parse.y revision 1.659
1/* $OpenBSD: parse.y,v 1.659 2017/05/15 11:23:25 mikeb Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/types.h> 31#include <sys/socket.h> 32#include <sys/stat.h> 33#include <net/if.h> 34#include <netinet/in.h> 35#include <netinet/ip.h> 36#include <netinet/ip_icmp.h> 37#include <netinet/icmp6.h> 38#include <net/pfvar.h> 39#include <arpa/inet.h> 40 41#include <stdio.h> 42#include <unistd.h> 43#include <stdlib.h> 44#include <netdb.h> 45#include <stdarg.h> 46#include <errno.h> 47#include <string.h> 48#include <ctype.h> 49#include <math.h> 50#include <err.h> 51#include <limits.h> 52#include <pwd.h> 53#include <grp.h> 54#include <md5.h> 55 56#include "pfctl_parser.h" 57#include "pfctl.h" 58 59static struct pfctl *pf = NULL; 60static int debug = 0; 61static u_int16_t returnicmpdefault = 62 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 63static u_int16_t returnicmp6default = 64 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 65static int blockpolicy = PFRULE_DROP; 66static int default_statelock; 67 68TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 69static struct file { 70 TAILQ_ENTRY(file) entry; 71 FILE *stream; 72 char *name; 73 int lineno; 74 int errors; 75} *file; 76struct file *pushfile(const char *, int); 77int popfile(void); 78int check_file_secrecy(int, const char *); 79int yyparse(void); 80int yylex(void); 81int yyerror(const char *, ...); 82int kw_cmp(const void *, const void *); 83int lookup(char *); 84int lgetc(int); 85int lungetc(int); 86int findeol(void); 87 88TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 89struct sym { 90 TAILQ_ENTRY(sym) entry; 91 int used; 92 int persist; 93 char *nam; 94 char *val; 95}; 96int symset(const char *, const char *, int); 97char *symget(const char *); 98 99int atoul(char *, u_long *); 100 101struct node_proto { 102 u_int8_t proto; 103 struct node_proto *next; 104 struct node_proto *tail; 105}; 106 107struct node_port { 108 u_int16_t port[2]; 109 u_int8_t op; 110 struct node_port *next; 111 struct node_port *tail; 112}; 113 114struct node_uid { 115 uid_t uid[2]; 116 u_int8_t op; 117 struct node_uid *next; 118 struct node_uid *tail; 119}; 120 121struct node_gid { 122 gid_t gid[2]; 123 u_int8_t op; 124 struct node_gid *next; 125 struct node_gid *tail; 126}; 127 128struct node_icmp { 129 u_int8_t code; 130 u_int8_t type; 131 u_int8_t proto; 132 struct node_icmp *next; 133 struct node_icmp *tail; 134}; 135 136enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 137 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 138 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 139 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 140 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, 141 PF_STATE_OPT_PFLOW }; 142 143enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 144 145struct node_state_opt { 146 int type; 147 union { 148 u_int32_t max_states; 149 u_int32_t max_src_states; 150 u_int32_t max_src_conn; 151 struct { 152 u_int32_t limit; 153 u_int32_t seconds; 154 } max_src_conn_rate; 155 struct { 156 u_int8_t flush; 157 char tblname[PF_TABLE_NAME_SIZE]; 158 } overload; 159 u_int32_t max_src_nodes; 160 u_int8_t src_track; 161 u_int32_t statelock; 162 struct { 163 int number; 164 u_int32_t seconds; 165 } timeout; 166 } data; 167 struct node_state_opt *next; 168 struct node_state_opt *tail; 169}; 170 171struct peer { 172 struct node_host *host; 173 struct node_port *port; 174}; 175 176struct node_queue { 177 char queue[PF_QNAME_SIZE]; 178 char parent[PF_QNAME_SIZE]; 179 char ifname[IFNAMSIZ]; 180 int scheduler; 181 struct node_queue *next; 182 struct node_queue *tail; 183}; 184 185struct node_qassign { 186 char *qname; 187 char *pqname; 188}; 189 190struct range { 191 int a; 192 int b; 193 int t; 194}; 195struct redirection { 196 struct node_host *host; 197 struct range rport; 198}; 199 200struct pool_opts { 201 int marker; 202#define POM_TYPE 0x01 203#define POM_STICKYADDRESS 0x02 204 u_int8_t opts; 205 int type; 206 int staticport; 207 struct pf_poolhashkey *key; 208 209} pool_opts; 210 211struct divertspec { 212 struct node_host *addr; 213 u_int16_t port; 214}; 215 216struct redirspec { 217 struct redirection *rdr; 218 struct pool_opts pool_opts; 219 int binat; 220 int af; 221}; 222 223struct filter_opts { 224 int marker; 225#define FOM_FLAGS 0x0001 226#define FOM_ICMP 0x0002 227#define FOM_TOS 0x0004 228#define FOM_KEEP 0x0008 229#define FOM_SRCTRACK 0x0010 230#define FOM_MINTTL 0x0020 231#define FOM_MAXMSS 0x0040 232#define FOM_AFTO 0x0080 233#define FOM_SETTOS 0x0100 234#define FOM_SCRUB_TCP 0x0200 235#define FOM_SETPRIO 0x0400 236#define FOM_ONCE 0x1000 237#define FOM_PRIO 0x2000 238 struct node_uid *uid; 239 struct node_gid *gid; 240 struct node_if *rcv; 241 struct { 242 u_int8_t b1; 243 u_int8_t b2; 244 u_int16_t w; 245 u_int16_t w2; 246 } flags; 247 struct node_icmp *icmpspec; 248 u_int32_t tos; 249 u_int32_t prob; 250 struct { 251 int action; 252 struct node_state_opt *options; 253 } keep; 254 int fragment; 255 int allowopts; 256 char *label; 257 struct node_qassign queues; 258 char *tag; 259 char *match_tag; 260 u_int8_t match_tag_not; 261 u_int rtableid; 262 u_int8_t prio; 263 u_int8_t set_prio[2]; 264 struct divertspec divert; 265 struct divertspec divert_packet; 266 struct redirspec nat; 267 struct redirspec rdr; 268 struct redirspec rroute; 269 270 /* scrub opts */ 271 int nodf; 272 int minttl; 273 int settos; 274 int randomid; 275 int max_mss; 276 277 /* route opts */ 278 struct { 279 struct node_host *host; 280 u_int8_t rt; 281 u_int8_t pool_opts; 282 sa_family_t af; 283 struct pf_poolhashkey *key; 284 } route; 285} filter_opts; 286 287struct antispoof_opts { 288 char *label; 289 u_int rtableid; 290} antispoof_opts; 291 292struct scrub_opts { 293 int marker; 294 int nodf; 295 int minttl; 296 int maxmss; 297 int settos; 298 int randomid; 299 int reassemble_tcp; 300} scrub_opts; 301 302struct node_sc { 303 struct node_queue_bw m1; 304 u_int d; 305 struct node_queue_bw m2; 306}; 307 308struct node_fq { 309 u_int flows; 310 u_int quantum; 311 u_int target; 312 u_int interval; 313}; 314 315struct queue_opts { 316 int marker; 317#define QOM_BWSPEC 0x01 318#define QOM_PARENT 0x02 319#define QOM_DEFAULT 0x04 320#define QOM_QLIMIT 0x08 321#define QOM_FLOWS 0x10 322#define QOM_QUANTUM 0x20 323 struct node_sc realtime; 324 struct node_sc linkshare; 325 struct node_sc upperlimit; 326 struct node_fq flowqueue; 327 char *parent; 328 int flags; 329 u_int qlimit; 330} queue_opts; 331 332struct table_opts { 333 int flags; 334 int init_addr; 335 struct node_tinithead init_nodes; 336} table_opts; 337 338struct node_hfsc_opts hfsc_opts; 339struct node_state_opt *keep_state_defaults = NULL; 340 341int disallow_table(struct node_host *, const char *); 342int disallow_urpf_failed(struct node_host *, const char *); 343int disallow_alias(struct node_host *, const char *); 344int rule_consistent(struct pf_rule *, int); 345int process_tabledef(char *, struct table_opts *); 346void expand_label_str(char *, size_t, const char *, const char *); 347void expand_label_if(const char *, char *, size_t, const char *); 348void expand_label_addr(const char *, char *, size_t, u_int8_t, 349 struct node_host *); 350void expand_label_port(const char *, char *, size_t, 351 struct node_port *); 352void expand_label_proto(const char *, char *, size_t, u_int8_t); 353void expand_label_nr(const char *, char *, size_t); 354void expand_label(char *, size_t, const char *, u_int8_t, 355 struct node_host *, struct node_port *, struct node_host *, 356 struct node_port *, u_int8_t); 357int expand_divertspec(struct pf_rule *, struct divertspec *); 358int collapse_redirspec(struct pf_pool *, struct pf_rule *, 359 struct redirspec *rs, u_int8_t); 360int apply_redirspec(struct pf_pool *, struct pf_rule *, 361 struct redirspec *, int, struct node_port *); 362void expand_rule(struct pf_rule *, int, struct node_if *, 363 struct redirspec *, struct redirspec *, struct redirspec *, 364 struct node_proto *, 365 struct node_os *, struct node_host *, struct node_port *, 366 struct node_host *, struct node_port *, struct node_uid *, 367 struct node_gid *, struct node_if *, struct node_icmp *, 368 const char *); 369int expand_queue(char *, struct node_if *, struct queue_opts *); 370int expand_skip_interface(struct node_if *); 371 372int getservice(char *); 373int rule_label(struct pf_rule *, char *); 374 375void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 376void decide_address_family(struct node_host *, sa_family_t *); 377int invalid_redirect(struct node_host *, sa_family_t); 378u_int16_t parseicmpspec(char *, sa_family_t); 379int kw_casecmp(const void *, const void *); 380int map_tos(char *string, int *); 381 382TAILQ_HEAD(loadanchorshead, loadanchors) 383 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 384 385struct loadanchors { 386 TAILQ_ENTRY(loadanchors) entries; 387 char *anchorname; 388 char *filename; 389}; 390 391typedef struct { 392 union { 393 int64_t number; 394 double probability; 395 int i; 396 char *string; 397 u_int rtableid; 398 u_int16_t weight; 399 struct { 400 u_int8_t b1; 401 u_int8_t b2; 402 u_int16_t w; 403 u_int16_t w2; 404 } b; 405 struct range range; 406 struct node_if *interface; 407 struct node_proto *proto; 408 struct node_icmp *icmp; 409 struct node_host *host; 410 struct node_os *os; 411 struct node_port *port; 412 struct node_uid *uid; 413 struct node_gid *gid; 414 struct node_state_opt *state_opt; 415 struct peer peer; 416 struct { 417 struct peer src, dst; 418 struct node_os *src_os; 419 } fromto; 420 struct redirection *redirection; 421 struct { 422 int action; 423 struct node_state_opt *options; 424 } keep_state; 425 struct { 426 u_int8_t log; 427 u_int8_t logif; 428 u_int8_t quick; 429 } logquick; 430 struct { 431 int neg; 432 char *name; 433 } tagged; 434 struct pf_poolhashkey *hashkey; 435 struct node_queue *queue; 436 struct node_queue_opt queue_options; 437 struct node_queue_bw queue_bwspec; 438 struct node_qassign qassign; 439 struct node_sc sc; 440 struct filter_opts filter_opts; 441 struct antispoof_opts antispoof_opts; 442 struct queue_opts queue_opts; 443 struct scrub_opts scrub_opts; 444 struct table_opts table_opts; 445 struct pool_opts pool_opts; 446 struct node_hfsc_opts hfsc_opts; 447 } v; 448 int lineno; 449} YYSTYPE; 450 451#define PPORT_RANGE 1 452#define PPORT_STAR 2 453int parseport(char *, struct range *r, int); 454 455#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 456 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 457 !isdigit((unsigned char)(addr).v.ifname[strlen((addr).v.ifname)-1]))) 458 459%} 460 461%token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 462%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 463%token ICMP6TYPE CODE KEEP MODULATE STATE PORT BINATTO NODF 464%token MINTTL ERROR ALLOWOPTS FILENAME ROUTETO DUPTO REPLYTO NO LABEL 465%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 466%token REASSEMBLE ANCHOR 467%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 468%token SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 469%token ANTISPOOF FOR INCLUDE MATCHES 470%token BITMASK RANDOM SOURCEHASH ROUNDROBIN LEASTSTATES STATICPORT PROBABILITY 471%token WEIGHT BANDWIDTH FLOWS QUANTUM 472%token QUEUE PRIORITY QLIMIT RTABLE RDOMAIN MINIMUM BURST PARENT 473%token LOAD RULESET_OPTIMIZATION RTABLE RDOMAIN PRIO ONCE DEFAULT 474%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 475%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW 476%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE 477%token DIVERTTO DIVERTREPLY DIVERTPACKET NATTO AFTO RDRTO RECEIVEDON NE LE GE 478%token <v.string> STRING 479%token <v.number> NUMBER 480%token <v.i> PORTBINARY 481%type <v.interface> interface if_list if_item_not if_item 482%type <v.number> number icmptype icmp6type uid gid 483%type <v.number> tos not yesno optnodf 484%type <v.probability> probability 485%type <v.weight> optweight 486%type <v.i> dir af optimizer 487%type <v.i> sourcetrack flush unaryop statelock 488%type <v.b> action 489%type <v.b> flags flag blockspec prio 490%type <v.range> portplain portstar portrange 491%type <v.hashkey> hashkey 492%type <v.proto> proto proto_list proto_item 493%type <v.number> protoval 494%type <v.icmp> icmpspec 495%type <v.icmp> icmp_list icmp_item 496%type <v.icmp> icmp6_list icmp6_item 497%type <v.number> reticmpspec reticmp6spec 498%type <v.fromto> fromto 499%type <v.peer> ipportspec from to 500%type <v.host> ipspec xhost host dynaddr host_list 501%type <v.host> table_host_list tablespec 502%type <v.host> redir_host_list redirspec 503%type <v.host> route_host route_host_list routespec 504%type <v.os> os xos os_list 505%type <v.port> portspec port_list port_item 506%type <v.uid> uids uid_list uid_item 507%type <v.gid> gids gid_list gid_item 508%type <v.redirection> redirpool 509%type <v.string> label stringall anchorname 510%type <v.string> string varstring numberstring 511%type <v.keep_state> keep 512%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 513%type <v.logquick> logquick quick log logopts logopt 514%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 515%type <v.qassign> qname 516%type <v.queue_bwspec> bandwidth 517%type <v.filter_opts> filter_opts filter_opt filter_opts_l 518%type <v.filter_opts> filter_sets filter_set filter_sets_l 519%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 520%type <v.queue_opts> queue_opts queue_opt queue_opts_l optscs 521%type <v.sc> scspec 522%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 523%type <v.table_opts> table_opts table_opt table_opts_l 524%type <v.pool_opts> pool_opts pool_opt pool_opts_l 525%% 526 527ruleset : /* empty */ 528 | ruleset include '\n' 529 | ruleset '\n' 530 | ruleset option '\n' 531 | ruleset pfrule '\n' 532 | ruleset anchorrule '\n' 533 | ruleset loadrule '\n' 534 | ruleset queuespec '\n' 535 | ruleset varset '\n' 536 | ruleset antispoof '\n' 537 | ruleset tabledef '\n' 538 | '{' fakeanchor '}' '\n'; 539 | ruleset error '\n' { file->errors++; } 540 ; 541 542include : INCLUDE STRING { 543 struct file *nfile; 544 545 if ((nfile = pushfile($2, 0)) == NULL) { 546 yyerror("failed to include file %s", $2); 547 free($2); 548 YYERROR; 549 } 550 free($2); 551 552 file = nfile; 553 lungetc('\n'); 554 } 555 ; 556 557/* 558 * apply to previously specified rule: must be careful to note 559 * what that is: pf or nat or binat or rdr 560 */ 561fakeanchor : fakeanchor '\n' 562 | fakeanchor anchorrule '\n' 563 | fakeanchor pfrule '\n' 564 | fakeanchor error '\n' 565 ; 566 567optimizer : string { 568 if (!strcmp($1, "none")) 569 $$ = 0; 570 else if (!strcmp($1, "basic")) 571 $$ = PF_OPTIMIZE_BASIC; 572 else if (!strcmp($1, "profile")) 573 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 574 else { 575 yyerror("unknown ruleset-optimization %s", $1); 576 YYERROR; 577 } 578 } 579 ; 580 581optnodf : /* empty */ { $$ = 0; } 582 | NODF { $$ = 1; } 583 ; 584 585option : SET REASSEMBLE yesno optnodf { 586 pfctl_set_reassembly(pf, $3, $4); 587 } 588 | SET OPTIMIZATION STRING { 589 if (pfctl_set_optimization(pf, $3) != 0) { 590 yyerror("unknown optimization %s", $3); 591 free($3); 592 YYERROR; 593 } 594 free($3); 595 } 596 | SET RULESET_OPTIMIZATION optimizer { 597 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 598 pf->opts |= PF_OPT_OPTIMIZE; 599 pf->optimize = $3; 600 } 601 } 602 | SET TIMEOUT timeout_spec 603 | SET TIMEOUT '{' optnl timeout_list '}' 604 | SET LIMIT limit_spec 605 | SET LIMIT '{' optnl limit_list '}' 606 | SET LOGINTERFACE stringall { 607 if (pfctl_set_logif(pf, $3) != 0) { 608 