; 4449 struct pf_pooladdr *pa; 4450 4451 if (!rs || !rs->rdr) 4452 return (0); 4453 4454 if (!r->af && ! rs->rdr->host->ifindex) 4455 r->af = rs->rdr->host->af; 4456 4457 remove_invalid_hosts(&rs->rdr->host, &r->af); 4458 if (invalid_redirect(rs->rdr->host, r->af)) 4459 return (1); 4460 if (check_netmask(rs->rdr->host, r->af)) 4461 return (1); 4462 4463 rpool->proxy_port[0] = ntohs(rs->rdr->rport.a); 4464 4465 if (isrdr) { 4466 if (!rs->rdr->rport.b && rs->rdr->rport.t && np->port != NULL) { 4467 rpool->proxy_port[1] = ntohs(rs->rdr->rport.a) + 4468 (ntohs(np->port[1]) - ntohs(np->port[0])); 4469 } else 4470 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4471 } else { 4472 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4473 if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { 4474 rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW; 4475 rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH; 4476 } else if (!rpool->proxy_port[1]) 4477 rpool->proxy_port[1] = rpool->proxy_port[0]; 4478 } 4479 4480 rpool->opts = rs->pool_opts.type; 4481 if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_NONE && 4482 (rs->rdr->host->next != NULL || 4483 rs->rdr->host->addr.type == PF_ADDR_TABLE || 4484 DYNIF_MULTIADDR(rs->rdr->host->addr))) 4485 rpool->opts = PF_POOL_ROUNDROBIN; 4486 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN && 4487 disallow_table(rs->rdr->host, "tables are only supported in " 4488 "round-robin redirection pools")) 4489 return (1); 4490 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN && 4491 disallow_alias(rs->rdr->host, "interface (%s) is only supported in " 4492 "round-robin redirection pools")) 4493 return (1); 4494 if (rs->rdr->host->next != NULL) { 4495 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) { 4496 yyerror("only round-robin valid for multiple " 4497 "redirection addresses"); 4498 return (1); 4499 } 4500 } 4501 4502 if (rs->pool_opts.key != NULL) 4503 memcpy(&rpool->key, rs->pool_opts.key, 4504 sizeof(struct pf_poolhashkey)); 4505 4506 if (rs->pool_opts.opts) 4507 rpool->opts |= rs->pool_opts.opts; 4508 4509 if (rs->pool_opts.staticport) { 4510 if (isrdr) { 4511 yyerror("the 'static-port' option is only valid with " 4512 "nat rules"); 4513 return (1); 4514 } 4515 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 4516 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 4517 yyerror("the 'static-port' option can't be used when " 4518 "specifying a port range"); 4519 return (1); 4520 } 4521 rpool->proxy_port[0] = 0; 4522 rpool->proxy_port[1] = 0; 4523 } 4524 4525 TAILQ_INIT(&rpool->list); 4526 for (h = rs->rdr->host; h != NULL; h = h->next) { 4527 if ((pa = calloc(1, sizeof(struct pf_pooladdr))) == NULL) 4528 err(1, "apply_redirspec: calloc"); 4529 pa->addr = h->addr; 4530 if (h->ifname != NULL) { 4531 if (strlcpy(pa->ifname, h->ifname, sizeof pa->ifname) >= 4532 sizeof(pa->ifname)) 4533 errx(1, "apply_redirspec: strlcpy"); 4534 } else 4535 pa->ifname[0] = 0; 4536 TAILQ_INSERT_TAIL(&rpool->list, pa, entries); 4537 } 4538 4539 return (0); 4540} 4541 4542 4543void 4544expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces, 4545 struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute, 4546 struct node_proto *protos, struct node_os *src_oses, 4547 struct node_host *src_hosts, struct node_port *src_ports, 4548 struct node_host *dst_hosts, struct node_port *dst_ports, 4549 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4550 const char *anchor_call) 4551{ 4552 sa_family_t af = r->af; 4553 int added = 0, error = 0; 4554 char ifname[IF_NAMESIZE]; 4555 char label[PF_RULE_LABEL_SIZE]; 4556 char tagname[PF_TAG_NAME_SIZE]; 4557 char match_tagname[PF_TAG_NAME_SIZE]; 4558 u_int8_t flags, flagset, keep_state; 4559 struct node_host *srch, *dsth; 4560 struct redirspec binat; 4561 struct pf_rule rb; 4562 int dir = r->direction; 4563 4564 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4565 errx(1, "expand_rule: strlcpy"); 4566 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4567 errx(1, "expand_rule: strlcpy"); 4568 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4569 