parse.y revision 1.578
1/* $OpenBSD: parse.y,v 1.578 2009/12/24 10:06:35 sobrado Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/types.h> 31#include <sys/socket.h> 32#include <sys/stat.h> 33#include <net/if.h> 34#include <netinet/in.h> 35#include <netinet/in_systm.h> 36#include <netinet/ip.h> 37#include <netinet/ip_icmp.h> 38#include <netinet/icmp6.h> 39#include <net/pfvar.h> 40#include <arpa/inet.h> 41#include <altq/altq.h> 42#include <altq/altq_cbq.h> 43#include <altq/altq_priq.h> 44#include <altq/altq_hfsc.h> 45 46#include <stdio.h> 47#include <unistd.h> 48#include <stdlib.h> 49#include <netdb.h> 50#include <stdarg.h> 51#include <errno.h> 52#include <string.h> 53#include <ctype.h> 54#include <math.h> 55#include <err.h> 56#include <limits.h> 57#include <pwd.h> 58#include <grp.h> 59#include <md5.h> 60 61#include "pfctl_parser.h" 62#include "pfctl.h" 63 64static struct pfctl *pf = NULL; 65static int debug = 0; 66static int rulestate = 0; 67static u_int16_t returnicmpdefault = 68 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 69static u_int16_t returnicmp6default = 70 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 71static int blockpolicy = PFRULE_DROP; 72static int require_order = 0; 73static int default_statelock; 74 75TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 76static struct file { 77 TAILQ_ENTRY(file) entry; 78 FILE *stream; 79 char *name; 80 int lineno; 81 int errors; 82} *file; 83struct file *pushfile(const char *, int); 84int popfile(void); 85int check_file_secrecy(int, const char *); 86int yyparse(void); 87int yylex(void); 88int yyerror(const char *, ...); 89int kw_cmp(const void *, const void *); 90int lookup(char *); 91int lgetc(int); 92int lungetc(int); 93int findeol(void); 94 95TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 96struct sym { 97 TAILQ_ENTRY(sym) entry; 98 int used; 99 int persist; 100 char *nam; 101 char *val; 102}; 103int symset(const char *, const char *, int); 104char *symget(const char *); 105 106int atoul(char *, u_long *); 107 108enum { 109 PFCTL_STATE_NONE, 110 PFCTL_STATE_OPTION, 111 PFCTL_STATE_QUEUE, 112 PFCTL_STATE_NAT, 113 PFCTL_STATE_FILTER 114}; 115 116struct node_proto { 117 u_int8_t proto; 118 struct node_proto *next; 119 struct node_proto *tail; 120}; 121 122struct node_port { 123 u_int16_t port[2]; 124 u_int8_t op; 125 struct node_port *next; 126 struct node_port *tail; 127}; 128 129struct node_uid { 130 uid_t uid[2]; 131 u_int8_t op; 132 struct node_uid *next; 133 struct node_uid *tail; 134}; 135 136struct node_gid { 137 gid_t gid[2]; 138 u_int8_t op; 139 struct node_gid *next; 140 struct node_gid *tail; 141}; 142 143struct node_icmp { 144 u_int8_t code; 145 u_int8_t type; 146 u_int8_t proto; 147 struct node_icmp *next; 148 struct node_icmp *tail; 149}; 150 151enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 152 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 153 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 154 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 155 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, 156 PF_STATE_OPT_PFLOW }; 157 158enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 159 160struct node_state_opt { 161 int type; 162 union { 163 u_int32_t max_states; 164 u_int32_t max_src_states; 165 u_int32_t max_src_conn; 166 struct { 167 u_int32_t limit; 168 u_int32_t seconds; 169 } max_src_conn_rate; 170 struct { 171 u_int8_t flush; 172 char tblname[PF_TABLE_NAME_SIZE]; 173 } overload; 174 u_int32_t max_src_nodes; 175 u_int8_t src_track; 176 u_int32_t statelock; 177 struct { 178 int number; 179 u_int32_t seconds; 180 } timeout; 181 } data; 182 struct node_state_opt *next; 183 struct node_state_opt *tail; 184}; 185 186struct peer { 187 struct node_host *host; 188 struct node_port *port; 189}; 190 191struct node_queue { 192 char queue[PF_QNAME_SIZE]; 193 char parent[PF_QNAME_SIZE]; 194 char ifname[IFNAMSIZ]; 195 int scheduler; 196 struct node_queue *next; 197 struct node_queue *tail; 198} *queues = NULL; 199 200struct node_qassign { 201 char *qname; 202 char *pqname; 203}; 204 205struct range { 206 int a; 207 int b; 208 int t; 209}; 210struct redirection { 211 struct node_host *host; 212 struct range rport; 213}; 214 215struct pool_opts { 216 int marker; 217#define POM_TYPE 0x01 218#define POM_STICKYADDRESS 0x02 219 u_int8_t opts; 220 int type; 221 int staticport; 222 struct pf_poolhashkey *key; 223 224} pool_opts; 225 226struct redirspec { 227 struct redirection *rdr; 228 struct pool_opts pool_opts; 229 int binat; 230}; 231 232struct filter_opts { 233 int marker; 234#define FOM_FLAGS 0x0001 235#define FOM_ICMP 0x0002 236#define FOM_TOS 0x0004 237#define FOM_KEEP 0x0008 238#define FOM_SRCTRACK 0x0010 239#define FOM_MINTTL 0x0020 240#define FOM_MAXMSS 0x0040 241#define FOM_SETTOS 0x0100 242#define FOM_SCRUB_TCP 0x0200 243 struct node_uid *uid; 244 struct node_gid *gid; 245 struct node_if *rcv; 246 struct { 247 u_int8_t b1; 248 u_int8_t b2; 249 u_int16_t w; 250 u_int16_t w2; 251 } flags; 252 struct node_icmp *icmpspec; 253 u_int32_t tos; 254 u_int32_t prob; 255 struct { 256 int action; 257 struct node_state_opt *options; 258 } keep; 259 int fragment; 260 int allowopts; 261 char *label; 262 struct node_qassign queues; 263 char *tag; 264 char *match_tag; 265 u_int8_t match_tag_not; 266 u_int rtableid; 267 struct { 268 struct node_host *addr; 269 u_int16_t port; 270 } divert, divert_packet; 271 struct redirspec nat; 272 struct redirspec rdr; 273 struct redirspec rroute; 274 275 /* scrub opts */ 276 int nodf; 277 int minttl; 278 int settos; 279 int randomid; 280 int max_mss; 281 282 /* route opts */ 283 struct { 284 struct node_host *host; 285 u_int8_t rt; 286 u_int8_t pool_opts; 287 sa_family_t af; 288 struct pf_poolhashkey *key; 289 } route; 290} filter_opts; 291 292struct antispoof_opts { 293 char *label; 294 u_int rtableid; 295} antispoof_opts; 296 297struct scrub_opts { 298 int marker; 299 int nodf; 300 int minttl; 301 int maxmss; 302 int settos; 303 int randomid; 304 int reassemble_tcp; 305} scrub_opts; 306 307struct queue_opts { 308 int marker; 309#define QOM_BWSPEC 0x01 310#define QOM_SCHEDULER 0x02 311#define QOM_PRIORITY 0x04 312#define QOM_TBRSIZE 0x08 313#define QOM_QLIMIT 0x10 314 struct node_queue_bw queue_bwspec; 315 struct node_queue_opt scheduler; 316 int priority; 317 int tbrsize; 318 int qlimit; 319} queue_opts; 320 321struct table_opts { 322 int flags; 323 int init_addr; 324 struct node_tinithead init_nodes; 325} table_opts; 326 327struct node_hfsc_opts hfsc_opts; 328struct node_state_opt *keep_state_defaults = NULL; 329 330int disallow_table(struct node_host *, const char *); 331int disallow_urpf_failed(struct node_host *, const char *); 332int disallow_alias(struct node_host *, const char *); 333int rule_consistent(struct pf_rule *, int); 334int process_tabledef(char *, struct table_opts *); 335void expand_label_str(char *, size_t, const char *, const char *); 336void expand_label_if(const char *, char *, size_t, const char *); 337void expand_label_addr(const char *, char *, size_t, u_int8_t, 338 struct node_host *); 339void expand_label_port(const char *, char *, size_t, 340 struct node_port *); 341void expand_label_proto(const char *, char *, size_t, u_int8_t); 342void expand_label_nr(const char *, char *, size_t); 343void expand_label(char *, size_t, const char *, u_int8_t, 344 struct node_host *, struct node_port *, struct node_host *, 345 struct node_port *, u_int8_t); 346int apply_redirspec(struct pf_pool *, struct pf_rule *, 347 struct redirspec *, int, struct node_port *); 348void expand_rule(struct pf_rule *, int, struct node_if *, 349 struct redirspec *, struct redirspec *, struct redirspec *, 350 struct node_proto *, 351 struct node_os *, struct node_host *, struct node_port *, 352 struct node_host *, struct node_port *, struct node_uid *, 353 struct node_gid *, struct node_if *, struct node_icmp *, 354 const char *); 355int expand_altq(struct pf_altq *, struct node_if *, 356 struct node_queue *, struct node_queue_bw bwspec, 357 struct node_queue_opt *); 358int expand_queue(struct pf_altq *, struct node_if *, 359 struct node_queue *, struct node_queue_bw, 360 struct node_queue_opt *); 361int expand_skip_interface(struct node_if *); 362 363int check_rulestate(int); 364int getservice(char *); 365int rule_label(struct pf_rule *, char *); 366 367void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 368void decide_address_family(struct node_host *, sa_family_t *); 369void remove_invalid_hosts(struct node_host **, sa_family_t *); 370int invalid_redirect(struct node_host *, sa_family_t); 371u_int16_t parseicmpspec(char *, sa_family_t); 372int kw_casecmp(const void *, const void *); 373int map_tos(char *string, int *); 374 375TAILQ_HEAD(loadanchorshead, loadanchors) 376 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 377 378struct loadanchors { 379 TAILQ_ENTRY(loadanchors) entries; 380 char *anchorname; 381 char *filename; 382}; 383 384typedef struct { 385 union { 386 int64_t number; 387 double probability; 388 int i; 389 char *string; 390 u_int rtableid; 391 struct { 392 u_int8_t b1; 393 u_int8_t b2; 394 u_int16_t w; 395 u_int16_t w2; 396 } b; 397 struct range range; 398 struct node_if *interface; 399 struct node_proto *proto; 400 struct node_icmp *icmp; 401 struct node_host *host; 402 struct node_os *os; 403 struct node_port *port; 404 struct node_uid *uid; 405 struct node_gid *gid; 406 struct node_state_opt *state_opt; 407 struct peer peer; 408 struct { 409 struct peer src, dst; 410 struct node_os *src_os; 411 } fromto; 412 struct redirection *redirection; 413 struct { 414 int action; 415 struct node_state_opt *options; 416 } keep_state; 417 struct { 418 u_int8_t log; 419 u_int8_t logif; 420 u_int8_t quick; 421 } logquick; 422 struct { 423 int neg; 424 char *name; 425 } tagged; 426 struct pf_poolhashkey *hashkey; 427 struct node_queue *queue; 428 struct node_queue_opt queue_options; 429 struct node_queue_bw queue_bwspec; 430 struct node_qassign qassign; 431 struct filter_opts filter_opts; 432 struct antispoof_opts antispoof_opts; 433 struct queue_opts queue_opts; 434 struct scrub_opts scrub_opts; 435 struct table_opts table_opts; 436 struct pool_opts pool_opts; 437 struct node_hfsc_opts hfsc_opts; 438 } v; 439 int lineno; 440} YYSTYPE; 441 442#define PPORT_RANGE 1 443#define PPORT_STAR 2 444int parseport(char *, struct range *r, int); 445 446#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 447 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 448 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 449 450%} 451 452%token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 453%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 454%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINATTO NODF 455%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 456%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 457%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 458%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 459%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 460%token ANTISPOOF FOR INCLUDE 461%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 462%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 463%token QUEUE PRIORITY QLIMIT RTABLE 464%token LOAD RULESET_OPTIMIZATION 465%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 466%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW 467%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 468%token DIVERTTO DIVERTREPLY DIVERTPACKET NATTO RDRTO RECEIVEDON 469%token <v.string> STRING 470%token <v.number> NUMBER 471%token <v.i> PORTBINARY 472%type <v.interface> interface if_list if_item_not if_item 473%type <v.number> number icmptype icmp6type uid gid 474%type <v.number> tos not yesno optnodf 475%type <v.probability> probability 476%type <v.i> dir af optimizer 477%type <v.i> sourcetrack flush unaryop statelock 478%type <v.b> action 479%type <v.b> flags flag blockspec 480%type <v.range> portplain portstar portrange 481%type <v.hashkey> hashkey 482%type <v.proto> proto proto_list proto_item 483%type <v.number> protoval 484%type <v.icmp> icmpspec 485%type <v.icmp> icmp_list icmp_item 486%type <v.icmp> icmp6_list icmp6_item 487%type <v.number> reticmpspec reticmp6spec 488%type <v.fromto> fromto 489%type <v.peer> ipportspec from to 490%type <v.host> ipspec xhost host dynaddr host_list 491%type <v.host> redir_host_list redirspec 492%type <v.host> route_host route_host_list routespec 493%type <v.os> os xos os_list 494%type <v.port> portspec port_list port_item 495%type <v.uid> uids uid_list uid_item 496%type <v.gid> gids gid_list gid_item 497%type <v.redirection> redirpool 498%type <v.string> label stringall anchorname 499%type <v.string> string varstring numberstring 500%type <v.keep_state> keep 501%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 502%type <v.logquick> logquick quick log logopts logopt 503%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 504%type <v.qassign> qname 505%type <v.queue> qassign qassign_list qassign_item 506%type <v.queue_options> scheduler 507%type <v.number> cbqflags_list cbqflags_item 508%type <v.number> priqflags_list priqflags_item 509%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 510%type <v.queue_bwspec> bandwidth 511%type <v.filter_opts> filter_opts filter_opt filter_opts_l 512%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 513%type <v.queue_opts> queue_opts queue_opt queue_opts_l 514%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 515%type <v.table_opts> table_opts table_opt table_opts_l 516%type <v.pool_opts> pool_opts pool_opt pool_opts_l 517%% 518 519ruleset : /* empty */ 520 | ruleset include '\n' 521 | ruleset '\n' 522 | ruleset option '\n' 523 | ruleset pfrule '\n' 524 | ruleset anchorrule '\n' 525 | ruleset loadrule '\n' 526 | ruleset altqif '\n' 527 | ruleset queuespec '\n' 528 | ruleset varset '\n' 529 | ruleset antispoof '\n' 530 | ruleset tabledef '\n' 531 | '{' fakeanchor '}' '\n'; 532 | ruleset error '\n' { file->errors++; } 533 ; 534 535include : INCLUDE STRING { 536 struct file *nfile; 537 538 if ((nfile = pushfile($2, 0)) == NULL) { 539 yyerror("failed to include file %s", $2); 540 free($2); 541 YYERROR; 542 } 543 free($2); 544 545 file = nfile; 546 lungetc('\n'); 547 } 548 ; 549 550/* 551 * apply to previously specified rule: must be careful to note 552 * what that is: pf or nat or binat or rdr 553 */ 554fakeanchor : fakeanchor '\n' 555 | fakeanchor anchorrule '\n' 556 | fakeanchor pfrule '\n' 557 | fakeanchor error '\n' 558 ; 559 560optimizer : string { 561 if (!strcmp($1, "none")) 562 $$ = 0; 563 else if (!strcmp($1, "basic")) 564 $$ = PF_OPTIMIZE_BASIC; 565 else if (!strcmp($1, "profile")) 566 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 567 else { 568 yyerror("unknown ruleset-optimization %s", $1); 569 YYERROR; 570 } 571 } 572 ; 573 574optnodf : /* empty */ { $$ = 0; } 575 | NODF { $$ = 1; } 576 ; 577 578option : SET REASSEMBLE yesno optnodf { 579 if (check_rulestate(PFCTL_STATE_OPTION)) 580 YYERROR; 581 pfctl_set_reassembly(pf, $3, $4); 582 } 583 | SET OPTIMIZATION STRING { 584 if (check_rulestate(PFCTL_STATE_OPTION)) { 585 free($3); 586 YYERROR; 587 } 588 if (pfctl_set_optimization(pf, $3) != 0) { 589 yyerror("unknown optimization %s", $3); 590 free($3); 591 YYERROR; 592 } 593 free($3); 594 } 595 | SET RULESET_OPTIMIZATION optimizer { 596 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 597 pf->opts |= PF_OPT_OPTIMIZE; 598 pf->optimize = $3; 599 } 600 } 601 | SET TIMEOUT timeout_spec 602 | SET TIMEOUT '{' optnl timeout_list '}' 603 | SET LIMIT limit_spec 604 | SET LIMIT '{' optnl limit_list '}' 605 | SET LOGINTERFACE stringall { 606 if (check_rulestate(PFCTL_STATE_OPTION)) { 607 free($3); 608 YYERROR; 609 } 610 if (pfctl_set_logif(pf, $3) != 0) { 611 yyerror("error setting loginterface %s", $3); 612 free($3); 613 YYERROR; 614 } 615 free($3); 616 } 617 | SET HOSTID number { 618 if ($3 == 0 || $3 > UINT_MAX) { 619 yyerror("hostid must be non-zero"); 620 YYERROR; 621 } 622 if (pfctl_set_hostid(pf, $3) != 0) { 623 yyerror("error setting hostid %08x", $3); 624 YYERROR; 625 } 626 } 627 | SET BLOCKPOLICY DROP { 628 if (pf->opts & PF_OPT_VERBOSE) 629 printf("set block-policy drop\n"); 630 if (check_rulestate(PFCTL_STATE_OPTION)) 631 YYERROR; 632 blockpolicy = PFRULE_DROP; 633 } 634 | SET BLOCKPOLICY RETURN { 635 if (pf->opts & PF_OPT_VERBOSE) 636 printf("set block-policy return\n"); 637 if (check_rulestate(PFCTL_STATE_OPTION)) 638 YYERROR; 639 blockpolicy = PFRULE_RETURN; 640 } 641 | SET REQUIREORDER yesno { 642 if (pf->opts & PF_OPT_VERBOSE) 643 printf("set require-order %s\n", 644 $3 == 1 ? "yes" : "no"); 645 require_order = $3; 646 } 647 | SET FINGERPRINTS STRING { 648 if (pf->opts & PF_OPT_VERBOSE) 649 printf("set fingerprints \"%s\"\n", $3); 650 if (check_rulestate(PFCTL_STATE_OPTION)) { 651 free($3); 652 YYERROR; 653 } 654 if (!pf->anchor->name[0]) { 655 if (pfctl_file_fingerprints(pf->dev, 656 pf->opts, $3)) { 657 yyerror("error loading " 658 "fingerprints %s", $3); 659 free($3); 660 YYERROR; 661 } 662 } 663 free($3); 664 } 665 | SET STATEPOLICY statelock { 666 if (pf->opts & PF_OPT_VERBOSE) 667 switch ($3) { 668 case 0: 669 printf("set state-policy floating\n"); 670 break; 671 case PFRULE_IFBOUND: 672 printf("set state-policy if-bound\n"); 673 break; 674 } 675 default_statelock = $3; 676 } 677 | SET DEBUG STRING { 678 if (check_rulestate(PFCTL_STATE_OPTION)) { 679 free($3); 680 YYERROR; 681 } 682 if (pfctl_set_debug(pf, $3) != 0) { 683 yyerror("error setting debuglevel %s", $3); 684 free($3); 685 YYERROR; 686 } 687 free($3); 688 } 689 | SET SKIP interface { 690 if (expand_skip_interface($3) != 0) { 691 yyerror("error setting skip interface(s)"); 692 YYERROR; 693 } 694 } 695 | SET STATEDEFAULTS state_opt_list { 696 if (keep_state_defaults != NULL) { 697 yyerror("cannot redefine