parse.y revision 1.650
1/* $OpenBSD: parse.y,v 1.650 2016/06/16 15:46:20 henning Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/types.h> 31#include <sys/socket.h> 32#include <sys/stat.h> 33#include <net/if.h> 34#include <netinet/in.h> 35#include <netinet/ip.h> 36#include <netinet/ip_icmp.h> 37#include <netinet/icmp6.h> 38#include <net/pfvar.h> 39#include <net/hfsc.h> 40#include <arpa/inet.h> 41 42#include <stdio.h> 43#include <unistd.h> 44#include <stdlib.h> 45#include <netdb.h> 46#include <stdarg.h> 47#include <errno.h> 48#include <string.h> 49#include <ctype.h> 50#include <math.h> 51#include <err.h> 52#include <limits.h> 53#include <pwd.h> 54#include <grp.h> 55#include <md5.h> 56 57#include "pfctl_parser.h" 58#include "pfctl.h" 59 60static struct pfctl *pf = NULL; 61static int debug = 0; 62static u_int16_t returnicmpdefault = 63 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 64static u_int16_t returnicmp6default = 65 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 66static int blockpolicy = PFRULE_DROP; 67static int default_statelock; 68 69TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 70static struct file { 71 TAILQ_ENTRY(file) entry; 72 FILE *stream; 73 char *name; 74 int lineno; 75 int errors; 76} *file; 77struct file *pushfile(const char *, int); 78int popfile(void); 79int check_file_secrecy(int, const char *); 80int yyparse(void); 81int yylex(void); 82int yyerror(const char *, ...); 83int kw_cmp(const void *, const void *); 84int lookup(char *); 85int lgetc(int); 86int lungetc(int); 87int findeol(void); 88 89TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 90struct sym { 91 TAILQ_ENTRY(sym) entry; 92 int used; 93 int persist; 94 char *nam; 95 char *val; 96}; 97int symset(const char *, const char *, int); 98char *symget(const char *); 99 100int atoul(char *, u_long *); 101 102struct node_proto { 103 u_int8_t proto; 104 struct node_proto *next; 105 struct node_proto *tail; 106}; 107 108struct node_port { 109 u_int16_t port[2]; 110 u_int8_t op; 111 struct node_port *next; 112 struct node_port *tail; 113}; 114 115struct node_uid { 116 uid_t uid[2]; 117 u_int8_t op; 118 struct node_uid *next; 119 struct node_uid *tail; 120}; 121 122struct node_gid { 123 gid_t gid[2]; 124 u_int8_t op; 125 struct node_gid *next; 126 struct node_gid *tail; 127}; 128 129struct node_icmp { 130 u_int8_t code; 131 u_int8_t type; 132 u_int8_t proto; 133 struct node_icmp *next; 134 struct node_icmp *tail; 135}; 136 137enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 138 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 139 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 140 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 141 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, 142 PF_STATE_OPT_PFLOW }; 143 144enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 145 146struct node_state_opt { 147 int type; 148 union { 149 u_int32_t max_states; 150 u_int32_t max_src_states; 151 u_int32_t max_src_conn; 152 struct { 153 u_int32_t limit; 154 u_int32_t seconds; 155 } max_src_conn_rate; 156 struct { 157 u_int8_t flush; 158 char tblname[PF_TABLE_NAME_SIZE]; 159 } overload; 160 u_int32_t max_src_nodes; 161 u_int8_t src_track; 162 u_int32_t statelock; 163 struct { 164 int number; 165 u_int32_t seconds; 166 } timeout; 167 } data; 168 struct node_state_opt *next; 169 struct node_state_opt *tail; 170}; 171 172struct peer { 173 struct node_host *host; 174 struct node_port *port; 175}; 176 177struct node_queue { 178 char queue[PF_QNAME_SIZE]; 179 char parent[PF_QNAME_SIZE]; 180 char ifname[IFNAMSIZ]; 181 int scheduler; 182 struct node_queue *next; 183 struct node_queue *tail; 184} *oqueues = NULL; 185 186struct node_qassign { 187 char *qname; 188 char *pqname; 189}; 190 191struct range { 192 int a; 193 int b; 194 int t; 195}; 196struct redirection { 197 struct node_host *host; 198 struct range rport; 199}; 200 201struct pool_opts { 202 int marker; 203#define POM_TYPE 0x01 204#define POM_STICKYADDRESS 0x02 205 u_int8_t opts; 206 int type; 207 int staticport; 208 struct pf_poolhashkey *key; 209 210} pool_opts; 211 212struct divertspec { 213 struct node_host *addr; 214 u_int16_t port; 215}; 216 217struct redirspec { 218 struct redirection *rdr; 219 struct pool_opts pool_opts; 220 int binat; 221 int af; 222}; 223 224struct filter_opts { 225 int marker; 226#define FOM_FLAGS 0x0001 227#define FOM_ICMP 0x0002 228#define FOM_TOS 0x0004 229#define FOM_KEEP 0x0008 230#define FOM_SRCTRACK 0x0010 231#define FOM_MINTTL 0x0020 232#define FOM_MAXMSS 0x0040 233#define FOM_AFTO 0x0080 234#define FOM_SETTOS 0x0100 235#define FOM_SCRUB_TCP 0x0200 236#define FOM_SETPRIO 0x0400 237#define FOM_ONCE 0x1000 238#define FOM_PRIO 0x2000 239 struct node_uid *uid; 240 struct node_gid *gid; 241 struct node_if *rcv; 242 struct { 243 u_int8_t b1; 244 u_int8_t b2; 245 u_int16_t w; 246 u_int16_t w2; 247 } flags; 248 struct node_icmp *icmpspec; 249 u_int32_t tos; 250 u_int32_t prob; 251 struct { 252 int action; 253 struct node_state_opt *options; 254 } keep; 255 int fragment; 256 int allowopts; 257 char *label; 258 struct node_qassign queues; 259 char *tag; 260 char *match_tag; 261 u_int8_t match_tag_not; 262 u_int rtableid; 263 u_int8_t prio; 264 u_int8_t set_prio[2]; 265 struct divertspec divert; 266 struct divertspec divert_packet; 267 struct redirspec nat; 268 struct redirspec rdr; 269 struct redirspec rroute; 270 271 /* scrub opts */ 272 int nodf; 273 int minttl; 274 int settos; 275 int randomid; 276 int max_mss; 277 278 /* route opts */ 279 struct { 280 struct node_host *host; 281 u_int8_t rt; 282 u_int8_t pool_opts; 283 sa_family_t af; 284 struct pf_poolhashkey *key; 285 } route; 286} filter_opts; 287 288struct antispoof_opts { 289 char *label; 290 u_int rtableid; 291} antispoof_opts; 292 293struct scrub_opts { 294 int marker; 295 int nodf; 296 int minttl; 297 int maxmss; 298 int settos; 299 int randomid; 300 int reassemble_tcp; 301} scrub_opts; 302 303struct node_sc { 304 struct node_queue_bw m1; 305 u_int d; 306 struct node_queue_bw m2; 307}; 308 309struct queue_opts { 310 int marker; 311#define QOM_BWSPEC 0x01 312#define QOM_PARENT 0x02 313#define QOM_DEFAULT 0x04 314#define QOM_QLIMIT 0x08 315 struct node_sc realtime; 316 struct node_sc linkshare; 317 struct node_sc upperlimit; 318 char *parent; 319 int flags; 320 u_int qlimit; 321} queue_opts; 322 323struct table_opts { 324 int flags; 325 int init_addr; 326 struct node_tinithead init_nodes; 327} table_opts; 328 329struct node_hfsc_opts hfsc_opts; 330struct node_state_opt *keep_state_defaults = NULL; 331 332int disallow_table(struct node_host *, const char *); 333int disallow_urpf_failed(struct node_host *, const char *); 334int disallow_alias(struct node_host *, const char *); 335int rule_consistent(struct pf_rule *, int); 336int process_tabledef(char *, struct table_opts *); 337void expand_label_str(char *, size_t, const char *, const char *); 338void expand_label_if(const char *, char *, size_t, const char *); 339void expand_label_addr(const char *, char *, size_t, u_int8_t, 340 struct node_host *); 341void expand_label_port(const char *, char *, size_t, 342 struct node_port *); 343void expand_label_proto(const char *, char *, size_t, u_int8_t); 344void expand_label_nr(const char *, char *, size_t); 345void expand_label(char *, size_t, const char *, u_int8_t, 346 struct node_host *, struct node_port *, struct node_host *, 347 struct node_port *, u_int8_t); 348int expand_divertspec(struct pf_rule *, struct divertspec *); 349int collapse_redirspec(struct pf_pool *, struct pf_rule *, 350 struct redirspec *rs, u_int8_t); 351int apply_redirspec(struct pf_pool *, struct pf_rule *, 352 struct redirspec *, int, struct node_port *); 353void expand_rule(struct pf_rule *, int, struct node_if *, 354 struct redirspec *, struct redirspec *, struct redirspec *, 355 struct node_proto *, 356 struct node_os *, struct node_host *, struct node_port *, 357 struct node_host *, struct node_port *, struct node_uid *, 358 struct node_gid *, struct node_if *, struct node_icmp *, 359 const char *); 360int expand_queue(char *, struct node_if *, struct queue_opts *); 361int expand_skip_interface(struct node_if *); 362 363int getservice(char *); 364int rule_label(struct pf_rule *, char *); 365 366void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 367void decide_address_family(struct node_host *, sa_family_t *); 368int invalid_redirect(struct node_host *, sa_family_t); 369u_int16_t parseicmpspec(char *, sa_family_t); 370int kw_casecmp(const void *, const void *); 371int map_tos(char *string, int *); 372 373TAILQ_HEAD(loadanchorshead, loadanchors) 374 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 375 376struct loadanchors { 377 TAILQ_ENTRY(loadanchors) entries; 378 char *anchorname; 379 char *filename; 380}; 381 382typedef struct { 383 union { 384 int64_t number; 385 double probability; 386 int i; 387 char *string; 388 u_int rtableid; 389 u_int16_t weight; 390 struct { 391 u_int8_t b1; 392 u_int8_t b2; 393 u_int16_t w; 394 u_int16_t w2; 395 } b; 396 struct range range; 397 struct node_if *interface; 398 struct node_proto *proto; 399 struct node_icmp *icmp; 400 struct node_host *host; 401 struct node_os *os; 402 struct node_port *port; 403 struct node_uid *uid; 404 struct node_gid *gid; 405 struct node_state_opt *state_opt; 406 struct peer peer; 407 struct { 408 struct peer src, dst; 409 struct node_os *src_os; 410 } fromto; 411 struct redirection *redirection; 412 struct { 413 int action; 414 struct node_state_opt *options; 415 } keep_state; 416 struct { 417 u_int8_t log; 418 u_int8_t logif; 419 u_int8_t quick; 420 } logquick; 421 struct { 422 int neg; 423 char *name; 424 } tagged; 425 struct pf_poolhashkey *hashkey; 426 struct node_queue *queue; 427 struct node_queue_opt queue_options; 428 struct node_queue_bw queue_bwspec; 429 struct node_qassign qassign; 430 struct node_sc sc; 431 struct filter_opts filter_opts; 432 struct antispoof_opts antispoof_opts; 433 struct queue_opts queue_opts; 434 struct scrub_opts scrub_opts; 435 struct table_opts table_opts; 436 struct pool_opts pool_opts; 437 struct node_hfsc_opts hfsc_opts; 438 } v; 439 int lineno; 440} YYSTYPE; 441 442#define PPORT_RANGE 1 443#define PPORT_STAR 2 444int parseport(char *, struct range *r, int); 445 446#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 447 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 448 !isdigit((unsigned char)(addr).v.ifname[strlen((addr).v.ifname)-1]))) 449 450%} 451 452%token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 453%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 454%token ICMP6TYPE CODE KEEP MODULATE STATE PORT BINATTO NODF 455%token MINTTL ERROR ALLOWOPTS FILENAME ROUTETO DUPTO REPLYTO NO LABEL 456%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 457%token REASSEMBLE ANCHOR 458%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 459%token SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 460%token ANTISPOOF FOR INCLUDE MATCHES 461%token BITMASK RANDOM SOURCEHASH ROUNDROBIN LEASTSTATES STATICPORT PROBABILITY 462%token WEIGHT BANDWIDTH 463%token QUEUE PRIORITY QLIMIT RTABLE RDOMAIN MINIMUM BURST PARENT 464%token LOAD RULESET_OPTIMIZATION RTABLE RDOMAIN PRIO ONCE DEFAULT 465%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 466%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW 467%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE 468%token DIVERTTO DIVERTREPLY DIVERTPACKET NATTO AFTO RDRTO RECEIVEDON NE LE GE 469%token <v.string> STRING 470%token <v.number> NUMBER 471%token <v.i> PORTBINARY 472%type <v.interface> interface if_list if_item_not if_item 473%type <v.number> number icmptype icmp6type uid gid 474%type <v.number> tos not yesno optnodf 475%type <v.probability> probability 476%type <v.weight> optweight 477%type <v.i> dir af optimizer 478%type <v.i> sourcetrack flush unaryop statelock 479%type <v.b> action 480%type <v.b> flags flag blockspec prio 481%type <v.range> portplain portstar portrange 482%type <v.hashkey> hashkey 483%type <v.proto> proto proto_list proto_item 484%type <v.number> protoval 485%type <v.icmp> icmpspec 486%type <v.icmp> icmp_list icmp_item 487%type <v.icmp> icmp6_list icmp6_item 488%type <v.number> reticmpspec reticmp6spec 489%type <v.fromto> fromto 490%type <v.peer> ipportspec from to 491%type <v.host> ipspec xhost host dynaddr host_list 492%type <v.host> table_host_list tablespec 493%type <v.host> redir_host_list redirspec 494%type <v.host> route_host route_host_list routespec 495%type <v.os> os xos os_list 496%type <v.port> portspec port_list port_item 497%type <v.uid> uids uid_list uid_item 498%type <v.gid> gids gid_list gid_item 499%type <v.redirection> redirpool 500%type <v.string> label stringall anchorname 501%type <v.string> string varstring numberstring 502%type <v.keep_state> keep 503%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 504%type <v.logquick> logquick quick log logopts logopt 505%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 506%type <v.qassign> qname 507%type <v.queue_bwspec> bandwidth 508%type <v.filter_opts> filter_opts filter_opt filter_opts_l 509%type <v.filter_opts> filter_sets filter_set filter_sets_l 510%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 511%type <v.queue_opts> queue_opts queue_opt queue_opts_l optscs 512%type <v.sc> scspec 513%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 514%type <v.table_opts> table_opts table_opt table_opts_l 515%type <v.pool_opts> pool_opts pool_opt pool_opts_l 516%% 517 518ruleset : /* empty */ 519 | ruleset include '\n' 520 | ruleset '\n' 521 | ruleset option '\n' 522 | ruleset pfrule '\n' 523 | ruleset anchorrule '\n' 524 | ruleset loadrule '\n' 525 | ruleset queuespec '\n' 526 | ruleset varset '\n' 527 | ruleset antispoof '\n' 528 | ruleset tabledef '\n' 529 | '{' fakeanchor '}' '\n'; 530 | ruleset error '\n' { file->errors++; } 531 ; 532 533include : INCLUDE STRING { 534 struct file *nfile; 535 536 if ((nfile = pushfile($2, 0)) == NULL) { 537 yyerror("failed to include file %s", $2); 538 free($2); 539 YYERROR; 540 } 541 free($2); 542 543 file = nfile; 544 lungetc('\n'); 545 } 546 ; 547 548/* 549 * apply to previously specified rule: must be careful to note 550 * what that is: pf or nat or binat or rdr 551 */ 552fakeanchor : fakeanchor '\n' 553 | fakeanchor anchorrule '\n' 554 | fakeanchor pfrule '\n' 555 | fakeanchor error '\n' 556 ; 557 558optimizer : string { 559 if (!strcmp($1, "none")) 560 $$ = 0; 561 else if (!strcmp($1, "basic")) 562 $$ = PF_OPTIMIZE_BASIC; 563 else if (!strcmp($1, "profile")) 564 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 565 else { 566 yyerror("unknown ruleset-optimization %s", $1); 567 YYERROR; 568 } 569 } 570 ; 571 572optnodf : /* empty */ { $$ = 0; } 573 | NODF { $$ = 1; } 574 ; 575 576option : SET REASSEMBLE yesno optnodf { 577 pfctl_set_reassembly(pf, $3, $4); 578 } 579 | SET OPTIMIZATION STRING { 580 if (pfctl_set_optimization(pf, $3) != 0) { 581 yyerror("unknown optimization %s", $3); 582 free($3); 583 YYERROR; 584 } 585 free($3); 586 } 587 | SET RULESET_OPTIMIZATION optimizer { 588 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 589 pf->opts |= PF_OPT_OPTIMIZE; 590 pf->optimize = $3; 591 } 592 } 593 | SET TIMEOUT timeout_spec 594 | SET TIMEOUT '{' optnl timeout_list '}' 595 | SET LIMIT limit_spec 596 | SET LIMIT '{' optnl limit_list '}' 597 | SET LOGINTERFACE stringall { 598 if (pfctl_set_logif(pf, $3) != 0) { 599 yyerror("error setting loginterface %s", $3); 600 free($3); 601 YYERROR; 602 } 603 free($3); 604 } 605 | SET HOSTID number { 606 if ($3 == 0 || $3 > UINT_MAX) { 607 yyerror("hostid must be non-zero"); 608 YYERROR; 609 } 610 pfctl_set_hostid(pf, $3); 611 } 612 | SET BLOCKPOLICY DROP { 613 if (pf->opts & PF_OPT_VERBOSE) 614 printf("set block-policy drop\n"); 615 blockpolicy = PFRULE_DROP; 616 } 617 | SET BLOCKPOLICY RETURN { 618 if (pf->opts & PF_OPT_VERBOSE) 619 printf("set block-policy return\n"); 620 blockpolicy = PFRULE_RETURN; 621 } 622 | SET FINGERPRINTS STRING { 623 if (pf->opts & PF_OPT_VERBOSE) 624 printf("set fingerprints \"%s\"\n", $3); 625 if (!pf->anchor->name[0]) { 626 if (pfctl_file_fingerprints(pf->dev, 627 pf->opts, $3)) { 628 yyerror("error loading " 629 "fingerprints %s", $3); 630 free($3); 631 YYERROR; 632 } 633 } 634 free($3); 635 } 636 | SET STATEPOLICY statelock { 637 if (pf->opts & PF_OPT_VERBOSE) 638 switch ($3) { 639 case 0: 640 printf("set state-policy floating\n"); 641 break; 642 case PFRULE_IFBOUND: 643 printf("set state-policy if-bound\n"); 644 break; 645 } 646 default_statelock = $3; 647 } 648 | SET DEBUG STRING { 649 if (pfctl_set_debug(pf, $3) != 0) { 650 yyerror("error setting debuglevel %s", $3); 651 free($3); 652 YYERROR; 653 } 654 free($3); 655 } 656 | SET DEBUG DEBUG { 657 if (pfctl_set_debug(pf, "debug") != 0) { 658 yyerror("error setting debuglevel debug"); 659 YYERROR; 660 } 661 } 662 | SET SKIP interface { 663 if (expand_skip_interface($3) != 0) { 664 yyerror("error setting skip interface(s)"); 665 YYERROR; 666 } 667 } 668 | SET STATEDEFAULTS state_opt_list { 669 if (keep_state_defaults != NULL) { 670 yyerror("cannot redefine state-defaults"); 671 YYERROR; 672 } 673 keep_state_defaults = $3; 674 } 675 ; 676 677stringall : STRING { $$ = $1; } 678 | ALL { 679 if (($$ = strdup("all")) == NULL) { 680 err(1, "stringall: strdup"); 681 } 682 } 683 ; 684 685string : STRING string { 686 if (asprintf(&$$, "%s %s", $1, $2) == -1) 687 err(1, "string: asprintf"); 688 free($1); 689 free($2); 690 } 691 | STRING 692 ; 693 694varstring : numberstring varstring { 695 if (asprintf(&$$, "%s %s", $1, $2) == -1) 696 err(1, "string: asprintf"); 697 free($1); 698 free($2); 699 } 700 | numberstring 701 ; 702 703numberstring : NUMBER { 704 char *s; 705 if (asprintf(&s, "%lld", $1) == -1) { 706 yyerror("string: asprintf"); 707 YYERROR; 708 } 709 $$ = s; 710 } 711 | STRING 712 ; 713 714varset : STRING '=' varstring { 715 if (pf->opts & PF_OPT_VERBOSE) 716 printf("%s = \"%s\"\n", $1, $3); 717 if (symset($1, $3, 0) == -1) 718 err(1, "cannot store variable %s", $1); 719 free($1); 720 free($3); 721 } 722 ; 723 724anchorname : STRING { $$ = $1; } 725 | /* empty */ { $$ = NULL; } 726 ; 727 728pfa_anchorlist : /* empty */ 729 | pfa_anchorlist '\n' 730 | pfa_anchorlist pfrule '\n' 731 | pfa_anchorlist anchorrule '\n' 732 | pfa_anchorlist include '\n' 733 ; 734 735pfa_anchor : '{' 736 { 737 char ta[PF_ANCHOR_NAME_SIZE]; 738 struct pf_ruleset *rs; 739 740 /* steping into a brace anchor */ 741 pf->asd++; 742 pf->bn++; 743 pf->brace = 1; 744 745 /* 746 * Anchor contents are parsed before the anchor rule 747 * production completes, so we don't know the real 748 * location yet. Create a holding ruleset in the root; 749 * contents will be moved afterwards. 