sizeof(match_tagname)) 4570 errx(1, "expand_rule: strlcpy"); 4571 flags = r->flags; 4572 flagset = r->flagset; 4573 keep_state = r->keep_state; 4574 4575 LOOP_THROUGH(struct node_if, interface, interfaces, 4576 LOOP_THROUGH(struct node_proto, proto, protos, 4577 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4578 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4579 LOOP_THROUGH(struct node_port, src_port, src_ports, 4580 LOOP_THROUGH(struct node_os, src_os, src_oses, 4581 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4582 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4583 LOOP_THROUGH(struct node_uid, uid, uids, 4584 LOOP_THROUGH(struct node_gid, gid, gids, 4585 4586 r->af = af; 4587 /* for link-local IPv6 address, interface must match up */ 4588 if ((r->af && src_host->af && r->af != src_host->af) || 4589 (r->af && dst_host->af && r->af != dst_host->af) || 4590 (src_host->af && dst_host->af && 4591 src_host->af != dst_host->af) || 4592 (src_host->ifindex && dst_host->ifindex && 4593 src_host->ifindex != dst_host->ifindex) || 4594 (src_host->ifindex && *interface->ifname && 4595 src_host->ifindex != if_nametoindex(interface->ifname)) || 4596 (dst_host->ifindex && *interface->ifname && 4597 dst_host->ifindex != if_nametoindex(interface->ifname))) 4598 continue; 4599 if (!r->af && src_host->af) 4600 r->af = src_host->af; 4601 else if (!r->af && dst_host->af) 4602 r->af = dst_host->af; 4603 4604 if (*interface->ifname) 4605 strlcpy(r->ifname, interface->ifname, 4606 sizeof(r->ifname)); 4607 else if (if_indextoname(src_host->ifindex, ifname)) 4608 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4609 else if (if_indextoname(dst_host->ifindex, ifname)) 4610 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4611 else 4612 memset(r->ifname, '\0', sizeof(r->ifname)); 4613 4614 if (strlcpy(r->label, label, sizeof(r->label)) >= 4615 sizeof(r->label)) 4616 errx(1, "expand_rule: strlcpy"); 4617 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4618 sizeof(r->tagname)) 4619 errx(1, "expand_rule: strlcpy"); 4620 if (strlcpy(r->match_tagname, match_tagname, 4621 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4622 errx(1, "expand_rule: strlcpy"); 4623 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4624 src_host, src_port, dst_host, dst_port, proto->proto); 4625 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4626 src_host, src_port, dst_host, dst_port, proto->proto); 4627 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4628 r->af, src_host, src_port, dst_host, dst_port, 4629 proto->proto); 4630 4631 error += check_netmask(src_host, r->af); 4632 error += check_netmask(dst_host, r->af); 4633 4634 r->ifnot = interface->not; 4635 r->proto = proto->proto; 4636 r->src.addr = src_host->addr; 4637 r->src.neg = src_host->not; 4638 r->src.port[0] = src_port->port[0]; 4639 r->src.port[1] = src_port->port[1]; 4640 r->src.port_op = src_port->op; 4641 r->dst.addr = dst_host->addr; 4642 r->dst.neg = dst_host->not; 4643 r->dst.port[0] = dst_port->port[0]; 4644 r->dst.port[1] = dst_port->port[1]; 4645 r->dst.port_op = dst_port->op; 4646 r->uid.op = uid->op; 4647 r->uid.uid[0] = uid->uid[0]; 4648 r->uid.uid[1] = uid->uid[1]; 4649 r->gid.op = gid->op; 4650 r->gid.gid[0] = gid->gid[0]; 4651 r->gid.gid[1] = gid->gid[1]; 4652 r->type = icmp_type->type; 4653 r->code = icmp_type->code; 4654 4655 if ((keep_state == PF_STATE_MODULATE || 4656 keep_state == PF_STATE_SYNPROXY) && 4657 r->proto && r->proto != IPPROTO_TCP) 4658 r->keep_state = PF_STATE_NORMAL; 4659 else 4660 r->keep_state = keep_state; 4661 4662 if (r->proto && r->proto != IPPROTO_TCP) { 4663 r->flags = 0; 4664 r->flagset = 0; 4665 } else { 4666 r->flags = flags; 4667 r->flagset = flagset; 4668 } 4669 if (icmp_type->proto && r->proto != icmp_type->proto) { 4670 yyerror("icmp-type mismatch"); 4671 error++; 4672 } 4673 4674 if (src_os && src_os->os) { 4675 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4676 if ((pf->opts & PF_OPT_VERBOSE2) && 4677 r->os_fingerprint == PF_OSFP_NOMATCH) 4678 fprintf(stderr, 4679 "warning: unknown '%s' OS fingerprint\n", 4680 