state-defaults"); 698 YYERROR; 699 } 700 keep_state_defaults = $3; 701 } 702 ; 703 704stringall : STRING { $$ = $1; } 705 | ALL { 706 if (($$ = strdup("all")) == NULL) { 707 err(1, "stringall: strdup"); 708 } 709 } 710 ; 711 712string : STRING string { 713 if (asprintf(&$$, "%s %s", $1, $2) == -1) 714 err(1, "string: asprintf"); 715 free($1); 716 free($2); 717 } 718 | STRING 719 ; 720 721varstring : numberstring varstring { 722 if (asprintf(&$$, "%s %s", $1, $2) == -1) 723 err(1, "string: asprintf"); 724 free($1); 725 free($2); 726 } 727 | numberstring 728 ; 729 730numberstring : NUMBER { 731 char *s; 732 if (asprintf(&s, "%lld", $1) == -1) { 733 yyerror("string: asprintf"); 734 YYERROR; 735 } 736 $$ = s; 737 } 738 | STRING 739 ; 740 741varset : STRING '=' varstring { 742 if (pf->opts & PF_OPT_VERBOSE) 743 printf("%s = \"%s\"\n", $1, $3); 744 if (symset($1, $3, 0) == -1) 745 err(1, "cannot store variable %s", $1); 746 free($1); 747 free($3); 748 } 749 ; 750 751anchorname : STRING { $$ = $1; } 752 | /* empty */ { $$ = NULL; } 753 ; 754 755pfa_anchorlist : /* empty */ 756 | pfa_anchorlist '\n' 757 | pfa_anchorlist pfrule '\n' 758 | pfa_anchorlist anchorrule '\n' 759 ; 760 761pfa_anchor : '{' 762 { 763 char ta[PF_ANCHOR_NAME_SIZE]; 764 struct pf_ruleset *rs; 765 766 /* steping into a brace anchor */ 767 pf->asd++; 768 pf->bn++; 769 pf->brace = 1; 770 771 /* create a holding ruleset in the root */ 772 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 773 rs = pf_find_or_create_ruleset(ta); 774 if (rs == NULL) 775 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 776 pf->astack[pf->asd] = rs->anchor; 777 pf->anchor = rs->anchor; 778 } '\n' pfa_anchorlist '}' 779 { 780 pf->alast = pf->anchor; 781 pf->asd--; 782 pf->anchor = pf->astack[pf->asd]; 783 } 784 | /* empty */ 785 ; 786 787anchorrule : ANCHOR anchorname dir quick interface af proto fromto 788 filter_opts pfa_anchor 789 { 790 struct pf_rule r; 791 struct node_proto *proto; 792 793 if (check_rulestate(PFCTL_STATE_FILTER)) { 794 if ($2) 795 free($2); 796 YYERROR; 797 } 798 799 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 800 free($2); 801 yyerror("anchor names beginning with '_' " 802 "are reserved for internal use"); 803 YYERROR; 804 } 805 806 memset(&r, 0, sizeof(r)); 807 if (pf->astack[pf->asd + 1]) { 808 /* move inline rules into relative location */ 809 pf_anchor_setup(&r, 810 &pf->astack[pf->asd]->ruleset, 811 $2 ? $2 : pf->alast->name); 812 813 if (r.anchor == NULL) 814 err(1, "anchorrule: unable to " 815 "create ruleset"); 816 817 if (pf->alast != r.anchor) { 818 if (r.anchor->match) { 819 yyerror("inline anchor '%s' " 820 "already exists", 821 r.anchor->name); 822 YYERROR; 823 } 824 mv_rules(&pf->alast->ruleset, 825 &r.anchor->ruleset); 826 } 827 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 828 pf->alast = r.anchor; 829 } else { 830 if (!$2) { 831 yyerror("anchors without explicit " 832 "rules must specify a name"); 833 YYERROR; 834 } 835 } 836 r.direction = $3; 837 r.quick = $4.quick; 838 r.af = $6; 839 r.prob = $9.prob; 840 r.rtableid = $9.rtableid; 841 842 if ($9.tag) 843 if (strlcpy(r.tagname, $9.tag, 844 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 845 yyerror("tag too long, max %u chars", 846 PF_TAG_NAME_SIZE - 1); 847 YYERROR; 848 } 849 if ($9.match_tag) 850 if (strlcpy(r.match_tagname, $9.match_tag, 851 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 852 yyerror("tag too long, max %u chars", 853 PF_TAG_NAME_SIZE - 1); 854 YYERROR; 855 } 856 r.match_tag_not = $9.match_tag_not; 857 if (rule_label(&r, $9.label)) 858 YYERROR; 859 free($9.label); 860 r.flags = $9.flags.b1; 861 r.flagset = $9.flags.b2; 862 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 863 yyerror("flags always false"); 864 YYERROR; 865 } 866 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 867 for (proto = $7; proto != NULL && 868 proto->proto != IPPROTO_TCP; 869 proto = proto->next) 870 ; /* nothing */ 871 if (proto == NULL && $7 != NULL) { 872 if ($9.flags.b1 || $9.flags.b2) 873 yyerror( 874 "flags only apply to tcp"); 875 if ($8.src_os) 876 yyerror( 877 "OS fingerprinting only " 878 "applies to tcp"); 879 YYERROR; 880 } 881 } 882 883 r.tos = $9.tos; 884 885 if ($9.keep.action) { 886 yyerror("cannot specify state handling " 887 "on anchors"); 888 YYERROR; 889 } 890 891 if ($9.route.rt) { 892 yyerror("cannot specify route handling " 893 "on anchors"); 894 YYERROR; 895 } 896 897 if ($9.match_tag) 898 if (strlcpy(r.match_tagname, $9.match_tag, 899 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 900 yyerror("tag too long, max %u chars", 901 PF_TAG_NAME_SIZE - 1); 902 YYERROR; 903 } 904 r.match_tag_not = $9.match_tag_not; 905 906 decide_address_family($8.src.host, &r.af); 907 decide_address_family($8.dst.host, &r.af); 908 909 expand_rule(&r, 0, $5, NULL, NULL, NULL, $7, $8.src_os, 910 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 911 $9.uid, $9.gid, $9.rcv, $9.icmpspec, 912 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 913 free($2); 914 pf->astack[pf->asd + 1] = NULL; 915 } 916 ; 917 918loadrule : LOAD ANCHOR string FROM string { 919 struct loadanchors *loadanchor; 920 921 if (strlen(pf->anchor->name) + 1 + 922 strlen($3) >= MAXPATHLEN) { 923 yyerror("anchorname %s too long, max %u\n", 924 $3, MAXPATHLEN - 1); 925 free($3); 926 YYERROR; 927 } 928 loadanchor = calloc(1, sizeof(struct loadanchors)); 929 if (loadanchor == NULL) 930 err(1, "loadrule: calloc"); 931 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 932 NULL) 933 err(1, "loadrule: malloc"); 934 if (pf->anchor->name[0]) 935 snprintf(loadanchor->anchorname, MAXPATHLEN, 936 "%s/%s", pf->anchor->name, $3); 937 else 938 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 939 if ((loadanchor->filename = strdup($5)) == NULL) 940 err(1, "loadrule: strdup"); 941 942 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 943 entries); 944 945 free($3); 946 free($5); 947 }; 948 949scrub_opts : { 950 bzero(&scrub_opts, sizeof scrub_opts); 951 } 952 scrub_opts_l 953 { $$ = scrub_opts; } 954 ; 955 956scrub_opts_l : scrub_opts_l comma scrub_opt 957 | scrub_opt 958 ; 959 960scrub_opt : NODF { 961 if (scrub_opts.nodf) { 962 yyerror("no-df cannot be respecified"); 963 YYERROR; 964 } 965 scrub_opts.nodf = 1; 966 } 967 | MINTTL NUMBER { 968 if (scrub_opts.marker & FOM_MINTTL) { 969 yyerror("min-ttl cannot be respecified"); 970 YYERROR; 971 } 972 if ($2 < 0 || $2 > 255) { 973 yyerror("illegal min-ttl value %d", $2); 974 YYERROR; 975 } 976 scrub_opts.marker |= FOM_MINTTL; 977 scrub_opts.minttl = $2; 978 } 979 | MAXMSS NUMBER { 980 if (scrub_opts.marker & FOM_MAXMSS) { 981 yyerror("max-mss cannot be respecified"); 982 YYERROR; 983 } 984 if ($2 < 0 || $2 > 65535) { 985 yyerror("illegal max-mss value %d", $2); 986 YYERROR; 987 } 988 scrub_opts.marker |= FOM_MAXMSS; 989 scrub_opts.maxmss = $2; 990 } 991 | SETTOS tos { 992 if (scrub_opts.marker & FOM_SETTOS) { 993 yyerror("set-tos cannot be respecified"); 994 YYERROR; 995 } 996 scrub_opts.marker |= FOM_SETTOS; 997 scrub_opts.settos = $2; 998 } 999 | REASSEMBLE STRING { 1000 if (strcasecmp($2, "tcp") != 0) { 1001 yyerror("scrub reassemble supports only tcp, " 1002 "not '%s'", $2); 1003 free($2); 1004 YYERROR; 1005 } 1006 free($2); 1007 if (scrub_opts.reassemble_tcp) { 1008 yyerror("reassemble tcp cannot be respecified"); 1009 YYERROR; 1010 } 1011 scrub_opts.reassemble_tcp = 1; 1012 } 1013 | RANDOMID { 1014 if (scrub_opts.randomid) { 1015 yyerror("random-id cannot be respecified"); 1016 YYERROR; 1017 } 1018 scrub_opts.randomid = 1; 1019 } 1020 ; 1021 1022antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1023 struct pf_rule r; 1024 struct node_host *h = NULL, *hh; 1025 struct node_if *i, *j; 1026 1027 if (check_rulestate(PFCTL_STATE_FILTER)) 1028 YYERROR; 1029 1030 for (i = $3; i; i = i->next) { 1031 bzero(&r, sizeof(r)); 1032 1033 r.action = PF_DROP; 1034 r.direction = PF_IN; 1035 r.log = $2.log; 1036 r.logif = $2.logif; 1037 r.quick = $2.quick; 1038 r.af = $4; 1039 if (rule_label(&r, $5.label)) 1040 YYERROR; 1041 r.rtableid = $5.rtableid; 1042 j = calloc(1, sizeof(struct node_if)); 1043 if (j == NULL) 1044 err(1, "antispoof: calloc"); 1045 if (strlcpy(j->ifname, i->ifname, 1046 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1047 free(j); 1048 yyerror("interface name too long"); 1049 YYERROR; 1050 } 1051 j->not = 1; 1052 if (i->dynamic) { 1053 h = calloc(1, sizeof(*h)); 1054 if (h == NULL) 1055 err(1, "address: calloc"); 1056 h->addr.type = PF_ADDR_DYNIFTL; 1057 set_ipmask(h, 128); 1058 if (strlcpy(h->addr.v.ifname, i->ifname, 1059 sizeof(h->addr.v.ifname)) >= 1060 sizeof(h->addr.v.ifname)) { 1061 free(h); 1062 yyerror( 1063 "interface name too long"); 1064 YYERROR; 1065 } 1066 hh = malloc(sizeof(*hh)); 1067 if (hh == NULL) 1068 err(1, "address: malloc"); 1069 bcopy(h, hh, sizeof(*hh)); 1070 h->addr.iflags = PFI_AFLAG_NETWORK; 1071 } else { 1072 h = ifa_lookup(j->ifname, 1073 PFI_AFLAG_NETWORK); 1074 hh = NULL; 1075 } 1076 1077 if (h != NULL) 1078 expand_rule(&r, 0, j, NULL, NULL, NULL, 1079 NULL, NULL, h, NULL, NULL, NULL, 1080 NULL, NULL, NULL, NULL, ""); 1081 1082 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1083 bzero(&r, sizeof(r)); 1084 1085 r.action = PF_DROP; 1086 r.direction = PF_IN; 1087 r.log = $2.log; 1088 r.logif = $2.logif; 1089 r.quick = $2.quick; 1090 r.af = $4; 1091 if (rule_label(&r, $5.label)) 1092 YYERROR; 1093 r.rtableid = $5.rtableid; 1094 if (hh != NULL) 1095 h = hh; 1096 else 1097 h = ifa_lookup(i->ifname, 0); 1098 if (h != NULL) 1099 expand_rule(&r, 0, NULL, NULL, 1100 NULL, NULL, NULL, NULL, h, 1101 NULL, NULL, NULL, NULL, 1102 NULL, NULL, NULL, ""); 1103 } else 1104 free(hh); 1105 } 1106 free($5.label); 1107 } 1108 ; 1109 1110antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1111 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1112 ; 1113 1114antispoof_iflst : antispoof_if optnl { $$ = $1; } 1115 | antispoof_iflst comma antispoof_if optnl { 1116 $1->tail->next = $3; 1117 $1->tail = $3; 1118 $$ = $1; 1119 } 1120 ; 1121 1122antispoof_if : if_item { $$ = $1; } 1123 | '(' if_item ')' { 1124 $2->dynamic = 1; 1125 $$ = $2; 1126 } 1127 ; 1128 1129antispoof_opts : { 1130 bzero(&antispoof_opts, sizeof antispoof_opts); 1131 antispoof_opts.rtableid = -1; 1132 } 1133 antispoof_opts_l 1134 { $$ = antispoof_opts; } 1135 | /* empty */ { 1136 bzero(&antispoof_opts, sizeof antispoof_opts); 1137 antispoof_opts.rtableid = -1; 1138 $$ = antispoof_opts; 1139 } 1140 ; 1141 1142antispoof_opts_l : antispoof_opts_l antispoof_opt 1143 | antispoof_opt 1144 ; 1145 1146antispoof_opt : label { 1147 if (antispoof_opts.label) { 1148 yyerror("label cannot be redefined"); 1149 YYERROR; 1150 } 1151 antispoof_opts.label = $1; 1152 } 1153 | RTABLE NUMBER { 1154 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 1155 yyerror("invalid rtable id"); 1156 YYERROR; 1157 } 1158 antispoof_opts.rtableid = $2; 1159 } 1160 ; 1161 1162not : '!' { $$ = 1; } 1163 | /* empty */ { $$ = 0; } 1164 ; 1165 1166tabledef : TABLE '<' STRING '>' table_opts { 1167 struct node_host *h, *nh; 1168 struct node_tinit *ti, *nti; 1169 1170 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1171 yyerror("table name too long, max %d chars", 1172 PF_TABLE_NAME_SIZE - 1); 1173 free($3); 1174 YYERROR; 1175 } 1176 if (pf->loadopt & PFCTL_FLAG_TABLE) 1177 if (process_tabledef($3, &$5)) { 1178 free($3); 1179 YYERROR; 1180 } 1181 free($3); 1182 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1183 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1184 if (ti->file) 1185 free(ti->file); 1186 for (h = ti->host; h != NULL; h = nh) { 1187 nh = h->next; 1188 free(h); 1189 } 1190 nti = SIMPLEQ_NEXT(ti, entries); 1191 free(ti); 1192 } 1193 } 1194 ; 1195 1196table_opts : { 1197 bzero(&table_opts, sizeof table_opts); 1198 SIMPLEQ_INIT(&table_opts.init_nodes); 1199 } 1200 table_opts_l 1201 { $$ = table_opts; } 1202 | /* empty */ 1203 { 1204 bzero(&table_opts, sizeof table_opts); 1205 SIMPLEQ_INIT(&table_opts.init_nodes); 1206 $$ = table_opts; 1207 } 1208 ; 1209 1210table_opts_l : table_opts_l table_opt 1211 | table_opt 1212 ; 1213 1214table_opt : STRING { 1215 if (!strcmp($1, "const")) 1216 table_opts.flags |= PFR_TFLAG_CONST; 1217 else if (!strcmp($1, "persist")) 1218 table_opts.flags |= PFR_TFLAG_PERSIST; 1219 else if (!strcmp($1, "counters")) 1220 table_opts.flags |= PFR_TFLAG_COUNTERS; 1221 else { 1222 yyerror("invalid table option '%s'", $1); 1223 free($1); 1224 YYERROR; 1225 } 1226 free($1); 1227 } 1228 | '{' optnl '}' { table_opts.init_addr = 1; } 1229 | '{' optnl host_list '}' { 1230 struct node_host *n; 1231 struct node_tinit *ti; 1232 1233 for (n = $3; n != NULL; n = n->next) { 1234 switch (n->addr.type) { 1235 case PF_ADDR_ADDRMASK: 1236 continue; /* ok */ 1237 case PF_ADDR_RANGE: 1238 yyerror("address ranges are not " 1239 "permitted inside tables"); 1240 break; 1241 case PF_ADDR_DYNIFTL: 1242 yyerror("dynamic addresses are not " 1243 "permitted inside tables"); 1244 break; 1245 case PF_ADDR_TABLE: 1246 yyerror("tables cannot contain tables"); 1247 break; 1248 case PF_ADDR_NOROUTE: 1249 yyerror("\"no-route\" is not permitted " 1250 "inside tables"); 1251 break; 1252 case PF_ADDR_URPFFAILED: 1253 yyerror("\"urpf-failed\" is not " 1254 "permitted inside tables"); 1255 break; 1256 default: 1257 yyerror("unknown address type %d", 1258 n->addr.type); 1259 } 1260 YYERROR; 1261 } 1262 if (!(ti = calloc(1, sizeof(*ti)))) 1263 err(1, "table_opt: calloc"); 1264 ti->host = $3; 1265 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1266 entries); 1267 table_opts.init_addr = 1; 1268 } 1269 | FILENAME STRING { 1270 struct node_tinit *ti; 1271 1272 if (!(ti = calloc(1, sizeof(*ti)))) 1273 err(1, "table_opt: calloc"); 1274 ti->file = $2; 1275 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1276 entries); 1277 table_opts.init_addr = 1; 1278 } 1279 ; 1280 1281altqif : ALTQ interface queue_opts QUEUE qassign { 1282 struct pf_altq a; 1283 1284 if (check_rulestate(PFCTL_STATE_QUEUE)) 1285 YYERROR; 1286 1287 memset(&a, 0, sizeof(a)); 1288 if ($3.scheduler.qtype == ALTQT_NONE) { 1289 yyerror("no scheduler specified!"); 1290 YYERROR; 1291 } 1292 a.scheduler = $3.scheduler.qtype; 1293 a.qlimit = $3.qlimit; 1294 a.tbrsize = $3.tbrsize; 1295 if ($5 == NULL) { 1296 yyerror("no child queues specified"); 1297 YYERROR; 1298 } 1299 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1300 &$3.scheduler)) 1301 YYERROR; 1302 } 1303 ; 1304 1305queuespec : QUEUE STRING interface queue_opts qassign { 1306 struct pf_altq a; 1307 1308 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1309 free($2); 1310 YYERROR; 1311 } 1312 1313 memset(&a, 0, sizeof(a)); 1314 1315 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1316 sizeof(a.qname)) { 1317 yyerror("queue name too long (max " 1318 "%d chars)", PF_QNAME_SIZE-1); 1319 free($2); 1320 YYERROR; 1321 } 1322 free($2); 1323 if ($4.tbrsize) { 1324 yyerror("cannot specify tbrsize for queue"); 1325 YYERROR; 1326 } 1327 if ($4.priority > 255) { 1328 yyerror("priority out of range: max 255"); 1329 YYERROR; 1330 } 1331 a.priority = $4.priority; 1332 a.qlimit = $4.qlimit; 1333 a.scheduler = $4.scheduler.qtype; 1334 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1335 &$4.scheduler)) { 1336 yyerror("errors in queue definition"); 1337 YYERROR; 1338 } 1339 } 1340 ; 1341 1342queue_opts : { 1343 bzero(&queue_opts, sizeof queue_opts); 1344 queue_opts.priority = DEFAULT_PRIORITY; 1345 queue_opts.qlimit = DEFAULT_QLIMIT; 1346 queue_opts.scheduler.qtype = ALTQT_NONE; 1347 queue_opts.queue_bwspec.bw_percent = 100; 1348 } 1349 queue_opts_l 1350 { $$ = queue_opts; } 1351 | /* empty */ { 1352 bzero(&queue_opts, sizeof queue_opts); 1353 queue_opts.priority = DEFAULT_PRIORITY; 1354 queue_opts.qlimit = DEFAULT_QLIMIT; 1355 queue_opts.scheduler.qtype = ALTQT_NONE; 1356 queue_opts.queue_bwspec.bw_percent = 100; 1357 $$ = queue_opts; 1358 } 1359 ; 1360 1361queue_opts_l : queue_opts_l queue_opt 1362 | queue_opt 1363 ; 1364 1365queue_opt : BANDWIDTH bandwidth { 1366 if (queue_opts.marker & QOM_BWSPEC) { 1367 yyerror("bandwidth cannot be respecified"); 1368 YYERROR; 1369 } 1370 queue_opts.marker |= QOM_BWSPEC; 1371 queue_opts.queue_bwspec = $2; 1372 } 1373 | PRIORITY NUMBER { 1374 if (queue_opts.marker & QOM_PRIORITY) { 1375 yyerror("priority cannot be respecified"); 1376 YYERROR; 1377 } 1378 if ($2 < 0 || $2 > 255) { 1379 yyerror("priority out of range: max 255"); 1380 YYERROR; 1381 } 1382 queue_opts.marker |= QOM_PRIORITY; 1383 queue_opts.priority = $2; 1384 } 1385 | QLIMIT NUMBER { 1386 if (queue_opts.marker & QOM_QLIMIT) { 1387 yyerror("qlimit cannot be respecified"); 1388 YYERROR; 1389 } 1390 if ($2 < 0 || $2 > 65535) { 1391 yyerror("qlimit out of range: max 65535"); 1392 YYERROR; 1393 } 1394 queue_opts.marker |= QOM_QLIMIT; 1395 queue_opts.qlimit = $2; 1396 } 1397 | scheduler { 1398 if (queue_opts.marker & QOM_SCHEDULER) { 1399 yyerror("scheduler cannot be respecified"); 1400 YYERROR; 1401 } 1402 queue_opts.marker |= QOM_SCHEDULER; 1403 queue_opts.scheduler = $1; 1404 } 1405 | TBRSIZE NUMBER { 1406 if (queue_opts.marker & QOM_TBRSIZE) { 1407 yyerror("tbrsize cannot be respecified"); 1408 YYERROR; 1409 } 1410 if ($2 < 0 || $2 > 65535) { 1411 yyerror("tbrsize too big: max 65535"); 1412 YYERROR; 1413 } 1414 queue_opts.marker |= QOM_TBRSIZE; 1415 queue_opts.tbrsize = $2; 1416 } 1417 ; 1418 1419bandwidth : STRING { 1420 double bps; 1421 char *cp; 1422 1423 $$.bw_percent = 0; 1424 1425 bps = strtod($1, &cp); 1426 if (cp != NULL) { 1427 if (!strcmp(cp, "b")) 1428 ; /* nothing */ 1429 else if (!strcmp(cp, "Kb")) 1430 bps *= 1000; 1431 else if (!strcmp(cp, "Mb")) 1432 bps *= 1000 * 1000; 1433 else if (!strcmp(cp, "Gb")) 1434 bps *= 1000 * 1000 * 1000; 1435 else if (!strcmp(cp, "%")) { 1436 if (bps < 0 || bps > 100) { 1437 yyerror("bandwidth spec " 1438 "out of range"); 