750 */ 751 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 752 rs = pf_find_or_create_ruleset(ta); 753 if (rs == NULL) 754 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 755 pf->astack[pf->asd] = rs->anchor; 756 pf->anchor = rs->anchor; 757 } '\n' pfa_anchorlist '}' 758 { 759 pf->alast = pf->anchor; 760 pf->asd--; 761 pf->anchor = pf->astack[pf->asd]; 762 } 763 | /* empty */ 764 ; 765 766anchorrule : ANCHOR anchorname dir quick interface af proto fromto 767 filter_opts pfa_anchor 768 { 769 struct pf_rule r; 770 struct node_proto *proto; 771 772 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 773 free($2); 774 yyerror("anchor names beginning with '_' " 775 "are reserved for internal use"); 776 YYERROR; 777 } 778 779 memset(&r, 0, sizeof(r)); 780 if (pf->astack[pf->asd + 1]) { 781 if ($2 && strchr($2, '/') != NULL) { 782 free($2); 783 yyerror("anchor paths containing '/' " 784 "cannot be used for inline anchors."); 785 YYERROR; 786 } 787 788 /* Move inline rules into relative location. */ 789 pf_anchor_setup(&r, 790 &pf->astack[pf->asd]->ruleset, 791 $2 ? $2 : pf->alast->name); 792 793 if (r.anchor == NULL) 794 err(1, "anchorrule: unable to " 795 "create ruleset"); 796 797 if (pf->alast != r.anchor) { 798 if (r.anchor->match) { 799 yyerror("inline anchor '%s' " 800 "already exists", 801 r.anchor->name); 802 YYERROR; 803 } 804 mv_rules(&pf->alast->ruleset, 805 &r.anchor->ruleset); 806 } 807 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 808 pf->alast = r.anchor; 809 } else { 810 if (!$2) { 811 yyerror("anchors without explicit " 812 "rules must specify a name"); 813 YYERROR; 814 } 815 } 816 r.direction = $3; 817 r.quick = $4.quick; 818 r.af = $6; 819 r.prob = $9.prob; 820 r.rtableid = $9.rtableid; 821 822 if ($9.tag) 823 if (strlcpy(r.tagname, $9.tag, 824 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 825 yyerror("tag too long, max %u chars", 826 PF_TAG_NAME_SIZE - 1); 827 YYERROR; 828 } 829 if ($9.match_tag) 830 if (strlcpy(r.match_tagname, $9.match_tag, 831 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 832 yyerror("tag too long, max %u chars", 833 PF_TAG_NAME_SIZE - 1); 834 YYERROR; 835 } 836 r.match_tag_not = $9.match_tag_not; 837 if (rule_label(&r, $9.label)) 838 YYERROR; 839 free($9.label); 840 r.flags = $9.flags.b1; 841 r.flagset = $9.flags.b2; 842 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 843 yyerror("flags always false"); 844 YYERROR; 845 } 846 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 847 for (proto = $7; proto != NULL && 848 proto->proto != IPPROTO_TCP; 849 proto = proto->next) 850 ; /* nothing */ 851 if (proto == NULL && $7 != NULL) { 852 if ($9.flags.b1 || $9.flags.b2) 853 yyerror( 854 "flags only apply to tcp"); 855 if ($8.src_os) 856 yyerror( 857 "OS fingerprinting only " 858 "applies to tcp"); 859 YYERROR; 860 } 861 } 862 863 r.tos = $9.tos; 864 865 if ($9.keep.action) { 866 yyerror("cannot specify state handling " 867 "on anchors"); 868 YYERROR; 869 } 870 871 if ($9.route.rt) { 872 yyerror("cannot specify route handling " 873 "on anchors"); 874 YYERROR; 875 } 876 877 if ($9.marker & FOM_ONCE) { 878 yyerror("cannot specify 'once' " 879 "on anchors"); 880 YYERROR; 881 } 882 883 if ($9.match_tag) 884 if (strlcpy(r.match_tagname, $9.match_tag, 885 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 886 yyerror("tag too long, max %u chars", 887 PF_TAG_NAME_SIZE - 1); 888 YYERROR; 889 } 890 r.match_tag_not = $9.match_tag_not; 891 if ($9.marker & FOM_PRIO) { 892 if ($9.prio == 0) 893 r.prio = PF_PRIO_ZERO; 894 else 895 r.prio = $9.prio; 896 } 897 if ($9.marker & FOM_SETPRIO) { 898 r.set_prio[0] = $9.set_prio[0]; 899 r.set_prio[1] = $9.set_prio[1]; 900 r.scrub_flags |= PFSTATE_SETPRIO; 901 } 902 903 decide_address_family($8.src.host, &r.af); 904 decide_address_family($8.dst.host, &r.af); 905 906 expand_rule(&r, 0, $5, NULL, NULL, NULL, $7, $8.src_os, 907 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 908 $9.uid, $9.gid, $9.rcv, $9.icmpspec, 909 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 910 free($2); 911 pf->astack[pf->asd + 1] = NULL; 912 } 913 ; 914 915loadrule : LOAD ANCHOR string FROM string { 916 struct loadanchors *loadanchor; 917 918 if (strlen(pf->anchor->name) + 1 + 919 strlen($3) >= PATH_MAX) { 920 yyerror("anchorname %s too long, max %u\n", 921 $3, PATH_MAX - 1); 922 free($3); 923 YYERROR; 924 } 925 loadanchor = calloc(1, sizeof(struct loadanchors)); 926 if (loadanchor == NULL) 927 err(1, "loadrule: calloc"); 928 if ((loadanchor->anchorname = malloc(PATH_MAX)) == 929 NULL) 930 err(1, "loadrule: malloc"); 931 if (pf->anchor->name[0]) 932 snprintf(loadanchor->anchorname, PATH_MAX, 933 "%s/%s", pf->anchor->name, $3); 934 else 935 strlcpy(loadanchor->anchorname, $3, PATH_MAX); 936 if ((loadanchor->filename = strdup($5)) == NULL) 937 err(1, "loadrule: strdup"); 938 939 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 940 entries); 941 942 free($3); 943 free($5); 944 }; 945 946scrub_opts : { 947 bzero(&scrub_opts, sizeof scrub_opts); 948 } 949 scrub_opts_l 950 { $$ = scrub_opts; } 951 ; 952 953scrub_opts_l : scrub_opts_l comma scrub_opt 954 | scrub_opt 955 ; 956 957scrub_opt : NODF { 958 if (scrub_opts.nodf) { 959 yyerror("no-df cannot be respecified"); 960 YYERROR; 961 } 962 scrub_opts.nodf = 1; 963 } 964 | MINTTL NUMBER { 965 if (scrub_opts.marker & FOM_MINTTL) { 966 yyerror("min-ttl cannot be respecified"); 967 YYERROR; 968 } 969 if ($2 < 0 || $2 > 255) { 970 yyerror("illegal min-ttl value %d", $2); 971 YYERROR; 972 } 973 scrub_opts.marker |= FOM_MINTTL; 974 scrub_opts.minttl = $2; 975 } 976 | MAXMSS NUMBER { 977 if (scrub_opts.marker & FOM_MAXMSS) { 978 yyerror("max-mss cannot be respecified"); 979 YYERROR; 980 } 981 if ($2 < 0 || $2 > 65535) { 982 yyerror("illegal max-mss value %d", $2); 983 YYERROR; 984 } 985 scrub_opts.marker |= FOM_MAXMSS; 986 scrub_opts.maxmss = $2; 987 } 988 | REASSEMBLE STRING { 989 if (strcasecmp($2, "tcp") != 0) { 990 yyerror("scrub reassemble supports only tcp, " 991 "not '%s'", $2); 992 free($2); 993 YYERROR; 994 } 995 free($2); 996 if (scrub_opts.reassemble_tcp) { 997 yyerror("reassemble tcp cannot be respecified"); 998 YYERROR; 999 } 1000 scrub_opts.reassemble_tcp = 1; 1001 } 1002 | RANDOMID { 1003 if (scrub_opts.randomid) { 1004 yyerror("random-id cannot be respecified"); 1005 YYERROR; 1006 } 1007 scrub_opts.randomid = 1; 1008 } 1009 ; 1010 1011antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1012 struct pf_rule r; 1013 struct node_host *h = NULL, *hh; 1014 struct node_if *i, *j; 1015 1016 for (i = $3; i; i = i->next) { 1017 bzero(&r, sizeof(r)); 1018 1019 r.action = PF_DROP; 1020 r.direction = PF_IN; 1021 r.log = $2.log; 1022 r.logif = $2.logif; 1023 r.quick = $2.quick; 1024 r.af = $4; 1025 if (rule_label(&r, $5.label)) 1026 YYERROR; 1027 r.rtableid = $5.rtableid; 1028 j = calloc(1, sizeof(struct node_if)); 1029 if (j == NULL) 1030 err(1, "antispoof: calloc"); 1031 if (strlcpy(j->ifname, i->ifname, 1032 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1033 free(j); 1034 yyerror("interface name too long"); 1035 YYERROR; 1036 } 1037 j->not = 1; 1038 if (i->dynamic) { 1039 h = calloc(1, sizeof(*h)); 1040 if (h == NULL) 1041 err(1, "address: calloc"); 1042 h->addr.type = PF_ADDR_DYNIFTL; 1043 set_ipmask(h, 128); 1044 if (strlcpy(h->addr.v.ifname, i->ifname, 1045 sizeof(h->addr.v.ifname)) >= 1046 sizeof(h->addr.v.ifname)) { 1047 free(h); 1048 yyerror( 1049 "interface name too long"); 1050 YYERROR; 1051 } 1052 hh = malloc(sizeof(*hh)); 1053 if (hh == NULL) 1054 err(1, "address: malloc"); 1055 bcopy(h, hh, sizeof(*hh)); 1056 h->addr.iflags = PFI_AFLAG_NETWORK; 1057 } else { 1058 h = ifa_lookup(j->ifname, 1059 PFI_AFLAG_NETWORK); 1060 hh = NULL; 1061 } 1062 1063 if (h != NULL) 1064 expand_rule(&r, 0, j, NULL, NULL, NULL, 1065 NULL, NULL, h, NULL, NULL, NULL, 1066 NULL, NULL, NULL, NULL, ""); 1067 1068 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1069 bzero(&r, sizeof(r)); 1070 1071 r.action = PF_DROP; 1072 r.direction = PF_IN; 1073 r.log = $2.log; 1074 r.logif = $2.logif; 1075 r.quick = $2.quick; 1076 r.af = $4; 1077 if (rule_label(&r, $5.label)) 1078 YYERROR; 1079 r.rtableid = $5.rtableid; 1080 if (hh != NULL) 1081 h = hh; 1082 else 1083 h = ifa_lookup(i->ifname, 0); 1084 if (h != NULL) 1085 expand_rule(&r, 0, NULL, NULL, 1086 NULL, NULL, NULL, NULL, h, 1087 NULL, NULL, NULL, NULL, 1088 NULL, NULL, NULL, ""); 1089 } else 1090 free(hh); 1091 } 1092 free($5.label); 1093 } 1094 ; 1095 1096antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1097 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1098 ; 1099 1100antispoof_iflst : antispoof_if optnl { $$ = $1; } 1101 | antispoof_iflst comma antispoof_if optnl { 1102 $1->tail->next = $3; 1103 $1->tail = $3; 1104 $$ = $1; 1105 } 1106 ; 1107 1108antispoof_if : if_item { $$ = $1; } 1109 | '(' if_item ')' { 1110 $2->dynamic = 1; 1111 $$ = $2; 1112 } 1113 ; 1114 1115antispoof_opts : { 1116 bzero(&antispoof_opts, sizeof antispoof_opts); 1117 antispoof_opts.rtableid = -1; 1118 } 1119 antispoof_opts_l 1120 { $$ = antispoof_opts; } 1121 | /* empty */ { 1122 bzero(&antispoof_opts, sizeof antispoof_opts); 1123 antispoof_opts.rtableid = -1; 1124 $$ = antispoof_opts; 1125 } 1126 ; 1127 1128antispoof_opts_l : antispoof_opts_l antispoof_opt 1129 | antispoof_opt 1130 ; 1131 1132antispoof_opt : LABEL label { 1133 if (antispoof_opts.label) { 1134 yyerror("label cannot be redefined"); 1135 YYERROR; 1136 } 1137 antispoof_opts.label = $2; 1138 } 1139 | RTABLE NUMBER { 1140 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 1141 yyerror("invalid rtable id"); 1142 YYERROR; 1143 } 1144 antispoof_opts.rtableid = $2; 1145 } 1146 ; 1147 1148not : '!' { $$ = 1; } 1149 | /* empty */ { $$ = 0; } 1150 ; 1151 1152tabledef : TABLE '<' STRING '>' table_opts { 1153 struct node_host *h, *nh; 1154 struct node_tinit *ti, *nti; 1155 1156 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1157 yyerror("table name too long, max %d chars", 1158 PF_TABLE_NAME_SIZE - 1); 1159 free($3); 1160 YYERROR; 1161 } 1162 if (process_tabledef($3, &$5)) { 1163 free($3); 1164 YYERROR; 1165 } 1166 free($3); 1167 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); ti != NULL; 1168 ti = nti) { 1169 if (ti->file) 1170 free(ti->file); 1171 for (h = ti->host; h != NULL; h = nh) { 1172 nh = h->next; 1173 free(h); 1174 } 1175 nti = SIMPLEQ_NEXT(ti, entries); 1176 free(ti); 1177 } 1178 } 1179 ; 1180 1181table_opts : { 1182 bzero(&table_opts, sizeof table_opts); 1183 SIMPLEQ_INIT(&table_opts.init_nodes); 1184 } 1185 table_opts_l 1186 { $$ = table_opts; } 1187 | /* empty */ 1188 { 1189 bzero(&table_opts, sizeof table_opts); 1190 SIMPLEQ_INIT(&table_opts.init_nodes); 1191 $$ = table_opts; 1192 } 1193 ; 1194 1195table_opts_l : table_opts_l table_opt 1196 | table_opt 1197 ; 1198 1199table_opt : STRING { 1200 if (!strcmp($1, "const")) 1201 table_opts.flags |= PFR_TFLAG_CONST; 1202 else if (!strcmp($1, "persist")) 1203 table_opts.flags |= PFR_TFLAG_PERSIST; 1204 else if (!strcmp($1, "counters")) 1205 table_opts.flags |= PFR_TFLAG_COUNTERS; 1206 else { 1207 yyerror("invalid table option '%s'", $1); 1208 free($1); 1209 YYERROR; 1210 } 1211 free($1); 1212 } 1213 | '{' optnl '}' { table_opts.init_addr = 1; } 1214 | '{' optnl table_host_list '}' { 1215 struct node_host *n; 1216 struct node_tinit *ti; 1217 1218 for (n = $3; n != NULL; n = n->next) { 1219 switch (n->addr.type) { 1220 case PF_ADDR_ADDRMASK: 1221 continue; /* ok */ 1222 case PF_ADDR_RANGE: 1223 yyerror("address ranges are not " 1224 "permitted inside tables"); 1225 break; 1226 case PF_ADDR_DYNIFTL: 1227 yyerror("dynamic addresses are not " 1228 "permitted inside tables"); 1229 break; 1230 case PF_ADDR_TABLE: 1231 yyerror("tables cannot contain tables"); 1232 break; 1233 case PF_ADDR_NOROUTE: 1234 yyerror("\"no-route\" is not permitted " 1235 "inside tables"); 1236 break; 1237 case PF_ADDR_URPFFAILED: 1238 yyerror("\"urpf-failed\" is not " 1239 "permitted inside tables"); 1240 break; 1241 default: 1242 yyerror("unknown address type %d", 1243 n->addr.type); 1244 } 1245 YYERROR; 1246 } 1247 if (!(ti = calloc(1, sizeof(*ti)))) 1248 err(1, "table_opt: calloc"); 1249 ti->host = $3; 1250 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1251 entries); 1252 table_opts.init_addr = 1; 1253 } 1254 | FILENAME STRING { 1255 struct node_tinit *ti; 1256 1257 if (!(ti = calloc(1, sizeof(*ti)))) 1258 err(1, "table_opt: calloc"); 1259 ti->file = $2; 1260 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1261 entries); 1262 table_opts.init_addr = 1; 1263 } 1264 ; 1265 1266tablespec : xhost optweight { 1267 if ($2 > 0) { 1268 struct node_host *n; 1269 for (n = $1; n != NULL; n = n->next) 1270 n->weight = $2; 1271 } 1272 $$ = $1; 1273 } 1274 | '{' optnl table_host_list '}' { $$ = $3; } 1275 ; 1276 1277table_host_list : tablespec optnl { $$ = $1; } 1278 | table_host_list comma tablespec optnl { 1279 $1->tail->next = $3; 1280 $1->tail = $3->tail; 1281 $$ = $1; 1282 } 1283 ; 1284 1285queuespec : QUEUE STRING interface queue_opts { 1286 if ($3 == NULL && $4.parent == NULL) { 1287 yyerror("root queue without interface"); 1288 YYERROR; 1289 } 1290 if ($2[0] == '_') { 1291 yyerror("queue names must not start with _"); 1292 YYERROR; 1293 } 1294 expand_queue($2, $3, &$4); 1295 } 1296 ; 1297 1298queue_opts : { 1299 bzero(&queue_opts, sizeof queue_opts); 1300 } 1301 queue_opts_l 1302 { $$ = queue_opts; } 1303 ; 1304 1305queue_opts_l : queue_opts_l queue_opt 1306 | queue_opt 1307 ; 1308 1309queue_opt : BANDWIDTH scspec optscs { 1310 if (queue_opts.marker & QOM_BWSPEC) { 1311 yyerror("bandwidth cannot be respecified"); 1312 YYERROR; 1313 } 1314 queue_opts.marker |= QOM_BWSPEC; 1315 queue_opts.linkshare = $2; 1316 queue_opts.realtime= $3.realtime; 1317 queue_opts.upperlimit = $3.upperlimit; 1318 } 1319 | PARENT STRING { 1320 if (queue_opts.marker & QOM_PARENT) { 1321 yyerror("parent cannot be respecified"); 1322 YYERROR; 1323 } 1324 queue_opts.marker |= QOM_PARENT; 1325 queue_opts.parent = $2; 1326 } 1327 | DEFAULT { 1328 if (queue_opts.marker & QOM_DEFAULT) { 1329 yyerror("default cannot be respecified"); 1330 YYERROR; 1331 } 1332 queue_opts.marker |= QOM_DEFAULT; 1333 queue_opts.flags |= HFSC_DEFAULTCLASS; 1334 } 1335 | QLIMIT NUMBER { 1336 if (queue_opts.marker & QOM_QLIMIT) { 1337 yyerror("qlimit cannot be respecified"); 1338 YYERROR; 1339 } 1340 if ($2 < 0 || $2 > 65535) { 1341 yyerror("qlimit out of range: max 65535"); 1342 YYERROR; 1343 } 1344 queue_opts.marker |= QOM_QLIMIT; 1345 queue_opts.qlimit = $2; 1346 } 1347 ; 1348 1349optscs : /* nada */ { 1350 1351 } 1352 | comma MINIMUM scspec { 1353 $$.realtime = $3; 1354 } 1355 | comma MAXIMUM scspec { 1356 $$.upperlimit = $3; 1357 } 1358 | comma MINIMUM scspec comma MAXIMUM scspec { 1359 $$.realtime = $3; 1360 $$.upperlimit = $6; 1361 } 1362 | comma MAXIMUM scspec comma MINIMUM scspec { 1363 $$.realtime = $6; 1364 $$.upperlimit = $3; 1365 } 1366 ; 1367 1368scspec : bandwidth { 1369 $$.m2 = $1; 1370 $$.d = 0; 1371 if ($$.m2.bw_percent) { 1372 yyerror("no bandwidth in %% yet"); 1373 YYERROR; 1374 } 1375 } 1376 | bandwidth BURST bandwidth FOR STRING { 1377 u_long ul; 1378 char *cp; 1379 1380 ul = strtoul($5, &cp, 10); 1381 if (cp == NULL || strcmp(cp, "ms")) { 1382 yyerror("time in scspec must be in ms"); 1383 YYERROR; 1384 } 1385 1386 $$.m1 = $3; 1387 $$.d = ul; 1388 $$.m2 = $1; 1389 1390 if ($$.m1.bw_percent || $$.m2.bw_percent) { 1391 yyerror("no bandwidth in %% yet"); 1392 YYERROR; 1393 } 1394 } 1395 ; 1396 1397bandwidth : STRING { 1398 double bps; 1399 char *cp; 1400 1401 $$.bw_percent = 0; 1402 1403 bps = strtod($1, &cp); 1404 if (cp != NULL) { 1405 if (strlen(cp) > 1) { 1406 char *cu = cp + 1; 1407 if (!strcmp(cu, "Bit") || 1408 !strcmp(cu, "B") || 1409 !strcmp(cu, "bit") || 1410 !strcmp(cu, "b")) { 1411 *cu = 0; 1412 } 1413 } 1414 if (!strcmp(cp, "b")) 1415 ; /* nothing */ 1416 else if (!strcmp(cp, "K")) 1417 bps *= 1000; 1418 else if (!strcmp(cp, "M")) 1419 bps *= 1000 * 1000; 1420 else if (!strcmp(cp, "G")) 1421 bps *= 1000 * 1000 * 1000; 1422 else if (!strcmp(cp, "%")) { 1423 if (bps < 0 || bps > 100) { 1424 yyerror("bandwidth spec " 1425 "out of range"); 1426 free($1); 1427 YYERROR; 1428 } 1429 $$.bw_percent = bps; 1430 bps = 0; 1431 } else { 1432 yyerror("unknown unit \"%s\"", cp); 1433 free($1); 1434 YYERROR; 1435 } 1436 } 1437 free($1); 1438 $$.bw_absolute = (u_int32_t)bps; 1439 } 1440 | NUMBER { 1441 if ($1 < 0 || $1 > UINT_MAX) { 1442 yyerror("bandwidth number too big"); 1443 YYERROR; 1444 } 1445 $$.bw_percent = 0; 1446 $$.bw_absolute = $1; 1447 } 1448 ; 1449 1450pfrule : action dir logquick interface af proto fromto 1451 filter_opts 1452 { 1453 struct pf_rule r; 1454 struct node_state_opt *o; 1455 struct node_proto *proto; 1456 int srctrack = 0; 1457 int statelock = 0; 1458 int adaptive = 0; 1459 int defaults = 0; 1460 1461 memset(&r, 0, sizeof(r)); 1462 r.action = $1.b1; 1463 switch ($1.b2) { 1464 case PFRULE_RETURNRST: 1465 r.rule_flag |= PFRULE_RETURNRST; 1466 r.return_ttl = $1.w; 1467 break; 1468 case PFRULE_RETURNICMP: 1469 r.rule_flag |= PFRULE_RETURNICMP; 1470 r.return_icmp = $1.w; 1471 r.return_icmp6 = $1.w2; 1472 break; 1473 case PFRULE_RETURN: 1474 r.rule_flag |= PFRULE_RETURN; 1475 r.return_icmp = $1.w; 1476 r.return_icmp6 = $1.w2; 1477 break; 1478 } 1479 r.direction = $2; 1480 r.log = $3.log; 1481 r.logif = $3.logif; 1482 r.quick = $3.quick; 1483 r.prob = $8.prob; 1484 r.rtableid = $8.rtableid; 1485 1486 if ($8.nodf) 1487 r.scrub_flags |= PFSTATE_NODF; 1488 if ($8.randomid) 1489 r.scrub_flags |= PFSTATE_RANDOMID; 1490 if ($8.minttl) 1491 r.min_ttl = $8.minttl; 1492 if ($8.max_mss) 1493 r.max_mss = $8.max_mss; 1494 if ($8.marker & FOM_SETTOS) { 1495 r.scrub_flags |= PFSTATE_SETTOS; 1496 r.set_tos = $8.settos; 1497 } 1498 if ($8.marker & FOM_SCRUB_TCP) 1499 r.scrub_flags |= PFSTATE_SCRUB_TCP; 1500 if ($8.marker & FOM_PRIO) { 1501 if ($8.prio == 0) 1502 r.prio = PF_PRIO_ZERO; 1503 else 1504 r.prio = $8.prio; 1505 } 1506 if ($8.marker & FOM_SETPRIO) { 1507 r.set_prio[0] = $8.set_prio[0]; 1508 r.set_prio[1] = $8.set_prio[1]; 1509 r.scrub_flags |= PFSTATE_SETPRIO; 1510 } 1511 if ($8.marker & FOM_ONCE) { 1512 if (r.action == PF_MATCH) { 1513 yyerror("can't specify once for " 1514 "match rules"); 1515 YYERROR; 1516 } 1517 r.rule_flag |= PFRULE_ONCE; 1518 } 1519 if ($8.marker & FOM_AFTO) 1520 r.rule_flag |= PFRULE_AFTO; 1521 r.af = $5; 1522 1523 if ($8.tag) 1524 if (strlcpy(r.tagname, $8.tag, 1525 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1526 yyerror("tag too long, max %u chars", 1527 PF_TAG_NAME_SIZE - 1); 1528 YYERROR; 1529 } 1530 if ($8.match_tag) 1531 if (strlcpy(r.match_tagname, $8.match_tag, 1532 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1533 yyerror("tag too long, max %u chars", 1534 PF_TAG_NAME_SIZE - 1); 1535 YYERROR; 1536 } 1537 r.match_tag_not = $8.match_tag_not; 1538 if (rule_label(&r, $8.label)) 1539 YYERROR; 1540 free($8.label); 1541 r.flags = $8.flags.b1; 1542 r.flagset = $8.flags.b2; 1543 if (($8.flags.b1 & $8.flags.b2) != $8.flags.b1) { 1544 yyerror("flags always false"); 1545 YYERROR; 1546 } 1547 if ($8.flags.b1 || $8.flags.b2 || $7.src_os) { 1548 for (proto = $6; proto != NULL && 1549 proto->proto != IPPROTO_TCP; 1550 proto = proto->next) 1551 ; /* nothing */ 1552 if (proto == NULL && $6 != NULL) { 1553 if ($8.flags.b1 || $8.flags.b2) 1554 yyerror( 1555 "flags only apply to tcp"); 1556 if ($7.src_os) 1557 yyerror( 1558 "OS fingerprinting only " 1559 "apply to tcp"); 1560 YYERROR; 1561 } 1562#if 0 1563 if (($8.flags.b1 & parse_flags("S")) == 0 && 1564 $7.src_os) { 1565 yyerror("OS fingerprinting requires " 1566 "the SYN TCP flag (flags S/SA)"); 1567 YYERROR; 1568 } 1569#endif 1570 } 1571 1572 r.tos = $8.tos; 1573 r.keep_state = $8.keep.action; 1574 o = $8.keep.options; 1575 1576 /* 'keep state' by default on pass rules. */ 1577 if (!r.keep_state && !r.action && 1578 !