src_os->os); 4681 } else { 4682 r->os_fingerprint = PF_OSFP_ANY; 4683 } 4684 4685 if (nat && nat->rdr && nat->binat) { 4686 if (disallow_table(src_host, "invalid use of table " 4687 "<%s> as the source address of a binat-to rule") || 4688 disallow_alias(src_host, "invalid use of interface " 4689 "(%s) as the source address of a binat-to rule")) { 4690 error++; 4691 } else if (src_host->af == AF_UNSPEC) { 4692 yyerror("binat-to requires a specified " 4693 "source and redirect address"); 4694 error++; 4695 } 4696 if (disallow_table(src_host, "invalid use of table " 4697 "<%s> as the redirect address of a " 4698 "binat-to rule") || 4699 disallow_alias(dst_host, "invalid use of interface " 4700 "(%s) as the redirect address of a " 4701 "binat-to rule") || 4702 disallow_urpf_failed(dst_host, "\"urpf-failed\" " 4703 "is not permitted as a binat-to destination")) { 4704 error++; 4705 } 4706 if (r->direction != PF_INOUT) { 4707 yyerror("binat-to cannot be specified " 4708 "with a direction"); 4709 error++; 4710 } 4711 4712 /* first specify outbound NAT rule */ 4713 r->direction = PF_OUT; 4714 } 4715 4716 error += apply_redirspec(&r->nat, r, nat, 0, dst_port); 4717 error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port); 4718 error += apply_redirspec(&r->route, r, rroute, 2, dst_port); 4719 4720 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4721 yyerror("skipping rule due to errors"); 4722 else { 4723 r->nr = pf->astack[pf->asd]->match++; 4724 pfctl_add_rule(pf, r, anchor_call); 4725 added++; 4726 } 4727 r->direction = dir; 4728 4729 /* Generate binat's matching inbound rule */ 4730 if (!error && nat && nat->rdr && nat->binat) { 4731 bcopy(r, &rb, sizeof(rb)); 4732 4733 /* now specify inbound rdr rule */ 4734 rb.direction = PF_IN; 4735 4736 if ((srch = calloc(1, sizeof(*srch))) == NULL) 4737 err(1, "expand_rule: calloc"); 4738 bcopy(src_host, srch, sizeof(*srch)); 4739 srch->ifname = NULL; 4740 srch->next = NULL; 4741 srch->tail = NULL; 4742 4743 if ((dsth = calloc(1, sizeof(*dsth))) == NULL) 4744 err(1, "expand_rule: calloc"); 4745 bcopy(nat->rdr->host, dsth, sizeof(*dsth)); 4746 dsth->ifname = NULL; 4747 dsth->next = NULL; 4748 dsth->tail = NULL; 4749 4750 if ((binat.rdr = 4751 calloc(1, sizeof(*binat.rdr))) == NULL) 4752 err(1, "expand_rule: calloc"); 4753 bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr)); 4754 bcopy(&nat->pool_opts, &binat.pool_opts, 4755 sizeof(binat.pool_opts)); 4756 binat.pool_opts.staticport = 0; 4757 binat.rdr->host = srch; 4758 4759 expand_rule(&rb, 1, interface, NULL, &binat, NULL, 4760 proto, 4761 src_os, dst_host, dst_port, dsth, src_port, 4762 uid, gid, icmp_type, anchor_call); 4763 } 4764 4765 )))))))))); 4766 4767 if (!keeprule) { 4768 FREE_LIST(struct node_if, interfaces); 4769 FREE_LIST(struct node_proto, protos); 4770 FREE_LIST(struct node_host, src_hosts); 4771 FREE_LIST(struct node_port, src_ports); 4772 FREE_LIST(struct node_os, src_oses); 4773 FREE_LIST(struct node_host, dst_hosts); 4774 FREE_LIST(struct node_port, dst_ports); 4775 FREE_LIST(struct node_uid, uids); 4776 FREE_LIST(struct node_gid, gids); 4777 FREE_LIST(struct node_icmp, icmp_types); 4778 if (nat && nat->rdr) 4779 FREE_LIST(struct node_host, nat->rdr->host); 4780 if (rdr && rdr->rdr) 4781 FREE_LIST(struct node_host, rdr->rdr->host); 4782 } 4783 4784 if (!added) 4785 yyerror("rule expands to no valid combination"); 4786} 4787 4788int 4789expand_skip_interface(struct node_if *interfaces) 4790{ 4791 int errs = 0; 4792 4793 if (!interfaces || (!interfaces->next && !interfaces->not && 4794 !strcmp(interfaces->ifname, "none"))) { 4795 if (pf->opts & PF_OPT_VERBOSE) 4796 printf("set skip on none\n"); 4797 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4798 return (errs); 4799 } 4800 4801 if (pf->opts & PF_OPT_VERBOSE) 4802 printf("set skip on {"); 4803 LOOP_THROUGH(struct node_if, interface, interfaces, 4804 if (pf->opts & PF_OPT_VERBOSE) 4805 printf(" %s", interface->ifname); 4806 if (interface->not) { 4807 yyerror("skip on ! <interface> is not supported"); 4808 errs++; 4809 } else 4810 errs += pfctl_set_interface_flags(pf, 