1439 free($1); 1440 YYERROR; 1441 } 1442 $$.bw_percent = bps; 1443 bps = 0; 1444 } else { 1445 yyerror("unknown unit %s", cp); 1446 free($1); 1447 YYERROR; 1448 } 1449 } 1450 free($1); 1451 $$.bw_absolute = (u_int32_t)bps; 1452 } 1453 | NUMBER { 1454 if ($1 < 0 || $1 > UINT_MAX) { 1455 yyerror("bandwidth number too big"); 1456 YYERROR; 1457 } 1458 $$.bw_percent = 0; 1459 $$.bw_absolute = $1; 1460 } 1461 ; 1462 1463scheduler : CBQ { 1464 $$.qtype = ALTQT_CBQ; 1465 $$.data.cbq_opts.flags = 0; 1466 } 1467 | CBQ '(' cbqflags_list ')' { 1468 $$.qtype = ALTQT_CBQ; 1469 $$.data.cbq_opts.flags = $3; 1470 } 1471 | PRIQ { 1472 $$.qtype = ALTQT_PRIQ; 1473 $$.data.priq_opts.flags = 0; 1474 } 1475 | PRIQ '(' priqflags_list ')' { 1476 $$.qtype = ALTQT_PRIQ; 1477 $$.data.priq_opts.flags = $3; 1478 } 1479 | HFSC { 1480 $$.qtype = ALTQT_HFSC; 1481 bzero(&$$.data.hfsc_opts, 1482 sizeof(struct node_hfsc_opts)); 1483 } 1484 | HFSC '(' hfsc_opts ')' { 1485 $$.qtype = ALTQT_HFSC; 1486 $$.data.hfsc_opts = $3; 1487 } 1488 ; 1489 1490cbqflags_list : cbqflags_item { $$ |= $1; } 1491 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1492 ; 1493 1494cbqflags_item : STRING { 1495 if (!strcmp($1, "default")) 1496 $$ = CBQCLF_DEFCLASS; 1497 else if (!strcmp($1, "borrow")) 1498 $$ = CBQCLF_BORROW; 1499 else if (!strcmp($1, "red")) 1500 $$ = CBQCLF_RED; 1501 else if (!strcmp($1, "ecn")) 1502 $$ = CBQCLF_RED|CBQCLF_ECN; 1503 else if (!strcmp($1, "rio")) 1504 $$ = CBQCLF_RIO; 1505 else { 1506 yyerror("unknown cbq flag \"%s\"", $1); 1507 free($1); 1508 YYERROR; 1509 } 1510 free($1); 1511 } 1512 ; 1513 1514priqflags_list : priqflags_item { $$ |= $1; } 1515 | priqflags_list comma priqflags_item { $$ |= $3; } 1516 ; 1517 1518priqflags_item : STRING { 1519 if (!strcmp($1, "default")) 1520 $$ = PRCF_DEFAULTCLASS; 1521 else if (!strcmp($1, "red")) 1522 $$ = PRCF_RED; 1523 else if (!strcmp($1, "ecn")) 1524 $$ = PRCF_RED|PRCF_ECN; 1525 else if (!strcmp($1, "rio")) 1526 $$ = PRCF_RIO; 1527 else { 1528 yyerror("unknown priq flag \"%s\"", $1); 1529 free($1); 1530 YYERROR; 1531 } 1532 free($1); 1533 } 1534 ; 1535 1536hfsc_opts : { 1537 bzero(&hfsc_opts, 1538 sizeof(struct node_hfsc_opts)); 1539 } 1540 hfscopts_list { 1541 $$ = hfsc_opts; 1542 } 1543 ; 1544 1545hfscopts_list : hfscopts_item 1546 | hfscopts_list comma hfscopts_item 1547 ; 1548 1549hfscopts_item : LINKSHARE bandwidth { 1550 if (hfsc_opts.linkshare.used) { 1551 yyerror("linkshare already specified"); 1552 YYERROR; 1553 } 1554 hfsc_opts.linkshare.m2 = $2; 1555 hfsc_opts.linkshare.used = 1; 1556 } 1557 | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 1558 { 1559 if ($5 < 0 || $5 > INT_MAX) { 1560 yyerror("timing in curve out of range"); 1561 YYERROR; 1562 } 1563 if (hfsc_opts.linkshare.used) { 1564 yyerror("linkshare already specified"); 1565 YYERROR; 1566 } 1567 hfsc_opts.linkshare.m1 = $3; 1568 hfsc_opts.linkshare.d = $5; 1569 hfsc_opts.linkshare.m2 = $7; 1570 hfsc_opts.linkshare.used = 1; 1571 } 1572 | REALTIME bandwidth { 1573 if (hfsc_opts.realtime.used) { 1574 yyerror("realtime already specified"); 1575 YYERROR; 1576 } 1577 hfsc_opts.realtime.m2 = $2; 1578 hfsc_opts.realtime.used = 1; 1579 } 1580 | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 1581 { 1582 if ($5 < 0 || $5 > INT_MAX) { 1583 yyerror("timing in curve out of range"); 1584 YYERROR; 1585 } 1586 if (hfsc_opts.realtime.used) { 1587 yyerror("realtime already specified"); 1588 YYERROR; 1589 } 1590 hfsc_opts.realtime.m1 = $3; 1591 hfsc_opts.realtime.d = $5; 1592 hfsc_opts.realtime.m2 = $7; 1593 hfsc_opts.realtime.used = 1; 1594 } 1595 | UPPERLIMIT bandwidth { 1596 if (hfsc_opts.upperlimit.used) { 1597 yyerror("upperlimit already specified"); 1598 YYERROR; 1599 } 1600 hfsc_opts.upperlimit.m2 = $2; 1601 hfsc_opts.upperlimit.used = 1; 1602 } 1603 | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 1604 { 1605 if ($5 < 0 || $5 > INT_MAX) { 1606 yyerror("timing in curve out of range"); 1607 YYERROR; 1608 } 1609 if (hfsc_opts.upperlimit.used) { 1610 yyerror("upperlimit already specified"); 1611 YYERROR; 1612 } 1613 hfsc_opts.upperlimit.m1 = $3; 1614 hfsc_opts.upperlimit.d = $5; 1615 hfsc_opts.upperlimit.m2 = $7; 1616 hfsc_opts.upperlimit.used = 1; 1617 } 1618 | STRING { 1619 if (!strcmp($1, "default")) 1620 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1621 else if (!strcmp($1, "red")) 1622 hfsc_opts.flags |= HFCF_RED; 1623 else if (!strcmp($1, "ecn")) 1624 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1625 else if (!strcmp($1, "rio")) 1626 hfsc_opts.flags |= HFCF_RIO; 1627 else { 1628 yyerror("unknown hfsc flag \"%s\"", $1); 1629 free($1); 1630 YYERROR; 1631 } 1632 free($1); 1633 } 1634 ; 1635 1636qassign : /* empty */ { $$ = NULL; } 1637 | qassign_item { $$ = $1; } 1638 | '{' optnl qassign_list '}' { $$ = $3; } 1639 ; 1640 1641qassign_list : qassign_item optnl { $$ = $1; } 1642 | qassign_list comma qassign_item optnl { 1643 $1->tail->next = $3; 1644 $1->tail = $3; 1645 $$ = $1; 1646 } 1647 ; 1648 1649qassign_item : STRING { 1650 $$ = calloc(1, sizeof(struct node_queue)); 1651 if ($$ == NULL) 1652 err(1, "qassign_item: calloc"); 1653 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1654 sizeof($$->queue)) { 1655 yyerror("queue name '%s' too long (max " 1656 "%d chars)", $1, sizeof($$->queue)-1); 1657 free($1); 1658 free($$); 1659 YYERROR; 1660 } 1661 free($1); 1662 $$->next = NULL; 1663 $$->tail = $$; 1664 } 1665 ; 1666 1667pfrule : action dir logquick interface af proto fromto 1668 filter_opts 1669 { 1670 struct pf_rule r; 1671 struct node_state_opt *o; 1672 struct node_proto *proto; 1673 int srctrack = 0; 1674 int statelock = 0; 1675 int adaptive = 0; 1676 int defaults = 0; 1677 1678 if (check_rulestate(PFCTL_STATE_FILTER)) 1679 YYERROR; 1680 1681 memset(&r, 0, sizeof(r)); 1682 1683 r.action = $1.b1; 1684 switch ($1.b2) { 1685 case PFRULE_RETURNRST: 1686 r.rule_flag |= PFRULE_RETURNRST; 1687 r.return_ttl = $1.w; 1688 break; 1689 case PFRULE_RETURNICMP: 1690 r.rule_flag |= PFRULE_RETURNICMP; 1691 r.return_icmp = $1.w; 1692 r.return_icmp6 = $1.w2; 1693 break; 1694 case PFRULE_RETURN: 1695 r.rule_flag |= PFRULE_RETURN; 1696 r.return_icmp = $1.w; 1697 r.return_icmp6 = $1.w2; 1698 break; 1699 } 1700 r.direction = $2; 1701 r.log = $3.log; 1702 r.logif = $3.logif; 1703 r.quick = $3.quick; 1704 r.prob = $8.prob; 1705 r.rtableid = $8.rtableid; 1706 1707 if ($8.nodf) 1708 r.scrub_flags |= PFSTATE_NODF; 1709 if ($8.randomid) 1710 r.scrub_flags |= PFSTATE_RANDOMID; 1711 if ($8.minttl) 1712 r.min_ttl = $8.minttl; 1713 if ($8.max_mss) 1714 r.max_mss = $8.max_mss; 1715 if ($8.marker & FOM_SETTOS) { 1716 r.scrub_flags |= PFSTATE_SETTOS; 1717 r.set_tos = $8.settos; 1718 } 1719 if ($8.marker & FOM_SCRUB_TCP) 1720 r.scrub_flags |= PFSTATE_SCRUB_TCP; 1721 1722 r.af = $5; 1723 if ($8.tag) 1724 if (strlcpy(r.tagname, $8.tag, 1725 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1726 yyerror("tag too long, max %u chars", 1727 PF_TAG_NAME_SIZE - 1); 1728 YYERROR; 1729 } 1730 if ($8.match_tag) 1731 if (strlcpy(r.match_tagname, $8.match_tag, 1732 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1733 yyerror("tag too long, max %u chars", 1734 PF_TAG_NAME_SIZE - 1); 1735 YYERROR; 1736 } 1737 r.match_tag_not = $8.match_tag_not; 1738 if (rule_label(&r, $8.label)) 1739 YYERROR; 1740 free($8.label); 1741 r.flags = $8.flags.b1; 1742 r.flagset = $8.flags.b2; 1743 if (($8.flags.b1 & $8.flags.b2) != $8.flags.b1) { 1744 yyerror("flags always false"); 1745 YYERROR; 1746 } 1747 if ($8.flags.b1 || $8.flags.b2 || $7.src_os) { 1748 for (proto = $6; proto != NULL && 1749 proto->proto != IPPROTO_TCP; 1750 proto = proto->next) 1751 ; /* nothing */ 1752 if (proto == NULL && $6 != NULL) { 1753 if ($8.flags.b1 || $8.flags.b2) 1754 yyerror( 1755 "flags only apply to tcp"); 1756 if ($7.src_os) 1757 yyerror( 1758 "OS fingerprinting only " 1759 "apply to tcp"); 1760 YYERROR; 1761 } 1762#if 0 1763 if (($8.flags.b1 & parse_flags("S")) == 0 && 1764 $7.src_os) { 1765 yyerror("OS fingerprinting requires " 1766 "the SYN TCP flag (flags S/SA)"); 1767 YYERROR; 1768 } 1769#endif 1770 } 1771 1772 r.tos = $8.tos; 1773 r.keep_state = $8.keep.action; 1774 o = $8.keep.options; 1775 1776 /* 'keep state' by default on pass rules. */ 1777 if (!r.keep_state && !r.action && 1778 !($8.marker & FOM_KEEP)) { 1779 r.keep_state = PF_STATE_NORMAL; 1780 o = keep_state_defaults; 1781 defaults = 1; 1782 } 1783 1784 while (o) { 1785 struct node_state_opt *p = o; 1786 1787 switch (o->type) { 1788 case PF_STATE_OPT_MAX: 1789 if (r.max_states) { 1790 yyerror("state option 'max' " 1791 "multiple definitions"); 1792 YYERROR; 1793 } 1794 r.max_states = o->data.max_states; 1795 break; 1796 case PF_STATE_OPT_NOSYNC: 1797 if (r.rule_flag & PFRULE_NOSYNC) { 1798 yyerror("state option 'sync' " 1799 "multiple definitions"); 1800 YYERROR; 1801 } 1802 r.rule_flag |= PFRULE_NOSYNC; 1803 break; 1804 case PF_STATE_OPT_SRCTRACK: 1805 if (srctrack) { 1806 yyerror("state option " 1807 "'source-track' " 1808 "multiple definitions"); 1809 YYERROR; 1810 } 1811 srctrack = o->data.src_track; 1812 r.rule_flag |= PFRULE_SRCTRACK; 1813 break; 1814 case PF_STATE_OPT_MAX_SRC_STATES: 1815 if (r.max_src_states) { 1816 yyerror("state option " 1817 "'max-src-states' " 1818 "multiple definitions"); 1819 YYERROR; 1820 } 1821 if (o->data.max_src_states == 0) { 1822 yyerror("'max-src-states' must " 1823 "be > 0"); 1824 YYERROR; 1825 } 1826 r.max_src_states = 1827 o->data.max_src_states; 1828 r.rule_flag |= PFRULE_SRCTRACK; 1829 break; 1830 case PF_STATE_OPT_OVERLOAD: 1831 if (r.overload_tblname[0]) { 1832 yyerror("multiple 'overload' " 1833 "table definitions"); 1834 YYERROR; 1835 } 1836 if (strlcpy(r.overload_tblname, 1837 o->data.overload.tblname, 1838 PF_TABLE_NAME_SIZE) >= 1839 PF_TABLE_NAME_SIZE) { 1840 yyerror("state option: " 1841 "strlcpy"); 1842 YYERROR; 1843 } 1844 r.flush = o->data.overload.flush; 1845 break; 1846 case PF_STATE_OPT_MAX_SRC_CONN: 1847 if (r.max_src_conn) { 1848 yyerror("state option " 1849 "'max-src-conn' " 1850 "multiple definitions"); 1851 YYERROR; 1852 } 1853 if (o->data.max_src_conn == 0) { 1854 yyerror("'max-src-conn' " 1855 "must be > 0"); 1856 YYERROR; 1857 } 1858 r.max_src_conn = 1859 o->data.max_src_conn; 1860 r.rule_flag |= PFRULE_SRCTRACK | 1861 PFRULE_RULESRCTRACK; 1862 break; 1863 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1864 if (r.max_src_conn_rate.limit) { 1865 yyerror("state option " 1866 "'max-src-conn-rate' " 1867 "multiple definitions"); 1868 YYERROR; 1869 } 1870 if (!o->data.max_src_conn_rate.limit || 1871 !o->data.max_src_conn_rate.seconds) { 1872 yyerror("'max-src-conn-rate' " 1873 "values must be > 0"); 1874 YYERROR; 1875 } 1876 if (o->data.max_src_conn_rate.limit > 1877 PF_THRESHOLD_MAX) { 1878 yyerror("'max-src-conn-rate' " 1879 "maximum rate must be < %u", 1880 PF_THRESHOLD_MAX); 1881 YYERROR; 1882 } 1883 r.max_src_conn_rate.limit = 1884 o->data.max_src_conn_rate.limit; 1885 r.max_src_conn_rate.seconds = 1886 o->data.max_src_conn_rate.seconds; 1887 r.rule_flag |= PFRULE_SRCTRACK | 1888 PFRULE_RULESRCTRACK; 1889 break; 1890 case PF_STATE_OPT_MAX_SRC_NODES: 1891 if (r.max_src_nodes) { 1892 yyerror("state option " 1893 "'max-src-nodes' " 1894 "multiple definitions"); 1895 YYERROR; 1896 } 1897 if (o->data.max_src_nodes == 0) { 1898 yyerror("'max-src-nodes' must " 1899 "be > 0"); 1900 YYERROR; 1901 } 1902 r.max_src_nodes = 1903 o->data.max_src_nodes; 1904 r.rule_flag |= PFRULE_SRCTRACK | 1905 PFRULE_RULESRCTRACK; 1906 break; 1907 case PF_STATE_OPT_STATELOCK: 1908 if (statelock) { 1909 yyerror("state locking option: " 1910 "multiple definitions"); 1911 YYERROR; 1912 } 1913 statelock = 1; 1914 r.rule_flag |= o->data.statelock; 1915 break; 1916 case PF_STATE_OPT_SLOPPY: 1917 if (r.rule_flag & PFRULE_STATESLOPPY) { 1918 yyerror("state sloppy option: " 1919 "multiple definitions"); 1920 YYERROR; 1921 } 1922 r.rule_flag |= PFRULE_STATESLOPPY; 1923 break; 1924 case PF_STATE_OPT_PFLOW: 1925 if (r.rule_flag & PFRULE_PFLOW) { 1926 yyerror("state pflow " 1927 "option: multiple " 1928 "definitions"); 1929 YYERROR; 1930 } 1931 r.rule_flag |= PFRULE_PFLOW; 1932 break; 1933 case PF_STATE_OPT_TIMEOUT: 1934 if (o->data.timeout.number == 1935 PFTM_ADAPTIVE_START || 1936 o->data.timeout.number == 1937 PFTM_ADAPTIVE_END) 1938 adaptive = 1; 1939 if (r.timeout[o->data.timeout.number]) { 1940 yyerror("state timeout %s " 1941 "multiple definitions", 1942 pf_timeouts[o->data. 1943 timeout.number].name); 1944 YYERROR; 1945 } 1946 r.timeout[o->data.timeout.number] = 1947 o->data.timeout.seconds; 1948 } 1949 o = o->next; 1950 if (!defaults) 1951 free(p); 1952 } 1953 1954 /* 'flags S/SA' by default on stateful rules */ 1955 if (!r.action && !r.flags && !r.flagset && 1956 !$8.fragment && !($8.marker & FOM_FLAGS) && 1957 r.keep_state) { 1958 r.flags = parse_flags("S"); 1959 r.flagset = parse_flags("SA"); 1960 } 1961 if (!adaptive && r.max_states) { 1962 r.timeout[PFTM_ADAPTIVE_START] = 1963 (r.max_states / 10) * 6; 1964 r.timeout[PFTM_ADAPTIVE_END] = 1965 (r.max_states / 10) * 12; 1966 } 1967 if (r.rule_flag & PFRULE_SRCTRACK) { 1968 if (srctrack == PF_SRCTRACK_GLOBAL && 1969 r.max_src_nodes) { 1970 yyerror("'max-src-nodes' is " 1971 "incompatible with " 1972 "'source-track global'"); 1973 YYERROR; 1974 } 1975 if (srctrack == PF_SRCTRACK_GLOBAL && 1976 r.max_src_conn) { 1977 yyerror("'max-src-conn' is " 1978 "incompatible with " 1979 "'source-track global'"); 1980 YYERROR; 1981 } 1982 if (srctrack == PF_SRCTRACK_GLOBAL && 1983 r.max_src_conn_rate.seconds) { 1984 yyerror("'max-src-conn-rate' is " 1985 "incompatible with " 1986 "'source-track global'"); 1987 YYERROR; 1988 } 1989 if (r.timeout[PFTM_SRC_NODE] < 1990 r.max_src_conn_rate.seconds) 1991 r.timeout[PFTM_SRC_NODE] = 1992 r.max_src_conn_rate.seconds; 1993 r.rule_flag |= PFRULE_SRCTRACK; 1994 if (srctrack == PF_SRCTRACK_RULE) 1995 r.rule_flag |= PFRULE_RULESRCTRACK; 1996 } 1997 if (r.keep_state && !statelock) 1998 r.rule_flag |= default_statelock; 1999 2000 if ($8.fragment) 2001 r.rule_flag |= PFRULE_FRAGMENT; 2002 r.allow_opts = $8.allowopts; 2003 2004 decide_address_family($7.src.host, &r.af); 2005 decide_address_family($7.dst.host, &r.af); 2006 2007 if ($8.route.rt) { 2008 if (!r.direction) { 2009 yyerror("direction must be explicit " 2010 "with rules that specify routing"); 2011 YYERROR; 2012 } 2013 r.rt = $8.route.rt; 2014 r.route.opts = $8.route.pool_opts; 2015 if ($8.route.key != NULL) 2016 memcpy(&r.route.key, $8.route.key, 2017 sizeof(struct pf_poolhashkey)); 2018 } 2019 if (r.rt && r.rt != PF_FASTROUTE) { 2020 decide_address_family($8.route.host, &r.af); 2021 remove_invalid_hosts(&$8.route.host, &r.af); 2022 if ($8.route.host == NULL) { 2023 yyerror("no routing address with " 2024 "matching address family found."); 2025 YYERROR; 2026 } 2027 if ((r.route.opts & PF_POOL_TYPEMASK) == 2028 PF_POOL_NONE && ($8.route.host->next != NULL || 2029 $8.route.host->addr.type == PF_ADDR_TABLE || 2030 DYNIF_MULTIADDR($8.route.host->addr))) 2031 r.route.opts |= PF_POOL_ROUNDROBIN; 2032 if ((r.route.opts & PF_POOL_TYPEMASK) != 2033 PF_POOL_ROUNDROBIN && 2034 disallow_table($8.route.host, 2035 "tables are only " 2036 "supported in round-robin routing pools")) 2037 YYERROR; 2038 if ((r.route.opts & PF_POOL_TYPEMASK) != 2039 PF_POOL_ROUNDROBIN && 2040 disallow_alias($8.route.host, 2041 "interface (%s) " 2042 "is only supported in round-robin " 2043 "routing pools")) 2044 YYERROR; 2045 if ($8.route.host->next != NULL) { 2046 if ((r.route.opts & PF_POOL_TYPEMASK) != 2047 PF_POOL_ROUNDROBIN) { 2048 yyerror("r.route.opts must " 2049 "be PF_POOL_ROUNDROBIN"); 2050 YYERROR; 2051 } 2052 } 2053 /* fake redirspec */ 2054 if (($8.rroute.rdr = calloc(1, 2055 sizeof(*$8.rroute.rdr))) == NULL) 2056 err(1, "$8.rroute.rdr"); 2057 $8.rroute.rdr->host = $8.route.host; 2058 } 2059 if ($8.queues.qname != NULL) { 2060 if (strlcpy(r.qname, $8.queues.qname, 2061 sizeof(r.qname)) >= sizeof(r.qname)) { 2062 yyerror("rule qname too long (max " 2063 "%d chars)", sizeof(r.qname)-1); 2064 YYERROR; 2065 } 2066 free($8.queues.qname); 2067 } 2068 if ($8.queues.pqname != NULL) { 2069 if (strlcpy(r.pqname, $8.queues.pqname, 2070 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2071 yyerror("rule pqname too long (max " 2072 "%d chars)", sizeof(r.pqname)-1); 2073 YYERROR; 2074 } 2075 free($8.queues.pqname); 2076 } 2077 if ((r.divert.port = $8.divert.port)) { 2078 if (r.direction == PF_OUT) { 2079 if ($8.divert.addr) { 2080 yyerror("address specified " 2081 "for outgoing divert"); 2082 YYERROR; 2083 } 2084 bzero(&r.divert.addr, 2085 sizeof(r.divert.addr)); 2086 } else { 2087 if (!