parse.y revision 1.596
1/* $OpenBSD: parse.y,v 1.596 2010/12/15 13:54:50 henning Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/types.h> 31#include <sys/socket.h> 32#include <sys/stat.h> 33#include <net/if.h> 34#include <netinet/in.h> 35#include <netinet/in_systm.h> 36#include <netinet/ip.h> 37#include <netinet/ip_icmp.h> 38#include <netinet/icmp6.h> 39#include <net/pfvar.h> 40#include <arpa/inet.h> 41#include <altq/altq.h> 42#include <altq/altq_cbq.h> 43#include <altq/altq_priq.h> 44#include <altq/altq_hfsc.h> 45 46#include <stdio.h> 47#include <unistd.h> 48#include <stdlib.h> 49#include <netdb.h> 50#include <stdarg.h> 51#include <errno.h> 52#include <string.h> 53#include <ctype.h> 54#include <math.h> 55#include <err.h> 56#include <limits.h> 57#include <pwd.h> 58#include <grp.h> 59#include <md5.h> 60 61#include "pfctl_parser.h" 62#include "pfctl.h" 63 64static struct pfctl *pf = NULL; 65static int debug = 0; 66static int rulestate = 0; 67static u_int16_t returnicmpdefault = 68 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 69static u_int16_t returnicmp6default = 70 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 71static int blockpolicy = PFRULE_DROP; 72static int require_order = 0; 73static int default_statelock; 74 75TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 76static struct file { 77 TAILQ_ENTRY(file) entry; 78 FILE *stream; 79 char *name; 80 int lineno; 81 int errors; 82} *file; 83struct file *pushfile(const char *, int); 84int popfile(void); 85int check_file_secrecy(int, const char *); 86int yyparse(void); 87int yylex(void); 88int yyerror(const char *, ...); 89int kw_cmp(const void *, const void *); 90int lookup(char *); 91int lgetc(int); 92int lungetc(int); 93int findeol(void); 94 95TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 96struct sym { 97 TAILQ_ENTRY(sym) entry; 98 int used; 99 int persist; 100 char *nam; 101 char *val; 102}; 103int symset(const char *, const char *, int); 104char *symget(const char *); 105 106int atoul(char *, u_long *); 107 108enum { 109 PFCTL_STATE_NONE, 110 PFCTL_STATE_OPTION, 111 PFCTL_STATE_QUEUE, 112 PFCTL_STATE_NAT, 113 PFCTL_STATE_FILTER 114}; 115 116struct node_proto { 117 u_int8_t proto; 118 struct node_proto *next; 119 struct node_proto *tail; 120}; 121 122struct node_port { 123 u_int16_t port[2]; 124 u_int8_t op; 125 struct node_port *next; 126 struct node_port *tail; 127}; 128 129struct node_uid { 130 uid_t uid[2]; 131 u_int8_t op; 132 struct node_uid *next; 133 struct node_uid *tail; 134}; 135 136struct node_gid { 137 gid_t gid[2]; 138 u_int8_t op; 139 struct node_gid *next; 140 struct node_gid *tail; 141}; 142 143struct node_icmp { 144 u_int8_t code; 145 u_int8_t type; 146 u_int8_t proto; 147 struct node_icmp *next; 148 struct node_icmp *tail; 149}; 150 151enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 152 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 153 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 154 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 155 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, 156 PF_STATE_OPT_PFLOW }; 157 158enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 159 160struct node_state_opt { 161 int type; 162 union { 163 u_int32_t max_states; 164 u_int32_t max_src_states; 165 u_int32_t max_src_conn; 166 struct { 167 u_int32_t limit; 168 u_int32_t seconds; 169 } max_src_conn_rate; 170 struct { 171 u_int8_t flush; 172 char tblname[PF_TABLE_NAME_SIZE]; 173 } overload; 174 u_int32_t max_src_nodes; 175 u_int8_t src_track; 176 u_int32_t statelock; 177 struct { 178 int number; 179 u_int32_t seconds; 180 } timeout; 181 } data; 182 struct node_state_opt *next; 183 struct node_state_opt *tail; 184}; 185 186struct peer { 187 struct node_host *host; 188 struct node_port *port; 189}; 190 191struct node_queue { 192 char queue[PF_QNAME_SIZE]; 193 char parent[PF_QNAME_SIZE]; 194 char ifname[IFNAMSIZ]; 195 int scheduler; 196 struct node_queue *next; 197 struct node_queue *tail; 198} *queues = NULL; 199 200struct node_qassign { 201 char *qname; 202 char *pqname; 203}; 204 205struct range { 206 int a; 207 int b; 208 int t; 209}; 210struct redirection { 211 struct node_host *host; 212 struct range rport; 213}; 214 215struct pool_opts { 216 int marker; 217#define POM_TYPE 0x01 218#define POM_STICKYADDRESS 0x02 219 u_int8_t opts; 220 int type; 221 int staticport; 222 struct pf_poolhashkey *key; 223 224} pool_opts; 225 226struct redirspec { 227 struct redirection *rdr; 228 struct pool_opts pool_opts; 229 int binat; 230}; 231 232struct filter_opts { 233 int marker; 234#define FOM_FLAGS 0x0001 235#define FOM_ICMP 0x0002 236#define FOM_TOS 0x0004 237#define FOM_KEEP 0x0008 238#define FOM_SRCTRACK 0x0010 239#define FOM_MINTTL 0x0020 240#define FOM_MAXMSS 0x0040 241#define FOM_SETTOS 0x0100 242#define FOM_SCRUB_TCP 0x0200 243 struct node_uid *uid; 244 struct node_gid *gid; 245 struct node_if *rcv; 246 struct { 247 u_int8_t b1; 248 u_int8_t b2; 249 u_int16_t w; 250 u_int16_t w2; 251 } flags; 252 struct node_icmp *icmpspec; 253 u_int32_t tos; 254 u_int32_t prob; 255 struct { 256 int action; 257 struct node_state_opt *options; 258 } keep; 259 int fragment; 260 int allowopts; 261 char *label; 262 struct node_qassign queues; 263 char *tag; 264 char *match_tag; 265 u_int8_t match_tag_not; 266 u_int rtableid; 267 struct { 268 struct node_host *addr; 269 u_int16_t port; 270 } divert, divert_packet; 271 struct redirspec nat; 272 struct redirspec rdr; 273 struct redirspec rroute; 274 275 /* scrub opts */ 276 int nodf; 277 int minttl; 278 int settos; 279 int randomid; 280 int max_mss; 281 282 /* route opts */ 283 struct { 284 struct node_host *host; 285 u_int8_t rt; 286 u_int8_t pool_opts; 287 sa_family_t af; 288 struct pf_poolhashkey *key; 289 } route; 290} filter_opts; 291 292struct antispoof_opts { 293 char *label; 294 u_int rtableid; 295} antispoof_opts; 296 297struct scrub_opts { 298 int marker; 299 int nodf; 300 int minttl; 301 int maxmss; 302 int settos; 303 int randomid; 304 int reassemble_tcp; 305} scrub_opts; 306 307struct queue_opts { 308 int marker; 309#define QOM_BWSPEC 0x01 310#define QOM_SCHEDULER 0x02 311#define QOM_PRIORITY 0x04 312#define QOM_TBRSIZE 0x08 313#define QOM_QLIMIT 0x10 314 struct node_queue_bw queue_bwspec; 315 struct node_queue_opt scheduler; 316 int priority; 317 int tbrsize; 318 int qlimit; 319} queue_opts; 320 321struct table_opts { 322 int flags; 323 int init_addr; 324 struct node_tinithead init_nodes; 325} table_opts; 326 327struct node_hfsc_opts hfsc_opts; 328struct node_state_opt *keep_state_defaults = NULL; 329 330int disallow_table(struct node_host *, const char *); 331int disallow_urpf_failed(struct node_host *, const char *); 332int disallow_alias(struct node_host *, const char *); 333int rule_consistent(struct pf_rule *, int); 334int process_tabledef(char *, struct table_opts *); 335void expand_label_str(char *, size_t, const char *, const char *); 336void expand_label_if(const char *, char *, size_t, const char *); 337void expand_label_addr(const char *, char *, size_t, u_int8_t, 338 struct node_host *); 339void expand_label_port(const char *, char *, size_t, 340 struct node_port *); 341void expand_label_proto(const char *, char *, size_t, u_int8_t); 342void expand_label_nr(const char *, char *, size_t); 343void expand_label(char *, size_t, const char *, u_int8_t, 344 struct node_host *, struct node_port *, struct node_host *, 345 struct node_port *, u_int8_t); 346int collapse_redirspec(struct pf_pool *, struct pf_rule *, 347 struct redirspec *rs, u_int8_t); 348int apply_redirspec(struct pf_pool *, struct pf_rule *, 349 struct redirspec *, int, struct node_port *); 350void expand_rule(struct pf_rule *, int, struct node_if *, 351 struct redirspec *, struct redirspec *, struct redirspec *, 352 struct node_proto *, 353 struct node_os *, struct node_host *, struct node_port *, 354 struct node_host *, struct node_port *, struct node_uid *, 355 struct node_gid *, struct node_if *, struct node_icmp *, 356 const char *); 357int expand_altq(struct pf_altq *, struct node_if *, 358 struct node_queue *, struct node_queue_bw bwspec, 359 struct node_queue_opt *); 360int expand_queue(struct pf_altq *, struct node_if *, 361 struct node_queue *, struct node_queue_bw, 362 struct node_queue_opt *); 363int expand_skip_interface(struct node_if *); 364 365int check_rulestate(int); 366int getservice(char *); 367int rule_label(struct pf_rule *, char *); 368 369void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 370void decide_address_family(struct node_host *, sa_family_t *); 371int invalid_redirect(struct node_host *, sa_family_t); 372u_int16_t parseicmpspec(char *, sa_family_t); 373int kw_casecmp(const void *, const void *); 374int map_tos(char *string, int *); 375 376TAILQ_HEAD(loadanchorshead, loadanchors) 377 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 378 379struct loadanchors { 380 TAILQ_ENTRY(loadanchors) entries; 381 char *anchorname; 382 char *filename; 383}; 384 385typedef struct { 386 union { 387 int64_t number; 388 double probability; 389 int i; 390 char *string; 391 u_int rtableid; 392 struct { 393 u_int8_t b1; 394 u_int8_t b2; 395 u_int16_t w; 396 u_int16_t w2; 397 } b; 398 struct range range; 399 struct node_if *interface; 400 struct node_proto *proto; 401 struct node_icmp *icmp; 402 struct node_host *host; 403 struct node_os *os; 404 struct node_port *port; 405 struct node_uid *uid; 406 struct node_gid *gid; 407 struct node_state_opt *state_opt; 408 struct peer peer; 409 struct { 410 struct peer src, dst; 411 struct node_os *src_os; 412 } fromto; 413 struct redirection *redirection; 414 struct { 415 int action; 416 struct node_state_opt *options; 417 } keep_state; 418 struct { 419 u_int8_t log; 420 u_int8_t logif; 421 u_int8_t quick; 422 } logquick; 423 struct { 424 int neg; 425 char *name; 426 } tagged; 427 struct pf_poolhashkey *hashkey; 428 struct node_queue *queue; 429 struct node_queue_opt queue_options; 430 struct node_queue_bw queue_bwspec; 431 struct node_qassign qassign; 432 struct filter_opts filter_opts; 433 struct antispoof_opts antispoof_opts; 434 struct queue_opts queue_opts; 435 struct scrub_opts scrub_opts; 436 struct table_opts table_opts; 437 struct pool_opts pool_opts; 438 struct node_hfsc_opts hfsc_opts; 439 } v; 440 int lineno; 441} YYSTYPE; 442 443#define PPORT_RANGE 1 444#define PPORT_STAR 2 445int parseport(char *, struct range *r, int); 446 447#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 448 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 449 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 450 451%} 452 453%token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 454%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 455%token ICMP6TYPE CODE KEEP MODULATE STATE PORT BINATTO NODF 456%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 457%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 458%token REASSEMBLE ANCHOR 459%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 460%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 461%token ANTISPOOF FOR INCLUDE MATCHES 462%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 463%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 464%token QUEUE PRIORITY QLIMIT RTABLE 465%token LOAD RULESET_OPTIMIZATION 466%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 467%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW 468%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 469%token DIVERTTO DIVERTREPLY DIVERTPACKET NATTO RDRTO RECEIVEDON NE LE GE 470%token <v.string> STRING 471%token <v.number> NUMBER 472%token <v.i> PORTBINARY 473%type <v.interface> interface if_list if_item_not if_item 474%type <v.number> number icmptype icmp6type uid gid 475%type <v.number> tos not yesno optnodf 476%type <v.probability> probability 477%type <v.i> dir af optimizer 478%type <v.i> sourcetrack flush unaryop statelock 479%type <v.b> action 480%type <v.b> flags flag blockspec 481%type <v.range> portplain portstar portrange 482%type <v.hashkey> hashkey 483%type <v.proto> proto proto_list proto_item 484%type <v.number> protoval 485%type <v.icmp> icmpspec 486%type <v.icmp> icmp_list icmp_item 487%type <v.icmp> icmp6_list icmp6_item 488%type <v.number> reticmpspec reticmp6spec 489%type <v.fromto> fromto 490%type <v.peer> ipportspec from to 491%type <v.host> ipspec xhost host dynaddr host_list 492%type <v.host> redir_host_list redirspec 493%type <v.host> route_host route_host_list routespec 494%type <v.os> os xos os_list 495%type <v.port> portspec port_list port_item 496%type <v.uid> uids uid_list uid_item 497%type <v.gid> gids gid_list gid_item 498%type <v.redirection> redirpool 499%type <v.string> label stringall anchorname 500%type <v.string> string varstring numberstring 501%type <v.keep_state> keep 502%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 503%type <v.logquick> logquick quick log logopts logopt 504%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 505%type <v.qassign> qname 506%type <v.queue> qassign qassign_list qassign_item 507%type <v.queue_options> scheduler 508%type <v.number> cbqflags_list cbqflags_item 509%type <v.number> priqflags_list priqflags_item 510%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 511%type <v.queue_bwspec> bandwidth 512%type <v.filter_opts> filter_opts filter_opt filter_opts_l 513%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 514%type <v.queue_opts> queue_opts queue_opt queue_opts_l 515%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 516%type <v.table_opts> table_opts table_opt table_opts_l 517%type <v.pool_opts> pool_opts pool_opt pool_opts_l 518%% 519 520ruleset : /* empty */ 521 | ruleset include '\n' 522 | ruleset '\n' 523 | ruleset option '\n' 524 | ruleset pfrule '\n' 525 | ruleset anchorrule '\n' 526 | ruleset loadrule '\n' 527 | ruleset altqif '\n' 528 | ruleset queuespec '\n' 529 | ruleset varset '\n' 530 | ruleset antispoof '\n' 531 | ruleset tabledef '\n' 532 | '{' fakeanchor '}' '\n'; 533 | ruleset error '\n' { file->errors++; } 534 ; 535 536include : INCLUDE STRING { 537 struct file *nfile; 538 539 if ((nfile = pushfile($2, 0)) == NULL) { 540 yyerror("failed to include file %s", $2); 541 free($2); 542 YYERROR; 543 } 544 free($2); 545 546 file = nfile; 547 lungetc('\n'); 548 } 549 ; 550 551/* 552 * apply to previously specified rule: must be careful to note 553 * what that is: pf or nat or binat or rdr 554 */ 555fakeanchor : fakeanchor '\n' 556 | fakeanchor anchorrule '\n' 557 | fakeanchor pfrule '\n' 558 | fakeanchor error '\n' 559 ; 560 561optimizer : string { 562 if (!strcmp($1, "none")) 563 $$ = 0; 564 else if (!strcmp($1, "basic")) 565 $$ = PF_OPTIMIZE_BASIC; 566 else if (!strcmp($1, "profile")) 567 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 568 else { 569 yyerror("unknown ruleset-optimization %s", $1); 570 YYERROR; 571 } 572 } 573 ; 574 575optnodf : /* empty */ { $$ = 0; } 576 | NODF { $$ = 1; } 577 ; 578 579option : SET REASSEMBLE yesno optnodf { 580 if (check_rulestate(PFCTL_STATE_OPTION)) 581 YYERROR; 582 pfctl_set_reassembly(pf, $3, $4); 583 } 584 | SET OPTIMIZATION STRING { 585 if (check_rulestate(PFCTL_STATE_OPTION)) { 586 free($3); 587 YYERROR; 588 } 589 if (pfctl_set_optimization(pf, $3) != 0) { 590 yyerror("unknown optimization %s", $3); 591 free($3); 592 YYERROR; 593 } 594 free($3); 595 } 596 | SET RULESET_OPTIMIZATION optimizer { 597 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 598 pf->opts |= PF_OPT_OPTIMIZE; 599 pf->optimize = $3; 600 } 601 } 602 | SET TIMEOUT timeout_spec 603 | SET TIMEOUT '{' optnl timeout_list '}' 604 | SET LIMIT limit_spec 605 | SET LIMIT '{' optnl limit_list '}' 606 | SET LOGINTERFACE stringall { 607 if (check_rulestate(PFCTL_STATE_OPTION)) { 608 free($3); 609 YYERROR; 610 } 611 if (pfctl_set_logif(pf, $3) != 0) { 612 yyerror("error setting loginterface %s", $3); 613 free($3); 614 YYERROR; 615 } 616 free($3); 617 } 618 | SET HOSTID number { 619 if ($3 == 0 || $3 > UINT_MAX) { 620 yyerror("hostid must be non-zero"); 621 YYERROR; 622 } 623 if (pfctl_set_hostid(pf, $3) != 0) { 624 yyerror("error setting hostid %08x", $3); 625 YYERROR; 626 } 627 } 628 | SET BLOCKPOLICY DROP { 629 if (pf->opts & PF_OPT_VERBOSE) 630 printf("set block-policy drop\n"); 631 if (check_rulestate(PFCTL_STATE_OPTION)) 632 YYERROR; 633 blockpolicy = PFRULE_DROP; 634 } 635 | SET BLOCKPOLICY RETURN { 636 if (pf->opts & PF_OPT_VERBOSE) 637 printf("set block-policy return\n"); 638 if (check_rulestate(PFCTL_STATE_OPTION)) 639 YYERROR; 640 blockpolicy = PFRULE_RETURN; 641 } 642 | SET REQUIREORDER yesno { 643 if (pf->opts & PF_OPT_VERBOSE) 644 printf("set require-order %s\n", 645 $3 == 1 ? "yes" : "no"); 646 require_order = $3; 647 } 648 | SET FINGERPRINTS STRING { 649 if (pf->opts & PF_OPT_VERBOSE) 650 printf("set fingerprints \"%s\"\n", $3); 651 if (check_rulestate(PFCTL_STATE_OPTION)) { 652 free($3); 653 YYERROR; 654 } 655 if (!pf->anchor->name[0]) { 656 if (pfctl_file_fingerprints(pf->dev, 657 pf->opts, $3)) { 658 yyerror("error loading " 659 "fingerprints %s", $3); 660 free($3); 661 YYERROR; 662 } 663 } 664 free($3); 665 } 666 | SET STATEPOLICY statelock { 667 if (pf->opts & PF_OPT_VERBOSE) 668 switch ($3) { 669 case 0: 670 printf("set state-policy floating\n"); 671 break; 672 case PFRULE_IFBOUND: 673 printf("set state-policy if-bound\n"); 674 break; 675 } 676 default_statelock = $3; 677 } 678 | SET DEBUG STRING { 679 if (check_rulestate(PFCTL_STATE_OPTION)) { 680 free($3); 681 YYERROR; 682 } 683 if (pfctl_set_debug(pf, $3) != 0) { 684 yyerror("error setting debuglevel %s", $3); 685 free($3); 686 YYERROR; 687 } 688 free($3); 689 } 690 | SET SKIP interface { 691 if (expand_skip_interface($3) != 0) { 692 yyerror("error setting skip interface(s)"); 693 YYERROR; 694 } 695 } 696 | SET STATEDEFAULTS state_opt_list { 697 if (keep_state_defaults != NULL) { 698 yyerror("cannot redefine state-defaults"); 699 YYERROR; 700 } 701 keep_state_defaults = $3; 702 } 703 ; 704 705stringall : STRING { $$ = $1; } 706 | ALL { 707 if (($$ = strdup("all")) == NULL) { 708 err(1, "stringall: strdup"); 709 } 710 } 711 ; 712 713string : STRING string { 714 if (asprintf(&$$, "%s %s", $1, $2) == -1) 715 err(1, "string: asprintf"); 716 free($1); 717 free($2); 718 } 719 | STRING 720 ; 721 722varstring : numberstring varstring { 723 if (asprintf(&$$, "%s %s", $1, $2) == -1) 724 err(1, "string: asprintf"); 725 free($1); 726 free($2); 727 } 728 | numberstring 729 ; 730 731numberstring : NUMBER { 732 char *s; 733 if (asprintf(&s, "%lld", $1) == -1) { 734 yyerror("string: asprintf"); 735 YYERROR; 736 } 737 $$ = s; 738 } 739 | STRING 740 ; 741 742varset : STRING '=' varstring { 743 if (pf->opts & PF_OPT_VERBOSE) 744 printf("%s = \"%s\"\n", $1, $3); 745 if (symset($1, $3, 0) == -1) 746 err(1, "cannot store variable %s", $1); 747 free($1); 748 free($3); 749 } 750 ; 751 752anchorname : STRING { $$ = $1; } 753 | /* empty */ { $$ = NULL; } 754 ; 755 756pfa_anchorlist : /* empty */ 757 | pfa_anchorlist '\n' 758 | pfa_anchorlist pfrule '\n' 759 | pfa_anchorlist anchorrule '\n' 760 ; 761 762pfa_anchor : '{' 763 { 764 char ta[PF_ANCHOR_NAME_SIZE]; 765 struct pf_ruleset *rs; 766 767 /* steping into a brace anchor */ 768 pf->asd++; 769 pf->bn++; 770 pf->brace = 1; 771 772 /* 773 * Anchor contents are parsed before the anchor rule 774 * production completes, so we don't know the real 775 * location yet. Create a holding ruleset in the root; 776 * contents will be moved afterwards. 