($8.marker & FOM_KEEP)) { 1579 r.keep_state = PF_STATE_NORMAL; 1580 o = keep_state_defaults; 1581 defaults = 1; 1582 } 1583 1584 while (o) { 1585 struct node_state_opt *p = o; 1586 1587 switch (o->type) { 1588 case PF_STATE_OPT_MAX: 1589 if (r.max_states) { 1590 yyerror("state option 'max' " 1591 "multiple definitions"); 1592 YYERROR; 1593 } 1594 r.max_states = o->data.max_states; 1595 break; 1596 case PF_STATE_OPT_NOSYNC: 1597 if (r.rule_flag & PFRULE_NOSYNC) { 1598 yyerror("state option 'sync' " 1599 "multiple definitions"); 1600 YYERROR; 1601 } 1602 r.rule_flag |= PFRULE_NOSYNC; 1603 break; 1604 case PF_STATE_OPT_SRCTRACK: 1605 if (srctrack) { 1606 yyerror("state option " 1607 "'source-track' " 1608 "multiple definitions"); 1609 YYERROR; 1610 } 1611 srctrack = o->data.src_track; 1612 r.rule_flag |= PFRULE_SRCTRACK; 1613 break; 1614 case PF_STATE_OPT_MAX_SRC_STATES: 1615 if (r.max_src_states) { 1616 yyerror("state option " 1617 "'max-src-states' " 1618 "multiple definitions"); 1619 YYERROR; 1620 } 1621 if (o->data.max_src_states == 0) { 1622 yyerror("'max-src-states' must " 1623 "be > 0"); 1624 YYERROR; 1625 } 1626 r.max_src_states = 1627 o->data.max_src_states; 1628 r.rule_flag |= PFRULE_SRCTRACK; 1629 break; 1630 case PF_STATE_OPT_OVERLOAD: 1631 if (r.overload_tblname[0]) { 1632 yyerror("multiple 'overload' " 1633 "table definitions"); 1634 YYERROR; 1635 } 1636 if (strlcpy(r.overload_tblname, 1637 o->data.overload.tblname, 1638 PF_TABLE_NAME_SIZE) >= 1639 PF_TABLE_NAME_SIZE) { 1640 yyerror("state option: " 1641 "strlcpy"); 1642 YYERROR; 1643 } 1644 r.flush = o->data.overload.flush; 1645 break; 1646 case PF_STATE_OPT_MAX_SRC_CONN: 1647 if (r.max_src_conn) { 1648 yyerror("state option " 1649 "'max-src-conn' " 1650 "multiple definitions"); 1651 YYERROR; 1652 } 1653 if (o->data.max_src_conn == 0) { 1654 yyerror("'max-src-conn' " 1655 "must be > 0"); 1656 YYERROR; 1657 } 1658 r.max_src_conn = 1659 o->data.max_src_conn; 1660 r.rule_flag |= PFRULE_SRCTRACK | 1661 PFRULE_RULESRCTRACK; 1662 break; 1663 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1664 if (r.max_src_conn_rate.limit) { 1665 yyerror("state option " 1666 "'max-src-conn-rate' " 1667 "multiple definitions"); 1668 YYERROR; 1669 } 1670 if (!o->data.max_src_conn_rate.limit || 1671 !o->data.max_src_conn_rate.seconds) { 1672 yyerror("'max-src-conn-rate' " 1673 "values must be > 0"); 1674 YYERROR; 1675 } 1676 if (o->data.max_src_conn_rate.limit > 1677 PF_THRESHOLD_MAX) { 1678 yyerror("'max-src-conn-rate' " 1679 "maximum rate must be < %u", 1680 PF_THRESHOLD_MAX); 1681 YYERROR; 1682 } 1683 r.max_src_conn_rate.limit = 1684 o->data.max_src_conn_rate.limit; 1685 r.max_src_conn_rate.seconds = 1686 o->data.max_src_conn_rate.seconds; 1687 r.rule_flag |= PFRULE_SRCTRACK | 1688 PFRULE_RULESRCTRACK; 1689 break; 1690 case PF_STATE_OPT_MAX_SRC_NODES: 1691 if (r.max_src_nodes) { 1692 yyerror("state option " 1693 "'max-src-nodes' " 1694 "multiple definitions"); 1695 YYERROR; 1696 } 1697 if (o->data.max_src_nodes == 0) { 1698 yyerror("'max-src-nodes' must " 1699 "be > 0"); 1700 YYERROR; 1701 } 1702 r.max_src_nodes = 1703 o->data.max_src_nodes; 1704 r.rule_flag |= PFRULE_SRCTRACK | 1705 PFRULE_RULESRCTRACK; 1706 break; 1707 case PF_STATE_OPT_STATELOCK: 1708 if (statelock) { 1709 yyerror("state locking option: " 1710 "multiple definitions"); 1711 YYERROR; 1712 } 1713 statelock = 1; 1714 r.rule_flag |= o->data.statelock; 1715 break; 1716 case PF_STATE_OPT_SLOPPY: 1717 if (r.rule_flag & PFRULE_STATESLOPPY) { 1718 yyerror("state sloppy option: " 1719 "multiple definitions"); 1720 YYERROR; 1721 } 1722 r.rule_flag |= PFRULE_STATESLOPPY; 1723 break; 1724 case PF_STATE_OPT_PFLOW: 1725 if (r.rule_flag & PFRULE_PFLOW) { 1726 yyerror("state pflow " 1727 "option: multiple " 1728 "definitions"); 1729 YYERROR; 1730 } 1731 r.rule_flag |= PFRULE_PFLOW; 1732 break; 1733 case PF_STATE_OPT_TIMEOUT: 1734 if (o->data.timeout.number == 1735 PFTM_ADAPTIVE_START || 1736 o->data.timeout.number == 1737 PFTM_ADAPTIVE_END) 1738 adaptive = 1; 1739 if (r.timeout[o->data.timeout.number]) { 1740 yyerror("state timeout %s " 1741 "multiple definitions", 1742 pf_timeouts[o->data. 1743 timeout.number].name); 1744 YYERROR; 1745 } 1746 r.timeout[o->data.timeout.number] = 1747 o->data.timeout.seconds; 1748 } 1749 o = o->next; 1750 if (!defaults) 1751 free(p); 1752 } 1753 1754 /* 'flags S/SA' by default on stateful rules */ 1755 if (!r.action && !r.flags && !r.flagset && 1756 !$8.fragment && !($8.marker & FOM_FLAGS) && 1757 r.keep_state) { 1758 r.flags = parse_flags("S"); 1759 r.flagset = parse_flags("SA"); 1760 } 1761 if (!adaptive && r.max_states) { 1762 r.timeout[PFTM_ADAPTIVE_START] = 1763 (r.max_states / 10) * 6; 1764 r.timeout[PFTM_ADAPTIVE_END] = 1765 (r.max_states / 10) * 12; 1766 } 1767 if (r.rule_flag & PFRULE_SRCTRACK) { 1768 if (srctrack == PF_SRCTRACK_GLOBAL && 1769 r.max_src_nodes) { 1770 yyerror("'max-src-nodes' is " 1771 "incompatible with " 1772 "'source-track global'"); 1773 YYERROR; 1774 } 1775 if (srctrack == PF_SRCTRACK_GLOBAL && 1776 r.max_src_conn) { 1777 yyerror("'max-src-conn' is " 1778 "incompatible with " 1779 "'source-track global'"); 1780 YYERROR; 1781 } 1782 if (srctrack == PF_SRCTRACK_GLOBAL && 1783 r.max_src_conn_rate.seconds) { 1784 yyerror("'max-src-conn-rate' is " 1785 "incompatible with " 1786 "'source-track global'"); 1787 YYERROR; 1788 } 1789 if (r.timeout[PFTM_SRC_NODE] < 1790 r.max_src_conn_rate.seconds) 1791 r.timeout[PFTM_SRC_NODE] = 1792 r.max_src_conn_rate.seconds; 1793 r.rule_flag |= PFRULE_SRCTRACK; 1794 if (srctrack == PF_SRCTRACK_RULE) 1795 r.rule_flag |= PFRULE_RULESRCTRACK; 1796 } 1797 if (r.keep_state && !statelock) 1798 r.rule_flag |= default_statelock; 1799 1800 if ($8.fragment) 1801 r.rule_flag |= PFRULE_FRAGMENT; 1802 r.allow_opts = $8.allowopts; 1803 1804 decide_address_family($7.src.host, &r.af); 1805 decide_address_family($7.dst.host, &r.af); 1806 1807 if ($8.route.rt) { 1808 if (!r.direction) { 1809 yyerror("direction must be explicit " 1810 "with rules that specify routing"); 1811 YYERROR; 1812 } 1813 r.rt = $8.route.rt; 1814 r.route.opts = $8.route.pool_opts; 1815 if ($8.route.key != NULL) 1816 memcpy(&r.route.key, $8.route.key, 1817 sizeof(struct pf_poolhashkey)); 1818 } 1819 if (r.rt) { 1820 decide_address_family($8.route.host, &r.af); 1821 if ((r.route.opts & PF_POOL_TYPEMASK) == 1822 PF_POOL_NONE && ($8.route.host->next != NULL || 1823 $8.route.host->addr.type == PF_ADDR_TABLE || 1824 DYNIF_MULTIADDR($8.route.host->addr))) 1825 r.route.opts |= PF_POOL_ROUNDROBIN; 1826 if ($8.route.host->next != NULL) { 1827 if (!PF_POOL_DYNTYPE(r.route.opts)) { 1828 yyerror("address pool option " 1829 "not supported by type"); 1830 YYERROR; 1831 } 1832 } 1833 /* fake redirspec */ 1834 if (($8.rroute.rdr = calloc(1, 1835 sizeof(*$8.rroute.rdr))) == NULL) 1836 err(1, "$8.rroute.rdr"); 1837 $8.rroute.rdr->host = $8.route.host; 1838 } 1839 if ($8.queues.qname != NULL) { 1840 if (strlcpy(r.qname, $8.queues.qname, 1841 sizeof(r.qname)) >= sizeof(r.qname)) { 1842 yyerror("rule qname too long (max " 1843 "%d chars)", sizeof(r.qname)-1); 1844 YYERROR; 1845 } 1846 free($8.queues.qname); 1847 } 1848 if ($8.queues.pqname != NULL) { 1849 if (strlcpy(r.pqname, $8.queues.pqname, 1850 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1851 yyerror("rule pqname too long (max " 1852 "%d chars)", sizeof(r.pqname)-1); 1853 YYERROR; 1854 } 1855 free($8.queues.pqname); 1856 } 1857 if (expand_divertspec(&r, &$8.divert)) 1858 YYERROR; 1859 r.divert_packet.port = $8.divert_packet.port; 1860 1861 expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, &$8.rroute, $6, 1862 $7.src_os, 1863 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 1864 $8.uid, $8.gid, $8.rcv, $8.icmpspec, ""); 1865 } 1866 ; 1867 1868filter_opts : { 1869 bzero(&filter_opts, sizeof filter_opts); 1870 filter_opts.rtableid = -1; 1871 } 1872 filter_opts_l 1873 { $$ = filter_opts; } 1874 | /* empty */ { 1875 bzero(&filter_opts, sizeof filter_opts); 1876 filter_opts.rtableid = -1; 1877 $$ = filter_opts; 1878 } 1879 ; 1880 1881filter_opts_l : filter_opts_l filter_opt 1882 | filter_opt 1883 ; 1884 1885filter_opt : USER uids { 1886 if (filter_opts.uid) 1887 $2->tail->next = filter_opts.uid; 1888 filter_opts.uid = $2; 1889 } 1890 | GROUP gids { 1891 if (filter_opts.gid) 1892 $2->tail->next = filter_opts.gid; 1893 filter_opts.gid = $2; 1894 } 1895 | flags { 1896 if (filter_opts.marker & FOM_FLAGS) { 1897 yyerror("flags cannot be redefined"); 1898 YYERROR; 1899 } 1900 filter_opts.marker |= FOM_FLAGS; 1901 filter_opts.flags.b1 |= $1.b1; 1902 filter_opts.flags.b2 |= $1.b2; 1903 filter_opts.flags.w |= $1.w; 1904 filter_opts.flags.w2 |= $1.w2; 1905 } 1906 | icmpspec { 1907 if (filter_opts.marker & FOM_ICMP) { 1908 yyerror("icmp-type cannot be redefined"); 1909 YYERROR; 1910 } 1911 filter_opts.marker |= FOM_ICMP; 1912 filter_opts.icmpspec = $1; 1913 } 1914 | PRIO NUMBER { 1915 if (filter_opts.marker & FOM_PRIO) { 1916 yyerror("prio cannot be redefined"); 1917 YYERROR; 1918 } 1919 if ($2 < 0 || $2 > IFQ_MAXPRIO) { 1920 yyerror("prio must be 0 - %u", IFQ_MAXPRIO); 1921 YYERROR; 1922 } 1923 filter_opts.marker |= FOM_PRIO; 1924 filter_opts.prio = $2; 1925 } 1926 | TOS tos { 1927 if (filter_opts.marker & FOM_TOS) { 1928 yyerror("tos cannot be redefined"); 1929 YYERROR; 1930 } 1931 filter_opts.marker |= FOM_TOS; 1932 filter_opts.tos = $2; 1933 } 1934 | keep { 1935 if (filter_opts.marker & FOM_KEEP) { 1936 yyerror("modulate or keep cannot be redefined"); 1937 YYERROR; 1938 } 1939 filter_opts.marker |= FOM_KEEP; 1940 filter_opts.keep.action = $1.action; 1941 filter_opts.keep.options = $1.options; 1942 } 1943 | FRAGMENT { 1944 filter_opts.fragment = 1; 1945 } 1946 | ALLOWOPTS { 1947 filter_opts.allowopts = 1; 1948 } 1949 | LABEL label { 1950 if (filter_opts.label) { 1951 yyerror("label cannot be redefined"); 1952 YYERROR; 1953 } 1954 filter_opts.label = $2; 1955 } 1956 | QUEUE qname { 1957 if (filter_opts.queues.qname) { 1958 yyerror("queue cannot be redefined"); 1959 YYERROR; 1960 } 1961 filter_opts.queues = $2; 1962 } 1963 | TAG string { 1964 filter_opts.tag = $2; 1965 } 1966 | not TAGGED string { 1967 filter_opts.match_tag = $3; 1968 filter_opts.match_tag_not = $1; 1969 } 1970 | PROBABILITY probability { 1971 double p; 1972 1973 p = floor($2 * UINT_MAX + 0.5); 1974 if (p < 0.0 || p > UINT_MAX) { 1975 yyerror("invalid probability: %g%%", $2 * 100); 1976 YYERROR; 1977 } 1978 filter_opts.prob = (u_int32_t)p; 1979 if (filter_opts.prob == 0) 1980 filter_opts.prob = 1; 1981 } 1982 | RTABLE NUMBER { 1983 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 1984 yyerror("invalid rtable id"); 1985 YYERROR; 1986 } 1987 filter_opts.rtableid = $2; 1988 } 1989 | DIVERTTO STRING PORT portplain { 1990 if ((filter_opts.divert.addr = host($2)) == NULL) { 1991 yyerror("could not parse divert address: %s", 1992 $2); 1993 free($2); 1994 YYERROR; 1995 } 1996 free($2); 1997 filter_opts.divert.port = $4.a; 1998 if (!filter_opts.divert.port) { 1999 yyerror("invalid divert port: %u", ntohs($4.a)); 2000 YYERROR; 2001 } 2002 } 2003 | DIVERTREPLY { 2004 filter_opts.divert.port = 1; /* some random value */ 2005 } 2006 | DIVERTPACKET PORT number { 2007 /* 2008 * If IP reassembly was not turned off, also 2009 * forcibly enable TCP reassembly by default. 2010 */ 2011 if (pf->reassemble & PF_REASS_ENABLED) 2012 filter_opts.marker |= FOM_SCRUB_TCP; 2013 2014 if ($3 < 1 || $3 > 65535) { 2015 yyerror("invalid divert port"); 2016 YYERROR; 2017 } 2018 2019 filter_opts.divert_packet.port = htons($3); 2020 } 2021 | SCRUB '(' scrub_opts ')' { 2022 filter_opts.nodf = $3.nodf; 2023 filter_opts.minttl = $3.minttl; 2024 filter_opts.randomid = $3.randomid; 2025 filter_opts.max_mss = $3.maxmss; 2026 if ($3.reassemble_tcp) 2027 filter_opts.marker |= FOM_SCRUB_TCP; 2028 filter_opts.marker |= $3.marker; 2029 } 2030 | NATTO redirpool pool_opts { 2031 if (filter_opts.nat.rdr) { 2032 yyerror("cannot respecify nat-to/binat-to"); 2033 YYERROR; 2034 } 2035 filter_opts.nat.rdr = $2; 2036 memcpy(&filter_opts.nat.pool_opts, &$3, 2037 sizeof(filter_opts.nat.pool_opts)); 2038 } 2039 | AFTO af FROM redirpool pool_opts { 2040 if (filter_opts.nat.rdr) { 2041 yyerror("cannot respecify af-to"); 2042 YYERROR; 2043 } 2044 if ($2 == 0) { 2045 yyerror("no target address family specified"); 2046 YYERROR; 2047 } 2048 filter_opts.nat.af = $2; 2049 filter_opts.nat.rdr = $4; 2050 memcpy(&filter_opts.nat.pool_opts, &$5, 2051 sizeof(filter_opts.nat.pool_opts)); 2052 filter_opts.rdr.rdr = 2053 calloc(1, sizeof(struct redirection)); 2054 bzero(&filter_opts.rdr.pool_opts, 2055 sizeof(filter_opts.rdr.pool_opts)); 2056 filter_opts.marker |= FOM_AFTO; 2057 } 2058 | AFTO af FROM redirpool pool_opts TO redirpool pool_opts { 2059 if (filter_opts.nat.rdr) { 2060 yyerror("cannot respecify af-to"); 2061 YYERROR; 2062 } 2063 if ($2 == 0) { 2064 yyerror("no address family specified"); 2065 YYERROR; 2066 } 2067 if (($4->host->af && $4->host->af != $2) || 2068 ($7->host->af && $7->host->af != $2)) { 2069 yyerror("af-to addresses must be in the " 2070 "target address family"); 2071 YYERROR; 2072 } 2073 filter_opts.nat.af = $2; 2074 filter_opts.nat.rdr = $4; 2075 memcpy(&filter_opts.nat.pool_opts, &$5, 2076 sizeof(filter_opts.nat.pool_opts)); 2077 filter_opts.rdr.af = $2; 2078 filter_opts.rdr.rdr = $7; 2079 memcpy(&filter_opts.nat.pool_opts, &$8, 2080 sizeof(filter_opts.nat.pool_opts)); 2081 filter_opts.marker |= FOM_AFTO; 2082 } 2083 | RDRTO redirpool pool_opts { 2084 if (filter_opts.rdr.rdr) { 2085 yyerror("cannot respecify rdr-to"); 2086 YYERROR; 2087 } 2088 filter_opts.rdr.rdr = $2; 2089 memcpy(&filter_opts.rdr.pool_opts, &$3, 2090 sizeof(filter_opts.rdr.pool_opts)); 2091 } 2092 | BINATTO redirpool pool_opts { 2093 if (filter_opts.nat.rdr) { 2094 yyerror("cannot respecify nat-to/binat-to"); 2095 YYERROR; 2096 } 2097 filter_opts.nat.rdr = $2; 2098 filter_opts.nat.binat = 1; 2099 memcpy(&filter_opts.nat.pool_opts, &$3, 2100 sizeof(filter_opts.nat.pool_opts)); 2101 filter_opts.nat.pool_opts.staticport = 1; 2102 } 2103 | ROUTETO routespec pool_opts { 2104 filter_opts.route.host = $2; 2105 filter_opts.route.rt = PF_ROUTETO; 2106 filter_opts.route.pool_opts = $3.type | $3.opts; 2107 memcpy(&filter_opts.rroute.pool_opts, &$3, 2108 sizeof(filter_opts.rroute.pool_opts)); 2109 if ($3.key != NULL) 2110 filter_opts.route.key = $3.key; 2111 } 2112 | REPLYTO routespec pool_opts { 2113 filter_opts.route.host = $2; 2114 filter_opts.route.rt = PF_REPLYTO; 2115 filter_opts.route.pool_opts = $3.type | $3.opts; 2116 if ($3.key != NULL) 2117 filter_opts.route.key = $3.key; 2118 } 2119 | DUPTO routespec pool_opts { 2120 filter_opts.route.host = $2; 2121 filter_opts.route.rt = PF_DUPTO; 2122 filter_opts.route.pool_opts = $3.type | $3.opts; 2123 memcpy(&filter_opts.rroute.pool_opts, &$3, 2124 sizeof(filter_opts.rroute.pool_opts)); 2125 if ($3.key != NULL) 2126 filter_opts.route.key = $3.key; 2127 } 2128 | not RECEIVEDON if_item { 2129 if (filter_opts.rcv) { 2130 yyerror("cannot respecify received-on"); 2131 YYERROR; 2132 } 2133 filter_opts.rcv = $3; 2134 filter_opts.rcv->not = $1; 2135 } 2136 | ONCE { 2137 filter_opts.marker |= FOM_ONCE; 2138 } 2139 | filter_sets 2140 ; 2141 2142filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; } 2143 | SET filter_set { $$ = filter_opts; } 2144 ; 2145 2146filter_sets_l : filter_sets_l comma filter_set 2147 | filter_set 2148 ; 2149 2150filter_set : prio { 2151 if (filter_opts.marker & FOM_SETPRIO) { 2152 yyerror("prio cannot be redefined"); 2153 YYERROR; 2154 } 2155 filter_opts.marker |= FOM_SETPRIO; 2156 filter_opts.set_prio[0] = $1.b1; 2157 filter_opts.set_prio[1] = $1.b2; 2158 } 2159 | QUEUE qname { 2160 if (filter_opts.queues.qname) { 2161 yyerror("queue cannot be redefined"); 2162 YYERROR; 2163 } 2164 filter_opts.queues = $2; 2165 } 2166 | TOS tos { 2167 if (filter_opts.marker & FOM_SETTOS) { 2168 yyerror("tos cannot be respecified"); 2169 YYERROR; 2170 } 2171 filter_opts.marker |= FOM_SETTOS; 2172 filter_opts.settos = $2; 2173 } 2174 ; 2175 2176prio : PRIO NUMBER { 2177 if ($2 < 0 || $2 > IFQ_MAXPRIO) { 2178 yyerror("prio must be 0 - %u", IFQ_MAXPRIO); 2179 YYERROR; 2180 } 2181 $$.b1 = $$.b2 = $2; 2182 } 2183 | PRIO '(' NUMBER comma NUMBER ')' { 2184 if ($3 < 0 || $3 > IFQ_MAXPRIO || 2185 $5 < 0 || $5 > IFQ_MAXPRIO) { 2186 yyerror("prio must be 0 - %u", IFQ_MAXPRIO); 2187 YYERROR; 2188 } 2189 $$.b1 = $3; 2190 $$.b2 = $5; 2191 } 2192 ; 2193 2194probability : STRING { 2195 char *e; 2196 double p = strtod($1, &e); 2197 2198 if (*e == '%') { 2199 p *= 0.01; 2200 e++; 2201 } 2202 if (*e) { 2203 yyerror("invalid probability: %s", $1); 2204 free($1); 2205 YYERROR; 2206 } 2207 free($1); 2208 $$ = p; 2209 } 2210 | NUMBER { 2211 $$ = (double)$1; 2212 } 2213 ; 2214 2215 2216action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2217 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 2218 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2219 ; 2220 2221blockspec : /* empty */ { 2222 $$.b2 = blockpolicy; 2223 $$.w = returnicmpdefault; 2224 $$.w2 = returnicmp6default; 2225 } 2226 | DROP { 2227 $$.b2 = PFRULE_DROP; 2228 $$.w = 0; 2229 $$.w2 = 0; 2230 } 2231 | RETURNRST { 2232 $$.b2 = PFRULE_RETURNRST; 2233 $$.w = 0; 2234 $$.w2 = 0; 2235 } 2236 | RETURNRST '(' TTL NUMBER ')' { 2237 if ($4 < 0 || $4 > 255) { 2238 yyerror("illegal ttl value %d", $4); 2239 YYERROR; 2240 } 2241 $$.b2 = PFRULE_RETURNRST; 2242 $$.w = $4; 2243 $$.w2 = 0; 2244 } 2245 | RETURNICMP { 2246 $$.b2 = PFRULE_RETURNICMP; 2247 $$.w = returnicmpdefault; 2248 $$.w2 = returnicmp6default; 2249 } 2250 | RETURNICMP6 { 2251 $$.b2 = PFRULE_RETURNICMP; 2252 $$.w = returnicmpdefault; 2253 $$.w2 = returnicmp6default; 2254 } 2255 | RETURNICMP '(' reticmpspec ')' { 2256 $$.b2 = PFRULE_RETURNICMP; 2257 $$.w = $3; 2258 $$.w2 = returnicmpdefault; 2259 } 2260 | RETURNICMP6 '(' reticmp6spec ')' { 2261 $$.b2 = PFRULE_RETURNICMP; 2262 $$.w = returnicmpdefault; 2263 $$.w2 = $3; 2264 } 2265 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2266 $$.b2 = PFRULE_RETURNICMP; 2267 $$.w = $3; 2268 $$.w2 = $5; 2269 } 2270 | RETURN { 2271 $$.b2 = PFRULE_RETURN; 2272 $$.w = returnicmpdefault; 2273 $$.w2 = returnicmp6default; 2274 } 2275 ; 2276 2277reticmpspec : STRING { 2278 if (!