$8.divert.addr) { 2088 yyerror("no address specified " 2089 "for incoming divert"); 2090 YYERROR; 2091 } 2092 if ($8.divert.addr->af != r.af) { 2093 yyerror("address family " 2094 "mismatch for divert"); 2095 YYERROR; 2096 } 2097 r.divert.addr = 2098 $8.divert.addr->addr.v.a.addr; 2099 } 2100 } 2101 r.divert_packet.port = $8.divert_packet.port; 2102 2103 expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, &$8.rroute, $6, 2104 $7.src_os, 2105 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 2106 $8.uid, $8.gid, $8.rcv, $8.icmpspec, ""); 2107 } 2108 ; 2109 2110filter_opts : { 2111 bzero(&filter_opts, sizeof filter_opts); 2112 filter_opts.rtableid = -1; 2113 } 2114 filter_opts_l 2115 { $$ = filter_opts; } 2116 | /* empty */ { 2117 bzero(&filter_opts, sizeof filter_opts); 2118 filter_opts.rtableid = -1; 2119 $$ = filter_opts; 2120 } 2121 ; 2122 2123filter_opts_l : filter_opts_l filter_opt 2124 | filter_opt 2125 ; 2126 2127filter_opt : USER uids { 2128 if (filter_opts.uid) 2129 $2->tail->next = filter_opts.uid; 2130 filter_opts.uid = $2; 2131 } 2132 | GROUP gids { 2133 if (filter_opts.gid) 2134 $2->tail->next = filter_opts.gid; 2135 filter_opts.gid = $2; 2136 } 2137 | flags { 2138 if (filter_opts.marker & FOM_FLAGS) { 2139 yyerror("flags cannot be redefined"); 2140 YYERROR; 2141 } 2142 filter_opts.marker |= FOM_FLAGS; 2143 filter_opts.flags.b1 |= $1.b1; 2144 filter_opts.flags.b2 |= $1.b2; 2145 filter_opts.flags.w |= $1.w; 2146 filter_opts.flags.w2 |= $1.w2; 2147 } 2148 | icmpspec { 2149 if (filter_opts.marker & FOM_ICMP) { 2150 yyerror("icmp-type cannot be redefined"); 2151 YYERROR; 2152 } 2153 filter_opts.marker |= FOM_ICMP; 2154 filter_opts.icmpspec = $1; 2155 } 2156 | TOS tos { 2157 if (filter_opts.marker & FOM_TOS) { 2158 yyerror("tos cannot be redefined"); 2159 YYERROR; 2160 } 2161 filter_opts.marker |= FOM_TOS; 2162 filter_opts.tos = $2; 2163 } 2164 | keep { 2165 if (filter_opts.marker & FOM_KEEP) { 2166 yyerror("modulate or keep cannot be redefined"); 2167 YYERROR; 2168 } 2169 filter_opts.marker |= FOM_KEEP; 2170 filter_opts.keep.action = $1.action; 2171 filter_opts.keep.options = $1.options; 2172 } 2173 | FRAGMENT { 2174 filter_opts.fragment = 1; 2175 } 2176 | ALLOWOPTS { 2177 filter_opts.allowopts = 1; 2178 } 2179 | label { 2180 if (filter_opts.label) { 2181 yyerror("label cannot be redefined"); 2182 YYERROR; 2183 } 2184 filter_opts.label = $1; 2185 } 2186 | qname { 2187 if (filter_opts.queues.qname) { 2188 yyerror("queue cannot be redefined"); 2189 YYERROR; 2190 } 2191 filter_opts.queues = $1; 2192 } 2193 | TAG string { 2194 filter_opts.tag = $2; 2195 } 2196 | not TAGGED string { 2197 filter_opts.match_tag = $3; 2198 filter_opts.match_tag_not = $1; 2199 } 2200 | PROBABILITY probability { 2201 double p; 2202 2203 p = floor($2 * UINT_MAX + 0.5); 2204 if (p < 0.0 || p > UINT_MAX) { 2205 yyerror("invalid probability: %lf", p); 2206 YYERROR; 2207 } 2208 filter_opts.prob = (u_int32_t)p; 2209 if (filter_opts.prob == 0) 2210 filter_opts.prob = 1; 2211 } 2212 | RTABLE NUMBER { 2213 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 2214 yyerror("invalid rtable id"); 2215 YYERROR; 2216 } 2217 filter_opts.rtableid = $2; 2218 } 2219 | DIVERTTO STRING PORT portplain { 2220 if ((filter_opts.divert.addr = host($2)) == NULL) { 2221 yyerror("could not parse divert address: %s", 2222 $2); 2223 free($2); 2224 YYERROR; 2225 } 2226 free($2); 2227 filter_opts.divert.port = $4.a; 2228 if (!filter_opts.divert.port) { 2229 yyerror("invalid divert port: %u", ntohs($4.a)); 2230 YYERROR; 2231 } 2232 } 2233 | DIVERTREPLY { 2234 filter_opts.divert.port = 1; /* some random value */ 2235 } 2236 | DIVERTPACKET PORT number { 2237 /* 2238 * If IP reassembly was not turned off, also 2239 * forcibly enable TCP reassembly by default. 2240 */ 2241 if (pf->reassemble & PF_REASS_ENABLED) 2242 filter_opts.marker |= FOM_SCRUB_TCP; 2243 2244 if ($3 < 1 || $3 > 65535) { 2245 yyerror("invalid divert port"); 2246 YYERROR; 2247 } 2248 2249 filter_opts.divert_packet.port = htons($3); 2250 } 2251 | SCRUB '(' scrub_opts ')' { 2252 filter_opts.nodf = $3.nodf; 2253 filter_opts.minttl = $3.minttl; 2254 filter_opts.settos = $3.settos; 2255 filter_opts.randomid = $3.randomid; 2256 filter_opts.max_mss = $3.maxmss; 2257 if ($3.reassemble_tcp) 2258 filter_opts.marker |= FOM_SCRUB_TCP; 2259 filter_opts.marker |= $3.marker; 2260 } 2261 | NATTO redirpool pool_opts { 2262 if (filter_opts.nat.rdr) { 2263 yyerror("cannot respecify nat-to/binat-to"); 2264 YYERROR; 2265 } 2266 filter_opts.nat.rdr = $2; 2267 memcpy(&filter_opts.nat.pool_opts, &$3, 2268 sizeof(filter_opts.nat.pool_opts)); 2269 } 2270 | RDRTO redirpool pool_opts { 2271 if (filter_opts.rdr.rdr) { 2272 yyerror("cannot respecify rdr-to"); 2273 YYERROR; 2274 } 2275 filter_opts.rdr.rdr = $2; 2276 memcpy(&filter_opts.rdr.pool_opts, &$3, 2277 sizeof(filter_opts.rdr.pool_opts)); 2278 } 2279 | BINATTO redirpool pool_opts { 2280 if (filter_opts.nat.rdr) { 2281 yyerror("cannot respecify nat-to/binat-to"); 2282 YYERROR; 2283 } 2284 filter_opts.nat.rdr = $2; 2285 filter_opts.nat.binat = 1; 2286 memcpy(&filter_opts.nat.pool_opts, &$3, 2287 sizeof(filter_opts.nat.pool_opts)); 2288 filter_opts.nat.pool_opts.staticport = 1; 2289 } 2290 | FASTROUTE { 2291 filter_opts.route.host = NULL; 2292 filter_opts.route.rt = PF_FASTROUTE; 2293 filter_opts.route.pool_opts = 0; 2294 } 2295 | ROUTETO routespec pool_opts { 2296 filter_opts.route.host = $2; 2297 filter_opts.route.rt = PF_ROUTETO; 2298 filter_opts.route.pool_opts = $3.type | $3.opts; 2299 if ($3.key != NULL) 2300 filter_opts.route.key = $3.key; 2301 } 2302 | REPLYTO routespec pool_opts { 2303 filter_opts.route.host = $2; 2304 filter_opts.route.rt = PF_REPLYTO; 2305 filter_opts.route.pool_opts = $3.type | $3.opts; 2306 if ($3.key != NULL) 2307 filter_opts.route.key = $3.key; 2308 } 2309 | DUPTO routespec pool_opts { 2310 filter_opts.route.host = $2; 2311 filter_opts.route.rt = PF_DUPTO; 2312 filter_opts.route.pool_opts = $3.type | $3.opts; 2313 if ($3.key != NULL) 2314 filter_opts.route.key = $3.key; 2315 } 2316 | RECEIVEDON if_item { 2317 if (filter_opts.rcv) { 2318 yyerror("cannot respecify received-on"); 2319 YYERROR; 2320 } 2321 filter_opts.rcv = $2; 2322 } 2323 ; 2324 2325probability : STRING { 2326 char *e; 2327 double p = strtod($1, &e); 2328 2329 if (*e == '%') { 2330 p *= 0.01; 2331 e++; 2332 } 2333 if (*e) { 2334 yyerror("invalid probability: %s", $1); 2335 free($1); 2336 YYERROR; 2337 } 2338 free($1); 2339 $$ = p; 2340 } 2341 | NUMBER { 2342 $$ = (double)$1; 2343 } 2344 ; 2345 2346 2347action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2348 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 2349 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2350 ; 2351 2352blockspec : /* empty */ { 2353 $$.b2 = blockpolicy; 2354 $$.w = returnicmpdefault; 2355 $$.w2 = returnicmp6default; 2356 } 2357 | DROP { 2358 $$.b2 = PFRULE_DROP; 2359 $$.w = 0; 2360 $$.w2 = 0; 2361 } 2362 | RETURNRST { 2363 $$.b2 = PFRULE_RETURNRST; 2364 $$.w = 0; 2365 $$.w2 = 0; 2366 } 2367 | RETURNRST '(' TTL NUMBER ')' { 2368 if ($4 < 0 || $4 > 255) { 2369 yyerror("illegal ttl value %d", $4); 2370 YYERROR; 2371 } 2372 $$.b2 = PFRULE_RETURNRST; 2373 $$.w = $4; 2374 $$.w2 = 0; 2375 } 2376 | RETURNICMP { 2377 $$.b2 = PFRULE_RETURNICMP; 2378 $$.w = returnicmpdefault; 2379 $$.w2 = returnicmp6default; 2380 } 2381 | RETURNICMP6 { 2382 $$.b2 = PFRULE_RETURNICMP; 2383 $$.w = returnicmpdefault; 2384 $$.w2 = returnicmp6default; 2385 } 2386 | RETURNICMP '(' reticmpspec ')' { 2387 $$.b2 = PFRULE_RETURNICMP; 2388 $$.w = $3; 2389 $$.w2 = returnicmpdefault; 2390 } 2391 | RETURNICMP6 '(' reticmp6spec ')' { 2392 $$.b2 = PFRULE_RETURNICMP; 2393 $$.w = returnicmpdefault; 2394 $$.w2 = $3; 2395 } 2396 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2397 $$.b2 = PFRULE_RETURNICMP; 2398 $$.w = $3; 2399 $$.w2 = $5; 2400 } 2401 | RETURN { 2402 $$.b2 = PFRULE_RETURN; 2403 $$.w = returnicmpdefault; 2404 $$.w2 = returnicmp6default; 2405 } 2406 ; 2407 2408reticmpspec : STRING { 2409 if (!($$ = parseicmpspec($1, AF_INET))) { 2410 free($1); 2411 YYERROR; 2412 } 2413 free($1); 2414 } 2415 | NUMBER { 2416 u_int8_t icmptype; 2417 2418 if ($1 < 0 || $1 > 255) { 2419 yyerror("invalid icmp code %lu", $1); 2420 YYERROR; 2421 } 2422 icmptype = returnicmpdefault >> 8; 2423 $$ = (icmptype << 8 | $1); 2424 } 2425 ; 2426 2427reticmp6spec : STRING { 2428 if (!($$ = parseicmpspec($1, AF_INET6))) { 2429 free($1); 2430 YYERROR; 2431 } 2432 free($1); 2433 } 2434 | NUMBER { 2435 u_int8_t icmptype; 2436 2437 if ($1 < 0 || $1 > 255) { 2438 yyerror("invalid icmp code %lu", $1); 2439 YYERROR; 2440 } 2441 icmptype = returnicmp6default >> 8; 2442 $$ = (icmptype << 8 | $1); 2443 } 2444 ; 2445 2446dir : /* empty */ { $$ = PF_INOUT; } 2447 | IN { $$ = PF_IN; } 2448 | OUT { $$ = PF_OUT; } 2449 ; 2450 2451quick : /* empty */ { $$.quick = 0; } 2452 | QUICK { $$.quick = 1; } 2453 ; 2454 2455logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2456 | log { $$ = $1; $$.quick = 0; } 2457 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2458 | log QUICK { $$ = $1; $$.quick = 1; } 2459 | QUICK log { $$ = $2; $$.quick = 1; } 2460 ; 2461 2462log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2463 | LOG '(' logopts ')' { 2464 $$.log = PF_LOG | $3.log; 2465 $$.logif = $3.logif; 2466 } 2467 ; 2468 2469logopts : logopt { $$ = $1; } 2470 | logopts comma logopt { 2471 $$.log = $1.log | $3.log; 2472 $$.logif = $3.logif; 2473 if ($$.logif == 0) 2474 $$.logif = $1.logif; 2475 } 2476 ; 2477 2478logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2479 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2480 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2481 | TO string { 2482 const char *errstr; 2483 u_int i; 2484 2485 $$.log = 0; 2486 if (strncmp($2, "pflog", 5)) { 2487 yyerror("%s: should be a pflog interface", $2); 2488 free($2); 2489 YYERROR; 2490 } 2491 i = strtonum($2 + 5, 0, 255, &errstr); 2492 if (errstr) { 2493 yyerror("%s: %s", $2, errstr); 2494 free($2); 2495 YYERROR; 2496 } 2497 free($2); 2498 $$.logif = i; 2499 } 2500 ; 2501 2502interface : /* empty */ { $$ = NULL; } 2503 | ON if_item_not { $$ = $2; } 2504 | ON '{' optnl if_list '}' { $$ = $4; } 2505 ; 2506 2507if_list : if_item_not optnl { $$ = $1; } 2508 | if_list comma if_item_not optnl { 2509 $1->tail->next = $3; 2510 $1->tail = $3; 2511 $$ = $1; 2512 } 2513 ; 2514 2515if_item_not : not if_item { $$ = $2; $$->not = $1; } 2516 ; 2517 2518if_item : STRING { 2519 struct node_host *n; 2520 2521 $$ = calloc(1, sizeof(struct node_if)); 2522 if ($$ == NULL) 2523 err(1, "if_item: calloc"); 2524 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2525 sizeof($$->ifname)) { 2526 free($1); 2527 free($$); 2528 yyerror("interface name too long"); 2529 YYERROR; 2530 } 2531 2532 if ((n = ifa_exists($1)) != NULL) 2533 $$->ifa_flags = n->ifa_flags; 2534 2535 free($1); 2536 $$->not = 0; 2537 $$->next = NULL; 2538 $$->tail = $$; 2539 } 2540 ; 2541 2542af : /* empty */ { $$ = 0; } 2543 | INET { $$ = AF_INET; } 2544 | INET6 { $$ = AF_INET6; } 2545 ; 2546 2547proto : /* empty */ { $$ = NULL; } 2548 | PROTO proto_item { $$ = $2; } 2549 | PROTO '{' optnl proto_list '}' { $$ = $4; } 2550 ; 2551 2552proto_list : proto_item optnl { $$ = $1; } 2553 | proto_list comma proto_item optnl { 2554 $1->tail->next = $3; 2555 $1->tail = $3; 2556 $$ = $1; 2557 } 2558 ; 2559 2560proto_item : protoval { 2561 u_int8_t pr; 2562 2563 pr = (u_int8_t)$1; 2564 if (pr == 0) { 2565 yyerror("proto 0 cannot be used"); 2566 YYERROR; 2567 } 2568 $$ = calloc(1, sizeof(struct node_proto)); 2569 if ($$ == NULL) 2570 err(1, "proto_item: calloc"); 2571 $$->proto = pr; 2572 $$->next = NULL; 2573 $$->tail = $$; 2574 } 2575 ; 2576 2577protoval : STRING { 2578 struct protoent *p; 2579 2580 p = getprotobyname($1); 2581 if (p == NULL) { 2582 yyerror("unknown protocol %s", $1); 2583 free($1); 2584 YYERROR; 2585 } 2586 $$ = p->p_proto; 2587 free($1); 2588 } 2589 | NUMBER { 2590 if ($1 < 0 || $1 > 255) { 2591 yyerror("protocol outside range"); 2592 YYERROR; 2593 } 2594 } 2595 ; 2596 2597fromto : ALL { 2598 $$.src.host = NULL; 2599 $$.src.port = NULL; 2600 $$.dst.host = NULL; 2601 $$.dst.port = NULL; 2602 $$.src_os = NULL; 2603 } 2604 | from os to { 2605 $$.src = $1; 2606 $$.src_os = $2; 2607 $$.dst = $3; 2608 } 2609 ; 2610 2611os : /* empty */ { $$ = NULL; } 2612 | OS xos { $$ = $2; } 2613 | OS '{' optnl os_list '}' { $$ = $4; } 2614 ; 2615 2616xos : STRING { 2617 $$ = calloc(1, sizeof(struct node_os)); 2618 if ($$ == NULL) 2619 err(1, "os: calloc"); 2620 $$->os = $1; 2621 $$->tail = $$; 2622 } 2623 ; 2624 2625os_list : xos optnl { $$ = $1; } 2626 | os_list comma xos optnl { 2627 $1->tail->next = $3; 2628 $1->tail = $3; 2629 $$ = $1; 2630 } 2631 ; 2632 2633from : /* empty */ { 2634 $$.host = NULL; 2635 $$.port = NULL; 2636 } 2637 | FROM ipportspec { 2638 $$ = $2; 2639 } 2640 ; 2641 2642to : /* empty */ { 2643 $$.host = NULL; 2644 $$.port = NULL; 2645 } 2646 | TO ipportspec { 2647 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2648 "not permitted in a destination address")) 2649 YYERROR; 2650 $$ = $2; 2651 } 2652 ; 2653 2654ipportspec : ipspec { 2655 $$.host = $1; 2656 $$.port = NULL; 2657 } 2658 | ipspec PORT portspec { 2659 $$.host = $1; 2660 $$.port = $3; 2661 } 2662 | PORT portspec { 2663 $$.host = NULL; 2664 $$.port = $2; 2665 } 2666 ; 2667 2668optnl : '\n' optnl 2669 | 2670 ; 2671 2672ipspec : ANY { $$ = NULL; } 2673 | xhost { $$ = $1; } 2674 | '{' optnl host_list '}' { $$ = $3; } 2675 ; 2676 2677host_list : ipspec optnl { $$ = $1; } 2678 | host_list comma ipspec optnl { 2679 if ($3 == NULL) 2680 $$ = $1; 2681 else if ($1 == NULL) 2682 $$ = $3; 2683 else { 2684 $1->tail->next = $3; 2685 $1->tail = $3->tail; 2686 $$ = $1; 2687 } 2688 } 2689 ; 2690 2691xhost : not host { 2692 struct node_host *n; 2693 2694 for (n = $2; n != NULL; n = n->next) 2695 n->not = $1; 2696 $$ = $2; 2697 } 2698 | not NOROUTE { 2699 $$ = calloc(1, sizeof(struct node_host)); 2700 if ($$ == NULL) 2701 err(1, "xhost: calloc"); 2702 $$->addr.type = PF_ADDR_NOROUTE; 2703 $$->next = NULL; 2704 $$->not = $1; 2705 $$->tail = $$; 2706 } 2707 | not URPFFAILED { 2708 $$ = calloc(1, sizeof(struct node_host)); 2709 if ($$ == NULL) 2710 err(1, "xhost: calloc"); 2711 $$->addr.type = PF_ADDR_URPFFAILED; 2712 $$->next = NULL; 2713 $$->not = $1; 2714 $$->tail = $$; 2715 } 2716 ; 2717 2718host : STRING { 2719 if (($$ = host($1)) == NULL) { 2720 /* error. "any" is handled elsewhere */ 2721 free($1); 2722 yyerror("could not parse host specification"); 2723 YYERROR; 2724 } 2725 free($1); 2726 2727 } 2728 | STRING '-' STRING { 2729 struct node_host *b, *e; 2730 2731 if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 2732 free($1); 2733 free($3); 2734 yyerror("could not parse host specification"); 2735 YYERROR; 2736 } 2737 if (b->af != e->af || 2738 b->addr.type != PF_ADDR_ADDRMASK || 2739 e->addr.type != PF_ADDR_ADDRMASK || 2740 unmask(&b->addr.v.a.mask, b->af) != 2741 (b->af == AF_INET ? 32 : 128) || 2742 unmask(&e->addr.v.a.mask, e->af) != 2743 (e->af == AF_INET ? 32 : 128) || 2744 b->next != NULL || b->not || 2745 e->next != NULL || e->not) { 2746 free(b); 2747 free(e); 2748 free($1); 2749 free($3); 2750 yyerror("invalid address range"); 2751 YYERROR; 2752 } 2753 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 2754 sizeof(b->addr.v.a.mask)); 2755 b->addr.type = PF_ADDR_RANGE; 2756 $$ = b; 2757 free(e); 2758 free($1); 2759 free($3); 2760 } 2761 | STRING '/' NUMBER { 2762 char *buf; 2763 2764 if (asprintf(&buf, "%s/%lld", $1, $3) == -1) 2765 err(1, "host: asprintf"); 2766 free($1); 2767 if (($$ = host(buf)) == NULL) { 2768 /* error. "any" is handled elsewhere */ 2769 free(buf); 2770 yyerror("could not parse host specification"); 2771 YYERROR; 2772 } 2773 free(buf); 2774 } 2775 | NUMBER '/' NUMBER { 2776 char *buf; 2777 2778 /* ie. for 10/8 parsing */ 2779 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 2780 err(1, "host: asprintf"); 2781 if (($$ = host(buf)) == NULL) { 2782 /* error. "any" is handled elsewhere */ 2783 free(buf); 2784 yyerror("could not parse host specification"); 2785 YYERROR; 2786 } 2787 free(buf); 2788 } 2789 | dynaddr 2790 | dynaddr '/' NUMBER { 2791 struct node_host *n; 2792 2793 if ($3 < 0 || $3 > 128) { 2794 yyerror("bit number too big"); 2795 YYERROR; 2796 } 2797 $$ = $1; 2798 for (n = $1; n != NULL; n = n->next) 2799 set_ipmask(n, $3); 2800 } 2801 | '<' STRING '>' { 2802 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2803 yyerror("table name '%s' too long", $2); 2804 free($2); 2805 YYERROR; 2806 } 2807 $$ = calloc(1, sizeof(struct node_host)); 2808 if ($$ == NULL) 2809 err(1, "host: calloc"); 2810 $$->addr.type = PF_ADDR_TABLE; 2811 if (strlcpy($$->addr.v.tblname, $2, 2812 sizeof($$->addr.v.tblname)) >= 2813 sizeof($$->addr.v.tblname)) 2814 errx(1, "host: strlcpy"); 2815 free($2); 2816 $$->next = NULL; 2817 $$->tail = $$; 2818 } 2819 | ROUTE STRING { 2820 $$ = calloc(1, sizeof(struct node_host)); 2821 if ($$ == NULL) { 2822 free($2); 2823 err(1, "host: calloc"); 2824 } 2825 $$->addr.type = PF_ADDR_RTLABEL; 2826 if (strlcpy($$->addr.v.rtlabelname, $2, 2827 sizeof($$->addr.v.rtlabelname)) >= 2828 sizeof($$->addr.v.rtlabelname)) { 2829 yyerror("route label too long, max %u chars", 2830 sizeof($$->addr.v.rtlabelname) - 1); 2831 free($2); 2832 free($$); 2833 YYERROR; 2834 } 2835 $$->next = NULL; 2836 $$->tail = $$; 2837 free($2); 2838 } 2839 ; 2840 2841number : NUMBER 2842 | STRING { 2843 u_long ulval; 2844 2845 if (atoul($1, &ulval) == -1) { 2846 yyerror("%s is not a number", $1); 2847 free($1); 2848 YYERROR; 2849 } else 2850 $$ = ulval; 2851 free($1); 2852 } 2853 ; 2854 2855dynaddr : '(' STRING ')' { 2856 int flags = 0; 2857 char *p, *op; 2858 2859 op = $2; 2860 if (!isalpha(op[0])) { 2861 yyerror("invalid interface name '%s'", op); 2862 free(op); 2863 YYERROR; 2864 } 2865 while ((p = strrchr($2, ':')) != NULL) { 2866 if (!strcmp(p+1, "network")) 2867 flags |= PFI_AFLAG_NETWORK; 2868 else if (!strcmp(p+1, "broadcast")) 2869 flags |= PFI_AFLAG_BROADCAST; 2870 else if (!strcmp(p+1, "peer")) 2871 flags |= PFI_AFLAG_PEER; 2872 else if (!strcmp(p+1, "0")) 2873 flags |= PFI_AFLAG_NOALIAS; 2874 else { 2875 yyerror("interface %s has bad modifier", 2876 $2); 2877 free(op); 2878 YYERROR; 2879 } 2880 *p = '\0'; 2881 } 2882 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2883 free(op); 2884 yyerror("illegal combination of " 2885 "interface modifiers"); 2886 YYERROR; 2887 } 2888 $$ = calloc(1, sizeof(struct node_host)); 2889 if ($$ == NULL) 2890 err(1, "address: calloc"); 2891 $$->af = 0; 2892 set_ipmask($$, 128); 2893 $$->addr.type = PF_ADDR_DYNIFTL; 2894 $$->addr.iflags = flags; 2895 if (strlcpy($$->addr.v.ifname, $2, 2896 sizeof($$->addr.v.ifname)) >= 2897 sizeof($$->addr.v.ifname)) { 2898 free(op); 2899 free($$); 2900 yyerror("interface name too long"); 2901 YYERROR; 2902 } 2903 free(op); 2904 $$->next = NULL; 2905 $$->tail = $$; 2906 } 2907 ; 2908 2909portspec : port_item { $$ = $1; } 2910 | '{' optnl port_list '}' { $$ = $3; } 2911 ; 2912 2913port_list : port_item optnl { $$ = $1; } 2914 | port_list comma port_item optnl { 2915 $1->tail->next = $3; 2916 $1->tail = $3; 2917 $$ = $1; 2918 } 2919 ; 2920 2921port_item : portrange { 2922 $$ = calloc(1, sizeof(struct node_port)); 2923 if ($$ == NULL) 2924 err(1, "port_item: calloc"); 2925 $$->port[0] = $1.a; 2926 $$->port[1] = $1.b; 2927 if ($1.t) 2928 $$->op = PF_OP_RRG; 2929 else 2930 $$->op = PF_OP_EQ; 2931 $$->next = NULL; 2932 $$->tail = $$; 2933 } 2934 | unaryop portrange { 2935 if ($2.t) { 2936 yyerror("':' cannot be used with an other " 2937 "port operator"); 2938 YYERROR; 2939 } 2940 $$ = calloc(1, sizeof(struct node_port)); 2941 if ($$ == NULL) 2942 err(1, "port_item: calloc"); 2943 $$->port[0] = $2.a; 2944 $$->port[1] = $2.b; 2945 $$->op = $1; 2946 $$->next = NULL; 2947 $$->tail = $$; 2948 } 2949 | portrange PORTBINARY portrange { 2950 if ($1.t || $3.t) { 2951 yyerror("':' cannot be used with an other " 2952 "port operator"); 2953 YYERROR; 2954 } 2955 $$ = calloc(1, sizeof(struct node_port)); 2956 if ($$ == NULL) 2957 err(1, "port_item: calloc"); 2958 $$->port[0] = $1.a; 2959 $$->port[1] = $3.a; 2960 $$->op = $2; 2961 $$->next = NULL; 2962 $$->tail = $$; 2963 } 2964 ; 2965 2966portplain : numberstring { 2967 if (parseport($1, &$$, 0) == -1) { 2968 free($1); 2969 YYERROR; 2970 } 2971 free($1); 2972 } 2973 ; 2974 2975portrange : numberstring { 2976 if (parseport($1, &$$, PPORT_RANGE) == -1) { 2977 free($1); 2978 YYERROR; 2979 } 2980 free($1); 2981 } 2982 ; 2983 2984uids : uid_item { $$ = $1; } 2985 | '{' optnl uid_list '}' { $$ = $3; } 2986 ; 2987 2988uid_list : uid_item optnl { $$ = $1; } 2989 | uid_list comma uid_item optnl { 2990 $1->tail->next = $3; 2991 $1->tail = $3; 2992 $$ = $1; 2993 } 2994 ; 2995 2996uid_item : uid { 2997 $$ = calloc(1, sizeof(struct node_uid)); 2998 if ($$ == NULL) 2999 err(1, "uid_item: calloc"); 3000 $$->uid[0] = $1; 3001 $$->uid[1] = $1; 3002 $$->op = PF_OP_EQ; 3003 $$->next = NULL; 3004 $$->tail = $$; 3005 } 3006 | unaryop uid { 3007 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3008 yyerror("user unknown requires operator = or " 3009 "!