777 */ 778 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 779 rs = pf_find_or_create_ruleset(ta); 780 if (rs == NULL) 781 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 782 pf->astack[pf->asd] = rs->anchor; 783 pf->anchor = rs->anchor; 784 } '\n' pfa_anchorlist '}' 785 { 786 pf->alast = pf->anchor; 787 pf->asd--; 788 pf->anchor = pf->astack[pf->asd]; 789 } 790 | /* empty */ 791 ; 792 793anchorrule : ANCHOR anchorname dir quick interface af proto fromto 794 filter_opts pfa_anchor 795 { 796 struct pf_rule r; 797 struct node_proto *proto; 798 799 if (check_rulestate(PFCTL_STATE_FILTER)) { 800 if ($2) 801 free($2); 802 YYERROR; 803 } 804 805 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 806 free($2); 807 yyerror("anchor names beginning with '_' " 808 "are reserved for internal use"); 809 YYERROR; 810 } 811 812 memset(&r, 0, sizeof(r)); 813 if (pf->astack[pf->asd + 1]) { 814 if ($2 && strchr($2, '/') != NULL) { 815 free($2); 816 yyerror("anchor paths containing '/' " 817 "cannot be used for inline anchors."); 818 YYERROR; 819 } 820 821 /* Move inline rules into relative location. */ 822 pf_anchor_setup(&r, 823 &pf->astack[pf->asd]->ruleset, 824 $2 ? $2 : pf->alast->name); 825 826 if (r.anchor == NULL) 827 err(1, "anchorrule: unable to " 828 "create ruleset"); 829 830 if (pf->alast != r.anchor) { 831 if (r.anchor->match) { 832 yyerror("inline anchor '%s' " 833 "already exists", 834 r.anchor->name); 835 YYERROR; 836 } 837 mv_rules(&pf->alast->ruleset, 838 &r.anchor->ruleset); 839 } 840 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 841 pf->alast = r.anchor; 842 } else { 843 if (!$2) { 844 yyerror("anchors without explicit " 845 "rules must specify a name"); 846 YYERROR; 847 } 848 } 849 r.direction = $3; 850 r.quick = $4.quick; 851 r.af = $6; 852 r.prob = $9.prob; 853 r.rtableid = $9.rtableid; 854 855 if ($9.tag) 856 if (strlcpy(r.tagname, $9.tag, 857 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 858 yyerror("tag too long, max %u chars", 859 PF_TAG_NAME_SIZE - 1); 860 YYERROR; 861 } 862 if ($9.match_tag) 863 if (strlcpy(r.match_tagname, $9.match_tag, 864 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 865 yyerror("tag too long, max %u chars", 866 PF_TAG_NAME_SIZE - 1); 867 YYERROR; 868 } 869 r.match_tag_not = $9.match_tag_not; 870 if (rule_label(&r, $9.label)) 871 YYERROR; 872 free($9.label); 873 r.flags = $9.flags.b1; 874 r.flagset = $9.flags.b2; 875 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 876 yyerror("flags always false"); 877 YYERROR; 878 } 879 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 880 for (proto = $7; proto != NULL && 881 proto->proto != IPPROTO_TCP; 882 proto = proto->next) 883 ; /* nothing */ 884 if (proto == NULL && $7 != NULL) { 885 if ($9.flags.b1 || $9.flags.b2) 886 yyerror( 887 "flags only apply to tcp"); 888 if ($8.src_os) 889 yyerror( 890 "OS fingerprinting only " 891 "applies to tcp"); 892 YYERROR; 893 } 894 } 895 896 r.tos = $9.tos; 897 898 if ($9.keep.action) { 899 yyerror("cannot specify state handling " 900 "on anchors"); 901 YYERROR; 902 } 903 904 if ($9.route.rt) { 905 yyerror("cannot specify route handling " 906 "on anchors"); 907 YYERROR; 908 } 909 910 if ($9.match_tag) 911 if (strlcpy(r.match_tagname, $9.match_tag, 912 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 913 yyerror("tag too long, max %u chars", 914 PF_TAG_NAME_SIZE - 1); 915 YYERROR; 916 } 917 r.match_tag_not = $9.match_tag_not; 918 919 decide_address_family($8.src.host, &r.af); 920 decide_address_family($8.dst.host, &r.af); 921 922 expand_rule(&r, 0, $5, NULL, NULL, NULL, $7, $8.src_os, 923 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 924 $9.uid, $9.gid, $9.rcv, $9.icmpspec, 925 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 926 free($2); 927 pf->astack[pf->asd + 1] = NULL; 928 } 929 ; 930 931loadrule : LOAD ANCHOR string FROM string { 932 struct loadanchors *loadanchor; 933 934 if (strlen(pf->anchor->name) + 1 + 935 strlen($3) >= MAXPATHLEN) { 936 yyerror("anchorname %s too long, max %u\n", 937 $3, MAXPATHLEN - 1); 938 free($3); 939 YYERROR; 940 } 941 loadanchor = calloc(1, sizeof(struct loadanchors)); 942 if (loadanchor == NULL) 943 err(1, "loadrule: calloc"); 944 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 945 NULL) 946 err(1, "loadrule: malloc"); 947 if (pf->anchor->name[0]) 948 snprintf(loadanchor->anchorname, MAXPATHLEN, 949 "%s/%s", pf->anchor->name, $3); 950 else 951 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 952 if ((loadanchor->filename = strdup($5)) == NULL) 953 err(1, "loadrule: strdup"); 954 955 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 956 entries); 957 958 free($3); 959 free($5); 960 }; 961 962scrub_opts : { 963 bzero(&scrub_opts, sizeof scrub_opts); 964 } 965 scrub_opts_l 966 { $$ = scrub_opts; } 967 ; 968 969scrub_opts_l : scrub_opts_l comma scrub_opt 970 | scrub_opt 971 ; 972 973scrub_opt : NODF { 974 if (scrub_opts.nodf) { 975 yyerror("no-df cannot be respecified"); 976 YYERROR; 977 } 978 scrub_opts.nodf = 1; 979 } 980 | MINTTL NUMBER { 981 if (scrub_opts.marker & FOM_MINTTL) { 982 yyerror("min-ttl cannot be respecified"); 983 YYERROR; 984 } 985 if ($2 < 0 || $2 > 255) { 986 yyerror("illegal min-ttl value %d", $2); 987 YYERROR; 988 } 989 scrub_opts.marker |= FOM_MINTTL; 990 scrub_opts.minttl = $2; 991 } 992 | MAXMSS NUMBER { 993 if (scrub_opts.marker & FOM_MAXMSS) { 994 yyerror("max-mss cannot be respecified"); 995 YYERROR; 996 } 997 if ($2 < 0 || $2 > 65535) { 998 yyerror("illegal max-mss value %d", $2); 999 YYERROR; 1000 } 1001 scrub_opts.marker |= FOM_MAXMSS; 1002 scrub_opts.maxmss = $2; 1003 } 1004 | SETTOS tos { 1005 if (scrub_opts.marker & FOM_SETTOS) { 1006 yyerror("set-tos cannot be respecified"); 1007 YYERROR; 1008 } 1009 scrub_opts.marker |= FOM_SETTOS; 1010 scrub_opts.settos = $2; 1011 } 1012 | REASSEMBLE STRING { 1013 if (strcasecmp($2, "tcp") != 0) { 1014 yyerror("scrub reassemble supports only tcp, " 1015 "not '%s'", $2); 1016 free($2); 1017 YYERROR; 1018 } 1019 free($2); 1020 if (scrub_opts.reassemble_tcp) { 1021 yyerror("reassemble tcp cannot be respecified"); 1022 YYERROR; 1023 } 1024 scrub_opts.reassemble_tcp = 1; 1025 } 1026 | RANDOMID { 1027 if (scrub_opts.randomid) { 1028 yyerror("random-id cannot be respecified"); 1029 YYERROR; 1030 } 1031 scrub_opts.randomid = 1; 1032 } 1033 ; 1034 1035antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1036 struct pf_rule r; 1037 struct node_host *h = NULL, *hh; 1038 struct node_if *i, *j; 1039 1040 if (check_rulestate(PFCTL_STATE_FILTER)) 1041 YYERROR; 1042 1043 for (i = $3; i; i = i->next) { 1044 bzero(&r, sizeof(r)); 1045 1046 r.action = PF_DROP; 1047 r.direction = PF_IN; 1048 r.log = $2.log; 1049 r.logif = $2.logif; 1050 r.quick = $2.quick; 1051 r.af = $4; 1052 if (rule_label(&r, $5.label)) 1053 YYERROR; 1054 r.rtableid = $5.rtableid; 1055 j = calloc(1, sizeof(struct node_if)); 1056 if (j == NULL) 1057 err(1, "antispoof: calloc"); 1058 if (strlcpy(j->ifname, i->ifname, 1059 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1060 free(j); 1061 yyerror("interface name too long"); 1062 YYERROR; 1063 } 1064 j->not = 1; 1065 if (i->dynamic) { 1066 h = calloc(1, sizeof(*h)); 1067 if (h == NULL) 1068 err(1, "address: calloc"); 1069 h->addr.type = PF_ADDR_DYNIFTL; 1070 set_ipmask(h, 128); 1071 if (strlcpy(h->addr.v.ifname, i->ifname, 1072 sizeof(h->addr.v.ifname)) >= 1073 sizeof(h->addr.v.ifname)) { 1074 free(h); 1075 yyerror( 1076 "interface name too long"); 1077 YYERROR; 1078 } 1079 hh = malloc(sizeof(*hh)); 1080 if (hh == NULL) 1081 err(1, "address: malloc"); 1082 bcopy(h, hh, sizeof(*hh)); 1083 h->addr.iflags = PFI_AFLAG_NETWORK; 1084 } else { 1085 h = ifa_lookup(j->ifname, 1086 PFI_AFLAG_NETWORK); 1087 hh = NULL; 1088 } 1089 1090 if (h != NULL) 1091 expand_rule(&r, 0, j, NULL, NULL, NULL, 1092 NULL, NULL, h, NULL, NULL, NULL, 1093 NULL, NULL, NULL, NULL, ""); 1094 1095 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1096 bzero(&r, sizeof(r)); 1097 1098 r.action = PF_DROP; 1099 r.direction = PF_IN; 1100 r.log = $2.log; 1101 r.logif = $2.logif; 1102 r.quick = $2.quick; 1103 r.af = $4; 1104 if (rule_label(&r, $5.label)) 1105 YYERROR; 1106 r.rtableid = $5.rtableid; 1107 if (hh != NULL) 1108 h = hh; 1109 else 1110 h = ifa_lookup(i->ifname, 0); 1111 if (h != NULL) 1112 expand_rule(&r, 0, NULL, NULL, 1113 NULL, NULL, NULL, NULL, h, 1114 NULL, NULL, NULL, NULL, 1115 NULL, NULL, NULL, ""); 1116 } else 1117 free(hh); 1118 } 1119 free($5.label); 1120 } 1121 ; 1122 1123antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1124 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1125 ; 1126 1127antispoof_iflst : antispoof_if optnl { $$ = $1; } 1128 | antispoof_iflst comma antispoof_if optnl { 1129 $1->tail->next = $3; 1130 $1->tail = $3; 1131 $$ = $1; 1132 } 1133 ; 1134 1135antispoof_if : if_item { $$ = $1; } 1136 | '(' if_item ')' { 1137 $2->dynamic = 1; 1138 $$ = $2; 1139 } 1140 ; 1141 1142antispoof_opts : { 1143 bzero(&antispoof_opts, sizeof antispoof_opts); 1144 antispoof_opts.rtableid = -1; 1145 } 1146 antispoof_opts_l 1147 { $$ = antispoof_opts; } 1148 | /* empty */ { 1149 bzero(&antispoof_opts, sizeof antispoof_opts); 1150 antispoof_opts.rtableid = -1; 1151 $$ = antispoof_opts; 1152 } 1153 ; 1154 1155antispoof_opts_l : antispoof_opts_l antispoof_opt 1156 | antispoof_opt 1157 ; 1158 1159antispoof_opt : LABEL label { 1160 if (antispoof_opts.label) { 1161 yyerror("label cannot be redefined"); 1162 YYERROR; 1163 } 1164 antispoof_opts.label = $2; 1165 } 1166 | RTABLE NUMBER { 1167 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 1168 yyerror("invalid rtable id"); 1169 YYERROR; 1170 } 1171 antispoof_opts.rtableid = $2; 1172 } 1173 ; 1174 1175not : '!' { $$ = 1; } 1176 | /* empty */ { $$ = 0; } 1177 ; 1178 1179tabledef : TABLE '<' STRING '>' table_opts { 1180 struct node_host *h, *nh; 1181 struct node_tinit *ti, *nti; 1182 1183 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1184 yyerror("table name too long, max %d chars", 1185 PF_TABLE_NAME_SIZE - 1); 1186 free($3); 1187 YYERROR; 1188 } 1189 if (process_tabledef($3, &$5)) { 1190 free($3); 1191 YYERROR; 1192 } 1193 free($3); 1194 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1195 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1196 if (ti->file) 1197 free(ti->file); 1198 for (h = ti->host; h != NULL; h = nh) { 1199 nh = h->next; 1200 free(h); 1201 } 1202 nti = SIMPLEQ_NEXT(ti, entries); 1203 free(ti); 1204 } 1205 } 1206 ; 1207 1208table_opts : { 1209 bzero(&table_opts, sizeof table_opts); 1210 SIMPLEQ_INIT(&table_opts.init_nodes); 1211 } 1212 table_opts_l 1213 { $$ = table_opts; } 1214 | /* empty */ 1215 { 1216 bzero(&table_opts, sizeof table_opts); 1217 SIMPLEQ_INIT(&table_opts.init_nodes); 1218 $$ = table_opts; 1219 } 1220 ; 1221 1222table_opts_l : table_opts_l table_opt 1223 | table_opt 1224 ; 1225 1226table_opt : STRING { 1227 if (!strcmp($1, "const")) 1228 table_opts.flags |= PFR_TFLAG_CONST; 1229 else if (!strcmp($1, "persist")) 1230 table_opts.flags |= PFR_TFLAG_PERSIST; 1231 else if (!strcmp($1, "counters")) 1232 table_opts.flags |= PFR_TFLAG_COUNTERS; 1233 else { 1234 yyerror("invalid table option '%s'", $1); 1235 free($1); 1236 YYERROR; 1237 } 1238 free($1); 1239 } 1240 | '{' optnl '}' { table_opts.init_addr = 1; } 1241 | '{' optnl host_list '}' { 1242 struct node_host *n; 1243 struct node_tinit *ti; 1244 1245 for (n = $3; n != NULL; n = n->next) { 1246 switch (n->addr.type) { 1247 case PF_ADDR_ADDRMASK: 1248 continue; /* ok */ 1249 case PF_ADDR_RANGE: 1250 yyerror("address ranges are not " 1251 "permitted inside tables"); 1252 break; 1253 case PF_ADDR_DYNIFTL: 1254 yyerror("dynamic addresses are not " 1255 "permitted inside tables"); 1256 break; 1257 case PF_ADDR_TABLE: 1258 yyerror("tables cannot contain tables"); 1259 break; 1260 case PF_ADDR_NOROUTE: 1261 yyerror("\"no-route\" is not permitted " 1262 "inside tables"); 1263 break; 1264 case PF_ADDR_URPFFAILED: 1265 yyerror("\"urpf-failed\" is not " 1266 "permitted inside tables"); 1267 break; 1268 default: 1269 yyerror("unknown address type %d", 1270 n->addr.type); 1271 } 1272 YYERROR; 1273 } 1274 if (!(ti = calloc(1, sizeof(*ti)))) 1275 err(1, "table_opt: calloc"); 1276 ti->host = $3; 1277 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1278 entries); 1279 table_opts.init_addr = 1; 1280 } 1281 | FILENAME STRING { 1282 struct node_tinit *ti; 1283 1284 if (!(ti = calloc(1, sizeof(*ti)))) 1285 err(1, "table_opt: calloc"); 1286 ti->file = $2; 1287 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1288 entries); 1289 table_opts.init_addr = 1; 1290 } 1291 ; 1292 1293altqif : ALTQ interface queue_opts QUEUE qassign { 1294 struct pf_altq a; 1295 1296 if (check_rulestate(PFCTL_STATE_QUEUE)) 1297 YYERROR; 1298 1299 memset(&a, 0, sizeof(a)); 1300 if ($3.scheduler.qtype == ALTQT_NONE) { 1301 yyerror("no scheduler specified!"); 1302 YYERROR; 1303 } 1304 a.scheduler = $3.scheduler.qtype; 1305 a.qlimit = $3.qlimit; 1306 a.tbrsize = $3.tbrsize; 1307 if ($5 == NULL) { 1308 yyerror("no child queues specified"); 1309 YYERROR; 1310 } 1311 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1312 &$3.scheduler)) 1313 YYERROR; 1314 } 1315 ; 1316 1317queuespec : QUEUE STRING interface queue_opts qassign { 1318 struct pf_altq a; 1319 1320 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1321 free($2); 1322 YYERROR; 1323 } 1324 1325 memset(&a, 0, sizeof(a)); 1326 1327 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1328 sizeof(a.qname)) { 1329 yyerror("queue name too long (max " 1330 "%d chars)", PF_QNAME_SIZE-1); 1331 free($2); 1332 YYERROR; 1333 } 1334 free($2); 1335 if ($4.tbrsize) { 1336 yyerror("cannot specify tbrsize for queue"); 1337 YYERROR; 1338 } 1339 if ($4.priority > 255) { 1340 yyerror("priority out of range: max 255"); 1341 YYERROR; 1342 } 1343 a.priority = $4.priority; 1344 a.qlimit = $4.qlimit; 1345 a.scheduler = $4.scheduler.qtype; 1346 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1347 &$4.scheduler)) { 1348 yyerror("errors in queue definition"); 1349 YYERROR; 1350 } 1351 } 1352 ; 1353 1354queue_opts : { 1355 bzero(&queue_opts, sizeof queue_opts); 1356 queue_opts.priority = DEFAULT_PRIORITY; 1357 queue_opts.qlimit = DEFAULT_QLIMIT; 1358 queue_opts.scheduler.qtype = ALTQT_NONE; 1359 queue_opts.queue_bwspec.bw_percent = 100; 1360 } 1361 queue_opts_l 1362 { $$ = queue_opts; } 1363 | /* empty */ { 1364 bzero(&queue_opts, sizeof queue_opts); 1365 queue_opts.priority = DEFAULT_PRIORITY; 1366 queue_opts.qlimit = DEFAULT_QLIMIT; 1367 queue_opts.scheduler.qtype = ALTQT_NONE; 1368 queue_opts.queue_bwspec.bw_percent = 100; 1369 $$ = queue_opts; 1370 } 1371 ; 1372 1373queue_opts_l : queue_opts_l queue_opt 1374 | queue_opt 1375 ; 1376 1377queue_opt : BANDWIDTH bandwidth { 1378 if (queue_opts.marker & QOM_BWSPEC) { 1379 yyerror("bandwidth cannot be respecified"); 1380 YYERROR; 1381 } 1382 queue_opts.marker |= QOM_BWSPEC; 1383 queue_opts.queue_bwspec = $2; 1384 } 1385 | PRIORITY NUMBER { 1386 if (queue_opts.marker & QOM_PRIORITY) { 1387 yyerror("priority cannot be respecified"); 1388 YYERROR; 1389 } 1390 if ($2 < 0 || $2 > 255) { 1391 yyerror("priority out of range: max 255"); 1392 YYERROR; 1393 } 1394 queue_opts.marker |= QOM_PRIORITY; 1395 queue_opts.priority = $2; 1396 } 1397 | QLIMIT NUMBER { 1398 if (queue_opts.marker & QOM_QLIMIT) { 1399 yyerror("qlimit cannot be respecified"); 1400 YYERROR; 1401 } 1402 if ($2 < 0 || $2 > 65535) { 1403 yyerror("qlimit out of range: max 65535"); 1404 YYERROR; 1405 } 1406 queue_opts.marker |= QOM_QLIMIT; 1407 queue_opts.qlimit = $2; 1408 } 1409 | scheduler { 1410 if (queue_opts.marker & QOM_SCHEDULER) { 1411 yyerror("scheduler cannot be respecified"); 1412 YYERROR; 1413 } 1414 queue_opts.marker |= QOM_SCHEDULER; 1415 queue_opts.scheduler = $1; 1416 } 1417 | TBRSIZE NUMBER { 1418 if (queue_opts.marker & QOM_TBRSIZE) { 1419 yyerror("tbrsize cannot be respecified"); 1420 YYERROR; 1421 } 1422 if ($2 < 0 || $2 > 65535) { 1423 yyerror("tbrsize too big: max 65535"); 1424 YYERROR; 1425 } 1426 queue_opts.marker |= QOM_TBRSIZE; 1427 queue_opts.tbrsize = $2; 1428 } 1429 ; 1430 1431bandwidth : STRING { 1432 double bps; 1433 char *cp; 1434 1435 $$.bw_percent = 0; 1436 1437 bps = strtod($1, &cp); 1438 if (cp != NULL) { 1439 if (!strcmp(cp, "b")) 1440 ; /* nothing */ 1441 else if (!strcmp(cp, "Kb")) 1442 bps *= 1000; 1443 else if (!strcmp(cp, "Mb")) 1444 bps *= 1000 * 1000; 1445 else if (!strcmp(cp, "Gb")) 1446 bps *= 1000 * 1000 * 1000; 1447 else if (!strcmp(cp, "%")) { 1448 if (bps < 0 || bps > 100) { 1449 yyerror("bandwidth spec " 1450 "out of range"); 1451 free($1); 1452 YYERROR; 1453 } 1454 $$.bw_percent = bps; 1455 bps = 0; 1456 } else { 1457 yyerror("unknown unit %s", cp); 1458 free($1); 1459 YYERROR; 1460 } 1461 } 1462 free($1); 1463 $$.bw_absolute = (u_int32_t)bps; 1464 } 1465 | NUMBER { 1466 if ($1 < 0 || $1 > UINT_MAX) { 1467 yyerror("bandwidth number too big"); 1468 YYERROR; 1469 } 1470 $$.bw_percent = 0; 1471 $$.bw_absolute = $1; 1472 } 1473 ; 1474 1475scheduler : CBQ { 1476 $$.qtype = ALTQT_CBQ; 