($$ = parseicmpspec($1, AF_INET))) { 2279 free($1); 2280 YYERROR; 2281 } 2282 free($1); 2283 } 2284 | NUMBER { 2285 u_int8_t icmptype; 2286 2287 if ($1 < 0 || $1 > 255) { 2288 yyerror("invalid icmp code %lu", $1); 2289 YYERROR; 2290 } 2291 icmptype = returnicmpdefault >> 8; 2292 $$ = (icmptype << 8 | $1); 2293 } 2294 ; 2295 2296reticmp6spec : STRING { 2297 if (!($$ = parseicmpspec($1, AF_INET6))) { 2298 free($1); 2299 YYERROR; 2300 } 2301 free($1); 2302 } 2303 | NUMBER { 2304 u_int8_t icmptype; 2305 2306 if ($1 < 0 || $1 > 255) { 2307 yyerror("invalid icmp code %lu", $1); 2308 YYERROR; 2309 } 2310 icmptype = returnicmp6default >> 8; 2311 $$ = (icmptype << 8 | $1); 2312 } 2313 ; 2314 2315dir : /* empty */ { $$ = PF_INOUT; } 2316 | IN { $$ = PF_IN; } 2317 | OUT { $$ = PF_OUT; } 2318 ; 2319 2320quick : /* empty */ { $$.quick = 0; } 2321 | QUICK { $$.quick = 1; } 2322 ; 2323 2324logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2325 | log { $$ = $1; $$.quick = 0; } 2326 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2327 | log QUICK { $$ = $1; $$.quick = 1; } 2328 | QUICK log { $$ = $2; $$.quick = 1; } 2329 ; 2330 2331log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2332 | LOG '(' logopts ')' { 2333 $$.log = PF_LOG | $3.log; 2334 $$.logif = $3.logif; 2335 } 2336 ; 2337 2338logopts : logopt { $$ = $1; } 2339 | logopts comma logopt { 2340 $$.log = $1.log | $3.log; 2341 $$.logif = $3.logif; 2342 if ($$.logif == 0) 2343 $$.logif = $1.logif; 2344 } 2345 ; 2346 2347logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2348 | MATCHES { $$.log = PF_LOG_MATCHES; $$.logif = 0; } 2349 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2350 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2351 | TO string { 2352 const char *errstr; 2353 u_int i; 2354 2355 $$.log = 0; 2356 if (strncmp($2, "pflog", 5)) { 2357 yyerror("%s: should be a pflog interface", $2); 2358 free($2); 2359 YYERROR; 2360 } 2361 i = strtonum($2 + 5, 0, 255, &errstr); 2362 if (errstr) { 2363 yyerror("%s: %s", $2, errstr); 2364 free($2); 2365 YYERROR; 2366 } 2367 free($2); 2368 $$.logif = i; 2369 } 2370 ; 2371 2372interface : /* empty */ { $$ = NULL; } 2373 | ON if_item_not { $$ = $2; } 2374 | ON '{' optnl if_list '}' { $$ = $4; } 2375 ; 2376 2377if_list : if_item_not optnl { $$ = $1; } 2378 | if_list comma if_item_not optnl { 2379 $1->tail->next = $3; 2380 $1->tail = $3; 2381 $$ = $1; 2382 } 2383 ; 2384 2385if_item_not : not if_item { $$ = $2; $$->not = $1; } 2386 ; 2387 2388if_item : STRING { 2389 struct node_host *n; 2390 2391 $$ = calloc(1, sizeof(struct node_if)); 2392 if ($$ == NULL) 2393 err(1, "if_item: calloc"); 2394 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2395 sizeof($$->ifname)) { 2396 free($1); 2397 free($$); 2398 yyerror("interface name too long"); 2399 YYERROR; 2400 } 2401 2402 if ((n = ifa_exists($1)) != NULL) 2403 $$->ifa_flags = n->ifa_flags; 2404 2405 free($1); 2406 $$->not = 0; 2407 $$->next = NULL; 2408 $$->tail = $$; 2409 } 2410 | ANY { 2411 $$ = calloc(1, sizeof(struct node_if)); 2412 if ($$ == NULL) 2413 err(1, "if_item: calloc"); 2414 strlcpy($$->ifname, "any", sizeof($$->ifname)); 2415 $$->not = 0; 2416 $$->next = NULL; 2417 $$->tail = $$; 2418 } 2419 | RDOMAIN NUMBER { 2420 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 2421 yyerror("rdomain outside range"); 2422 YYERROR; 2423 } 2424 $$ = calloc(1, sizeof(struct node_if)); 2425 if ($$ == NULL) 2426 err(1, "if_item: calloc"); 2427 $$->not = 0; 2428 $$->use_rdomain = 1; 2429 $$->rdomain = $2; 2430 $$->next = NULL; 2431 $$->tail = $$; 2432 } 2433 ; 2434 2435af : /* empty */ { $$ = 0; } 2436 | INET { $$ = AF_INET; } 2437 | INET6 { $$ = AF_INET6; } 2438 ; 2439 2440proto : /* empty */ { $$ = NULL; } 2441 | PROTO proto_item { $$ = $2; } 2442 | PROTO '{' optnl proto_list '}' { $$ = $4; } 2443 ; 2444 2445proto_list : proto_item optnl { $$ = $1; } 2446 | proto_list comma proto_item optnl { 2447 $1->tail->next = $3; 2448 $1->tail = $3; 2449 $$ = $1; 2450 } 2451 ; 2452 2453proto_item : protoval { 2454 u_int8_t pr; 2455 2456 pr = (u_int8_t)$1; 2457 if (pr == 0) { 2458 yyerror("proto 0 cannot be used"); 2459 YYERROR; 2460 } 2461 $$ = calloc(1, sizeof(struct node_proto)); 2462 if ($$ == NULL) 2463 err(1, "proto_item: calloc"); 2464 $$->proto = pr; 2465 $$->next = NULL; 2466 $$->tail = $$; 2467 } 2468 ; 2469 2470protoval : STRING { 2471 struct protoent *p; 2472 2473 p = getprotobyname($1); 2474 if (p == NULL) { 2475 yyerror("unknown protocol %s", $1); 2476 free($1); 2477 YYERROR; 2478 } 2479 $$ = p->p_proto; 2480 free($1); 2481 } 2482 | NUMBER { 2483 if ($1 < 0 || $1 > 255) { 2484 yyerror("protocol outside range"); 2485 YYERROR; 2486 } 2487 } 2488 ; 2489 2490fromto : ALL { 2491 $$.src.host = NULL; 2492 $$.src.port = NULL; 2493 $$.dst.host = NULL; 2494 $$.dst.port = NULL; 2495 $$.src_os = NULL; 2496 } 2497 | from os to { 2498 $$.src = $1; 2499 $$.src_os = $2; 2500 $$.dst = $3; 2501 } 2502 ; 2503 2504os : /* empty */ { $$ = NULL; } 2505 | OS xos { $$ = $2; } 2506 | OS '{' optnl os_list '}' { $$ = $4; } 2507 ; 2508 2509xos : STRING { 2510 $$ = calloc(1, sizeof(struct node_os)); 2511 if ($$ == NULL) 2512 err(1, "os: calloc"); 2513 $$->os = $1; 2514 $$->tail = $$; 2515 } 2516 ; 2517 2518os_list : xos optnl { $$ = $1; } 2519 | os_list comma xos optnl { 2520 $1->tail->next = $3; 2521 $1->tail = $3; 2522 $$ = $1; 2523 } 2524 ; 2525 2526from : /* empty */ { 2527 $$.host = NULL; 2528 $$.port = NULL; 2529 } 2530 | FROM ipportspec { 2531 $$ = $2; 2532 } 2533 ; 2534 2535to : /* empty */ { 2536 $$.host = NULL; 2537 $$.port = NULL; 2538 } 2539 | TO ipportspec { 2540 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2541 "not permitted in a destination address")) 2542 YYERROR; 2543 $$ = $2; 2544 } 2545 ; 2546 2547ipportspec : ipspec { 2548 $$.host = $1; 2549 $$.port = NULL; 2550 } 2551 | ipspec PORT portspec { 2552 $$.host = $1; 2553 $$.port = $3; 2554 } 2555 | PORT portspec { 2556 $$.host = NULL; 2557 $$.port = $2; 2558 } 2559 ; 2560 2561optnl : '\n' optnl 2562 | /* empty */ 2563 ; 2564 2565ipspec : ANY { $$ = NULL; } 2566 | xhost { $$ = $1; } 2567 | '{' optnl host_list '}' { $$ = $3; } 2568 ; 2569 2570 2571host_list : ipspec optnl { $$ = $1; } 2572 | host_list comma ipspec optnl { 2573 if ($1 == NULL) { 2574 freehostlist($3); 2575 $$ = $1; 2576 } else if ($3 == NULL) { 2577 freehostlist($1); 2578 $$ = $3; 2579 } else { 2580 $1->tail->next = $3; 2581 $1->tail = $3->tail; 2582 $$ = $1; 2583 } 2584 } 2585 ; 2586 2587xhost : not host { 2588 struct node_host *n; 2589 2590 for (n = $2; n != NULL; n = n->next) 2591 n->not = $1; 2592 $$ = $2; 2593 } 2594 | not NOROUTE { 2595 $$ = calloc(1, sizeof(struct node_host)); 2596 if ($$ == NULL) 2597 err(1, "xhost: calloc"); 2598 $$->addr.type = PF_ADDR_NOROUTE; 2599 $$->next = NULL; 2600 $$->not = $1; 2601 $$->tail = $$; 2602 } 2603 | not URPFFAILED { 2604 $$ = calloc(1, sizeof(struct node_host)); 2605 if ($$ == NULL) 2606 err(1, "xhost: calloc"); 2607 $$->addr.type = PF_ADDR_URPFFAILED; 2608 $$->next = NULL; 2609 $$->not = $1; 2610 $$->tail = $$; 2611 } 2612 ; 2613 2614optweight : WEIGHT NUMBER { 2615 if ($2 < 1 || $2 > USHRT_MAX) { 2616 yyerror("weight out of range"); 2617 YYERROR; 2618 } 2619 $$ = $2; 2620 } 2621 | /* empty */ { $$ = 0; } 2622 ; 2623 2624host : STRING { 2625 if (($$ = host($1)) == NULL) { 2626 /* error. "any" is handled elsewhere */ 2627 free($1); 2628 yyerror("could not parse host specification"); 2629 YYERROR; 2630 } 2631 free($1); 2632 2633 } 2634 | STRING '-' STRING { 2635 struct node_host *b, *e; 2636 2637 if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 2638 free($1); 2639 free($3); 2640 yyerror("could not parse host specification"); 2641 YYERROR; 2642 } 2643 if (b->af != e->af || 2644 b->addr.type != PF_ADDR_ADDRMASK || 2645 e->addr.type != PF_ADDR_ADDRMASK || 2646 unmask(&b->addr.v.a.mask, b->af) != 2647 (b->af == AF_INET ? 32 : 128) || 2648 unmask(&e->addr.v.a.mask, e->af) != 2649 (e->af == AF_INET ? 32 : 128) || 2650 b->next != NULL || b->not || 2651 e->next != NULL || e->not) { 2652 free(b); 2653 free(e); 2654 free($1); 2655 free($3); 2656 yyerror("invalid address range"); 2657 YYERROR; 2658 } 2659 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 2660 sizeof(b->addr.v.a.mask)); 2661 b->addr.type = PF_ADDR_RANGE; 2662 $$ = b; 2663 free(e); 2664 free($1); 2665 free($3); 2666 } 2667 | STRING '/' NUMBER { 2668 char *buf; 2669 2670 if (asprintf(&buf, "%s/%lld", $1, $3) == -1) 2671 err(1, "host: asprintf"); 2672 free($1); 2673 if (($$ = host(buf)) == NULL) { 2674 /* error. "any" is handled elsewhere */ 2675 free(buf); 2676 yyerror("could not parse host specification"); 2677 YYERROR; 2678 } 2679 free(buf); 2680 } 2681 | NUMBER '/' NUMBER { 2682 char *buf; 2683 2684 /* ie. for 10/8 parsing */ 2685 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 2686 err(1, "host: asprintf"); 2687 if (($$ = host(buf)) == NULL) { 2688 /* error. "any" is handled elsewhere */ 2689 free(buf); 2690 yyerror("could not parse host specification"); 2691 YYERROR; 2692 } 2693 free(buf); 2694 } 2695 | dynaddr 2696 | dynaddr '/' NUMBER { 2697 struct node_host *n; 2698 2699 if ($3 < 0 || $3 > 128) { 2700 yyerror("bit number too big"); 2701 YYERROR; 2702 } 2703 $$ = $1; 2704 for (n = $1; n != NULL; n = n->next) 2705 set_ipmask(n, $3); 2706 } 2707 | '<' STRING '>' { 2708 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2709 yyerror("table name '%s' too long", $2); 2710 free($2); 2711 YYERROR; 2712 } 2713 $$ = calloc(1, sizeof(struct node_host)); 2714 if ($$ == NULL) 2715 err(1, "host: calloc"); 2716 $$->addr.type = PF_ADDR_TABLE; 2717 if (strlcpy($$->addr.v.tblname, $2, 2718 sizeof($$->addr.v.tblname)) >= 2719 sizeof($$->addr.v.tblname)) 2720 errx(1, "host: strlcpy"); 2721 free($2); 2722 $$->next = NULL; 2723 $$->tail = $$; 2724 } 2725 | ROUTE STRING { 2726 $$ = calloc(1, sizeof(struct node_host)); 2727 if ($$ == NULL) { 2728 free($2); 2729 err(1, "host: calloc"); 2730 } 2731 $$->addr.type = PF_ADDR_RTLABEL; 2732 if (strlcpy($$->addr.v.rtlabelname, $2, 2733 sizeof($$->addr.v.rtlabelname)) >= 2734 sizeof($$->addr.v.rtlabelname)) { 2735 yyerror("route label too long, max %u chars", 2736 sizeof($$->addr.v.rtlabelname) - 1); 2737 free($2); 2738 free($$); 2739 YYERROR; 2740 } 2741 $$->next = NULL; 2742 $$->tail = $$; 2743 free($2); 2744 } 2745 ; 2746 2747number : NUMBER 2748 | STRING { 2749 u_long ulval; 2750 2751 if (atoul($1, &ulval) == -1) { 2752 yyerror("%s is not a number", $1); 2753 free($1); 2754 YYERROR; 2755 } else 2756 $$ = ulval; 2757 free($1); 2758 } 2759 ; 2760 2761dynaddr : '(' STRING ')' { 2762 int flags = 0; 2763 char *p, *op; 2764 2765 op = $2; 2766 if (!isalpha((unsigned char)op[0])) { 2767 yyerror("invalid interface name '%s'", op); 2768 free(op); 2769 YYERROR; 2770 } 2771 while ((p = strrchr($2, ':')) != NULL) { 2772 if (!strcmp(p+1, "network")) 2773 flags |= PFI_AFLAG_NETWORK; 2774 else if (!strcmp(p+1, "broadcast")) 2775 flags |= PFI_AFLAG_BROADCAST; 2776 else if (!strcmp(p+1, "peer")) 2777 flags |= PFI_AFLAG_PEER; 2778 else if (!strcmp(p+1, "0")) 2779 flags |= PFI_AFLAG_NOALIAS; 2780 else { 2781 yyerror("interface %s has bad modifier", 2782 $2); 2783 free(op); 2784 YYERROR; 2785 } 2786 *p = '\0'; 2787 } 2788 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2789 free(op); 2790 yyerror("illegal combination of " 2791 "interface modifiers"); 2792 YYERROR; 2793 } 2794 $$ = calloc(1, sizeof(struct node_host)); 2795 if ($$ == NULL) 2796 err(1, "address: calloc"); 2797 $$->af = 0; 2798 set_ipmask($$, 128); 2799 $$->addr.type = PF_ADDR_DYNIFTL; 2800 $$->addr.iflags = flags; 2801 if (strlcpy($$->addr.v.ifname, $2, 2802 sizeof($$->addr.v.ifname)) >= 2803 sizeof($$->addr.v.ifname)) { 2804 free(op); 2805 free($$); 2806 yyerror("interface name too long"); 2807 YYERROR; 2808 } 2809 free(op); 2810 $$->next = NULL; 2811 $$->tail = $$; 2812 } 2813 ; 2814 2815portspec : port_item { $$ = $1; } 2816 | '{' optnl port_list '}' { $$ = $3; } 2817 ; 2818 2819port_list : port_item optnl { $$ = $1; } 2820 | port_list comma port_item optnl { 2821 $1->tail->next = $3; 2822 $1->tail = $3; 2823 $$ = $1; 2824 } 2825 ; 2826 2827port_item : portrange { 2828 $$ = calloc(1, sizeof(struct node_port)); 2829 if ($$ == NULL) 2830 err(1, "port_item: calloc"); 2831 $$->port[0] = $1.a; 2832 $$->port[1] = $1.b; 2833 if ($1.t) 2834 $$->op = PF_OP_RRG; 2835 else 2836 $$->op = PF_OP_EQ; 2837 $$->next = NULL; 2838 $$->tail = $$; 2839 } 2840 | unaryop portrange { 2841 if ($2.t) { 2842 yyerror("':' cannot be used with an other " 2843 "port operator"); 2844 YYERROR; 2845 } 2846 $$ = calloc(1, sizeof(struct node_port)); 2847 if ($$ == NULL) 2848 err(1, "port_item: calloc"); 2849 $$->port[0] = $2.a; 2850 $$->port[1] = $2.b; 2851 $$->op = $1; 2852 $$->next = NULL; 2853 $$->tail = $$; 2854 } 2855 | portrange PORTBINARY portrange { 2856 if ($1.t || $3.t) { 2857 yyerror("':' cannot be used with an other " 2858 "port operator"); 2859 YYERROR; 2860 } 2861 $$ = calloc(1, sizeof(struct node_port)); 2862 if ($$ == NULL) 2863 err(1, "port_item: calloc"); 2864 $$->port[0] = $1.a; 2865 $$->port[1] = $3.a; 2866 $$->op = $2; 2867 $$->next = NULL; 2868 $$->tail = $$; 2869 } 2870 ; 2871 2872portplain : numberstring { 2873 if (parseport($1, &$$, 0) == -1) { 2874 free($1); 2875 YYERROR; 2876 } 2877 free($1); 2878 } 2879 ; 2880 2881portrange : numberstring { 2882 if (parseport($1, &$$, PPORT_RANGE) == -1) { 2883 free($1); 2884 YYERROR; 2885 } 2886 free($1); 2887 } 2888 ; 2889 2890uids : uid_item { $$ = $1; } 2891 | '{' optnl uid_list '}' { $$ = $3; } 2892 ; 2893 2894uid_list : uid_item optnl { $$ = $1; } 2895 | uid_list comma uid_item optnl { 2896 $1->tail->next = $3; 2897 $1->tail = $3; 2898 $$ = $1; 2899 } 2900 ; 2901 2902uid_item : uid { 2903 $$ = calloc(1, sizeof(struct node_uid)); 2904 if ($$ == NULL) 2905 err(1, "uid_item: calloc"); 2906 $$->uid[0] = $1; 2907 $$->uid[1] = $1; 2908 $$->op = PF_OP_EQ; 2909 $$->next = NULL; 2910 $$->tail = $$; 2911 } 2912 | unaryop uid { 2913 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2914 yyerror("user unknown requires operator = or " 2915 "!="); 2916 YYERROR; 2917 } 2918 $$ = calloc(1, sizeof(struct node_uid)); 2919 if ($$ == NULL) 2920 err(1, "uid_item: calloc"); 2921 $$->uid[0] = $2; 2922 $$->uid[1] = $2; 2923 $$->op = $1; 2924 $$->next = NULL; 2925 $$->tail = $$; 2926 } 2927 | uid PORTBINARY uid { 2928 if ($1 == UID_MAX || $3 == UID_MAX) { 2929 yyerror("user unknown requires operator = or " 2930 "!="); 2931 YYERROR; 2932 } 2933 $$ = calloc(1, sizeof(struct node_uid)); 2934 if ($$ == NULL) 2935 err(1, "uid_item: calloc"); 2936 $$->uid[0] = $1; 2937 $$->uid[1] = $3; 2938 $$->op = $2; 2939 $$->next = NULL; 2940 $$->tail = $$; 2941 } 2942 ; 2943 2944uid : STRING { 2945 if (!strcmp($1, "unknown")) 2946 $$ = UID_MAX; 2947 else { 2948 struct passwd *pw; 2949 2950 if ((pw = getpwnam($1)) == NULL) { 2951 yyerror("unknown user %s", $1); 2952 free($1); 2953 YYERROR; 2954 } 2955 $$ = pw->pw_uid; 2956 } 2957 free($1); 2958 } 2959 | NUMBER { 2960 if ($1 < 0 || $1 >= UID_MAX) { 2961 yyerror("illegal uid value %lu", $1); 2962 YYERROR; 2963 } 2964 $$ = $1; 2965 } 2966 ; 2967 2968gids : gid_item { $$ = $1; } 2969 | '{' optnl gid_list '}' { $$ = $3; } 2970 ; 2971 2972gid_list : gid_item optnl { $$ = $1; } 2973 | gid_list comma gid_item optnl { 2974 $1->tail->next = $3; 2975 $1->tail = $3; 2976 $$ = $1; 2977 } 2978 ; 2979 2980gid_item : gid { 2981 $$ = calloc(1, sizeof(struct node_gid)); 2982 if ($$ == NULL) 2983 err(1, "gid_item: calloc"); 2984 $$->gid[0] = $1; 2985 $$->gid[1] = $1; 2986 $$->op = PF_OP_EQ; 2987 $$->next = NULL; 2988 $$->tail = $$; 2989 } 2990 | unaryop gid { 2991 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2992 yyerror("group unknown requires operator = or " 2993 "!