="); 3010 YYERROR; 3011 } 3012 $$ = calloc(1, sizeof(struct node_uid)); 3013 if ($$ == NULL) 3014 err(1, "uid_item: calloc"); 3015 $$->uid[0] = $2; 3016 $$->uid[1] = $2; 3017 $$->op = $1; 3018 $$->next = NULL; 3019 $$->tail = $$; 3020 } 3021 | uid PORTBINARY uid { 3022 if ($1 == UID_MAX || $3 == UID_MAX) { 3023 yyerror("user unknown requires operator = or " 3024 "!="); 3025 YYERROR; 3026 } 3027 $$ = calloc(1, sizeof(struct node_uid)); 3028 if ($$ == NULL) 3029 err(1, "uid_item: calloc"); 3030 $$->uid[0] = $1; 3031 $$->uid[1] = $3; 3032 $$->op = $2; 3033 $$->next = NULL; 3034 $$->tail = $$; 3035 } 3036 ; 3037 3038uid : STRING { 3039 if (!strcmp($1, "unknown")) 3040 $$ = UID_MAX; 3041 else { 3042 struct passwd *pw; 3043 3044 if ((pw = getpwnam($1)) == NULL) { 3045 yyerror("unknown user %s", $1); 3046 free($1); 3047 YYERROR; 3048 } 3049 $$ = pw->pw_uid; 3050 } 3051 free($1); 3052 } 3053 | NUMBER { 3054 if ($1 < 0 || $1 >= UID_MAX) { 3055 yyerror("illegal uid value %lu", $1); 3056 YYERROR; 3057 } 3058 $$ = $1; 3059 } 3060 ; 3061 3062gids : gid_item { $$ = $1; } 3063 | '{' optnl gid_list '}' { $$ = $3; } 3064 ; 3065 3066gid_list : gid_item optnl { $$ = $1; } 3067 | gid_list comma gid_item optnl { 3068 $1->tail->next = $3; 3069 $1->tail = $3; 3070 $$ = $1; 3071 } 3072 ; 3073 3074gid_item : gid { 3075 $$ = calloc(1, sizeof(struct node_gid)); 3076 if ($$ == NULL) 3077 err(1, "gid_item: calloc"); 3078 $$->gid[0] = $1; 3079 $$->gid[1] = $1; 3080 $$->op = PF_OP_EQ; 3081 $$->next = NULL; 3082 $$->tail = $$; 3083 } 3084 | unaryop gid { 3085 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3086 yyerror("group unknown requires operator = or " 3087 "!="); 3088 YYERROR; 3089 } 3090 $$ = calloc(1, sizeof(struct node_gid)); 3091 if ($$ == NULL) 3092 err(1, "gid_item: calloc"); 3093 $$->gid[0] = $2; 3094 $$->gid[1] = $2; 3095 $$->op = $1; 3096 $$->next = NULL; 3097 $$->tail = $$; 3098 } 3099 | gid PORTBINARY gid { 3100 if ($1 == GID_MAX || $3 == GID_MAX) { 3101 yyerror("group unknown requires operator = or " 3102 "!="); 3103 YYERROR; 3104 } 3105 $$ = calloc(1, sizeof(struct node_gid)); 3106 if ($$ == NULL) 3107 err(1, "gid_item: calloc"); 3108 $$->gid[0] = $1; 3109 $$->gid[1] = $3; 3110 $$->op = $2; 3111 $$->next = NULL; 3112 $$->tail = $$; 3113 } 3114 ; 3115 3116gid : STRING { 3117 if (!strcmp($1, "unknown")) 3118 $$ = GID_MAX; 3119 else { 3120 struct group *grp; 3121 3122 if ((grp = getgrnam($1)) == NULL) { 3123 yyerror("unknown group %s", $1); 3124 free($1); 3125 YYERROR; 3126 } 3127 $$ = grp->gr_gid; 3128 } 3129 free($1); 3130 } 3131 | NUMBER { 3132 if ($1 < 0 || $1 >= GID_MAX) { 3133 yyerror("illegal gid value %lu", $1); 3134 YYERROR; 3135 } 3136 $$ = $1; 3137 } 3138 ; 3139 3140flag : STRING { 3141 int f; 3142 3143 if ((f = parse_flags($1)) < 0) { 3144 yyerror("bad flags %s", $1); 3145 free($1); 3146 YYERROR; 3147 } 3148 free($1); 3149 $$.b1 = f; 3150 } 3151 ; 3152 3153flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3154 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3155 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3156 ; 3157 3158icmpspec : ICMPTYPE icmp_item { $$ = $2; } 3159 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3160 | ICMP6TYPE icmp6_item { $$ = $2; } 3161 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3162 ; 3163 3164icmp_list : icmp_item optnl { $$ = $1; } 3165 | icmp_list comma icmp_item optnl { 3166 $1->tail->next = $3; 3167 $1->tail = $3; 3168 $$ = $1; 3169 } 3170 ; 3171 3172icmp6_list : icmp6_item optnl { $$ = $1; } 3173 | icmp6_list comma icmp6_item optnl { 3174 $1->tail->next = $3; 3175 $1->tail = $3; 3176 $$ = $1; 3177 } 3178 ; 3179 3180icmp_item : icmptype { 3181 $$ = calloc(1, sizeof(struct node_icmp)); 3182 if ($$ == NULL) 3183 err(1, "icmp_item: calloc"); 3184 $$->type = $1; 3185 $$->code = 0; 3186 $$->proto = IPPROTO_ICMP; 3187 $$->next = NULL; 3188 $$->tail = $$; 3189 } 3190 | icmptype CODE STRING { 3191 const struct icmpcodeent *p; 3192 3193 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3194 yyerror("unknown icmp-code %s", $3); 3195 free($3); 3196 YYERROR; 3197 } 3198 3199 free($3); 3200 $$ = calloc(1, sizeof(struct node_icmp)); 3201 if ($$ == NULL) 3202 err(1, "icmp_item: calloc"); 3203 $$->type = $1; 3204 $$->code = p->code + 1; 3205 $$->proto = IPPROTO_ICMP; 3206 $$->next = NULL; 3207 $$->tail = $$; 3208 } 3209 | icmptype CODE NUMBER { 3210 if ($3 < 0 || $3 > 255) { 3211 yyerror("illegal icmp-code %lu", $3); 3212 YYERROR; 3213 } 3214 $$ = calloc(1, sizeof(struct node_icmp)); 3215 if ($$ == NULL) 3216 err(1, "icmp_item: calloc"); 3217 $$->type = $1; 3218 $$->code = $3 + 1; 3219 $$->proto = IPPROTO_ICMP; 3220 $$->next = NULL; 3221 $$->tail = $$; 3222 } 3223 ; 3224 3225icmp6_item : icmp6type { 3226 $$ = calloc(1, sizeof(struct node_icmp)); 3227 if ($$ == NULL) 3228 err(1, "icmp_item: calloc"); 3229 $$->type = $1; 3230 $$->code = 0; 3231 $$->proto = IPPROTO_ICMPV6; 3232 $$->next = NULL; 3233 $$->tail = $$; 3234 } 3235 | icmp6type CODE STRING { 3236 const struct icmpcodeent *p; 3237 3238 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3239 yyerror("unknown icmp6-code %s", $3); 3240 free($3); 3241 YYERROR; 3242 } 3243 free($3); 3244 3245 $$ = calloc(1, sizeof(struct node_icmp)); 3246 if ($$ == NULL) 3247 err(1, "icmp_item: calloc"); 3248 $$->type = $1; 3249 $$->code = p->code + 1; 3250 $$->proto = IPPROTO_ICMPV6; 3251 $$->next = NULL; 3252 $$->tail = $$; 3253 } 3254 | icmp6type CODE NUMBER { 3255 if ($3 < 0 || $3 > 255) { 3256 yyerror("illegal icmp-code %lu", $3); 3257 YYERROR; 3258 } 3259 $$ = calloc(1, sizeof(struct node_icmp)); 3260 if ($$ == NULL) 3261 err(1, "icmp_item: calloc"); 3262 $$->type = $1; 3263 $$->code = $3 + 1; 3264 $$->proto = IPPROTO_ICMPV6; 3265 $$->next = NULL; 3266 $$->tail = $$; 3267 } 3268 ; 3269 3270icmptype : STRING { 3271 const struct icmptypeent *p; 3272 3273 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3274 yyerror("unknown icmp-type %s", $1); 3275 free($1); 3276 YYERROR; 3277 } 3278 $$ = p->type + 1; 3279 free($1); 3280 } 3281 | NUMBER { 3282 if ($1 < 0 || $1 > 255) { 3283 yyerror("illegal icmp-type %lu", $1); 3284 YYERROR; 3285 } 3286 $$ = $1 + 1; 3287 } 3288 ; 3289 3290icmp6type : STRING { 3291 const struct icmptypeent *p; 3292 3293 if ((p = geticmptypebyname($1, AF_INET6)) == 3294 NULL) { 3295 yyerror("unknown icmp6-type %s", $1); 3296 free($1); 3297 YYERROR; 3298 } 3299 $$ = p->type + 1; 3300 free($1); 3301 } 3302 | NUMBER { 3303 if ($1 < 0 || $1 > 255) { 3304 yyerror("illegal icmp6-type %lu", $1); 3305 YYERROR; 3306 } 3307 $$ = $1 + 1; 3308 } 3309 ; 3310 3311tos : STRING { 3312 int val; 3313 if (map_tos($1, &val)) 3314 $$ = val; 3315 else if ($1[0] == '0' && $1[1] == 'x') 3316 $$ = strtoul($1, NULL, 16); 3317 else 3318 $$ = 256; /* flag bad argument */ 3319 if ($$ > 255) { 3320 yyerror("illegal tos value %s", $1); 3321 free($1); 3322 YYERROR; 3323 } 3324 free($1); 3325 } 3326 | NUMBER { 3327 $$ = $1; 3328 if ($$ > 255) { 3329 yyerror("illegal tos value %s", $1); 3330 YYERROR; 3331 } 3332 } 3333 ; 3334 3335sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3336 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3337 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3338 ; 3339 3340statelock : IFBOUND { 3341 $$ = PFRULE_IFBOUND; 3342 } 3343 | FLOATING { 3344 $$ = 0; 3345 } 3346 ; 3347 3348keep : NO STATE { 3349 $$.action = 0; 3350 $$.options = NULL; 3351 } 3352 | KEEP STATE state_opt_spec { 3353 $$.action = PF_STATE_NORMAL; 3354 $$.options = $3; 3355 } 3356 | MODULATE STATE state_opt_spec { 3357 $$.action = PF_STATE_MODULATE; 3358 $$.options = $3; 3359 } 3360 | SYNPROXY STATE state_opt_spec { 3361 $$.action = PF_STATE_SYNPROXY; 3362 $$.options = $3; 3363 } 3364 ; 3365 3366flush : /* empty */ { $$ = 0; } 3367 | FLUSH { $$ = PF_FLUSH; } 3368 | FLUSH GLOBAL { 3369 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3370 } 3371 ; 3372 3373state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3374 | /* empty */ { $$ = NULL; } 3375 ; 3376 3377state_opt_list : state_opt_item { $$ = $1; } 3378 | state_opt_list comma state_opt_item { 3379 $1->tail->next = $3; 3380 $1->tail = $3; 3381 $$ = $1; 3382 } 3383 ; 3384 3385state_opt_item : MAXIMUM NUMBER { 3386 if ($2 < 0 || $2 > UINT_MAX) { 3387 yyerror("only positive values permitted"); 3388 YYERROR; 3389 } 3390 $$ = calloc(1, sizeof(struct node_state_opt)); 3391 if ($$ == NULL) 3392 err(1, "state_opt_item: calloc"); 3393 $$->type = PF_STATE_OPT_MAX; 3394 $$->data.max_states = $2; 3395 $$->next = NULL; 3396 $$->tail = $$; 3397 } 3398 | NOSYNC { 3399 $$ = calloc(1, sizeof(struct node_state_opt)); 3400 if ($$ == NULL) 3401 err(1, "state_opt_item: calloc"); 3402 $$->type = PF_STATE_OPT_NOSYNC; 3403 $$->next = NULL; 3404 $$->tail = $$; 3405 } 3406 | MAXSRCSTATES NUMBER { 3407 if ($2 < 0 || $2 > UINT_MAX) { 3408 yyerror("only positive values permitted"); 3409 YYERROR; 3410 } 3411 $$ = calloc(1, sizeof(struct node_state_opt)); 3412 if ($$ == NULL) 3413 err(1, "state_opt_item: calloc"); 3414 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3415 $$->data.max_src_states = $2; 3416 $$->next = NULL; 3417 $$->tail = $$; 3418 } 3419 | MAXSRCCONN NUMBER { 3420 if ($2 < 0 || $2 > UINT_MAX) { 3421 yyerror("only positive values permitted"); 3422 YYERROR; 3423 } 3424 $$ = calloc(1, sizeof(struct node_state_opt)); 3425 if ($$ == NULL) 3426 err(1, "state_opt_item: calloc"); 3427 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3428 $$->data.max_src_conn = $2; 3429 $$->next = NULL; 3430 $$->tail = $$; 3431 } 3432 | MAXSRCCONNRATE NUMBER '/' NUMBER { 3433 if ($2 < 0 || $2 > UINT_MAX || 3434 $4 < 0 || $4 > UINT_MAX) { 3435 yyerror("only positive values permitted"); 3436 YYERROR; 3437 } 3438 $$ = calloc(1, sizeof(struct node_state_opt)); 3439 if ($$ == NULL) 3440 err(1, "state_opt_item: calloc"); 3441 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3442 $$->data.max_src_conn_rate.limit = $2; 3443 $$->data.max_src_conn_rate.seconds = $4; 3444 $$->next = NULL; 3445 $$->tail = $$; 3446 } 3447 | OVERLOAD '<' STRING '>' flush { 3448 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3449 yyerror("table name '%s' too long", $3); 3450 free($3); 3451 YYERROR; 3452 } 3453 $$ = calloc(1, sizeof(struct node_state_opt)); 3454 if ($$ == NULL) 3455 err(1, "state_opt_item: calloc"); 3456 if (strlcpy($$->data.overload.tblname, $3, 3457 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3458 errx(1, "state_opt_item: strlcpy"); 3459 free($3); 3460 $$->type = PF_STATE_OPT_OVERLOAD; 3461 $$->data.overload.flush = $5; 3462 $$->next = NULL; 3463 $$->tail = $$; 3464 } 3465 | MAXSRCNODES NUMBER { 3466 if ($2 < 0 || $2 > UINT_MAX) { 3467 yyerror("only positive values permitted"); 3468 YYERROR; 3469 } 3470 $$ = calloc(1, sizeof(struct node_state_opt)); 3471 if ($$ == NULL) 3472 err(1, "state_opt_item: calloc"); 3473 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3474 $$->data.max_src_nodes = $2; 3475 $$->next = NULL; 3476 $$->tail = $$; 3477 } 3478 | sourcetrack { 3479 $$ = calloc(1, sizeof(struct node_state_opt)); 3480 if ($$ == NULL) 3481 err(1, "state_opt_item: calloc"); 3482 $$->type = PF_STATE_OPT_SRCTRACK; 3483 $$->data.src_track = $1; 3484 $$->next = NULL; 3485 $$->tail = $$; 3486 } 3487 | statelock { 3488 $$ = calloc(1, sizeof(struct node_state_opt)); 3489 if ($$ == NULL) 3490 err(1, "state_opt_item: calloc"); 3491 $$->type = PF_STATE_OPT_STATELOCK; 3492 $$->data.statelock = $1; 3493 $$->next = NULL; 3494 $$->tail = $$; 3495 } 3496 | SLOPPY { 3497 $$ = calloc(1, sizeof(struct node_state_opt)); 3498 if ($$ == NULL) 3499 err(1, "state_opt_item: calloc"); 3500 $$->type = PF_STATE_OPT_SLOPPY; 3501 $$->next = NULL; 3502 $$->tail = $$; 3503 } 3504 | PFLOW { 3505 $$ = calloc(1, sizeof(struct node_state_opt)); 3506 if ($$ == NULL) 3507 err(1, "state_opt_item: calloc"); 3508 $$->type = PF_STATE_OPT_PFLOW; 3509 $$->next = NULL; 3510 $$->tail = $$; 3511 } 3512 | STRING NUMBER { 3513 int i; 3514 3515 if ($2 < 0 || $2 > UINT_MAX) { 3516 yyerror("only positive values permitted"); 3517 YYERROR; 3518 } 3519 for (i = 0; pf_timeouts[i].name && 3520 strcmp(pf_timeouts[i].name, $1); ++i) 3521 ; /* nothing */ 3522 if (!pf_timeouts[i].name) { 3523 yyerror("illegal timeout name %s", $1); 3524 free($1); 3525 YYERROR; 3526 } 3527 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3528 yyerror("illegal state timeout %s", $1); 3529 free($1); 3530 YYERROR; 3531 } 3532 free($1); 3533 $$ = calloc(1, sizeof(struct node_state_opt)); 3534 if ($$ == NULL) 3535 err(1, "state_opt_item: calloc"); 3536 $$->type = PF_STATE_OPT_TIMEOUT; 3537 $$->data.timeout.number = pf_timeouts[i].timeout; 3538 $$->data.timeout.seconds = $2; 3539 $$->next = NULL; 3540 $$->tail = $$; 3541 } 3542 ; 3543 3544label : LABEL STRING { 3545 $$ = $2; 3546 } 3547 ; 3548 3549qname : QUEUE STRING { 3550 $$.qname = $2; 3551 $$.pqname = NULL; 3552 } 3553 | QUEUE '(' STRING ')' { 3554 $$.qname = $3; 3555 $$.pqname = NULL; 3556 } 3557 | QUEUE '(' STRING comma STRING ')' { 3558 $$.qname = $3; 3559 $$.pqname = $5; 3560 } 3561 ; 3562 3563portstar : numberstring { 3564 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3565 free($1); 3566 YYERROR; 3567 } 3568 free($1); 3569 } 3570 ; 3571 3572redirspec : host { $$ = $1; } 3573 | '{' optnl redir_host_list '}' { $$ = $3; } 3574 ; 3575 3576redir_host_list : host optnl { $$ = $1; } 3577 | redir_host_list comma host optnl { 3578 $1->tail->next = $3; 3579 $1->tail = $3->tail; 3580 $$ = $1; 3581 } 3582 ; 3583 3584redirpool : redirspec { 3585 $$ = calloc(1, sizeof(struct redirection)); 3586 if ($$ == NULL) 3587 err(1, "redirection: calloc"); 3588 $$->host = $1; 3589 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3590 } 3591 | redirspec PORT portstar { 3592 $$ = calloc(1, sizeof(struct redirection)); 3593 if ($$ == NULL) 3594 err(1, "redirection: calloc"); 3595 $$->host = $1; 3596 $$->rport = $3; 3597 } 3598 ; 3599 3600hashkey : /* empty */ 3601 { 3602 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3603 if ($$ == NULL) 3604 err(1, "hashkey: calloc"); 3605 $$->key32[0] = arc4random(); 3606 $$->key32[1] = arc4random(); 3607 $$->key32[2] = arc4random(); 3608 $$->key32[3] = arc4random(); 3609 } 3610 | string 3611 { 3612 if (!strncmp($1, "0x", 2)) { 3613 if (strlen($1) != 34) { 3614 free($1); 3615 yyerror("hex key must be 128 bits " 3616 "(32 hex digits) long"); 3617 YYERROR; 3618 } 3619 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3620 if ($$ == NULL) 3621 err(1, "hashkey: calloc"); 3622 3623 if (sscanf($1, "0x%8x%8x%8x%8x", 3624 &$$->key32[0], &$$->key32[1], 3625 &$$->key32[2], &$$->key32[3]) != 4) { 3626 free($$); 3627 free($1); 3628 yyerror("invalid hex key"); 3629 YYERROR; 3630 } 3631 } else { 3632 MD5_CTX context; 3633 3634 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3635 if ($$ == NULL) 3636 err(1, "hashkey: calloc"); 3637 MD5Init(&context); 3638 MD5Update(&context, (unsigned char *)$1, 3639 strlen($1)); 3640 MD5Final((unsigned char *)$$, &context); 3641 HTONL($$->key32[0]); 3642 HTONL($$->key32[1]); 3643 HTONL($$->key32[2]); 3644 HTONL($$->key32[3]); 3645 } 3646 free($1); 3647 } 3648 ; 3649 3650pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3651 pool_opts_l 3652 { $$ = pool_opts; } 3653 | /* empty */ { 3654 bzero(&pool_opts, sizeof pool_opts); 3655 $$ = pool_opts; 3656 } 3657 ; 3658 3659pool_opts_l : pool_opts_l pool_opt 3660 | pool_opt 3661 ; 3662 3663pool_opt : BITMASK { 3664 if (pool_opts.type) { 3665 yyerror("pool type cannot be redefined"); 3666 YYERROR; 3667 } 3668 pool_opts.type = PF_POOL_BITMASK; 3669 } 3670 | RANDOM { 3671 if (pool_opts.type) { 3672 yyerror("pool type cannot be redefined"); 3673 YYERROR; 3674 } 3675 pool_opts.type = PF_POOL_RANDOM; 3676 } 3677 | SOURCEHASH hashkey { 3678 if (pool_opts.type) { 3679 