1477 $$.data.cbq_opts.flags = 0; 1478 } 1479 | CBQ '(' cbqflags_list ')' { 1480 $$.qtype = ALTQT_CBQ; 1481 $$.data.cbq_opts.flags = $3; 1482 } 1483 | PRIQ { 1484 $$.qtype = ALTQT_PRIQ; 1485 $$.data.priq_opts.flags = 0; 1486 } 1487 | PRIQ '(' priqflags_list ')' { 1488 $$.qtype = ALTQT_PRIQ; 1489 $$.data.priq_opts.flags = $3; 1490 } 1491 | HFSC { 1492 $$.qtype = ALTQT_HFSC; 1493 bzero(&$$.data.hfsc_opts, 1494 sizeof(struct node_hfsc_opts)); 1495 } 1496 | HFSC '(' hfsc_opts ')' { 1497 $$.qtype = ALTQT_HFSC; 1498 $$.data.hfsc_opts = $3; 1499 } 1500 ; 1501 1502cbqflags_list : cbqflags_item { $$ |= $1; } 1503 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1504 ; 1505 1506cbqflags_item : STRING { 1507 if (!strcmp($1, "default")) 1508 $$ = CBQCLF_DEFCLASS; 1509 else if (!strcmp($1, "borrow")) 1510 $$ = CBQCLF_BORROW; 1511 else if (!strcmp($1, "red")) 1512 $$ = CBQCLF_RED; 1513 else if (!strcmp($1, "ecn")) 1514 $$ = CBQCLF_RED|CBQCLF_ECN; 1515 else if (!strcmp($1, "rio")) 1516 $$ = CBQCLF_RIO; 1517 else { 1518 yyerror("unknown cbq flag \"%s\"", $1); 1519 free($1); 1520 YYERROR; 1521 } 1522 free($1); 1523 } 1524 ; 1525 1526priqflags_list : priqflags_item { $$ |= $1; } 1527 | priqflags_list comma priqflags_item { $$ |= $3; } 1528 ; 1529 1530priqflags_item : STRING { 1531 if (!strcmp($1, "default")) 1532 $$ = PRCF_DEFAULTCLASS; 1533 else if (!strcmp($1, "red")) 1534 $$ = PRCF_RED; 1535 else if (!strcmp($1, "ecn")) 1536 $$ = PRCF_RED|PRCF_ECN; 1537 else if (!strcmp($1, "rio")) 1538 $$ = PRCF_RIO; 1539 else { 1540 yyerror("unknown priq flag \"%s\"", $1); 1541 free($1); 1542 YYERROR; 1543 } 1544 free($1); 1545 } 1546 ; 1547 1548hfsc_opts : { 1549 bzero(&hfsc_opts, 1550 sizeof(struct node_hfsc_opts)); 1551 } 1552 hfscopts_list { 1553 $$ = hfsc_opts; 1554 } 1555 ; 1556 1557hfscopts_list : hfscopts_item 1558 | hfscopts_list comma hfscopts_item 1559 ; 1560 1561hfscopts_item : LINKSHARE bandwidth { 1562 if (hfsc_opts.linkshare.used) { 1563 yyerror("linkshare already specified"); 1564 YYERROR; 1565 } 1566 hfsc_opts.linkshare.m2 = $2; 1567 hfsc_opts.linkshare.used = 1; 1568 } 1569 | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 1570 { 1571 if ($5 < 0 || $5 > INT_MAX) { 1572 yyerror("timing in curve out of range"); 1573 YYERROR; 1574 } 1575 if (hfsc_opts.linkshare.used) { 1576 yyerror("linkshare already specified"); 1577 YYERROR; 1578 } 1579 hfsc_opts.linkshare.m1 = $3; 1580 hfsc_opts.linkshare.d = $5; 1581 hfsc_opts.linkshare.m2 = $7; 1582 hfsc_opts.linkshare.used = 1; 1583 } 1584 | REALTIME bandwidth { 1585 if (hfsc_opts.realtime.used) { 1586 yyerror("realtime already specified"); 1587 YYERROR; 1588 } 1589 hfsc_opts.realtime.m2 = $2; 1590 hfsc_opts.realtime.used = 1; 1591 } 1592 | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 1593 { 1594 if ($5 < 0 || $5 > INT_MAX) { 1595 yyerror("timing in curve out of range"); 1596 YYERROR; 1597 } 1598 if (hfsc_opts.realtime.used) { 1599 yyerror("realtime already specified"); 1600 YYERROR; 1601 } 1602 hfsc_opts.realtime.m1 = $3; 1603 hfsc_opts.realtime.d = $5; 1604 hfsc_opts.realtime.m2 = $7; 1605 hfsc_opts.realtime.used = 1; 1606 } 1607 | UPPERLIMIT bandwidth { 1608 if (hfsc_opts.upperlimit.used) { 1609 yyerror("upperlimit already specified"); 1610 YYERROR; 1611 } 1612 hfsc_opts.upperlimit.m2 = $2; 1613 hfsc_opts.upperlimit.used = 1; 1614 } 1615 | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 1616 { 1617 if ($5 < 0 || $5 > INT_MAX) { 1618 yyerror("timing in curve out of range"); 1619 YYERROR; 1620 } 1621 if (hfsc_opts.upperlimit.used) { 1622 yyerror("upperlimit already specified"); 1623 YYERROR; 1624 } 1625 hfsc_opts.upperlimit.m1 = $3; 1626 hfsc_opts.upperlimit.d = $5; 1627 hfsc_opts.upperlimit.m2 = $7; 1628 hfsc_opts.upperlimit.used = 1; 1629 } 1630 | STRING { 1631 if (!strcmp($1, "default")) 1632 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1633 else if (!strcmp($1, "red")) 1634 hfsc_opts.flags |= HFCF_RED; 1635 else if (!strcmp($1, "ecn")) 1636 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1637 else if (!strcmp($1, "rio")) 1638 hfsc_opts.flags |= HFCF_RIO; 1639 else { 1640 yyerror("unknown hfsc flag \"%s\"", $1); 1641 free($1); 1642 YYERROR; 1643 } 1644 free($1); 1645 } 1646 ; 1647 1648qassign : /* empty */ { $$ = NULL; } 1649 | qassign_item { $$ = $1; } 1650 | '{' optnl qassign_list '}' { $$ = $3; } 1651 ; 1652 1653qassign_list : qassign_item optnl { $$ = $1; } 1654 | qassign_list comma qassign_item optnl { 1655 $1->tail->next = $3; 1656 $1->tail = $3; 1657 $$ = $1; 1658 } 1659 ; 1660 1661qassign_item : STRING { 1662 $$ = calloc(1, sizeof(struct node_queue)); 1663 if ($$ == NULL) 1664 err(1, "qassign_item: calloc"); 1665 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1666 sizeof($$->queue)) { 1667 yyerror("queue name '%s' too long (max " 1668 "%d chars)", $1, sizeof($$->queue)-1); 1669 free($1); 1670 free($$); 1671 YYERROR; 1672 } 1673 free($1); 1674 $$->next = NULL; 1675 $$->tail = $$; 1676 } 1677 ; 1678 1679pfrule : action dir logquick interface af proto fromto 1680 filter_opts 1681 { 1682 struct pf_rule r; 1683 struct node_state_opt *o; 1684 struct node_proto *proto; 1685 int srctrack = 0; 1686 int statelock = 0; 1687 int adaptive = 0; 1688 int defaults = 0; 1689 1690 if (check_rulestate(PFCTL_STATE_FILTER)) 1691 YYERROR; 1692 1693 memset(&r, 0, sizeof(r)); 1694 1695 r.action = $1.b1; 1696 switch ($1.b2) { 1697 case PFRULE_RETURNRST: 1698 r.rule_flag |= PFRULE_RETURNRST; 1699 r.return_ttl = $1.w; 1700 break; 1701 case PFRULE_RETURNICMP: 1702 r.rule_flag |= PFRULE_RETURNICMP; 1703 r.return_icmp = $1.w; 1704 r.return_icmp6 = $1.w2; 1705 break; 1706 case PFRULE_RETURN: 1707 r.rule_flag |= PFRULE_RETURN; 1708 r.return_icmp = $1.w; 1709 r.return_icmp6 = $1.w2; 1710 break; 1711 } 1712 r.direction = $2; 1713 r.log = $3.log; 1714 r.logif = $3.logif; 1715 r.quick = $3.quick; 1716 r.prob = $8.prob; 1717 r.rtableid = $8.rtableid; 1718 1719 if ($8.nodf) 1720 r.scrub_flags |= PFSTATE_NODF; 1721 if ($8.randomid) 1722 r.scrub_flags |= PFSTATE_RANDOMID; 1723 if ($8.minttl) 1724 r.min_ttl = $8.minttl; 1725 if ($8.max_mss) 1726 r.max_mss = $8.max_mss; 1727 if ($8.marker & FOM_SETTOS) { 1728 r.scrub_flags |= PFSTATE_SETTOS; 1729 r.set_tos = $8.settos; 1730 } 1731 if ($8.marker & FOM_SCRUB_TCP) 1732 r.scrub_flags |= PFSTATE_SCRUB_TCP; 1733 1734 r.af = $5; 1735 if ($8.tag) 1736 if (strlcpy(r.tagname, $8.tag, 1737 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1738 yyerror("tag too long, max %u chars", 1739 PF_TAG_NAME_SIZE - 1); 1740 YYERROR; 1741 } 1742 if ($8.match_tag) 1743 if (strlcpy(r.match_tagname, $8.match_tag, 1744 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1745 yyerror("tag too long, max %u chars", 1746 PF_TAG_NAME_SIZE - 1); 1747 YYERROR; 1748 } 1749 r.match_tag_not = $8.match_tag_not; 1750 if (rule_label(&r, $8.label)) 1751 YYERROR; 1752 free($8.label); 1753 r.flags = $8.flags.b1; 1754 r.flagset = $8.flags.b2; 1755 if (($8.flags.b1 & $8.flags.b2) != $8.flags.b1) { 1756 yyerror("flags always false"); 1757 YYERROR; 1758 } 1759 if ($8.flags.b1 || $8.flags.b2 || $7.src_os) { 1760 for (proto = $6; proto != NULL && 1761 proto->proto != IPPROTO_TCP; 1762 proto = proto->next) 1763 ; /* nothing */ 1764 if (proto == NULL && $6 != NULL) { 1765 if ($8.flags.b1 || $8.flags.b2) 1766 yyerror( 1767 "flags only apply to tcp"); 1768 if ($7.src_os) 1769 yyerror( 1770 "OS fingerprinting only " 1771 "apply to tcp"); 1772 YYERROR; 1773 } 1774#if 0 1775 if (($8.flags.b1 & parse_flags("S")) == 0 && 1776 $7.src_os) { 1777 yyerror("OS fingerprinting requires " 1778 "the SYN TCP flag (flags S/SA)"); 1779 YYERROR; 1780 } 1781#endif 1782 } 1783 1784 r.tos = $8.tos; 1785 r.keep_state = $8.keep.action; 1786 o = $8.keep.options; 1787 1788 /* 'keep state' by default on pass rules. */ 1789 if (!r.keep_state && !r.action && 1790 !($8.marker & FOM_KEEP)) { 1791 r.keep_state = PF_STATE_NORMAL; 1792 o = keep_state_defaults; 1793 defaults = 1; 1794 } 1795 1796 while (o) { 1797 struct node_state_opt *p = o; 1798 1799 switch (o->type) { 1800 case PF_STATE_OPT_MAX: 1801 if (r.max_states) { 1802 yyerror("state option 'max' " 1803 "multiple definitions"); 1804 YYERROR; 1805 } 1806 r.max_states = o->data.max_states; 1807 break; 1808 case PF_STATE_OPT_NOSYNC: 1809 if (r.rule_flag & PFRULE_NOSYNC) { 1810 yyerror("state option 'sync' " 1811 "multiple definitions"); 1812 YYERROR; 1813 } 1814 r.rule_flag |= PFRULE_NOSYNC; 1815 break; 1816 case PF_STATE_OPT_SRCTRACK: 1817 if (srctrack) { 1818 yyerror("state option " 1819 "'source-track' " 1820 "multiple definitions"); 1821 YYERROR; 1822 } 1823 srctrack = o->data.src_track; 1824 r.rule_flag |= PFRULE_SRCTRACK; 1825 break; 1826 case PF_STATE_OPT_MAX_SRC_STATES: 1827 if (r.max_src_states) { 1828 yyerror("state option " 1829 "'max-src-states' " 1830 "multiple definitions"); 1831 YYERROR; 1832 } 1833 if (o->data.max_src_states == 0) { 1834 yyerror("'max-src-states' must " 1835 "be > 0"); 1836 YYERROR; 1837 } 1838 r.max_src_states = 1839 o->data.max_src_states; 1840 r.rule_flag |= PFRULE_SRCTRACK; 1841 break; 1842 case PF_STATE_OPT_OVERLOAD: 1843 if (r.overload_tblname[0]) { 1844 yyerror("multiple 'overload' " 1845 "table definitions"); 1846 YYERROR; 1847 } 1848 if (strlcpy(r.overload_tblname, 1849 o->data.overload.tblname, 1850 PF_TABLE_NAME_SIZE) >= 1851 PF_TABLE_NAME_SIZE) { 1852 yyerror("state option: " 1853 "strlcpy"); 1854 YYERROR; 1855 } 1856 r.flush = o->data.overload.flush; 1857 break; 1858 case PF_STATE_OPT_MAX_SRC_CONN: 1859 if (r.max_src_conn) { 1860 yyerror("state option " 1861 "'max-src-conn' " 1862 "multiple definitions"); 1863 YYERROR; 1864 } 1865 if (o->data.max_src_conn == 0) { 1866 yyerror("'max-src-conn' " 1867 "must be > 0"); 1868 YYERROR; 1869 } 1870 r.max_src_conn = 1871 o->data.max_src_conn; 1872 r.rule_flag |= PFRULE_SRCTRACK | 1873 PFRULE_RULESRCTRACK; 1874 break; 1875 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1876 if (r.max_src_conn_rate.limit) { 1877 yyerror("state option " 1878 "'max-src-conn-rate' " 1879 "multiple definitions"); 1880 YYERROR; 1881 } 1882 if (!o->data.max_src_conn_rate.limit || 1883 !o->data.max_src_conn_rate.seconds) { 1884 yyerror("'max-src-conn-rate' " 1885 "values must be > 0"); 1886 YYERROR; 1887 } 1888 if (o->data.max_src_conn_rate.limit > 1889 PF_THRESHOLD_MAX) { 1890 yyerror("'max-src-conn-rate' " 1891 "maximum rate must be < %u", 1892 PF_THRESHOLD_MAX); 1893 YYERROR; 1894 } 1895 r.max_src_conn_rate.limit = 1896 o->data.max_src_conn_rate.limit; 1897 r.max_src_conn_rate.seconds = 1898 o->data.max_src_conn_rate.seconds; 1899 r.rule_flag |= PFRULE_SRCTRACK | 1900 PFRULE_RULESRCTRACK; 1901 break; 1902 case PF_STATE_OPT_MAX_SRC_NODES: 1903 if (r.max_src_nodes) { 1904 yyerror("state option " 1905 "'max-src-nodes' " 1906 "multiple definitions"); 1907 YYERROR; 1908 } 1909 if (o->data.max_src_nodes == 0) { 1910 yyerror("'max-src-nodes' must " 1911 "be > 0"); 1912 YYERROR; 1913 } 1914 r.max_src_nodes = 1915 o->data.max_src_nodes; 1916 r.rule_flag |= PFRULE_SRCTRACK | 1917 PFRULE_RULESRCTRACK; 1918 break; 1919 case PF_STATE_OPT_STATELOCK: 1920 if (statelock) { 1921 yyerror("state locking option: " 1922 "multiple definitions"); 1923 YYERROR; 1924 } 1925 statelock = 1; 1926 r.rule_flag |= o->data.statelock; 1927 break; 1928 case PF_STATE_OPT_SLOPPY: 1929 if (r.rule_flag & PFRULE_STATESLOPPY) { 1930 yyerror("state sloppy option: " 1931 "multiple definitions"); 1932 YYERROR; 1933 } 1934 r.rule_flag |= PFRULE_STATESLOPPY; 1935 break; 1936 case PF_STATE_OPT_PFLOW: 1937 if (r.rule_flag & PFRULE_PFLOW) { 1938 yyerror("state pflow " 1939 "option: multiple " 1940 "definitions"); 1941 YYERROR; 1942 } 1943 r.rule_flag |= PFRULE_PFLOW; 1944 break; 1945 case PF_STATE_OPT_TIMEOUT: 1946 if (o->data.timeout.number == 1947 PFTM_ADAPTIVE_START || 1948 o->data.timeout.number == 1949 PFTM_ADAPTIVE_END) 1950 adaptive = 1; 1951 if (r.timeout[o->data.timeout.number]) { 1952 yyerror("state timeout %s " 1953 "multiple definitions", 1954 pf_timeouts[o->data. 1955 timeout.number].name); 1956 YYERROR; 1957 } 1958 r.timeout[o->data.timeout.number] = 1959 o->data.timeout.seconds; 1960 } 1961 o = o->next; 1962 if (!defaults) 1963 free(p); 1964 } 1965 1966 /* 'flags S/SA' by default on stateful rules */ 1967 if (!r.action && !r.flags && !r.flagset && 1968 !$8.fragment && !($8.marker & FOM_FLAGS) && 1969 r.keep_state) { 1970 r.flags = parse_flags("S"); 1971 r.flagset = parse_flags("SA"); 1972 } 1973 if (!adaptive && r.max_states) { 1974 r.timeout[PFTM_ADAPTIVE_START] = 1975 (r.max_states / 10) * 6; 1976 r.timeout[PFTM_ADAPTIVE_END] = 1977 (r.max_states / 10) * 12; 1978 } 1979 if (r.rule_flag & PFRULE_SRCTRACK) { 1980 if (srctrack == PF_SRCTRACK_GLOBAL && 1981 r.max_src_nodes) { 1982 yyerror("'max-src-nodes' is " 1983 "incompatible with " 1984 "'source-track global'"); 1985 YYERROR; 1986 } 1987 if (srctrack == PF_SRCTRACK_GLOBAL && 1988 r.max_src_conn) { 1989 yyerror("'max-src-conn' is " 1990 "incompatible with " 1991 "'source-track global'"); 1992 YYERROR; 1993 } 1994 if (srctrack == PF_SRCTRACK_GLOBAL && 1995 r.max_src_conn_rate.seconds) { 1996 yyerror("'max-src-conn-rate' is " 1997 "incompatible with " 1998 "'source-track global'"); 1999 YYERROR; 2000 } 2001 if (r.timeout[PFTM_SRC_NODE] < 2002 r.max_src_conn_rate.seconds) 2003 r.timeout[PFTM_SRC_NODE] = 2004 r.max_src_conn_rate.seconds; 2005 r.rule_flag |= PFRULE_SRCTRACK; 2006 if (srctrack == PF_SRCTRACK_RULE) 2007 r.rule_flag |= PFRULE_RULESRCTRACK; 2008 } 2009 if (r.keep_state && !statelock) 2010 r.rule_flag |= default_statelock; 2011 2012 if ($8.fragment) 2013 r.rule_flag |= PFRULE_FRAGMENT; 2014 r.allow_opts = $8.allowopts; 2015 2016 decide_address_family($7.src.host, &r.af); 2017 decide_address_family($7.dst.host, &r.af); 2018 2019 if ($8.route.rt) { 2020 if (!r.direction) { 2021 yyerror("direction must be explicit " 2022 "with rules that specify routing"); 2023 YYERROR; 2024 } 2025 r.rt = $8.route.rt; 2026 r.route.opts = $8.route.pool_opts; 2027 if ($8.route.key != NULL) 2028 memcpy(&r.route.key, $8.route.key, 2029 sizeof(struct pf_poolhashkey)); 2030 } 2031 if (r.rt && r.rt != PF_FASTROUTE) { 2032 decide_address_family($8.route.host, &r.af); 2033 if ((r.route.opts & PF_POOL_TYPEMASK) == 2034 PF_POOL_NONE && ($8.route.host->next != NULL || 2035 $8.route.host->addr.type == PF_ADDR_TABLE || 2036 DYNIF_MULTIADDR($8.route.host->addr))) 2037 r.route.opts |= PF_POOL_ROUNDROBIN; 2038 if ((r.route.opts & PF_POOL_TYPEMASK) != 2039 PF_POOL_ROUNDROBIN && 2040 disallow_table($8.route.host, 2041 "tables are only " 2042 "supported in round-robin routing pools")) 2043 YYERROR; 2044 if ((r.route.opts & PF_POOL_TYPEMASK) != 2045 PF_POOL_ROUNDROBIN && 2046 disallow_alias($8.route.host, 2047 "interface (%s) " 2048 "is only supported in round-robin " 2049 "routing pools")) 2050 YYERROR; 2051 if ($8.route.host->next != NULL) { 2052 if ((r.route.opts & PF_POOL_TYPEMASK) != 2053 PF_POOL_ROUNDROBIN) { 2054 yyerror("r.route.opts must " 2055 "be PF_POOL_ROUNDROBIN"); 2056 YYERROR; 2057 } 2058 } 2059 /* fake redirspec */ 2060 if (($8.rroute.rdr = calloc(1, 2061 sizeof(*$8.rroute.rdr))) == NULL) 2062 err(1, "$8.rroute.rdr"); 2063 $8.rroute.rdr->host = $8.route.host; 2064 } 2065 if ($8.queues.qname != NULL) { 2066 if (strlcpy(r.qname, $8.queues.qname, 2067 sizeof(r.qname)) >= sizeof(r.qname)) { 2068 yyerror("rule qname too long (max " 2069 "%d chars)", sizeof(r.qname)-1); 2070 YYERROR; 2071 } 2072 free($8.queues.qname); 2073 } 2074 if ($8.queues.pqname != NULL) { 2075 if (strlcpy(r.pqname, $8.queues.pqname, 2076 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2077 yyerror("rule pqname too long (max " 2078 "%d chars)", sizeof(r.pqname)-1); 2079 YYERROR; 2080 } 2081 free($8.queues.pqname); 2082 } 2083 if ((r.divert.port = $8.divert.port)) { 2084 if (r.direction == PF_OUT) { 2085 if ($8.divert.addr) { 2086 yyerror("address specified " 2087 "for outgoing divert"); 2088 YYERROR; 2089 } 2090 bzero(&r.divert.addr, 2091 sizeof(r.divert.addr)); 2092 } else { 2093 if (!$8.divert.addr) { 2094 yyerror("no address specified " 2095 "for incoming divert"); 2096 YYERROR; 2097 } 2098 if ($8.divert.addr->af != r.af) { 2099 yyerror("address family " 2100 "mismatch for divert"); 2101 YYERROR; 2102 } 2103 r.divert.addr = 2104 $8.divert.addr->addr.v.a.addr; 2105 } 2106 } 2107 r.divert_packet.port = $8.divert_packet.port; 2108 2109 expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, &$8.rroute, $6, 2110 $7.src_os, 2111 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 2112 $8.uid, $8.gid, $8.rcv, $8.icmpspec, ""); 2113 } 2114 ; 2115 2116filter_opts : { 2117 bzero(&filter_opts, sizeof filter_opts); 2118 filter_opts.rtableid = -1; 2119 } 2120 filter_opts_l 2121 { $$ = filter_opts; } 2122 | /* empty */ { 2123 bzero(&filter_opts, sizeof filter_opts); 2124 filter_opts.rtableid = -1; 2125 $$ = filter_opts; 2126 } 2127 ; 2128 2129filter_opts_l : filter_opts_l filter_opt 2130 | filter_opt 2131 ; 2132 2133filter_opt : USER uids { 2134 if (filter_opts.uid) 2135 $2->tail->next = filter_opts.uid; 2136 filter_opts.uid = $2; 2137 } 2138 | GROUP gids { 2139 if (filter_opts.gid) 2140 $2->tail->next = filter_opts.gid; 2141 filter_opts.gid = $2; 2142 } 2143 | flags { 2144 if (filter_opts.marker & FOM_FLAGS) { 2145 yyerror("flags cannot be redefined"); 2146 YYERROR; 2147 } 2148 filter_opts.marker |= FOM_FLAGS; 2149 filter_opts.flags.b1 |= $1.b1; 2150 filter_opts.flags.b2 |= $1.b2; 2151 filter_opts.flags.w |= $1.w; 2152 filter_opts.flags.w2 |= $1.w2; 2153 } 2154 | icmpspec { 2155 if (filter_opts.marker & FOM_ICMP) { 2156 yyerror("icmp-type cannot be redefined"); 2157 YYERROR; 2158 } 2159 filter_opts.marker |= FOM_ICMP; 2160 filter_opts.icmpspec = $1; 2161 } 2162 | TOS tos { 2163 if (filter_opts.marker & FOM_TOS) { 2164 yyerror("tos cannot be redefined"); 2165 YYERROR; 2166 } 2167 filter_opts.marker |= FOM_TOS; 2168 filter_opts.tos = $2; 2169 } 2170 | keep { 2171 if (filter_opts.marker & FOM_KEEP) { 2172 yyerror("modulate or keep cannot be redefined"); 2173 YYERROR; 2174 } 2175 filter_opts.marker |= FOM_KEEP; 2176 filter_opts.keep.action = $1.action; 2177 filter_opts.keep.options = $1.options; 2178 } 2179 | FRAGMENT { 2180 filter_opts.fragment = 1; 2181 } 2182 | ALLOWOPTS { 2183 filter_opts.allowopts = 1; 2184 } 2185 | LABEL label { 2186 if (filter_opts.label) { 2187 yyerror("label cannot be redefined"); 2188 YYERROR; 2189 } 2190 filter_opts.label = $2; 2191 } 2192 | QUEUE qname { 2193 if (filter_opts.queues.qname) { 2194 yyerror("queue cannot be redefined"); 2195 YYERROR; 2196 } 2197 filter_opts.queues = $2; 2198 } 2199 | TAG string { 2200 filter_opts.tag = $2; 2201 } 2202 | not TAGGED string { 2203 filter_opts.match_tag = $3; 2204 filter_opts.match_tag_not = $1; 2205 } 2206 | PROBABILITY probability { 2207 double p; 2208 2209 p = floor($2 * UINT_MAX + 0.5); 2210 if (p < 0.0 || p > UINT_MAX) { 2211 yyerror("invalid probability: %g%%", $2 * 100); 2212 YYERROR; 2213 } 2214 filter_opts.prob = (u_int32_t)p; 2215 if (filter_opts.prob == 0) 2216 filter_opts.prob = 1; 2217 } 2218 | RTABLE NUMBER { 2219 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 2220 yyerror("invalid rtable id"); 2221 YYERROR; 2222 } 2223 filter_opts.rtableid = $2; 2224 } 2225 | DIVERTTO STRING PORT portplain { 2226 if ((filter_opts.divert.addr = host($2)) == NULL) { 2227 yyerror("could not parse divert address: %s", 2228 $2); 2229 free($2); 2230 YYERROR; 2231 } 2232 free($2); 2233 filter_opts.divert.port = $4.a; 2234 if (!filter_opts.divert.port) { 2235 yyerror("invalid divert port: %u", ntohs($4.a)); 2236 YYERROR; 2237 } 2238 } 2239 | DIVERTREPLY { 2240 filter_opts.divert.port = 1; /* some random value */ 2241 } 2242 | DIVERTPACKET PORT number { 2243 /* 2244 * If IP reassembly was not turned off, also 2245 * forcibly enable TCP reassembly by default. 