yyerror("error setting loginterface %s", $3); 609 free($3); 610 YYERROR; 611 } 612 free($3); 613 } 614 | SET HOSTID number { 615 if ($3 == 0 || $3 > UINT_MAX) { 616 yyerror("hostid must be non-zero"); 617 YYERROR; 618 } 619 pfctl_set_hostid(pf, $3); 620 } 621 | SET BLOCKPOLICY DROP { 622 if (pf->opts & PF_OPT_VERBOSE) 623 printf("set block-policy drop\n"); 624 blockpolicy = PFRULE_DROP; 625 } 626 | SET BLOCKPOLICY RETURN { 627 if (pf->opts & PF_OPT_VERBOSE) 628 printf("set block-policy return\n"); 629 blockpolicy = PFRULE_RETURN; 630 } 631 | SET FINGERPRINTS STRING { 632 if (pf->opts & PF_OPT_VERBOSE) 633 printf("set fingerprints \"%s\"\n", $3); 634 if (!pf->anchor->name[0]) { 635 if (pfctl_file_fingerprints(pf->dev, 636 pf->opts, $3)) { 637 yyerror("error loading " 638 "fingerprints %s", $3); 639 free($3); 640 YYERROR; 641 } 642 } 643 free($3); 644 } 645 | SET STATEPOLICY statelock { 646 if (pf->opts & PF_OPT_VERBOSE) 647 switch ($3) { 648 case 0: 649 printf("set state-policy floating\n"); 650 break; 651 case PFRULE_IFBOUND: 652 printf("set state-policy if-bound\n"); 653 break; 654 } 655 default_statelock = $3; 656 } 657 | SET DEBUG STRING { 658 if (pfctl_set_debug(pf, $3) != 0) { 659 yyerror("error setting debuglevel %s", $3); 660 free($3); 661 YYERROR; 662 } 663 free($3); 664 } 665 | SET DEBUG DEBUG { 666 if (pfctl_set_debug(pf, "debug") != 0) { 667 yyerror("error setting debuglevel %s", "debug"); 668 YYERROR; 669 } 670 } 671 | SET SKIP interface { 672 if (expand_skip_interface($3) != 0) { 673 yyerror("error setting skip interface(s)"); 674 YYERROR; 675 } 676 } 677 | SET STATEDEFAULTS state_opt_list { 678 if (keep_state_defaults != NULL) { 679 yyerror("cannot redefine state-defaults"); 680 YYERROR; 681 } 682 keep_state_defaults = $3; 683 } 684 ; 685 686stringall : STRING { $$ = $1; } 687 | ALL { 688 if (($$ = strdup("all")) == NULL) { 689 err(1, "stringall: strdup"); 690 } 691 } 692 ; 693 694string : STRING string { 695 if (asprintf(&$$, "%s %s", $1, $2) == -1) 696 err(1, "string: asprintf"); 697 free($1); 698 free($2); 699 } 700 | STRING 701 ; 702 703varstring : numberstring varstring { 704 if (asprintf(&$$, "%s %s", $1, $2) == -1) 705 err(1, "string: asprintf"); 706 free($1); 707 free($2); 708 } 709 | numberstring 710 ; 711 712numberstring : NUMBER { 713 char *s; 714 if (asprintf(&s, "%lld", $1) == -1) { 715 yyerror("string: asprintf"); 716 YYERROR; 717 } 718 $$ = s; 719 } 720 | STRING 721 ; 722 723varset : STRING '=' varstring { 724 char *s = $1; 725 if (pf->opts & PF_OPT_VERBOSE) 726 printf("%s = \"%s\"\n", $1, $3); 727 while (*s++) { 728 if (isspace((unsigned char)*s)) { 729 yyerror("macro name cannot contain " 730 "whitespace"); 731 YYERROR; 732 } 733 } 734 if (symset($1, $3, 0) == -1) 735 err(1, "cannot store variable %s", $1); 736 free($1); 737 free($3); 738 } 739 ; 740 741anchorname : STRING { $$ = $1; } 742 | /* empty */ { $$ = NULL; } 743 ; 744 745pfa_anchorlist : /* empty */ 746 | pfa_anchorlist '\n' 747 | pfa_anchorlist pfrule '\n' 748 | pfa_anchorlist anchorrule '\n' 749 | pfa_anchorlist include '\n' 750 ; 751 752pfa_anchor : '{' 753 { 754 char ta[PF_ANCHOR_NAME_SIZE]; 755 struct pf_ruleset *rs; 756 757 /* steping into a brace anchor */ 758 pf->asd++; 759 pf->bn++; 760 pf->brace = 1; 761 762 /* 763 * Anchor contents are parsed before the anchor rule 764 * production completes, so we don't know the real 765 * location yet. Create a holding ruleset in the root; 766 * contents will be moved afterwards. 767 */ 768 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 769 rs = pf_find_or_create_ruleset(ta); 770 if (rs == NULL) 771 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 772 pf->astack[pf->asd] = rs->anchor; 773 pf->anchor = rs->anchor; 774 } '\n' pfa_anchorlist '}' 775 { 776 pf->alast = pf->anchor; 777 pf->asd--; 778 pf->anchor = pf->astack[pf->asd]; 779 } 780 | /* empty */ 781 ; 782 783anchorrule : ANCHOR anchorname dir quick interface af proto fromto 784 filter_opts pfa_anchor 785 { 786 struct pf_rule r; 787 struct node_proto *proto; 788 789 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 790 free($2); 791 yyerror("anchor names beginning with '_' " 792 "are reserved for internal use"); 793 YYERROR; 794 } 795 796 memset(&r, 0, sizeof(r)); 797 if (pf->astack[pf->asd + 1]) { 798 if ($2 && strchr($2, '/') != NULL) { 799 free($2); 800 yyerror("anchor paths containing '/' " 801 "cannot be used for inline anchors."); 802 YYERROR; 803 } 804 805 /* Move inline rules into relative location. */ 806 pf_anchor_setup(&r, 807 &pf->astack[pf->asd]->ruleset, 808 $2 ? $2 : pf->alast->name); 809 810 if (r.anchor == NULL) 811 err(1, "anchorrule: unable to " 812 "create ruleset"); 813 814 if (pf->alast != r.anchor) { 815 if (r.anchor->match) { 816 yyerror("inline anchor '%s' " 817 "already exists", 818 r.anchor->name); 819 YYERROR; 820 } 821 mv_rules(&pf->alast->ruleset, 822 &r.anchor->ruleset); 823 } 824 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 825 pf->alast = r.anchor; 826 } else { 827 if (!$2) { 828 yyerror("anchors without explicit " 829 "rules must specify a name"); 830 YYERROR; 831 } 832 } 833 r.direction = $3; 834 r.quick = $4.quick; 835 r.af = $6; 836 r.prob = $9.prob; 837 r.rtableid = $9.rtableid; 838 839 if ($9.tag) 840 if (strlcpy(r.tagname, $9.tag, 841 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 842 yyerror("tag too long, max %u chars", 843 PF_TAG_NAME_SIZE - 1); 844 YYERROR; 845 } 846 if ($9.match_tag) 847 if (strlcpy(r.match_tagname, $9.match_tag, 848 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 849 yyerror("tag too long, max %u chars", 850 PF_TAG_NAME_SIZE - 1); 851 YYERROR; 852 } 853 r.match_tag_not = $9.match_tag_not; 854 if (rule_label(&r, $9.label)) 855 YYERROR; 856 free($9.label); 857 r.flags = $9.flags.b1; 858 r.flagset = $9.flags.b2; 859 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 860 yyerror("flags always false"); 861 YYERROR; 862 } 863 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 864 for (proto = $7; proto != NULL && 865 proto->proto != IPPROTO_TCP; 866 proto = proto->next) 867 ; /* nothing */ 868 if (proto == NULL && $7 != NULL) { 869 if ($9.flags.b1 || $9.flags.b2) 870 yyerror( 871 "flags only apply to tcp"); 872 if ($8.src_os) 873 yyerror( 874 "OS fingerprinting only " 875 "applies to tcp"); 876 YYERROR; 877 } 878 } 879 880 r.tos = $9.tos; 881 882 if ($9.keep.action) { 883 yyerror("cannot specify state handling " 884 "on anchors"); 885 YYERROR; 886 } 887 888 if ($9.route.rt) { 889 yyerror("cannot specify route handling " 890 "on anchors"); 891 YYERROR; 892 } 893 894 if ($9.marker & FOM_ONCE) { 895 yyerror("cannot specify 'once' " 896 "on anchors"); 897 YYERROR; 898 } 899 900 if ($9.match_tag) 901 if (strlcpy(r.match_tagname, $9.match_tag, 902 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 903 yyerror("tag too long, max %u chars", 904 PF_TAG_NAME_SIZE - 1); 905 YYERROR; 906 } 907 r.match_tag_not = $9.match_tag_not; 908 if ($9.marker & FOM_PRIO) { 909 if ($9.prio == 0) 910 r.prio = PF_PRIO_ZERO; 911 else 912 r.prio = $9.prio; 913 } 914 if ($9.marker & FOM_SETPRIO) { 915 r.set_prio[0] = $9.set_prio[0]; 916 r.set_prio[1] = $9.set_prio[1]; 917 r.scrub_flags |= PFSTATE_SETPRIO; 918 } 919 920 decide_address_family($8.src.host, &r.af); 921 decide_address_family($8.dst.host, &r.af); 922 923 expand_rule(&r, 0, $5, NULL, NULL, NULL, $7, $8.src_os, 924 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 925 $9.uid, $9.gid, $9.rcv, $9.icmpspec, 926 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 927 free($2); 928 pf->astack[pf->asd + 1] = NULL; 929 } 930 ; 931 932loadrule : LOAD ANCHOR string FROM string { 933 struct loadanchors *loadanchor; 934 935 if (strlen(pf->anchor->name) + 1 + 936 strlen($3) >= PATH_MAX) { 937 yyerror("anchorname %s too long, max %u\n", 938 $3, PATH_MAX - 1); 939 free($3); 940 YYERROR; 941 } 942 loadanchor = calloc(1, sizeof(struct loadanchors)); 943 if (loadanchor == NULL) 944 err(1, "loadrule: calloc"); 945 if ((loadanchor->anchorname = malloc(PATH_MAX)) == 946 NULL) 947 err(1, "loadrule: malloc"); 948 if (pf->anchor->name[0]) 949 snprintf(loadanchor->anchorname, PATH_MAX, 950 "%s/%s", pf->anchor->name, $3); 951 else 952 strlcpy(loadanchor->anchorname, $3, PATH_MAX); 953 if ((loadanchor->filename = strdup($5)) == NULL) 954 err(1, "loadrule: strdup"); 955 956 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 957 entries); 958 959 free($3); 960 free($5); 961 }; 962 963scrub_opts : { 964 bzero(&scrub_opts, sizeof scrub_opts); 965 } 966 scrub_opts_l 967 { $$ = scrub_opts; } 968 ; 969 970scrub_opts_l : scrub_opts_l comma scrub_opt 971 | scrub_opt 972 ; 973 974scrub_opt : NODF { 975 if (scrub_opts.nodf) { 976 yyerror("no-df cannot be respecified"); 977 YYERROR; 978 } 979 scrub_opts.nodf = 1; 980 } 981 | MINTTL NUMBER { 982 if (scrub_opts.marker & FOM_MINTTL) { 983 yyerror("min-ttl cannot be respecified"); 984 YYERROR; 985 } 986 if ($2 < 0 || $2 > 255) { 987 yyerror("illegal min-ttl value %d", $2); 988 YYERROR; 989 } 990 scrub_opts.marker |= FOM_MINTTL; 991 scrub_opts.minttl = $2; 992 } 993 | MAXMSS NUMBER { 994 if (scrub_opts.marker & FOM_MAXMSS) { 995 yyerror("max-mss cannot be respecified"); 996 YYERROR; 997 } 998 if ($2 < 0 || $2 > 65535) { 999 yyerror("illegal max-mss value %d", $2); 1000 YYERROR; 1001 } 1002 scrub_opts.marker |= FOM_MAXMSS; 1003 scrub_opts.maxmss = $2; 1004 } 1005 | REASSEMBLE STRING { 1006 if (strcasecmp($2, "tcp") != 0) { 1007 yyerror("scrub reassemble supports only tcp, " 1008 "not '%s'", $2); 1009 free($2); 1010 YYERROR; 1011 } 1012 free($2); 1013 if (scrub_opts.reassemble_tcp) { 1014 yyerror("reassemble tcp cannot be respecified"); 1015 YYERROR; 1016 } 1017 scrub_opts.reassemble_tcp = 1; 1018 } 1019 | RANDOMID { 1020 if (scrub_opts.randomid) { 1021 yyerror("random-id cannot be respecified"); 1022 YYERROR; 1023 } 1024 scrub_opts.randomid = 1; 1025 } 1026 ; 1027 1028antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1029 struct pf_rule r; 1030 struct node_host *h = NULL, *hh; 1031 struct node_if *i, *j; 1032 1033 for (i = $3; i; i = i->next) { 1034 bzero(&r, sizeof(r)); 1035 1036 r.action = PF_DROP; 1037 r.direction = PF_IN; 1038 r.log = $2.log; 1039 r.logif = $2.logif; 1040 r.quick = $2.quick; 1041 r.af = $4; 1042 if (rule_label(&r, $5.label)) 1043 YYERROR; 1044 r.rtableid = $5.rtableid; 1045 j = calloc(1, sizeof(struct node_if)); 1046 if (j == NULL) 1047 err(1, "antispoof: calloc"); 1048 if (strlcpy(j->ifname, i->ifname, 1049 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1050 free(j); 1051 yyerror("interface name too long"); 1052 YYERROR; 1053 } 1054 j->not = 1; 1055 if (i->dynamic) { 1056 h = calloc(1, sizeof(*h)); 1057 if (h == NULL) 1058 err(1, "address: calloc"); 1059 h->addr.type = PF_ADDR_DYNIFTL; 1060 set_ipmask(h, 128); 1061 if (strlcpy(h->addr.v.ifname, i->ifname, 1062 sizeof(h->addr.v.ifname)) >= 1063 sizeof(h->addr.v.ifname)) { 1064 free(h); 1065 yyerror( 1066 "interface name too long"); 1067 YYERROR; 1068 } 1069 hh = malloc(sizeof(*hh)); 1070 if (hh == NULL) 1071 err(1, "address: malloc"); 1072 bcopy(h, hh, sizeof(*hh)); 1073 h->addr.iflags = PFI_AFLAG_NETWORK; 1074 } else { 1075 h = ifa_lookup(j->ifname, 1076 PFI_AFLAG_NETWORK); 1077 hh = NULL; 1078 } 1079 1080 if (h != NULL) 1081 expand_rule(&r, 0, j, NULL, NULL, NULL, 1082 NULL, NULL, h, NULL, NULL, NULL, 1083 NULL, NULL, NULL, NULL, ""); 1084 1085 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1086 bzero(&r, sizeof(r)); 1087 1088 r.action = PF_DROP; 1089 r.direction = PF_IN; 1090 r.log = $2.log; 1091 r.logif = $2.logif; 1092 r.quick = $2.quick; 1093 r.af = $4; 1094 if (rule_label(&r, $5.label)) 1095 YYERROR; 1096 r.rtableid = $5.rtableid; 1097 if (hh != NULL) 1098 h = hh; 1099 else 1100 h = ifa_lookup(i->ifname, 0); 1101 if (h != NULL) 1102 expand_rule(&r, 0, NULL, NULL, 1103 NULL, NULL, NULL, NULL, h, 1104 NULL, NULL, NULL, NULL, 1105 NULL, NULL, NULL, ""); 1106 } else 1107 free(hh); 1108 } 1109 free($5.label); 1110 } 1111 ; 1112 1113antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1114 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1115 ; 1116 1117antispoof_iflst : antispoof_if optnl { $$ = $1; } 1118 | antispoof_iflst comma antispoof_if optnl { 1119 $1->tail->next = $3; 1120 $1->tail = $3; 1121 $$ = $1; 1122 } 1123 ; 1124 1125antispoof_if : if_item { $$ = $1; } 1126 | '(' if_item ')' { 1127 $2->dynamic = 1; 1128 $$ = $2; 1129 } 1130 ; 1131 1132antispoof_opts : { 1133 bzero(&antispoof_opts, sizeof antispoof_opts); 1134 antispoof_opts.rtableid = -1; 1135 } 1136 antispoof_opts_l 1137 { $$ = antispoof_opts; } 1138 | /* empty */ { 1139 bzero(&antispoof_opts, sizeof antispoof_opts); 1140 antispoof_opts.rtableid = -1; 1141 $$ = antispoof_opts; 1142 } 1143 ; 1144 1145antispoof_opts_l : antispoof_opts_l antispoof_opt 1146 | antispoof_opt 1147 ; 1148 1149antispoof_opt : LABEL label { 1150 if (antispoof_opts.label) { 1151 yyerror("label cannot be redefined"); 1152 YYERROR; 1153 } 1154 antispoof_opts.label = $2; 1155 } 1156 | RTABLE NUMBER { 1157 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 1158 yyerror("invalid rtable id"); 1159 YYERROR; 1160 } 1161 antispoof_opts.rtableid = $2; 1162 } 1163 ; 1164 1165not : '!' { $$ = 1; } 1166 | /* empty */ { $$ = 0; } 1167 ; 1168 1169tabledef : TABLE '<' STRING '>' table_opts { 1170 struct node_host *h, *nh; 1171 struct node_tinit *ti, *nti; 1172 1173 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1174 yyerror("table name too long, max %d chars", 1175 PF_TABLE_NAME_SIZE - 1); 1176 free($3); 1177 YYERROR; 1178 } 1179 if (process_tabledef($3, &$5)) { 1180 free($3); 1181 YYERROR; 1182 } 1183 free($3); 1184 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); ti != NULL; 1185 ti = nti) { 1186 if (ti->file) 1187 free(ti->file); 1188 for (h = ti->host; h != NULL; h = nh) { 1189 nh = h->next; 1190 free(h); 1191 } 1192 nti = SIMPLEQ_NEXT(ti, entries); 1193 free(ti); 1194 } 1195 } 1196 ; 1197 1198table_opts : { 1199 bzero(&table_opts, sizeof table_opts); 1200 SIMPLEQ_INIT(&table_opts.init_nodes); 1201 } 1202 table_opts_l 1203 { $$ = table_opts; } 1204 | /* empty */ 1205 { 1206 bzero(&table_opts, sizeof table_opts); 1207 SIMPLEQ_INIT(&table_opts.init_nodes); 1208 $$ = table_opts; 1209 } 1210 ; 1211 1212table_opts_l : table_opts_l table_opt 1213 | table_opt 1214 ; 1215 1216table_opt : STRING { 1217 if (!strcmp($1, "const")) 1218 table_opts.flags |= PFR_TFLAG_CONST; 1219 else if (!strcmp($1, "persist")) 1220 table_opts.flags |= PFR_TFLAG_PERSIST; 1221 else if (!strcmp($1, "counters")) 1222 table_opts.flags |= PFR_TFLAG_COUNTERS; 1223 else { 1224 yyerror("invalid table option '%s'", $1); 1225 free($1); 1226 YYERROR; 1227 } 1228 free($1); 1229 } 1230 | '{' optnl '}' { table_opts.init_addr = 1; } 1231 | '{' optnl table_host_list '}' { 1232 struct node_host *n; 1233 struct node_tinit *ti; 1234 1235 for (n = $3; n != NULL; n = n->next) { 1236 switch (n->addr.type) { 1237 case PF_ADDR_ADDRMASK: 1238 continue; /* ok */ 1239 case PF_ADDR_RANGE: 1240 yyerror("address ranges are not " 1241 "permitted inside tables"); 1242 break; 1243 case PF_ADDR_DYNIFTL: 1244 yyerror("dynamic addresses are not " 1245 "permitted inside tables"); 1246 break; 1247 case PF_ADDR_TABLE: 1248 yyerror("tables cannot contain tables"); 1249 break; 1250 case PF_ADDR_NOROUTE: 1251 yyerror("\"no-route\" is not permitted " 1252 "inside tables"); 1253 break; 1254 case PF_ADDR_URPFFAILED: 1255 yyerror("\"urpf-failed\" is not " 1256 "permitted inside tables"); 1257 break; 1258 default: 1259 yyerror("unknown address type %d", 1260 n->addr.type); 1261 } 1262 YYERROR; 1263 } 1264 if (!