="); 2994 YYERROR; 2995 } 2996 $$ = calloc(1, sizeof(struct node_gid)); 2997 if ($$ == NULL) 2998 err(1, "gid_item: calloc"); 2999 $$->gid[0] = $2; 3000 $$->gid[1] = $2; 3001 $$->op = $1; 3002 $$->next = NULL; 3003 $$->tail = $$; 3004 } 3005 | gid PORTBINARY gid { 3006 if ($1 == GID_MAX || $3 == GID_MAX) { 3007 yyerror("group unknown requires operator = or " 3008 "!="); 3009 YYERROR; 3010 } 3011 $$ = calloc(1, sizeof(struct node_gid)); 3012 if ($$ == NULL) 3013 err(1, "gid_item: calloc"); 3014 $$->gid[0] = $1; 3015 $$->gid[1] = $3; 3016 $$->op = $2; 3017 $$->next = NULL; 3018 $$->tail = $$; 3019 } 3020 ; 3021 3022gid : STRING { 3023 if (!strcmp($1, "unknown")) 3024 $$ = GID_MAX; 3025 else { 3026 struct group *grp; 3027 3028 if ((grp = getgrnam($1)) == NULL) { 3029 yyerror("unknown group %s", $1); 3030 free($1); 3031 YYERROR; 3032 } 3033 $$ = grp->gr_gid; 3034 } 3035 free($1); 3036 } 3037 | NUMBER { 3038 if ($1 < 0 || $1 >= GID_MAX) { 3039 yyerror("illegal gid value %lu", $1); 3040 YYERROR; 3041 } 3042 $$ = $1; 3043 } 3044 ; 3045 3046flag : STRING { 3047 int f; 3048 3049 if ((f = parse_flags($1)) < 0) { 3050 yyerror("bad flags %s", $1); 3051 free($1); 3052 YYERROR; 3053 } 3054 free($1); 3055 $$.b1 = f; 3056 } 3057 ; 3058 3059flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3060 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3061 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3062 ; 3063 3064icmpspec : ICMPTYPE icmp_item { $$ = $2; } 3065 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3066 | ICMP6TYPE icmp6_item { $$ = $2; } 3067 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3068 ; 3069 3070icmp_list : icmp_item optnl { $$ = $1; } 3071 | icmp_list comma icmp_item optnl { 3072 $1->tail->next = $3; 3073 $1->tail = $3; 3074 $$ = $1; 3075 } 3076 ; 3077 3078icmp6_list : icmp6_item optnl { $$ = $1; } 3079 | icmp6_list comma icmp6_item optnl { 3080 $1->tail->next = $3; 3081 $1->tail = $3; 3082 $$ = $1; 3083 } 3084 ; 3085 3086icmp_item : icmptype { 3087 $$ = calloc(1, sizeof(struct node_icmp)); 3088 if ($$ == NULL) 3089 err(1, "icmp_item: calloc"); 3090 $$->type = $1; 3091 $$->code = 0; 3092 $$->proto = IPPROTO_ICMP; 3093 $$->next = NULL; 3094 $$->tail = $$; 3095 } 3096 | icmptype CODE STRING { 3097 const struct icmpcodeent *p; 3098 3099 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3100 yyerror("unknown icmp-code %s", $3); 3101 free($3); 3102 YYERROR; 3103 } 3104 3105 free($3); 3106 $$ = calloc(1, sizeof(struct node_icmp)); 3107 if ($$ == NULL) 3108 err(1, "icmp_item: calloc"); 3109 $$->type = $1; 3110 $$->code = p->code + 1; 3111 $$->proto = IPPROTO_ICMP; 3112 $$->next = NULL; 3113 $$->tail = $$; 3114 } 3115 | icmptype CODE NUMBER { 3116 if ($3 < 0 || $3 > 255) { 3117 yyerror("illegal icmp-code %lu", $3); 3118 YYERROR; 3119 } 3120 $$ = calloc(1, sizeof(struct node_icmp)); 3121 if ($$ == NULL) 3122 err(1, "icmp_item: calloc"); 3123 $$->type = $1; 3124 $$->code = $3 + 1; 3125 $$->proto = IPPROTO_ICMP; 3126 $$->next = NULL; 3127 $$->tail = $$; 3128 } 3129 ; 3130 3131icmp6_item : icmp6type { 3132 $$ = calloc(1, sizeof(struct node_icmp)); 3133 if ($$ == NULL) 3134 err(1, "icmp_item: calloc"); 3135 $$->type = $1; 3136 $$->code = 0; 3137 $$->proto = IPPROTO_ICMPV6; 3138 $$->next = NULL; 3139 $$->tail = $$; 3140 } 3141 | icmp6type CODE STRING { 3142 const struct icmpcodeent *p; 3143 3144 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3145 yyerror("unknown icmp6-code %s", $3); 3146 free($3); 3147 YYERROR; 3148 } 3149 free($3); 3150 3151 $$ = calloc(1, sizeof(struct node_icmp)); 3152 if ($$ == NULL) 3153 err(1, "icmp_item: calloc"); 3154 $$->type = $1; 3155 $$->code = p->code + 1; 3156 $$->proto = IPPROTO_ICMPV6; 3157 $$->next = NULL; 3158 $$->tail = $$; 3159 } 3160 | icmp6type CODE NUMBER { 3161 if ($3 < 0 || $3 > 255) { 3162 yyerror("illegal icmp-code %lu", $3); 3163 YYERROR; 3164 } 3165 $$ = calloc(1, sizeof(struct node_icmp)); 3166 if ($$ == NULL) 3167 err(1, "icmp_item: calloc"); 3168 $$->type = $1; 3169 $$->code = $3 + 1; 3170 $$->proto = IPPROTO_ICMPV6; 3171 $$->next = NULL; 3172 $$->tail = $$; 3173 } 3174 ; 3175 3176icmptype : STRING { 3177 const struct icmptypeent *p; 3178 3179 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3180 yyerror("unknown icmp-type %s", $1); 3181 free($1); 3182 YYERROR; 3183 } 3184 $$ = p->type + 1; 3185 free($1); 3186 } 3187 | NUMBER { 3188 if ($1 < 0 || $1 > 255) { 3189 yyerror("illegal icmp-type %lu", $1); 3190 YYERROR; 3191 } 3192 $$ = $1 + 1; 3193 } 3194 ; 3195 3196icmp6type : STRING { 3197 const struct icmptypeent *p; 3198 3199 if ((p = geticmptypebyname($1, AF_INET6)) == 3200 NULL) { 3201 yyerror("unknown icmp6-type %s", $1); 3202 free($1); 3203 YYERROR; 3204 } 3205 $$ = p->type + 1; 3206 free($1); 3207 } 3208 | NUMBER { 3209 if ($1 < 0 || $1 > 255) { 3210 yyerror("illegal icmp6-type %lu", $1); 3211 YYERROR; 3212 } 3213 $$ = $1 + 1; 3214 } 3215 ; 3216 3217tos : STRING { 3218 int val; 3219 char *end; 3220 3221 if (map_tos($1, &val)) 3222 $$ = val; 3223 else if ($1[0] == '0' && $1[1] == 'x') { 3224 errno = 0; 3225 $$ = strtoul($1, &end, 16); 3226 if (errno || *end != '\0') 3227 $$ = 256; 3228 } else 3229 $$ = 256; /* flag bad argument */ 3230 if ($$ < 0 || $$ > 255) { 3231 yyerror("illegal tos value %s", $1); 3232 free($1); 3233 YYERROR; 3234 } 3235 free($1); 3236 } 3237 | NUMBER { 3238 $$ = $1; 3239 if ($$ < 0 || $$ > 255) { 3240 yyerror("illegal tos value %lld", $1); 3241 YYERROR; 3242 } 3243 } 3244 ; 3245 3246sourcetrack : /* empty */ { $$ = PF_SRCTRACK; } 3247 | GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3248 | RULE { $$ = PF_SRCTRACK_RULE; } 3249 ; 3250 3251statelock : IFBOUND { 3252 $$ = PFRULE_IFBOUND; 3253 } 3254 | FLOATING { 3255 $$ = 0; 3256 } 3257 ; 3258 3259keep : NO STATE { 3260 $$.action = 0; 3261 $$.options = NULL; 3262 } 3263 | KEEP STATE state_opt_spec { 3264 $$.action = PF_STATE_NORMAL; 3265 $$.options = $3; 3266 } 3267 | MODULATE STATE state_opt_spec { 3268 $$.action = PF_STATE_MODULATE; 3269 $$.options = $3; 3270 } 3271 | SYNPROXY STATE state_opt_spec { 3272 $$.action = PF_STATE_SYNPROXY; 3273 $$.options = $3; 3274 } 3275 ; 3276 3277flush : /* empty */ { $$ = 0; } 3278 | FLUSH { $$ = PF_FLUSH; } 3279 | FLUSH GLOBAL { 3280 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3281 } 3282 ; 3283 3284state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3285 | /* empty */ { $$ = NULL; } 3286 ; 3287 3288state_opt_list : state_opt_item { $$ = $1; } 3289 | state_opt_list comma state_opt_item { 3290 $1->tail->next = $3; 3291 $1->tail = $3; 3292 $$ = $1; 3293 } 3294 ; 3295 3296state_opt_item : MAXIMUM NUMBER { 3297 if ($2 < 0 || $2 > UINT_MAX) { 3298 yyerror("only positive values permitted"); 3299 YYERROR; 3300 } 3301 $$ = calloc(1, sizeof(struct node_state_opt)); 3302 if ($$ == NULL) 3303 err(1, "state_opt_item: calloc"); 3304 $$->type = PF_STATE_OPT_MAX; 3305 $$->data.max_states = $2; 3306 $$->next = NULL; 3307 $$->tail = $$; 3308 } 3309 | NOSYNC { 3310 $$ = calloc(1, sizeof(struct node_state_opt)); 3311 if ($$ == NULL) 3312 err(1, "state_opt_item: calloc"); 3313 $$->type = PF_STATE_OPT_NOSYNC; 3314 $$->next = NULL; 3315 $$->tail = $$; 3316 } 3317 | MAXSRCSTATES NUMBER { 3318 if ($2 < 0 || $2 > UINT_MAX) { 3319 yyerror("only positive values permitted"); 3320 YYERROR; 3321 } 3322 $$ = calloc(1, sizeof(struct node_state_opt)); 3323 if ($$ == NULL) 3324 err(1, "state_opt_item: calloc"); 3325 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3326 $$->data.max_src_states = $2; 3327 $$->next = NULL; 3328 $$->tail = $$; 3329 } 3330 | MAXSRCCONN NUMBER { 3331 if ($2 < 0 || $2 > UINT_MAX) { 3332 yyerror("only positive values permitted"); 3333 YYERROR; 3334 } 3335 $$ = calloc(1, sizeof(struct node_state_opt)); 3336 if ($$ == NULL) 3337 err(1, "state_opt_item: calloc"); 3338 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3339 $$->data.max_src_conn = $2; 3340 $$->next = NULL; 3341 $$->tail = $$; 3342 } 3343 | MAXSRCCONNRATE NUMBER '/' NUMBER { 3344 if ($2 < 0 || $2 > UINT_MAX || 3345 $4 < 0 || $4 > UINT_MAX) { 3346 yyerror("only positive values permitted"); 3347 YYERROR; 3348 } 3349 $$ = calloc(1, sizeof(struct node_state_opt)); 3350 if ($$ == NULL) 3351 err(1, "state_opt_item: calloc"); 3352 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3353 $$->data.max_src_conn_rate.limit = $2; 3354 $$->data.max_src_conn_rate.seconds = $4; 3355 $$->next = NULL; 3356 $$->tail = $$; 3357 } 3358 | OVERLOAD '<' STRING '>' flush { 3359 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3360 yyerror("table name '%s' too long", $3); 3361 free($3); 3362 YYERROR; 3363 } 3364 $$ = calloc(1, sizeof(struct node_state_opt)); 3365 if ($$ == NULL) 3366 err(1, "state_opt_item: calloc"); 3367 if (strlcpy($$->data.overload.tblname, $3, 3368 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3369 errx(1, "state_opt_item: strlcpy"); 3370 free($3); 3371 $$->type = PF_STATE_OPT_OVERLOAD; 3372 $$->data.overload.flush = $5; 3373 $$->next = NULL; 3374 $$->tail = $$; 3375 } 3376 | MAXSRCNODES NUMBER { 3377 if ($2 < 0 || $2 > UINT_MAX) { 3378 yyerror("only positive values permitted"); 3379 YYERROR; 3380 } 3381 $$ = calloc(1, sizeof(struct node_state_opt)); 3382 if ($$ == NULL) 3383 err(1, "state_opt_item: calloc"); 3384 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3385 $$->data.max_src_nodes = $2; 3386 $$->next = NULL; 3387 $$->tail = $$; 3388 } 3389 | SOURCETRACK sourcetrack { 3390 $$ = calloc(1, sizeof(struct node_state_opt)); 3391 if ($$ == NULL) 3392 err(1, "state_opt_item: calloc"); 3393 $$->type = PF_STATE_OPT_SRCTRACK; 3394 $$->data.src_track = $2; 3395 $$->next = NULL; 3396 $$->tail = $$; 3397 } 3398 | statelock { 3399 $$ = calloc(1, sizeof(struct node_state_opt)); 3400 if ($$ == NULL) 3401 err(1, "state_opt_item: calloc"); 3402 $$->type = PF_STATE_OPT_STATELOCK; 3403 $$->data.statelock = $1; 3404 $$->next = NULL; 3405 $$->tail = $$; 3406 } 3407 | SLOPPY { 3408 $$ = calloc(1, sizeof(struct node_state_opt)); 3409 if ($$ == NULL) 3410 err(1, "state_opt_item: calloc"); 3411 $$->type = PF_STATE_OPT_SLOPPY; 3412 $$->next = NULL; 3413 $$->tail = $$; 3414 } 3415 | PFLOW { 3416 $$ = calloc(1, sizeof(struct node_state_opt)); 3417 if ($$ == NULL) 3418 err(1, "state_opt_item: calloc"); 3419 $$->type = PF_STATE_OPT_PFLOW; 3420 $$->next = NULL; 3421 $$->tail = $$; 3422 } 3423 | STRING NUMBER { 3424 int i; 3425 3426 if ($2 < 0 || $2 > UINT_MAX) { 3427 yyerror("only positive values permitted"); 3428 YYERROR; 3429 } 3430 for (i = 0; pf_timeouts[i].name && 3431 strcmp(pf_timeouts[i].name, $1); ++i) 3432 ; /* nothing */ 3433 if (!pf_timeouts[i].name) { 3434 yyerror("illegal timeout name %s", $1); 3435 free($1); 3436 YYERROR; 3437 } 3438 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3439 yyerror("illegal state timeout %s", $1); 3440 free($1); 3441 YYERROR; 3442 } 3443 free($1); 3444 $$ = calloc(1, sizeof(struct node_state_opt)); 3445 if ($$ == NULL) 3446 err(1, "state_opt_item: calloc"); 3447 $$->type = PF_STATE_OPT_TIMEOUT; 3448 $$->data.timeout.number = pf_timeouts[i].timeout; 3449 $$->data.timeout.seconds = $2; 3450 $$->next = NULL; 3451 $$->tail = $$; 3452 } 3453 ; 3454 3455label : STRING { 3456 $$ = $1; 3457 } 3458 ; 3459 3460qname : STRING { 3461 struct pfctl_qsitem *qsi; 3462 3463 if ((qsi = pfctl_find_queue($1, &qspecs)) == NULL) { 3464 yyerror("queue %s is not defined", $1); 3465 YYERROR; 3466 } 3467 $$.qname = $1; 3468 $$.pqname = NULL; 3469 } 3470 | '(' STRING ')' { 3471 struct pfctl_qsitem *qsi; 3472 3473 if ((qsi = pfctl_find_queue($2, &qspecs)) == NULL) { 3474 yyerror("queue %s is not defined", $2); 3475 YYERROR; 3476 } 3477 $$.qname = $2; 3478 $$.pqname = NULL; 3479 } 3480 | '(' STRING comma STRING ')' { 3481 struct pfctl_qsitem *qsi, *pqsi; 3482 3483 if ((qsi = pfctl_find_queue($2, &qspecs)) == NULL) { 3484 yyerror("queue %s is not defined", $2); 3485 YYERROR; 3486 } 3487 if ((pqsi = pfctl_find_queue($4, &qspecs)) == NULL) { 3488 yyerror("queue %s is not defined", $4); 3489 YYERROR; 3490 } 3491 $$.qname = $2; 3492 $$.pqname = $4; 3493 } 3494 ; 3495 3496portstar : numberstring { 3497 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3498 free($1); 3499 YYERROR; 3500 } 3501 free($1); 3502 } 3503 ; 3504 3505redirspec : host optweight { 3506 if ($2 > 0) { 3507 struct node_host *n; 3508 for (n = $1; n != NULL; n = n->next) 3509 n->weight = $2; 3510 } 3511 $$ = $1; 3512 } 3513 | '{' optnl redir_host_list '}' { $$ = $3; } 3514 ; 3515 3516redir_host_list : host optweight optnl { 3517 if ($1->addr.type != PF_ADDR_ADDRMASK) { 3518 free($1); 3519 yyerror("only addresses can be listed for " 3520 "redirection pools "); 3521 YYERROR; 3522 } 3523 if ($2 > 0) { 3524 struct node_host *n; 3525 for (n = $1; n != NULL; n = n->next) 3526 n->weight = $2; 3527 } 3528 $$ = $1; 3529 } 3530 | redir_host_list comma host optweight optnl { 3531 $1->tail->next = $3; 3532 $1->tail = $3->tail; 3533 if ($4 > 0) { 3534 struct node_host *n; 3535 for (n = $3; n != NULL; n = n->next) 3536 n->weight = $4; 3537 } 3538 $$ = $1; 3539 } 3540 ; 3541 3542redirpool : redirspec { 3543 $$ = calloc(1, sizeof(struct redirection)); 3544 if ($$ == NULL) 3545 err(1, "redirection: calloc"); 3546 $$->host = $1; 3547 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3548 } 3549 | redirspec PORT portstar { 3550 $$ = calloc(1, sizeof(struct redirection)); 3551 if ($$ == NULL) 3552 err(1, "redirection: calloc"); 3553 $$->host = $1; 3554 $$->rport = $3; 3555 } 3556 ; 3557 3558hashkey : /* empty */ 3559 { 3560 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3561 if ($$ == NULL) 3562 err(1, "hashkey: calloc"); 3563 $$->key32[0] = arc4random(); 3564 $$->key32[1] = arc4random(); 3565 $$->key32[2] = arc4random(); 3566 $$->key32[3] = arc4random(); 3567 } 3568 | string 3569 { 3570 if (!strncmp($1, "0x", 2)) { 3571 if (strlen($1) != 34) { 3572 free($1); 3573 yyerror("hex key must be 128 bits " 3574 "(32 hex digits) long"); 3575 YYERROR; 3576 } 3577 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3578 if ($$ == NULL) 3579 err(1, "hashkey: calloc"); 3580 3581 if (sscanf($1, "0x%8x%8x%8x%8x", 3582 &$$->key32[0], &$$->key32[1], 3583 &$$->key32[2], &$$->key32[3]) != 4) { 3584 free($$); 3585 free($1); 3586 yyerror("invalid hex key"); 3587 YYERROR; 3588 } 3589 } else { 3590 MD5_CTX context; 3591 3592 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3593 if ($$ == NULL) 3594 err(1, "hashkey: calloc"); 3595 MD5Init(&context); 3596 MD5Update(&context, (unsigned char *)$1, 3597 strlen($1)); 3598 MD5Final((unsigned char *)$$, &context); 3599 HTONL($$->key32[0]); 3600 HTONL($$->key32[1]); 3601 HTONL($$->key32[2]); 3602 HTONL($$->key32[3]); 3603 } 3604 free($1); 3605 } 3606 ; 3607 3608pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3609 pool_opts_l 3610 { $$ = pool_opts; } 3611 | /* empty */ { 3612 bzero(&pool_opts, sizeof pool_opts); 3613 $$ = pool_opts; 3614 } 3615 ; 3616 3617pool_opts_l : pool_opts_l pool_opt 3618 | pool_opt 3619 ; 3620 3621pool_opt : BITMASK { 3622 if (pool_opts.type) { 3623 yyerror("pool type cannot be redefined"); 3624 YYERROR; 3625 } 3626 pool_opts.type = PF_POOL_BITMASK; 3627 } 3628 | RANDOM { 3629 if (pool_opts.type) { 3630 yyerror("pool type cannot be redefined"); 3631 YYERROR; 3632 } 3633 pool_opts.type = PF_POOL_RANDOM; 3634 } 3635 | SOURCEHASH hashkey { 3636 if (pool_opts.type) { 3637 yyerror("pool type cannot be redefined"); 3638 YYERROR; 3639 } 3640 pool_opts.type = PF_POOL_SRCHASH; 3641 pool_opts.key = $2; 3642 } 3643 | ROUNDROBIN { 3644 if (pool_opts.type) { 3645 yyerror("pool type cannot be redefined"); 3646 YYERROR; 3647 } 3648 pool_opts.type = PF_POOL_ROUNDROBIN; 3649 } 3650 | LEASTSTATES { 3651 if (pool_opts.type) { 3652 yyerror("pool type cannot be redefined"); 3653 YYERROR; 3654 } 3655 pool_opts.type = PF_POOL_LEASTSTATES; 3656 } 3657 | STATICPORT { 3658 if (pool_opts.staticport) { 3659 yyerror("static-port cannot be redefined"); 3660 YYERROR; 3661 } 3662 pool_opts.staticport = 1; 3663 } 3664 | STICKYADDRESS { 3665 if (filter_opts.marker & POM_STICKYADDRESS) { 3666 yyerror("sticky-address cannot be redefined"); 3667 YYERROR; 3668 } 3669 pool_opts.marker |= POM_STICKYADDRESS; 3670 pool_opts.opts |= PF_POOL_STICKYADDR; 3671 } 3672 ; 3673 3674route_host : STRING { 3675 /* try to find @if0 address specs */ 3676 if (strrchr($1, '@') != NULL) { 3677 if (($$ = host($1)) == NULL) { 3678 yyerror("invalid host for route spec"); 3679 YYERROR; 3680 } 3681 free($1); 3682 } else { 3683 $$ = calloc(1, sizeof(struct node_host)); 3684 if ($$ == NULL) 3685 err(1, "route_host: calloc"); 3686 $$->ifname = $1; 3687 $$->addr.type = PF_ADDR_NONE; 3688 set_ipmask($$, 128); 3689 $$->next = NULL; 3690 $$->tail = $$; 3691 } 3692 } 3693 | STRING '/' STRING { 3694 char *buf; 3695 3696 if (asprintf(&buf, "%s/%s", $1, $3) == -1) 3697 err(1, "host: asprintf"); 3698 free($1); 3699 if (($$ = host(buf)) == NULL) { 3700 /* error. "any" is handled elsewhere */ 3701 free(buf); 3702 yyerror("could not parse host specification"); 3703 YYERROR; 3704 } 3705 free(buf); 3706 } 3707 | '<' STRING '>' { 3708 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 3709 yyerror("table name '%s' too long", $2); 3710 free($2); 3711 YYERROR; 3712 } 3713 $$ = calloc(1, sizeof(struct node_host)); 3714 if ($$ == NULL) 3715 err(1, "host: calloc"); 3716 $$->addr.type = PF_ADDR_TABLE; 3717 if (strlcpy($$->addr.v.tblname, $2, 3718 sizeof($$->addr.v.tblname)) >= 3719 sizeof($$->addr.v.tblname)) 3720 errx(1, "host: strlcpy"); 3721 free($2); 3722 $$->next = NULL; 3723 $$->tail = $$; 3724 } 3725 | dynaddr '/' NUMBER { 3726 struct node_host *n; 3727 3728 if ($3 < 0 || $3 > 128) { 3729 yyerror("bit number too big"); 3730 YYERROR; 3731 } 3732 $$ = $1; 3733 for (n = $1; n != NULL; n = n->next) 3734 set_ipmask(n, $3); 3735 } 3736 | '(' STRING host ')' { 3737 struct node_host *n; 3738 3739 $$ = $3; 3740 /* XXX check masks, only full mask should be allowed */ 3741 for (n = $3; n != NULL; n = n->next) { 3742 if ($$->ifname) { 3743 yyerror("cannot specify interface twice " 3744 "in route spec"); 3745 YYERROR; 3746 } 3747 if (($$->ifname = strdup($2)) == NULL) 3748 errx(1, "host: strdup"); 3749 } 3750 free($2); 3751 } 3752 ; 3753 3754route_host_list : route_host optweight optnl { 3755 if ($2 > 0) { 3756 struct node_host *n; 3757 for (n = $1; n != NULL; n = n->next) 3758 n->weight = $2; 3759 } 3760 $$ = $1; 3761 } 3762 | route_host_list comma route_host optweight optnl { 3763 if ($1->af == 0) 3764 $1->af = $3->af; 3765 if ($1->af != $3->af) { 3766 yyerror("all pool addresses must be in the " 3767 "same address family"); 3768 YYERROR; 3769 } 3770 $1->tail->next = $3; 3771 $1->tail = $3->tail; 3772 if ($4 > 0) { 3773 struct node_host *n; 3774 for (n = $3; n != NULL; n = n->next) 3775 n->weight = $4; 3776 } 3777 $$ = $1; 3778 } 3779 ; 3780 3781routespec : route_host optweight { 3782 if ($2 > 0) { 3783 struct node_host *n; 3784 for (n = $1; n != NULL; n = n->next) 3785 n->weight = $2; 3786 } 3787 $$ = $1; 3788 } 3789 | '{' optnl route_host_list '}' { $$ = $3; } 3790 ; 3791 3792timeout_spec : STRING NUMBER 3793 { 3794 if ($2 < 0 || $2 > UINT_MAX) { 3795 yyerror("only positive values permitted"); 3796 YYERROR; 3797 } 3798 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3799 yyerror("unknown timeout %s", $1); 3800 free($1); 3801 YYERROR; 3802 } 3803 free($1); 3804 } 3805 ; 3806 3807timeout_list : timeout_list comma timeout_spec optnl 3808 | timeout_spec optnl 3809 ; 3810 3811limit_spec : STRING NUMBER 3812 { 3813 if ($2 < 0 || $2 > UINT_MAX) { 3814 yyerror("only positive values permitted"); 3815 YYERROR; 3816 } 3817 if (pfctl_set_limit(pf, $1, $2) != 0) { 3818 yyerror("unable to set limit %s %u", $1, $2); 3819 free($1); 3820 YYERROR; 3821 } 3822 free($1); 3823 } 3824 ; 3825 3826limit_list : limit_list comma limit_spec optnl 3827 | limit_spec optnl 3828 ; 3829 3830comma : ',' 3831 | /* empty */ 3832 ; 3833 3834yesno : NO { $$ = 0; } 3835 | STRING { 3836 if (!strcmp($1, "yes")) 3837 $$ = 1; 3838 else { 3839 yyerror("invalid value '%s', expected 'yes' " 3840 "or 'no'", $1); 3841 free($1); 3842 YYERROR; 3843 } 3844 free($1); 3845 } 3846 ; 3847 3848unaryop : '=' { $$ = PF_OP_EQ; } 3849 | NE { $$ = PF_OP_NE; } 3850 | LE { $$ = PF_OP_LE; } 3851 | '<' { $$ = PF_OP_LT; } 3852 | GE { $$ = PF_OP_GE; } 3853 | '>' { $$ = PF_OP_GT; } 3854 ; 3855 3856%% 3857 3858int 3859yyerror(const char *fmt, ...) 