2246 */ 2247 if (pf->reassemble & PF_REASS_ENABLED) 2248 filter_opts.marker |= FOM_SCRUB_TCP; 2249 2250 if ($3 < 1 || $3 > 65535) { 2251 yyerror("invalid divert port"); 2252 YYERROR; 2253 } 2254 2255 filter_opts.divert_packet.port = htons($3); 2256 } 2257 | SCRUB '(' scrub_opts ')' { 2258 filter_opts.nodf = $3.nodf; 2259 filter_opts.minttl = $3.minttl; 2260 filter_opts.settos = $3.settos; 2261 filter_opts.randomid = $3.randomid; 2262 filter_opts.max_mss = $3.maxmss; 2263 if ($3.reassemble_tcp) 2264 filter_opts.marker |= FOM_SCRUB_TCP; 2265 filter_opts.marker |= $3.marker; 2266 } 2267 | NATTO redirpool pool_opts { 2268 if (filter_opts.nat.rdr) { 2269 yyerror("cannot respecify nat-to/binat-to"); 2270 YYERROR; 2271 } 2272 filter_opts.nat.rdr = $2; 2273 memcpy(&filter_opts.nat.pool_opts, &$3, 2274 sizeof(filter_opts.nat.pool_opts)); 2275 } 2276 | RDRTO redirpool pool_opts { 2277 if (filter_opts.rdr.rdr) { 2278 yyerror("cannot respecify rdr-to"); 2279 YYERROR; 2280 } 2281 filter_opts.rdr.rdr = $2; 2282 memcpy(&filter_opts.rdr.pool_opts, &$3, 2283 sizeof(filter_opts.rdr.pool_opts)); 2284 } 2285 | BINATTO redirpool pool_opts { 2286 if (filter_opts.nat.rdr) { 2287 yyerror("cannot respecify nat-to/binat-to"); 2288 YYERROR; 2289 } 2290 filter_opts.nat.rdr = $2; 2291 filter_opts.nat.binat = 1; 2292 memcpy(&filter_opts.nat.pool_opts, &$3, 2293 sizeof(filter_opts.nat.pool_opts)); 2294 filter_opts.nat.pool_opts.staticport = 1; 2295 } 2296 | FASTROUTE { 2297 filter_opts.route.host = NULL; 2298 filter_opts.route.rt = PF_FASTROUTE; 2299 filter_opts.route.pool_opts = 0; 2300 } 2301 | ROUTETO routespec pool_opts { 2302 filter_opts.route.host = $2; 2303 filter_opts.route.rt = PF_ROUTETO; 2304 filter_opts.route.pool_opts = $3.type | $3.opts; 2305 if ($3.key != NULL) 2306 filter_opts.route.key = $3.key; 2307 } 2308 | REPLYTO routespec pool_opts { 2309 filter_opts.route.host = $2; 2310 filter_opts.route.rt = PF_REPLYTO; 2311 filter_opts.route.pool_opts = $3.type | $3.opts; 2312 if ($3.key != NULL) 2313 filter_opts.route.key = $3.key; 2314 } 2315 | DUPTO routespec pool_opts { 2316 filter_opts.route.host = $2; 2317 filter_opts.route.rt = PF_DUPTO; 2318 filter_opts.route.pool_opts = $3.type | $3.opts; 2319 if ($3.key != NULL) 2320 filter_opts.route.key = $3.key; 2321 } 2322 | RECEIVEDON if_item { 2323 if (filter_opts.rcv) { 2324 yyerror("cannot respecify received-on"); 2325 YYERROR; 2326 } 2327 filter_opts.rcv = $2; 2328 } 2329 ; 2330 2331probability : STRING { 2332 char *e; 2333 double p = strtod($1, &e); 2334 2335 if (*e == '%') { 2336 p *= 0.01; 2337 e++; 2338 } 2339 if (*e) { 2340 yyerror("invalid probability: %s", $1); 2341 free($1); 2342 YYERROR; 2343 } 2344 free($1); 2345 $$ = p; 2346 } 2347 | NUMBER { 2348 $$ = (double)$1; 2349 } 2350 ; 2351 2352 2353action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2354 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 2355 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2356 ; 2357 2358blockspec : /* empty */ { 2359 $$.b2 = blockpolicy; 2360 $$.w = returnicmpdefault; 2361 $$.w2 = returnicmp6default; 2362 } 2363 | DROP { 2364 $$.b2 = PFRULE_DROP; 2365 $$.w = 0; 2366 $$.w2 = 0; 2367 } 2368 | RETURNRST { 2369 $$.b2 = PFRULE_RETURNRST; 2370 $$.w = 0; 2371 $$.w2 = 0; 2372 } 2373 | RETURNRST '(' TTL NUMBER ')' { 2374 if ($4 < 0 || $4 > 255) { 2375 yyerror("illegal ttl value %d", $4); 2376 YYERROR; 2377 } 2378 $$.b2 = PFRULE_RETURNRST; 2379 $$.w = $4; 2380 $$.w2 = 0; 2381 } 2382 | RETURNICMP { 2383 $$.b2 = PFRULE_RETURNICMP; 2384 $$.w = returnicmpdefault; 2385 $$.w2 = returnicmp6default; 2386 } 2387 | RETURNICMP6 { 2388 $$.b2 = PFRULE_RETURNICMP; 2389 $$.w = returnicmpdefault; 2390 $$.w2 = returnicmp6default; 2391 } 2392 | RETURNICMP '(' reticmpspec ')' { 2393 $$.b2 = PFRULE_RETURNICMP; 2394 $$.w = $3; 2395 $$.w2 = returnicmpdefault; 2396 } 2397 | RETURNICMP6 '(' reticmp6spec ')' { 2398 $$.b2 = PFRULE_RETURNICMP; 2399 $$.w = returnicmpdefault; 2400 $$.w2 = $3; 2401 } 2402 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2403 $$.b2 = PFRULE_RETURNICMP; 2404 $$.w = $3; 2405 $$.w2 = $5; 2406 } 2407 | RETURN { 2408 $$.b2 = PFRULE_RETURN; 2409 $$.w = returnicmpdefault; 2410 $$.w2 = returnicmp6default; 2411 } 2412 ; 2413 2414reticmpspec : STRING { 2415 if (!($$ = parseicmpspec($1, AF_INET))) { 2416 free($1); 2417 YYERROR; 2418 } 2419 free($1); 2420 } 2421 | NUMBER { 2422 u_int8_t icmptype; 2423 2424 if ($1 < 0 || $1 > 255) { 2425 yyerror("invalid icmp code %lu", $1); 2426 YYERROR; 2427 } 2428 icmptype = returnicmpdefault >> 8; 2429 $$ = (icmptype << 8 | $1); 2430 } 2431 ; 2432 2433reticmp6spec : STRING { 2434 if (!($$ = parseicmpspec($1, AF_INET6))) { 2435 free($1); 2436 YYERROR; 2437 } 2438 free($1); 2439 } 2440 | NUMBER { 2441 u_int8_t icmptype; 2442 2443 if ($1 < 0 || $1 > 255) { 2444 yyerror("invalid icmp code %lu", $1); 2445 YYERROR; 2446 } 2447 icmptype = returnicmp6default >> 8; 2448 $$ = (icmptype << 8 | $1); 2449 } 2450 ; 2451 2452dir : /* empty */ { $$ = PF_INOUT; } 2453 | IN { $$ = PF_IN; } 2454 | OUT { $$ = PF_OUT; } 2455 ; 2456 2457quick : /* empty */ { $$.quick = 0; } 2458 | QUICK { $$.quick = 1; } 2459 ; 2460 2461logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2462 | log { $$ = $1; $$.quick = 0; } 2463 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2464 | log QUICK { $$ = $1; $$.quick = 1; } 2465 | QUICK log { $$ = $2; $$.quick = 1; } 2466 ; 2467 2468log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2469 | LOG '(' logopts ')' { 2470 $$.log = PF_LOG | $3.log; 2471 $$.logif = $3.logif; 2472 } 2473 ; 2474 2475logopts : logopt { $$ = $1; } 2476 | logopts comma logopt { 2477 $$.log = $1.log | $3.log; 2478 $$.logif = $3.logif; 2479 if ($$.logif == 0) 2480 $$.logif = $1.logif; 2481 } 2482 ; 2483 2484logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2485 | MATCHES { $$.log = PF_LOG_MATCHES; $$.logif = 0; } 2486 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2487 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2488 | TO string { 2489 const char *errstr; 2490 u_int i; 2491 2492 $$.log = 0; 2493 if (strncmp($2, "pflog", 5)) { 2494 yyerror("%s: should be a pflog interface", $2); 2495 free($2); 2496 YYERROR; 2497 } 2498 i = strtonum($2 + 5, 0, 255, &errstr); 2499 if (errstr) { 2500 yyerror("%s: %s", $2, errstr); 2501 free($2); 2502 YYERROR; 2503 } 2504 free($2); 2505 $$.logif = i; 2506 } 2507 ; 2508 2509interface : /* empty */ { $$ = NULL; } 2510 | ON if_item_not { $$ = $2; } 2511 | ON '{' optnl if_list '}' { $$ = $4; } 2512 ; 2513 2514if_list : if_item_not optnl { $$ = $1; } 2515 | if_list comma if_item_not optnl { 2516 $1->tail->next = $3; 2517 $1->tail = $3; 2518 $$ = $1; 2519 } 2520 ; 2521 2522if_item_not : not if_item { $$ = $2; $$->not = $1; } 2523 ; 2524 2525if_item : STRING { 2526 struct node_host *n; 2527 2528 $$ = calloc(1, sizeof(struct node_if)); 2529 if ($$ == NULL) 2530 err(1, "if_item: calloc"); 2531 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2532 sizeof($$->ifname)) { 2533 free($1); 2534 free($$); 2535 yyerror("interface name too long"); 2536 YYERROR; 2537 } 2538 2539 if ((n = ifa_exists($1)) != NULL) 2540 $$->ifa_flags = n->ifa_flags; 2541 2542 free($1); 2543 $$->not = 0; 2544 $$->next = NULL; 2545 $$->tail = $$; 2546 } 2547 ; 2548 2549af : /* empty */ { $$ = 0; } 2550 | INET { $$ = AF_INET; } 2551 | INET6 { $$ = AF_INET6; } 2552 ; 2553 2554proto : /* empty */ { $$ = NULL; } 2555 | PROTO proto_item { $$ = $2; } 2556 | PROTO '{' optnl proto_list '}' { $$ = $4; } 2557 ; 2558 2559proto_list : proto_item optnl { $$ = $1; } 2560 | proto_list comma proto_item optnl { 2561 $1->tail->next = $3; 2562 $1->tail = $3; 2563 $$ = $1; 2564 } 2565 ; 2566 2567proto_item : protoval { 2568 u_int8_t pr; 2569 2570 pr = (u_int8_t)$1; 2571 if (pr == 0) { 2572 yyerror("proto 0 cannot be used"); 2573 YYERROR; 2574 } 2575 $$ = calloc(1, sizeof(struct node_proto)); 2576 if ($$ == NULL) 2577 err(1, "proto_item: calloc"); 2578 $$->proto = pr; 2579 $$->next = NULL; 2580 $$->tail = $$; 2581 } 2582 ; 2583 2584protoval : STRING { 2585 struct protoent *p; 2586 2587 p = getprotobyname($1); 2588 if (p == NULL) { 2589 yyerror("unknown protocol %s", $1); 2590 free($1); 2591 YYERROR; 2592 } 2593 $$ = p->p_proto; 2594 free($1); 2595 } 2596 | NUMBER { 2597 if ($1 < 0 || $1 > 255) { 2598 yyerror("protocol outside range"); 2599 YYERROR; 2600 } 2601 } 2602 ; 2603 2604fromto : ALL { 2605 $$.src.host = NULL; 2606 $$.src.port = NULL; 2607 $$.dst.host = NULL; 2608 $$.dst.port = NULL; 2609 $$.src_os = NULL; 2610 } 2611 | from os to { 2612 $$.src = $1; 2613 $$.src_os = $2; 2614 $$.dst = $3; 2615 } 2616 ; 2617 2618os : /* empty */ { $$ = NULL; } 2619 | OS xos { $$ = $2; } 2620 | OS '{' optnl os_list '}' { $$ = $4; } 2621 ; 2622 2623xos : STRING { 2624 $$ = calloc(1, sizeof(struct node_os)); 2625 if ($$ == NULL) 2626 err(1, "os: calloc"); 2627 $$->os = $1; 2628 $$->tail = $$; 2629 } 2630 ; 2631 2632os_list : xos optnl { $$ = $1; } 2633 | os_list comma xos optnl { 2634 $1->tail->next = $3; 2635 $1->tail = $3; 2636 $$ = $1; 2637 } 2638 ; 2639 2640from : /* empty */ { 2641 $$.host = NULL; 2642 $$.port = NULL; 2643 } 2644 | FROM ipportspec { 2645 $$ = $2; 2646 } 2647 ; 2648 2649to : /* empty */ { 2650 $$.host = NULL; 2651 $$.port = NULL; 2652 } 2653 | TO ipportspec { 2654 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2655 "not permitted in a destination address")) 2656 YYERROR; 2657 $$ = $2; 2658 } 2659 ; 2660 2661ipportspec : ipspec { 2662 $$.host = $1; 2663 $$.port = NULL; 2664 } 2665 | ipspec PORT portspec { 2666 $$.host = $1; 2667 $$.port = $3; 2668 } 2669 | PORT portspec { 2670 $$.host = NULL; 2671 $$.port = $2; 2672 } 2673 ; 2674 2675optnl : '\n' optnl 2676 | /* empty */ 2677 ; 2678 2679ipspec : ANY { $$ = NULL; } 2680 | xhost { $$ = $1; } 2681 | '{' optnl host_list '}' { $$ = $3; } 2682 ; 2683 2684host_list : ipspec optnl { $$ = $1; } 2685 | host_list comma ipspec optnl { 2686 if ($1 == NULL) { 2687 freehostlist($3); 2688 $$ = $1; 2689 } else if ($3 == NULL) { 2690 freehostlist($1); 2691 $$ = $3; 2692 } else { 2693 $1->tail->next = $3; 2694 $1->tail = $3->tail; 2695 $$ = $1; 2696 } 2697 } 2698 ; 2699 2700xhost : not host { 2701 struct node_host *n; 2702 2703 for (n = $2; n != NULL; n = n->next) 2704 n->not = $1; 2705 $$ = $2; 2706 } 2707 | not NOROUTE { 2708 $$ = calloc(1, sizeof(struct node_host)); 2709 if ($$ == NULL) 2710 err(1, "xhost: calloc"); 2711 $$->addr.type = PF_ADDR_NOROUTE; 2712 $$->next = NULL; 2713 $$->not = $1; 2714 $$->tail = $$; 2715 } 2716 | not URPFFAILED { 2717 $$ = calloc(1, sizeof(struct node_host)); 2718 if ($$ == NULL) 2719 err(1, "xhost: calloc"); 2720 $$->addr.type = PF_ADDR_URPFFAILED; 2721 $$->next = NULL; 2722 $$->not = $1; 2723 $$->tail = $$; 2724 } 2725 ; 2726 2727host : STRING { 2728 if (($$ = host($1)) == NULL) { 2729 /* error. "any" is handled elsewhere */ 2730 free($1); 2731 yyerror("could not parse host specification"); 2732 YYERROR; 2733 } 2734 free($1); 2735 2736 } 2737 | STRING '-' STRING { 2738 struct node_host *b, *e; 2739 2740 if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 2741 free($1); 2742 free($3); 2743 yyerror("could not parse host specification"); 2744 YYERROR; 2745 } 2746 if (b->af != e->af || 2747 b->addr.type != PF_ADDR_ADDRMASK || 2748 e->addr.type != PF_ADDR_ADDRMASK || 2749 unmask(&b->addr.v.a.mask, b->af) != 2750 (b->af == AF_INET ? 32 : 128) || 2751 unmask(&e->addr.v.a.mask, e->af) != 2752 (e->af == AF_INET ? 32 : 128) || 2753 b->next != NULL || b->not || 2754 e->next != NULL || e->not) { 2755 free(b); 2756 free(e); 2757 free($1); 2758 free($3); 2759 yyerror("invalid address range"); 2760 YYERROR; 2761 } 2762 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 2763 sizeof(b->addr.v.a.mask)); 2764 b->addr.type = PF_ADDR_RANGE; 2765 $$ = b; 2766 free(e); 2767 free($1); 2768 free($3); 2769 } 2770 | STRING '/' NUMBER { 2771 char *buf; 2772 2773 if (asprintf(&buf, "%s/%lld", $1, $3) == -1) 2774 err(1, "host: asprintf"); 2775 free($1); 2776 if (($$ = host(buf)) == NULL) { 2777 /* error. "any" is handled elsewhere */ 2778 free(buf); 2779 yyerror("could not parse host specification"); 2780 YYERROR; 2781 } 2782 free(buf); 2783 } 2784 | NUMBER '/' NUMBER { 2785 char *buf; 2786 2787 /* ie. for 10/8 parsing */ 2788 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 2789 err(1, "host: asprintf"); 2790 if (($$ = host(buf)) == NULL) { 2791 /* error. "any" is handled elsewhere */ 2792 free(buf); 2793 yyerror("could not parse host specification"); 2794 YYERROR; 2795 } 2796 free(buf); 2797 } 2798 | dynaddr 2799 | dynaddr '/' NUMBER { 2800 struct node_host *n; 2801 2802 if ($3 < 0 || $3 > 128) { 2803 yyerror("bit number too big"); 2804 YYERROR; 2805 } 2806 $$ = $1; 2807 for (n = $1; n != NULL; n = n->next) 2808 set_ipmask(n, $3); 2809 } 2810 | '<' STRING '>' { 2811 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2812 yyerror("table name '%s' too long", $2); 2813 free($2); 2814 YYERROR; 2815 } 2816 $$ = calloc(1, sizeof(struct node_host)); 2817 if ($$ == NULL) 2818 err(1, "host: calloc"); 2819 $$->addr.type = PF_ADDR_TABLE; 2820 if (strlcpy($$->addr.v.tblname, $2, 2821 sizeof($$->addr.v.tblname)) >= 2822 sizeof($$->addr.v.tblname)) 2823 errx(1, "host: strlcpy"); 2824 free($2); 2825 $$->next = NULL; 2826 $$->tail = $$; 2827 } 2828 | ROUTE STRING { 2829 $$ = calloc(1, sizeof(struct node_host)); 2830 if ($$ == NULL) { 2831 free($2); 2832 err(1, "host: calloc"); 2833 } 2834 $$->addr.type = PF_ADDR_RTLABEL; 2835 if (strlcpy($$->addr.v.rtlabelname, $2, 2836 sizeof($$->addr.v.rtlabelname)) >= 2837 sizeof($$->addr.v.rtlabelname)) { 2838 yyerror("route label too long, max %u chars", 2839 sizeof($$->addr.v.rtlabelname) - 1); 2840 free($2); 2841 free($$); 2842 YYERROR; 2843 } 2844 $$->next = NULL; 2845 $$->tail = $$; 2846 free($2); 2847 } 2848 ; 2849 2850number : NUMBER 2851 | STRING { 2852 u_long ulval; 2853 2854 if (atoul($1, &ulval) == -1) { 2855 yyerror("%s is not a number", $1); 2856 free($1); 2857 YYERROR; 2858 } else 2859 $$ = ulval; 2860 free($1); 2861 } 2862 ; 2863 2864dynaddr : '(' STRING ')' { 2865 int flags = 0; 2866 char *p, *op; 2867 2868 op = $2; 2869 if (!isalpha(op[0])) { 2870 yyerror("invalid interface name '%s'", op); 2871 free(op); 2872 YYERROR; 2873 } 2874 while ((p = strrchr($2, ':')) != NULL) { 2875 if (!strcmp(p+1, "network")) 2876 flags |= PFI_AFLAG_NETWORK; 2877 else if (!strcmp(p+1, "broadcast")) 2878 flags |= PFI_AFLAG_BROADCAST; 2879 else if (!strcmp(p+1, "peer")) 2880 flags |= PFI_AFLAG_PEER; 2881 else if (!strcmp(p+1, "0")) 2882 flags |= PFI_AFLAG_NOALIAS; 2883 else { 2884 yyerror("interface %s has bad modifier", 2885 $2); 2886 free(op); 2887 YYERROR; 2888 } 2889 *p = '\0'; 2890 } 2891 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2892 free(op); 2893 yyerror("illegal combination of " 2894 "interface modifiers"); 2895 YYERROR; 2896 } 2897 $$ = calloc(1, sizeof(struct node_host)); 2898 if ($$ == NULL) 2899 err(1, "address: calloc"); 2900 $$->af = 0; 2901 set_ipmask($$, 128); 2902 $$->addr.type = PF_ADDR_DYNIFTL; 2903 $$->addr.iflags = flags; 2904 if (strlcpy($$->addr.v.ifname, $2, 2905 sizeof($$->addr.v.ifname)) >= 2906 sizeof($$->addr.v.ifname)) { 2907 free(op); 2908 free($$); 2909 yyerror("interface name too long"); 2910 YYERROR; 2911 } 2912 free(op); 2913 $$->next = NULL; 2914 $$->tail = $$; 2915 } 2916 ; 2917 2918portspec : port_item { $$ = $1; } 2919 | '{' optnl port_list '}' { $$ = $3; } 2920 ; 2921 2922port_list : port_item optnl { $$ = $1; } 2923 | port_list comma port_item optnl { 2924 $1->tail->next = $3; 2925 $1->tail = $3; 2926 $$ = $1; 2927 } 2928 ; 2929 2930port_item : portrange { 2931 $$ = calloc(1, sizeof(struct node_port)); 2932 if ($$ == NULL) 2933 err(1, "port_item: calloc"); 2934 $$->port[0] = $1.a; 2935 $$->port[1] = $1.b; 2936 if ($1.t) 2937 $$->op = PF_OP_RRG; 2938 else 2939 $$->op = PF_OP_EQ; 2940 $$->next = NULL; 2941 $$->tail = $$; 2942 } 2943 | unaryop portrange { 2944 if ($2.t) { 2945 yyerror("':' cannot be used with an other " 2946 "port operator"); 2947 YYERROR; 2948 } 2949 $$ = calloc(1, sizeof(struct node_port)); 2950 if ($$ == NULL) 2951 err(1, "port_item: calloc"); 2952 $$->port[0] = $2.a; 2953 $$->port[1] = $2.b; 2954 $$->op = $1; 2955 $$->next = NULL; 2956 $$->tail = $$; 2957 } 2958 | portrange PORTBINARY portrange { 2959 if ($1.t || $3.t) { 2960 yyerror("':' cannot be used with an other " 2961 "port operator"); 2962 YYERROR; 2963 } 2964 $$ = calloc(1, sizeof(struct node_port)); 2965 if ($$ == NULL) 2966 err(1, "port_item: calloc"); 2967 $$->port[0] = $1.a; 2968 $$->port[1] = $3.a; 2969 $$->op = $2; 2970 $$->next = NULL; 2971 $$->tail = $$; 2972 } 2973 ; 2974 2975portplain : numberstring { 2976 if (parseport($1, &$$, 0) == -1) { 2977 free($1); 2978 YYERROR; 2979 } 2980 free($1); 2981 } 2982 ; 2983 2984portrange : numberstring { 2985 if (parseport($1, &$$, PPORT_RANGE) == -1) { 2986 free($1); 2987 YYERROR; 2988 } 2989 free($1); 2990 } 2991 ; 2992 2993uids : uid_item { $$ = $1; } 2994 | '{' optnl uid_list '}' { $$ = $3; } 2995 ; 2996 2997uid_list : uid_item optnl { $$ = $1; } 2998 | uid_list comma uid_item optnl { 2999 $1->tail->next = $3; 3000 $1->tail = $3; 3001 $$ = $1; 3002 } 3003 ; 3004 3005uid_item : uid { 3006 $$ = calloc(1, sizeof(struct node_uid)); 3007 if ($$ == NULL) 3008 err(1, "uid_item: calloc"); 3009 $$->uid[0] = $1; 3010 $$->uid[1] = $1; 3011 $$->op = PF_OP_EQ; 3012 $$->next = NULL; 3013 $$->tail = $$; 3014 } 3015 | unaryop uid { 3016 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3017 yyerror("user unknown requires operator = or " 3018 "!