(ti = calloc(1, sizeof(*ti)))) 1265 err(1, "table_opt: calloc"); 1266 ti->host = $3; 1267 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1268 entries); 1269 table_opts.init_addr = 1; 1270 } 1271 | FILENAME STRING { 1272 struct node_tinit *ti; 1273 1274 if (!(ti = calloc(1, sizeof(*ti)))) 1275 err(1, "table_opt: calloc"); 1276 ti->file = $2; 1277 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1278 entries); 1279 table_opts.init_addr = 1; 1280 } 1281 ; 1282 1283tablespec : xhost optweight { 1284 if ($2 > 0) { 1285 struct node_host *n; 1286 for (n = $1; n != NULL; n = n->next) 1287 n->weight = $2; 1288 } 1289 $$ = $1; 1290 } 1291 | '{' optnl table_host_list '}' { $$ = $3; } 1292 ; 1293 1294table_host_list : tablespec optnl { $$ = $1; } 1295 | table_host_list comma tablespec optnl { 1296 $1->tail->next = $3; 1297 $1->tail = $3->tail; 1298 $$ = $1; 1299 } 1300 ; 1301 1302queuespec : QUEUE STRING interface queue_opts { 1303 if ($3 == NULL && $4.parent == NULL) { 1304 yyerror("root queue without interface"); 1305 YYERROR; 1306 } 1307 if ($2[0] == '_') { 1308 yyerror("queue names must not start with _"); 1309 YYERROR; 1310 } 1311 expand_queue($2, $3, &$4); 1312 } 1313 ; 1314 1315queue_opts : { 1316 bzero(&queue_opts, sizeof queue_opts); 1317 } 1318 queue_opts_l 1319 { $$ = queue_opts; } 1320 ; 1321 1322queue_opts_l : queue_opts_l queue_opt 1323 | queue_opt 1324 ; 1325 1326queue_opt : BANDWIDTH scspec optscs { 1327 if (queue_opts.marker & QOM_BWSPEC) { 1328 yyerror("bandwidth cannot be respecified"); 1329 YYERROR; 1330 } 1331 if (queue_opts.marker & QOM_FLOWS) { 1332 yyerror("bandwidth cannot be specified for " 1333 "a flow queue"); 1334 YYERROR; 1335 } 1336 queue_opts.marker |= QOM_BWSPEC; 1337 queue_opts.linkshare = $2; 1338 queue_opts.realtime= $3.realtime; 1339 queue_opts.upperlimit = $3.upperlimit; 1340 } 1341 | PARENT STRING { 1342 if (queue_opts.marker & QOM_PARENT) { 1343 yyerror("parent cannot be respecified"); 1344 YYERROR; 1345 } 1346 queue_opts.marker |= QOM_PARENT; 1347 queue_opts.parent = $2; 1348 } 1349 | DEFAULT { 1350 if (queue_opts.marker & QOM_DEFAULT) { 1351 yyerror("default cannot be respecified"); 1352 YYERROR; 1353 } 1354 queue_opts.marker |= QOM_DEFAULT; 1355 queue_opts.flags |= PFQS_DEFAULT; 1356 } 1357 | QLIMIT NUMBER { 1358 if (queue_opts.marker & QOM_QLIMIT) { 1359 yyerror("qlimit cannot be respecified"); 1360 YYERROR; 1361 } 1362 if ($2 < 0 || $2 > 65535) { 1363 yyerror("qlimit out of range: max 65535"); 1364 YYERROR; 1365 } 1366 queue_opts.marker |= QOM_QLIMIT; 1367 queue_opts.qlimit = $2; 1368 } 1369 | FLOWS NUMBER { 1370 if (queue_opts.marker & QOM_FLOWS) { 1371 yyerror("number of flows cannot be respecified"); 1372 YYERROR; 1373 } 1374 if (queue_opts.marker & QOM_BWSPEC) { 1375 yyerror("bandwidth cannot be specified for " 1376 "a flow queue"); 1377 YYERROR; 1378 } 1379 if ($2 < 1 || $2 > 32767) { 1380 yyerror("number of flows out of range: " 1381 "max 32767"); 1382 YYERROR; 1383 } 1384 queue_opts.marker |= QOM_FLOWS; 1385 queue_opts.flags |= PFQS_FLOWQUEUE; 1386 queue_opts.flowqueue.flows = $2; 1387 } 1388 | QUANTUM NUMBER { 1389 if (queue_opts.marker & QOM_QUANTUM) { 1390 yyerror("quantum cannot be respecified"); 1391 YYERROR; 1392 } 1393 if ($2 < 1 || $2 > 65535) { 1394 yyerror("quantum out of range: max 65535"); 1395 YYERROR; 1396 } 1397 queue_opts.marker |= QOM_QUANTUM; 1398 queue_opts.flowqueue.quantum = $2; 1399 } 1400 ; 1401 1402optscs : /* nada */ { 1403 1404 } 1405 | comma MINIMUM scspec { 1406 $$.realtime = $3; 1407 } 1408 | comma MAXIMUM scspec { 1409 $$.upperlimit = $3; 1410 } 1411 | comma MINIMUM scspec comma MAXIMUM scspec { 1412 $$.realtime = $3; 1413 $$.upperlimit = $6; 1414 } 1415 | comma MAXIMUM scspec comma MINIMUM scspec { 1416 $$.realtime = $6; 1417 $$.upperlimit = $3; 1418 } 1419 ; 1420 1421scspec : bandwidth { 1422 $$.m2 = $1; 1423 $$.d = 0; 1424 if ($$.m2.bw_percent) { 1425 yyerror("no bandwidth in %% yet"); 1426 YYERROR; 1427 } 1428 } 1429 | bandwidth BURST bandwidth FOR STRING { 1430 u_long ul; 1431 char *cp; 1432 1433 ul = strtoul($5, &cp, 10); 1434 if (cp == NULL || strcmp(cp, "ms")) { 1435 yyerror("time in scspec must be in ms"); 1436 YYERROR; 1437 } 1438 1439 $$.m1 = $3; 1440 $$.d = ul; 1441 $$.m2 = $1; 1442 1443 if ($$.m1.bw_percent || $$.m2.bw_percent) { 1444 yyerror("no bandwidth in %% yet"); 1445 YYERROR; 1446 } 1447 } 1448 ; 1449 1450bandwidth : STRING { 1451 double bps; 1452 char *cp; 1453 1454 $$.bw_percent = 0; 1455 1456 bps = strtod($1, &cp); 1457 if (cp != NULL) { 1458 if (strlen(cp) > 1) { 1459 char *cu = cp + 1; 1460 if (!strcmp(cu, "Bit") || 1461 !strcmp(cu, "B") || 1462 !strcmp(cu, "bit") || 1463 !strcmp(cu, "b")) { 1464 *cu = 0; 1465 } 1466 } 1467 if (!strcmp(cp, "b")) 1468 ; /* nothing */ 1469 else if (!strcmp(cp, "K")) 1470 bps *= 1000; 1471 else if (!strcmp(cp, "M")) 1472 bps *= 1000 * 1000; 1473 else if (!strcmp(cp, "G")) 1474 bps *= 1000 * 1000 * 1000; 1475 else if (!strcmp(cp, "%")) { 1476 if (bps < 0 || bps > 100) { 1477 yyerror("bandwidth spec " 1478 "out of range"); 1479 free($1); 1480 YYERROR; 1481 } 1482 $$.bw_percent = bps; 1483 bps = 0; 1484 } else { 1485 yyerror("unknown unit \"%s\"", cp); 1486 free($1); 1487 YYERROR; 1488 } 1489 } 1490 free($1); 1491 $$.bw_absolute = (u_int32_t)bps; 1492 } 1493 | NUMBER { 1494 if ($1 < 0 || $1 > UINT_MAX) { 1495 yyerror("bandwidth number too big"); 1496 YYERROR; 1497 } 1498 $$.bw_percent = 0; 1499 $$.bw_absolute = $1; 1500 } 1501 ; 1502 1503pfrule : action dir logquick interface af proto fromto 1504 filter_opts 1505 { 1506 struct pf_rule r; 1507 struct node_state_opt *o; 1508 struct node_proto *proto; 1509 int srctrack = 0; 1510 int statelock = 0; 1511 int adaptive = 0; 1512 int defaults = 0; 1513 1514 memset(&r, 0, sizeof(r)); 1515 r.action = $1.b1; 1516 switch ($1.b2) { 1517 case PFRULE_RETURNRST: 1518 r.rule_flag |= PFRULE_RETURNRST; 1519 r.return_ttl = $1.w; 1520 break; 1521 case PFRULE_RETURNICMP: 1522 r.rule_flag |= PFRULE_RETURNICMP; 1523 r.return_icmp = $1.w; 1524 r.return_icmp6 = $1.w2; 1525 break; 1526 case PFRULE_RETURN: 1527 r.rule_flag |= PFRULE_RETURN; 1528 r.return_icmp = $1.w; 1529 r.return_icmp6 = $1.w2; 1530 break; 1531 } 1532 r.direction = $2; 1533 r.log = $3.log; 1534 r.logif = $3.logif; 1535 r.quick = $3.quick; 1536 r.prob = $8.prob; 1537 r.rtableid = $8.rtableid; 1538 1539 if ($8.nodf) 1540 r.scrub_flags |= PFSTATE_NODF; 1541 if ($8.randomid) 1542 r.scrub_flags |= PFSTATE_RANDOMID; 1543 if ($8.minttl) 1544 r.min_ttl = $8.minttl; 1545 if ($8.max_mss) 1546 r.max_mss = $8.max_mss; 1547 if ($8.marker & FOM_SETTOS) { 1548 r.scrub_flags |= PFSTATE_SETTOS; 1549 r.set_tos = $8.settos; 1550 } 1551 if ($8.marker & FOM_SCRUB_TCP) 1552 r.scrub_flags |= PFSTATE_SCRUB_TCP; 1553 if ($8.marker & FOM_PRIO) { 1554 if ($8.prio == 0) 1555 r.prio = PF_PRIO_ZERO; 1556 else 1557 r.prio = $8.prio; 1558 } 1559 if ($8.marker & FOM_SETPRIO) { 1560 r.set_prio[0] = $8.set_prio[0]; 1561 r.set_prio[1] = $8.set_prio[1]; 1562 r.scrub_flags |= PFSTATE_SETPRIO; 1563 } 1564 if ($8.marker & FOM_ONCE) { 1565 if (r.action == PF_MATCH) { 1566 yyerror("can't specify once for " 1567 "match rules"); 1568 YYERROR; 1569 } 1570 r.rule_flag |= PFRULE_ONCE; 1571 } 1572 if ($8.marker & FOM_AFTO) 1573 r.rule_flag |= PFRULE_AFTO; 1574 if (($8.marker & FOM_AFTO) && r.direction != PF_IN) { 1575 yyerror("af-to can only be used with direction in"); 1576 YYERROR; 1577 } 1578 if (($8.marker & FOM_AFTO) && $8.route.rt) { 1579 yyerror("af-to cannot be used together with " 1580 "route-to, reply-to, dup-to"); 1581 YYERROR; 1582 } 1583 r.af = $5; 1584 1585 if ($8.tag) 1586 if (strlcpy(r.tagname, $8.tag, 1587 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1588 yyerror("tag too long, max %u chars", 1589 PF_TAG_NAME_SIZE - 1); 1590 YYERROR; 1591 } 1592 if ($8.match_tag) 1593 if (strlcpy(r.match_tagname, $8.match_tag, 1594 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1595 yyerror("tag too long, max %u chars", 1596 PF_TAG_NAME_SIZE - 1); 1597 YYERROR; 1598 } 1599 r.match_tag_not = $8.match_tag_not; 1600 if (rule_label(&r, $8.label)) 1601 YYERROR; 1602 free($8.label); 1603 r.flags = $8.flags.b1; 1604 r.flagset = $8.flags.b2; 1605 if (($8.flags.b1 & $8.flags.b2) != $8.flags.b1) { 1606 yyerror("flags always false"); 1607 YYERROR; 1608 } 1609 if ($8.flags.b1 || $8.flags.b2 || $7.src_os) { 1610 for (proto = $6; proto != NULL && 1611 proto->proto != IPPROTO_TCP; 1612 proto = proto->next) 1613 ; /* nothing */ 1614 if (proto == NULL && $6 != NULL) { 1615 if ($8.flags.b1 || $8.flags.b2) 1616 yyerror( 1617 "flags only apply to tcp"); 1618 if ($7.src_os) 1619 yyerror( 1620 "OS fingerprinting only " 1621 "apply to tcp"); 1622 YYERROR; 1623 } 1624#if 0 1625 if (($8.flags.b1 & parse_flags("S")) == 0 && 1626 $7.src_os) { 1627 yyerror("OS fingerprinting requires " 1628 "the SYN TCP flag (flags S/SA)"); 1629 YYERROR; 1630 } 1631#endif 1632 } 1633 1634 r.tos = $8.tos; 1635 r.keep_state = $8.keep.action; 1636 o = $8.keep.options; 1637 1638 /* 'keep state' by default on pass rules. */ 1639 if (!r.keep_state && !r.action && 1640 !($8.marker & FOM_KEEP)) { 1641 r.keep_state = PF_STATE_NORMAL; 1642 o = keep_state_defaults; 1643 defaults = 1; 1644 } 1645 1646 while (o) { 1647 struct node_state_opt *p = o; 1648 1649 switch (o->type) { 1650 case PF_STATE_OPT_MAX: 1651 if (r.max_states) { 1652 yyerror("state option 'max' " 1653 "multiple definitions"); 1654 YYERROR; 1655 } 1656 r.max_states = o->data.max_states; 1657 break; 1658 case PF_STATE_OPT_NOSYNC: 1659 if (r.rule_flag & PFRULE_NOSYNC) { 1660 yyerror("state option 'sync' " 1661 "multiple definitions"); 1662 YYERROR; 1663 } 1664 r.rule_flag |= PFRULE_NOSYNC; 1665 break; 1666 case PF_STATE_OPT_SRCTRACK: 1667 if (srctrack) { 1668 yyerror("state option " 1669 "'source-track' " 1670 "multiple definitions"); 1671 YYERROR; 1672 } 1673 srctrack = o->data.src_track; 1674 r.rule_flag |= PFRULE_SRCTRACK; 1675 break; 1676 case PF_STATE_OPT_MAX_SRC_STATES: 1677 if (r.max_src_states) { 1678 yyerror("state option " 1679 "'max-src-states' " 1680 "multiple definitions"); 1681 YYERROR; 1682 } 1683 if (o->data.max_src_states == 0) { 1684 yyerror("'max-src-states' must " 1685 "be > 0"); 1686 YYERROR; 1687 } 1688 r.max_src_states = 1689 o->data.max_src_states; 1690 r.rule_flag |= PFRULE_SRCTRACK; 1691 break; 1692 case PF_STATE_OPT_OVERLOAD: 1693 if (r.overload_tblname[0]) { 1694 yyerror("multiple 'overload' " 1695 "table definitions"); 1696 YYERROR; 1697 } 1698 if (strlcpy(r.overload_tblname, 1699 o->data.overload.tblname, 1700 PF_TABLE_NAME_SIZE) >= 1701 PF_TABLE_NAME_SIZE) { 1702 yyerror("state option: " 1703 "strlcpy"); 1704 YYERROR; 1705 } 1706 r.flush = o->data.overload.flush; 1707 break; 1708 case PF_STATE_OPT_MAX_SRC_CONN: 1709 if (r.max_src_conn) { 1710 yyerror("state option " 1711 "'max-src-conn' " 1712 "multiple definitions"); 1713 YYERROR; 1714 } 1715 if (o->data.max_src_conn == 0) { 1716 yyerror("'max-src-conn' " 1717 "must be > 0"); 1718 YYERROR; 1719 } 1720 r.max_src_conn = 1721 o->data.max_src_conn; 1722 r.rule_flag |= PFRULE_SRCTRACK | 1723 PFRULE_RULESRCTRACK; 1724 break; 1725 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1726 if (r.max_src_conn_rate.limit) { 1727 yyerror("state option " 1728 "'max-src-conn-rate' " 1729 "multiple definitions"); 1730 YYERROR; 1731 } 1732 if (!o->data.max_src_conn_rate.limit || 1733 !o->data.max_src_conn_rate.seconds) { 1734 yyerror("'max-src-conn-rate' " 1735 "values must be > 0"); 1736 YYERROR; 1737 } 1738 if (o->data.max_src_conn_rate.limit > 1739 PF_THRESHOLD_MAX) { 1740 yyerror("'max-src-conn-rate' " 1741 "maximum rate must be < %u", 1742 PF_THRESHOLD_MAX); 1743 YYERROR; 1744 } 1745 r.max_src_conn_rate.limit = 1746 o->data.max_src_conn_rate.limit; 1747 r.max_src_conn_rate.seconds = 1748 o->data.max_src_conn_rate.seconds; 1749 r.rule_flag |= PFRULE_SRCTRACK | 1750 PFRULE_RULESRCTRACK; 1751 break; 1752 case PF_STATE_OPT_MAX_SRC_NODES: 1753 if (r.max_src_nodes) { 1754 yyerror("state option " 1755 "'max-src-nodes' " 1756 "multiple definitions"); 1757 YYERROR; 1758 } 1759 if (o->data.max_src_nodes == 0) { 1760 yyerror("'max-src-nodes' must " 1761 "be > 0"); 1762 YYERROR; 1763 } 1764 r.max_src_nodes = 1765 o->data.max_src_nodes; 1766 r.rule_flag |= PFRULE_SRCTRACK | 1767 PFRULE_RULESRCTRACK; 1768 break; 1769 case PF_STATE_OPT_STATELOCK: 1770 if (statelock) { 1771 yyerror("state locking option: " 1772 "multiple definitions"); 1773 YYERROR; 1774 } 1775 statelock = 1; 1776 r.rule_flag |= o->data.statelock; 1777 break; 1778 case PF_STATE_OPT_SLOPPY: 1779 if (r.rule_flag & PFRULE_STATESLOPPY) { 1780 yyerror("state sloppy option: " 1781 "multiple definitions"); 1782 YYERROR; 1783 } 1784 r.rule_flag |= PFRULE_STATESLOPPY; 1785 break; 1786 case PF_STATE_OPT_PFLOW: 1787 if (r.rule_flag & PFRULE_PFLOW) { 1788 yyerror("state pflow " 1789 "option: multiple " 1790 "definitions"); 1791 YYERROR; 1792 } 1793 r.rule_flag |= PFRULE_PFLOW; 1794 break; 1795 case PF_STATE_OPT_TIMEOUT: 1796 if (o->data.timeout.number == 1797 PFTM_ADAPTIVE_START || 1798 o->data.timeout.number == 1799 PFTM_ADAPTIVE_END) 1800 adaptive = 1; 1801 if (r.timeout[o->data.timeout.number]) { 1802 yyerror("state timeout %s " 1803 "multiple definitions", 1804 pf_timeouts[o->data. 1805 timeout.number].name); 1806 YYERROR; 1807 } 1808 r.timeout[o->data.timeout.number] = 1809 o->data.timeout.seconds; 1810 } 1811 o = o->next; 1812 if (!defaults) 1813 free(p); 1814 } 1815 1816 /* 'flags S/SA' by default on stateful rules */ 1817 if (!r.action && !r.flags && !r.flagset && 1818 !$8.fragment && !