4811 interface->ifname, PFI_IFLAG_SKIP, 1); 4812 ); 4813 if (pf->opts & PF_OPT_VERBOSE) 4814 printf(" }\n"); 4815 4816 FREE_LIST(struct node_if, interfaces); 4817 4818 if (errs) 4819 return (1); 4820 else 4821 return (0); 4822} 4823 4824#undef FREE_LIST 4825#undef LOOP_THROUGH 4826 4827int 4828check_rulestate(int desired_state) 4829{ 4830 if (require_order && (rulestate > desired_state)) { 4831 yyerror("Rules must be in order: options, normalization, " 4832 "queueing, translation, filtering"); 4833 return (1); 4834 } 4835 rulestate = desired_state; 4836 return (0); 4837} 4838 4839int 4840kw_cmp(const void *k, const void *e) 4841{ 4842 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4843} 4844 4845int 4846lookup(char *s) 4847{ 4848 /* this has to be sorted always */ 4849 static const struct keywords keywords[] = { 4850 { "all", ALL}, 4851 { "allow-opts", ALLOWOPTS}, 4852 { "altq", ALTQ}, 4853 { "anchor", ANCHOR}, 4854 { "antispoof", ANTISPOOF}, 4855 { "any", ANY}, 4856 { "bandwidth", BANDWIDTH}, 4857 { "binat-to", BINATTO}, 4858 { "bitmask", BITMASK}, 4859 { "block", BLOCK}, 4860 { "block-policy", BLOCKPOLICY}, 4861 { "cbq", CBQ}, 4862 { "code", CODE}, 4863 { "crop", FRAGCROP}, 4864 { "debug", DEBUG}, 4865 { "divert-packet", DIVERTPACKET}, 4866 { "divert-reply", DIVERTREPLY}, 4867 { "divert-to", DIVERTTO}, 4868 { "drop", DROP}, 4869 { "drop-ovl", FRAGDROP}, 4870 { "dup-to", DUPTO}, 4871 { "fastroute", FASTROUTE}, 4872 { "file", FILENAME}, 4873 { "fingerprints", FINGERPRINTS}, 4874 { "flags", FLAGS}, 4875 { "floating", FLOATING}, 4876 { "flush", FLUSH}, 4877 { "for", FOR}, 4878 { "fragment", FRAGMENT}, 4879 { "from", FROM}, 4880 { "global", GLOBAL}, 4881 { "group", GROUP}, 4882 { "hfsc", HFSC}, 4883 { "hostid", HOSTID}, 4884 { "icmp-type", ICMPTYPE}, 4885 { "icmp6-type", ICMP6TYPE}, 4886 { "if-bound", IFBOUND}, 4887 { "in", IN}, 4888 { "include", INCLUDE}, 4889 { "inet", INET}, 4890 { "inet6", INET6}, 4891 { "keep", KEEP}, 4892 { "label", LABEL}, 4893 { "limit", LIMIT}, 4894 { "linkshare", LINKSHARE}, 4895 { "load", LOAD}, 4896 { "log", LOG}, 4897 { "loginterface", LOGINTERFACE}, 4898 { "match", MATCH}, 4899 { "max", MAXIMUM}, 4900 { "max-mss", MAXMSS}, 4901 { "max-src-conn", MAXSRCCONN}, 4902 { "max-src-conn-rate", MAXSRCCONNRATE}, 4903 { "max-src-nodes", MAXSRCNODES}, 4904 { "max-src-states", MAXSRCSTATES}, 4905 { "min-ttl", MINTTL}, 4906 { "modulate", MODULATE}, 4907 { "nat", NAT}, 4908 { "nat-anchor", NATANCHOR}, 4909 { "nat-to", NATTO}, 4910 { "no", NO}, 4911 { "no-df", NODF}, 4912 { "no-route", NOROUTE}, 4913 { "no-sync", NOSYNC}, 4914 { "on", ON}, 4915 { "optimization", OPTIMIZATION}, 4916 { "os", OS}, 4917 { "out", OUT}, 4918 { "overload", OVERLOAD}, 4919 { "pass", PASS}, 4920 { "pflow", PFLOW}, 4921 { "port", PORT}, 4922 { "priority", PRIORITY}, 4923 { "priq", PRIQ}, 4924 { "probability", PROBABILITY}, 4925 { "proto", PROTO}, 4926 { "qlimit", QLIMIT}, 4927 { "queue", QUEUE}, 4928 { "quick", QUICK}, 4929 { "random", RANDOM}, 4930 { "random-id", RANDOMID}, 4931 { "rdr", RDR}, 4932 { "rdr-anchor", RDRANCHOR}, 4933 { "rdr-to", RDRTO}, 4934 { "realtime", REALTIME}, 4935 { "reassemble", REASSEMBLE}, 4936 { "reply-to", REPLYTO}, 4937 { "require-order", REQUIREORDER}, 4938 { "return", RETURN}, 4939 { "return-icmp", RETURNICMP}, 4940 { "return-icmp6", RETURNICMP6}, 4941 { "return-rst", RETURNRST}, 4942 { "round-robin", ROUNDROBIN}, 4943 { "route", ROUTE}, 4944 { "route-to", ROUTETO}, 4945 { "rtable", RTABLE}, 4946 { "rule", RULE}, 4947 { "ruleset-optimization", RULESET_OPTIMIZATION}, 4948 { "scrub", SCRUB}, 4949 { "set", SET}, 4950 { "set-tos", SETTOS}, 4951 { "skip", SKIP}, 4952 { "sloppy", SLOPPY}, 4953 { "source-hash", SOURCEHASH}, 4954 { "source-track", SOURCETRACK}, 4955 { "state", STATE}, 4956 { "state-defaults", STATEDEFAULTS}, 4957 { "state-policy", STATEPOLICY}, 4958 { "static-port", STATICPORT}, 4959 { "sticky-address", STICKYADDRESS}, 4960 { "synproxy", SYNPROXY}, 4961 { "table", TABLE}, 4962 { "tag", TAG}, 4963 { "tagged", TAGGED}, 4964 { "tbrsize", TBRSIZE}, 4965 { "timeout", TIMEOUT}, 4966 { "to", TO}, 4967 { "tos", TOS}, 4968 { "ttl", TTL}, 4969 { "upperlimit", UPPERLIMIT}, 4970 { "urpf-failed", URPFFAILED}, 4971 { "user", USER}, 4972 }; 4973 const struct keywords *p; 4974 4975 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4976 sizeof(keywords[0]), kw_cmp); 4977 4978 if (p) { 4979 if (debug > 1) 4980 fprintf(stderr, "%s: %d\n", s, p->k_val); 4981 return (p->k_val); 4982 } else { 4983 if (debug > 1) 4984 fprintf(stderr, "string: %s\n", s); 4985 return (STRING); 4986 } 4987} 4988 4989#define MAXPUSHBACK 128 4990 4991char *parsebuf; 4992int parseindex; 4993char pushback_buffer[MAXPUSHBACK]; 4994int pushback_index = 0; 4995 4996int 4997lgetc(int quotec) 4998{ 4999 int c, next; 5000 5001 if (parsebuf) { 5002 /* Read character from the parsebuffer instead of input. */ 5003 if (parseindex >= 0) { 5004 c = parsebuf[parseindex++]; 5005 if (c != '\0') 5006 return (c); 5007 parsebuf = NULL; 5008 } else 5009 parseindex++; 5010 } 5011 5012 if (pushback_index) 5013 return (pushback_buffer[--pushback_index]); 5014 5015 if (quotec) { 5016 if ((c = getc(file->stream)) == EOF) { 5017 yyerror("reached end of file while parsing quoted string"); 5018 if (popfile() == EOF) 5019 return (EOF); 5020 return (quotec); 5021 } 5022 return (c); 5023 } 5024 5025 while ((c = getc(file->stream)) == '\\') { 5026 next = getc(file->stream); 5027 if (next != '\n') { 5028 c = next; 5029 break; 5030 } 5031 yylval.lineno = file->lineno; 5032 file->lineno++; 5033 } 5034 5035 while (c == EOF) { 5036 if (popfile() == EOF) 5037 return (EOF); 5038 c = getc(file->stream); 5039 } 5040 return (c); 5041} 5042 5043int 5044lungetc(int c) 5045{ 5046 if (c == EOF) 5047 return (EOF); 5048 if (parsebuf) { 5049 parseindex--; 5050 if (parseindex >= 0) 5051 return (c); 5052 } 5053 if (pushback_index < MAXPUSHBACK-1) 5054 return (pushback_buffer[pushback_index++] = c); 5055 else 5056 return (EOF); 5057} 5058 5059int 5060findeol(void) 5061{ 5062 int c; 5063 5064 parsebuf = NULL; 5065 5066 /* skip to either EOF or the first real EOL */ 5067 while (1) { 5068 if (pushback_index) 5069 c = pushback_buffer[--pushback_index]; 5070 else 5071 c = lgetc(0); 5072 if (c == '\n') { 5073 file->lineno++; 5074 break; 5075 } 5076 if (c == EOF) 5077 break; 5078 } 5079 return (ERROR); 5080} 5081 5082int 5083yylex(void) 5084{ 5085 char buf[8096]; 5086 char *p, *val; 5087 int quotec, next, c; 5088 int token; 5089 5090top: 5091 p = buf; 5092 while ((c = lgetc(0)) == ' ' || c == '\t') 5093 ; /* nothing */ 5094 5095 yylval.lineno = file->lineno; 5096 if (c == '#') 5097 while ((c = lgetc(0)) != '\n' && c != EOF) 5098 ; /* nothing */ 5099 if (c == '$' && parsebuf == NULL) { 5100 while (1) { 5101 if ((c = lgetc(0)) == EOF) 5102 return (0); 5103 5104 if (p + 1 >= buf + sizeof(buf) - 1) { 5105 yyerror("string too long"); 5106 return (findeol()); 5107 } 5108 if (isalnum(c) || c == '_') { 5109 *p++ = (char)c; 5110 continue; 5111 } 5112 *p = '\0'; 5113 lungetc(c); 5114 break; 5115 } 5116 val = symget(buf); 5117 if (val == NULL) { 5118 yyerror("macro '%s' not defined", buf); 5119 return (findeol()); 5120 } 5121 parsebuf = val; 5122 parseindex = 0; 5123 goto top; 5124 } 5125 5126 switch (c) { 5127 case '\'': 5128 case '"': 5129 quotec = c; 5130 while (1) { 5131 if ((c = lgetc(quotec)) == EOF) 5132 return (0); 5133 if (c == '\n') { 5134 file->lineno++; 5135 continue; 5136 } else if (c == '\\') { 5137 if ((next = lgetc(quotec)) == EOF) 5138 return (0); 5139 if (next == quotec || c == ' ' || c == '\t') 5140 c = next; 5141 else if (next == '\n') 5142 continue; 5143 else 5144 lungetc(next); 5145 } else if (c == quotec) { 5146 *p = '\0'; 5147 break; 5148 } 5149 if (p + 1 >= buf + sizeof(buf) - 1) { 5150 yyerror("string too long"); 5151 return (findeol()); 5152 } 5153 *p++ = (char)c; 5154 } 5155 yylval.v.string = strdup(buf); 5156 if (yylval.v.string == NULL) 5157 err(1, "yylex: strdup"); 5158 return (STRING); 5159 case '<': 5160 next = lgetc(0); 5161 if (next == '>') { 5162 yylval.v.i = PF_OP_XRG; 5163 return (PORTBINARY); 5164 } 5165 lungetc(next); 5166 break; 5167 case '>': 5168 next = lgetc(0); 5169 if (next == '<') { 5170 yylval.v.i = PF_OP_IRG; 