="); 3019 YYERROR; 3020 } 3021 $$ = calloc(1, sizeof(struct node_uid)); 3022 if ($$ == NULL) 3023 err(1, "uid_item: calloc"); 3024 $$->uid[0] = $2; 3025 $$->uid[1] = $2; 3026 $$->op = $1; 3027 $$->next = NULL; 3028 $$->tail = $$; 3029 } 3030 | uid PORTBINARY uid { 3031 if ($1 == UID_MAX || $3 == UID_MAX) { 3032 yyerror("user unknown requires operator = or " 3033 "!="); 3034 YYERROR; 3035 } 3036 $$ = calloc(1, sizeof(struct node_uid)); 3037 if ($$ == NULL) 3038 err(1, "uid_item: calloc"); 3039 $$->uid[0] = $1; 3040 $$->uid[1] = $3; 3041 $$->op = $2; 3042 $$->next = NULL; 3043 $$->tail = $$; 3044 } 3045 ; 3046 3047uid : STRING { 3048 if (!strcmp($1, "unknown")) 3049 $$ = UID_MAX; 3050 else { 3051 struct passwd *pw; 3052 3053 if ((pw = getpwnam($1)) == NULL) { 3054 yyerror("unknown user %s", $1); 3055 free($1); 3056 YYERROR; 3057 } 3058 $$ = pw->pw_uid; 3059 } 3060 free($1); 3061 } 3062 | NUMBER { 3063 if ($1 < 0 || $1 >= UID_MAX) { 3064 yyerror("illegal uid value %lu", $1); 3065 YYERROR; 3066 } 3067 $$ = $1; 3068 } 3069 ; 3070 3071gids : gid_item { $$ = $1; } 3072 | '{' optnl gid_list '}' { $$ = $3; } 3073 ; 3074 3075gid_list : gid_item optnl { $$ = $1; } 3076 | gid_list comma gid_item optnl { 3077 $1->tail->next = $3; 3078 $1->tail = $3; 3079 $$ = $1; 3080 } 3081 ; 3082 3083gid_item : gid { 3084 $$ = calloc(1, sizeof(struct node_gid)); 3085 if ($$ == NULL) 3086 err(1, "gid_item: calloc"); 3087 $$->gid[0] = $1; 3088 $$->gid[1] = $1; 3089 $$->op = PF_OP_EQ; 3090 $$->next = NULL; 3091 $$->tail = $$; 3092 } 3093 | unaryop gid { 3094 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3095 yyerror("group unknown requires operator = or " 3096 "!="); 3097 YYERROR; 3098 } 3099 $$ = calloc(1, sizeof(struct node_gid)); 3100 if ($$ == NULL) 3101 err(1, "gid_item: calloc"); 3102 $$->gid[0] = $2; 3103 $$->gid[1] = $2; 3104 $$->op = $1; 3105 $$->next = NULL; 3106 $$->tail = $$; 3107 } 3108 | gid PORTBINARY gid { 3109 if ($1 == GID_MAX || $3 == GID_MAX) { 3110 yyerror("group unknown requires operator = or " 3111 "!="); 3112 YYERROR; 3113 } 3114 $$ = calloc(1, sizeof(struct node_gid)); 3115 if ($$ == NULL) 3116 err(1, "gid_item: calloc"); 3117 $$->gid[0] = $1; 3118 $$->gid[1] = $3; 3119 $$->op = $2; 3120 $$->next = NULL; 3121 $$->tail = $$; 3122 } 3123 ; 3124 3125gid : STRING { 3126 if (!strcmp($1, "unknown")) 3127 $$ = GID_MAX; 3128 else { 3129 struct group *grp; 3130 3131 if ((grp = getgrnam($1)) == NULL) { 3132 yyerror("unknown group %s", $1); 3133 free($1); 3134 YYERROR; 3135 } 3136 $$ = grp->gr_gid; 3137 } 3138 free($1); 3139 } 3140 | NUMBER { 3141 if ($1 < 0 || $1 >= GID_MAX) { 3142 yyerror("illegal gid value %lu", $1); 3143 YYERROR; 3144 } 3145 $$ = $1; 3146 } 3147 ; 3148 3149flag : STRING { 3150 int f; 3151 3152 if ((f = parse_flags($1)) < 0) { 3153 yyerror("bad flags %s", $1); 3154 free($1); 3155 YYERROR; 3156 } 3157 free($1); 3158 $$.b1 = f; 3159 } 3160 ; 3161 3162flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3163 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3164 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3165 ; 3166 3167icmpspec : ICMPTYPE icmp_item { $$ = $2; } 3168 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3169 | ICMP6TYPE icmp6_item { $$ = $2; } 3170 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3171 ; 3172 3173icmp_list : icmp_item optnl { $$ = $1; } 3174 | icmp_list comma icmp_item optnl { 3175 $1->tail->next = $3; 3176 $1->tail = $3; 3177 $$ = $1; 3178 } 3179 ; 3180 3181icmp6_list : icmp6_item optnl { $$ = $1; } 3182 | icmp6_list comma icmp6_item optnl { 3183 $1->tail->next = $3; 3184 $1->tail = $3; 3185 $$ = $1; 3186 } 3187 ; 3188 3189icmp_item : icmptype { 3190 $$ = calloc(1, sizeof(struct node_icmp)); 3191 if ($$ == NULL) 3192 err(1, "icmp_item: calloc"); 3193 $$->type = $1; 3194 $$->code = 0; 3195 $$->proto = IPPROTO_ICMP; 3196 $$->next = NULL; 3197 $$->tail = $$; 3198 } 3199 | icmptype CODE STRING { 3200 const struct icmpcodeent *p; 3201 3202 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3203 yyerror("unknown icmp-code %s", $3); 3204 free($3); 3205 YYERROR; 3206 } 3207 3208 free($3); 3209 $$ = calloc(1, sizeof(struct node_icmp)); 3210 if ($$ == NULL) 3211 err(1, "icmp_item: calloc"); 3212 $$->type = $1; 3213 $$->code = p->code + 1; 3214 $$->proto = IPPROTO_ICMP; 3215 $$->next = NULL; 3216 $$->tail = $$; 3217 } 3218 | icmptype CODE NUMBER { 3219 if ($3 < 0 || $3 > 255) { 3220 yyerror("illegal icmp-code %lu", $3); 3221 YYERROR; 3222 } 3223 $$ = calloc(1, sizeof(struct node_icmp)); 3224 if ($$ == NULL) 3225 err(1, "icmp_item: calloc"); 3226 $$->type = $1; 3227 $$->code = $3 + 1; 3228 $$->proto = IPPROTO_ICMP; 3229 $$->next = NULL; 3230 $$->tail = $$; 3231 } 3232 ; 3233 3234icmp6_item : icmp6type { 3235 $$ = calloc(1, sizeof(struct node_icmp)); 3236 if ($$ == NULL) 3237 err(1, "icmp_item: calloc"); 3238 $$->type = $1; 3239 $$->code = 0; 3240 $$->proto = IPPROTO_ICMPV6; 3241 $$->next = NULL; 3242 $$->tail = $$; 3243 } 3244 | icmp6type CODE STRING { 3245 const struct icmpcodeent *p; 3246 3247 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3248 yyerror("unknown icmp6-code %s", $3); 3249 free($3); 3250 YYERROR; 3251 } 3252 free($3); 3253 3254 $$ = calloc(1, sizeof(struct node_icmp)); 3255 if ($$ == NULL) 3256 err(1, "icmp_item: calloc"); 3257 $$->type = $1; 3258 $$->code = p->code + 1; 3259 $$->proto = IPPROTO_ICMPV6; 3260 $$->next = NULL; 3261 $$->tail = $$; 3262 } 3263 | icmp6type CODE NUMBER { 3264 if ($3 < 0 || $3 > 255) { 3265 yyerror("illegal icmp-code %lu", $3); 3266 YYERROR; 3267 } 3268 $$ = calloc(1, sizeof(struct node_icmp)); 3269 if ($$ == NULL) 3270 err(1, "icmp_item: calloc"); 3271 $$->type = $1; 3272 $$->code = $3 + 1; 3273 $$->proto = IPPROTO_ICMPV6; 3274 $$->next = NULL; 3275 $$->tail = $$; 3276 } 3277 ; 3278 3279icmptype : STRING { 3280 const struct icmptypeent *p; 3281 3282 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3283 yyerror("unknown icmp-type %s", $1); 3284 free($1); 3285 YYERROR; 3286 } 3287 $$ = p->type + 1; 3288 free($1); 3289 } 3290 | NUMBER { 3291 if ($1 < 0 || $1 > 255) { 3292 yyerror("illegal icmp-type %lu", $1); 3293 YYERROR; 3294 } 3295 $$ = $1 + 1; 3296 } 3297 ; 3298 3299icmp6type : STRING { 3300 const struct icmptypeent *p; 3301 3302 if ((p = geticmptypebyname($1, AF_INET6)) == 3303 NULL) { 3304 yyerror("unknown icmp6-type %s", $1); 3305 free($1); 3306 YYERROR; 3307 } 3308 $$ = p->type + 1; 3309 free($1); 3310 } 3311 | NUMBER { 3312 if ($1 < 0 || $1 > 255) { 3313 yyerror("illegal icmp6-type %lu", $1); 3314 YYERROR; 3315 } 3316 $$ = $1 + 1; 3317 } 3318 ; 3319 3320tos : STRING { 3321 int val; 3322 if (map_tos($1, &val)) 3323 $$ = val; 3324 else if ($1[0] == '0' && $1[1] == 'x') 3325 $$ = strtoul($1, NULL, 16); 3326 else 3327 $$ = 256; /* flag bad argument */ 3328 if ($$ > 255) { 3329 yyerror("illegal tos value %s", $1); 3330 free($1); 3331 YYERROR; 3332 } 3333 free($1); 3334 } 3335 | NUMBER { 3336 $$ = $1; 3337 if ($$ > 255) { 3338 yyerror("illegal tos value %s", $1); 3339 YYERROR; 3340 } 3341 } 3342 ; 3343 3344sourcetrack : /* empty */ { $$ = PF_SRCTRACK; } 3345 | GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3346 | RULE { $$ = PF_SRCTRACK_RULE; } 3347 ; 3348 3349statelock : IFBOUND { 3350 $$ = PFRULE_IFBOUND; 3351 } 3352 | FLOATING { 3353 $$ = 0; 3354 } 3355 ; 3356 3357keep : NO STATE { 3358 $$.action = 0; 3359 $$.options = NULL; 3360 } 3361 | KEEP STATE state_opt_spec { 3362 $$.action = PF_STATE_NORMAL; 3363 $$.options = $3; 3364 } 3365 | MODULATE STATE state_opt_spec { 3366 $$.action = PF_STATE_MODULATE; 3367 $$.options = $3; 3368 } 3369 | SYNPROXY STATE state_opt_spec { 3370 $$.action = PF_STATE_SYNPROXY; 3371 $$.options = $3; 3372 } 3373 ; 3374 3375flush : /* empty */ { $$ = 0; } 3376 | FLUSH { $$ = PF_FLUSH; } 3377 | FLUSH GLOBAL { 3378 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3379 } 3380 ; 3381 3382state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3383 | /* empty */ { $$ = NULL; } 3384 ; 3385 3386state_opt_list : state_opt_item { $$ = $1; } 3387 | state_opt_list comma state_opt_item { 3388 $1->tail->next = $3; 3389 $1->tail = $3; 3390 $$ = $1; 3391 } 3392 ; 3393 3394state_opt_item : MAXIMUM NUMBER { 3395 if ($2 < 0 || $2 > UINT_MAX) { 3396 yyerror("only positive values permitted"); 3397 YYERROR; 3398 } 3399 $$ = calloc(1, sizeof(struct node_state_opt)); 3400 if ($$ == NULL) 3401 err(1, "state_opt_item: calloc"); 3402 $$->type = PF_STATE_OPT_MAX; 3403 $$->data.max_states = $2; 3404 $$->next = NULL; 3405 $$->tail = $$; 3406 } 3407 | NOSYNC { 3408 $$ = calloc(1, sizeof(struct node_state_opt)); 3409 if ($$ == NULL) 3410 err(1, "state_opt_item: calloc"); 3411 $$->type = PF_STATE_OPT_NOSYNC; 3412 $$->next = NULL; 3413 $$->tail = $$; 3414 } 3415 | MAXSRCSTATES NUMBER { 3416 if ($2 < 0 || $2 > UINT_MAX) { 3417 yyerror("only positive values permitted"); 3418 YYERROR; 3419 } 3420 $$ = calloc(1, sizeof(struct node_state_opt)); 3421 if ($$ == NULL) 3422 err(1, "state_opt_item: calloc"); 3423 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3424 $$->data.max_src_states = $2; 3425 $$->next = NULL; 3426 $$->tail = $$; 3427 } 3428 | MAXSRCCONN NUMBER { 3429 if ($2 < 0 || $2 > UINT_MAX) { 3430 yyerror("only positive values permitted"); 3431 YYERROR; 3432 } 3433 $$ = calloc(1, sizeof(struct node_state_opt)); 3434 if ($$ == NULL) 3435 err(1, "state_opt_item: calloc"); 3436 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3437 $$->data.max_src_conn = $2; 3438 $$->next = NULL; 3439 $$->tail = $$; 3440 } 3441 | MAXSRCCONNRATE NUMBER '/' NUMBER { 3442 if ($2 < 0 || $2 > UINT_MAX || 3443 $4 < 0 || $4 > UINT_MAX) { 3444 yyerror("only positive values permitted"); 3445 YYERROR; 3446 } 3447 $$ = calloc(1, sizeof(struct node_state_opt)); 3448 if ($$ == NULL) 3449 err(1, "state_opt_item: calloc"); 3450 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3451 $$->data.max_src_conn_rate.limit = $2; 3452 $$->data.max_src_conn_rate.seconds = $4; 3453 $$->next = NULL; 3454 $$->tail = $$; 3455 } 3456 | OVERLOAD '<' STRING '>' flush { 3457 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3458 yyerror("table name '%s' too long", $3); 3459 free($3); 3460 YYERROR; 3461 } 3462 $$ = calloc(1, sizeof(struct node_state_opt)); 3463 if ($$ == NULL) 3464 err(1, "state_opt_item: calloc"); 3465 if (strlcpy($$->data.overload.tblname, $3, 3466 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3467 errx(1, "state_opt_item: strlcpy"); 3468 free($3); 3469 $$->type = PF_STATE_OPT_OVERLOAD; 3470 $$->data.overload.flush = $5; 3471 $$->next = NULL; 3472 $$->tail = $$; 3473 } 3474 | MAXSRCNODES NUMBER { 3475 if ($2 < 0 || $2 > UINT_MAX) { 3476 yyerror("only positive values permitted"); 3477 YYERROR; 3478 } 3479 $$ = calloc(1, sizeof(struct node_state_opt)); 3480 if ($$ == NULL) 3481 err(1, "state_opt_item: calloc"); 3482 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3483 $$->data.max_src_nodes = $2; 3484 $$->next = NULL; 3485 $$->tail = $$; 3486 } 3487 | SOURCETRACK sourcetrack { 3488 $$ = calloc(1, sizeof(struct node_state_opt)); 3489 if ($$ == NULL) 3490 err(1, "state_opt_item: calloc"); 3491 $$->type = PF_STATE_OPT_SRCTRACK; 3492 $$->data.src_track = $2; 3493 $$->next = NULL; 3494 $$->tail = $$; 3495 } 3496 | statelock { 3497 $$ = calloc(1, sizeof(struct node_state_opt)); 3498 if ($$ == NULL) 3499 err(1, "state_opt_item: calloc"); 3500 $$->type = PF_STATE_OPT_STATELOCK; 3501 $$->data.statelock = $1; 3502 $$->next = NULL; 3503 $$->tail = $$; 3504 } 3505 | SLOPPY { 3506 $$ = calloc(1, sizeof(struct node_state_opt)); 3507 if ($$ == NULL) 3508 err(1, "state_opt_item: calloc"); 3509 $$->type = PF_STATE_OPT_SLOPPY; 3510 $$->next = NULL; 3511 $$->tail = $$; 3512 } 3513 | PFLOW { 3514 $$ = calloc(1, sizeof(struct node_state_opt)); 3515 if ($$ == NULL) 3516 err(1, "state_opt_item: calloc"); 3517 $$->type = PF_STATE_OPT_PFLOW; 3518 $$->next = NULL; 3519 $$->tail = $$; 3520 } 3521 | STRING NUMBER { 3522 int i; 3523 3524 if ($2 < 0 || $2 > UINT_MAX) { 3525 yyerror("only positive values permitted"); 3526 YYERROR; 3527 } 3528 for (i = 0; pf_timeouts[i].name && 3529 strcmp(pf_timeouts[i].name, $1); ++i) 3530 ; /* nothing */ 3531 if (!pf_timeouts[i].name) { 3532 yyerror("illegal timeout name %s", $1); 3533 free($1); 3534 YYERROR; 3535 } 3536 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3537 yyerror("illegal state timeout %s", $1); 3538 free($1); 3539 YYERROR; 3540 } 3541 free($1); 3542 $$ = calloc(1, sizeof(struct node_state_opt)); 3543 if ($$ == NULL) 3544 err(1, "state_opt_item: calloc"); 3545 $$->type = PF_STATE_OPT_TIMEOUT; 3546 $$->data.timeout.number = pf_timeouts[i].timeout; 3547 $$->data.timeout.seconds = $2; 3548 $$->next = NULL; 3549 $$->tail = $$; 3550 } 3551 ; 3552 3553label : STRING { 3554 $$ = $1; 3555 } 3556 ; 3557 3558qname : STRING { 3559 $$.qname = $1; 3560 $$.pqname = NULL; 3561 } 3562 | '(' STRING ')' { 3563 $$.qname = $2; 3564 $$.pqname = NULL; 3565 } 3566 | '(' STRING comma STRING ')' { 3567 $$.qname = $2; 3568 $$.pqname = $4; 3569 } 3570 ; 3571 3572portstar : numberstring { 3573 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3574 free($1); 3575 YYERROR; 3576 } 3577 free($1); 3578 } 3579 ; 3580 3581redirspec : host { $$ = $1; } 3582 | '{' optnl redir_host_list '}' { $$ = $3; } 3583 ; 3584 3585redir_host_list : host optnl { 3586 if ($1->addr.type != PF_ADDR_ADDRMASK) { 3587 free($1); 3588 yyerror("only addresses can be listed for" 3589 "redirection pools "); 3590 YYERROR; 3591 } 3592 $$ = $1; 3593 } 3594 | redir_host_list comma host optnl { 3595 $1->tail->next = $3; 3596 $1->tail = $3->tail; 3597 $$ = $1; 3598 } 3599 ; 3600 3601redirpool : redirspec { 3602 $$ = calloc(1, sizeof(struct redirection)); 3603 if ($$ == NULL) 3604 err(1, "redirection: calloc"); 3605 $$->host = $1; 3606 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3607 } 3608 | redirspec PORT portstar { 3609 $$ = calloc(1, sizeof(struct redirection)); 3610 if ($$ == NULL) 3611 err(1, "redirection: calloc"); 3612 $$->host = $1; 3613 $$->rport = $3; 3614 } 3615 ; 3616 3617hashkey : /* empty */ 3618 { 3619 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3620 if ($$ == NULL) 3621 err(1, "hashkey: calloc"); 3622 $$->key32[0] = arc4random(); 3623 $$->key32[1] = arc4random(); 3624 $$->key32[2] = arc4random(); 3625 $$->key32[3] = arc4random(); 3626 } 3627 | string 3628 { 3629 if (!strncmp($1, "0x", 2)) { 3630 if (strlen($1) != 34) { 3631 free($1); 3632 yyerror("hex key must be 128 bits " 3633 "(32 hex digits) long"); 3634 YYERROR; 3635 } 3636 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3637 if ($$ == NULL) 3638 err(1, "hashkey: calloc"); 3639 3640 if (sscanf($1, "0x%8x%8x%8x%8x", 3641 &$$->key32[0], &$$->key32[1], 3642 &$$->key32[2], &$$->key32[3]) != 4) { 3643 free($$); 3644 free($1); 3645 yyerror("invalid hex key"); 3646 YYERROR; 3647 } 3648 } else { 3649 MD5_CTX context; 3650 3651 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3652 if ($$ == NULL) 3653 err(1, "hashkey: calloc"); 3654 MD5Init(&context); 3655 MD5Update(&context, (unsigned char *)$1, 3656 strlen($1)); 3657 MD5Final((unsigned char *)$$, &context); 3658 HTONL($$->key32[0]); 3659 HTONL($$->key32[1]); 3660 HTONL($$->key32[2]); 3661 HTONL($$->key32[3]); 3662 } 3663 free($1); 3664 } 3665 ; 3666 3667pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3668 pool_opts_l 3669 { $$ = pool_opts; } 3670 | /* empty */ { 3671 bzero(&pool_opts, sizeof pool_opts); 3672 $$ = pool_opts; 3673 } 3674 ; 3675 3676pool_opts_l : pool_opts_l pool_opt 3677 | pool_opt 3678 ; 3679 3680pool_opt : BITMASK { 3681 if (pool_opts.type) { 3682 yyerror("pool type cannot be redefined"); 3683 YYERROR; 3684 } 3685 pool_opts.type = PF_POOL_BITMASK; 3686 } 3687 | RANDOM { 3688 if (pool_opts.type) { 3689 yyerror("pool type cannot be redefined"); 3690 YYERROR; 3691 } 3692 pool_opts.type = PF_POOL_RANDOM; 3693 } 3694 | SOURCEHASH hashkey { 3695 if (pool_opts.type) { 3696 yyerror("pool type cannot be redefined"); 3697 YYERROR; 3698 } 3699 pool_opts.type = PF_POOL_SRCHASH; 3700 pool_opts.key = $2; 3701 } 3702 | ROUNDROBIN { 3703 if (pool_opts.type) { 3704 yyerror("pool type cannot be redefined"); 3705 YYERROR; 3706 } 3707 pool_opts.type = PF_POOL_ROUNDROBIN; 3708 } 3709 | STATICPORT { 3710 if (pool_opts.staticport) { 3711 yyerror("static-port cannot be redefined"); 3712 YYERROR; 3713 } 3714 pool_opts.staticport = 1; 3715 } 3716 | STICKYADDRESS { 3717 if (filter_opts.marker & POM_STICKYADDRESS) { 3718 yyerror("sticky-address cannot be redefined"); 3719 YYERROR; 3720 } 3721 pool_opts.marker |= POM_STICKYADDRESS; 3722 pool_opts.opts |= PF_POOL_STICKYADDR; 3723 } 3724 ; 3725 3726route_host : STRING { 3727 /* try to find @if0 address specs */ 3728 if (strrchr($1, '@') != NULL) { 3729 if (($$ = host($1)) == NULL) { 3730 yyerror("invalid host for route spec"); 3731 YYERROR; 3732 } 3733 free($1); 3734 } else { 3735 $$ = calloc(1, sizeof(struct node_host)); 3736 if ($$ == NULL) 3737 err(1, "route_host: calloc"); 3738 $$->ifname = $1; 3739 $$->addr.type = PF_ADDR_NONE; 3740 set_ipmask($$, 128); 3741 $$->next = NULL; 3742 $$->tail = $$; 3743 } 3744 } 3745 | STRING '/' STRING { 3746 char *buf; 3747 3748 if (asprintf(&buf, "%s/%s", $1, $3) == -1) 3749 err(1, "host: asprintf"); 3750 free($1); 3751 if (($$ = host(buf)) == NULL) { 3752 /* error. "any" is handled elsewhere */ 3753 free(buf); 3754 yyerror("could not parse host specification"); 3755 YYERROR; 3756 } 3757 free(buf); 3758 } 3759 | '<' STRING '>' { 3760 