($8.marker & FOM_FLAGS) && 1819 r.keep_state) { 1820 r.flags = parse_flags("S"); 1821 r.flagset = parse_flags("SA"); 1822 } 1823 if (!adaptive && r.max_states) { 1824 r.timeout[PFTM_ADAPTIVE_START] = 1825 (r.max_states / 10) * 6; 1826 r.timeout[PFTM_ADAPTIVE_END] = 1827 (r.max_states / 10) * 12; 1828 } 1829 if (r.rule_flag & PFRULE_SRCTRACK) { 1830 if (srctrack == PF_SRCTRACK_GLOBAL && 1831 r.max_src_nodes) { 1832 yyerror("'max-src-nodes' is " 1833 "incompatible with " 1834 "'source-track global'"); 1835 YYERROR; 1836 } 1837 if (srctrack == PF_SRCTRACK_GLOBAL && 1838 r.max_src_conn) { 1839 yyerror("'max-src-conn' is " 1840 "incompatible with " 1841 "'source-track global'"); 1842 YYERROR; 1843 } 1844 if (srctrack == PF_SRCTRACK_GLOBAL && 1845 r.max_src_conn_rate.seconds) { 1846 yyerror("'max-src-conn-rate' is " 1847 "incompatible with " 1848 "'source-track global'"); 1849 YYERROR; 1850 } 1851 if (r.timeout[PFTM_SRC_NODE] < 1852 r.max_src_conn_rate.seconds) 1853 r.timeout[PFTM_SRC_NODE] = 1854 r.max_src_conn_rate.seconds; 1855 r.rule_flag |= PFRULE_SRCTRACK; 1856 if (srctrack == PF_SRCTRACK_RULE) 1857 r.rule_flag |= PFRULE_RULESRCTRACK; 1858 } 1859 if (r.keep_state && !statelock) 1860 r.rule_flag |= default_statelock; 1861 1862 if ($8.fragment) 1863 r.rule_flag |= PFRULE_FRAGMENT; 1864 r.allow_opts = $8.allowopts; 1865 1866 decide_address_family($7.src.host, &r.af); 1867 decide_address_family($7.dst.host, &r.af); 1868 1869 if ($8.route.rt) { 1870 if (!r.direction) { 1871 yyerror("direction must be explicit " 1872 "with rules that specify routing"); 1873 YYERROR; 1874 } 1875 r.rt = $8.route.rt; 1876 r.route.opts = $8.route.pool_opts; 1877 if ($8.route.key != NULL) 1878 memcpy(&r.route.key, $8.route.key, 1879 sizeof(struct pf_poolhashkey)); 1880 } 1881 if (r.rt) { 1882 decide_address_family($8.route.host, &r.af); 1883 if ((r.route.opts & PF_POOL_TYPEMASK) == 1884 PF_POOL_NONE && ($8.route.host->next != NULL || 1885 $8.route.host->addr.type == PF_ADDR_TABLE || 1886 DYNIF_MULTIADDR($8.route.host->addr))) 1887 r.route.opts |= PF_POOL_ROUNDROBIN; 1888 if ($8.route.host->next != NULL) { 1889 if (!PF_POOL_DYNTYPE(r.route.opts)) { 1890 yyerror("address pool option " 1891 "not supported by type"); 1892 YYERROR; 1893 } 1894 } 1895 /* fake redirspec */ 1896 if (($8.rroute.rdr = calloc(1, 1897 sizeof(*$8.rroute.rdr))) == NULL) 1898 err(1, "$8.rroute.rdr"); 1899 $8.rroute.rdr->host = $8.route.host; 1900 } 1901 if ($8.queues.qname != NULL) { 1902 if (strlcpy(r.qname, $8.queues.qname, 1903 sizeof(r.qname)) >= sizeof(r.qname)) { 1904 yyerror("rule qname too long (max " 1905 "%d chars)", sizeof(r.qname)-1); 1906 YYERROR; 1907 } 1908 free($8.queues.qname); 1909 } 1910 if ($8.queues.pqname != NULL) { 1911 if (strlcpy(r.pqname, $8.queues.pqname, 1912 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1913 yyerror("rule pqname too long (max " 1914 "%d chars)", sizeof(r.pqname)-1); 1915 YYERROR; 1916 } 1917 free($8.queues.pqname); 1918 } 1919 if (expand_divertspec(&r, &$8.divert)) 1920 YYERROR; 1921 r.divert_packet.port = $8.divert_packet.port; 1922 1923 expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, &$8.rroute, $6, 1924 $7.src_os, 1925 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 1926 $8.uid, $8.gid, $8.rcv, $8.icmpspec, ""); 1927 } 1928 ; 1929 1930filter_opts : { 1931 bzero(&filter_opts, sizeof filter_opts); 1932 filter_opts.rtableid = -1; 1933 } 1934 filter_opts_l 1935 { $$ = filter_opts; } 1936 | /* empty */ { 1937 bzero(&filter_opts, sizeof filter_opts); 1938 filter_opts.rtableid = -1; 1939 $$ = filter_opts; 1940 } 1941 ; 1942 1943filter_opts_l : filter_opts_l filter_opt 1944 | filter_opt 1945 ; 1946 1947filter_opt : USER uids { 1948 if (filter_opts.uid) 1949 $2->tail->next = filter_opts.uid; 1950 filter_opts.uid = $2; 1951 } 1952 | GROUP gids { 1953 if (filter_opts.gid) 1954 $2->tail->next = filter_opts.gid; 1955 filter_opts.gid = $2; 1956 } 1957 | flags { 1958 if (filter_opts.marker & FOM_FLAGS) { 1959 yyerror("flags cannot be redefined"); 1960 YYERROR; 1961 } 1962 filter_opts.marker |= FOM_FLAGS; 1963 filter_opts.flags.b1 |= $1.b1; 1964 filter_opts.flags.b2 |= $1.b2; 1965 filter_opts.flags.w |= $1.w; 1966 filter_opts.flags.w2 |= $1.w2; 1967 } 1968 | icmpspec { 1969 if (filter_opts.marker & FOM_ICMP) { 1970 yyerror("icmp-type cannot be redefined"); 1971 YYERROR; 1972 } 1973 filter_opts.marker |= FOM_ICMP; 1974 filter_opts.icmpspec = $1; 1975 } 1976 | PRIO NUMBER { 1977 if (filter_opts.marker & FOM_PRIO) { 1978 yyerror("prio cannot be redefined"); 1979 YYERROR; 1980 } 1981 if ($2 < 0 || $2 > IFQ_MAXPRIO) { 1982 yyerror("prio must be 0 - %u", IFQ_MAXPRIO); 1983 YYERROR; 1984 } 1985 filter_opts.marker |= FOM_PRIO; 1986 filter_opts.prio = $2; 1987 } 1988 | TOS tos { 1989 if (filter_opts.marker & FOM_TOS) { 1990 yyerror("tos cannot be redefined"); 1991 YYERROR; 1992 } 1993 filter_opts.marker |= FOM_TOS; 1994 filter_opts.tos = $2; 1995 } 1996 | keep { 1997 if (filter_opts.marker & FOM_KEEP) { 1998 yyerror("modulate or keep cannot be redefined"); 1999 YYERROR; 2000 } 2001 filter_opts.marker |= FOM_KEEP; 2002 filter_opts.keep.action = $1.action; 2003 filter_opts.keep.options = $1.options; 2004 } 2005 | FRAGMENT { 2006 filter_opts.fragment = 1; 2007 } 2008 | ALLOWOPTS { 2009 filter_opts.allowopts = 1; 2010 } 2011 | LABEL label { 2012 if (filter_opts.label) { 2013 yyerror("label cannot be redefined"); 2014 YYERROR; 2015 } 2016 filter_opts.label = $2; 2017 } 2018 | QUEUE qname { 2019 if (filter_opts.queues.qname) { 2020 yyerror("queue cannot be redefined"); 2021 YYERROR; 2022 } 2023 filter_opts.queues = $2; 2024 } 2025 | TAG string { 2026 filter_opts.tag = $2; 2027 } 2028 | not TAGGED string { 2029 filter_opts.match_tag = $3; 2030 filter_opts.match_tag_not = $1; 2031 } 2032 | PROBABILITY probability { 2033 double p; 2034 2035 p = floor($2 * UINT_MAX + 0.5); 2036 if (p < 0.0 || p > UINT_MAX) { 2037 yyerror("invalid probability: %g%%", $2 * 100); 2038 YYERROR; 2039 } 2040 filter_opts.prob = (u_int32_t)p; 2041 if (filter_opts.prob == 0) 2042 filter_opts.prob = 1; 2043 } 2044 | RTABLE NUMBER { 2045 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 2046 yyerror("invalid rtable id"); 2047 YYERROR; 2048 } 2049 filter_opts.rtableid = $2; 2050 } 2051 | DIVERTTO STRING PORT portplain { 2052 if ((filter_opts.divert.addr = host($2)) == NULL) { 2053 yyerror("could not parse divert address: %s", 2054 $2); 2055 free($2); 2056 YYERROR; 2057 } 2058 free($2); 2059 filter_opts.divert.port = $4.a; 2060 if (!filter_opts.divert.port) { 2061 yyerror("invalid divert port: %u", ntohs($4.a)); 2062 YYERROR; 2063 } 2064 } 2065 | DIVERTREPLY { 2066 filter_opts.divert.port = 1; /* some random value */ 2067 } 2068 | DIVERTPACKET PORT number { 2069 /* 2070 * If IP reassembly was not turned off, also 2071 * forcibly enable TCP reassembly by default. 2072 */ 2073 if (pf->reassemble & PF_REASS_ENABLED) 2074 filter_opts.marker |= FOM_SCRUB_TCP; 2075 2076 if ($3 < 1 || $3 > 65535) { 2077 yyerror("invalid divert port"); 2078 YYERROR; 2079 } 2080 2081 filter_opts.divert_packet.port = htons($3); 2082 } 2083 | SCRUB '(' scrub_opts ')' { 2084 filter_opts.nodf = $3.nodf; 2085 filter_opts.minttl = $3.minttl; 2086 filter_opts.randomid = $3.randomid; 2087 filter_opts.max_mss = $3.maxmss; 2088 if ($3.reassemble_tcp) 2089 filter_opts.marker |= FOM_SCRUB_TCP; 2090 filter_opts.marker |= $3.marker; 2091 } 2092 | NATTO redirpool pool_opts { 2093 if (filter_opts.nat.rdr) { 2094 yyerror("cannot respecify nat-to/binat-to"); 2095 YYERROR; 2096 } 2097 filter_opts.nat.rdr = $2; 2098 memcpy(&filter_opts.nat.pool_opts, &$3, 2099 sizeof(filter_opts.nat.pool_opts)); 2100 } 2101 | AFTO af FROM redirpool pool_opts { 2102 if (filter_opts.nat.rdr) { 2103 yyerror("cannot respecify af-to"); 2104 YYERROR; 2105 } 2106 if ($2 == 0) { 2107 yyerror("no target address family specified"); 2108 YYERROR; 2109 } 2110 filter_opts.nat.af = $2; 2111 filter_opts.nat.rdr = $4; 2112 memcpy(&filter_opts.nat.pool_opts, &$5, 2113 sizeof(filter_opts.nat.pool_opts)); 2114 filter_opts.rdr.rdr = 2115 calloc(1, sizeof(struct redirection)); 2116 bzero(&filter_opts.rdr.pool_opts, 2117 sizeof(filter_opts.rdr.pool_opts)); 2118 filter_opts.marker |= FOM_AFTO; 2119 } 2120 | AFTO af FROM redirpool pool_opts TO redirpool pool_opts { 2121 if (filter_opts.nat.rdr) { 2122 yyerror("cannot respecify af-to"); 2123 YYERROR; 2124 } 2125 if ($2 == 0) { 2126 yyerror("no address family specified"); 2127 YYERROR; 2128 } 2129 if (($4->host->af && $4->host->af != $2) || 2130 ($7->host->af && $7->host->af != $2)) { 2131 yyerror("af-to addresses must be in the " 2132 "target address family"); 2133 YYERROR; 2134 } 2135 filter_opts.nat.af = $2; 2136 filter_opts.nat.rdr = $4; 2137 memcpy(&filter_opts.nat.pool_opts, &$5, 2138 sizeof(filter_opts.nat.pool_opts)); 2139 filter_opts.rdr.af = $2; 2140 filter_opts.rdr.rdr = $7; 2141 memcpy(&filter_opts.nat.pool_opts, &$8, 2142 sizeof(filter_opts.nat.pool_opts)); 2143 filter_opts.marker |= FOM_AFTO; 2144 } 2145 | RDRTO redirpool pool_opts { 2146 if (filter_opts.rdr.rdr) { 2147 yyerror("cannot respecify rdr-to"); 2148 YYERROR; 2149 } 2150 filter_opts.rdr.rdr = $2; 2151 memcpy(&filter_opts.rdr.pool_opts, &$3, 2152 sizeof(filter_opts.rdr.pool_opts)); 2153 } 2154 | BINATTO redirpool pool_opts { 2155 if (filter_opts.nat.rdr) { 2156 yyerror("cannot respecify nat-to/binat-to"); 2157 YYERROR; 2158 } 2159 filter_opts.nat.rdr = $2; 2160 filter_opts.nat.binat = 1; 2161 memcpy(&filter_opts.nat.pool_opts, &$3, 2162 sizeof(filter_opts.nat.pool_opts)); 2163 filter_opts.nat.pool_opts.staticport = 1; 2164 } 2165 | ROUTETO routespec pool_opts { 2166 filter_opts.route.host = $2; 2167 filter_opts.route.rt = PF_ROUTETO; 2168 filter_opts.route.pool_opts = $3.type | $3.opts; 2169 memcpy(&filter_opts.rroute.pool_opts, &$3, 2170 sizeof(filter_opts.rroute.pool_opts)); 2171 if ($3.key != NULL) 2172 filter_opts.route.key = $3.key; 2173 } 2174 | REPLYTO routespec pool_opts { 2175 filter_opts.route.host = $2; 2176 filter_opts.route.rt = PF_REPLYTO; 2177 filter_opts.route.pool_opts = $3.type | $3.opts; 2178 if ($3.key != NULL) 2179 filter_opts.route.key = $3.key; 2180 } 2181 | DUPTO routespec pool_opts { 2182 filter_opts.route.host = $2; 2183 filter_opts.route.rt = PF_DUPTO; 2184 filter_opts.route.pool_opts = $3.type | $3.opts; 2185 memcpy(&filter_opts.rroute.pool_opts, &$3, 2186 sizeof(filter_opts.rroute.pool_opts)); 2187 if ($3.key != NULL) 2188 filter_opts.route.key = $3.key; 2189 } 2190 | not RECEIVEDON if_item { 2191 if (filter_opts.rcv) { 2192 yyerror("cannot respecify received-on"); 2193 YYERROR; 2194 } 2195 filter_opts.rcv = $3; 2196 filter_opts.rcv->not = $1; 2197 } 2198 | ONCE { 2199 filter_opts.marker |= FOM_ONCE; 2200 } 2201 | filter_sets 2202 ; 2203 2204filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; } 2205 | SET filter_set { $$ = filter_opts; } 2206 ; 2207 2208filter_sets_l : filter_sets_l comma filter_set 2209 | filter_set 2210 ; 2211 2212filter_set : prio { 2213 if (filter_opts.marker & FOM_SETPRIO) { 2214 yyerror("prio cannot be redefined"); 2215 YYERROR; 2216 } 2217 filter_opts.marker |= FOM_SETPRIO; 2218 filter_opts.set_prio[0] = $1.b1; 2219 filter_opts.set_prio[1] = $1.b2; 2220 } 2221 | QUEUE qname { 2222 if (filter_opts.queues.qname) { 2223 yyerror("queue cannot be redefined"); 2224 YYERROR; 2225 } 2226 filter_opts.queues = $2; 2227 } 2228 | TOS tos { 2229 if (filter_opts.marker & FOM_SETTOS) { 2230 yyerror("tos cannot be respecified"); 2231 YYERROR; 2232 } 2233 filter_opts.marker |= FOM_SETTOS; 2234 filter_opts.settos = $2; 2235 } 2236 ; 2237 2238prio : PRIO NUMBER { 2239 if ($2 < 0 || $2 > IFQ_MAXPRIO) { 2240 yyerror("prio must be 0 - %u", IFQ_MAXPRIO); 2241 YYERROR; 2242 } 2243 $$.b1 = $$.b2 = $2; 2244 } 2245 | PRIO '(' NUMBER comma NUMBER ')' { 2246 if ($3 < 0 || $3 > IFQ_MAXPRIO || 2247 $5 < 0 || $5 > IFQ_MAXPRIO) { 2248 yyerror("prio must be 0 - %u", IFQ_MAXPRIO); 2249 YYERROR; 2250 } 2251 $$.b1 = $3; 2252 $$.b2 = $5; 2253 } 2254 ; 2255 2256probability : STRING { 2257 char *e; 2258 double p = strtod($1, &e); 2259 2260 if (*e == '%') { 2261 p *= 0.01; 2262 e++; 2263 } 2264 if (*e) { 2265 yyerror("invalid probability: %s", $1); 2266 free($1); 2267 YYERROR; 2268 } 2269 free($1); 2270 $$ = p; 2271 } 2272 | NUMBER { 2273 $$ = (double)$1; 2274 } 2275 ; 2276 2277 2278action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2279 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 2280 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2281 ; 2282 2283blockspec : /* empty */ { 2284 $$.b2 = blockpolicy; 2285 $$.w = returnicmpdefault; 2286 $$.w2 = returnicmp6default; 2287 } 2288 | DROP { 2289 $$.b2 = PFRULE_DROP; 2290 $$.w = 0; 2291 $$.w2 = 0; 2292 } 2293 | RETURNRST { 2294 $$.b2 = PFRULE_RETURNRST; 2295 $$.w = 0; 2296 $$.w2 = 0; 2297 } 2298 | RETURNRST '(' TTL NUMBER ')' { 2299 if ($4 < 0 || $4 > 255) { 2300 yyerror("illegal ttl value %d", $4); 2301 YYERROR; 2302 } 2303 $$.b2 = PFRULE_RETURNRST; 2304 $$.w = $4; 2305 $$.w2 = 0; 2306 } 2307 | RETURNICMP { 2308 $$.b2 = PFRULE_RETURNICMP; 2309 $$.w = returnicmpdefault; 2310 $$.w2 = returnicmp6default; 2311 } 2312 | RETURNICMP6 { 2313 $$.b2 = PFRULE_RETURNICMP; 2314 $$.w = returnicmpdefault; 2315 $$.w2 = returnicmp6default; 2316 } 2317 | RETURNICMP '(' reticmpspec ')' { 2318 $$.b2 = PFRULE_RETURNICMP; 2319 $$.w = $3; 2320 $$.w2 = returnicmpdefault; 2321 } 2322 | RETURNICMP6 '(' reticmp6spec ')' { 2323 $$.b2 = PFRULE_RETURNICMP; 2324 $$.w = returnicmpdefault; 2325 $$.w2 = $3; 2326 } 2327 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2328 $$.b2 = PFRULE_RETURNICMP; 2329 $$.w = $3; 2330 $$.w2 = $5; 2331 } 2332 | RETURN { 2333 $$.b2 = PFRULE_RETURN; 2334 $$.w = returnicmpdefault; 2335 $$.w2 = returnicmp6default; 2336 } 2337 ; 2338 2339reticmpspec : STRING { 2340 if (!($$ = parseicmpspec($1, AF_INET))) { 2341 free($1); 2342 YYERROR; 2343 } 2344 free($1); 2345 } 2346 | NUMBER { 2347 u_int8_t icmptype; 2348 2349 if ($1 < 0 || $1 > 255) { 2350 yyerror("invalid icmp code %lu", $1); 2351 YYERROR; 2352 } 2353 icmptype = returnicmpdefault >> 8; 2354 $$ = (icmptype << 8 | $1); 2355 } 2356 ; 2357 2358reticmp6spec : STRING { 2359 if (!($$ = parseicmpspec($1, AF_INET6))) { 2360 free($1); 2361 YYERROR; 2362 } 2363 free($1); 2364 } 2365 | NUMBER { 2366 u_int8_t icmptype; 2367 2368 if ($1 < 0 || $1 > 255) { 2369 yyerror("invalid icmp code %lu", $1); 2370 YYERROR; 2371 } 2372 icmptype = returnicmp6default >> 8; 2373 $$ = (icmptype << 8 | $1); 2374 } 2375 ; 2376 2377dir : /* empty */ { $$ = PF_INOUT; } 2378 | IN { $$ = PF_IN; } 2379 | OUT { $$ = PF_OUT; } 2380 ; 2381 2382quick : /* empty */ { $$.quick = 0; } 2383 | QUICK { $$.quick = 1; } 2384 ; 2385 2386logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2387 | log { $$ = $1; $$.quick = 0; } 2388 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2389 | log QUICK { $$ = $1; $$.quick = 1; } 2390 | QUICK log { $$ = $2; $$.quick = 1; } 2391 ; 2392 2393log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2394 | LOG '(' logopts ')' { 2395 $$.log = PF_LOG | $3.log; 2396 $$.logif = $3.logif; 2397 } 2398 ; 2399 2400logopts : logopt { $$ = $1; } 2401 | logopts comma logopt { 2402 $$.log = $1.log | $3.log; 2403 $$.logif = $3.logif; 2404 if ($$.logif == 0) 2405 $$.logif = $1.logif; 2406 } 2407 ; 2408 2409logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2410 | MATCHES { $$.log = PF_LOG_MATCHES; $$.logif = 0; } 2411 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2412 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2413 | TO string { 2414 const char *errstr; 2415 u_int i; 2416 2417 $$.log = 0; 2418 if (strncmp($2, "pflog", 5)) { 2419 yyerror("%s: should be a pflog interface", $2); 2420 free($2); 2421 YYERROR; 2422 } 2423 i = strtonum($2 + 5, 0, 255, &errstr); 2424 if (errstr) { 2425 yyerror("%s: %s", $2, errstr); 2426 free($2); 2427 YYERROR; 2428 } 2429 free($2); 2430 $$.logif = i; 2431 } 2432 ; 2433 2434interface : /* empty */ { $$ = NULL; } 2435 | ON if_item_not { $$ = $2; } 2436 | ON '{' optnl if_list '}' { $$ = $4; } 2437 ; 2438 2439if_list : if_item_not optnl { $$ = $1; } 2440 | if_list comma if_item_not optnl { 2441 $1->tail->next = $3; 2442 $1->tail = $3; 2443 $$ = $1; 2444 } 2445 ; 2446 2447if_item_not : not if_item { $$ = $2; $$->not = $1; } 2448 ; 2449 2450if_item : STRING { 2451 struct node_host *n; 2452 2453 $$ = calloc(1, sizeof(struct node_if)); 2454 if ($$ == NULL) 2455 err(1, "if_item: calloc"); 2456 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2457 sizeof($$->ifname)) { 2458 free($1); 2459 free($$); 2460 yyerror("interface name too long"); 2461 YYERROR; 2462 } 2463 2464 if ((n = ifa_exists($1)) != NULL) 2465 $$->ifa_flags = n->ifa_flags; 2466 2467 free($1); 2468 $$->not = 0; 2469 $$->next = NULL; 2470 $$->tail = $$; 2471 } 2472 | ANY { 2473 $$ = calloc(1, sizeof(struct node_if)); 2474 if ($$ == NULL) 2475 err(1, "if_item: calloc"); 2476 strlcpy($$->ifname, "any", sizeof($$->ifname)); 2477 $$->not = 0; 2478 $$->next = NULL; 2479 $$->tail = $$; 2480 } 2481 | RDOMAIN NUMBER { 2482 if ($2 < 0 || $2 > RT_TABLEID_MAX) { 2483 yyerror("rdomain outside range"); 2484 YYERROR; 2485 } 2486 $$ = calloc(1, sizeof(struct node_if)); 2487 if ($$ == NULL) 2488 err(1, "if_item: calloc"); 2489 $$->not = 0; 2490 $$->use_rdomain = 1; 2491 $$->rdomain = $2; 2492 $$->next = NULL; 2493 $$->tail = $$; 2494 } 2495 ; 2496 2497af : /* empty */ { $$ = 0; } 2498 | INET { $$ = AF_INET; } 2499 | INET6 { $$ = AF_INET6; } 2500 ; 2501 2502proto : /* empty */ { $$ = NULL; } 2503 | PROTO proto_item { $$ = $2; } 2504 | PROTO '{' optnl proto_list '}' { $$ = $4; } 2505 ; 2506 2507proto_list : proto_item optnl { $$ = $1; } 2508 | proto_list comma proto_item