5171 return (PORTBINARY); 5172 } 5173 lungetc(next); 5174 break; 5175 } 5176 5177#define allowed_to_end_number(x) \ 5178 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5179 5180 if (c == '-' || isdigit(c)) { 5181 do { 5182 *p++ = c; 5183 if ((unsigned)(p-buf) >= sizeof(buf)) { 5184 yyerror("string too long"); 5185 return (findeol()); 5186 } 5187 } while ((c = lgetc(0)) != EOF && isdigit(c)); 5188 lungetc(c); 5189 if (p == buf + 1 && buf[0] == '-') 5190 goto nodigits; 5191 if (c == EOF || allowed_to_end_number(c)) { 5192 const char *errstr = NULL; 5193 5194 *p = '\0'; 5195 yylval.v.number = strtonum(buf, LLONG_MIN, 5196 LLONG_MAX, &errstr); 5197 if (errstr) { 5198 yyerror("\"%s\" invalid number: %s", 5199 buf, errstr); 5200 return (findeol()); 5201 } 5202 return (NUMBER); 5203 } else { 5204nodigits: 5205 while (p > buf + 1) 5206 lungetc(*--p); 5207 c = *--p; 5208 if (c == '-') 5209 return (c); 5210 } 5211 } 5212 5213#define allowed_in_string(x) \ 5214 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5215 x != '{' && x != '}' && x != '<' && x != '>' && \ 5216 x != '!' && x != '=' && x != '/' && x != '#' && \ 5217 x != ',')) 5218 5219 if (isalnum(c) || c == ':' || c == '_') { 5220 do { 5221 *p++ = c; 5222 if ((unsigned)(p-buf) >= sizeof(buf)) { 5223 yyerror("string too long"); 5224 return (findeol()); 5225 } 5226 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 5227 lungetc(c); 5228 *p = '\0'; 5229 if ((token = lookup(buf)) == STRING) 5230 if ((yylval.v.string = strdup(buf)) == NULL) 5231 err(1, "yylex: strdup"); 5232 return (token); 5233 } 5234 if (c == '\n') { 5235 yylval.lineno = file->lineno; 5236 file->lineno++; 5237 } 5238 if (c == EOF) 5239 return (0); 5240 return (c); 5241} 5242 5243int 5244check_file_secrecy(int fd, const char *fname) 5245{ 5246 struct stat st; 5247 5248 if (fstat(fd, &st)) { 5249 warn("cannot stat %s", fname); 5250 return (-1); 5251 } 5252 if (st.st_uid != 0 && st.st_uid != getuid()) { 5253 warnx("%s: owner not root or current user", fname); 5254 return (-1); 5255 } 5256 if (st.st_mode & (S_IRWXG | S_IRWXO)) { 5257 warnx("%s: group/world readable/writeable", fname); 5258 return (-1); 5259 } 5260 return (0); 5261} 5262 5263struct file * 5264pushfile(const char *name, int secret) 5265{ 5266 struct file *nfile; 5267 5268 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 5269 (nfile->name = strdup(name)) == NULL) { 5270 if (nfile) 5271 free(nfile); 5272 warn("malloc"); 5273 return (NULL); 5274 } 5275 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 5276 nfile->stream = stdin; 5277 free(nfile->name); 5278 if ((nfile->name = strdup("stdin")) == NULL) { 5279 warn("strdup"); 5280 free(nfile); 5281 return (NULL); 5282 } 5283 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 5284 warn("%s", nfile->name); 5285 free(nfile->name); 5286 free(nfile); 5287 return (NULL); 5288 } else if (secret && 5289 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 5290 fclose(nfile->stream); 5291 free(nfile->name); 5292 free(nfile); 5293 return (NULL); 5294 } 5295 nfile->lineno = 1; 5296 TAILQ_INSERT_TAIL(&files, nfile, entry); 5297 return (nfile); 5298} 5299 5300int 5301popfile(void) 5302{ 5303 struct file *prev; 5304 5305 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 5306 prev->errors += file->errors; 5307 TAILQ_REMOVE(&files, file, entry); 5308 fclose(file->stream); 5309 free(file->name); 5310 free(file); 5311 file = prev; 5312 return (0); 5313 } 5314 return (EOF); 5315} 5316 5317int 5318parse_config(char *filename, struct pfctl *xpf) 5319{ 5320 int errors = 0; 5321 struct sym *sym; 5322 5323 pf = xpf; 5324 errors = 0; 5325 rulestate = PFCTL_STATE_NONE; 5326 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5327 returnicmp6default = 5328 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5329 blockpolicy = PFRULE_DROP; 5330 require_order = 0; 5331 5332 if ((file = pushfile(filename, 0)) == NULL) { 5333 warn("cannot open the main config file!"); 5334 return (-1); 5335 } 5336 5337 yyparse(); 5338 errors = file->errors; 5339 popfile(); 5340 5341 /* Free macros and check which have not been used. */ 5342 