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 3761 yyerror("table name '%s' too long", $2); 3762 free($2); 3763 YYERROR; 3764 } 3765 $$ = calloc(1, sizeof(struct node_host)); 3766 if ($$ == NULL) 3767 err(1, "host: calloc"); 3768 $$->addr.type = PF_ADDR_TABLE; 3769 if (strlcpy($$->addr.v.tblname, $2, 3770 sizeof($$->addr.v.tblname)) >= 3771 sizeof($$->addr.v.tblname)) 3772 errx(1, "host: strlcpy"); 3773 free($2); 3774 $$->next = NULL; 3775 $$->tail = $$; 3776 } 3777 | dynaddr '/' NUMBER { 3778 struct node_host *n; 3779 3780 if ($3 < 0 || $3 > 128) { 3781 yyerror("bit number too big"); 3782 YYERROR; 3783 } 3784 $$ = $1; 3785 for (n = $1; n != NULL; n = n->next) 3786 set_ipmask(n, $3); 3787 } 3788 | '(' STRING host ')' { 3789 struct node_host *n; 3790 3791 $$ = $3; 3792 /* XXX check masks, only full mask should be allowed */ 3793 for (n = $3; n != NULL; n = n->next) { 3794 if ($$->ifname) { 3795 yyerror("cannot specify interface twice " 3796 "in route spec"); 3797 YYERROR; 3798 } 3799 if (($$->ifname = strdup($2)) == NULL) 3800 errx(1, "host: strdup"); 3801 } 3802 free($2); 3803 } 3804 ; 3805 3806route_host_list : route_host optnl { $$ = $1; } 3807 | route_host_list comma route_host optnl { 3808 if ($1->af == 0) 3809 $1->af = $3->af; 3810 if ($1->af != $3->af) { 3811 yyerror("all pool addresses must be in the " 3812 "same address family"); 3813 YYERROR; 3814 } 3815 $1->tail->next = $3; 3816 $1->tail = $3->tail; 3817 $$ = $1; 3818 } 3819 ; 3820 3821routespec : route_host { $$ = $1; } 3822 | '{' optnl route_host_list '}' { $$ = $3; } 3823 ; 3824 3825timeout_spec : STRING NUMBER 3826 { 3827 if (check_rulestate(PFCTL_STATE_OPTION)) { 3828 free($1); 3829 YYERROR; 3830 } 3831 if ($2 < 0 || $2 > UINT_MAX) { 3832 yyerror("only positive values permitted"); 3833 YYERROR; 3834 } 3835 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3836 yyerror("unknown timeout %s", $1); 3837 free($1); 3838 YYERROR; 3839 } 3840 free($1); 3841 } 3842 ; 3843 3844timeout_list : timeout_list comma timeout_spec optnl 3845 | timeout_spec optnl 3846 ; 3847 3848limit_spec : STRING NUMBER 3849 { 3850 if (check_rulestate(PFCTL_STATE_OPTION)) { 3851 free($1); 3852 YYERROR; 3853 } 3854 if ($2 < 0 || $2 > UINT_MAX) { 3855 yyerror("only positive values permitted"); 3856 YYERROR; 3857 } 3858 if (pfctl_set_limit(pf, $1, $2) != 0) { 3859 yyerror("unable to set limit %s %u", $1, $2); 3860 free($1); 3861 YYERROR; 3862 } 3863 free($1); 3864 } 3865 ; 3866 3867limit_list : limit_list comma limit_spec optnl 3868 | limit_spec optnl 3869 ; 3870 3871comma : ',' 3872 | /* empty */ 3873 ; 3874 3875yesno : NO { $$ = 0; } 3876 | STRING { 3877 if (!strcmp($1, "yes")) 3878 $$ = 1; 3879 else { 3880 yyerror("invalid value '%s', expected 'yes' " 3881 "or 'no'", $1); 3882 free($1); 3883 YYERROR; 3884 } 3885 free($1); 3886 } 3887 ; 3888 3889unaryop : '=' { $$ = PF_OP_EQ; } 3890 | NE { $$ = PF_OP_NE; } 3891 | LE { $$ = PF_OP_LE; } 3892 | '<' { $$ = PF_OP_LT; } 3893 | GE { $$ = PF_OP_GE; } 3894 | '>' { $$ = PF_OP_GT; } 3895 ; 3896 3897%% 3898 3899int 3900yyerror(const char *fmt, ...) 3901{ 3902 va_list ap; 3903 3904 file->errors++; 3905 va_start(ap, fmt); 3906 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 3907 vfprintf(stderr, fmt, ap); 3908 fprintf(stderr, "\n"); 3909 va_end(ap); 3910 return (0); 3911} 3912 3913int 3914disallow_table(struct node_host *h, const char *fmt) 3915{ 3916 for (; h != NULL; h = h->next) 3917 if (h->addr.type == PF_ADDR_TABLE) { 3918 yyerror(fmt, h->addr.v.tblname); 3919 return (1); 3920 } 3921 return (0); 3922} 3923 3924int 3925disallow_urpf_failed(struct node_host *h, const char *fmt) 3926{ 3927 for (; h != NULL; h = h->next) 3928 if (h->addr.type == PF_ADDR_URPFFAILED) { 3929 yyerror(fmt); 3930 return (1); 3931 } 3932 return (0); 3933} 3934 3935int 3936disallow_alias(struct node_host *h, const char *fmt) 3937{ 3938 for (; h != NULL; h = h->next) 3939 if (DYNIF_MULTIADDR(h->addr)) { 3940 yyerror(fmt, h->addr.v.tblname); 3941 return (1); 3942 } 3943 return (0); 3944} 3945 3946int 3947rule_consistent(struct pf_rule *r, int anchor_call) 3948{ 3949 int problems = 0; 3950 3951 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3952 (r->src.port_op || r->dst.port_op)) { 3953 yyerror("port only applies to tcp/udp"); 3954 problems++; 3955 } 3956 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3957 (r->type || r->code)) { 3958 yyerror("icmp-type/code only applies to icmp"); 3959 problems++; 3960 } 3961 if (!r->af && (r->type || r->code)) { 3962 yyerror("must indicate address family with icmp-type/code"); 3963 problems++; 3964 } 3965 if (r->overload_tblname[0] && 3966 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3967 yyerror("'overload' requires 'max-src-conn' " 3968 "or 'max-src-conn-rate'"); 3969 problems++; 3970 } 3971 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3972 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3973 yyerror("proto %s doesn't match address family %s", 3974 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3975 r->af == AF_INET ? "inet" : "inet6"); 3976 problems++; 3977 } 3978 if (r->allow_opts && r->action != PF_PASS) { 3979 yyerror("allow-opts can only be specified for pass rules"); 3980 problems++; 3981 } 3982 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3983 r->dst.port_op || r->flagset || r->type || r->code)) { 3984 yyerror("fragments can be filtered only on IP header fields"); 3985 problems++; 3986 } 3987 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3988 yyerror("return-rst can only be applied to TCP rules"); 3989 problems++; 3990 } 3991 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3992 yyerror("max-src-nodes requires 'source-track rule'"); 3993 problems++; 3994 } 3995 if (r->action != PF_PASS && r->keep_state) { 3996 yyerror("keep state is great, but only for pass rules"); 3997 problems++; 3998 } 3999 if (r->rule_flag & PFRULE_STATESLOPPY && 4000 (r->keep_state == PF_STATE_MODULATE || 4001 r->keep_state == PF_STATE_SYNPROXY)) { 4002 yyerror("sloppy state matching cannot be used with " 4003 "synproxy state or modulate state"); 4004 problems++; 4005 } 4006 if ((r->nat.addr.type != PF_ADDR_NONE || 4007 r->rdr.addr.type != PF_ADDR_NONE) && 4008 r->action != PF_MATCH && !r->keep_state) { 4009 yyerror("nat-to and rdr-to require keep state"); 4010 problems++; 4011 } 4012 if (r->direction == PF_INOUT && (r->nat.addr.type != PF_ADDR_NONE || 4013 r->rdr.addr.type != PF_ADDR_NONE)) { 4014 yyerror("nat-to and rdr-to require a direction"); 4015 problems++; 4016 } 4017 4018 /* match rules rules */ 4019 if (r->action == PF_MATCH) { 4020 if (r->divert.port) { 4021 yyerror("divert is not supported on match rules"); 4022 problems++; 4023 } 4024 if (r->divert_packet.port) { 4025 yyerror("divert is not supported on match rules"); 4026 problems++; 4027 } 4028 if (r->rt) { 4029 yyerror("route-to, reply-to, dup-to and fastroute " 4030 "must not be used on match rules"); 4031 problems++; 4032 } 4033 } 4034 return (-problems); 4035} 4036 4037int 4038process_tabledef(char *name, struct table_opts *opts) 4039{ 4040 struct pfr_buffer ab; 4041 struct node_tinit *ti; 4042 4043 bzero(&ab, sizeof(ab)); 4044 ab.pfrb_type = PFRB_ADDRS; 4045 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4046 if (ti->file) 4047 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 4048 if (errno) 4049 yyerror("cannot load \"%s\": %s", 4050 ti->file, strerror(errno)); 4051 else 4052 yyerror("file \"%s\" contains bad data", 4053 ti->file); 4054 goto _error; 4055 } 4056 if (ti->host) 4057 if (append_addr_host(&ab, ti->host, 0, 0)) { 4058 yyerror("cannot create address buffer: %s", 4059 strerror(errno)); 4060 goto _error; 4061 } 4062 } 4063 if (pf->opts & PF_OPT_VERBOSE) 4064 print_tabledef(name, opts->flags, opts->init_addr, 4065 &opts->init_nodes); 4066 if (!(pf->opts & PF_OPT_NOACTION) && 4067 pfctl_define_table(name, opts->flags, opts->init_addr, 4068 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4069 yyerror("cannot define table %s: %s", name, 4070 pfr_strerror(errno)); 4071 goto _error; 4072 } 4073 pf->tdirty = 1; 4074 pfr_buf_clear(&ab); 4075 return (0); 4076_error: 4077 pfr_buf_clear(&ab); 4078 return (-1); 4079} 4080 4081struct keywords { 4082 const char *k_name; 4083 int k_val; 4084}; 4085 4086/* macro gore, but you should've seen the prior indentation nightmare... */ 4087 4088#define FREE_LIST(T,r) \ 4089 do { \ 4090 T *p, *node = r; \ 4091 while (node != NULL) { \ 4092 p = node; \ 4093 node = node->next; \ 4094 free(p); \ 4095 } \ 4096 } while (0) 4097 4098#define LOOP_THROUGH(T,n,r,C) \ 4099 do { \ 4100 T *n; \ 4101 if (r == NULL) { \ 4102 r = calloc(1, sizeof(T)); \ 4103 if (r == NULL) \ 4104 err(1, "LOOP: calloc"); \ 4105 r->next = NULL; \ 4106 } \ 4107 n = r; \ 4108 while (n != NULL) { \ 4109 do { \ 4110 C; \ 4111 } while (0); \ 4112 n = n->next; \ 4113 } \ 4114 } while (0) 4115 4116void 4117expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4118{ 4119 char *tmp; 4120 char *p, *q; 4121 4122 if ((tmp = calloc(1, len)) == NULL) 4123 err(1, "expand_label_str: calloc"); 4124 p = q = label; 4125 while ((q = strstr(p, srch)) != NULL) { 4126 *q = '\0'; 4127 if ((strlcat(tmp, p, len) >= len) || 4128 (strlcat(tmp, repl, len) >= len)) 4129 errx(1, "expand_label: label too long"); 4130 q += strlen(srch); 4131 p = q; 4132 } 4133 if (strlcat(tmp, p, len) >= len) 4134 errx(1, "expand_label: label too long"); 4135 strlcpy(label, tmp, len); /* always fits */ 4136 free(tmp); 4137} 4138 4139void 4140expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4141{ 4142 if (strstr(label, name) != NULL) { 4143 if (!*ifname) 4144 expand_label_str(label, len, name, "any"); 4145 else 4146 expand_label_str(label, len, name, ifname); 4147 } 4148} 4149 4150void 4151expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4152 struct node_host *h) 4153{ 4154 char tmp[64], tmp_not[66]; 4155 4156 if (strstr(label, name) != NULL) { 4157 switch (h->addr.type) { 4158 case PF_ADDR_DYNIFTL: 4159 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4160 break; 4161 case PF_ADDR_TABLE: 4162 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4163 break; 4164 case PF_ADDR_NOROUTE: 4165 snprintf(tmp, sizeof(tmp), "no-route"); 4166 break; 4167 case PF_ADDR_URPFFAILED: 4168 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4169 break; 4170 case PF_ADDR_ADDRMASK: 4171 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4172 PF_AZERO(&h->addr.v.a.mask, af))) 4173 snprintf(tmp, sizeof(tmp), "any"); 4174 else { 4175 char a[48]; 4176 int bits; 4177 4178 if (inet_ntop(af, &h->addr.v.a.addr, a, 4179 sizeof(a)) == NULL) 4180 snprintf(tmp, sizeof(tmp), "?"); 4181 else { 4182 bits = unmask(&h->addr.v.a.mask, af); 4183 if ((af == AF_INET && bits < 32) || 4184 (af == AF_INET6 && bits < 128)) 4185 snprintf(tmp, sizeof(tmp), 4186 "%s/%d", a, bits); 4187 else 4188 snprintf(tmp, sizeof(tmp), 4189 "%s", a); 4190 } 4191 } 4192 break; 4193 default: 4194 snprintf(tmp, sizeof(tmp), "?"); 4195 break; 4196 } 4197 4198 if (h->not) { 4199 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4200 expand_label_str(label, len, name, tmp_not); 4201 } else 4202 expand_label_str(label, len, name, tmp); 4203 } 4204} 4205 4206void 4207expand_label_port(const char *name, char *label, size_t len, 4208 struct node_port *port) 4209{ 4210 char a1[6], a2[6], op[13] = ""; 4211 4212 if (strstr(label, name) != NULL) { 4213 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4214 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4215 if (!port->op) 4216 ; 4217 else if (port->op == PF_OP_IRG) 4218 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4219 else if (port->op == PF_OP_XRG) 4220 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4221 else if (port->op == PF_OP_EQ) 4222 snprintf(op, sizeof(op), "%s", a1); 4223 else if (port->op == PF_OP_NE) 4224 snprintf(op, sizeof(op), "!=%s", a1); 4225 else if (port->op == PF_OP_LT) 4226 snprintf(op, sizeof(op), "<%s", a1); 4227 else if (port->op == PF_OP_LE) 4228 snprintf(op, sizeof(op), "<=%s", a1); 4229 else if (port->op == PF_OP_GT) 4230 snprintf(op, sizeof(op), ">%s", a1); 4231 else if (port->op == PF_OP_GE) 4232 snprintf(op, sizeof(op), ">=%s", a1); 4233 expand_label_str(label, len, name, op); 4234 } 4235} 4236 4237void 4238expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4239{ 4240 struct protoent *pe; 4241 char n[4]; 4242 4243 if (strstr(label, name) != NULL) { 4244 pe = getprotobynumber(proto); 4245 if (pe != NULL) 4246 expand_label_str(label, len, name, pe->p_name); 4247 else { 4248 snprintf(n, sizeof(n), "%u", proto); 4249 expand_label_str(label, len, name, n); 4250 } 4251 } 4252} 4253 4254void 4255expand_label_nr(const char *name, char *label, size_t len) 4256{ 4257 char n[11]; 4258 4259 if (strstr(label, name) != NULL) { 4260 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4261 expand_label_str(label, len, name, n); 4262 } 4263} 4264 4265void 4266expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4267 struct node_host *src_host, struct node_port *src_port, 4268 struct node_host *dst_host, struct node_port *dst_port, 4269 u_int8_t proto) 4270{ 4271 expand_label_if("$if", label, len, ifname); 4272 expand_label_addr("$srcaddr", label, len, af, src_host); 4273 expand_label_addr("$dstaddr", label, len, af, dst_host); 4274 expand_label_port("$srcport", label, len, src_port); 4275 expand_label_port("$dstport", label, len, dst_port); 4276 expand_label_proto("$proto", label, len, proto); 4277 expand_label_nr("$nr", label, len); 4278} 4279 4280int 4281expand_altq(struct pf_altq *a, struct node_if *interfaces, 4282 struct node_queue *nqueues, struct node_queue_bw bwspec, 4283 struct node_queue_opt *opts) 4284{ 4285 struct pf_altq pa, pb; 4286 char qname[PF_QNAME_SIZE]; 4287 struct node_queue *n; 4288 struct node_queue_bw bw; 4289 int errs = 0; 4290 4291 LOOP_THROUGH(struct node_if, interface, interfaces, 4292 memcpy(&pa, a, sizeof(struct pf_altq)); 4293 if (strlcpy(pa.ifname, interface->ifname, 4294 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4295 errx(1, "expand_altq: strlcpy"); 4296 4297 if (interface->not) { 4298 yyerror("altq on ! <interface> is not supported"); 4299 errs++; 4300 } else { 4301 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4302 errs++; 4303 else 4304 if (pfctl_add_altq(pf, &pa)) 4305 errs++; 4306 4307 if (pf->opts & PF_OPT_VERBOSE) { 4308 print_altq(&pf->paltq->altq, 0, 4309 &bwspec, opts); 4310 if (nqueues && nqueues->tail) { 4311 printf("queue { "); 4312 LOOP_THROUGH(struct node_queue, queue, 4313 nqueues, 4314 printf("%s ", 4315 queue->queue); 4316 ); 4317 printf("}"); 4318 } 4319 printf("\n"); 4320 } 4321 4322 if (pa.scheduler == ALTQT_CBQ || 4323 pa.scheduler == ALTQT_HFSC) { 4324 /* now create a root queue */ 4325 memset(&pb, 0, sizeof(struct pf_altq)); 4326 if (strlcpy(qname, "root_", sizeof(qname)) >= 4327 sizeof(qname)) 4328 errx(1, "expand_altq: strlcpy"); 4329 if (strlcat(qname, interface->ifname, 4330 sizeof(qname)) >= sizeof(qname)) 4331 errx(1, "expand_altq: strlcat"); 4332 if (strlcpy(pb.qname, qname, 4333 sizeof(pb.qname)) >= sizeof(pb.qname)) 4334 errx(1, "expand_altq: strlcpy"); 4335 if (strlcpy(pb.ifname, interface->ifname, 4336 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4337 errx(1, "expand_altq: strlcpy"); 4338 pb.qlimit = pa.qlimit; 4339 pb.scheduler = pa.scheduler; 4340 bw.bw_absolute = pa.ifbandwidth; 4341 bw.bw_percent = 0; 4342 if (eval_pfqueue(pf, &pb, &bw, opts)) 4343 errs++; 4344 else 4345 if (pfctl_add_altq(pf, &pb)) 4346 errs++; 4347 } 4348 4349 LOOP_THROUGH(struct node_queue, queue, nqueues, 4350 n = calloc(1, sizeof(struct node_queue)); 4351 if (n == NULL) 4352 err(1, "expand_altq: calloc"); 4353 if (pa.scheduler == ALTQT_CBQ || 4354 pa.scheduler == ALTQT_HFSC) 4355 if (strlcpy(n->parent, qname, 4356 sizeof(n->parent)) >= 4357 sizeof(n->parent)) 4358 errx(1, "expand_altq: strlcpy"); 4359 if (strlcpy(n->queue, queue->queue, 4360 sizeof(n->queue)) >= sizeof(n->queue)) 4361 errx(1, "expand_altq: strlcpy"); 4362 if (strlcpy(n->ifname, interface->ifname, 4363 sizeof(n->ifname)) >= sizeof(n->ifname)) 4364 errx(1, "expand_altq: strlcpy"); 4365 n->scheduler = pa.scheduler; 4366 n->next = NULL; 4367 n->tail = n; 4368 if (queues == NULL) 4369 queues = n; 4370 else { 4371 queues->tail->next = n; 4372 queues->tail = n; 4373 } 4374 ); 4375 } 4376 ); 4377 FREE_LIST(struct node_if, interfaces); 4378 FREE_LIST(struct node_queue, nqueues); 4379 4380 return (errs); 4381} 4382 4383int 4384expand_queue(struct pf_altq *a, struct node_if *interfaces, 4385 struct node_queue *nqueues, struct node_queue_bw bwspec, 4386 struct node_queue_opt *opts) 4387{ 4388 struct node_queue *n, *nq; 4389 struct pf_altq pa; 4390 u_int8_t found = 0; 4391 u_int8_t errs = 0; 4392 4393 if (queues == NULL) { 4394 yyerror("queue %s has no parent", a->qname); 4395 FREE_LIST(struct node_queue, nqueues); 4396 return (1); 4397 } 4398 4399 LOOP_THROUGH(struct node_if, interface, interfaces, 4400 LOOP_THROUGH(struct node_queue, tqueue, queues, 4401 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4402 (interface->ifname[0] == 0 || 4403 (!interface->not && !strncmp(interface->ifname, 4404 tqueue->ifname, IFNAMSIZ)) || 4405 (interface->not && strncmp(interface->ifname, 4406 tqueue->ifname, IFNAMSIZ)))) { 4407 /* found ourself in queues */ 4408 found++; 4409 4410 memcpy(&pa, a, sizeof(struct pf_altq)); 4411 4412 if (pa.scheduler != ALTQT_NONE && 4413 pa.scheduler != tqueue->scheduler) { 4414 yyerror("exactly one scheduler type " 4415 "per interface allowed"); 4416 return (1); 4417 } 4418 pa.scheduler = tqueue->scheduler; 4419 4420 /* scheduler dependent error checking */ 4421 switch (pa.scheduler) { 4422 case ALTQT_PRIQ: 4423 if (nqueues != NULL) { 4424 yyerror("priq queues cannot " 4425 "have child queues"); 4426 return (1); 4427 } 4428 if (bwspec.bw_absolute > 0 || 4429 bwspec.bw_percent < 100) { 4430 yyerror("priq doesn't take " 4431 "bandwidth"); 4432 return (1); 4433 } 4434 break; 4435 default: 4436 break; 4437 } 4438 4439 if (strlcpy(pa.ifname, tqueue->ifname, 4440 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4441 errx(1, "expand_queue: strlcpy"); 4442 if (strlcpy(pa.parent, tqueue->parent, 4443 sizeof(pa.parent)) >= sizeof(pa.parent)) 4444 errx(1, "expand_queue: strlcpy"); 