optnl { 2509 $1->tail->next = $3; 2510 $1->tail = $3; 2511 $$ = $1; 2512 } 2513 ; 2514 2515proto_item : protoval { 2516 u_int8_t pr; 2517 2518 pr = (u_int8_t)$1; 2519 if (pr == 0) { 2520 yyerror("proto 0 cannot be used"); 2521 YYERROR; 2522 } 2523 $$ = calloc(1, sizeof(struct node_proto)); 2524 if ($$ == NULL) 2525 err(1, "proto_item: calloc"); 2526 $$->proto = pr; 2527 $$->next = NULL; 2528 $$->tail = $$; 2529 } 2530 ; 2531 2532protoval : STRING { 2533 struct protoent *p; 2534 2535 p = getprotobyname($1); 2536 if (p == NULL) { 2537 yyerror("unknown protocol %s", $1); 2538 free($1); 2539 YYERROR; 2540 } 2541 $$ = p->p_proto; 2542 free($1); 2543 } 2544 | NUMBER { 2545 if ($1 < 0 || $1 > 255) { 2546 yyerror("protocol outside range"); 2547 YYERROR; 2548 } 2549 } 2550 ; 2551 2552fromto : ALL { 2553 $$.src.host = NULL; 2554 $$.src.port = NULL; 2555 $$.dst.host = NULL; 2556 $$.dst.port = NULL; 2557 $$.src_os = NULL; 2558 } 2559 | from os to { 2560 $$.src = $1; 2561 $$.src_os = $2; 2562 $$.dst = $3; 2563 } 2564 ; 2565 2566os : /* empty */ { $$ = NULL; } 2567 | OS xos { $$ = $2; } 2568 | OS '{' optnl os_list '}' { $$ = $4; } 2569 ; 2570 2571xos : STRING { 2572 $$ = calloc(1, sizeof(struct node_os)); 2573 if ($$ == NULL) 2574 err(1, "os: calloc"); 2575 $$->os = $1; 2576 $$->tail = $$; 2577 } 2578 ; 2579 2580os_list : xos optnl { $$ = $1; } 2581 | os_list comma xos optnl { 2582 $1->tail->next = $3; 2583 $1->tail = $3; 2584 $$ = $1; 2585 } 2586 ; 2587 2588from : /* empty */ { 2589 $$.host = NULL; 2590 $$.port = NULL; 2591 } 2592 | FROM ipportspec { 2593 $$ = $2; 2594 } 2595 ; 2596 2597to : /* empty */ { 2598 $$.host = NULL; 2599 $$.port = NULL; 2600 } 2601 | TO ipportspec { 2602 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2603 "not permitted in a destination address")) 2604 YYERROR; 2605 $$ = $2; 2606 } 2607 ; 2608 2609ipportspec : ipspec { 2610 $$.host = $1; 2611 $$.port = NULL; 2612 } 2613 | ipspec PORT portspec { 2614 $$.host = $1; 2615 $$.port = $3; 2616 } 2617 | PORT portspec { 2618 $$.host = NULL; 2619 $$.port = $2; 2620 } 2621 ; 2622 2623optnl : '\n' optnl 2624 | /* empty */ 2625 ; 2626 2627ipspec : ANY { $$ = NULL; } 2628 | xhost { $$ = $1; } 2629 | '{' optnl host_list '}' { $$ = $3; } 2630 ; 2631 2632 2633host_list : ipspec optnl { $$ = $1; } 2634 | host_list comma ipspec optnl { 2635 if ($1 == NULL) { 2636 freehostlist($3); 2637 $$ = $1; 2638 } else if ($3 == NULL) { 2639 freehostlist($1); 2640 $$ = $3; 2641 } else { 2642 $1->tail->next = $3; 2643 $1->tail = $3->tail; 2644 $$ = $1; 2645 } 2646 } 2647 ; 2648 2649xhost : not host { 2650 struct node_host *n; 2651 2652 for (n = $2; n != NULL; n = n->next) 2653 n->not = $1; 2654 $$ = $2; 2655 } 2656 | not NOROUTE { 2657 $$ = calloc(1, sizeof(struct node_host)); 2658 if ($$ == NULL) 2659 err(1, "xhost: calloc"); 2660 $$->addr.type = PF_ADDR_NOROUTE; 2661 $$->next = NULL; 2662 $$->not = $1; 2663 $$->tail = $$; 2664 } 2665 | not URPFFAILED { 2666 $$ = calloc(1, sizeof(struct node_host)); 2667 if ($$ == NULL) 2668 err(1, "xhost: calloc"); 2669 $$->addr.type = PF_ADDR_URPFFAILED; 2670 $$->next = NULL; 2671 $$->not = $1; 2672 $$->tail = $$; 2673 } 2674 ; 2675 2676optweight : WEIGHT NUMBER { 2677 if ($2 < 1 || $2 > USHRT_MAX) { 2678 yyerror("weight out of range"); 2679 YYERROR; 2680 } 2681 $$ = $2; 2682 } 2683 | /* empty */ { $$ = 0; } 2684 ; 2685 2686host : STRING { 2687 if (($$ = host($1)) == NULL) { 2688 /* error. "any" is handled elsewhere */ 2689 free($1); 2690 yyerror("could not parse host specification"); 2691 YYERROR; 2692 } 2693 free($1); 2694 2695 } 2696 | STRING '-' STRING { 2697 struct node_host *b, *e; 2698 2699 if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 2700 free($1); 2701 free($3); 2702 yyerror("could not parse host specification"); 2703 YYERROR; 2704 } 2705 if (b->af != e->af || 2706 b->addr.type != PF_ADDR_ADDRMASK || 2707 e->addr.type != PF_ADDR_ADDRMASK || 2708 unmask(&b->addr.v.a.mask, b->af) != 2709 (b->af == AF_INET ? 32 : 128) || 2710 unmask(&e->addr.v.a.mask, e->af) != 2711 (e->af == AF_INET ? 32 : 128) || 2712 b->next != NULL || b->not || 2713 e->next != NULL || e->not) { 2714 free(b); 2715 free(e); 2716 free($1); 2717 free($3); 2718 yyerror("invalid address range"); 2719 YYERROR; 2720 } 2721 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 2722 sizeof(b->addr.v.a.mask)); 2723 b->addr.type = PF_ADDR_RANGE; 2724 $$ = b; 2725 free(e); 2726 free($1); 2727 free($3); 2728 } 2729 | STRING '/' NUMBER { 2730 char *buf; 2731 2732 if (asprintf(&buf, "%s/%lld", $1, $3) == -1) 2733 err(1, "host: asprintf"); 2734 free($1); 2735 if (($$ = host(buf)) == NULL) { 2736 /* error. "any" is handled elsewhere */ 2737 free(buf); 2738 yyerror("could not parse host specification"); 2739 YYERROR; 2740 } 2741 free(buf); 2742 } 2743 | NUMBER '/' NUMBER { 2744 char *buf; 2745 2746 /* ie. for 10/8 parsing */ 2747 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 2748 err(1, "host: asprintf"); 2749 if (($$ = host(buf)) == NULL) { 2750 /* error. "any" is handled elsewhere */ 2751 free(buf); 2752 yyerror("could not parse host specification"); 2753 YYERROR; 2754 } 2755 free(buf); 2756 } 2757 | dynaddr 2758 | dynaddr '/' NUMBER { 2759 struct node_host *n; 2760 2761 if ($3 < 0 || $3 > 128) { 2762 yyerror("bit number too big"); 2763 YYERROR; 2764 } 2765 $$ = $1; 2766 for (n = $1; n != NULL; n = n->next) 2767 set_ipmask(n, $3); 2768 } 2769 | '<' STRING '>' { 2770 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2771 yyerror("table name '%s' too long", $2); 2772 free($2); 2773 YYERROR; 2774 } 2775 $$ = calloc(1, sizeof(struct node_host)); 2776 if ($$ == NULL) 2777 err(1, "host: calloc"); 2778 $$->addr.type = PF_ADDR_TABLE; 2779 if (strlcpy($$->addr.v.tblname, $2, 2780 sizeof($$->addr.v.tblname)) >= 2781 sizeof($$->addr.v.tblname)) 2782 errx(1, "host: strlcpy"); 2783 free($2); 2784 $$->next = NULL; 2785 $$->tail = $$; 2786 } 2787 | ROUTE STRING { 2788 $$ = calloc(1, sizeof(struct node_host)); 2789 if ($$ == NULL) { 2790 free($2); 2791 err(1, "host: calloc"); 2792 } 2793 $$->addr.type = PF_ADDR_RTLABEL; 2794 if (strlcpy($$->addr.v.rtlabelname, $2, 2795 sizeof($$->addr.v.rtlabelname)) >= 2796 sizeof($$->addr.v.rtlabelname)) { 2797 yyerror("route label too long, max %u chars", 2798 sizeof($$->addr.v.rtlabelname) - 1); 2799 free($2); 2800 free($$); 2801 YYERROR; 2802 } 2803 $$->next = NULL; 2804 $$->tail = $$; 2805 free($2); 2806 } 2807 ; 2808 2809number : NUMBER 2810 | STRING { 2811 u_long ulval; 2812 2813 if (atoul($1, &ulval) == -1) { 2814 yyerror("%s is not a number", $1); 2815 free($1); 2816 YYERROR; 2817 } else 2818 $$ = ulval; 2819 free($1); 2820 } 2821 ; 2822 2823dynaddr : '(' STRING ')' { 2824 int flags = 0; 2825 char *p, *op; 2826 2827 op = $2; 2828 if (!isalpha((unsigned char)op[0])) { 2829 yyerror("invalid interface name '%s'", op); 2830 free(op); 2831 YYERROR; 2832 } 2833 while ((p = strrchr($2, ':')) != NULL) { 2834 if (!strcmp(p+1, "network")) 2835 flags |= PFI_AFLAG_NETWORK; 2836 else if (!strcmp(p+1, "broadcast")) 2837 flags |= PFI_AFLAG_BROADCAST; 2838 else if (!strcmp(p+1, "peer")) 2839 flags |= PFI_AFLAG_PEER; 2840 else if (!strcmp(p+1, "0")) 2841 flags |= PFI_AFLAG_NOALIAS; 2842 else { 2843 yyerror("interface %s has bad modifier", 2844 $2); 2845 free(op); 2846 YYERROR; 2847 } 2848 *p = '\0'; 2849 } 2850 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2851 free(op); 2852 yyerror("illegal combination of " 2853 "interface modifiers"); 2854 YYERROR; 2855 } 2856 $$ = calloc(1, sizeof(struct node_host)); 2857 if ($$ == NULL) 2858 err(1, "address: calloc"); 2859 $$->af = 0; 2860 set_ipmask($$, 128); 2861 $$->addr.type = PF_ADDR_DYNIFTL; 2862 $$->addr.iflags = flags; 2863 if (strlcpy($$->addr.v.ifname, $2, 2864 sizeof($$->addr.v.ifname)) >= 2865 sizeof($$->addr.v.ifname)) { 2866 free(op); 2867 free($$); 2868 yyerror("interface name too long"); 2869 YYERROR; 2870 } 2871 free(op); 2872 $$->next = NULL; 2873 $$->tail = $$; 2874 } 2875 ; 2876 2877portspec : port_item { $$ = $1; } 2878 | '{' optnl port_list '}' { $$ = $3; } 2879 ; 2880 2881port_list : port_item optnl { $$ = $1; } 2882 | port_list comma port_item optnl { 2883 $1->tail->next = $3; 2884 $1->tail = $3; 2885 $$ = $1; 2886 } 2887 ; 2888 2889port_item : portrange { 2890 $$ = calloc(1, sizeof(struct node_port)); 2891 if ($$ == NULL) 2892 err(1, "port_item: calloc"); 2893 $$->port[0] = $1.a; 2894 $$->port[1] = $1.b; 2895 if ($1.t) 2896 $$->op = PF_OP_RRG; 2897 else 2898 $$->op = PF_OP_EQ; 2899 $$->next = NULL; 2900 $$->tail = $$; 2901 } 2902 | unaryop portrange { 2903 if ($2.t) { 2904 yyerror("':' cannot be used with an other " 2905 "port operator"); 2906 YYERROR; 2907 } 2908 $$ = calloc(1, sizeof(struct node_port)); 2909 if ($$ == NULL) 2910 err(1, "port_item: calloc"); 2911 $$->port[0] = $2.a; 2912 $$->port[1] = $2.b; 2913 $$->op = $1; 2914 $$->next = NULL; 2915 $$->tail = $$; 2916 } 2917 | portrange PORTBINARY portrange { 2918 if ($1.t || $3.t) { 2919 yyerror("':' cannot be used with an other " 2920 "port operator"); 2921 YYERROR; 2922 } 2923 $$ = calloc(1, sizeof(struct node_port)); 2924 if ($$ == NULL) 2925 err(1, "port_item: calloc"); 2926 $$->port[0] = $1.a; 2927 $$->port[1] = $3.a; 2928 $$->op = $2; 2929 $$->next = NULL; 2930 $$->tail = $$; 2931 } 2932 ; 2933 2934portplain : numberstring { 2935 if (parseport($1, &$$, 0) == -1) { 2936 free($1); 2937 YYERROR; 2938 } 2939 free($1); 2940 } 2941 ; 2942 2943portrange : numberstring { 2944 if (parseport($1, &$$, PPORT_RANGE) == -1) { 2945 free($1); 2946 YYERROR; 2947 } 2948 free($1); 2949 } 2950 ; 2951 2952uids : uid_item { $$ = $1; } 2953 | '{' optnl uid_list '}' { $$ = $3; } 2954 ; 2955 2956uid_list : uid_item optnl { $$ = $1; } 2957 | uid_list comma uid_item optnl { 2958 $1->tail->next = $3; 2959 $1->tail = $3; 2960 $$ = $1; 2961 } 2962 ; 2963 2964uid_item : uid { 2965 $$ = calloc(1, sizeof(struct node_uid)); 2966 if ($$ == NULL) 2967 err(1, "uid_item: calloc"); 2968 $$->uid[0] = $1; 2969 $$->uid[1] = $1; 2970 $$->op = PF_OP_EQ; 2971 $$->next = NULL; 2972 $$->tail = $$; 2973 } 2974 | unaryop uid { 2975 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2976 yyerror("user unknown requires operator = or " 2977 "!="); 2978 YYERROR; 2979 } 2980 $$ = calloc(1, sizeof(struct node_uid)); 2981 if ($$ == NULL) 2982 err(1, "uid_item: calloc"); 2983 $$->uid[0] = $2; 2984 $$->uid[1] = $2; 2985 $$->op = $1; 2986 $$->next = NULL; 2987 $$->tail = $$; 2988 } 2989 | uid PORTBINARY uid { 2990 if ($1 == UID_MAX || $3 == UID_MAX) { 2991 yyerror("user unknown requires operator = or " 2992 "!="); 2993 YYERROR; 2994 } 2995 $$ = calloc(1, sizeof(struct node_uid)); 2996 if ($$ == NULL) 2997 err(1, "uid_item: calloc"); 2998 $$->uid[0] = $1; 2999 $$->uid[1] = $3; 3000 $$->op = $2; 3001 $$->next = NULL; 3002 $$->tail = $$; 3003 } 3004 ; 3005 3006uid : STRING { 3007 if (!strcmp($1, "unknown")) 3008 $$ = UID_MAX; 3009 else { 3010 struct passwd *pw; 3011 3012 if ((pw = getpwnam($1)) == NULL) { 3013 yyerror("unknown user %s", $1); 3014 free($1); 3015 YYERROR; 3016 } 3017 $$ = pw->pw_uid; 3018 } 3019 free($1); 3020 } 3021 | NUMBER { 3022 if ($1 < 0 || $1 >= UID_MAX) { 3023 yyerror("illegal uid value %lu", $1); 3024 YYERROR; 3025 } 3026 $$ = $1; 3027 } 3028 ; 3029 3030gids : gid_item { $$ = $1; } 3031 | '{' optnl gid_list '}' { $$ = $3; } 3032 ; 3033 3034gid_list : gid_item optnl { $$ = $1; } 3035 | gid_list comma gid_item optnl { 3036 $1->tail->next = $3; 3037 $1->tail = $3; 3038 $$ = $1; 3039 } 3040 ; 3041 3042gid_item : gid { 3043 $$ = calloc(1, sizeof(struct node_gid)); 3044 if ($$ == NULL) 3045 err(1, "gid_item: calloc"); 3046 $$->gid[0] = $1; 3047 $$->gid[1] = $1; 3048 $$->op = PF_OP_EQ; 3049 $$->next = NULL; 3050 $$->tail = $$; 3051 } 3052 | unaryop gid { 3053 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3054 yyerror("group unknown requires operator = or " 3055 "!="); 3056 YYERROR; 3057 } 3058 $$ = calloc(1, sizeof(struct node_gid)); 3059 if ($$ == NULL) 3060 err(1, "gid_item: calloc"); 3061 $$->gid[0] = $2; 3062 $$->gid[1] = $2; 3063 $$->op = $1; 3064 $$->next = NULL; 3065 $$->tail = $$; 3066 } 3067 | gid PORTBINARY gid { 3068 if ($1 == GID_MAX || $3 == GID_MAX) { 3069 yyerror("group unknown requires operator = or " 3070 "!="); 3071 YYERROR; 3072 } 3073 $$ = calloc(1, sizeof(struct node_gid)); 3074 if ($$ == NULL) 3075 err(1, "gid_item: calloc"); 3076 $$->gid[0] = $1; 3077 $$->gid[1] = $3; 3078 $$->op = $2; 3079 $$->next = NULL; 3080 $$->tail = $$; 3081 } 3082 ; 3083 3084gid : STRING { 3085 if (!strcmp($1, "unknown")) 3086 $$ = GID_MAX; 3087 else { 3088 struct group *grp; 3089 3090 if ((grp = getgrnam($1)) == NULL) { 3091 yyerror("unknown group %s", $1); 3092 free($1); 3093 YYERROR; 3094 } 3095 $$ = grp->gr_gid; 3096 } 3097 free($1); 3098 } 3099 | NUMBER { 3100 if ($1 < 0 || $1 >= GID_MAX) { 3101 yyerror("illegal gid value %lu", $1); 3102 YYERROR; 3103 } 3104 $$ = $1; 3105 } 3106 ; 3107 3108flag : STRING { 3109 int f; 3110 3111 if ((f = parse_flags($1)) < 0) { 3112 yyerror("bad flags %s", $1); 3113 free($1); 3114 YYERROR; 3115 } 3116 free($1); 3117 $$.b1 = f; 3118 } 3119 ; 3120 3121flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3122 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3123 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3124 ; 3125 3126icmpspec : ICMPTYPE icmp_item { $$ = $2; } 3127 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3128 | ICMP6TYPE icmp6_item { $$ = $2; } 3129 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3130 ; 3131 3132icmp_list : icmp_item optnl { $$ = $1; } 3133 | icmp_list comma icmp_item optnl { 3134 $1->tail->next = $3; 3135 $1->tail = $3; 3136 $$ = $1; 3137 } 3138 ; 3139 3140icmp6_list : icmp6_item optnl { $$ = $1; } 3141 | icmp6_list comma icmp6_item optnl { 3142 $1->tail->next = $3; 3143 $1->tail = $3; 3144 $$ = $1; 3145 } 3146 ; 3147 3148icmp_item : icmptype { 3149 $$ = calloc(1, sizeof(struct node_icmp)); 3150 if ($$ == NULL) 3151 err(1, "icmp_item: calloc"); 3152 $$->type = $1; 3153 $$->code = 0; 3154 $$->proto = IPPROTO_ICMP; 3155 $$->next = NULL; 3156 $$->tail = $$; 3157 } 3158 | icmptype CODE STRING { 3159 const struct icmpcodeent *p; 3160 3161 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3162 yyerror("unknown icmp-code %s", $3); 3163 free($3); 3164 YYERROR; 3165 } 3166 3167 free($3); 3168 $$ = calloc(1, sizeof(struct node_icmp)); 3169 if ($$ == NULL) 3170 err(1, "icmp_item: calloc"); 3171 $$->type = $1; 3172 $$->code = p->code + 1; 3173 $$->proto = IPPROTO_ICMP; 3174 $$->next = NULL; 3175 $$->tail = $$; 3176 } 3177 | icmptype CODE NUMBER { 3178 if ($3 < 0 || $3 > 255) { 3179 yyerror("illegal icmp-code %lu", $3); 3180 YYERROR; 3181 } 3182 $$ = calloc(1, sizeof(struct node_icmp)); 3183 if ($$ == NULL) 3184 err(1, "icmp_item: calloc"); 3185 $$->type = $1; 3186 $$->code = $3 + 1; 3187 $$->proto = IPPROTO_ICMP; 3188 $$->next = NULL; 3189 $$->tail = $$; 3190 } 3191 ; 3192 3193icmp6_item : icmp6type { 3194 $$ = calloc(1, sizeof(struct node_icmp)); 3195 if ($$ == NULL) 3196 err(1, "icmp_item: calloc"); 3197 $$->type = $1; 3198 $$->code = 0; 3199 $$->proto = IPPROTO_ICMPV6; 3200 $$->next = NULL; 3201 $$->tail = $$; 3202 } 3203 | icmp6type CODE STRING { 3204 const struct icmpcodeent *p; 3205 3206 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3207 yyerror("unknown icmp6-code %s", $3); 3208 free($3); 3209 YYERROR; 3210 } 3211 free($3); 3212 3213 $$ = calloc(1, sizeof(struct node_icmp)); 3214 if ($$ == NULL) 3215 err(1, "icmp_item: calloc"); 3216 $$->type = $1; 3217 $$->code = p->code + 1; 3218 $$->proto = IPPROTO_ICMPV6; 3219 $$->next = NULL; 3220 $$->tail = $$; 3221 } 3222 | icmp6type