yyerror("pool type cannot be redefined"); 3680 YYERROR; 3681 } 3682 pool_opts.type = PF_POOL_SRCHASH; 3683 pool_opts.key = $2; 3684 } 3685 | ROUNDROBIN { 3686 if (pool_opts.type) { 3687 yyerror("pool type cannot be redefined"); 3688 YYERROR; 3689 } 3690 pool_opts.type = PF_POOL_ROUNDROBIN; 3691 } 3692 | STATICPORT { 3693 if (pool_opts.staticport) { 3694 yyerror("static-port cannot be redefined"); 3695 YYERROR; 3696 } 3697 pool_opts.staticport = 1; 3698 } 3699 | STICKYADDRESS { 3700 if (filter_opts.marker & POM_STICKYADDRESS) { 3701 yyerror("sticky-address cannot be redefined"); 3702 YYERROR; 3703 } 3704 pool_opts.marker |= POM_STICKYADDRESS; 3705 pool_opts.opts |= PF_POOL_STICKYADDR; 3706 } 3707 ; 3708 3709route_host : STRING { 3710 $$ = calloc(1, sizeof(struct node_host)); 3711 if ($$ == NULL) 3712 err(1, "route_host: calloc"); 3713 $$->ifname = $1; 3714 $$->addr.type = PF_ADDR_DYNIFTL; 3715 set_ipmask($$, 128); 3716 $$->next = NULL; 3717 $$->tail = $$; 3718 } 3719 | '(' STRING host ')' { 3720 $$ = $3; 3721 $$->ifname = $2; 3722 } 3723 ; 3724 3725route_host_list : route_host optnl { $$ = $1; } 3726 | route_host_list comma route_host optnl { 3727 if ($1->af == 0) 3728 $1->af = $3->af; 3729 if ($1->af != $3->af) { 3730 yyerror("all pool addresses must be in the " 3731 "same address family"); 3732 YYERROR; 3733 } 3734 $1->tail->next = $3; 3735 $1->tail = $3->tail; 3736 $$ = $1; 3737 } 3738 ; 3739 3740routespec : route_host { $$ = $1; } 3741 | '{' optnl route_host_list '}' { $$ = $3; } 3742 ; 3743 3744timeout_spec : STRING NUMBER 3745 { 3746 if (check_rulestate(PFCTL_STATE_OPTION)) { 3747 free($1); 3748 YYERROR; 3749 } 3750 if ($2 < 0 || $2 > UINT_MAX) { 3751 yyerror("only positive values permitted"); 3752 YYERROR; 3753 } 3754 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3755 yyerror("unknown timeout %s", $1); 3756 free($1); 3757 YYERROR; 3758 } 3759 free($1); 3760 } 3761 ; 3762 3763timeout_list : timeout_list comma timeout_spec optnl 3764 | timeout_spec optnl 3765 ; 3766 3767limit_spec : STRING NUMBER 3768 { 3769 if (check_rulestate(PFCTL_STATE_OPTION)) { 3770 free($1); 3771 YYERROR; 3772 } 3773 if ($2 < 0 || $2 > UINT_MAX) { 3774 yyerror("only positive values permitted"); 3775 YYERROR; 3776 } 3777 if (pfctl_set_limit(pf, $1, $2) != 0) { 3778 yyerror("unable to set limit %s %u", $1, $2); 3779 free($1); 3780 YYERROR; 3781 } 3782 free($1); 3783 } 3784 ; 3785 3786limit_list : limit_list comma limit_spec optnl 3787 | limit_spec optnl 3788 ; 3789 3790comma : ',' 3791 | /* empty */ 3792 ; 3793 3794yesno : NO { $$ = 0; } 3795 | STRING { 3796 if (!strcmp($1, "yes")) 3797 $$ = 1; 3798 else { 3799 yyerror("invalid value '%s', expected 'yes' " 3800 "or 'no'", $1); 3801 free($1); 3802 YYERROR; 3803 } 3804 free($1); 3805 } 3806 ; 3807 3808unaryop : '=' { $$ = PF_OP_EQ; } 3809 | '!' '=' { $$ = PF_OP_NE; } 3810 | '<' '=' { $$ = PF_OP_LE; } 3811 | '<' { $$ = PF_OP_LT; } 3812 | '>' '=' { $$ = PF_OP_GE; } 3813 | '>' { $$ = PF_OP_GT; } 3814 ; 3815 3816%% 3817 3818int 3819yyerror(const char *fmt, ...) 3820{ 3821 va_list ap; 3822 3823 file->errors++; 3824 va_start(ap, fmt); 3825 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 3826 vfprintf(stderr, fmt, ap); 3827 fprintf(stderr, "\n"); 3828 va_end(ap); 3829 return (0); 3830} 3831 3832int 3833disallow_table(struct node_host *h, const char *fmt) 3834{ 3835 for (; h != NULL; h = h->next) 3836 if (h->addr.type == PF_ADDR_TABLE) { 3837 yyerror(fmt, h->addr.v.tblname); 3838 return (1); 3839 } 3840 return (0); 3841} 3842 3843int 3844disallow_urpf_failed(struct node_host *h, const char *fmt) 3845{ 3846 for (; h != NULL; h = h->next) 3847 if (h->addr.type == PF_ADDR_URPFFAILED) { 3848 yyerror(fmt); 3849 return (1); 3850 } 3851 return (0); 3852} 3853 3854int 3855disallow_alias(struct node_host *h, const char *fmt) 3856{ 3857 for (; h != NULL; h = h->next) 3858 if (DYNIF_MULTIADDR(h->addr)) { 3859 yyerror(fmt, h->addr.v.tblname); 3860 return (1); 3861 } 3862 return (0); 3863} 3864 3865int 3866rule_consistent(struct pf_rule *r, int anchor_call) 3867{ 3868 int problems = 0; 3869 3870 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3871 (r->src.port_op || r->dst.port_op)) { 3872 yyerror("port only applies to tcp/udp"); 3873 problems++; 3874 } 3875 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3876 (r->type || r->code)) { 3877 yyerror("icmp-type/code only applies to icmp"); 3878 problems++; 3879 } 3880 if (!r->af && (r->type || r->code)) { 3881 yyerror("must indicate address family with icmp-type/code"); 3882 problems++; 3883 } 3884 if (r->overload_tblname[0] && 3885 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3886 yyerror("'overload' requires 'max-src-conn' " 3887 "or 'max-src-conn-rate'"); 3888 problems++; 3889 } 3890 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3891 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3892 yyerror("proto %s doesn't match address family %s", 3893 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3894 r->af == AF_INET ? "inet" : "inet6"); 3895 problems++; 3896 } 3897 if (r->allow_opts && r->action != PF_PASS) { 3898 yyerror("allow-opts can only be specified for pass rules"); 3899 problems++; 3900 } 3901 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3902 r->dst.port_op || r->flagset || r->type || r->code)) { 3903 yyerror("fragments can be filtered only on IP header fields"); 3904 problems++; 3905 } 3906 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3907 yyerror("return-rst can only be applied to TCP rules"); 3908 problems++; 3909 } 3910 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3911 yyerror("max-src-nodes requires 'source-track rule'"); 3912 problems++; 3913 } 3914 if (r->action != PF_PASS && r->keep_state) { 3915 yyerror("keep state is great, but only for pass rules"); 3916 problems++; 3917 } 3918 if (r->rule_flag & PFRULE_STATESLOPPY && 3919 (r->keep_state == PF_STATE_MODULATE || 3920 r->keep_state == PF_STATE_SYNPROXY)) { 3921 yyerror("sloppy state matching cannot be used with " 3922 "synproxy state or modulate state"); 3923 problems++; 3924 } 3925 if ((!TAILQ_EMPTY(&r->nat.list) || 3926 (!r->rt && !TAILQ_EMPTY(&r->rdr.list))) && 3927 r->action != PF_MATCH && !r->keep_state) { 3928 yyerror("nat-to and rdr-to require keep state"); 3929 problems++; 3930 } 3931 if (!TAILQ_EMPTY(&r->nat.list) && r->direction != PF_OUT) { 3932 yyerror("nat-to can only be used outbound"); 3933 problems++; 3934 } 3935 if (!r->rt && !TAILQ_EMPTY(&r->rdr.list) && r->direction != PF_IN) { 3936 yyerror("rdr-to can only be used inbound"); 3937 problems++; 3938 } 3939 3940 /* match rules rules */ 3941 if (r->action == PF_MATCH) { 3942 if (r->divert.port) { 3943 yyerror("divert is not supported on match rules"); 3944 problems++; 3945 } 3946 if (r->divert_packet.port) { 3947 yyerror("divert is not supported on match rules"); 3948 problems++; 3949 } 3950 if (r->rt) { 3951 yyerror("route-to, reply-to, dup-to and fastroute " 3952 "must not be used on match rules"); 3953 problems++; 3954 } 3955 } 3956 return (-problems); 3957} 3958 3959int 3960process_tabledef(char *name, struct table_opts *opts) 3961{ 3962 struct pfr_buffer ab; 3963 struct node_tinit *ti; 3964 3965 bzero(&ab, sizeof(ab)); 3966 ab.pfrb_type = PFRB_ADDRS; 3967 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3968 if (ti->file) 3969 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3970 if (errno) 3971 yyerror("cannot load \"%s\": %s", 3972 ti->file, strerror(errno)); 3973 else 3974 yyerror("file \"%s\" contains bad data", 3975 ti->file); 3976 goto _error; 3977 } 3978 if (ti->host) 3979 if (append_addr_host(&ab, ti->host, 0, 0)) { 3980 yyerror("cannot create address buffer: %s", 3981 strerror(errno)); 3982 goto _error; 3983 } 3984 } 3985 if (pf->opts & PF_OPT_VERBOSE) 3986 print_tabledef(name, opts->flags, opts->init_addr, 3987 &opts->init_nodes); 3988 if (!(pf->opts & PF_OPT_NOACTION) && 3989 pfctl_define_table(name, opts->flags, opts->init_addr, 3990 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 3991 yyerror("cannot define table %s: %s", name, 3992 pfr_strerror(errno)); 3993 goto _error; 3994 } 3995 pf->tdirty = 1; 3996 pfr_buf_clear(&ab); 3997 return (0); 3998_error: 3999 pfr_buf_clear(&ab); 4000 return (-1); 4001} 4002 4003struct keywords { 4004 const char *k_name; 4005 int k_val; 4006}; 4007 4008/* macro gore, but you should've seen the prior indentation nightmare... */ 4009 4010#define FREE_LIST(T,r) \ 4011 do { \ 4012 T *p, *node = r; \ 4013 while (node != NULL) { \ 4014 p = node; \ 4015 node = node->next; \ 4016 free(p); \ 4017 } \ 4018 } while (0) 4019 4020#define LOOP_THROUGH(T,n,r,C) \ 4021 do { \ 4022 T *n; \ 4023 if (r == NULL) { \ 4024 r = calloc(1, sizeof(T)); \ 4025 if (r == NULL) \ 4026 err(1, "LOOP: calloc"); \ 4027 r->next = NULL; \ 4028 } \ 4029 n = r; \ 4030 while (n != NULL) { \ 4031 do { \ 4032 C; \ 4033 } while (0); \ 4034 n = n->next; \ 4035 } \ 4036 } while (0) 4037 4038void 4039expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4040{ 4041 char *tmp; 4042 char *p, *q; 4043 4044 if ((tmp = calloc(1, len)) == NULL) 4045 err(1, "expand_label_str: calloc"); 4046 p = q = label; 4047 while ((q = strstr(p, srch)) != NULL) { 4048 *q = '\0'; 4049 if ((strlcat(tmp, p, len) >= len) || 4050 (strlcat(tmp, repl, len) >= len)) 4051 errx(1, "expand_label: label too long"); 4052 q += strlen(srch); 4053 p = q; 4054 } 4055 if (strlcat(tmp, p, len) >= len) 4056 errx(1, "expand_label: label too long"); 4057 strlcpy(label, tmp, len); /* always fits */ 4058 free(tmp); 4059} 4060 4061void 4062expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4063{ 4064 if (strstr(label, name) != NULL) { 4065 if (!*ifname) 4066 expand_label_str(label, len, name, "any"); 4067 else 4068 expand_label_str(label, len, name, ifname); 4069 } 4070} 4071 4072void 4073expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4074 struct node_host *h) 4075{ 4076 char tmp[64], tmp_not[66]; 4077 4078 if (strstr(label, name) != NULL) { 4079 switch (h->addr.type) { 4080 case PF_ADDR_DYNIFTL: 4081 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4082 break; 4083 case PF_ADDR_TABLE: 4084 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4085 break; 4086 case PF_ADDR_NOROUTE: 4087 snprintf(tmp, sizeof(tmp), "no-route"); 4088 break; 4089 case PF_ADDR_URPFFAILED: 4090 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4091 break; 4092 case PF_ADDR_ADDRMASK: 4093 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4094 PF_AZERO(&h->addr.v.a.mask, af))) 4095 snprintf(tmp, sizeof(tmp), "any"); 4096 else { 4097 char a[48]; 4098 int bits; 4099 4100 if (inet_ntop(af, &h->addr.v.a.addr, a, 4101 sizeof(a)) == NULL) 4102 snprintf(tmp, sizeof(tmp), "?"); 4103 else { 4104 bits = unmask(&h->addr.v.a.mask, af); 4105 if ((af == AF_INET && bits < 32) || 4106 (af == AF_INET6 && bits < 128)) 4107 snprintf(tmp, sizeof(tmp), 4108 "%s/%d", a, bits); 4109 else 4110 snprintf(tmp, sizeof(tmp), 4111 "%s", a); 4112 } 4113 } 4114 break; 4115 default: 4116 snprintf(tmp, sizeof(tmp), "?"); 4117 break; 4118 } 4119 4120 if (h->not) { 4121 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4122 expand_label_str(label, len, name, tmp_not); 4123 } else 4124 expand_label_str(label, len, name, tmp); 4125 } 4126} 4127 4128void 4129expand_label_port(const char *name, char *label, size_t len, 4130 struct node_port *port) 4131{ 4132 char a1[6], a2[6], op[13] = ""; 4133 4134 if (strstr(label, name) != NULL) { 4135 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4136 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4137 if (!port->op) 4138 ; 4139 else if (port->op == PF_OP_IRG) 4140 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4141 else if (port->op == PF_OP_XRG) 4142 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4143 else if (port->op == PF_OP_EQ) 4144 snprintf(op, sizeof(op), "%s", a1); 4145 else if (port->op == PF_OP_NE) 4146 snprintf(op, sizeof(op), "!=%s", a1); 4147 else if (port->op == PF_OP_LT) 4148 snprintf(op, sizeof(op), "<%s", a1); 4149 else if (port->op == PF_OP_LE) 4150 snprintf(op, sizeof(op), "<=%s", a1); 4151 else if (port->op == PF_OP_GT) 4152 snprintf(op, sizeof(op), ">%s", a1); 4153 else if (port->op == PF_OP_GE) 4154 snprintf(op, sizeof(op), ">=%s", a1); 4155 expand_label_str(label, len, name, op); 4156 } 4157} 4158 4159void 4160expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4161{ 4162 struct protoent *pe; 4163 char n[4]; 4164 4165 if (strstr(label, name) != NULL) { 4166 pe = getprotobynumber(proto); 4167 if (pe != NULL) 4168 expand_label_str(label, len, name, pe->p_name); 4169 else { 4170 snprintf(n, sizeof(n), "%u", proto); 4171 expand_label_str(label, len, name, n); 4172 } 4173 } 4174} 4175 4176void 4177expand_label_nr(const char *name, char *label, size_t len) 4178{ 4179 char n[11]; 4180 4181 if (strstr(label, name) != NULL) { 4182 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4183 expand_label_str(label, len, name, n); 4184 } 4185} 4186 4187void 4188expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4189 struct node_host *src_host, struct node_port *src_port, 4190 struct node_host *dst_host, struct node_port *dst_port, 4191 u_int8_t proto) 4192{ 4193 expand_label_if("$if", label, len, ifname); 4194 expand_label_addr("$srcaddr", label, len, af, src_host); 4195 expand_label_addr("$dstaddr", label, len, af, dst_host); 4196 expand_label_port("$srcport", label, len, src_port); 4197 expand_label_port("$dstport", label, len, dst_port); 4198 expand_label_proto("$proto", label, len, proto); 4199 expand_label_nr("$nr", label, len); 4200} 4201 4202int 4203expand_altq(struct pf_altq *a, struct node_if *interfaces, 4204 struct node_queue *nqueues, struct node_queue_bw bwspec, 4205 struct node_queue_opt *opts) 4206{ 4207 struct pf_altq pa, pb; 4208 char qname[PF_QNAME_SIZE]; 4209 struct node_queue *n; 4210 struct node_queue_bw bw; 4211 int errs = 0; 4212 4213 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4214 FREE_LIST(struct node_if, interfaces); 4215 FREE_LIST(struct node_queue, nqueues); 4216 return (0); 4217 } 4218 4219 LOOP_THROUGH(struct node_if, interface, interfaces, 4220 memcpy(&pa, a, sizeof(struct pf_altq)); 4221 if (strlcpy(pa.ifname, interface->ifname, 4222 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4223 errx(1, "expand_altq: strlcpy"); 4224 4225 if (interface->not) { 4226 yyerror("altq on ! <interface> is not supported"); 4227 errs++; 4228 } else { 4229 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4230 errs++; 4231 else 4232 if (pfctl_add_altq(pf, &pa)) 4233 errs++; 4234 4235 if (pf->opts & PF_OPT_VERBOSE) { 4236 print_altq(&pf->paltq->altq, 0, 4237 &bwspec, opts); 4238 if (nqueues && nqueues->tail) { 4239 printf("queue { "); 4240 LOOP_THROUGH(struct node_queue, queue, 4241 nqueues, 4242 printf("%s ", 4243 queue->queue); 4244 ); 4245 printf("}"); 4246 } 4247 printf("\n"); 4248 } 4249 4250 if (pa.scheduler == ALTQT_CBQ || 4251 pa.scheduler == ALTQT_HFSC) { 4252 /* now create a root queue */ 4253 memset(&pb, 0, sizeof(struct pf_altq)); 4254 if (strlcpy(qname, "root_", sizeof(qname)) >= 4255 sizeof(qname)) 4256 errx(1, "expand_altq: strlcpy"); 4257 if (strlcat(qname, interface->ifname, 4258 sizeof(qname)) >= sizeof(qname)) 4259 errx(1, "expand_altq: strlcat"); 4260 if (strlcpy(pb.qname, qname, 4261 sizeof(pb.qname)) >= sizeof(pb.qname)) 4262 errx(1, "expand_altq: strlcpy"); 4263 if (strlcpy(pb.ifname, interface->ifname, 4264 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4265 errx(1, "expand_altq: strlcpy"); 4266 pb.qlimit = pa.qlimit; 4267 pb.scheduler = pa.scheduler; 4268 bw.bw_absolute = pa.ifbandwidth; 4269 bw.bw_percent = 0; 4270 if (eval_pfqueue(pf, &pb, &bw, opts)) 4271 errs++; 4272 else 4273 if (pfctl_add_altq(pf, &pb)) 4274 errs++; 4275 } 4276 4277 LOOP_THROUGH(struct node_queue, queue, nqueues, 4278 n = calloc(1, sizeof(struct node_queue)); 4279 if (n == NULL) 4280 err(1, "expand_altq: calloc"); 4281 if (pa.scheduler == ALTQT_CBQ || 4282 pa.scheduler == ALTQT_HFSC) 4283 if (strlcpy(n->parent, qname, 4284 sizeof(n->parent)) >= 4285 sizeof(n->parent)) 4286 errx(1, "expand_altq: strlcpy"); 4287 if (strlcpy(n->queue, queue->queue, 4288 sizeof(n->queue)) >= sizeof(n->queue)) 4289 errx(1, "expand_altq: strlcpy"); 4290 if (strlcpy(n->ifname, interface->ifname, 4291 sizeof(n->ifname)) >= sizeof(n->ifname)) 4292 errx(1, "expand_altq: strlcpy"); 4293 n->scheduler = pa.scheduler; 4294 n->next = NULL; 4295 n->tail = n; 4296 if (queues == NULL) 4297 queues = n; 4298 else { 4299 queues->tail->next = n; 4300 queues->tail = n; 4301 } 4302 ); 4303 } 4304 ); 4305 FREE_LIST(struct node_if, interfaces); 4306 FREE_LIST(struct node_queue, nqueues); 4307 4308 return (errs); 4309} 4310 4311int 4312expand_queue(struct pf_altq *a, struct node_if *interfaces, 4313 struct node_queue *nqueues, struct node_queue_bw bwspec, 4314 struct node_queue_opt *opts) 4315{ 4316 struct node_queue *n, *nq; 4317 struct pf_altq pa; 4318 u_int8_t found = 0; 4319 u_int8_t errs = 0; 4320 4321 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4322 FREE_LIST(struct node_queue, nqueues); 4323 return (0); 4324 } 4325 4326 if (queues == NULL) { 4327 yyerror("queue %s has no parent", a->qname); 4328 FREE_LIST(struct node_queue, nqueues); 4329 return (1); 4330 } 4331 4332 LOOP_THROUGH(struct node_if, interface, interfaces, 4333 LOOP_THROUGH(struct node_queue, tqueue, queues, 4334 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4335 (interface->ifname[0] == 0 || 4336 (!interface->not && !strncmp(interface->ifname, 4337 tqueue->ifname, IFNAMSIZ)) || 4338 (interface->not && strncmp(interface->ifname, 4339 tqueue->ifname, IFNAMSIZ)))) { 4340 /* found ourself in queues */ 4341 found++; 4342 4343 memcpy(&pa, a, sizeof(struct pf_altq)); 4344 4345 if (pa.scheduler != ALTQT_NONE && 4346 pa.scheduler != tqueue->scheduler) { 4347 yyerror("exactly one scheduler type " 4348 "per interface