4445 4446 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4447 errs++; 4448 else 4449 if (pfctl_add_altq(pf, &pa)) 4450 errs++; 4451 4452 for (nq = nqueues; nq != NULL; nq = nq->next) { 4453 if (!strcmp(a->qname, nq->queue)) { 4454 yyerror("queue cannot have " 4455 "itself as child"); 4456 errs++; 4457 continue; 4458 } 4459 n = calloc(1, 4460 sizeof(struct node_queue)); 4461 if (n == NULL) 4462 err(1, "expand_queue: calloc"); 4463 if (strlcpy(n->parent, a->qname, 4464 sizeof(n->parent)) >= 4465 sizeof(n->parent)) 4466 errx(1, "expand_queue strlcpy"); 4467 if (strlcpy(n->queue, nq->queue, 4468 sizeof(n->queue)) >= 4469 sizeof(n->queue)) 4470 errx(1, "expand_queue strlcpy"); 4471 if (strlcpy(n->ifname, tqueue->ifname, 4472 sizeof(n->ifname)) >= 4473 sizeof(n->ifname)) 4474 errx(1, "expand_queue strlcpy"); 4475 n->scheduler = tqueue->scheduler; 4476 n->next = NULL; 4477 n->tail = n; 4478 if (queues == NULL) 4479 queues = n; 4480 else { 4481 queues->tail->next = n; 4482 queues->tail = n; 4483 } 4484 } 4485 if ((pf->opts & PF_OPT_VERBOSE) && ( 4486 (found == 1 && interface->ifname[0] == 0) || 4487 (found > 0 && interface->ifname[0] != 0))) { 4488 print_queue(&pf->paltq->altq, 0, 4489 &bwspec, interface->ifname[0] != 0, 4490 opts); 4491 if (nqueues && nqueues->tail) { 4492 printf("{ "); 4493 LOOP_THROUGH(struct node_queue, 4494 queue, nqueues, 4495 printf("%s ", 4496 queue->queue); 4497 ); 4498 printf("}"); 4499 } 4500 printf("\n"); 4501 } 4502 } 4503 ); 4504 ); 4505 4506 FREE_LIST(struct node_queue, nqueues); 4507 FREE_LIST(struct node_if, interfaces); 4508 4509 if (!found) { 4510 yyerror("queue %s has no parent", a->qname); 4511 errs++; 4512 } 4513 4514 if (errs) 4515 return (1); 4516 else 4517 return (0); 4518} 4519 4520int 4521collapse_redirspec(struct pf_pool *rpool, struct pf_rule *r, 4522 struct redirspec *rs, u_int8_t allow_if) 4523{ 4524 struct pf_opt_tbl *tbl = NULL; 4525 struct node_host *h; 4526 struct pf_rule_addr ra; 4527 int i = 0; 4528 4529 4530 if (!rs || !rs->rdr || rs->rdr->host == NULL) { 4531 rpool->addr.type = PF_ADDR_NONE; 4532 return (0); 4533 } 4534 4535 /* count matching addresses */ 4536 for (h = rs->rdr->host; h != NULL; h = h->next) { 4537 if (!r->af || !h->af || h->af == r->af) { 4538 i++; 4539 if (h->af && !r->af) 4540 r->af = h->af; 4541 } 4542 } 4543 4544 if (i == 0) { /* no pool address */ 4545 yyerror("af mismatch in %s spec", 4546 allow_if ? "routing" : "translation"); 4547 return (1); 4548 } else if (i == 1) { /* only one address */ 4549 for (h = rs->rdr->host; h != NULL; h = h->next) 4550 if (!h->af || !r->af || r->af == h->af) 4551 break; 4552 rpool->addr = h->addr; 4553 if (!allow_if && h->ifname) { 4554 yyerror("@if not permitted for translation"); 4555 return (1); 4556 } 4557 if (h->ifname && strlcpy(rpool->ifname, h->ifname, 4558 sizeof(rpool->ifname)) >= sizeof(rpool->ifname)) 4559 errx(1, "collapse_redirspec: strlcpy"); 4560 4561 return (0); 4562 } else { /* more than one address */ 4563 if (rs->pool_opts.type && 4564 rs->pool_opts.type != PF_POOL_ROUNDROBIN) { 4565 yyerror("only round-robin valid for multiple " 4566 "translation or routing addresses"); 4567 return (1); 4568 } 4569 for (h = rs->rdr->host; h != NULL; h = h->next) { 4570 if (r->af != h->af) 4571 continue; 4572 if (h->addr.type != PF_ADDR_ADDRMASK && 4573 h->addr.type != PF_ADDR_NONE) { 4574 yyerror("multiple tables or dynamic interfaces " 4575 "not supported for translation or routing"); 4576 return (1); 4577 } 4578 if (!allow_if && h->ifname) { 4579 yyerror("@if not permitted for translation"); 4580 return (1); 4581 } 4582 memset(&ra, 0, sizeof(ra)); 4583 ra.addr = h->addr; 4584 if (add_opt_table(pf, &tbl, 4585 h->af, &ra, h->ifname)) 4586 return (1); 4587 } 4588 } 4589 if (tbl) { 4590 if ((pf->opts & PF_OPT_NOACTION) == 0 && 4591 pf_opt_create_table(pf, tbl)) 4592 return (1); 4593 4594 pf->tdirty = 1; 4595 4596 if (pf->opts & PF_OPT_VERBOSE) 4597 print_tabledef(tbl->pt_name, PFR_TFLAG_CONST, 4598 1, &tbl->pt_nodes); 4599 4600 memset(&rpool->addr, 0, sizeof(rpool->addr)); 4601 rpool->addr.type = PF_ADDR_TABLE; 4602 strlcpy(rpool->addr.v.tblname, tbl->pt_name, 4603 sizeof(rpool->addr.v.tblname)); 4604 4605 pfr_buf_clear(tbl->pt_buf); 4606 free(tbl->pt_buf); 4607 tbl->pt_buf = NULL; 4608 free(tbl); 4609 } 4610 return (0); 4611} 4612 4613 4614int 4615apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, 4616 int isrdr, struct node_port *np) 4617{ 4618 if (!rs || !rs->rdr) 4619 return (0); 4620 4621 rpool->proxy_port[0] = ntohs(rs->rdr->rport.a); 4622 4623 if (isrdr) { 4624 if (!rs->rdr->rport.b && rs->rdr->rport.t && np->port != NULL) { 4625 rpool->proxy_port[1] = ntohs(rs->rdr->rport.a) + 4626 (ntohs(np->port[1]) - ntohs(np->port[0])); 4627 } else 4628 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4629 } else { 4630 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4631 if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { 4632 rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW; 4633 rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH; 4634 } else if (!rpool->proxy_port[1]) 4635 rpool->proxy_port[1] = rpool->proxy_port[0]; 4636 } 4637 4638 rpool->opts = rs->pool_opts.type; 4639 if (rpool->addr.type == PF_ADDR_TABLE || 4640 DYNIF_MULTIADDR(rpool->addr)) 4641 rpool->opts |= PF_POOL_ROUNDROBIN; 4642 4643 if (rs->pool_opts.key != NULL) 4644 memcpy(&rpool->key, rs->pool_opts.key, 4645 sizeof(struct pf_poolhashkey)); 4646 4647 if (rs->pool_opts.opts) 4648 rpool->opts |= rs->pool_opts.opts; 4649 4650 if (rs->pool_opts.staticport) { 4651 if (isrdr) { 4652 yyerror("the 'static-port' option is only valid with " 4653 "nat rules"); 4654 return (1); 4655 } 4656 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 4657 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 4658 yyerror("the 'static-port' option can't be used when " 4659 "specifying a port range"); 4660 return (1); 4661 } 4662 rpool->proxy_port[0] = 0; 4663 rpool->proxy_port[1] = 0; 4664 } 4665 4666 return (0); 4667} 4668 4669 4670void 4671expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces, 4672 struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute, 4673 struct node_proto *protos, struct node_os *src_oses, 4674 struct node_host *src_hosts, struct node_port *src_ports, 4675 struct node_host *dst_hosts, struct node_port *dst_ports, 4676 struct node_uid *uids, struct node_gid *gids, struct node_if *rcv, 4677 struct node_icmp *icmp_types, const char *anchor_call) 4678{ 4679 sa_family_t af = r->af; 4680 int added = 0, error = 0; 4681 char ifname[IF_NAMESIZE]; 4682 char label[PF_RULE_LABEL_SIZE]; 4683 char tagname[PF_TAG_NAME_SIZE]; 4684 char match_tagname[PF_TAG_NAME_SIZE]; 4685 u_int8_t flags, flagset, keep_state; 4686 struct node_host *srch, *dsth; 4687 struct redirspec binat; 4688 struct pf_rule rb; 4689 int dir = r->direction; 4690 4691 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4692 errx(1, "expand_rule: strlcpy"); 4693 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4694 errx(1, "expand_rule: strlcpy"); 4695 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4696 sizeof(match_tagname)) 4697 errx(1, "expand_rule: strlcpy"); 4698 flags = r->flags; 4699 flagset = r->flagset; 4700 keep_state = r->keep_state; 4701 4702 r->src.addr.type = r->dst.addr.type = PF_ADDR_ADDRMASK; 4703 4704 LOOP_THROUGH(struct node_if, interface, interfaces, 4705 LOOP_THROUGH(struct node_proto, proto, protos, 4706 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4707 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4708 LOOP_THROUGH(struct node_port, src_port, src_ports, 4709 LOOP_THROUGH(struct node_os, src_os, src_oses, 4710 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4711 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4712 LOOP_THROUGH(struct node_uid, uid, uids, 4713 LOOP_THROUGH(struct node_gid, gid, gids, 4714 4715 r->af = af; 4716 4717 error += collapse_redirspec(&r->rdr, r, rdr, 0); 4718 error += collapse_redirspec(&r->nat, r, nat, 0); 4719 error += collapse_redirspec(&r->route, r, rroute, 1); 4720 4721 /* disallow @if in from or to for the time being */ 4722 if ((src_host->addr.type == PF_ADDR_ADDRMASK && 4723 src_host->ifname) || 4724 (dst_host->addr.type == PF_ADDR_ADDRMASK && 4725 dst_host->ifname)) { 4726 yyerror("@if syntax not permitted in from or to"); 4727 error++; 4728 } 4729 /* for link-local IPv6 address, interface must match up */ 4730 if ((r->af && src_host->af && r->af != src_host->af) || 4731 (r->af && dst_host->af && r->af != dst_host->af) || 4732 (src_host->af && dst_host->af && 4733 src_host->af != dst_host->af) || 4734 (src_host->ifindex && dst_host->ifindex && 4735 src_host->ifindex != dst_host->ifindex) || 4736 (src_host->ifindex && *interface->ifname && 4737 src_host->ifindex != if_nametoindex(interface->ifname)) || 4738 (dst_host->ifindex && *interface->ifname && 4739 dst_host->ifindex != if_nametoindex(interface->ifname))) 4740 continue; 4741 if (!r->af && src_host->af) 4742 r->af = src_host->af; 4743 else if (!r->af && dst_host->af) 4744 r->af = dst_host->af; 4745 4746 if (*interface->ifname) 4747 strlcpy(r->ifname, interface->ifname, 4748 sizeof(r->ifname)); 4749 else if (if_indextoname(src_host->ifindex, ifname)) 4750 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4751 else if (if_indextoname(dst_host->ifindex, ifname)) 4752 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4753 else 4754 memset(r->ifname, '\0', sizeof(r->ifname)); 4755 4756 if (strlcpy(r->label, label, sizeof(r->label)) >= 4757 sizeof(r->label)) 4758 errx(1, "expand_rule: strlcpy"); 4759 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4760 sizeof(r->tagname)) 4761 errx(1, "expand_rule: strlcpy"); 4762 if (strlcpy(r->match_tagname, match_tagname, 4763 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4764 errx(1, "expand_rule: strlcpy"); 4765 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4766 src_host, src_port, dst_host, dst_port, proto->proto); 4767 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4768 src_host, src_port, dst_host, dst_port, proto->proto); 4769 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4770 r->af, src_host, src_port, dst_host, dst_port, 4771 proto->proto); 4772 4773 error += check_netmask(src_host, r->af); 4774 error += check_netmask(dst_host, r->af); 4775 4776 r->ifnot = interface->not; 4777 r->proto = proto->proto; 4778 r->src.addr = src_host->addr; 4779 r->src.neg = src_host->not; 4780 r->src.port[0] = src_port->port[0]; 4781 r->src.port[1] = src_port->port[1]; 4782 r->src.port_op = src_port->op; 4783 r->dst.addr = dst_host->addr; 4784 r->dst.neg = dst_host->not; 4785 r->dst.port[0] = dst_port->port[0]; 4786 r->dst.port[1] = dst_port->port[1]; 4787 r->dst.port_op = dst_port->op; 4788 r->uid.op = uid->op; 4789 r->uid.uid[0] = uid->uid[0]; 4790 r->uid.uid[1] = uid->uid[1]; 4791 r->gid.op = gid->op; 4792 r->gid.gid[0] = gid->gid[0]; 4793 r->gid.gid[1] = gid->gid[1]; 4794 if (rcv) { 4795 strlcpy(r->rcv_ifname, rcv->ifname, 4796 sizeof(r->rcv_ifname)); 4797 } 4798 r->type = icmp_type->type; 4799 r->code = icmp_type->code; 4800 4801 if ((keep_state == PF_STATE_MODULATE || 4802 keep_state == PF_STATE_SYNPROXY) && 4803 r->proto && r->proto != IPPROTO_TCP) 4804 r->keep_state = PF_STATE_NORMAL; 4805 else 4806 r->keep_state = keep_state; 4807 4808 if (r->proto && r->proto != IPPROTO_TCP) { 4809 r->flags = 0; 4810 r->flagset = 0; 4811 } else { 4812 r->flags = flags; 4813 r->flagset = flagset; 4814 } 4815 if (icmp_type->proto && r->proto != icmp_type->proto) { 4816 yyerror("icmp-type mismatch"); 4817 error++; 4818 } 4819 4820 if (src_os && src_os->os) { 4821 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4822 if ((pf->opts & PF_OPT_VERBOSE2) && 4823 r->os_fingerprint == PF_OSFP_NOMATCH) 4824 fprintf(stderr, 4825 "warning: unknown '%s' OS fingerprint\n", 4826 src_os->os); 4827 } else { 4828 r->os_fingerprint = PF_OSFP_ANY; 4829 } 4830 4831 if (nat && nat->rdr && nat->binat) { 4832 if (disallow_table(src_host, "invalid use of table " 4833 "<%s> as the source address of a binat-to rule") || 4834 disallow_alias(src_host, "invalid use of interface " 4835 "(%s) as the source address of a binat-to rule")) { 4836 error++; 4837 } else if ((r->src.addr.type != PF_ADDR_ADDRMASK && 4838 r->src.addr.type != PF_ADDR_DYNIFTL) || 4839 (r->nat.addr.type != PF_ADDR_ADDRMASK && 4840 r->nat.addr.type != PF_ADDR_DYNIFTL)) { 4841 yyerror("binat-to requires a specified " 4842 "source and redirect address"); 4843 error++; 4844 } 4845 if (DYNIF_MULTIADDR(r->src.addr) || 4846 DYNIF_MULTIADDR(r->nat.addr)) { 4847 yyerror ("dynamic interfaces must be used with " 4848 ":0 in a binat-to rule"); 4849 error++; 4850 } 4851 if (PF_AZERO(&r->src.addr.v.a.mask, af) || 4852 PF_AZERO(&r->nat.addr.v.a.mask, af)) { 4853 yyerror ("source and redir addresess must have " 4854 "a matching network mask in binat-rule"); 4855 error++; 4856 } 4857 if (r->nat.addr.type == PF_ADDR_TABLE) { 4858 yyerror ("tables cannot be used as the redirect " 4859 "address of a binat-to rule"); 4860 error++; 4861 } 4862 if (r->direction != PF_INOUT) { 4863 yyerror("binat-to cannot be specified " 4864 "with a direction"); 4865 error++; 4866 } 4867 4868 /* first specify outbound NAT rule */ 4869 r->direction = PF_OUT; 4870 } 4871 4872 error += apply_redirspec(&r->nat, r, nat, 0, dst_port); 4873 error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port); 4874 error += apply_redirspec(&r->route, r, rroute, 2, dst_port); 4875 4876 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4877 yyerror("skipping rule due to errors"); 4878 else { 4879 r->nr = pf->astack[pf->asd]->match++; 4880 pfctl_add_rule(pf, r, anchor_call); 4881 added++; 4882 } 4883 r->direction = dir; 4884 4885 /* Generate binat's matching inbound rule */ 4886 if (!error && nat && nat->rdr && nat->binat) { 4887 bcopy(r, &rb, sizeof(rb)); 4888 4889 /* now specify inbound rdr rule */ 4890 rb.direction = PF_IN; 4891 4892 if ((srch = calloc(1, sizeof(*srch))) == NULL) 4893 err(1, "expand_rule: calloc"); 4894 bcopy(src_host, srch, sizeof(*srch)); 4895 srch->ifname = NULL; 4896 srch->next = NULL; 4897 srch->tail = NULL; 4898 4899 if ((dsth = calloc(1, sizeof(*dsth))) == NULL) 4900 err(1, "expand_rule: calloc"); 4901 bcopy(&rb.nat.addr, &dsth->addr, sizeof(dsth->addr)); 4902 dsth->ifname = NULL; 4903 dsth->next = NULL; 4904 dsth->tail = NULL; 4905 4906 if ((binat.rdr = 4907 calloc(1, sizeof(*binat.rdr))) == NULL) 4908 err(1, "expand_rule: calloc"); 4909 bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr)); 4910 bcopy(&nat->pool_opts, &binat.pool_opts, 4911 sizeof(binat.pool_opts)); 4912 binat.pool_opts.staticport = 0; 4913 binat.rdr->host = srch; 4914 4915 expand_rule(&rb, 1, interface, NULL, &binat, NULL, 4916 proto, 4917 src_os, dst_host, dst_port, dsth, src_port, 4918 uid, gid, rcv, icmp_type, anchor_call); 4919 } 4920 4921 )))))))))); 4922 4923 if (!keeprule) { 4924 FREE_LIST(struct node_if, interfaces); 4925 FREE_LIST(struct node_proto, protos); 4926 FREE_LIST(struct node_host, src_hosts); 4927 FREE_LIST(struct node_port, src_ports); 4928 FREE_LIST(struct node_os, src_oses); 4929 FREE_LIST(struct node_host, dst_hosts); 4930 FREE_LIST(struct node_port, dst_ports); 4931 FREE_LIST(struct node_uid, uids); 4932 FREE_LIST(struct node_gid, gids); 4933 FREE_LIST(struct node_icmp, icmp_types); 4934 if (nat && nat->rdr) 4935 FREE_LIST(struct node_host, nat->rdr->host); 4936 if (rdr && rdr->rdr) 4937 FREE_LIST(struct node_host, rdr->rdr->host); 4938 4939 } 4940 4941 if (!added) 4942 yyerror("rule expands to no valid combination"); 4943} 4944 4945int 4946expand_skip_interface(struct node_if *interfaces) 4947{ 4948 int errs = 0; 4949 4950 if (!interfaces || (!interfaces->next && !interfaces->not && 4951 !strcmp(interfaces->ifname, "none"))) { 4952 if (pf->opts & PF_OPT_VERBOSE) 4953 printf("set skip on none\n"); 4954 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4955 return (errs); 4956 } 4957 4958 if (pf->opts & PF_OPT_VERBOSE) 4959 printf("set skip on {"); 4960 LOOP_THROUGH(struct node_if, interface, interfaces, 4961 if (pf->opts & PF_OPT_VERBOSE) 4962 printf(" %s", interface->ifname); 4963 if (interface->not) { 4964 yyerror("skip on ! <interface> is not supported"); 4965 errs++; 4966 } else 4967 errs += pfctl_set_interface_flags(pf, 4968 interface->ifname, PFI_IFLAG_SKIP, 1); 4969 ); 4970 if (pf->opts & PF_OPT_VERBOSE) 4971 printf(" }\n"); 4972 4973 FREE_LIST(struct node_if, interfaces); 4974 4975 if (errs) 4976 return (1); 4977 else 4978 return (0); 4979} 4980 4981void 4982freehostlist(struct node_host *h) 4983{ 4984 struct node_host *n; 4985 4986 for (n = h; n != NULL; n = n->next) 4987 if (n->ifname) 4988 free(n->ifname); 4989 FREE_LIST(struct node_host, h); 4990} 4991 4992#undef FREE_LIST 4993#undef LOOP_THROUGH 4994 4995int 4996check_rulestate(int desired_state) 4997{ 4998 if (require_order && (rulestate > desired_state)) { 4999 yyerror("Rules must be in order: options, normalization, " 5000 "queueing, translation, filtering"); 5001 return (1); 5002 } 5003 rulestate = desired_state; 5004 return (0); 5005} 5006 5007int 5008kw_cmp(const void *k, const void *e) 5009{ 5010 return (strcmp(k, ((const struct keywords *)e)->k_name)); 5011} 5012 5013int 5014lookup(char *s) 5015{ 5016 /* this has to be sorted always */ 5017 static const struct keywords keywords[] = { 5018 { "all", ALL}, 5019 { "allow-opts", ALLOWOPTS}, 5020 { "altq", ALTQ}, 5021 { "anchor", ANCHOR}, 5022 { "antispoof", ANTISPOOF}, 5023 { "any", ANY}, 5024 { "bandwidth", BANDWIDTH}, 5025 { "binat-to", BINATTO}, 5026 { "bitmask", BITMASK}, 5027 { "block", BLOCK}, 5028 { "block-policy", BLOCKPOLICY}, 5029 { "cbq", CBQ}, 5030 { "code", CODE}, 5031 { "debug", DEBUG}, 5032 { "divert-packet", DIVERTPACKET}, 5033 { "divert-reply", DIVERTREPLY}, 5034 { "divert-to", DIVERTTO}, 5035 { "drop", DROP}, 5036 { "dup-to", DUPTO}, 5037 { "fastroute", FASTROUTE}, 5038 { "file", FILENAME}, 5039 { "fingerprints", FINGERPRINTS}, 5040 { "flags", FLAGS}, 5041 { "floating", FLOATING}, 5042 { "flush", FLUSH}, 5043 { "for", FOR}, 5044 { "fragment", FRAGMENT}, 5045 { "from", FROM}, 5046 { "global", GLOBAL}, 5047 { "group", GROUP}, 5048 { "hfsc", HFSC}, 5049 { "hostid", HOSTID}, 5050 { "icmp-type", ICMPTYPE}, 5051 { "icmp6-type", ICMP6TYPE}, 5052 { "if-bound", IFBOUND}, 5053 { "in", IN}, 5054 { "include", INCLUDE}, 5055 { "inet", INET}, 5056 { "inet6", INET6}, 5057 { "keep", KEEP}, 5058 { "label", LABEL}, 5059 { "limit", LIMIT}, 5060 { "linkshare", LINKSHARE}, 5061 { "load", LOAD}, 5062 { "log", LOG}, 5063 { "loginterface", LOGINTERFACE}, 5064 { "match", MATCH}, 5065 { "matches", MATCHES}, 5066 { "max", MAXIMUM}, 5067 { "max-mss", MAXMSS}, 5068 { "max-src-conn", MAXSRCCONN}, 5069 { "max-src-conn-rate", MAXSRCCONNRATE}, 5070 { "max-src-nodes", MAXSRCNODES}, 5071 { "max-src-states", MAXSRCSTATES}, 5072 { "min-ttl", MINTTL}, 5073 { "modulate", MODULATE}, 5074 { "nat-to", NATTO}, 5075 { "no", NO}, 5076 { "no-df", NODF}, 5077 { "no-route", NOROUTE}, 5078 { "no-sync", NOSYNC}, 5079 { "on", ON}, 5080 { "optimization", OPTIMIZATION}, 5081 { "os", OS}, 5082 { "out", OUT}, 5083 { "overload", OVERLOAD}, 5084 { "pass", PASS}, 5085 { "pflow", PFLOW}, 5086 { "port", PORT}, 5087 { "priority", PRIORITY}, 5088 { "priq", PRIQ}, 5089 { "probability", PROBABILITY}, 5090 { "proto", PROTO}, 5091 { "qlimit", QLIMIT}, 5092 { "queue", QUEUE}, 5093 { "quick", QUICK}, 5094 { "random", RANDOM}, 5095 { "random-id", RANDOMID}, 5096 { "rdr-to", RDRTO}, 5097 { "realtime", REALTIME}, 5098 { "reassemble", REASSEMBLE}, 5099 { "received-on", RECEIVEDON}, 5100 { "reply-to", REPLYTO}, 5101 { "require-order", REQUIREORDER}, 5102 { "return", RETURN}, 5103 { "return-icmp", RETURNICMP}, 5104 { "return-icmp6", RETURNICMP6}, 5105 { "return-rst", RETURNRST}, 5106 { "round-robin", ROUNDROBIN}, 5107 { "route", ROUTE}, 5108 { "route-to", ROUTETO}, 5109 { "rtable", RTABLE}, 5110 { "rule", RULE}, 5111 { "ruleset-optimization", RULESET_OPTIMIZATION}, 5112 { "scrub", SCRUB}, 5113 { "set", SET}, 5114 { "set-tos", SETTOS}, 5115 { "skip", SKIP}, 5116 { "sloppy", SLOPPY}, 5117 { "source-hash", SOURCEHASH}, 5118 { "source-track", SOURCETRACK}, 5119 { "state", STATE}, 5120 { "state-defaults", STATEDEFAULTS}, 5121 { "state-policy", STATEPOLICY}, 5122 { "static-port", STATICPORT}, 5123 { "sticky-address", STICKYADDRESS}, 5124 { "synproxy", SYNPROXY}, 5125 { "table", TABLE}, 5126 { "tag", TAG}, 5127 { "tagged", TAGGED}, 5128 { "tbrsize", TBRSIZE}, 5129 { "timeout", TIMEOUT}, 5130 { "to", TO}, 5131 { "tos", TOS}, 5132 { "ttl", TTL}, 5133 { "upperlimit", UPPERLIMIT}, 5134 { "urpf-failed", URPFFAILED}, 5135 { "user", USER}, 5136 }; 5137 const struct keywords *p; 5138 5139 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5140 sizeof(keywords[0]), kw_cmp); 5141 5142 if (p) { 5143 if (debug > 1) 5144 fprintf(stderr, "%s: %d\n", s, p->k_val); 5145 return (p->k_val); 5146 } else { 5147 if (debug > 1) 5148 fprintf(stderr, "string: %s\n", s); 5149 return (STRING); 5150 } 5151} 5152 5153#define MAXPUSHBACK 128 5154 5155char *parsebuf; 5156int parseindex; 5157char pushback_buffer[MAXPUSHBACK]; 5158int pushback_index = 0; 5159 5160int 5161lgetc(int quotec) 5162{ 5163 int c, next; 5164 5165 if (parsebuf) { 5166 /* Read character from the parsebuffer instead of input. */ 5167 if (parseindex >= 0) { 5168 c = parsebuf[parseindex++]; 5169 if (c != '\0') 5170 return (c); 5171 parsebuf = NULL; 5172 } else 5173 parseindex++; 5174 } 5175 5176 if (pushback_index) 5177 return (pushback_buffer[--pushback_index]); 5178 5179 if (quotec) { 5180 if ((c = getc(file->stream)) == EOF) { 5181 yyerror("reached end of file while parsing quoted string"); 5182 if (popfile() == EOF) 5183 return (EOF); 5184 return (quotec); 5185 } 5186 return (c); 5187 } 5188 5189 while ((c = getc(file->stream)) == '\\') { 5190 next = getc(file->stream); 5191 if (next != '\n') { 5192 c = next; 5193 break; 5194 } 5195 yylval.lineno = file->lineno; 5196 file->lineno++; 5197 } 5198 5199 while (c == EOF) { 5200 if (popfile() == EOF) 5201 return (EOF); 5202 c = getc(file->stream); 5203 } 5204 return (c); 5205} 5206 5207int 5208lungetc(int c) 5209{ 5210 if (c == EOF) 5211 return (EOF); 5212 if (parsebuf) { 5213 parseindex--; 5214 if (parseindex >= 0) 5215 return (c); 5216 } 5217 if (pushback_index < MAXPUSHBACK-1) 5218 return (pushback_buffer[pushback_index++] = c); 5219 else 5220 return (EOF); 5221} 5222 5223int 5224findeol(void) 5225{ 5226 int c; 5227 5228 parsebuf = NULL; 5229 5230 /* skip to either EOF or the first real EOL */ 5231 while (1) { 5232 if (pushback_index) 5233 c = pushback_buffer[--pushback_index]; 5234 else 5235 c = lgetc(0); 5236 if (c == '\n') { 5237 file->lineno++; 5238 break; 5239 } 5240 if (c == EOF) 5241 break; 5242 } 5243 return (ERROR); 5244} 5245 5246int 5247yylex(void) 5248{ 5249 char buf[8096]; 5250 char *p, *val; 5251 int quotec, next, c; 5252 int token; 5253 5254top: 5255 p = buf; 5256 while ((c = lgetc(0)) == ' ' || c == '\t') 5257 ; /* nothing */ 5258 5259 yylval.lineno = file->lineno; 5260 if (c == '#') 5261 while ((c = lgetc(0)) != '\n' && c != EOF) 5262 ; /* nothing */ 5263 if (c == '$' && parsebuf == NULL) { 5264 while (1) { 5265 if ((c = lgetc(0)) == EOF) 5266 return (0); 5267 5268 if (p + 1 >= buf + sizeof(buf) - 1) { 5269 yyerror("string too long"); 5270 return (findeol()); 5271 } 5272 if (isalnum(c) || c == '_') { 5273 *p++ = (char)c; 5274 continue; 5275 } 5276 *p = '\0'; 5277 lungetc(c); 5278 break; 5279 } 5280 val = symget(buf); 5281 if (val == NULL) { 5282 yyerror("macro '%s' not defined", buf); 5283 return (findeol()); 5284 } 5285 parsebuf = val; 5286 parseindex = 0; 5287 goto top; 5288 } 5289 5290 switch (c) { 5291 case '\'': 5292 case '"': 5293 quotec = c; 5294 while (1) { 5295 if ((c = lgetc(quotec)) == EOF) 5296 return (0); 5297 if (c == '\n') { 5298 file->lineno++; 5299 continue; 5300 } else if (c == '\\') { 5301 if ((next = lgetc(quotec)) == EOF) 5302 return (0); 5303 if (next == quotec || c == ' ' || c == '\t') 5304 c = next; 5305 else if (next == '\n') { 5306 file->lineno++; 5307 continue; 5308 } else 5309 lungetc(next); 5310 } else if (c == quotec) { 5311 *p = '\0'; 5312 break; 5313 } 5314 if (p + 1 >= buf + sizeof(buf) - 1) { 5315 yyerror("string too long"); 5316 return (findeol()); 5317 } 5318 *p++ = (char)c; 5319 } 5320 yylval.v.string = strdup(buf); 5321 if (yylval.v.string == NULL) 5322 err(1, "yylex: strdup"); 5323 return (STRING); 5324 case '!': 5325 next = lgetc(0); 5326 if (next == '=') 5327 return (NE); 5328 lungetc(next); 5329 break; 5330 case '<': 5331 next = lgetc(0); 5332 if (next == '>') { 5333 yylval.v.i = PF_OP_XRG; 5334 return (PORTBINARY); 5335 } else if (next == '=') 5336 return (LE); 5337 lungetc(next); 5338 break; 5339 case '>': 5340 next = lgetc(0); 5341 if (next == '<') { 5342 yylval.v.i = PF_OP_IRG; 5343 return (PORTBINARY); 5344 } else if (next == '=') 5345 return (GE); 5346 lungetc(next); 5347 break; 5348 } 5349 5350#define allowed_to_end_number(x) \ 5351 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5352 5353 if (c == '-' || isdigit(c)) { 5354 do { 5355 *p++ = c; 5356 if ((unsigned)(p-buf) >= sizeof(buf)) { 5357 yyerror("string too long"); 5358 return (findeol()); 5359 } 5360 } while ((c = lgetc(0)) != EOF && isdigit(c)); 5361 lungetc(c); 5362 if (p == buf + 1 && buf[0] == '-') 5363 goto nodigits; 5364 if (c == EOF || allowed_to_end_number(c)) { 5365 const char *errstr = NULL; 5366 5367 *p = '\0'; 5368 yylval.v.number = strtonum(buf, LLONG_MIN, 5369 LLONG_MAX, &errstr); 5370 if (errstr) { 5371 yyerror("\"%s\" invalid number: %s", 5372 buf, errstr); 5373 return (findeol()); 5374 } 5375 return (NUMBER); 5376 } else { 5377nodigits: 5378 while (p > buf + 1) 5379 lungetc(*--p); 5380 c = *--p; 5381 if (c == '-') 5382 return (c); 5383 } 5384 } 5385 5386#define allowed_in_string(x) \ 5387 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5388 x != '{' && x != '}' && x != '<' && x != '>' && \ 5389 x != '!' && x != '=' && x != '/' && x != '#' && \ 5390 x != ',')) 5391 5392 if (isalnum(c) || c == ':' || c == '_') { 5393 do { 5394 *p++ = c; 5395 if ((unsigned)(p-buf) >= sizeof(buf)) { 5396 yyerror("string too long"); 5397 return (findeol()); 5398 } 5399 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 5400 lungetc(c); 5401 *p = '\0'; 5402 if ((token = lookup(buf)) == STRING) 5403 if ((yylval.v.string = strdup(buf)) == NULL) 5404 err(1, "yylex: strdup"); 5405 return (token); 5406 } 5407 if (c == '\n') { 5408 yylval.lineno = file->lineno; 5409 file->lineno++; 5410 } 5411 if (c == EOF) 5412 return (0); 5413 return (c); 5414} 5415 5416int 5417check_file_secrecy(int fd, const char *fname) 5418{ 5419 struct stat st; 5420 5421 if (fstat(fd, &st)) { 5422 warn("cannot stat %s", fname); 5423 return (-1); 5424 } 5425 if (st.st_uid != 0 && st.st_uid != getuid()) { 5426 warnx("%s: owner not root or current user", fname); 5427 return (-1); 5428 } 5429 if (st.st_mode & (S_IRWXG | S_IRWXO)) { 5430 warnx("%s: group/world readable/writeable", fname); 5431 return (-1); 5432 } 5433 return (0); 5434} 5435 5436struct file * 5437pushfile(const char *name, int secret) 5438{ 5439 struct file *nfile; 5440 5441 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 5442 (nfile->name = strdup(name)) == NULL) { 5443 if (nfile) 5444 free(nfile); 5445 warn("malloc"); 5446 return (NULL); 5447 } 5448 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 5449 nfile->stream = stdin; 5450 free(nfile->name); 5451 if ((nfile->name = strdup("stdin")) == NULL) { 5452 warn("strdup"); 5453 free(nfile); 5454 return (NULL); 5455 } 5456 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 5457 warn("%s", nfile->name); 5458 free(nfile->name); 5459 free(nfile); 5460 return (NULL); 5461 } else if (secret && 5462 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 5463 fclose(nfile->stream); 5464 free(nfile->name); 5465 free(nfile); 5466 return (NULL); 5467 } 5468 nfile->lineno = 1; 5469 TAILQ_INSERT_TAIL(&files, nfile, entry); 5470 return (nfile); 5471} 5472 5473int 5474popfile(void) 5475{ 5476 struct file *prev; 5477 5478 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 5479 prev->errors += file->errors; 5480 TAILQ_REMOVE(&files, file, entry); 5481 fclose(file->stream); 5482 free(file->name); 5483 free(file); 5484 file = prev; 5485 return (0); 5486 } 5487 return (EOF); 5488} 5489 5490int 5491parse_config(char *filename, struct pfctl *xpf) 5492{ 5493 int errors = 0; 5494 struct sym *sym; 5495 5496 pf = xpf; 5497 errors = 0; 5498 rulestate = PFCTL_STATE_NONE; 5499 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5500 returnicmp6default = 5501 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5502 blockpolicy = PFRULE_DROP; 5503 require_order = 0; 5504 5505 if ((file = pushfile(filename, 0)) == NULL) { 5506 warn("cannot open the main config file!"); 5507 return (-1); 5508 } 5509 5510 yyparse(); 5511 errors = file->errors; 5512 popfile(); 5513 5514 /* Free macros and check which have not been used. */ 5515 while ((sym = TAILQ_FIRST(&symhead))) { 5516 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5517 fprintf(stderr, "warning: macro '%s' not " 5518 "used\n", sym->nam); 5519 free(sym->nam); 5520 free(sym->val); 5521 TAILQ_REMOVE(&symhead, sym, entry); 5522 free(sym); 5523 } 5524 5525 return (errors ? -1 : 0); 5526} 5527 5528int 5529symset(const char *nam, const char *val, int persist) 5530{ 5531 struct sym *sym; 5532 5533 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5534 sym = TAILQ_NEXT(sym, entry)) 5535 ; /* nothing */ 5536 5537 if (sym != NULL) { 5538 if (sym->persist == 1) 5539 return (0); 5540 else { 5541 free(sym->nam); 5542 free(sym->val); 5543 TAILQ_REMOVE(&symhead, sym, entry); 5544 free(sym); 5545 } 5546 } 5547 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5548 return (-1); 5549 5550 sym->nam = strdup(nam); 5551 if (sym->nam == NULL) { 5552 free(sym); 5553 return (-1); 5554 } 5555 sym->val = strdup(val); 5556 if (sym->val == NULL) { 5557 free(sym->nam); 5558 free(sym); 5559 return (-1); 5560 } 5561 sym->used = 0; 5562 sym->persist = persist; 5563 TAILQ_INSERT_TAIL(&symhead, sym, entry); 5564 return (0); 5565} 5566 5567int 5568pfctl_cmdline_symset(char *s) 5569{ 5570 char *sym, *val; 5571 int ret; 5572 5573 if ((val = strrchr(s, '=')) == NULL) 5574 return (-1); 5575 5576 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5577 err(1, "pfctl_cmdline_symset: malloc"); 5578 5579 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5580 5581 ret = symset(sym, val + 1, 1); 5582 free(sym); 5583 5584 return (ret); 5585} 5586 5587char * 5588symget(const char *nam) 5589{ 5590 struct sym *sym; 5591 5592 TAILQ_FOREACH(sym, &symhead, entry) 5593 if (strcmp(nam, sym->nam) == 0) { 5594 sym->used = 1; 5595 return (sym->val); 5596 } 5597 return (NULL); 5598} 5599 5600void 5601mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5602{ 5603 struct pf_rule *r; 5604 5605 while ((r = TAILQ_FIRST(src->rules.active.ptr)) != NULL) { 5606 TAILQ_REMOVE(src->rules.active.ptr, r, entries); 5607 TAILQ_INSERT_TAIL(dst->rules.active.ptr, r, entries); 5608 dst->anchor->match++; 5609 } 5610 src->anchor->match = 0; 5611 while ((r = TAILQ_FIRST(src->rules.inactive.ptr)) != NULL) { 5612 TAILQ_REMOVE(src->rules.inactive.ptr, r, entries); 5613 TAILQ_INSERT_TAIL(dst->rules.inactive.ptr, r, entries); 5614 } 5615} 5616 5617void 5618decide_address_family(struct node_host *n, sa_family_t *af) 5619{ 5620 if (*af != 0 || n == NULL) 5621 return; 5622 *af = n->af; 5623 while ((n = n->next) != NULL) { 5624 if (n->af != *af) { 5625 *af = 0; 5626 return; 5627 } 5628 } 5629} 5630 5631int 5632invalid_redirect(struct node_host *nh, sa_family_t af) 5633{ 5634 if (!af) { 5635 struct node_host *n; 5636 5637 /* tables and dyniftl are ok without an address family */ 5638 for (n = nh; n != NULL; n = n->next) { 5639 if (n->addr.type != PF_ADDR_TABLE && 5640 n->addr.type != PF_ADDR_DYNIFTL) { 5641 yyerror("address family not given and " 5642 "translation address expands to multiple " 5643 "address families"); 5644 return (1); 5645 } 5646 } 5647 } 5648 if (nh == NULL) { 5649 yyerror("no translation address with matching address family " 5650 "found."); 5651 return (1); 5652 } 5653 return (0); 5654} 5655 5656int 5657atoul(char *s, u_long *ulvalp) 5658{ 5659 u_long ulval; 5660 char *ep; 5661 5662 errno = 0; 5663 ulval = strtoul(s, &ep, 0); 5664 if (s[0] == '\0' || *ep != '\0') 5665 return (-1); 5666 if (errno == ERANGE && ulval == ULONG_MAX) 5667 return (-1); 5668 *ulvalp = ulval; 5669 return (0); 5670} 5671 5672int 5673getservice(char *n) 5674{ 5675 struct servent *s; 5676 u_long ulval; 5677 5678 if (atoul(n, &ulval) == 0) { 5679 if (ulval > 65535) { 5680 yyerror("illegal port value %lu", ulval); 5681 return (-1); 5682 } 5683 return (htons(ulval)); 5684 } else { 5685 s = getservbyname(n, "tcp"); 5686 if (s == NULL) 5687 s = getservbyname(n, "udp"); 5688 if (s == NULL) { 5689 yyerror("unknown port %s", n); 5690 return (-1); 5691 } 5692 return (s->s_port); 5693 } 5694} 5695 5696int 5697rule_label(struct pf_rule *r, char *s) 5698{ 5699 if (s) { 5700 if (strlcpy(r->label, s, sizeof(r->label)) >= 5701 sizeof(r->label)) { 5702 yyerror("rule label too long (max %d chars)", 5703 sizeof(r->label)-1); 5704 return (-1); 5705 } 5706 } 5707 return (0); 5708} 5709 5710u_int16_t 5711parseicmpspec(char *w, sa_family_t af) 5712{ 5713 const struct icmpcodeent *p; 5714 u_long ulval; 5715 u_int8_t icmptype; 5716 5717 if (af == AF_INET) 5718 icmptype = returnicmpdefault >> 8; 5719 else 5720 icmptype = returnicmp6default >> 8; 5721 5722 if (atoul(w, &ulval) == -1) { 5723 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5724 yyerror("unknown icmp code %s", w); 5725 return (0); 5726 } 5727 ulval = p->code; 5728 } 5729 if (ulval > 255) { 5730 yyerror("invalid icmp code %lu", ulval); 5731 return (0); 5732 } 5733 return (icmptype << 8 | ulval); 5734} 5735 5736int 5737parseport(char *port, struct range *r, int extensions) 5738{ 5739 char *p = strchr(port, ':'); 5740 5741 if (p == NULL) { 5742 if ((r->a = getservice(port)) == -1) 5743 return (-1); 5744 r->b = 0; 5745 r->t = PF_OP_NONE; 5746 return (0); 5747 } 5748 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 5749 *p = 0; 5750 if ((r->a = getservice(port)) == -1) 5751 return (-1); 5752 r->b = 0; 5753 r->t = PF_OP_IRG; 5754 return (0); 5755 } 5756 if ((extensions & PPORT_RANGE)) { 5757 *p++ = 0; 5758 if ((r->a = getservice(port)) == -1 || 5759 (r->b = getservice(p)) == -1) 5760 return (-1); 5761 if (r->a == r->b) { 5762 r->b = 0; 5763 r->t = PF_OP_NONE; 5764 } else 5765 r->t = PF_OP_RRG; 5766 return (0); 5767 } 5768 return (-1); 5769} 5770 5771int 5772pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5773{ 5774 struct loadanchors *la; 5775 5776 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5777 if (pf->opts & PF_OPT_VERBOSE) 5778 fprintf(stderr, "\nLoading anchor %s from %s\n", 5779 la->anchorname, la->filename); 5780 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 5781 la->anchorname, trans) == -1) 5782 return (-1); 5783 } 5784 5785 return (0); 5786} 5787 5788int 5789kw_casecmp(const void *k, const void *e) 5790{ 5791 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 5792} 5793 5794int 5795map_tos(char *s, int *val) 5796{ 5797 /* DiffServ Codepoints and other TOS mappings */ 5798 const struct keywords toswords[] = { 5799 { "af11", IPTOS_DSCP_AF11 }, 5800 { "af12", IPTOS_DSCP_AF12 }, 5801 { "af13", IPTOS_DSCP_AF13 }, 5802 { "af21", IPTOS_DSCP_AF21 }, 5803 { "af22", IPTOS_DSCP_AF22 }, 5804 { "af23", IPTOS_DSCP_AF23 }, 5805 { "af31", IPTOS_DSCP_AF31 }, 5806 { "af32", IPTOS_DSCP_AF32 }, 5807 { "af33", IPTOS_DSCP_AF33 }, 5808 { "af41", IPTOS_DSCP_AF41 }, 5809 { "af42", IPTOS_DSCP_AF42 }, 5810 { "af43", IPTOS_DSCP_AF43 }, 5811 { "critical", IPTOS_PREC_CRITIC_ECP }, 5812 { "cs0", IPTOS_DSCP_CS0 }, 5813 { "cs1", IPTOS_DSCP_CS1 }, 5814 { "cs2", IPTOS_DSCP_CS2 }, 5815 { "cs3", IPTOS_DSCP_CS3 }, 5816 { "cs4", IPTOS_DSCP_CS4 }, 5817 { "cs5", IPTOS_DSCP_CS5 }, 5818 { "cs6", IPTOS_DSCP_CS6 }, 5819 { "cs7", IPTOS_DSCP_CS7 }, 5820 { "ef", IPTOS_DSCP_EF }, 5821 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 5822 { "lowdelay", IPTOS_LOWDELAY }, 5823 { "netcontrol", IPTOS_PREC_NETCONTROL }, 5824 { "reliability", IPTOS_RELIABILITY }, 5825 { "throughput", IPTOS_THROUGHPUT } 5826 }; 5827 const struct keywords *p; 5828 5829 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 5830 sizeof(toswords[0]), kw_casecmp); 5831 5832 if (p) { 5833 *val = p->k_val; 5834 return (1); 5835 } 5836 return (0); 5837} 5838