while ((sym = TAILQ_FIRST(&symhead))) { 5343 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5344 fprintf(stderr, "warning: macro '%s' not " 5345 "used\n", sym->nam); 5346 free(sym->nam); 5347 free(sym->val); 5348 TAILQ_REMOVE(&symhead, sym, entry); 5349 free(sym); 5350 } 5351 5352 return (errors ? -1 : 0); 5353} 5354 5355int 5356symset(const char *nam, const char *val, int persist) 5357{ 5358 struct sym *sym; 5359 5360 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5361 sym = TAILQ_NEXT(sym, entry)) 5362 ; /* nothing */ 5363 5364 if (sym != NULL) { 5365 if (sym->persist == 1) 5366 return (0); 5367 else { 5368 free(sym->nam); 5369 free(sym->val); 5370 TAILQ_REMOVE(&symhead, sym, entry); 5371 free(sym); 5372 } 5373 } 5374 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5375 return (-1); 5376 5377 sym->nam = strdup(nam); 5378 if (sym->nam == NULL) { 5379 free(sym); 5380 return (-1); 5381 } 5382 sym->val = strdup(val); 5383 if (sym->val == NULL) { 5384 free(sym->nam); 5385 free(sym); 5386 return (-1); 5387 } 5388 sym->used = 0; 5389 sym->persist = persist; 5390 TAILQ_INSERT_TAIL(&symhead, sym, entry); 5391 return (0); 5392} 5393 5394int 5395pfctl_cmdline_symset(char *s) 5396{ 5397 char *sym, *val; 5398 int ret; 5399 5400 if ((val = strrchr(s, '=')) == NULL) 5401 return (-1); 5402 5403 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5404 err(1, "pfctl_cmdline_symset: malloc"); 5405 5406 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5407 5408 ret = symset(sym, val + 1, 1); 5409 free(sym); 5410 5411 return (ret); 5412} 5413 5414char * 5415symget(const char *nam) 5416{ 5417 struct sym *sym; 5418 5419 TAILQ_FOREACH(sym, &symhead, entry) 5420 if (strcmp(nam, sym->nam) == 0) { 5421 sym->used = 1; 5422 return (sym->val); 5423 } 5424 return (NULL); 5425} 5426 5427void 5428mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5429{ 5430 struct pf_rule *r; 5431 5432 while ((r = TAILQ_FIRST(src->rules.active.ptr)) != NULL) { 5433 TAILQ_REMOVE(src->rules.active.ptr, r, entries); 5434 TAILQ_INSERT_TAIL(dst->rules.active.ptr, r, entries); 5435 dst->anchor->match++; 5436 } 5437 src->anchor->match = 0; 5438 while ((r = TAILQ_FIRST(src->rules.inactive.ptr)) != NULL) { 5439 TAILQ_REMOVE(src->rules.inactive.ptr, r, entries); 5440 TAILQ_INSERT_TAIL(dst->rules.inactive.ptr, r, entries); 5441 } 5442} 5443 5444void 5445decide_address_family(struct node_host *n, sa_family_t *af) 5446{ 5447 if (*af != 0 || n == NULL) 5448 return; 5449 *af = n->af; 5450 while ((n = n->next) != NULL) { 5451 if (n->af != *af) { 5452 *af = 0; 5453 return; 5454 } 5455 } 5456} 5457 5458void 5459remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5460{ 5461 struct node_host *n = *nh, *prev = NULL; 5462 5463 while (n != NULL) { 5464 if (*af && n->af && n->af != *af) { 5465 /* unlink and free n */ 5466 struct node_host *next = n->next; 5467 5468 /* adjust tail pointer */ 5469 if (n == (*nh)->tail) 5470 (*nh)->tail = prev; 5471 /* adjust previous node's next pointer */ 5472 if (prev == NULL) 5473 *nh = next; 5474 else 5475 prev->next = next; 5476 /* free node */ 5477 if (n->ifname != NULL) 5478 free(n->ifname); 5479 free(n); 5480 n = next; 5481 } else { 5482 if (n->af && !*af) 5483 *af = n->af; 5484 prev = n; 5485 n = n->next; 5486 } 5487 } 5488} 5489 5490int 5491invalid_redirect(struct node_host *nh, sa_family_t af) 5492{ 5493 if (!af) { 5494 struct node_host *n; 5495 5496 /* tables and dyniftl are ok without an address family */ 5497 for (n = nh; n != NULL; n = n->next) { 5498 if (n->addr.type != PF_ADDR_TABLE && 5499 n->addr.type != PF_ADDR_DYNIFTL) { 5500 yyerror("address family not given and " 5501 "translation address expands to multiple " 5502 "address families"); 5503 return (1); 5504 } 5505 } 5506 } 5507 if (nh == NULL) { 5508 yyerror("no translation address with matching address family " 5509 "found."); 5510 return (1); 5511 } 5512 return (0); 5513} 5514 5515int 5516atoul(char *s, u_long *ulvalp) 5517{ 5518 u_long ulval; 5519 char *ep; 5520 5521 errno = 0; 5522 ulval = strtoul(s, &ep, 0); 5523 if (s[0] == '\0' || *ep != '\0') 5524 return (-1); 5525 if (errno == ERANGE && ulval == ULONG_MAX) 5526 return (-1); 5527 *ulvalp = ulval; 5528 return (0); 5529} 5530 5531int 5532getservice(char *n) 5533{ 5534 struct servent *s; 5535 u_long ulval; 5536 5537 if (atoul(n, &ulval) == 0) { 5538 if (ulval > 65535) { 5539 yyerror("illegal port value %lu", ulval); 5540 return (-1); 5541 } 5542 return (htons(ulval)); 5543 } else { 5544 s = getservbyname(n, "tcp"); 5545 if (s == NULL) 5546 s = getservbyname(n, "udp"); 5547 if (s == NULL) { 5548 yyerror("unknown port %s", n); 5549 return (-1); 5550 } 5551 return (s->s_port); 5552 } 5553} 5554 5555int 5556rule_label(struct pf_rule *r, char *s) 5557{ 5558 if (s) { 5559 if (strlcpy(r->label, s, sizeof(r->label)) >= 5560 sizeof(r->label)) { 5561 yyerror("rule label too long (max %d chars)", 5562 sizeof(r->label)-1); 5563 return (-1); 5564 } 5565 } 5566 return (0); 5567} 5568 5569u_int16_t 5570parseicmpspec(char *w, sa_family_t af) 5571{ 5572 const struct icmpcodeent *p; 5573 u_long ulval; 5574 u_int8_t icmptype; 5575 5576 if (af == AF_INET) 5577 icmptype = returnicmpdefault >> 8; 5578 else 5579 icmptype = returnicmp6default >> 8; 5580 5581 if (atoul(w, &ulval) == -1) { 5582 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5583 yyerror("unknown icmp code %s", w); 5584 return (0); 5585 } 5586 ulval = p->code; 5587 } 5588 if (ulval > 255) { 5589 yyerror("invalid icmp code %lu", ulval); 5590 return (0); 5591 } 5592 return (icmptype << 8 | ulval); 5593} 5594 5595int 5596parseport(char *port, struct range *r, int extensions) 5597{ 5598 char *p = strchr(port, ':'); 5599 5600 if (p == NULL) { 5601 if ((r->a = getservice(port)) == -1) 5602 return (-1); 5603 r->b = 0; 5604 r->t = PF_OP_NONE; 5605 return (0); 5606 } 5607 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 5608 *p = 0; 5609 if ((r->a = getservice(port)) == -1) 5610 return (-1); 5611 r->b = 0; 5612 r->t = PF_OP_IRG; 5613 return (0); 5614 } 5615 if ((extensions & PPORT_RANGE)) { 5616 *p++ = 0; 5617 if ((r->a = getservice(port)) == -1 || 5618 (r->b = getservice(p)) == -1) 5619 return (-1); 5620 if (r->a == r->b) { 5621 r->b = 0; 5622 r->t = PF_OP_NONE; 5623 } else 5624 r->t = PF_OP_RRG; 5625 return (0); 5626 } 5627 return (-1); 5628} 5629 5630int 5631pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5632{ 5633 struct loadanchors *la; 5634 5635 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5636 if (pf->opts & PF_OPT_VERBOSE) 5637 fprintf(stderr, "\nLoading anchor %s from %s\n", 5638 la->anchorname, la->filename); 5639 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 5640 la->anchorname, trans) == -1) 5641 return (-1); 5642 } 5643 5644 return (0); 5645} 5646 5647int 5648kw_casecmp(const void *k, const void *e) 5649{ 5650 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 5651} 5652 5653int 5654map_tos(char *s, int *val) 5655{ 5656 /* DiffServ Codepoints and other TOS mappings */ 5657 const struct keywords toswords[] = { 5658 { "af11", IPTOS_DSCP_AF11 }, 5659 { "af12", IPTOS_DSCP_AF12 }, 5660 { "af13", IPTOS_DSCP_AF13 }, 5661 { "af21", IPTOS_DSCP_AF21 }, 5662 { "af22", IPTOS_DSCP_AF22 }, 5663 { "af23", IPTOS_DSCP_AF23 }, 5664 { "af31", IPTOS_DSCP_AF31 }, 5665 { "af32", IPTOS_DSCP_AF32 }, 5666 { "af33", IPTOS_DSCP_AF33 }, 5667 { "af41", IPTOS_DSCP_AF41 }, 5668 { "af42", IPTOS_DSCP_AF42 }, 5669 { "af43", IPTOS_DSCP_AF43 }, 5670 { "critical", IPTOS_PREC_CRITIC_ECP }, 5671 { "cs0", IPTOS_DSCP_CS0 }, 5672 { "cs1", IPTOS_DSCP_CS1 }, 5673 { "cs2", IPTOS_DSCP_CS2 }, 5674 { "cs3", IPTOS_DSCP_CS3 }, 5675 { "cs4", IPTOS_DSCP_CS4 }, 5676 { "cs5", IPTOS_DSCP_CS5 }, 5677 { "cs6", IPTOS_DSCP_CS6 }, 5678 { "cs7", IPTOS_DSCP_CS7 }, 5679 { "ef", IPTOS_DSCP_EF }, 5680 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 5681 { "lowdelay", IPTOS_LOWDELAY }, 5682 { "netcontrol", IPTOS_PREC_NETCONTROL }, 5683 { "reliability", IPTOS_RELIABILITY }, 5684 { "throughput", IPTOS_THROUGHPUT } 5685 }; 5686 const struct keywords *p; 5687 5688 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 5689 sizeof(toswords[0]), kw_casecmp); 5690 5691 if (p) { 5692 *val = p->k_val; 5693 return (1); 5694 } 5695 return (0); 5696} 5697