CODE NUMBER { 3223 if ($3 < 0 || $3 > 255) { 3224 yyerror("illegal icmp-code %lu", $3); 3225 YYERROR; 3226 } 3227 $$ = calloc(1, sizeof(struct node_icmp)); 3228 if ($$ == NULL) 3229 err(1, "icmp_item: calloc"); 3230 $$->type = $1; 3231 $$->code = $3 + 1; 3232 $$->proto = IPPROTO_ICMPV6; 3233 $$->next = NULL; 3234 $$->tail = $$; 3235 } 3236 ; 3237 3238icmptype : STRING { 3239 const struct icmptypeent *p; 3240 3241 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3242 yyerror("unknown icmp-type %s", $1); 3243 free($1); 3244 YYERROR; 3245 } 3246 $$ = p->type + 1; 3247 free($1); 3248 } 3249 | NUMBER { 3250 if ($1 < 0 || $1 > 255) { 3251 yyerror("illegal icmp-type %lu", $1); 3252 YYERROR; 3253 } 3254 $$ = $1 + 1; 3255 } 3256 ; 3257 3258icmp6type : STRING { 3259 const struct icmptypeent *p; 3260 3261 if ((p = geticmptypebyname($1, AF_INET6)) == 3262 NULL) { 3263 yyerror("unknown icmp6-type %s", $1); 3264 free($1); 3265 YYERROR; 3266 } 3267 $$ = p->type + 1; 3268 free($1); 3269 } 3270 | NUMBER { 3271 if ($1 < 0 || $1 > 255) { 3272 yyerror("illegal icmp6-type %lu", $1); 3273 YYERROR; 3274 } 3275 $$ = $1 + 1; 3276 } 3277 ; 3278 3279tos : STRING { 3280 int val; 3281 char *end; 3282 3283 if (map_tos($1, &val)) 3284 $$ = val; 3285 else if ($1[0] == '0' && $1[1] == 'x') { 3286 errno = 0; 3287 $$ = strtoul($1, &end, 16); 3288 if (errno || *end != '\0') 3289 $$ = 256; 3290 } else 3291 $$ = 256; /* flag bad argument */ 3292 if ($$ < 0 || $$ > 255) { 3293 yyerror("illegal tos value %s", $1); 3294 free($1); 3295 YYERROR; 3296 } 3297 free($1); 3298 } 3299 | NUMBER { 3300 $$ = $1; 3301 if ($$ < 0 || $$ > 255) { 3302 yyerror("illegal tos value %lld", $1); 3303 YYERROR; 3304 } 3305 } 3306 ; 3307 3308sourcetrack : /* empty */ { $$ = PF_SRCTRACK; } 3309 | GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3310 | RULE { $$ = PF_SRCTRACK_RULE; } 3311 ; 3312 3313statelock : IFBOUND { 3314 $$ = PFRULE_IFBOUND; 3315 } 3316 | FLOATING { 3317 $$ = 0; 3318 } 3319 ; 3320 3321keep : NO STATE { 3322 $$.action = 0; 3323 $$.options = NULL; 3324 } 3325 | KEEP STATE state_opt_spec { 3326 $$.action = PF_STATE_NORMAL; 3327 $$.options = $3; 3328 } 3329 | MODULATE STATE state_opt_spec { 3330 $$.action = PF_STATE_MODULATE; 3331 $$.options = $3; 3332 } 3333 | SYNPROXY STATE state_opt_spec { 3334 $$.action = PF_STATE_SYNPROXY; 3335 $$.options = $3; 3336 } 3337 ; 3338 3339flush : /* empty */ { $$ = 0; } 3340 | FLUSH { $$ = PF_FLUSH; } 3341 | FLUSH GLOBAL { 3342 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3343 } 3344 ; 3345 3346state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3347 | /* empty */ { $$ = NULL; } 3348 ; 3349 3350state_opt_list : state_opt_item { $$ = $1; } 3351 | state_opt_list comma state_opt_item { 3352 $1->tail->next = $3; 3353 $1->tail = $3; 3354 $$ = $1; 3355 } 3356 ; 3357 3358state_opt_item : MAXIMUM NUMBER { 3359 if ($2 < 0 || $2 > UINT_MAX) { 3360 yyerror("only positive values permitted"); 3361 YYERROR; 3362 } 3363 $$ = calloc(1, sizeof(struct node_state_opt)); 3364 if ($$ == NULL) 3365 err(1, "state_opt_item: calloc"); 3366 $$->type = PF_STATE_OPT_MAX; 3367 $$->data.max_states = $2; 3368 $$->next = NULL; 3369 $$->tail = $$; 3370 } 3371 | NOSYNC { 3372 $$ = calloc(1, sizeof(struct node_state_opt)); 3373 if ($$ == NULL) 3374 err(1, "state_opt_item: calloc"); 3375 $$->type = PF_STATE_OPT_NOSYNC; 3376 $$->next = NULL; 3377 $$->tail = $$; 3378 } 3379 | MAXSRCSTATES NUMBER { 3380 if ($2 < 0 || $2 > UINT_MAX) { 3381 yyerror("only positive values permitted"); 3382 YYERROR; 3383 } 3384 $$ = calloc(1, sizeof(struct node_state_opt)); 3385 if ($$ == NULL) 3386 err(1, "state_opt_item: calloc"); 3387 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3388 $$->data.max_src_states = $2; 3389 $$->next = NULL; 3390 $$->tail = $$; 3391 } 3392 | MAXSRCCONN NUMBER { 3393 if ($2 < 0 || $2 > UINT_MAX) { 3394 yyerror("only positive values permitted"); 3395 YYERROR; 3396 } 3397 $$ = calloc(1, sizeof(struct node_state_opt)); 3398 if ($$ == NULL) 3399 err(1, "state_opt_item: calloc"); 3400 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3401 $$->data.max_src_conn = $2; 3402 $$->next = NULL; 3403 $$->tail = $$; 3404 } 3405 | MAXSRCCONNRATE NUMBER '/' NUMBER { 3406 if ($2 < 0 || $2 > UINT_MAX || 3407 $4 < 0 || $4 > UINT_MAX) { 3408 yyerror("only positive values permitted"); 3409 YYERROR; 3410 } 3411 $$ = calloc(1, sizeof(struct node_state_opt)); 3412 if ($$ == NULL) 3413 err(1, "state_opt_item: calloc"); 3414 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3415 $$->data.max_src_conn_rate.limit = $2; 3416 $$->data.max_src_conn_rate.seconds = $4; 3417 $$->next = NULL; 3418 $$->tail = $$; 3419 } 3420 | OVERLOAD '<' STRING '>' flush { 3421 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3422 yyerror("table name '%s' too long", $3); 3423 free($3); 3424 YYERROR; 3425 } 3426 $$ = calloc(1, sizeof(struct node_state_opt)); 3427 if ($$ == NULL) 3428 err(1, "state_opt_item: calloc"); 3429 if (strlcpy($$->data.overload.tblname, $3, 3430 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3431 errx(1, "state_opt_item: strlcpy"); 3432 free($3); 3433 $$->type = PF_STATE_OPT_OVERLOAD; 3434 $$->data.overload.flush = $5; 3435 $$->next = NULL; 3436 $$->tail = $$; 3437 } 3438 | MAXSRCNODES NUMBER { 3439 if ($2 < 0 || $2 > UINT_MAX) { 3440 yyerror("only positive values permitted"); 3441 YYERROR; 3442 } 3443 $$ = calloc(1, sizeof(struct node_state_opt)); 3444 if ($$ == NULL) 3445 err(1, "state_opt_item: calloc"); 3446 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3447 $$->data.max_src_nodes = $2; 3448 $$->next = NULL; 3449 $$->tail = $$; 3450 } 3451 | SOURCETRACK sourcetrack { 3452 $$ = calloc(1, sizeof(struct node_state_opt)); 3453 if ($$ == NULL) 3454 err(1, "state_opt_item: calloc"); 3455 $$->type = PF_STATE_OPT_SRCTRACK; 3456 $$->data.src_track = $2; 3457 $$->next = NULL; 3458 $$->tail = $$; 3459 } 3460 | statelock { 3461 $$ = calloc(1, sizeof(struct node_state_opt)); 3462 if ($$ == NULL) 3463 err(1, "state_opt_item: calloc"); 3464 $$->type = PF_STATE_OPT_STATELOCK; 3465 $$->data.statelock = $1; 3466 $$->next = NULL; 3467 $$->tail = $$; 3468 } 3469 | SLOPPY { 3470 $$ = calloc(1, sizeof(struct node_state_opt)); 3471 if ($$ == NULL) 3472 err(1, "state_opt_item: calloc"); 3473 $$->type = PF_STATE_OPT_SLOPPY; 3474 $$->next = NULL; 3475 $$->tail = $$; 3476 } 3477 | PFLOW { 3478 $$ = calloc(1, sizeof(struct node_state_opt)); 3479 if ($$ == NULL) 3480 err(1, "state_opt_item: calloc"); 3481 $$->type = PF_STATE_OPT_PFLOW; 3482 $$->next = NULL; 3483 $$->tail = $$; 3484 } 3485 | STRING NUMBER { 3486 int i; 3487 3488 if ($2 < 0 || $2 > UINT_MAX) { 3489 yyerror("only positive values permitted"); 3490 YYERROR; 3491 } 3492 for (i = 0; pf_timeouts[i].name && 3493 strcmp(pf_timeouts[i].name, $1); ++i) 3494 ; /* nothing */ 3495 if (!pf_timeouts[i].name) { 3496 yyerror("illegal timeout name %s", $1); 3497 free($1); 3498 YYERROR; 3499 } 3500 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3501 yyerror("illegal state timeout %s", $1); 3502 free($1); 3503 YYERROR; 3504 } 3505 free($1); 3506 $$ = calloc(1, sizeof(struct node_state_opt)); 3507 if ($$ == NULL) 3508 err(1, "state_opt_item: calloc"); 3509 $$->type = PF_STATE_OPT_TIMEOUT; 3510 $$->data.timeout.number = pf_timeouts[i].timeout; 3511 $$->data.timeout.seconds = $2; 3512 $$->next = NULL; 3513 $$->tail = $$; 3514 } 3515 ; 3516 3517label : STRING { 3518 $$ = $1; 3519 } 3520 ; 3521 3522qname : STRING { 3523 struct pfctl_qsitem *qsi; 3524 3525 if ((qsi = pfctl_find_queue($1, &qspecs)) == NULL) { 3526 yyerror("queue %s is not defined", $1); 3527 YYERROR; 3528 } 3529 $$.qname = $1; 3530 $$.pqname = NULL; 3531 } 3532 | '(' STRING ')' { 3533 struct pfctl_qsitem *qsi; 3534 3535 if ((qsi = pfctl_find_queue($2, &qspecs)) == NULL) { 3536 yyerror("queue %s is not defined", $2); 3537 YYERROR; 3538 } 3539 $$.qname = $2; 3540 $$.pqname = NULL; 3541 } 3542 | '(' STRING comma STRING ')' { 3543 struct pfctl_qsitem *qsi, *pqsi; 3544 3545 if ((qsi = pfctl_find_queue($2, &qspecs)) == NULL) { 3546 yyerror("queue %s is not defined", $2); 3547 YYERROR; 3548 } 3549 if ((pqsi = pfctl_find_queue($4, &qspecs)) == NULL) { 3550 yyerror("queue %s is not defined", $4); 3551 YYERROR; 3552 } 3553 $$.qname = $2; 3554 $$.pqname = $4; 3555 } 3556 ; 3557 3558portstar : numberstring { 3559 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3560 free($1); 3561 YYERROR; 3562 } 3563 free($1); 3564 } 3565 ; 3566 3567redirspec : host optweight { 3568 if ($2 > 0) { 3569 struct node_host *n; 3570 for (n = $1; n != NULL; n = n->next) 3571 n->weight = $2; 3572 } 3573 $$ = $1; 3574 } 3575 | '{' optnl redir_host_list '}' { $$ = $3; } 3576 ; 3577 3578redir_host_list : host optweight optnl { 3579 if ($1->addr.type != PF_ADDR_ADDRMASK) { 3580 free($1); 3581 yyerror("only addresses can be listed for " 3582 "redirection pools "); 3583 YYERROR; 3584 } 3585 if ($2 > 0) { 3586 struct node_host *n; 3587 for (n = $1; n != NULL; n = n->next) 3588 n->weight = $2; 3589 } 3590 $$ = $1; 3591 } 3592 | redir_host_list comma host optweight optnl { 3593 $1->tail->next = $3; 3594 $1->tail = $3->tail; 3595 if ($4 > 0) { 3596 struct node_host *n; 3597 for (n = $3; n != NULL; n = n->next) 3598 n->weight = $4; 3599 } 3600 $$ = $1; 3601 } 3602 ; 3603 3604redirpool : redirspec { 3605 $$ = calloc(1, sizeof(struct redirection)); 3606 if ($$ == NULL) 3607 err(1, "redirection: calloc"); 3608 $$->host = $1; 3609 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3610 } 3611 | redirspec PORT portstar { 3612 $$ = calloc(1, sizeof(struct redirection)); 3613 if ($$ == NULL) 3614 err(1, "redirection: calloc"); 3615 $$->host = $1; 3616 $$->rport = $3; 3617 } 3618 ; 3619 3620hashkey : /* empty */ 3621 { 3622 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3623 if ($$ == NULL) 3624 err(1, "hashkey: calloc"); 3625 $$->key32[0] = arc4random(); 3626 $$->key32[1] = arc4random(); 3627 $$->key32[2] = arc4random(); 3628 $$->key32[3] = arc4random(); 3629 } 3630 | string 3631 { 3632 if (!strncmp($1, "0x", 2)) { 3633 if (strlen($1) != 34) { 3634 free($1); 3635 yyerror("hex key must be 128 bits " 3636 "(32 hex digits) long"); 3637 YYERROR; 3638 } 3639 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3640 if ($$ == NULL) 3641 err(1, "hashkey: calloc"); 3642 3643 if (sscanf($1, "0x%8x%8x%8x%8x", 3644 &$$->key32[0], &$$->key32[1], 3645 &$$->key32[2], &$$->key32[3]) != 4) { 3646 free($$); 3647 free($1); 3648 yyerror("invalid hex key"); 3649 YYERROR; 3650 } 3651 } else { 3652 MD5_CTX context; 3653 3654 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3655 if ($$ == NULL) 3656 err(1, "hashkey: calloc"); 3657 MD5Init(&context); 3658 MD5Update(&context, (unsigned char *)$1, 3659 strlen($1)); 3660 MD5Final((unsigned char *)$$, &context); 3661 HTONL($$->key32[0]); 3662 HTONL($$->key32[1]); 3663 HTONL($$->key32[2]); 3664 HTONL($$->key32[3]); 3665 } 3666 free($1); 3667 } 3668 ; 3669 3670pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3671 pool_opts_l 3672 { $$ = pool_opts; } 3673 | /* empty */ { 3674 bzero(&pool_opts, sizeof pool_opts); 3675 $$ = pool_opts; 3676 } 3677 ; 3678 3679pool_opts_l : pool_opts_l pool_opt 3680 | pool_opt 3681 ; 3682 3683pool_opt : BITMASK { 3684 if (pool_opts.type) { 3685 yyerror("pool type cannot be redefined"); 3686 YYERROR; 3687 } 3688 pool_opts.type = PF_POOL_BITMASK; 3689 } 3690 | RANDOM { 3691 if (pool_opts.type) { 3692 yyerror("pool type cannot be redefined"); 3693 YYERROR; 3694 } 3695 pool_opts.type = PF_POOL_RANDOM; 3696 } 3697 | SOURCEHASH hashkey { 3698 if (pool_opts.type) { 3699 yyerror("pool type cannot be redefined"); 3700 YYERROR; 3701 } 3702 pool_opts.type = PF_POOL_SRCHASH; 3703 pool_opts.key = $2; 3704 } 3705 | ROUNDROBIN { 3706 if (pool_opts.type) { 3707 yyerror("pool type cannot be redefined"); 3708 YYERROR; 3709 } 3710 pool_opts.type = PF_POOL_ROUNDROBIN; 3711 } 3712 | LEASTSTATES { 3713 if (pool_opts.type) { 3714 yyerror("pool type cannot be redefined"); 3715 YYERROR; 3716 } 3717 pool_opts.type = PF_POOL_LEASTSTATES; 3718 } 3719 | STATICPORT { 3720 if (pool_opts.staticport) { 3721 yyerror("static-port cannot be redefined"); 3722 YYERROR; 3723 } 3724 pool_opts.staticport = 1; 3725 } 3726 | STICKYADDRESS { 3727 if (filter_opts.marker & POM_STICKYADDRESS) { 3728 yyerror("sticky-address cannot be redefined"); 3729 YYERROR; 3730 } 3731 pool_opts.marker |= POM_STICKYADDRESS; 3732 pool_opts.opts |= PF_POOL_STICKYADDR; 3733 } 3734 ; 3735 3736route_host : STRING { 3737 /* try to find @if0 address specs */ 3738 if (strrchr($1, '@') != NULL) { 3739 if (($$ = host($1)) == NULL) { 3740 yyerror("invalid host for route spec"); 3741 YYERROR; 3742 } 3743 free($1); 3744 } else { 3745 $$ = calloc(1, sizeof(struct node_host)); 3746 if ($$ == NULL) 3747 err(1, "route_host: calloc"); 3748 $$->ifname = $1; 3749 $$->addr.type = PF_ADDR_NONE; 3750 set_ipmask($$, 128); 3751 $$->next = NULL; 3752 $$->tail = $$; 3753 } 3754 } 3755 | STRING '/' STRING { 3756 char *buf; 3757 3758 if (asprintf(&buf, "%s/%s", $1, $3) == -1) 3759 err(1, "host: asprintf"); 3760 free($1); 3761 if (($$ = host(buf)) == NULL) { 3762 /* error. "any" is handled elsewhere */ 3763 free(buf); 3764 yyerror("could not parse host specification"); 3765 YYERROR; 3766 } 3767 free(buf); 3768 } 3769 | '<' STRING '>' { 3770 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 3771 yyerror("table name '%s' too long", $2); 3772 free($2); 3773 YYERROR; 3774 } 3775 $$ = calloc(1, sizeof(struct node_host)); 3776 if ($$ == NULL) 3777 err(1, "host: calloc"); 3778 $$->addr.type = PF_ADDR_TABLE; 3779 if (strlcpy($$->addr.v.tblname, $2, 3780 sizeof($$->addr.v.tblname)) >= 3781 sizeof($$->addr.v.tblname)) 3782 errx(1, "host: strlcpy"); 3783 free($2); 3784 $$->next = NULL; 3785 $$->tail = $$; 3786 } 3787 | dynaddr '/' NUMBER { 3788 struct node_host *n; 3789 3790 if ($3 < 0 || $3 > 128) { 3791 yyerror("bit number too big"); 3792 YYERROR; 3793 } 3794 $$ = $1; 3795 for (n = $1; n != NULL; n = n->next) 3796 set_ipmask(n, $3); 3797 } 3798 | '(' STRING host ')' { 3799 struct node_host *n; 3800 3801 $$ = $3; 3802 /* XXX check masks, only full mask should be allowed */ 3803 for (n = $3; n != NULL; n = n->next) { 3804 if ($$->ifname) { 3805 yyerror("cannot specify interface twice " 3806 "in route spec"); 3807 YYERROR; 3808 } 3809 if (($$->ifname = strdup($2)) == NULL) 3810 errx(1, "host: strdup"); 3811 } 3812 free($2); 3813 } 3814 ; 3815 3816route_host_list : route_host optweight optnl { 3817 if ($2 > 0) { 3818 struct node_host *n; 3819 for (n = $1; n != NULL; n = n->next) 3820 n->weight = $2; 3821 } 3822 $$ = $1; 3823 } 3824 | route_host_list comma route_host optweight optnl { 3825 if ($1->af == 0) 3826 $1->af = $3->af; 3827 if ($1->af != $3->af) { 3828 yyerror("all pool addresses must be in the " 3829 "same address family"); 3830 YYERROR; 3831 } 3832 $1->tail->next = $3; 3833 $1->tail = $3->tail; 3834 if ($4 > 0) { 3835 struct node_host *n; 3836 for (n = $3; n != NULL; n = n->next) 3837 n->weight = $4; 3838 } 3839 $$ = $1; 3840 } 3841 ; 3842 3843routespec : route_host optweight { 3844 if ($2 > 0) { 3845 struct node_host *n; 3846 for (n = $1; n != NULL; n = n->next) 3847 n->weight = $2; 3848 } 3849 $$ = $1; 3850 } 3851 | '{' optnl route_host_list '}' { $$ = $3; } 3852 ; 3853 3854timeout_spec : STRING NUMBER 3855 { 3856 if ($2 < 0 || $2 > UINT_MAX) { 3857 yyerror("only positive values permitted"); 3858 YYERROR; 3859 } 3860 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3861 yyerror("unknown timeout %s", $1); 3862 free($1); 3863 YYERROR; 3864 } 3865 free($1); 3866 } 3867 ; 3868 3869timeout_list : timeout_list comma timeout_spec optnl 3870 | timeout_spec optnl 3871 ; 3872 3873limit_spec : STRING NUMBER 3874 { 3875 if ($2 < 0 || $2 > UINT_MAX) { 3876 yyerror("only positive values permitted"); 3877 YYERROR; 3878 } 3879 if (pfctl_set_limit(pf, $1, $2) != 0) { 3880 yyerror("unable to set limit %s %u", $1, $2); 3881 free($1); 3882 YYERROR; 3883 } 3884 free($1); 3885 } 3886 ; 3887 3888limit_list : limit_list comma limit_spec optnl 3889 | limit_spec optnl 3890 ; 3891 3892comma : ',' 3893 | /* empty */ 3894 ; 3895 3896yesno : NO { $$ = 0; } 3897 | STRING { 3898 if (!strcmp($1, "yes")) 3899 $$ = 1; 3900 else { 3901 yyerror("invalid value '%s', expected 'yes' " 3902 "or 'no'", $1); 3903 free($1); 3904 YYERROR; 3905 } 3906 free($1); 3907 } 3908 ; 3909 3910unaryop : '=' { $$ = PF_OP_EQ; } 3911 | NE { $$ = PF_OP_NE; } 3912 | LE { $$ = PF_OP_LE; } 3913 | '<' { $$ = PF_OP_LT; } 3914 | GE { $$ = PF_OP_GE; } 3915 | '>' { $$ = PF_OP_GT; } 3916 ; 3917 3918%% 3919 3920int 3921yyerror(const char *fmt, ...) 