3860{ 3861 va_list ap; 3862 3863 file->errors++; 3864 va_start(ap, fmt); 3865 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 3866 vfprintf(stderr, fmt, ap); 3867 fprintf(stderr, "\n"); 3868 va_end(ap); 3869 return (0); 3870} 3871 3872int 3873disallow_table(struct node_host *h, const char *fmt) 3874{ 3875 for (; h != NULL; h = h->next) 3876 if (h->addr.type == PF_ADDR_TABLE) { 3877 yyerror(fmt, h->addr.v.tblname); 3878 return (1); 3879 } 3880 return (0); 3881} 3882 3883int 3884disallow_urpf_failed(struct node_host *h, const char *fmt) 3885{ 3886 for (; h != NULL; h = h->next) 3887 if (h->addr.type == PF_ADDR_URPFFAILED) { 3888 yyerror(fmt); 3889 return (1); 3890 } 3891 return (0); 3892} 3893 3894int 3895disallow_alias(struct node_host *h, const char *fmt) 3896{ 3897 for (; h != NULL; h = h->next) 3898 if (DYNIF_MULTIADDR(h->addr)) { 3899 yyerror(fmt, h->addr.v.tblname); 3900 return (1); 3901 } 3902 return (0); 3903} 3904 3905int 3906rule_consistent(struct pf_rule *r, int anchor_call) 3907{ 3908 int problems = 0; 3909 3910 if (r->proto != IPPROTO_TCP && r->os_fingerprint != PF_OSFP_ANY) { 3911 yyerror("os only applies to tcp"); 3912 problems++; 3913 } 3914 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3915 (r->src.port_op || r->dst.port_op)) { 3916 yyerror("port only applies to tcp/udp"); 3917 problems++; 3918 } 3919 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3920 r->uid.op) { 3921 yyerror("user only applies to tcp/udp"); 3922 problems++; 3923 } 3924 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3925 r->gid.op) { 3926 yyerror("group only applies to tcp/udp"); 3927 problems++; 3928 } 3929 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3930 (r->type || r->code)) { 3931 yyerror("icmp-type/code only applies to icmp"); 3932 problems++; 3933 } 3934 if (!r->af && (r->type || r->code)) { 3935 yyerror("must indicate address family with icmp-type/code"); 3936 problems++; 3937 } 3938 if (r->rule_flag & PFRULE_AFTO && r->af == r->naf) { 3939 yyerror("must indicate different address family with af-to"); 3940 problems++; 3941 } 3942 if (r->overload_tblname[0] && 3943 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3944 yyerror("'overload' requires 'max-src-conn' " 3945 "or 'max-src-conn-rate'"); 3946 problems++; 3947 } 3948 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3949 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3950 yyerror("proto %s doesn't match address family %s", 3951 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3952 r->af == AF_INET ? "inet" : "inet6"); 3953 problems++; 3954 } 3955 if (r->allow_opts && r->action != PF_PASS) { 3956 yyerror("allow-opts can only be specified for pass rules"); 3957 problems++; 3958 } 3959 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3960 r->dst.port_op || r->flagset || r->type || r->code)) { 3961 yyerror("fragments can be filtered only on IP header fields"); 3962 problems++; 3963 } 3964 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3965 yyerror("return-rst can only be applied to TCP rules"); 3966 problems++; 3967 } 3968 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3969 yyerror("max-src-nodes requires 'source-track rule'"); 3970 problems++; 3971 } 3972 if (r->action != PF_PASS && r->keep_state) { 3973 yyerror("keep state is great, but only for pass rules"); 3974 problems++; 3975 } 3976 if (r->rule_flag & PFRULE_STATESLOPPY && 3977 (r->keep_state == PF_STATE_MODULATE || 3978 r->keep_state == PF_STATE_SYNPROXY)) { 3979 yyerror("sloppy state matching cannot be used with " 3980 "synproxy state or modulate state"); 3981 problems++; 3982 } 3983 if ((r->nat.addr.type != PF_ADDR_NONE || 3984 r->rdr.addr.type != PF_ADDR_NONE) && 3985 r->action != PF_MATCH && !r->keep_state) { 3986 yyerror("nat-to and rdr-to require keep state"); 3987 problems++; 3988 } 3989 if (r->direction == PF_INOUT && (r->nat.addr.type != PF_ADDR_NONE || 3990 r->rdr.addr.type != PF_ADDR_NONE)) { 3991 yyerror("nat-to and rdr-to require a direction"); 3992 problems++; 3993 } 3994 if (r->af == AF_INET6 && (r->scrub_flags & 3995 (PFSTATE_NODF|PFSTATE_RANDOMID))) { 3996 yyerror("address family inet6 does not support scrub options " 3997 "no-df, random-id"); 3998 problems++; 3999 } 4000 4001 /* Basic rule sanity check. */ 4002 switch (r->action) { 4003 case PF_MATCH: 4004 if (r->divert.port) { 4005 yyerror("divert is not supported on match rules"); 4006 problems++; 4007 } 4008 if (r->divert_packet.port) { 4009 yyerror("divert is not supported on match rules"); 4010 problems++; 4011 } 4012 if (r->rt) { 4013 yyerror("route-to, reply-to and dup-to " 4014 "are not supported on match rules"); 4015 problems++; 4016 } 4017 if (r->rule_flag & PFRULE_AFTO) { 4018 yyerror("af-to is not supported on match rules"); 4019 problems++; 4020 } 4021 break; 4022 case PF_DROP: 4023 if (r->rt) { 4024 yyerror("route-to, reply-to and dup-to " 4025 "are not supported on block rules"); 4026 problems++; 4027 } 4028 break; 4029 default:; 4030 } 4031 return (-problems); 4032} 4033 4034int 4035process_tabledef(char *name, struct table_opts *opts) 4036{ 4037 struct pfr_buffer ab; 4038 struct node_tinit *ti; 4039 4040 bzero(&ab, sizeof(ab)); 4041 ab.pfrb_type = PFRB_ADDRS; 4042 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4043 if (ti->file) 4044 if (pfr_buf_load(&ab, ti->file, 0)) { 4045 if (errno) 4046 yyerror("cannot load \"%s\": %s", 4047 ti->file, strerror(errno)); 4048 else 4049 yyerror("file \"%s\" contains bad data", 4050 ti->file); 4051 goto _error; 4052 } 4053 if (ti->host) 4054 if (append_addr_host(&ab, ti->host, 0, 0)) { 4055 yyerror("cannot create address buffer: %s", 4056 strerror(errno)); 4057 goto _error; 4058 } 4059 } 4060 if (pf->opts & PF_OPT_VERBOSE) 4061 print_tabledef(name, opts->flags, opts->init_addr, 4062 &opts->init_nodes); 4063 if (!(pf->opts & PF_OPT_NOACTION) && 4064 pfctl_define_table(name, opts->flags, opts->init_addr, 4065 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4066 yyerror("cannot define table %s: %s", name, 4067 pfr_strerror(errno)); 4068 goto _error; 4069 } 4070 pf->tdirty = 1; 4071 pfr_buf_clear(&ab); 4072 return (0); 4073_error: 4074 pfr_buf_clear(&ab); 4075 return (-1); 4076} 4077 4078struct keywords { 4079 const char *k_name; 4080 int k_val; 4081}; 4082 4083/* macro gore, but you should've seen the prior indentation nightmare... */ 4084 4085#define FREE_LIST(T,r) \ 4086 do { \ 4087 T *p, *node = r; \ 4088 while (node != NULL) { \ 4089 p = node; \ 4090 node = node->next; \ 4091 free(p); \ 4092 } \ 4093 } while (0) 4094 4095#define LOOP_THROUGH(T,n,r,C) \ 4096 do { \ 4097 T *n; \ 4098 if (r == NULL) { \ 4099 r = calloc(1, sizeof(T)); \ 4100 if (r == NULL) \ 4101 err(1, "LOOP: calloc"); \ 4102 r->next = NULL; \ 4103 } \ 4104 n = r; \ 4105 while (n != NULL) { \ 4106 do { \ 4107 C; \ 4108 } while (0); \ 4109 n = n->next; \ 4110 } \ 4111 } while (0) 4112 4113void 4114expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4115{ 4116 char *tmp; 4117 char *p, *q; 4118 4119 if ((tmp = calloc(1, len)) == NULL) 4120 err(1, "expand_label_str: calloc"); 4121 p = q = label; 4122 while ((q = strstr(p, srch)) != NULL) { 4123 *q = '\0'; 4124 if ((strlcat(tmp, p, len) >= len) || 4125 (strlcat(tmp, repl, len) >= len)) 4126 errx(1, "expand_label: label too long"); 4127 q += strlen(srch); 4128 p = q; 4129 } 4130 if (strlcat(tmp, p, len) >= len) 4131 errx(1, "expand_label: label too long"); 4132 strlcpy(label, tmp, len); /* always fits */ 4133 free(tmp); 4134} 4135 4136void 4137expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4138{ 4139 if (strstr(label, name) != NULL) { 4140 if (!*ifname) 4141 expand_label_str(label, len, name, "any"); 4142 else 4143 expand_label_str(label, len, name, ifname); 4144 } 4145} 4146 4147void 4148expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4149 struct node_host *h) 4150{ 4151 char tmp[64], tmp_not[66]; 4152 4153 if (strstr(label, name) != NULL) { 4154 switch (h->addr.type) { 4155 case PF_ADDR_DYNIFTL: 4156 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4157 break; 4158 case PF_ADDR_TABLE: 4159 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4160 break; 4161 case PF_ADDR_NOROUTE: 4162 snprintf(tmp, sizeof(tmp), "no-route"); 4163 break; 4164 case PF_ADDR_URPFFAILED: 4165 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4166 break; 4167 case PF_ADDR_ADDRMASK: 4168 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4169 PF_AZERO(&h->addr.v.a.mask, af))) 4170 snprintf(tmp, sizeof(tmp), "any"); 4171 else { 4172 char a[48]; 4173 int bits; 4174 4175 if (inet_ntop(af, &h->addr.v.a.addr, a, 4176 sizeof(a)) == NULL) 4177 snprintf(tmp, sizeof(tmp), "?"); 4178 else { 4179 bits = unmask(&h->addr.v.a.mask, af); 4180 if ((af == AF_INET && bits < 32) || 4181 (af == AF_INET6 && bits < 128)) 4182 snprintf(tmp, sizeof(tmp), 4183 "%s/%d", a, bits); 4184 else 4185 snprintf(tmp, sizeof(tmp), 4186 "%s", a); 4187 } 4188 } 4189 break; 4190 default: 4191 snprintf(tmp, sizeof(tmp), "?"); 4192 break; 4193 } 4194 4195 if (h->not) { 4196 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4197 expand_label_str(label, len, name, tmp_not); 4198 } else 4199 expand_label_str(label, len, name, tmp); 4200 } 4201} 4202 4203void 4204expand_label_port(const char *name, char *label, size_t len, 4205 struct node_port *port) 4206{ 4207 char a1[6], a2[6], op[13] = ""; 4208 4209 if (strstr(label, name) != NULL) { 4210 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4211 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4212 if (!port->op) 4213 ; 4214 else if (port->op == PF_OP_IRG) 4215 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4216 else if (port->op == PF_OP_XRG) 4217 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4218 else if (port->op == PF_OP_EQ) 4219 snprintf(op, sizeof(op), "%s", a1); 4220 else if (port->op == PF_OP_NE) 4221 snprintf(op, sizeof(op), "!=%s", a1); 4222 else if (port->op == PF_OP_LT) 4223 snprintf(op, sizeof(op), "<%s", a1); 4224 else if (port->op == PF_OP_LE) 4225 snprintf(op, sizeof(op), "<=%s", a1); 4226 else if (port->op == PF_OP_GT) 4227 snprintf(op, sizeof(op), ">%s", a1); 4228 else if (port->op == PF_OP_GE) 4229 snprintf(op, sizeof(op), ">=%s", a1); 4230 expand_label_str(label, len, name, op); 4231 } 4232} 4233 4234void 4235expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4236{ 4237 struct protoent *pe; 4238 char n[4]; 4239 4240 if (strstr(label, name) != NULL) { 4241 pe = getprotobynumber(proto); 4242 if (pe != NULL) 4243 expand_label_str(label, len, name, pe->p_name); 4244 else { 4245 snprintf(n, sizeof(n), "%u", proto); 4246 expand_label_str(label, len, name, n); 4247 } 4248 } 4249} 4250 4251void 4252expand_label_nr(const char *name, char *label, size_t len) 4253{ 4254 char n[11]; 4255 4256 if (strstr(label, name) != NULL) { 4257 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4258 expand_label_str(label, len, name, n); 4259 } 4260} 4261 4262void 4263expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4264 struct node_host *src_host, struct node_port *src_port, 4265 struct node_host *dst_host, struct node_port *dst_port, 4266 u_int8_t proto) 4267{ 4268 expand_label_if("$if", label, len, ifname); 4269 expand_label_addr("$srcaddr", label, len, af, src_host); 4270 expand_label_addr("$dstaddr", label, len, af, dst_host); 4271 expand_label_port("$srcport", label, len, src_port); 4272 expand_label_port("$dstport", label, len, dst_port); 4273 expand_label_proto("$proto", label, len, proto); 4274 expand_label_nr("$nr", label, len); 4275} 4276 4277int 4278expand_queue(char *qname, struct node_if *interfaces, struct queue_opts *opts) 4279{ 4280 struct pf_queuespec qspec; 4281 4282 LOOP_THROUGH(struct node_if, interface, interfaces, 4283 bzero(&qspec, sizeof(qspec)); 4284 if (strlcpy(qspec.qname, qname, sizeof(qspec.qname)) >= 4285 sizeof(qspec.qname)) { 4286 yyerror("queuename too long"); 4287 return (1); 4288 } 4289 if (opts->parent && strlcpy(qspec.parent, opts->parent, 4290 sizeof(qspec.parent)) >= sizeof(qspec.parent)) { 4291 yyerror("parent too long"); 4292 return (1); 4293 } 4294 if (strlcpy(qspec.ifname, interface->ifname, 4295 sizeof(qspec.ifname)) >= sizeof(qspec.ifname)) { 4296 yyerror("interface too long"); 4297 return (1); 4298 } 4299 qspec.realtime.m1.absolute = opts->realtime.m1.bw_absolute; 4300 qspec.realtime.m1.percent = opts->realtime.m1.bw_percent; 4301 qspec.realtime.m2.absolute = opts->realtime.m2.bw_absolute; 4302 qspec.realtime.m2.percent = opts->realtime.m2.bw_percent; 4303 qspec.realtime.d = opts->realtime.d; 4304 4305 qspec.linkshare.m1.absolute = opts->linkshare.m1.bw_absolute; 4306 qspec.linkshare.m1.percent = opts->linkshare.m1.bw_percent; 4307 qspec.linkshare.m2.absolute = opts->linkshare.m2.bw_absolute; 4308 qspec.linkshare.m2.percent = opts->linkshare.m2.bw_percent; 4309 qspec.linkshare.d = opts->linkshare.d; 4310 4311 qspec.upperlimit.m1.absolute = opts->upperlimit.m1.bw_absolute; 4312 qspec.upperlimit.m1.percent = opts->upperlimit.m1.bw_percent; 4313 qspec.upperlimit.m2.absolute = opts->upperlimit.m2.bw_absolute; 4314 qspec.upperlimit.m2.percent = opts->upperlimit.m2.bw_percent; 4315 qspec.upperlimit.d = opts->upperlimit.d; 4316 4317 qspec.flags = opts->flags; 4318 qspec.qlimit = opts->qlimit; 4319 4320 if (pfctl_add_queue(pf, &qspec)) { 4321 yyerror("cannot add queue"); 4322 return (1); 4323 } 4324 ); 4325 4326 FREE_LIST(struct node_if, interfaces); 4327 return (0); 4328} 4329 4330int 4331expand_divertspec(struct pf_rule *r, struct divertspec *ds) 4332{ 4333 struct node_host *n; 4334 4335 if (ds->port == 0) 4336 return (0); 4337 4338 r->divert.port = ds->port; 4339 4340 if (r->direction == PF_OUT) { 4341 if (ds->addr) { 4342 yyerror("address specified for outgoing divert"); 4343 return (1); 4344 } 4345 bzero(&r->divert.addr, sizeof(r->divert.addr)); 4346 return (0); 4347 } 4348 4349 if (!ds->addr) { 4350 yyerror("no address specified for incoming divert"); 4351 return (1); 4352 } 4353 if (r->af) { 4354 n = ds->addr; 4355 for (n = ds->addr; n != NULL; n = n->next) 4356 if (n->af == r->af) 4357 break; 4358 if (n == NULL) { 4359 yyerror("address family mismatch for divert"); 4360 return (1); 4361 } 4362 r->divert.addr = n->addr.v.a.addr; 4363 } else { 4364 r->af = ds->addr->af; 4365 r->divert.addr = ds->addr->addr.v.a.addr; 4366 } 4367 return (0); 4368} 4369 4370int 4371collapse_redirspec(struct pf_pool *rpool, struct pf_rule *r, 4372 struct redirspec *rs, u_int8_t allow_if) 4373{ 4374 struct pf_opt_tbl *tbl = NULL; 4375 struct node_host *h, *hprev = NULL; 4376 struct pf_rule_addr ra; 4377 int af = 0, naddr = 0; 4378 4379 if (!rs || !rs->rdr || rs->rdr->host == NULL) { 4380 rpool->addr.type = PF_ADDR_NONE; 4381 return (0); 4382 } 4383 4384 if (r->rule_flag & PFRULE_AFTO) 4385 r->naf = rs->af; 4386 4387 for (h = rs->rdr->host; h != NULL; h = h->next) { 4388 /* set rule address family if redirect spec has one */ 4389 if (rs->af && !r->af && !af) { 4390 /* swap address families for af-to */ 4391 if (r->naf == AF_INET6) 4392 af = AF_INET; 4393 else if (r->naf == AF_INET) 4394 af = AF_INET6; 4395 else 4396 af = rs->af; 4397 } 4398 if (h->af && !r->naf) { /* nat-to/rdr-to case */ 4399 /* skip if the rule af doesn't match redirect af */ 4400 if (r->af && r->af != h->af) 4401 continue; 4402 /* 4403 * fail if the chosen af is not universal for 4404 * all addresses in the redirect address pool 4405 */ 4406 if (!r->af && af && af != h->af) { 4407 yyerror("%s spec contains addresses with " 4408 "different address families", 4409 allow_if ? "routing" : "translation"); 4410 return (1); 4411 } 4412 } else if (h->af) { /* af-to case */ 4413 /* 4414 * fail if the redirect spec af is not universal 4415 * for all addresses in the redirect address pool 4416 */ 4417 if (rs->af && rs->af != h->af) { 4418 yyerror("%s spec contains addresses that " 4419 "don't match target address family", 4420 allow_if ? "routing" : "translation"); 4421 return (1); 4422 } 4423 } 4424 /* else if (!h->af): 4425 * we silently allow any not af-specific host specs, 4426 * e.g. (em0) and let the kernel deal with them 4427 */ 4428 4429 /* if we haven't selected the rule af yet, now it's time */ 4430 if (!r->af && !af) 4431 af = h->af; 4432 4433 if (naddr == 0) { /* the first host */ 4434 rpool->addr = h->addr; 4435 if (!allow_if && h->ifname) { 4436 yyerror("@if not permitted for translation"); 4437 return (1); 4438 } 4439 if (h->ifname && strlcpy(rpool->ifname, h->ifname, 4440 sizeof(rpool->ifname)) >= sizeof(rpool->ifname)) 4441 errx(1, "collapse_redirspec: strlcpy"); 4442 hprev = h; /* in case we need to conver to a table */ 4443 } else { /* multiple hosts */ 4444 if (rs->pool_opts.type && 4445 !PF_POOL_DYNTYPE(rs->pool_opts.type)) { 4446 yyerror("pool type is not valid for multiple " 4447 "translation or routing addresses"); 4448 return (1); 4449 } 4450 if ((hprev && hprev->addr.type != PF_ADDR_ADDRMASK) && 4451 (hprev && hprev->addr.type != PF_ADDR_NONE) && 4452 h->addr.type != PF_ADDR_ADDRMASK && 4453 h->addr.type != PF_ADDR_NONE) { 4454 yyerror("multiple tables or dynamic interfaces " 4455 "not supported for translation or routing"); 4456 return (1); 4457 } 4458 if (!allow_if && h->ifname) { 4459 yyerror("@if not permitted for translation"); 4460 return (1); 4461 } 4462 if (hprev) { 4463 /* 4464 * undo some damage and convert the single 4465 * host pool to the table 4466 */ 4467 memset(&ra, 0, sizeof(ra)); 4468 memset(rpool->ifname, 0, sizeof(rpool->ifname)); 4469 ra.addr = hprev->addr; 4470 ra.weight = hprev->weight; 4471 if (add_opt_table(pf, &tbl, 4472 hprev->af, &ra, hprev->ifname)) 4473 return (1); 4474 hprev = NULL; 4475 } 4476 memset(&ra, 0, sizeof(ra)); 4477 ra.addr = h->addr; 4478 ra.weight = h->weight; 4479 if (add_opt_table(pf, &tbl, 4480 h->af, &ra, h->ifname)) 4481 return (1); 4482 } 4483 naddr++; 4484 } 4485 /* set rule af to the one chosen above */ 4486 if (!r->af && af) 4487 r->af = af; 4488 if (!naddr) { 4489 yyerror("af mismatch in %s spec", 4490 allow_if ? "routing" : "translation"); 4491 return (1); 4492 } 4493 if (tbl) { 4494 if ((pf->opts & PF_OPT_NOACTION) == 0 && 4495 pf_opt_create_table(pf, tbl)) 4496 return (1); 4497 4498 pf->tdirty = 1; 4499 4500 if (pf->opts & PF_OPT_VERBOSE) 4501 print_tabledef(tbl->pt_name, 4502 PFR_TFLAG_CONST | tbl->pt_flags, 4503 1, &tbl->pt_nodes); 4504 4505 memset(&rpool->addr, 0, sizeof(rpool->addr)); 4506 rpool->addr.type = PF_ADDR_TABLE; 4507 strlcpy(rpool->addr.v.tblname, tbl->pt_name, 4508 sizeof(rpool->addr.v.tblname)); 4509 4510 pfr_buf_clear(tbl->pt_buf); 4511 free(tbl->pt_buf); 4512 tbl->pt_buf = NULL; 4513 free(tbl); 4514 } 4515 return (0); 4516} 4517 4518 4519int 4520apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, 4521 int isrdr, struct node_port *np) 4522{ 4523 if (!rs || !rs->rdr) 4524 return (0); 4525 4526 rpool->proxy_port[0] = ntohs(rs->rdr->rport.a); 4527 4528 if (isrdr) { 4529 if (!rs->rdr->rport.b && rs->rdr->rport.t && np->port != NULL) { 4530 rpool->proxy_port[1] = ntohs(rs->rdr->rport.a) + 4531 (ntohs(np->port[1]) - ntohs(np->port[0])); 4532 } else 4533 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4534 } else { 4535 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4536 if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { 4537 rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW; 4538 rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH; 4539 } else if (!rpool->proxy_port[1]) 4540 rpool->proxy_port[1] = rpool->proxy_port[0]; 4541 } 4542 4543 rpool->opts = rs->pool_opts.type; 4544 if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_NONE && 4545 (rpool->addr.type == PF_ADDR_TABLE || 4546 DYNIF_MULTIADDR(rpool->addr))) 4547 rpool->opts |= PF_POOL_ROUNDROBIN; 4548 4549 if (!PF_POOL_DYNTYPE(rpool->opts) && 4550 (disallow_table(rs->rdr->host, 4551 "tables are not supported by pool type") || 4552 disallow_alias(rs->rdr->host, 4553 "interface (%s) is not supported by pool type"))) 4554 return (1); 4555 4556 if (rs->pool_opts.key != NULL) 4557 memcpy(&rpool->key, rs->pool_opts.key, 4558 sizeof(struct pf_poolhashkey)); 4559 4560 if (rs->pool_opts.opts) 4561 rpool->opts |= rs->pool_opts.opts; 4562 4563 if (rs->pool_opts.staticport) { 4564 if (isrdr) { 4565 yyerror("the 'static-port' option is only valid with " 4566 "nat rules"); 4567 return (1); 4568 } 4569 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 4570 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 4571 yyerror("the 'static-port' option can't be used when " 4572 "specifying a port range"); 4573 return (1); 4574 } 4575 rpool->proxy_port[0] = 0; 4576 rpool->proxy_port[1] = 0; 4577 } 4578 4579 return (0); 4580} 4581 4582 4583void 4584expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces, 4585 struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute, 4586 struct node_proto *protos, struct node_os *src_oses, 4587 struct node_host *src_hosts, struct node_port *src_ports, 4588 struct node_host *dst_hosts, struct node_port *dst_ports, 4589 struct node_uid *uids, struct node_gid *gids, struct node_if *rcv, 4590 struct node_icmp *icmp_types, const char *anchor_call) 4591{ 4592 sa_family_t af = r->af; 4593 int added = 0, error = 0; 4594 char ifname[IF_NAMESIZE]; 4595 char label[PF_RULE_LABEL_SIZE]; 4596 char tagname[PF_TAG_NAME_SIZE]; 4597 char match_tagname[PF_TAG_NAME_SIZE]; 4598 u_int8_t flags, flagset, keep_state; 4599 struct node_host *srch, *dsth, *osrch, *odsth; 4600 struct redirspec binat; 4601 struct pf_rule rb; 4602 int dir = r->direction; 4603 4604 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4605 errx(1, "expand_rule: strlcpy"); 4606 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4607 errx(1, "expand_rule: strlcpy"); 4608 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4609 sizeof(match_tagname)) 4610 errx(1, "expand_rule: strlcpy"); 4611 flags = r->flags; 4612 flagset = r->flagset; 4613 keep_state = r->keep_state; 4614 4615 r->src.addr.type = r->dst.addr.type = PF_ADDR_ADDRMASK; 4616 4617 LOOP_THROUGH(struct node_if, interface, interfaces, 4618 LOOP_THROUGH(struct node_proto, proto, protos, 4619 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4620 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4621 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4622 LOOP_THROUGH(struct node_port, src_port, src_ports, 4623 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4624 LOOP_THROUGH(struct node_os, src_os, src_oses, 4625 LOOP_THROUGH(struct node_uid, uid, uids, 4626 LOOP_THROUGH(struct node_gid, gid, gids, 4627 4628 r->af = af; 4629 4630 error += collapse_redirspec(&r->rdr, r, rdr, 0); 4631 error += collapse_redirspec(&r->nat, r, nat, 0); 4632 error += collapse_redirspec(&r->route, r, rroute, 1); 4633 4634 /* disallow @if in from or to for the time being */ 4635 if ((src_host->addr.type == PF_ADDR_ADDRMASK && 4636 src_host->ifname) || 4637 (dst_host->addr.type == PF_ADDR_ADDRMASK && 4638 dst_host->ifname)) { 4639 yyerror("@if syntax not permitted in from or to"); 4640 error++; 4641 } 4642 /* for link-local IPv6 address, interface must match up */ 4643 if ((r->af && src_host->af && r->af != src_host->af) || 4644 (r->af && dst_host->af && r->af != dst_host->af) || 4645 (src_host->af && dst_host->af && 4646 src_host->af != dst_host->af) || 4647 (src_host->ifindex && dst_host->ifindex && 4648 src_host->ifindex != dst_host->ifindex) || 4649 (src_host->ifindex && *interface->ifname && 4650 src_host->ifindex != ifa_nametoindex(interface->ifname)) || 4651 (dst_host->ifindex && *interface->ifname && 4652 dst_host->ifindex != ifa_nametoindex(interface->ifname))) 4653 continue; 4654 if (!r->af && src_host->af) 4655 r->af = src_host->af; 4656 else if (!r->af && dst_host->af) 4657 r->af = dst_host->af; 4658 4659 if (*interface->ifname) 4660 strlcpy(r->ifname, interface->ifname, 4661 sizeof(r->ifname)); 4662 else if (ifa_indextoname(src_host->ifindex, ifname)) 4663 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4664 else if (ifa_indextoname(dst_host->ifindex, ifname)) 4665 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4666 else 4667 memset(r->ifname, '\0', sizeof(r->ifname)); 4668 4669 if (interface->use_rdomain) 4670 r->onrdomain = interface->rdomain; 4671 else 4672 r->onrdomain = -1; 4673 if (strlcpy(r->label, label, sizeof(r->label)) >= 4674 sizeof(r->label)) 4675 errx(1, "expand_rule: strlcpy"); 4676 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4677 sizeof(r->tagname)) 4678 errx(1, "expand_rule: strlcpy"); 4679 if (strlcpy(r->match_tagname, match_tagname, 4680 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4681 errx(1, "expand_rule: strlcpy"); 4682 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4683 src_host, src_port, dst_host, dst_port, proto->proto); 4684 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4685 src_host, src_port, dst_host, dst_port, proto->proto); 4686 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4687 r->af, src_host, src_port, dst_host, dst_port, 4688 proto->proto); 4689 4690 osrch = odsth = NULL; 4691 if (src_host->addr.type == PF_ADDR_DYNIFTL) { 4692 osrch = src_host; 4693 if ((src_host = gen_dynnode(src_host, r->af)) == NULL) 4694 err(1, "expand_rule: calloc"); 4695 } 4696 if (dst_host->addr.type == PF_ADDR_DYNIFTL) { 4697 odsth = dst_host; 4698 if ((dst_host = gen_dynnode(dst_host, r->af)) == NULL) 4699 err(1, "expand_rule: calloc"); 4700 } 4701 4702 error += check_netmask(src_host, r->af); 4703 error += check_netmask(dst_host, r->af); 4704 4705 r->ifnot = interface->not; 4706 r->proto = proto->proto; 4707 r->src.addr = src_host->addr; 4708 r->src.neg = src_host->not; 4709 r->src.port[0] = src_port->port[0]; 4710 r->src.port[1] = src_port->port[1]; 4711 r->src.port_op = src_port->op; 4712 r->dst.addr = dst_host->addr; 4713 r->dst.neg = dst_host->not; 4714 r->dst.port[0] = dst_port->port[0]; 4715 r->dst.port[1] = dst_port->port[1]; 4716 r->dst.port_op = dst_port->op; 4717 r->uid.op = uid->op; 4718 r->uid.uid[0] = uid->uid[0]; 4719 r->uid.uid[1] = uid->uid[1]; 4720 r->gid.op = gid->op; 4721 r->gid.gid[0] = gid->gid[0]; 4722 r->gid.gid[1] = gid->gid[1]; 4723 if (rcv) { 4724 strlcpy(r->rcv_ifname, rcv->ifname, 4725 sizeof(r->rcv_ifname)); 4726 r->rcvifnot = rcv->not; 4727 } 4728 r->type = icmp_type->type; 4729 r->code = icmp_type->code; 4730 4731 if ((keep_state == PF_STATE_MODULATE || 4732 keep_state == PF_STATE_SYNPROXY) && 4733 r->proto && r->proto != IPPROTO_TCP) 4734 r->keep_state = PF_STATE_NORMAL; 4735 else 4736 r->keep_state = keep_state; 4737 4738 if (r->proto && r->proto != IPPROTO_TCP) { 4739 r->flags = 0; 4740 r->flagset = 0; 4741 } else { 4742 r->flags = flags; 4743 r->flagset = flagset; 4744 } 4745 if (icmp_type->proto && r->proto != icmp_type->proto) { 4746 yyerror("icmp-type mismatch"); 4747 error++; 4748 } 4749 4750 if (src_os && src_os->os) { 4751 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4752 if ((pf->opts & PF_OPT_VERBOSE2) && 4753 r->os_fingerprint == PF_OSFP_NOMATCH) 4754 fprintf(stderr, 4755 "warning: unknown '%s' OS fingerprint\n", 4756 src_os->os); 4757 } else { 4758 r->os_fingerprint = PF_OSFP_ANY; 4759 } 4760 4761 if (nat && nat->rdr && nat->binat) { 4762 if (disallow_table(src_host, "invalid use of table " 4763 "<%s> as the source address of a binat-to rule") || 4764 disallow_alias(src_host, "invalid use of interface " 4765 "(%s) as the source address of a binat-to rule")) { 4766 error++; 4767 } else if ((r->src.addr.type != PF_ADDR_ADDRMASK && 4768 r->src.addr.type != PF_ADDR_DYNIFTL) || 4769 (r->nat.addr.type != PF_ADDR_ADDRMASK && 4770 r->nat.addr.type != PF_ADDR_DYNIFTL)) { 4771 yyerror("binat-to requires a specified " 4772 "source and redirect address"); 4773 error++; 4774 } 4775 if (DYNIF_MULTIADDR(r->src.addr) || 4776 DYNIF_MULTIADDR(r->nat.addr)) { 4777 yyerror ("dynamic interfaces must be used with " 4778 ":0 in a binat-to rule"); 4779 error++; 4780 } 4781 if (PF_AZERO(&r->src.addr.v.a.mask, af) || 4782 PF_AZERO(&r->nat.addr.v.a.mask, af)) { 4783 yyerror ("source and redir addresess must have " 4784 "a matching network mask in binat-rule"); 4785 error++; 4786 } 4787 if (r->nat.addr.type == PF_ADDR_TABLE) { 4788 yyerror ("tables cannot be used as the redirect " 4789 "address of a binat-to rule"); 4790 error++; 4791 } 4792 if (r->direction != PF_INOUT) { 4793 yyerror("binat-to cannot be specified " 4794 "with a direction"); 4795 error++; 4796 } 4797 4798 /* first specify outbound NAT rule */ 4799 r->direction = PF_OUT; 4800 } 4801 4802 error += apply_redirspec(&r->nat, r, nat, 0, dst_port); 4803 error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port); 4804 error += apply_redirspec(&r->route, r, rroute, 2, dst_port); 4805 4806 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4807 yyerror("skipping rule due to errors"); 4808 else { 4809 r->nr = pf->astack[pf->asd]->match++; 4810 pfctl_add_rule(pf, r, anchor_call); 4811 added++; 4812 } 4813 r->direction = dir; 4814 4815 /* Generate binat's matching inbound rule */ 4816 if (!error && nat && nat->rdr && nat->binat) { 4817 bcopy(r, &rb, sizeof(rb)); 4818 4819 /* now specify inbound rdr rule */ 4820 rb.direction = PF_IN; 4821 4822 if ((srch = calloc(1, sizeof(*srch))) == NULL) 4823 err(1, "expand_rule: calloc"); 4824 bcopy(src_host, srch, sizeof(*srch)); 4825 srch->ifname = NULL; 4826 srch->next = NULL; 4827 srch->tail = NULL; 4828 4829 if ((dsth = calloc(1, sizeof(*dsth))) == NULL) 4830 err(1, "expand_rule: calloc"); 4831 bcopy(&rb.nat.addr, &dsth->addr, sizeof(dsth->addr)); 4832 dsth->ifname = NULL; 4833 dsth->next = NULL; 4834 dsth->tail = NULL; 4835 4836 bzero(&binat, sizeof(binat)); 4837 if ((binat.rdr = 4838 calloc(1, sizeof(*binat.rdr))) == NULL) 4839 err(1, "expand_rule: calloc"); 4840 bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr)); 4841 bcopy(&nat->pool_opts, &binat.pool_opts, 4842 sizeof(binat.pool_opts)); 4843 binat.pool_opts.staticport = 0; 4844 binat.rdr->host = srch; 4845 4846 expand_rule(&rb, 1, interface, NULL, &binat, NULL, 4847 proto, 4848 src_os, dst_host, dst_port, dsth, src_port, 4849 uid, gid, rcv, icmp_type, anchor_call); 4850 } 4851 4852 if (osrch && src_host->addr.type == PF_ADDR_DYNIFTL) { 4853 free(src_host); 4854 src_host = osrch; 4855 } 4856 if (odsth && dst_host->addr.type == PF_ADDR_DYNIFTL) { 4857 free(dst_host); 4858 dst_host = odsth; 4859 } 4860 )))))))))); 4861 4862 if (!keeprule) { 4863 FREE_LIST(struct node_if, interfaces); 4864 FREE_LIST(struct node_proto, protos); 4865 FREE_LIST(struct node_host, src_hosts); 4866 FREE_LIST(struct node_port, src_ports); 4867 FREE_LIST(struct node_os, src_oses); 4868 FREE_LIST(struct node_host, dst_hosts); 4869 FREE_LIST(struct node_port, dst_ports); 4870 FREE_LIST(struct node_uid, uids); 4871 FREE_LIST(struct node_gid, gids); 4872 FREE_LIST(struct node_icmp, icmp_types); 4873 if (nat && nat->rdr) 4874 FREE_LIST(struct node_host, nat->rdr->host); 4875 if (rdr && rdr->rdr) 4876 FREE_LIST(struct node_host, rdr->rdr->host); 4877 4878 } 4879 4880 if (!added) 4881 yyerror("rule expands to no valid combination"); 4882} 4883 4884int 4885expand_skip_interface(struct node_if *interfaces) 4886{ 4887 int errs = 0; 4888 4889 if (!interfaces || (!interfaces->next && !interfaces->not && 4890 !strcmp(interfaces->ifname, "none"))) { 4891 if (pf->opts & PF_OPT_VERBOSE) 4892 printf("set skip on none\n"); 4893 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4894 return (errs); 4895 } 4896 4897 if (pf->opts & PF_OPT_VERBOSE) 4898 printf("set skip on {"); 4899 LOOP_THROUGH(struct node_if, interface, interfaces, 4900 if (pf->opts & PF_OPT_VERBOSE) 4901 printf(" %s", interface->ifname); 4902 if (interface->not) { 4903 yyerror("skip on ! <interface> is not supported"); 4904 errs++; 4905 } else if (interface->use_rdomain) { 4906 yyerror("skip on rdomain <num> is not supported"); 4907 errs++; 4908 } else 4909 errs += pfctl_set_interface_flags(pf, 4910 interface->ifname, PFI_IFLAG_SKIP, 1); 4911 ); 4912 if (pf->opts & PF_OPT_VERBOSE) 4913 printf(" }\n"); 4914 4915 FREE_LIST(struct node_if, interfaces); 4916 4917 if (errs) 4918 return (1); 4919 else 4920 return (0); 4921} 4922 4923void 4924freehostlist(struct node_host *h) 4925{ 4926 struct node_host *n; 4927 4928 for (n = h; n != NULL; n = n->next) 4929 if (n->ifname) 4930 free(n->ifname); 4931 FREE_LIST(struct node_host, h); 4932} 4933 4934#undef FREE_LIST 4935#undef LOOP_THROUGH 4936 4937int 4938kw_cmp(const void *k, const void *e) 4939{ 4940 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4941} 4942 4943int 4944lookup(char *s) 4945{ 4946 /* this has to be sorted always */ 4947 static const struct keywords keywords[] = { 4948 { "af-to", AFTO}, 4949 { "all", ALL}, 4950 { "allow-opts", ALLOWOPTS}, 4951 { "anchor", ANCHOR}, 4952 { "antispoof", ANTISPOOF}, 4953 { "any", ANY}, 4954 { "bandwidth", BANDWIDTH}, 4955 { "binat-to", BINATTO}, 4956 { "bitmask", BITMASK}, 4957 { "block", BLOCK}, 4958 { "block-policy", BLOCKPOLICY}, 4959 { "burst", BURST}, 4960 { "code", CODE}, 4961 { "debug", DEBUG}, 4962 { "default", DEFAULT}, 4963 { "divert-packet", DIVERTPACKET}, 4964 { "divert-reply", DIVERTREPLY}, 4965 { "divert-to", DIVERTTO}, 4966 { "drop", DROP}, 4967 { "dup-to", DUPTO}, 4968 { "file", FILENAME}, 4969 { "fingerprints", FINGERPRINTS}, 4970 { "flags", FLAGS}, 4971 { "floating", FLOATING}, 4972 { "flush", FLUSH}, 4973 { "for", FOR}, 4974 { "fragment", FRAGMENT}, 4975 { "from", FROM}, 4976 { "global", GLOBAL}, 4977 { "group", GROUP}, 4978 { "hostid", HOSTID}, 4979 { "icmp-type", ICMPTYPE}, 4980 { "icmp6-type", ICMP6TYPE}, 4981 { "if-bound", IFBOUND}, 4982 { "in", IN}, 4983 { "include", INCLUDE}, 4984 { "inet", INET}, 4985 { "inet6", INET6}, 4986 { "keep", KEEP}, 