allowed"); 4349 return (1); 4350 } 4351 pa.scheduler = tqueue->scheduler; 4352 4353 /* scheduler dependent error checking */ 4354 switch (pa.scheduler) { 4355 case ALTQT_PRIQ: 4356 if (nqueues != NULL) { 4357 yyerror("priq queues cannot " 4358 "have child queues"); 4359 return (1); 4360 } 4361 if (bwspec.bw_absolute > 0 || 4362 bwspec.bw_percent < 100) { 4363 yyerror("priq doesn't take " 4364 "bandwidth"); 4365 return (1); 4366 } 4367 break; 4368 default: 4369 break; 4370 } 4371 4372 if (strlcpy(pa.ifname, tqueue->ifname, 4373 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4374 errx(1, "expand_queue: strlcpy"); 4375 if (strlcpy(pa.parent, tqueue->parent, 4376 sizeof(pa.parent)) >= sizeof(pa.parent)) 4377 errx(1, "expand_queue: strlcpy"); 4378 4379 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4380 errs++; 4381 else 4382 if (pfctl_add_altq(pf, &pa)) 4383 errs++; 4384 4385 for (nq = nqueues; nq != NULL; nq = nq->next) { 4386 if (!strcmp(a->qname, nq->queue)) { 4387 yyerror("queue cannot have " 4388 "itself as child"); 4389 errs++; 4390 continue; 4391 } 4392 n = calloc(1, 4393 sizeof(struct node_queue)); 4394 if (n == NULL) 4395 err(1, "expand_queue: calloc"); 4396 if (strlcpy(n->parent, a->qname, 4397 sizeof(n->parent)) >= 4398 sizeof(n->parent)) 4399 errx(1, "expand_queue strlcpy"); 4400 if (strlcpy(n->queue, nq->queue, 4401 sizeof(n->queue)) >= 4402 sizeof(n->queue)) 4403 errx(1, "expand_queue strlcpy"); 4404 if (strlcpy(n->ifname, tqueue->ifname, 4405 sizeof(n->ifname)) >= 4406 sizeof(n->ifname)) 4407 errx(1, "expand_queue strlcpy"); 4408 n->scheduler = tqueue->scheduler; 4409 n->next = NULL; 4410 n->tail = n; 4411 if (queues == NULL) 4412 queues = n; 4413 else { 4414 queues->tail->next = n; 4415 queues->tail = n; 4416 } 4417 } 4418 if ((pf->opts & PF_OPT_VERBOSE) && ( 4419 (found == 1 && interface->ifname[0] == 0) || 4420 (found > 0 && interface->ifname[0] != 0))) { 4421 print_queue(&pf->paltq->altq, 0, 4422 &bwspec, interface->ifname[0] != 0, 4423 opts); 4424 if (nqueues && nqueues->tail) { 4425 printf("{ "); 4426 LOOP_THROUGH(struct node_queue, 4427 queue, nqueues, 4428 printf("%s ", 4429 queue->queue); 4430 ); 4431 printf("}"); 4432 } 4433 printf("\n"); 4434 } 4435 } 4436 ); 4437 ); 4438 4439 FREE_LIST(struct node_queue, nqueues); 4440 FREE_LIST(struct node_if, interfaces); 4441 4442 if (!found) { 4443 yyerror("queue %s has no parent", a->qname); 4444 errs++; 4445 } 4446 4447 if (errs) 4448 return (1); 4449 else 4450 return (0); 4451} 4452 4453int 4454apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, 4455 int isrdr, struct node_port *np) 4456{ 4457 struct node_host *h; 4458 struct pf_pooladdr *pa; 4459 4460 if (!rs || !rs->rdr) 4461 return (0); 4462 4463 if (!r->af && ! rs->rdr->host->ifindex) 4464 r->af = rs->rdr->host->af; 4465 4466 remove_invalid_hosts(&rs->rdr->host, &r->af); 4467 if (invalid_redirect(rs->rdr->host, r->af)) 4468 return (1); 4469 if (check_netmask(rs->rdr->host, r->af)) 4470 return (1); 4471 4472 rpool->proxy_port[0] = ntohs(rs->rdr->rport.a); 4473 4474 if (isrdr) { 4475 if (!rs->rdr->rport.b && rs->rdr->rport.t && np->port != NULL) { 4476 rpool->proxy_port[1] = ntohs(rs->rdr->rport.a) + 4477 (ntohs(np->port[1]) - ntohs(np->port[0])); 4478 } else 4479 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4480 } else { 4481 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4482 if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { 4483 rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW; 4484 rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH; 4485 } else if (!rpool->proxy_port[1]) 4486 rpool->proxy_port[1] = rpool->proxy_port[0]; 4487 } 4488 4489 rpool->opts = rs->pool_opts.type; 4490 if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_NONE && 4491 (rs->rdr->host->next != NULL || 4492 rs->rdr->host->addr.type == PF_ADDR_TABLE || 4493 DYNIF_MULTIADDR(rs->rdr->host->addr))) 4494 rpool->opts = PF_POOL_ROUNDROBIN; 4495 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN && 4496 disallow_table(rs->rdr->host, "tables are only supported in " 4497 "round-robin redirection pools")) 4498 return (1); 4499 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN && 4500 disallow_alias(rs->rdr->host, "interface (%s) is only supported in " 4501 "round-robin redirection pools")) 4502 return (1); 4503 if (rs->rdr->host->next != NULL) { 4504 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) { 4505 yyerror("only round-robin valid for multiple " 4506 "redirection addresses"); 4507 return (1); 4508 } 4509 } 4510 4511 if (rs->pool_opts.key != NULL) 4512 memcpy(&rpool->key, rs->pool_opts.key, 4513 sizeof(struct pf_poolhashkey)); 4514 4515 if (rs->pool_opts.opts) 4516 rpool->opts |= rs->pool_opts.opts; 4517 4518 if (rs->pool_opts.staticport) { 4519 if (isrdr) { 4520 yyerror("the 'static-port' option is only valid with " 4521 "nat rules"); 4522 return (1); 4523 } 4524 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 4525 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 4526 yyerror("the 'static-port' option can't be used when " 4527 "specifying a port range"); 4528 return (1); 4529 } 4530 rpool->proxy_port[0] = 0; 4531 rpool->proxy_port[1] = 0; 4532 } 4533 4534 TAILQ_INIT(&rpool->list); 4535 for (h = rs->rdr->host; h != NULL; h = h->next) { 4536 if ((pa = calloc(1, sizeof(struct pf_pooladdr))) == NULL) 4537 err(1, "apply_redirspec: calloc"); 4538 pa->addr = h->addr; 4539 if (h->ifname != NULL) { 4540 if (strlcpy(pa->ifname, h->ifname, sizeof pa->ifname) >= 4541 sizeof(pa->ifname)) 4542 errx(1, "apply_redirspec: strlcpy"); 4543 } else 4544 pa->ifname[0] = 0; 4545 TAILQ_INSERT_TAIL(&rpool->list, pa, entries); 4546 } 4547 4548 return (0); 4549} 4550 4551 4552void 4553expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces, 4554 struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute, 4555 struct node_proto *protos, struct node_os *src_oses, 4556 struct node_host *src_hosts, struct node_port *src_ports, 4557 struct node_host *dst_hosts, struct node_port *dst_ports, 4558 struct node_uid *uids, struct node_gid *gids, struct node_if *rcv, 4559 struct node_icmp *icmp_types, const char *anchor_call) 4560{ 4561 sa_family_t af = r->af; 4562 int added = 0, error = 0; 4563 char ifname[IF_NAMESIZE]; 4564 char label[PF_RULE_LABEL_SIZE]; 4565 char tagname[PF_TAG_NAME_SIZE]; 4566 char match_tagname[PF_TAG_NAME_SIZE]; 4567 u_int8_t flags, flagset, keep_state; 4568 struct node_host *srch, *dsth; 4569 struct redirspec binat; 4570 struct pf_rule rb; 4571 int dir = r->direction; 4572 4573 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4574 errx(1, "expand_rule: strlcpy"); 4575 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4576 errx(1, "expand_rule: strlcpy"); 4577 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4578 sizeof(match_tagname)) 4579 errx(1, "expand_rule: strlcpy"); 4580 flags = r->flags; 4581 flagset = r->flagset; 4582 keep_state = r->keep_state; 4583 4584 LOOP_THROUGH(struct node_if, interface, interfaces, 4585 LOOP_THROUGH(struct node_proto, proto, protos, 4586 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4587 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4588 LOOP_THROUGH(struct node_port, src_port, src_ports, 4589 LOOP_THROUGH(struct node_os, src_os, src_oses, 4590 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4591 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4592 LOOP_THROUGH(struct node_uid, uid, uids, 4593 LOOP_THROUGH(struct node_gid, gid, gids, 4594 4595 r->af = af; 4596 /* for link-local IPv6 address, interface must match up */ 4597 if ((r->af && src_host->af && r->af != src_host->af) || 4598 (r->af && dst_host->af && r->af != dst_host->af) || 4599 (src_host->af && dst_host->af && 4600 src_host->af != dst_host->af) || 4601 (src_host->ifindex && dst_host->ifindex && 4602 src_host->ifindex != dst_host->ifindex) || 4603 (src_host->ifindex && *interface->ifname && 4604 src_host->ifindex != if_nametoindex(interface->ifname)) || 4605 (dst_host->ifindex && *interface->ifname && 4606 dst_host->ifindex != if_nametoindex(interface->ifname))) 4607 continue; 4608 if (!r->af && src_host->af) 4609 r->af = src_host->af; 4610 else if (!r->af && dst_host->af) 4611 r->af = dst_host->af; 4612 4613 if (*interface->ifname) 4614 strlcpy(r->ifname, interface->ifname, 4615 sizeof(r->ifname)); 4616 else if (if_indextoname(src_host->ifindex, ifname)) 4617 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4618 else if (if_indextoname(dst_host->ifindex, ifname)) 4619 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4620 else 4621 memset(r->ifname, '\0', sizeof(r->ifname)); 4622 4623 if (strlcpy(r->label, label, sizeof(r->label)) >= 4624 sizeof(r->label)) 4625 errx(1, "expand_rule: strlcpy"); 4626 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4627 sizeof(r->tagname)) 4628 errx(1, "expand_rule: strlcpy"); 4629 if (strlcpy(r->match_tagname, match_tagname, 4630 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4631 errx(1, "expand_rule: strlcpy"); 4632 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4633 src_host, src_port, dst_host, dst_port, proto->proto); 4634 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4635 src_host, src_port, dst_host, dst_port, proto->proto); 4636 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4637 r->af, src_host, src_port, dst_host, dst_port, 4638 proto->proto); 4639 4640 error += check_netmask(src_host, r->af); 4641 error += check_netmask(dst_host, r->af); 4642 4643 r->ifnot = interface->not; 4644 r->proto = proto->proto; 4645 r->src.addr = src_host->addr; 4646 r->src.neg = src_host->not; 4647 r->src.port[0] = src_port->port[0]; 4648 r->src.port[1] = src_port->port[1]; 4649 r->src.port_op = src_port->op; 4650 r->dst.addr = dst_host->addr; 4651 r->dst.neg = dst_host->not; 4652 r->dst.port[0] = dst_port->port[0]; 4653 r->dst.port[1] = dst_port->port[1]; 4654 r->dst.port_op = dst_port->op; 4655 r->uid.op = uid->op; 4656 r->uid.uid[0] = uid->uid[0]; 4657 r->uid.uid[1] = uid->uid[1]; 4658 r->gid.op = gid->op; 4659 r->gid.gid[0] = gid->gid[0]; 4660 r->gid.gid[1] = gid->gid[1]; 4661 if (rcv) { 4662 strlcpy(r->rcv_ifname, rcv->ifname, 4663 sizeof(r->rcv_ifname)); 4664 } 4665 r->type = icmp_type->type; 4666 r->code = icmp_type->code; 4667 4668 if ((keep_state == PF_STATE_MODULATE || 4669 keep_state == PF_STATE_SYNPROXY) && 4670 r->proto && r->proto != IPPROTO_TCP) 4671 r->keep_state = PF_STATE_NORMAL; 4672 else 4673 r->keep_state = keep_state; 4674 4675 if (r->proto && r->proto != IPPROTO_TCP) { 4676 r->flags = 0; 4677 r->flagset = 0; 4678 } else { 4679 r->flags = flags; 4680 r->flagset = flagset; 4681 } 4682 if (icmp_type->proto && r->proto != icmp_type->proto) { 4683 yyerror("icmp-type mismatch"); 4684 error++; 4685 } 4686 4687 if (src_os && src_os->os) { 4688 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4689 if ((pf->opts & PF_OPT_VERBOSE2) && 4690 r->os_fingerprint == PF_OSFP_NOMATCH) 4691 fprintf(stderr, 4692 "warning: unknown '%s' OS fingerprint\n", 4693 src_os->os); 4694 } else { 4695 r->os_fingerprint = PF_OSFP_ANY; 4696 } 4697 4698 if (nat && nat->rdr && nat->binat) { 4699 if (disallow_table(src_host, "invalid use of table " 4700 "<%s> as the source address of a binat-to rule") || 4701 disallow_alias(src_host, "invalid use of interface " 4702 "(%s) as the source address of a binat-to rule")) { 4703 error++; 4704 } else if (src_host->af == AF_UNSPEC) { 4705 yyerror("binat-to requires a specified " 4706 "source and redirect address"); 4707 error++; 4708 } 4709 if (disallow_table(src_host, "invalid use of table " 4710 "<%s> as the redirect address of a " 4711 "binat-to rule") || 4712 disallow_alias(dst_host, "invalid use of interface " 4713 "(%s) as the redirect address of a " 4714 "binat-to rule") || 4715 disallow_urpf_failed(dst_host, "\"urpf-failed\" " 4716 "is not permitted as a binat-to destination")) { 4717 error++; 4718 } 4719 if (r->direction != PF_INOUT) { 4720 yyerror("binat-to cannot be specified " 4721 "with a direction"); 4722 error++; 4723 } 4724 4725 /* first specify outbound NAT rule */ 4726 r->direction = PF_OUT; 4727 } 4728 4729 error += apply_redirspec(&r->nat, r, nat, 0, dst_port); 4730 error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port); 4731 error += apply_redirspec(&r->route, r, rroute, 2, dst_port); 4732 4733 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4734 yyerror("skipping rule due to errors"); 4735 else { 4736 r->nr = pf->astack[pf->asd]->match++; 4737 pfctl_add_rule(pf, r, anchor_call); 4738 added++; 4739 } 4740 r->direction = dir; 4741 4742 /* Generate binat's matching inbound rule */ 4743 if (!error && nat && nat->rdr && nat->binat) { 4744 bcopy(r, &rb, sizeof(rb)); 4745 4746 /* now specify inbound rdr rule */ 4747 rb.direction = PF_IN; 4748 4749 if ((srch = calloc(1, sizeof(*srch))) == NULL) 4750 err(1, "expand_rule: calloc"); 4751 bcopy(src_host, srch, sizeof(*srch)); 4752 srch->ifname = NULL; 4753 srch->next = NULL; 4754 srch->tail = NULL; 4755 4756 if ((dsth = calloc(1, sizeof(*dsth))) == NULL) 4757 err(1, "expand_rule: calloc"); 4758 bcopy(nat->rdr->host, dsth, sizeof(*dsth)); 4759 dsth->ifname = NULL; 4760 dsth->next = NULL; 4761 dsth->tail = NULL; 4762 4763 if ((binat.rdr = 4764 calloc(1, sizeof(*binat.rdr))) == NULL) 4765 err(1, "expand_rule: calloc"); 4766 bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr)); 4767 bcopy(&nat->pool_opts, &binat.pool_opts, 4768 sizeof(binat.pool_opts)); 4769 binat.pool_opts.staticport = 0; 4770 binat.rdr->host = srch; 4771 4772 expand_rule(&rb, 1, interface, NULL, &binat, NULL, 4773 proto, 4774 src_os, dst_host, dst_port, dsth, src_port, 4775 uid, gid, rcv, icmp_type, anchor_call); 4776 } 4777 4778 )))))))))); 4779 4780 if (!keeprule) { 4781 FREE_LIST(struct node_if, interfaces); 4782 FREE_LIST(struct node_proto, protos); 4783 FREE_LIST(struct node_host, src_hosts); 4784 FREE_LIST(struct node_port, src_ports); 4785 FREE_LIST(struct node_os, src_oses); 4786 FREE_LIST(struct node_host, dst_hosts); 4787 FREE_LIST(struct node_port, dst_ports); 4788 FREE_LIST(struct node_uid, uids); 4789 FREE_LIST(struct node_gid, gids); 4790 FREE_LIST(struct node_icmp, icmp_types); 4791 if (nat && nat->rdr) 4792 FREE_LIST(struct node_host, nat->rdr->host); 4793 if (rdr && rdr->rdr) 4794 FREE_LIST(struct node_host, rdr->rdr->host); 4795 } 4796 4797 if (!added) 4798 yyerror("rule expands to no valid combination"); 4799} 4800 4801int 4802expand_skip_interface(struct node_if *interfaces) 4803{ 4804 int errs = 0; 4805 4806 if (!interfaces || (!interfaces->next && !interfaces->not && 4807 !strcmp(interfaces->ifname, "none"))) { 4808 if (pf->opts & PF_OPT_VERBOSE) 4809 printf("set skip on none\n"); 4810 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4811 return (errs); 4812 } 4813 4814 if (pf->opts & PF_OPT_VERBOSE) 4815 printf("set skip on {"); 4816 LOOP_THROUGH(struct node_if, interface, interfaces, 4817 if (pf->opts & PF_OPT_VERBOSE) 4818 printf(" %s", interface->ifname); 4819 if (interface->not) { 4820 yyerror("skip on ! <interface> is not supported"); 4821 errs++; 4822 } else 4823 errs += pfctl_set_interface_flags(pf, 4824 interface->ifname, PFI_IFLAG_SKIP, 1); 4825 ); 4826 if (pf->opts & PF_OPT_VERBOSE) 4827 printf(" }\n"); 4828 4829 FREE_LIST(struct node_if, interfaces); 4830 4831 if (errs) 4832 return (1); 4833 else 4834 return (0); 4835} 4836 4837#undef FREE_LIST 4838#undef LOOP_THROUGH 4839 4840int 4841check_rulestate(int desired_state) 4842{ 4843 if (require_order && (rulestate > desired_state)) { 4844 yyerror("Rules must be in order: options, normalization, " 4845 "queueing, translation, filtering"); 4846 return (1); 4847 } 4848 rulestate = desired_state; 4849 return (0); 4850} 4851 4852int 4853kw_cmp(const void *k, const void *e) 4854{ 4855 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4856} 4857 4858int 4859lookup(char *s) 4860{ 4861 /* this has to be sorted always */ 4862 static const struct keywords keywords[] = { 4863 { "all", ALL}, 4864 { "allow-opts", ALLOWOPTS}, 4865 { "altq", ALTQ}, 4866 { "anchor", ANCHOR}, 4867 { "antispoof", ANTISPOOF}, 4868 { "any", ANY}, 4869 { "bandwidth", BANDWIDTH}, 4870 { "binat-to", BINATTO}, 4871 { "bitmask", BITMASK}, 4872 { "block", BLOCK}, 4873 { "block-policy", BLOCKPOLICY}, 4874 { "cbq", CBQ}, 4875 { "code", CODE}, 4876 { "crop", FRAGCROP}, 4877 { "debug", DEBUG}, 4878 { "divert-packet", DIVERTPACKET}, 4879 { "divert-reply", DIVERTREPLY}, 4880 { "divert-to", DIVERTTO}, 4881 { "drop", DROP}, 4882 { "drop-ovl", FRAGDROP}, 4883 { "dup-to", DUPTO}, 4884 { "fastroute", FASTROUTE}, 4885 { "file", FILENAME}, 4886 { "fingerprints", FINGERPRINTS}, 4887 { "flags", FLAGS}, 4888 { "floating", FLOATING}, 4889 { "flush", FLUSH}, 4890 { "for", FOR}, 4891 { "fragment", FRAGMENT}, 4892 { "from", FROM}, 4893 { "global", GLOBAL}, 4894 { "group", GROUP}, 4895 { "hfsc", HFSC}, 4896 { "hostid", HOSTID}, 4897 { "icmp-type", ICMPTYPE}, 4898 { "icmp6-type", ICMP6TYPE}, 4899 { "if-bound", IFBOUND}, 4900 { "in", IN}, 4901 { "include", INCLUDE}, 4902 { "inet", INET}, 4903 { "inet6", INET6}, 4904 { "keep", KEEP}, 4905 { "label", LABEL}, 4906 { "limit", LIMIT}, 4907 { "linkshare", LINKSHARE}, 4908 { "load", LOAD}, 4909 { "log", LOG}, 4910 { "loginterface", LOGINTERFACE}, 4911 { "match", MATCH}, 4912 { "max", MAXIMUM}, 4913 { "max-mss", MAXMSS}, 4914 { "max-src-conn", MAXSRCCONN}, 4915 { "max-src-conn-rate", MAXSRCCONNRATE}, 4916 { "max-src-nodes", MAXSRCNODES}, 4917 { "max-src-states", MAXSRCSTATES}, 4918 { "min-ttl", MINTTL}, 4919 { "modulate", MODULATE}, 4920 { "nat", NAT}, 4921 { "nat-anchor", NATANCHOR}, 4922 { "nat-to", NATTO}, 4923 { "no", NO}, 4924 { "no-df", NODF}, 4925 { "no-route", NOROUTE}, 4926 { "no-sync", NOSYNC}, 4927 { "on", ON}, 4928 { "optimization", OPTIMIZATION}, 4929 { "os", OS}, 4930 { "out", OUT}, 4931 { "overload", OVERLOAD}, 4932 { "pass", PASS}, 4933 { "pflow", PFLOW}, 4934 { "port", PORT}, 4935 { "priority", PRIORITY}, 4936 { "priq", PRIQ}, 4937 { "probability", PROBABILITY}, 4938 { "proto", PROTO}, 4939 { "qlimit", QLIMIT}, 4940 { "queue", QUEUE}, 4941 { "quick", QUICK}, 4942 { "random", RANDOM}, 4943 { "random-id", RANDOMID}, 4944 { "rdr", RDR}, 4945 { "rdr-anchor", RDRANCHOR}, 4946 { "rdr-to", RDRTO}, 4947 { "realtime", REALTIME}, 4948 { "reassemble", REASSEMBLE}, 4949 { "received-on", RECEIVEDON}, 4950 { "reply-to", REPLYTO}, 4951 { "require-order", REQUIREORDER}, 4952 { "return", RETURN}, 4953 { "return-icmp", RETURNICMP}, 4954 { "return-icmp6", RETURNICMP6}, 4955 { "return-rst", RETURNRST}, 4956 { "round-robin", ROUNDROBIN}, 4957 { "route", ROUTE}, 4958 { "route-to", ROUTETO}, 4959 { "rtable", RTABLE}, 4960 { "rule", RULE}, 4961 { "ruleset-optimization", RULESET_OPTIMIZATION}, 4962 { "scrub", SCRUB}, 4963 { "set", SET}, 4964 { "set-tos", SETTOS}, 4965 { "skip", SKIP}, 4966 { "sloppy", SLOPPY}, 4967 { "source-hash", SOURCEHASH}, 4968 { "source-track", SOURCETRACK}, 4969 { "state", STATE}, 4970 { "state-defaults", STATEDEFAULTS}, 4971 { "state-policy", STATEPOLICY}, 4972 { "static-port", STATICPORT}, 4973 { "sticky-address", STICKYADDRESS}, 4974 { "synproxy", SYNPROXY}, 4975 { "table", TABLE}, 4976 { "tag", TAG}, 4977 { "tagged", TAGGED}, 4978 { "tbrsize", TBRSIZE}, 4979 { "timeout", TIMEOUT}, 4980 { "to", TO}, 4981 { "tos", TOS}, 4982 { "ttl", TTL}, 4983 { "upperlimit", UPPERLIMIT}, 4984 { "urpf-failed", URPFFAILED}, 4985 { "user", USER}, 4986 }; 4987 const struct keywords *p; 4988 4989 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4990 sizeof(keywords[0]), kw_cmp); 4991 4992 if (p) { 4993 if (debug > 1) 4994 fprintf(stderr, "%s: %d\n", s, p->k_val); 4995 return (p->k_val); 4996 } else { 4997 if (debug > 1) 4998 fprintf(stderr, "string: %s\n", s); 4999 return (STRING); 5000 } 5001} 5002 5003#define MAXPUSHBACK 128 5004 5005char *parsebuf; 5006int parseindex; 5007char pushback_buffer[MAXPUSHBACK]; 5008int pushback_index = 0; 5009 5010int 5011lgetc(int quotec) 5012{ 5013 int c, next; 5014 5015 if (parsebuf) { 5016 /* Read character from the parsebuffer instead of input. */ 5017 if (parseindex >= 0) { 5018 c = parsebuf[parseindex++]; 5019 if (c != '\0') 5020 return (c); 5021 parsebuf = NULL; 5022 } else 5023 parseindex++; 5024 } 5025 5026 if (pushback_index) 5027 return (pushback_buffer[--pushback_index]); 5028 5029 if (quotec) { 5030 if ((c = getc(file->stream)) == EOF) { 5031 yyerror("reached end of file while parsing quoted string"); 5032 if (popfile() == EOF) 5033 return (EOF); 5034 return (quotec); 5035 } 5036 return (c); 5037 } 5038 5039 while ((c = getc(file->stream)) == '\\') { 5040 next = getc(file->stream); 5041 if (next != '\n') { 5042 c = next; 5043 break; 5044 } 5045 yylval.lineno = file->lineno; 5046 file->lineno++; 5047 } 5048 5049 while (c == EOF) { 5050 if (popfile() == EOF) 5051 return (EOF); 5052 c = getc(file->stream); 5053 } 5054 return (c); 5055} 5056 5057int 5058lungetc(int c) 5059{ 5060 if (c == EOF) 5061 return (EOF); 5062 if (parsebuf) { 5063 parseindex--; 5064 if (parseindex >= 0) 5065 return (c); 5066 } 5067 if (pushback_index < MAXPUSHBACK-1) 5068 return (pushback_buffer[pushback_index++] = c); 5069 else 5070 return (EOF); 5071} 5072 5073int 5074findeol(void) 5075{ 5076 int c; 5077 5078 parsebuf = NULL; 5079 5080 /* skip to either EOF or the first real EOL */ 5081 while (1) { 5082 if (pushback_index) 5083 c = pushback_buffer[--pushback_index]; 5084 else 5085 c = lgetc(0); 5086 if (c == '\n') { 5087 file->lineno++; 5088 break; 5089 } 5090 if (c == EOF) 5091 break; 5092 } 5093 return (ERROR); 5094} 5095 5096int 5097yylex(void) 5098{ 5099 char buf[8096]; 5100 char *p, *val; 5101 int quotec, next, c; 5102 int token; 5103 5104top: 5105 p = buf; 5106 while ((c = lgetc(0)) == ' ' || c == '\t') 5107 ; /* nothing */ 5108 5109 yylval.lineno = file->lineno; 5110 if (c == '#') 5111 while ((c = lgetc(0)) != '\n' && c != EOF) 5112 ; /* nothing */ 5113 if (c == '$' && parsebuf == NULL) { 5114 while (1) { 5115 if ((c = lgetc(0)) == EOF) 5116 return (0); 5117 5118 if (p + 1 >= buf + sizeof(buf) - 1) { 5119 yyerror("string too long"); 5120 return (findeol()); 5121 } 5122 if (isalnum(c) || c == '_') { 5123 *p++ = (char)c; 5124 continue; 5125 } 5126 *p = '\0'; 5127 lungetc(c); 5128 break; 5129 } 5130 val = symget(buf); 5131 if (val == NULL) { 5132 yyerror("macro '%s' not defined", buf); 5133 return (findeol()); 5134 } 5135 parsebuf = val; 5136 parseindex = 0; 5137 goto top; 5138 } 5139 5140 switch (c) { 5141 case '\'': 5142 case '"': 5143 quotec = c; 5144 while (1) { 5145 if ((c = lgetc(quotec)) == EOF) 5146 return (0); 5147 if (c == '\n') { 5148 file->lineno++; 5149 continue; 5150 } else if (c == '\\') { 5151 if ((next = lgetc(quotec)) == EOF) 5152 return (0); 5153 if (next == quotec || c == ' ' || c == '\t') 5154 c = next; 5155 else if (next == '\n') 5156 continue; 5157 else 5158 lungetc(next); 5159 } else if (c == quotec) { 5160 *p = '\0'; 5161 break; 5162 } 5163 if (p + 1 >= buf + sizeof(buf) - 1) { 5164 yyerror("string too long"); 5165 return (findeol()); 5166 } 5167 *p++ = (char)c; 5168 } 5169 yylval.v.string = strdup(buf); 5170 if (yylval.v.string == NULL) 5171 err(1, "yylex: strdup"); 5172 return (STRING); 5173 case '<': 5174 next = lgetc(0); 5175 if (next == '>') { 5176 yylval.v.i = PF_OP_XRG; 5177 return (PORTBINARY); 5178 } 5179 lungetc(next); 5180 break; 5181 case '>': 5182 next = lgetc(0); 5183 if (next == '<') { 5184 yylval.v.i = PF_OP_IRG; 5185 return (PORTBINARY); 5186 } 5187 lungetc(next); 5188 break; 5189 } 5190 5191#define allowed_to_end_number(x) \ 5192 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5193 5194 if (c == '-' || isdigit(c)) { 5195 do { 5196 *p++ = c; 5197 if ((unsigned)(p-buf) >= sizeof(buf)) { 5198 yyerror("string too long"); 5199 return (findeol()); 5200 } 5201 } while ((c = lgetc(0)) != EOF && isdigit(c)); 5202 lungetc(c); 5203 if (p == buf + 1 && buf[0] == '-') 5204 goto nodigits; 5205 if (c == EOF || allowed_to_end_number(c)) { 5206 const char *errstr = NULL; 5207 5208 *p = '\0'; 5209 yylval.v.number = strtonum(buf, LLONG_MIN, 5210 LLONG_MAX, &errstr); 5211 if (errstr) { 5212 yyerror("\"%s\" invalid number: %s", 5213 buf, errstr); 5214 return (findeol()); 5215 } 5216 return (NUMBER); 5217 } else { 5218nodigits: 5219 while (p > buf + 1) 5220 lungetc(*--p); 5221 c = *--p; 5222 if (c == '-') 5223 return (c); 5224 } 5225 } 5226 5227#define allowed_in_string(x) \ 5228 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5229 x != '{' && x != '}' && x != '<' && x != '>' && \ 5230 x != '!' && x != '=' && x != '/' && x != '#' && \ 5231 x != ',')) 5232 5233 if (isalnum(c) || c == ':' || c == '_') { 5234 do { 5235 *p++ = c; 5236 if ((unsigned)(p-buf) >= sizeof(buf)) { 5237 yyerror("string too long"); 5238 return (findeol()); 5239 } 5240 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 5241 lungetc(c); 5242 *p = '\0'; 5243 if ((token = lookup(buf)) == STRING) 5244 if ((yylval.v.string = strdup(buf)) == NULL) 5245 err(1, "yylex: strdup"); 5246 return (token); 5247 } 5248 if (c == '\n') { 5249 yylval.lineno = file->lineno; 5250 file->lineno++; 5251 } 5252 if (c == EOF) 5253 return (0); 5254 return (c); 5255} 5256 5257int 5258check_file_secrecy(int fd, const char *fname) 5259{ 5260 struct stat st; 5261 5262 if (fstat(fd, &st)) { 5263 warn("cannot stat %s", fname); 5264 return (-1); 5265 } 5266 if (st.st_uid != 0 && st.st_uid != getuid()) { 5267 warnx("%s: owner not root or current user", fname); 5268 return (-1); 5269 } 5270 if (st.st_mode & (S_IRWXG | S_IRWXO)) { 5271 warnx("%s: group/world readable/writeable", fname); 5272 return (-1); 5273 } 5274 return (0); 5275} 5276 5277struct file * 5278pushfile(const char *name, int secret) 5279{ 5280 struct file *nfile; 5281 5282 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 5283 (nfile->name = strdup(name)) == NULL) { 5284 if (nfile) 5285 free(nfile); 5286 warn("malloc"); 5287 return (NULL); 5288 } 5289 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 5290 nfile->stream = stdin; 5291 free(nfile->name); 5292 if ((nfile->name = strdup("stdin")) == NULL) { 5293 warn("strdup"); 5294 free(nfile); 5295 return (NULL); 5296 } 5297 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 5298 warn("%s", nfile->name); 5299 free(nfile->name); 5300 free(nfile); 5301 return (NULL); 5302 } else if (secret && 5303 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 5304 fclose(nfile->stream); 5305 free(nfile->name); 5306 free(nfile); 5307 return (NULL); 5308 } 5309 nfile->lineno = 1; 5310 TAILQ_INSERT_TAIL(&files, nfile, entry); 5311 return (nfile); 5312} 5313 5314int 5315popfile(void) 5316{ 5317 struct file *prev; 5318 5319 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 5320 prev->errors += file->errors; 5321 TAILQ_REMOVE(&files, file, entry); 5322 fclose(file->stream); 5323 free(file->name); 5324 free(file); 5325 file = prev; 5326 return (0); 5327 } 5328 return (EOF); 5329} 5330 5331int 5332parse_config(char *filename, struct pfctl *xpf) 5333{ 5334 int errors = 0; 5335 struct sym *sym; 5336 5337 pf = xpf; 5338 errors = 0; 5339 rulestate = PFCTL_STATE_NONE; 5340 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5341 returnicmp6default = 5342 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5343 blockpolicy = PFRULE_DROP; 5344 require_order = 0; 5345 5346 if ((file = pushfile(filename, 0)) == NULL) { 5347 warn("cannot open the main config file!"); 5348 return (-1); 5349 } 5350 5351 yyparse(); 5352 errors = file->errors; 5353 popfile(); 5354 5355 /* Free macros and check which have not been used. */ 5356 while ((sym = TAILQ_FIRST(&symhead))) { 5357 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5358 fprintf(stderr, "warning: macro '%s' not " 5359 "used\n", sym->nam); 5360 free(sym->nam); 5361 free(sym->val); 5362 TAILQ_REMOVE(&symhead, sym, entry); 5363 free(sym); 5364 } 5365 5366 return (errors ? -1 : 0); 5367} 5368 5369int 5370symset(const char *nam, const char *val, int persist) 5371{ 5372 struct sym *sym; 5373 5374 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5375 sym = TAILQ_NEXT(sym, entry)) 5376 ; /* nothing */ 5377 5378 if (sym != NULL) { 5379 if (sym->persist == 1) 5380 return (0); 5381 else { 5382 free(sym->nam); 5383 free(sym->val); 5384 TAILQ_REMOVE(&symhead, sym, entry); 5385 free(sym); 5386 } 5387 } 5388 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5389 return (-1); 5390 5391 sym->nam = strdup(nam); 5392 if (sym->nam == NULL) { 5393 free(sym); 5394 return (-1); 5395 } 5396 sym->val = strdup(val); 5397 if (sym->val == NULL) { 5398 free(sym->nam); 5399 free(sym); 5400 return (-1); 5401 } 5402 sym->used = 0; 5403 sym->persist = persist; 5404 TAILQ_INSERT_TAIL(&symhead, sym, entry); 5405 return (0); 5406} 5407 5408int 5409pfctl_cmdline_symset(char *s) 5410{ 5411 char *sym, *val; 5412 int ret; 5413 5414 if ((val = strrchr(s, '=')) == NULL) 5415 return (-1); 5416 5417 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5418 err(1, "pfctl_cmdline_symset: malloc"); 5419 5420 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5421 5422 ret = symset(sym, val + 1, 1); 5423 free(sym); 5424 5425 return (ret); 5426} 5427 5428char * 5429symget(const char *nam) 5430{ 5431 struct sym *sym; 5432 5433 TAILQ_FOREACH(sym, &symhead, entry) 5434 if (strcmp(nam, sym->nam) == 0) { 5435 sym->used = 1; 5436 return (sym->val); 5437 } 5438 return (NULL); 5439} 5440 5441void 5442mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5443{ 5444 struct pf_rule *r; 5445 5446 while ((r = TAILQ_FIRST(src->rules.active.ptr)) != NULL) { 5447 TAILQ_REMOVE(src->rules.active.ptr, r, entries); 5448 TAILQ_INSERT_TAIL(dst->rules.active.ptr, r, entries); 5449 dst->anchor->match++; 5450 } 5451 src->anchor->match = 0; 5452 while ((r = TAILQ_FIRST(src->rules.inactive.ptr)) != NULL) { 5453 TAILQ_REMOVE(src->rules.inactive.ptr, r, entries); 5454 TAILQ_INSERT_TAIL(dst->rules.inactive.ptr, r, entries); 5455 } 5456} 5457 5458void 5459decide_address_family(struct node_host *n, sa_family_t *af) 5460{ 5461 if (*af != 0 || n == NULL) 5462 return; 5463 *af = n->af; 5464 while ((n = n->next) != NULL) { 5465 if (n->af != *af) { 5466 *af = 0; 5467 return; 5468 } 5469 } 5470} 5471 5472void 5473remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5474{ 5475 struct node_host *n = *nh, *prev = NULL; 5476 5477 while (n != NULL) { 5478 if (*af && n->af && n->af != *af) { 5479 /* unlink and free n */ 5480 struct node_host *next = n->next; 5481 5482 /* adjust tail pointer */ 5483 if (n == (*nh)->tail) 5484 (*nh)->tail = prev; 5485 /* adjust previous node's next pointer */ 5486 if (prev == NULL) 5487 *nh = next; 5488 else 5489 prev->next = next; 5490 /* free node */ 5491 if (n->ifname != NULL) 5492 free(n->ifname); 5493 free(n); 5494 n = next; 5495 } else { 5496 if (n->af && !*af) 5497 *af = n->af; 5498 prev = n; 5499 n = n->next; 5500 } 5501 } 5502} 5503 5504int 5505invalid_redirect(struct node_host *nh, sa_family_t af) 5506{ 5507 if (!af) { 5508 struct node_host *n; 5509 5510 /* tables and dyniftl are ok without an address family */ 5511 for (n = nh; n != NULL; n = n->next) { 5512 if (n->addr.type != PF_ADDR_TABLE && 5513 n->addr.type != PF_ADDR_DYNIFTL) { 5514 yyerror("address family not given and " 5515 "translation address expands to multiple " 5516 "address families"); 5517 return (1); 5518 } 5519 } 5520 } 5521 if (nh == NULL) { 5522 yyerror("no translation address with matching address family " 5523 "found."); 5524 return (1); 5525 } 5526 return (0); 5527} 5528 5529int 5530atoul(char *s, u_long *ulvalp) 5531{ 5532 u_long ulval; 5533 char *ep; 5534 5535 errno = 0; 5536 ulval = strtoul(s, &ep, 0); 5537 if (s[0] == '\0' || *ep != '\0') 5538 return (-1); 5539 if (errno == ERANGE && ulval == ULONG_MAX) 5540 return (-1); 5541 *ulvalp = ulval; 5542 return (0); 5543} 5544 5545int 5546getservice(char *n) 5547{ 5548 struct servent *s; 5549 u_long ulval; 5550 5551 if (atoul(n, &ulval) == 0) { 5552 if (ulval > 65535) { 5553 yyerror("illegal port value %lu", ulval); 5554 return (-1); 5555 } 5556 return (htons(ulval)); 5557 } else { 5558 s = getservbyname(n, "tcp"); 5559 if (s == NULL) 5560 s = getservbyname(n, "udp"); 5561 if (s == NULL) { 5562 yyerror("unknown port %s", n); 5563 return (-1); 5564 } 5565 return (s->s_port); 5566 } 5567} 5568 5569int 5570rule_label(struct pf_rule *r, char *s) 5571{ 5572 if (s) { 5573 if (strlcpy(r->label, s, sizeof(r->label)) >= 5574 sizeof(r->label)) { 5575 yyerror("rule label too long (max %d chars)", 5576 sizeof(r->label)-1); 5577 return (-1); 5578 } 5579 } 5580 return (0); 5581} 5582 5583u_int16_t 5584parseicmpspec(char *w, sa_family_t af) 5585{ 5586 const struct icmpcodeent *p; 5587 u_long ulval; 5588 u_int8_t icmptype; 5589 5590 if (af == AF_INET) 5591 icmptype = returnicmpdefault >> 8; 5592 else 5593 icmptype = returnicmp6default >> 8; 5594 5595 if (atoul(w, &ulval) == -1) { 5596 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5597 yyerror("unknown icmp code %s", w); 5598 return (0); 5599 } 5600 ulval = p->code; 5601 } 5602 if (ulval > 255) { 5603 yyerror("invalid icmp code %lu", ulval); 5604 return (0); 5605 } 5606 return (icmptype << 8 | ulval); 5607} 5608 5609int 5610parseport(char *port, struct range *r, int extensions) 5611{ 5612 char *p = strchr(port, ':'); 5613 5614 if (p == NULL) { 5615 if ((r->a = getservice(port)) == -1) 5616 return (-1); 5617 r->b = 0; 5618 r->t = PF_OP_NONE; 5619 return (0); 5620 } 5621 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 5622 *p = 0; 5623 if ((r->a = getservice(port)) == -1) 5624 return (-1); 5625 r->b = 0; 5626 r->t = PF_OP_IRG; 5627 return (0); 5628 } 5629 if ((extensions & PPORT_RANGE)) { 5630 *p++ = 0; 5631 if ((r->a = getservice(port)) == -1 || 5632 (r->b = getservice(p)) == -1) 5633 return (-1); 5634 if (r->a == r->b) { 5635 r->b = 0; 5636 r->t = PF_OP_NONE; 5637 } else 5638 r->t = PF_OP_RRG; 5639 return (0); 5640 } 5641 return (-1); 5642} 5643 5644int 5645pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5646{ 5647 struct loadanchors *la; 5648 5649 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5650 if (pf->opts & PF_OPT_VERBOSE) 5651 fprintf(stderr, "\nLoading anchor %s from %s\n", 5652 la->anchorname, la->filename); 5653 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 5654 la->anchorname, trans) == -1) 5655 return (-1); 5656 } 5657 5658 return (0); 5659} 5660 5661int 5662kw_casecmp(const void *k, const void *e) 5663{ 5664 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 5665} 5666 5667int 5668map_tos(char *s, int *val) 5669{ 5670 /* DiffServ Codepoints and other TOS mappings */ 5671 const struct keywords toswords[] = { 5672 { "af11", IPTOS_DSCP_AF11 }, 5673 { "af12", IPTOS_DSCP_AF12 }, 5674 { "af13", IPTOS_DSCP_AF13 }, 5675 { "af21", IPTOS_DSCP_AF21 }, 5676 { "af22", IPTOS_DSCP_AF22 }, 5677 { "af23", IPTOS_DSCP_AF23 }, 5678 { "af31", IPTOS_DSCP_AF31 }, 5679 { "af32", IPTOS_DSCP_AF32 }, 5680 { "af33", IPTOS_DSCP_AF33 }, 5681 { "af41", IPTOS_DSCP_AF41 }, 5682 { "af42", IPTOS_DSCP_AF42 }, 5683 { "af43", IPTOS_DSCP_AF43 }, 5684 { "critical", IPTOS_PREC_CRITIC_ECP }, 5685 { "cs0", IPTOS_DSCP_CS0 }, 5686 { "cs1", IPTOS_DSCP_CS1 }, 5687 { "cs2", IPTOS_DSCP_CS2 }, 5688 { "cs3", IPTOS_DSCP_CS3 }, 5689 { "cs4", IPTOS_DSCP_CS4 }, 5690 { "cs5", IPTOS_DSCP_CS5 }, 5691 { "cs6", IPTOS_DSCP_CS6 }, 5692 { "cs7", IPTOS_DSCP_CS7 }, 5693 { "ef", IPTOS_DSCP_EF }, 5694 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 5695 { "lowdelay", IPTOS_LOWDELAY }, 5696 { "netcontrol", IPTOS_PREC_NETCONTROL }, 5697 { "reliability", IPTOS_RELIABILITY }, 5698 { "throughput", IPTOS_THROUGHPUT } 5699 }; 5700 const struct keywords *p; 5701 5702 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 5703 sizeof(toswords[0]), kw_casecmp); 5704 5705 if (p) { 5706 *val = p->k_val; 5707 return (1); 5708 } 5709 return (0); 5710} 5711