3922{ 3923 va_list ap; 3924 3925 file->errors++; 3926 va_start(ap, fmt); 3927 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 3928 vfprintf(stderr, fmt, ap); 3929 fprintf(stderr, "\n"); 3930 va_end(ap); 3931 return (0); 3932} 3933 3934int 3935disallow_table(struct node_host *h, const char *fmt) 3936{ 3937 for (; h != NULL; h = h->next) 3938 if (h->addr.type == PF_ADDR_TABLE) { 3939 yyerror(fmt, h->addr.v.tblname); 3940 return (1); 3941 } 3942 return (0); 3943} 3944 3945int 3946disallow_urpf_failed(struct node_host *h, const char *fmt) 3947{ 3948 for (; h != NULL; h = h->next) 3949 if (h->addr.type == PF_ADDR_URPFFAILED) { 3950 yyerror(fmt); 3951 return (1); 3952 } 3953 return (0); 3954} 3955 3956int 3957disallow_alias(struct node_host *h, const char *fmt) 3958{ 3959 for (; h != NULL; h = h->next) 3960 if (DYNIF_MULTIADDR(h->addr)) { 3961 yyerror(fmt, h->addr.v.tblname); 3962 return (1); 3963 } 3964 return (0); 3965} 3966 3967int 3968rule_consistent(struct pf_rule *r, int anchor_call) 3969{ 3970 int problems = 0; 3971 3972 if (r->proto != IPPROTO_TCP && r->os_fingerprint != PF_OSFP_ANY) { 3973 yyerror("os only applies to tcp"); 3974 problems++; 3975 } 3976 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3977 (r->src.port_op || r->dst.port_op)) { 3978 yyerror("port only applies to tcp/udp"); 3979 problems++; 3980 } 3981 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3982 r->uid.op) { 3983 yyerror("user only applies to tcp/udp"); 3984 problems++; 3985 } 3986 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3987 r->gid.op) { 3988 yyerror("group only applies to tcp/udp"); 3989 problems++; 3990 } 3991 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3992 (r->type || r->code)) { 3993 yyerror("icmp-type/code only applies to icmp"); 3994 problems++; 3995 } 3996 if (!r->af && (r->type || r->code)) { 3997 yyerror("must indicate address family with icmp-type/code"); 3998 problems++; 3999 } 4000 if (r->rule_flag & PFRULE_AFTO && r->af == r->naf) { 4001 yyerror("must indicate different address family with af-to"); 4002 problems++; 4003 } 4004 if (r->overload_tblname[0] && 4005 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 4006 yyerror("'overload' requires 'max-src-conn' " 4007 "or 'max-src-conn-rate'"); 4008 problems++; 4009 } 4010 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 4011 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 4012 yyerror("proto %s doesn't match address family %s", 4013 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 4014 r->af == AF_INET ? "inet" : "inet6"); 4015 problems++; 4016 } 4017 if (r->allow_opts && r->action != PF_PASS) { 4018 yyerror("allow-opts can only be specified for pass rules"); 4019 problems++; 4020 } 4021 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 4022 r->dst.port_op || r->flagset || r->type || r->code)) { 4023 yyerror("fragments can be filtered only on IP header fields"); 4024 problems++; 4025 } 4026 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 4027 yyerror("return-rst can only be applied to TCP rules"); 4028 problems++; 4029 } 4030 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 4031 yyerror("max-src-nodes requires 'source-track rule'"); 4032 problems++; 4033 } 4034 if (r->action != PF_PASS && r->keep_state) { 4035 yyerror("keep state is great, but only for pass rules"); 4036 problems++; 4037 } 4038 if (r->rule_flag & PFRULE_STATESLOPPY && 4039 (r->keep_state == PF_STATE_MODULATE || 4040 r->keep_state == PF_STATE_SYNPROXY)) { 4041 yyerror("sloppy state matching cannot be used with " 4042 "synproxy state or modulate state"); 4043 problems++; 4044 } 4045 if ((r->nat.addr.type != PF_ADDR_NONE || 4046 r->rdr.addr.type != PF_ADDR_NONE) && 4047 r->action != PF_MATCH && !r->keep_state) { 4048 yyerror("nat-to and rdr-to require keep state"); 4049 problems++; 4050 } 4051 if (r->direction == PF_INOUT && (r->nat.addr.type != PF_ADDR_NONE || 4052 r->rdr.addr.type != PF_ADDR_NONE)) { 4053 yyerror("nat-to and rdr-to require a direction"); 4054 problems++; 4055 } 4056 if (r->af == AF_INET6 && (r->scrub_flags & 4057 (PFSTATE_NODF|PFSTATE_RANDOMID))) { 4058 yyerror("address family inet6 does not support scrub options " 4059 "no-df, random-id"); 4060 problems++; 4061 } 4062 4063 /* Basic rule sanity check. */ 4064 switch (r->action) { 4065 case PF_MATCH: 4066 if (r->divert.port) { 4067 yyerror("divert is not supported on match rules"); 4068 problems++; 4069 } 4070 if (r->divert_packet.port) { 4071 yyerror("divert is not supported on match rules"); 4072 problems++; 4073 } 4074 if (r->rt) { 4075 yyerror("route-to, reply-to and dup-to " 4076 "are not supported on match rules"); 4077 problems++; 4078 } 4079 if (r->rule_flag & PFRULE_AFTO) { 4080 yyerror("af-to is not supported on match rules"); 4081 problems++; 4082 } 4083 break; 4084 case PF_DROP: 4085 if (r->rt) { 4086 yyerror("route-to, reply-to and dup-to " 4087 "are not supported on block rules"); 4088 problems++; 4089 } 4090 break; 4091 default:; 4092 } 4093 return (-problems); 4094} 4095 4096int 4097process_tabledef(char *name, struct table_opts *opts) 4098{ 4099 struct pfr_buffer ab; 4100 struct node_tinit *ti; 4101 4102 bzero(&ab, sizeof(ab)); 4103 ab.pfrb_type = PFRB_ADDRS; 4104 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4105 if (ti->file) 4106 if (pfr_buf_load(&ab, ti->file, 0)) { 4107 if (errno) 4108 yyerror("cannot load \"%s\": %s", 4109 ti->file, strerror(errno)); 4110 else 4111 yyerror("file \"%s\" contains bad data", 4112 ti->file); 4113 goto _error; 4114 } 4115 if (ti->host) 4116 if (append_addr_host(&ab, ti->host, 0, 0)) { 4117 yyerror("cannot create address buffer: %s", 4118 strerror(errno)); 4119 goto _error; 4120 } 4121 } 4122 if (pf->opts & PF_OPT_VERBOSE) 4123 print_tabledef(name, opts->flags, opts->init_addr, 4124 &opts->init_nodes); 4125 if (!(pf->opts & PF_OPT_NOACTION) && 4126 pfctl_define_table(name, opts->flags, opts->init_addr, 4127 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4128 yyerror("cannot define table %s: %s", name, 4129 pfr_strerror(errno)); 4130 goto _error; 4131 } 4132 pf->tdirty = 1; 4133 pfr_buf_clear(&ab); 4134 return (0); 4135_error: 4136 pfr_buf_clear(&ab); 4137 return (-1); 4138} 4139 4140struct keywords { 4141 const char *k_name; 4142 int k_val; 4143}; 4144 4145/* macro gore, but you should've seen the prior indentation nightmare... */ 4146 4147#define FREE_LIST(T,r) \ 4148 do { \ 4149 T *p, *node = r; \ 4150 while (node != NULL) { \ 4151 p = node; \ 4152 node = node->next; \ 4153 free(p); \ 4154 } \ 4155 } while (0) 4156 4157#define LOOP_THROUGH(T,n,r,C) \ 4158 do { \ 4159 T *n; \ 4160 if (r == NULL) { \ 4161 r = calloc(1, sizeof(T)); \ 4162 if (r == NULL) \ 4163 err(1, "LOOP: calloc"); \ 4164 r->next = NULL; \ 4165 } \ 4166 n = r; \ 4167 while (n != NULL) { \ 4168 do { \ 4169 C; \ 4170 } while (0); \ 4171 n = n->next; \ 4172 } \ 4173 } while (0) 4174 4175void 4176expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4177{ 4178 char *tmp; 4179 char *p, *q; 4180 4181 if ((tmp = calloc(1, len)) == NULL) 4182 err(1, "expand_label_str: calloc"); 4183 p = q = label; 4184 while ((q = strstr(p, srch)) != NULL) { 4185 *q = '\0'; 4186 if ((strlcat(tmp, p, len) >= len) || 4187 (strlcat(tmp, repl, len) >= len)) 4188 errx(1, "expand_label: label too long"); 4189 q += strlen(srch); 4190 p = q; 4191 } 4192 if (strlcat(tmp, p, len) >= len) 4193 errx(1, "expand_label: label too long"); 4194 strlcpy(label, tmp, len); /* always fits */ 4195 free(tmp); 4196} 4197 4198void 4199expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4200{ 4201 if (strstr(label, name) != NULL) { 4202 if (!*ifname) 4203 expand_label_str(label, len, name, "any"); 4204 else 4205 expand_label_str(label, len, name, ifname); 4206 } 4207} 4208 4209void 4210expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4211 struct node_host *h) 4212{ 4213 char tmp[64], tmp_not[66]; 4214 4215 if (strstr(label, name) != NULL) { 4216 switch (h->addr.type) { 4217 case PF_ADDR_DYNIFTL: 4218 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4219 break; 4220 case PF_ADDR_TABLE: 4221 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4222 break; 4223 case PF_ADDR_NOROUTE: 4224 snprintf(tmp, sizeof(tmp), "no-route"); 4225 break; 4226 case PF_ADDR_URPFFAILED: 4227 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4228 break; 4229 case PF_ADDR_ADDRMASK: 4230 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4231 PF_AZERO(&h->addr.v.a.mask, af))) 4232 snprintf(tmp, sizeof(tmp), "any"); 4233 else { 4234 char a[48]; 4235 int bits; 4236 4237 if (inet_ntop(af, &h->addr.v.a.addr, a, 4238 sizeof(a)) == NULL) 4239 snprintf(tmp, sizeof(tmp), "?"); 4240 else { 4241 bits = unmask(&h->addr.v.a.mask, af); 4242 if ((af == AF_INET && bits < 32) || 4243 (af == AF_INET6 && bits < 128)) 4244 snprintf(tmp, sizeof(tmp), 4245 "%s/%d", a, bits); 4246 else 4247 snprintf(tmp, sizeof(tmp), 4248 "%s", a); 4249 } 4250 } 4251 break; 4252 default: 4253 snprintf(tmp, sizeof(tmp), "?"); 4254 break; 4255 } 4256 4257 if (h->not) { 4258 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4259 expand_label_str(label, len, name, tmp_not); 4260 } else 4261 expand_label_str(label, len, name, tmp); 4262 } 4263} 4264 4265void 4266expand_label_port(const char *name, char *label, size_t len, 4267 struct node_port *port) 4268{ 4269 char a1[6], a2[6], op[13] = ""; 4270 4271 if (strstr(label, name) != NULL) { 4272 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4273 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4274 if (!port->op) 4275 ; 4276 else if (port->op == PF_OP_IRG) 4277 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4278 else if (port->op == PF_OP_XRG) 4279 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4280 else if (port->op == PF_OP_EQ) 4281 snprintf(op, sizeof(op), "%s", a1); 4282 else if (port->op == PF_OP_NE) 4283 snprintf(op, sizeof(op), "!=%s", a1); 4284 else if (port->op == PF_OP_LT) 4285 snprintf(op, sizeof(op), "<%s", a1); 4286 else if (port->op == PF_OP_LE) 4287 snprintf(op, sizeof(op), "<=%s", a1); 4288 else if (port->op == PF_OP_GT) 4289 snprintf(op, sizeof(op), ">%s", a1); 4290 else if (port->op == PF_OP_GE) 4291 snprintf(op, sizeof(op), ">=%s", a1); 4292 expand_label_str(label, len, name, op); 4293 } 4294} 4295 4296void 4297expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4298{ 4299 struct protoent *pe; 4300 char n[4]; 4301 4302 if (strstr(label, name) != NULL) { 4303 pe = getprotobynumber(proto); 4304 if (pe != NULL) 4305 expand_label_str(label, len, name, pe->p_name); 4306 else { 4307 snprintf(n, sizeof(n), "%u", proto); 4308 expand_label_str(label, len, name, n); 4309 } 4310 } 4311} 4312 4313void 4314expand_label_nr(const char *name, char *label, size_t len) 4315{ 4316 char n[11]; 4317 4318 if (strstr(label, name) != NULL) { 4319 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4320 expand_label_str(label, len, name, n); 4321 } 4322} 4323 4324void 4325expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4326 struct node_host *src_host, struct node_port *src_port, 4327 struct node_host *dst_host, struct node_port *dst_port, 4328 u_int8_t proto) 4329{ 4330 expand_label_if("$if", label, len, ifname); 4331 expand_label_addr("$srcaddr", label, len, af, src_host); 4332 expand_label_addr("$dstaddr", label, len, af, dst_host); 4333 expand_label_port("$srcport", label, len, src_port); 4334 expand_label_port("$dstport", label, len, dst_port); 4335 expand_label_proto("$proto", label, len, proto); 4336 expand_label_nr("$nr", label, len); 4337} 4338 4339int 4340expand_queue(char *qname, struct node_if *interfaces, struct queue_opts *opts) 4341{ 4342 struct pf_queuespec qspec; 4343 4344 LOOP_THROUGH(struct node_if, interface, interfaces, 4345 bzero(&qspec, sizeof(qspec)); 4346 if ((opts->flags & PFQS_FLOWQUEUE) && opts->parent) { 4347 yyerror("discipline doesn't support hierarchy"); 4348 return (1); 4349 } 4350 if (strlcpy(qspec.qname, qname, sizeof(qspec.qname)) >= 4351 sizeof(qspec.qname)) { 4352 yyerror("queuename too long"); 4353 return (1); 4354 } 4355 if (opts->parent && strlcpy(qspec.parent, opts->parent, 4356 sizeof(qspec.parent)) >= sizeof(qspec.parent)) { 4357 yyerror("parent too long"); 4358 return (1); 4359 } 4360 if (strlcpy(qspec.ifname, interface->ifname, 4361 sizeof(qspec.ifname)) >= sizeof(qspec.ifname)) { 4362 yyerror("interface too long"); 4363 return (1); 4364 } 4365 qspec.realtime.m1.absolute = opts->realtime.m1.bw_absolute; 4366 qspec.realtime.m1.percent = opts->realtime.m1.bw_percent; 4367 qspec.realtime.m2.absolute = opts->realtime.m2.bw_absolute; 4368 qspec.realtime.m2.percent = opts->realtime.m2.bw_percent; 4369 qspec.realtime.d = opts->realtime.d; 4370 4371 qspec.linkshare.m1.absolute = opts->linkshare.m1.bw_absolute; 4372 qspec.linkshare.m1.percent = opts->linkshare.m1.bw_percent; 4373 qspec.linkshare.m2.absolute = opts->linkshare.m2.bw_absolute; 4374 qspec.linkshare.m2.percent = opts->linkshare.m2.bw_percent; 4375 qspec.linkshare.d = opts->linkshare.d; 4376 4377 qspec.upperlimit.m1.absolute = opts->upperlimit.m1.bw_absolute; 4378 qspec.upperlimit.m1.percent = opts->upperlimit.m1.bw_percent; 4379 qspec.upperlimit.m2.absolute = opts->upperlimit.m2.bw_absolute; 4380 qspec.upperlimit.m2.percent = opts->upperlimit.m2.bw_percent; 4381 qspec.upperlimit.d = opts->upperlimit.d; 4382 4383 qspec.flowqueue.flows = opts->flowqueue.flows; 4384 qspec.flowqueue.quantum = opts->flowqueue.quantum; 4385 qspec.flowqueue.interval = opts->flowqueue.interval; 4386 qspec.flowqueue.target = opts->flowqueue.target; 4387 4388 qspec.flags = opts->flags; 4389 qspec.qlimit = opts->qlimit; 4390 4391 if (pfctl_add_queue(pf, &qspec)) { 4392 yyerror("cannot add queue"); 4393 return (1); 4394 } 4395 ); 4396 4397 FREE_LIST(struct node_if, interfaces); 4398 return (0); 4399} 4400 4401int 4402expand_divertspec(struct pf_rule *r, struct divertspec *ds) 4403{ 4404 struct node_host *n; 4405 4406 if (ds->port == 0) 4407 return (0); 4408 4409 r->divert.port = ds->port; 4410 4411 if (r->direction == PF_OUT) { 4412 if (ds->addr) { 4413 yyerror("address specified for outgoing divert"); 4414 return (1); 4415 } 4416 bzero(&r->divert.addr, sizeof(r->divert.addr)); 4417 return (0); 4418 } 4419 4420 if (!ds->addr) { 4421 yyerror("no address specified for incoming divert"); 4422 return (1); 4423 } 4424 if (r->af) { 4425 for (n = ds->addr; n != NULL; n = n->next) 4426 if (n->af == r->af) 4427 break; 4428 if (n == NULL) { 4429 yyerror("address family mismatch for divert"); 4430 return (1); 4431 } 4432 r->divert.addr = n->addr.v.a.addr; 4433 } else { 4434 r->af = ds->addr->af; 4435 r->divert.addr = ds->addr->addr.v.a.addr; 4436 } 4437 