4987 { "label", LABEL}, 4988 { "least-states", LEASTSTATES}, 4989 { "limit", LIMIT}, 4990 { "load", LOAD}, 4991 { "log", LOG}, 4992 { "loginterface", LOGINTERFACE}, 4993 { "match", MATCH}, 4994 { "matches", MATCHES}, 4995 { "max", MAXIMUM}, 4996 { "max-mss", MAXMSS}, 4997 { "max-src-conn", MAXSRCCONN}, 4998 { "max-src-conn-rate", MAXSRCCONNRATE}, 4999 { "max-src-nodes", MAXSRCNODES}, 5000 { "max-src-states", MAXSRCSTATES}, 5001 { "min", MINIMUM}, 5002 { "min-ttl", MINTTL}, 5003 { "modulate", MODULATE}, 5004 { "nat-to", NATTO}, 5005 { "no", NO}, 5006 { "no-df", NODF}, 5007 { "no-route", NOROUTE}, 5008 { "no-sync", NOSYNC}, 5009 { "on", ON}, 5010 { "once", ONCE}, 5011 { "optimization", OPTIMIZATION}, 5012 { "os", OS}, 5013 { "out", OUT}, 5014 { "overload", OVERLOAD}, 5015 { "parent", PARENT}, 5016 { "pass", PASS}, 5017 { "pflow", PFLOW}, 5018 { "port", PORT}, 5019 { "prio", PRIO}, 5020 { "probability", PROBABILITY}, 5021 { "proto", PROTO}, 5022 { "qlimit", QLIMIT}, 5023 { "queue", QUEUE}, 5024 { "quick", QUICK}, 5025 { "random", RANDOM}, 5026 { "random-id", RANDOMID}, 5027 { "rdomain", RDOMAIN}, 5028 { "rdr-to", RDRTO}, 5029 { "reassemble", REASSEMBLE}, 5030 { "received-on", RECEIVEDON}, 5031 { "reply-to", REPLYTO}, 5032 { "return", RETURN}, 5033 { "return-icmp", RETURNICMP}, 5034 { "return-icmp6", RETURNICMP6}, 5035 { "return-rst", RETURNRST}, 5036 { "round-robin", ROUNDROBIN}, 5037 { "route", ROUTE}, 5038 { "route-to", ROUTETO}, 5039 { "rtable", RTABLE}, 5040 { "rule", RULE}, 5041 { "ruleset-optimization", RULESET_OPTIMIZATION}, 5042 { "scrub", SCRUB}, 5043 { "set", SET}, 5044 { "skip", SKIP}, 5045 { "sloppy", SLOPPY}, 5046 { "source-hash", SOURCEHASH}, 5047 { "source-track", SOURCETRACK}, 5048 { "state", STATE}, 5049 { "state-defaults", STATEDEFAULTS}, 5050 { "state-policy", STATEPOLICY}, 5051 { "static-port", STATICPORT}, 5052 { "sticky-address", STICKYADDRESS}, 5053 { "synproxy", SYNPROXY}, 5054 { "table", TABLE}, 5055 { "tag", TAG}, 5056 { "tagged", TAGGED}, 5057 { "timeout", TIMEOUT}, 5058 { "to", TO}, 5059 { "tos", TOS}, 5060 { "ttl", TTL}, 5061 { "urpf-failed", URPFFAILED}, 5062 { "user", USER}, 5063 { "weight", WEIGHT}, 5064 }; 5065 const struct keywords *p; 5066 5067 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5068 sizeof(keywords[0]), kw_cmp); 5069 5070 if (p) { 5071 if (debug > 1) 5072 fprintf(stderr, "%s: %d\n", s, p->k_val); 5073 return (p->k_val); 5074 } else { 5075 if (debug > 1) 5076 fprintf(stderr, "string: %s\n", s); 5077 return (STRING); 5078 } 5079} 5080 5081#define MAXPUSHBACK 128 5082 5083u_char *parsebuf; 5084int parseindex; 5085u_char pushback_buffer[MAXPUSHBACK]; 5086int pushback_index = 0; 5087 5088int 5089lgetc(int quotec) 5090{ 5091 int c, next; 5092 5093 if (parsebuf) { 5094 /* Read character from the parsebuffer instead of input. */ 5095 if (parseindex >= 0) { 5096 c = parsebuf[parseindex++]; 5097 if (c != '\0') 5098 return (c); 5099 parsebuf = NULL; 5100 } else 5101 parseindex++; 5102 } 5103 5104 if (pushback_index) 5105 return (pushback_buffer[--pushback_index]); 5106 5107 if (quotec) { 5108 if ((c = getc(file->stream)) == EOF) { 5109 yyerror("reached end of file while parsing quoted string"); 5110 if (popfile() == EOF) 5111 return (EOF); 5112 return (quotec); 5113 } 5114 return (c); 5115 } 5116 5117 while ((c = getc(file->stream)) == '\\') { 5118 next = getc(file->stream); 5119 if (next != '\n') { 5120 c = next; 5121 break; 5122 } 5123 yylval.lineno = file->lineno; 5124 file->lineno++; 5125 } 5126 5127 while (c == EOF) { 5128 if (popfile() == EOF) 5129 return (EOF); 5130 c = getc(file->stream); 5131 } 5132 return (c); 5133} 5134 5135int 5136lungetc(int c) 5137{ 5138 if (c == EOF) 5139 return (EOF); 5140 if (parsebuf) { 5141 parseindex--; 5142 if (parseindex >= 0) 5143 return (c); 5144 } 5145 if (pushback_index < MAXPUSHBACK-1) 5146 return (pushback_buffer[pushback_index++] = c); 5147 else 5148 return (EOF); 5149} 5150 5151int 5152findeol(void) 5153{ 5154 int c; 5155 5156 parsebuf = NULL; 5157 5158 /* skip to either EOF or the first real EOL */ 5159 while (1) { 5160 if (pushback_index) 5161 c = pushback_buffer[--pushback_index]; 5162 else 5163 c = lgetc(0); 5164 if (c == '\n') { 5165 file->lineno++; 5166 break; 5167 } 5168 if (c == EOF) 5169 break; 5170 } 5171 return (ERROR); 5172} 5173 5174int 5175yylex(void) 5176{ 5177 u_char buf[8096]; 5178 u_char *p, *val; 5179 int quotec, next, c; 5180 int token; 5181 5182top: 5183 p = buf; 5184 while ((c = lgetc(0)) == ' ' || c == '\t') 5185 ; /* nothing */ 5186 5187 yylval.lineno = file->lineno; 5188 if (c == '#') 5189 while ((c = lgetc(0)) != '\n' && c != EOF) 5190 ; /* nothing */ 5191 if (c == '$' && parsebuf == NULL) { 5192 while (1) { 5193 if ((c = lgetc(0)) == EOF) 5194 return (0); 5195 5196 if (p + 1 >= buf + sizeof(buf) - 1) { 5197 yyerror("string too long"); 5198 return (findeol()); 5199 } 5200 if (isalnum(c) || c == '_') { 5201 *p++ = c; 5202 continue; 5203 } 5204 *p = '\0'; 5205 lungetc(c); 5206 break; 5207 } 5208 val = symget(buf); 5209 if (val == NULL) { 5210 yyerror("macro '%s' not defined", buf); 5211 return (findeol()); 5212 } 5213 parsebuf = val; 5214 parseindex = 0; 5215 goto top; 5216 } 5217 5218 switch (c) { 5219 case '\'': 5220 case '"': 5221 quotec = c; 5222 while (1) { 5223 if ((c = lgetc(quotec)) == EOF) 5224 return (0); 5225 if (c == '\n') { 5226 file->lineno++; 5227 continue; 5228 } else if (c == '\\') { 5229 if ((next = lgetc(quotec)) == EOF) 5230 return (0); 5231 if (next == quotec || c == ' ' || c == '\t') 5232 c = next; 5233 else if (next == '\n') { 5234 file->lineno++; 5235 continue; 5236 } else 5237 lungetc(next); 5238 } else if (c == quotec) { 5239 *p = '\0'; 5240 break; 5241 } else if (c == '\0') { 5242 yyerror("syntax error"); 5243 return (findeol()); 5244 } 5245 if (p + 1 >= buf + sizeof(buf) - 1) { 5246 yyerror("string too long"); 5247 return (findeol()); 5248 } 5249 *p++ = c; 5250 } 5251 yylval.v.string = strdup(buf); 5252 if (yylval.v.string == NULL) 5253 err(1, "yylex: strdup"); 5254 return (STRING); 5255 case '!': 5256 next = lgetc(0); 5257 if (next == '=') 5258 return (NE); 5259 lungetc(next); 5260 break; 5261 case '<': 5262 next = lgetc(0); 5263 if (next == '>') { 5264 yylval.v.i = PF_OP_XRG; 5265 return (PORTBINARY); 5266 } else if (next == '=') 5267 return (LE); 5268 lungetc(next); 5269 break; 5270 case '>': 5271 next = lgetc(0); 5272 if (next == '<') { 5273 yylval.v.i = PF_OP_IRG; 5274 return (PORTBINARY); 5275 } else if (next == '=') 5276 return (GE); 5277 lungetc(next); 5278 break; 5279 } 5280 5281#define allowed_to_end_number(x) \ 5282 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5283 5284 if (c == '-' || isdigit(c)) { 5285 do { 5286 *p++ = c; 5287 if ((unsigned)(p-buf) >= sizeof(buf)) { 5288 yyerror("string too long"); 5289 return (findeol()); 5290 } 5291 } while ((c = lgetc(0)) != EOF && isdigit(c)); 5292 lungetc(c); 5293 if (p == buf + 1 && buf[0] == '-') 5294 goto nodigits; 5295 if (c == EOF || allowed_to_end_number(c)) { 5296 const char *errstr = NULL; 5297 5298 *p = '\0'; 5299 yylval.v.number = strtonum(buf, LLONG_MIN, 5300 LLONG_MAX, &errstr); 5301 if (errstr) { 5302 yyerror("\"%s\" invalid number: %s", 5303 buf, errstr); 5304 return (findeol()); 5305 } 5306 return (NUMBER); 5307 } else { 5308nodigits: 5309 while (p > buf + 1) 5310 lungetc(*--p); 5311 c = *--p; 5312 if (c == '-') 5313 return (c); 5314 } 5315 } 5316 5317#define allowed_in_string(x) \ 5318 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5319 x != '{' && x != '}' && x != '<' && x != '>' && \ 5320 x != '!' && x != '=' && x != '/' && x != '#' && \ 5321 x != ',')) 5322 5323 if (isalnum(c) || c == ':' || c == '_') { 5324 do { 5325 *p++ = c; 5326 if ((unsigned)(p-buf) >= sizeof(buf)) { 5327 yyerror("string too long"); 5328 return (findeol()); 5329 } 5330 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 5331 lungetc(c); 5332 *p = '\0'; 5333 if ((token = lookup(buf)) == STRING) 5334 if ((yylval.v.string = strdup(buf)) == NULL) 5335 err(1, "yylex: strdup"); 5336 return (token); 5337 } 5338 if (c == '\n') { 5339 yylval.lineno = file->lineno; 5340 file->lineno++; 5341 } 5342 if (c == EOF) 5343 return (0); 5344 return (c); 5345} 5346 5347int 5348check_file_secrecy(int fd, const char *fname) 5349{ 5350 struct stat st; 5351 5352 if (fstat(fd, &st)) { 5353 warn("cannot stat %s", fname); 5354 return (-1); 5355 } 5356 if (st.st_uid != 0 && st.st_uid != getuid()) { 5357 warnx("%s: owner not root or current user", fname); 5358 return (-1); 5359 } 5360 if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) { 5361 warnx("%s: group writable or world read/writable", fname); 5362 return (-1); 5363 } 5364 return (0); 5365} 5366 5367struct file * 5368pushfile(const char *name, int secret) 5369{ 5370 struct file *nfile; 5371 5372 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 5373 (nfile->name = strdup(name)) == NULL) { 5374 if (nfile) 5375 free(nfile); 5376 warn("malloc"); 5377 return (NULL); 5378 } 5379 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 5380 nfile->stream = stdin; 5381 free(nfile->name); 5382 if ((nfile->name = strdup("stdin")) == NULL) { 5383 warn("strdup"); 5384 free(nfile); 5385 return (NULL); 5386 } 5387 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 5388 warn("%s", nfile->name); 5389 free(nfile->name); 5390 free(nfile); 5391 return (NULL); 5392 } else if (secret && 5393 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 5394 fclose(nfile->stream); 5395 free(nfile->name); 5396 free(nfile); 5397 return (NULL); 5398 } 5399 nfile->lineno = 1; 5400 TAILQ_INSERT_TAIL(&files, nfile, entry); 5401 return (nfile); 5402} 5403 5404int 5405popfile(void) 5406{ 5407 struct file *prev; 5408 5409 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 5410 prev->errors += file->errors; 5411 TAILQ_REMOVE(&files, file, entry); 5412 fclose(file->stream); 5413 free(file->name); 5414 free(file); 5415 file = prev; 5416 return (0); 5417 } 5418 return (EOF); 5419} 5420 5421int 5422parse_config(char *filename, struct pfctl *xpf) 5423{ 5424 int errors = 0; 5425 struct sym *sym; 5426 5427 pf = xpf; 5428 errors = 0; 5429 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5430 returnicmp6default = 5431 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5432 blockpolicy = PFRULE_DROP; 5433 5434 if ((file = pushfile(filename, 0)) == NULL) { 5435 warn("cannot open the main config file!"); 5436 return (-1); 5437 } 5438 5439 yyparse(); 5440 errors = file->errors; 5441 popfile(); 5442 5443 /* Free macros and check which have not been used. */ 5444 while ((sym = TAILQ_FIRST(&symhead))) { 5445 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5446 fprintf(stderr, "warning: macro '%s' not " 5447 "used\n", sym->nam); 5448 free(sym->nam); 5449 free(sym->val); 5450 TAILQ_REMOVE(&symhead, sym, entry); 5451 free(sym); 5452 } 5453 5454 return (errors ? -1 : 0); 5455} 5456 5457int 5458symset(const char *nam, const char *val, int persist) 5459{ 5460 struct sym *sym; 5461 5462 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5463 sym = TAILQ_NEXT(sym, entry)) 5464 ; /* nothing */ 5465 5466 if (sym != NULL) { 5467 if (sym->persist == 1) 5468 return (0); 5469 else { 5470 free(sym->nam); 5471 free(sym->val); 5472 TAILQ_REMOVE(&symhead, sym, entry); 5473 free(sym); 5474 } 5475 } 5476 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5477 return (-1); 5478 5479 sym->nam = strdup(nam); 5480 if (sym->nam == NULL) { 5481 free(sym); 5482 return (-1); 5483 } 5484 sym->val = strdup(val); 5485 if (sym->val == NULL) { 5486 free(sym->nam); 5487 free(sym); 5488 return (-1); 5489 } 5490 sym->used = 0; 5491 sym->persist = persist; 5492 TAILQ_INSERT_TAIL(&symhead, sym, entry); 5493 return (0); 5494} 5495 5496int 5497pfctl_cmdline_symset(char *s) 5498{ 5499 char *sym, *val; 5500 int ret; 5501 5502 if ((val = strrchr(s, '=')) == NULL) 5503 return (-1); 5504 5505 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5506 err(1, "pfctl_cmdline_symset: malloc"); 5507 5508 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5509 5510 ret = symset(sym, val + 1, 1); 5511 free(sym); 5512 5513 return (ret); 5514} 5515 5516char * 5517symget(const char *nam) 5518{ 5519 struct sym *sym; 5520 5521 TAILQ_FOREACH(sym, &symhead, entry) 5522 if (strcmp(nam, sym->nam) == 0) { 5523 sym->used = 1; 5524 return (sym->val); 5525 } 5526 return (NULL); 5527} 5528 5529void 5530mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5531{ 5532 struct pf_rule *r; 5533 5534 while ((r = TAILQ_FIRST(src->rules.active.ptr)) != NULL) { 5535 TAILQ_REMOVE(src->rules.active.ptr, r, entries); 5536 TAILQ_INSERT_TAIL(dst->rules.active.ptr, r, entries); 5537 dst->anchor->match++; 5538 } 5539 src->anchor->match = 0; 5540 while ((r = TAILQ_FIRST(src->rules.inactive.ptr)) != NULL) { 5541 TAILQ_REMOVE(src->rules.inactive.ptr, r, entries); 5542 TAILQ_INSERT_TAIL(dst->rules.inactive.ptr, r, entries); 5543 } 5544} 5545 5546void 5547decide_address_family(struct node_host *n, sa_family_t *af) 5548{ 5549 if (*af != 0 || n == NULL) 5550 return; 5551 *af = n->af; 5552 while ((n = n->next) != NULL) { 5553 if (n->af != *af) { 5554 *af = 0; 5555 return; 5556 } 5557 } 5558} 5559 5560int 5561invalid_redirect(struct node_host *nh, sa_family_t af) 5562{ 5563 if (!af) { 5564 struct node_host *n; 5565 5566 /* tables and dyniftl are ok without an address family */ 5567 for (n = nh; n != NULL; n = n->next) { 5568 if (n->addr.type != PF_ADDR_TABLE && 5569 n->addr.type != PF_ADDR_DYNIFTL) { 5570 yyerror("address family not given and " 5571 "translation address expands to multiple " 5572 "address families"); 5573 return (1); 5574 } 5575 } 5576 } 5577 if (nh == NULL) { 5578 yyerror("no translation address with matching address family " 5579 "found."); 5580 return (1); 5581 } 5582 return (0); 5583} 5584 5585int 5586atoul(char *s, u_long *ulvalp) 5587{ 5588 u_long ulval; 5589 char *ep; 5590 5591 errno = 0; 5592 ulval = strtoul(s, &ep, 0); 5593 if (s[0] == '\0' || *ep != '\0') 5594 return (-1); 5595 if (errno == ERANGE && ulval == ULONG_MAX) 5596 return (-1); 5597 *ulvalp = ulval; 5598 return (0); 5599} 5600 5601int 5602getservice(char *n) 5603{ 5604 struct servent *s; 5605 u_long ulval; 5606 5607 if (atoul(n, &ulval) == 0) { 5608 if (ulval > 65535) { 5609 yyerror("illegal port value %lu", ulval); 5610 return (-1); 5611 } 5612 return (htons(ulval)); 5613 } else { 5614 s = getservbyname(n, "tcp"); 5615 if (s == NULL) 5616 s = getservbyname(n, "udp"); 5617 if (s == NULL) { 5618 yyerror("unknown port %s", n); 5619 return (-1); 5620 } 5621 return (s->s_port); 5622 } 5623} 5624 5625int 5626rule_label(struct pf_rule *r, char *s) 5627{ 5628 if (s) { 5629 if (strlcpy(r->label, s, sizeof(r->label)) >= 5630 sizeof(r->label)) { 5631 yyerror("rule label too long (max %d chars)", 5632 sizeof(r->label)-1); 5633 return (-1); 5634 } 5635 } 5636 return (0); 5637} 5638 5639u_int16_t 5640parseicmpspec(char *w, sa_family_t af) 5641{ 5642 const struct icmpcodeent *p; 5643 u_long ulval; 5644 u_int8_t icmptype; 5645 5646 if (af == AF_INET) 5647 icmptype = returnicmpdefault >> 8; 5648 else 5649 icmptype = returnicmp6default >> 8; 5650 5651 if (atoul(w, &ulval) == -1) { 5652 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5653 yyerror("unknown icmp code %s", w); 5654 return (0); 5655 } 5656 ulval = p->code; 5657 } 5658 if (ulval > 255) { 5659 yyerror("invalid icmp code %lu", ulval); 5660 return (0); 5661 } 5662 return (icmptype << 8 | ulval); 5663} 5664 5665int 5666parseport(char *port, struct range *r, int extensions) 5667{ 5668 char *p = strchr(port, ':'); 5669 5670 if (p == NULL) { 5671 if ((r->a = getservice(port)) == -1) 5672 return (-1); 5673 r->b = 0; 5674 r->t = PF_OP_NONE; 5675 return (0); 5676 } 5677 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 5678 *p = 0; 5679 if ((r->a = getservice(port)) == -1) 5680 return (-1); 5681 r->b = 0; 5682 r->t = PF_OP_IRG; 5683 return (0); 5684 } 5685 if ((extensions & PPORT_RANGE)) { 5686 *p++ = 0; 5687 if ((r->a = getservice(port)) == -1 || 5688 (r->b = getservice(p)) == -1) 5689 return (-1); 5690 if (r->a == r->b) { 5691 r->b = 0; 5692 r->t = PF_OP_NONE; 5693 } else 5694 r->t = PF_OP_RRG; 5695 return (0); 5696 } 5697 return (-1); 5698} 5699 5700int 5701pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5702{ 5703 struct loadanchors *la; 5704 5705 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5706 if (pf->opts & PF_OPT_VERBOSE) 5707 fprintf(stderr, "\nLoading anchor %s from %s\n", 5708 la->anchorname, la->filename); 5709 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 5710 la->anchorname, trans) == -1) 5711 return (-1); 5712 } 5713 5714 return (0); 5715} 5716 5717int 5718kw_casecmp(const void *k, const void *e) 5719{ 5720 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 5721} 5722 5723int 5724map_tos(char *s, int *val) 5725{ 5726 /* DiffServ Codepoints and other TOS mappings */ 5727 const struct keywords toswords[] = { 5728 { "af11", IPTOS_DSCP_AF11 }, 5729 { "af12", IPTOS_DSCP_AF12 }, 5730 { "af13", IPTOS_DSCP_AF13 }, 5731 { "af21", IPTOS_DSCP_AF21 }, 5732 { "af22", IPTOS_DSCP_AF22 }, 5733 { "af23", IPTOS_DSCP_AF23 }, 5734 { "af31", IPTOS_DSCP_AF31 }, 5735 { "af32", IPTOS_DSCP_AF32 }, 5736 { "af33", IPTOS_DSCP_AF33 }, 5737 { "af41", IPTOS_DSCP_AF41 }, 5738 { "af42", IPTOS_DSCP_AF42 }, 5739 { "af43", IPTOS_DSCP_AF43 }, 5740 { "critical", IPTOS_PREC_CRITIC_ECP }, 5741 { "cs0", IPTOS_DSCP_CS0 }, 5742 { "cs1", IPTOS_DSCP_CS1 }, 5743 { "cs2", IPTOS_DSCP_CS2 }, 5744 { "cs3", IPTOS_DSCP_CS3 }, 5745 { "cs4", IPTOS_DSCP_CS4 }, 5746 { "cs5", IPTOS_DSCP_CS5 }, 5747 { "cs6", IPTOS_DSCP_CS6 }, 5748 { "cs7", IPTOS_DSCP_CS7 }, 5749 { "ef", IPTOS_DSCP_EF }, 5750 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 5751 { "lowdelay", IPTOS_LOWDELAY }, 5752 { "netcontrol", IPTOS_PREC_NETCONTROL }, 5753 { "reliability", IPTOS_RELIABILITY }, 5754 { "throughput", IPTOS_THROUGHPUT } 5755 }; 5756 const struct keywords *p; 5757 5758 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 5759 sizeof(toswords[0]), kw_casecmp); 5760 5761 if (p) { 5762 *val = p->k_val; 5763 return (1); 5764 } 5765 return (0); 5766} 5767