return (0); 4438} 4439 4440int 4441collapse_redirspec(struct pf_pool *rpool, struct pf_rule *r, 4442 struct redirspec *rs, u_int8_t allow_if) 4443{ 4444 struct pf_opt_tbl *tbl = NULL; 4445 struct node_host *h, *hprev = NULL; 4446 struct pf_rule_addr ra; 4447 int af = 0, naddr = 0; 4448 4449 if (!rs || !rs->rdr || rs->rdr->host == NULL) { 4450 rpool->addr.type = PF_ADDR_NONE; 4451 return (0); 4452 } 4453 4454 if (r->rule_flag & PFRULE_AFTO) 4455 r->naf = rs->af; 4456 4457 for (h = rs->rdr->host; h != NULL; h = h->next) { 4458 /* set rule address family if redirect spec has one */ 4459 if (rs->af && !r->af && !af) { 4460 /* swap address families for af-to */ 4461 if (r->naf == AF_INET6) 4462 af = AF_INET; 4463 else if (r->naf == AF_INET) 4464 af = AF_INET6; 4465 else 4466 af = rs->af; 4467 } 4468 if (h->af && !r->naf) { /* nat-to/rdr-to case */ 4469 /* skip if the rule af doesn't match redirect af */ 4470 if (r->af && r->af != h->af) 4471 continue; 4472 /* 4473 * fail if the chosen af is not universal for 4474 * all addresses in the redirect address pool 4475 */ 4476 if (!r->af && af && af != h->af) { 4477 yyerror("%s spec contains addresses with " 4478 "different address families", 4479 allow_if ? "routing" : "translation"); 4480 return (1); 4481 } 4482 } else if (h->af) { /* af-to case */ 4483 /* 4484 * fail if the redirect spec af is not universal 4485 * for all addresses in the redirect address pool 4486 */ 4487 if (rs->af && rs->af != h->af) { 4488 yyerror("%s spec contains addresses that " 4489 "don't match target address family", 4490 allow_if ? "routing" : "translation"); 4491 return (1); 4492 } 4493 } 4494 /* else if (!h->af): 4495 * we silently allow any not af-specific host specs, 4496 * e.g. (em0) and let the kernel deal with them 4497 */ 4498 4499 /* if we haven't selected the rule af yet, now it's time */ 4500 if (!r->af && !af) 4501 af = h->af; 4502 4503 if (naddr == 0) { /* the first host */ 4504 rpool->addr = h->addr; 4505 if (!allow_if && h->ifname) { 4506 yyerror("@if not permitted for translation"); 4507 return (1); 4508 } 4509 if (h->ifname && strlcpy(rpool->ifname, h->ifname, 4510 sizeof(rpool->ifname)) >= sizeof(rpool->ifname)) 4511 errx(1, "collapse_redirspec: strlcpy"); 4512 hprev = h; /* in case we need to conver to a table */ 4513 } else { /* multiple hosts */ 4514 if (rs->pool_opts.type && 4515 !PF_POOL_DYNTYPE(rs->pool_opts.type)) { 4516 yyerror("pool type is not valid for multiple " 4517 "translation or routing addresses"); 4518 return (1); 4519 } 4520 if ((hprev && hprev->addr.type != PF_ADDR_ADDRMASK) && 4521 (hprev && hprev->addr.type != PF_ADDR_NONE) && 4522 h->addr.type != PF_ADDR_ADDRMASK && 4523 h->addr.type != PF_ADDR_NONE) { 4524 yyerror("multiple tables or dynamic interfaces " 4525 "not supported for translation or routing"); 4526 return (1); 4527 } 4528 if (!allow_if && h->ifname) { 4529 yyerror("@if not permitted for translation"); 4530 return (1); 4531 } 4532 if (hprev) { 4533 /* 4534 * undo some damage and convert the single 4535 * host pool to the table 4536 */ 4537 memset(&ra, 0, sizeof(ra)); 4538 memset(rpool->ifname, 0, sizeof(rpool->ifname)); 4539 ra.addr = hprev->addr; 4540 ra.weight = hprev->weight; 4541 if (add_opt_table(pf, &tbl, 4542 hprev->af, &ra, hprev->ifname)) 4543 return (1); 4544 hprev = NULL; 4545 } 4546 memset(&ra, 0, sizeof(ra)); 4547 ra.addr = h->addr; 4548 ra.weight = h->weight; 4549 if (add_opt_table(pf, &tbl, 4550 h->af, &ra, h->ifname)) 4551 return (1); 4552 } 4553 naddr++; 4554 } 4555 /* set rule af to the one chosen above */ 4556 if (!r->af && af) 4557 r->af = af; 4558 if (!naddr) { 4559 yyerror("af mismatch in %s spec", 4560 allow_if ? "routing" : "translation"); 4561 return (1); 4562 } 4563 if (tbl) { 4564 if ((pf->opts & PF_OPT_NOACTION) == 0 && 4565 pf_opt_create_table(pf, tbl)) 4566 return (1); 4567 4568 pf->tdirty = 1; 4569 4570 if (pf->opts & PF_OPT_VERBOSE) 4571 print_tabledef(tbl->pt_name, 4572 PFR_TFLAG_CONST | tbl->pt_flags, 4573 1, &tbl->pt_nodes); 4574 4575 memset(&rpool->addr, 0, sizeof(rpool->addr)); 4576 rpool->addr.type = PF_ADDR_TABLE; 4577 strlcpy(rpool->addr.v.tblname, tbl->pt_name, 4578 sizeof(rpool->addr.v.tblname)); 4579 4580 pfr_buf_clear(tbl->pt_buf); 4581 free(tbl->pt_buf); 4582 tbl->pt_buf = NULL; 4583 free(tbl); 4584 } 4585 return (0); 4586} 4587 4588 4589int 4590apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, 4591 int isrdr, struct node_port *np) 4592{ 4593 if (!rs || !rs->rdr) 4594 return (0); 4595 4596 rpool->proxy_port[0] = ntohs(rs->rdr->rport.a); 4597 4598 if (isrdr) { 4599 if (!rs->rdr->rport.b && rs->rdr->rport.t && np->port != NULL) { 4600 rpool->proxy_port[1] = ntohs(rs->rdr->rport.a) + 4601 (ntohs(np->port[1]) - ntohs(np->port[0])); 4602 } else 4603 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4604 } else { 4605 rpool->proxy_port[1] = ntohs(rs->rdr->rport.b); 4606 if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { 4607 rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW; 4608 rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH; 4609 } else if (!rpool->proxy_port[1]) 4610 rpool->proxy_port[1] = rpool->proxy_port[0]; 4611 } 4612 4613 rpool->opts = rs->pool_opts.type; 4614 if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_NONE && 4615 (rpool->addr.type == PF_ADDR_TABLE || 4616 DYNIF_MULTIADDR(rpool->addr))) 4617 rpool->opts |= PF_POOL_ROUNDROBIN; 4618 4619 if (!PF_POOL_DYNTYPE(rpool->opts) && 4620 (disallow_table(rs->rdr->host, 4621 "tables are not supported by pool type") || 4622 disallow_alias(rs->rdr->host, 4623 "interface (%s) is not supported by pool type"))) 4624 return (1); 4625 4626 if (rs->pool_opts.key != NULL) 4627 memcpy(&rpool->key, rs->pool_opts.key, 4628 sizeof(struct pf_poolhashkey)); 4629 4630 if (rs->pool_opts.opts) 4631 rpool->opts |= rs->pool_opts.opts; 4632 4633 if (rs->pool_opts.staticport) { 4634 if (isrdr) { 4635 yyerror("the 'static-port' option is only valid with " 4636 "nat rules"); 4637 return (1); 4638 } 4639 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 4640 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 4641 yyerror("the 'static-port' option can't be used when " 4642 "specifying a port range"); 4643 return (1); 4644 } 4645 rpool->proxy_port[0] = 0; 4646 rpool->proxy_port[1] = 0; 4647 } 4648 4649 return (0); 4650} 4651 4652 4653void 4654expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces, 4655 struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute, 4656 struct node_proto *protos, struct node_os *src_oses, 4657 struct node_host *src_hosts, struct node_port *src_ports, 4658 struct node_host *dst_hosts, struct node_port *dst_ports, 4659 struct node_uid *uids, struct node_gid *gids, struct node_if *rcv, 4660 struct node_icmp *icmp_types, const char *anchor_call) 4661{ 4662 sa_family_t af = r->af; 4663 int added = 0, error = 0; 4664 char ifname[IF_NAMESIZE]; 4665 char label[PF_RULE_LABEL_SIZE]; 4666 char tagname[PF_TAG_NAME_SIZE]; 4667 char match_tagname[PF_TAG_NAME_SIZE]; 4668 u_int8_t flags, flagset, keep_state; 4669 struct node_host *srch, *dsth, *osrch, *odsth; 4670 struct redirspec binat; 4671 struct pf_rule rb; 4672 int dir = r->direction; 4673 4674 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4675 errx(1, "expand_rule: strlcpy"); 4676 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4677 errx(1, "expand_rule: strlcpy"); 4678 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4679 sizeof(match_tagname)) 4680 errx(1, "expand_rule: strlcpy"); 4681 flags = r->flags; 4682 flagset = r->flagset; 4683 keep_state = r->keep_state; 4684 4685 r->src.addr.type = r->dst.addr.type = PF_ADDR_ADDRMASK; 4686 4687 LOOP_THROUGH(struct node_if, interface, interfaces, 4688 LOOP_THROUGH(struct node_proto, proto, protos, 4689 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4690 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4691 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4692 LOOP_THROUGH(struct node_port, src_port, src_ports, 4693 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4694 LOOP_THROUGH(struct node_os, src_os, src_oses, 4695 LOOP_THROUGH(struct node_uid, uid, uids, 4696 LOOP_THROUGH(struct node_gid, gid, gids, 4697 4698 r->af = af; 4699 4700 error += collapse_redirspec(&r->rdr, r, rdr, 0); 4701 error += collapse_redirspec(&r->nat, r, nat, 0); 4702 error += collapse_redirspec(&r->route, r, rroute, 1); 4703 4704 /* disallow @if in from or to for the time being */ 4705 if ((src_host->addr.type == PF_ADDR_ADDRMASK && 4706 src_host->ifname) || 4707 (dst_host->addr.type == PF_ADDR_ADDRMASK && 4708 dst_host->ifname)) { 4709 yyerror("@if syntax not permitted in from or to"); 4710 error++; 4711 } 4712 /* for link-local IPv6 address, interface must match up */ 4713 if ((r->af && src_host->af && r->af != src_host->af) || 4714 (r->af && dst_host->af && r->af != dst_host->af) || 4715 (src_host->af && dst_host->af && 4716 src_host->af != dst_host->af) || 4717 (src_host->ifindex && dst_host->ifindex && 4718 src_host->ifindex != dst_host->ifindex) || 4719 (src_host->ifindex && *interface->ifname && 4720 src_host->ifindex != ifa_nametoindex(interface->ifname)) || 4721 (dst_host->ifindex && *interface->ifname && 4722 dst_host->ifindex != ifa_nametoindex(interface->ifname))) 4723 continue; 4724 if (!r->af && src_host->af) 4725 r->af = src_host->af; 4726 else if (!r->af && dst_host->af) 4727 r->af = dst_host->af; 4728 4729 if (*interface->ifname) 4730 strlcpy(r->ifname, interface->ifname, 4731 sizeof(r->ifname)); 4732 else if (ifa_indextoname(src_host->ifindex, ifname)) 4733 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4734 else if (ifa_indextoname(dst_host->ifindex, ifname)) 4735 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4736 else 4737 memset(r->ifname, '\0', sizeof(r->ifname)); 4738 4739 if (interface->use_rdomain) 4740 r->onrdomain = interface->rdomain; 4741 else 4742 r->onrdomain = -1; 4743 if (strlcpy(r->label, label, sizeof(r->label)) >= 4744 sizeof(r->label)) 4745 errx(1, "expand_rule: strlcpy"); 4746 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4747 sizeof(r->tagname)) 4748 errx(1, "expand_rule: strlcpy"); 4749 if (strlcpy(r->match_tagname, match_tagname, 4750 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4751 errx(1, "expand_rule: strlcpy"); 4752 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4753 src_host, src_port, dst_host, dst_port, proto->proto); 4754 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4755 src_host, src_port, dst_host, dst_port, proto->proto); 4756 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4757 r->af, src_host, src_port, dst_host, dst_port, 4758 proto->proto); 4759 4760 osrch = odsth = NULL; 4761 if (src_host->addr.type == PF_ADDR_DYNIFTL) { 4762 osrch = src_host; 4763 if ((src_host = gen_dynnode(src_host, r->af)) == NULL) 4764 err(1, "expand_rule: calloc"); 4765 } 4766 if (dst_host->addr.type == PF_ADDR_DYNIFTL) { 4767 odsth = dst_host; 4768 if ((dst_host = gen_dynnode(dst_host, r->af)) == NULL) 4769 err(1, "expand_rule: calloc"); 4770 } 4771 4772 error += check_netmask(src_host, r->af); 4773 error += check_netmask(dst_host, r->af); 4774 4775 r->ifnot = interface->not; 4776 r->proto = proto->proto; 4777 r->src.addr = src_host->addr; 4778 r->src.neg = src_host->not; 4779 r->src.port[0] = src_port->port[0]; 4780 r->src.port[1] = src_port->port[1]; 4781 r->src.port_op = src_port->op; 4782 r->dst.addr = dst_host->addr; 4783 r->dst.neg = dst_host->not; 4784 r->dst.port[0] = dst_port->port[0]; 4785 r->dst.port[1] = dst_port->port[1]; 4786 r->dst.port_op = dst_port->op; 4787 r->uid.op = uid->op; 4788 r->uid.uid[0] = uid->uid[0]; 4789 r->uid.uid[1] = uid->uid[1]; 4790 r->gid.op = gid->op; 4791 r->gid.gid[0] = gid->gid[0]; 4792 r->gid.gid[1] = gid->gid[1]; 4793 if (rcv) { 4794 strlcpy(r->rcv_ifname, rcv->ifname, 4795 sizeof(r->rcv_ifname)); 4796 r->rcvifnot = rcv->not; 4797 } 4798 r->type = icmp_type->type; 4799 r->code = icmp_type->code; 4800 4801 if ((keep_state == PF_STATE_MODULATE || 4802 keep_state == PF_STATE_SYNPROXY) && 4803 r->proto && r->proto != IPPROTO_TCP) 4804 r->keep_state = PF_STATE_NORMAL; 4805 else 4806 r->keep_state = keep_state; 4807 4808 if (r->proto && r->proto != IPPROTO_TCP) { 4809 r->flags = 0; 4810 r->flagset = 0; 4811 } else { 4812 r->flags = flags; 4813 r->flagset = flagset; 4814 } 4815 if (icmp_type->proto && r->proto != icmp_type->proto) { 4816 yyerror("icmp-type mismatch"); 4817 error++; 4818 } 4819 4820 if (src_os && src_os->os) { 4821 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4822 if ((pf->opts & PF_OPT_VERBOSE2) && 4823 r->os_fingerprint == PF_OSFP_NOMATCH) 4824 fprintf(stderr, 4825 "warning: unknown '%s' OS fingerprint\n", 4826 src_os->os); 4827 } else { 4828 r->os_fingerprint = PF_OSFP_ANY; 4829 } 4830 4831 if (nat && nat->rdr && nat->binat) { 4832 if (disallow_table(src_host, "invalid use of table " 4833 "<%s> as the source address of a binat-to rule") || 4834 disallow_alias(src_host, "invalid use of interface " 4835 "(%s) as the source address of a binat-to rule")) { 4836 error++; 4837 } else if ((r->src.addr.type != PF_ADDR_ADDRMASK && 4838 r->src.addr.type != PF_ADDR_DYNIFTL) || 4839 (r->nat.addr.type != PF_ADDR_ADDRMASK && 4840 r->nat.addr.type != PF_ADDR_DYNIFTL)) { 4841 yyerror("binat-to requires a specified " 4842 "source and redirect address"); 4843 error++; 4844 } 4845 if (DYNIF_MULTIADDR(r->src.addr) || 4846 DYNIF_MULTIADDR(r->nat.addr)) { 4847 yyerror ("dynamic interfaces must be used with " 4848 ":0 in a binat-to rule"); 4849 error++; 4850 } 4851 if (PF_AZERO(&r->src.addr.v.a.mask, af) || 4852 PF_AZERO(&r->nat.addr.v.a.mask, af)) { 4853 yyerror ("source and redir addresess must have " 4854 "a matching network mask in binat-rule"); 4855 error++; 4856 } 4857 if (r->nat.addr.type == PF_ADDR_TABLE) { 4858 yyerror ("tables cannot be used as the redirect " 4859 "address of a binat-to rule"); 4860 error++; 4861 } 4862 if (r->direction != PF_INOUT) { 4863 yyerror("binat-to cannot be specified " 4864 "with a direction"); 4865 error++; 4866 } 4867 4868 /* first specify outbound NAT rule */ 4869 r->direction = PF_OUT; 4870 } 4871 4872 error += apply_redirspec(&r->nat, r, nat, 0, dst_port); 4873 error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port); 4874 error += apply_redirspec(&r->route, r, rroute, 2, dst_port); 4875 4876 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4877 yyerror("skipping rule due to errors"); 4878 else { 4879 r->nr = pf->astack[pf->asd]->match++; 4880 pfctl_add_rule(pf, r, anchor_call); 4881 added++; 4882 } 4883 r->direction = dir; 4884 4885 /* Generate binat's matching inbound rule */ 4886 if (!error && nat && nat->rdr && nat->binat) { 4887 bcopy(r, &rb, sizeof(rb)); 4888 4889 /* now specify inbound rdr rule */ 4890 rb.direction = PF_IN; 4891 4892 if ((srch = calloc(1, sizeof(*srch))) == NULL) 4893 err(1, "expand_rule: calloc"); 4894 bcopy(src_host, srch, sizeof(*srch)); 4895 srch->ifname = NULL; 4896 srch->next = NULL; 4897 srch->tail = NULL; 4898 4899 if ((dsth = calloc(1, sizeof(*dsth))) == NULL) 4900 err(1, "expand_rule: calloc"); 4901 bcopy(&rb.nat.addr, &dsth->addr, sizeof(dsth->addr)); 4902 dsth->ifname = NULL; 4903 dsth->next = NULL; 4904 dsth->tail = NULL; 4905 4906 bzero(&binat, sizeof(binat)); 4907 if ((binat.rdr = 4908 calloc(1, sizeof(*binat.rdr))) == NULL) 4909 err(1, "expand_rule: calloc"); 4910 bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr)); 4911 bcopy(&nat->pool_opts, &binat.pool_opts, 4912 sizeof(binat.pool_opts)); 4913 binat.pool_opts.staticport = 0; 4914 binat.rdr->host = srch; 4915 4916 expand_rule(&rb, 1, interface, NULL, &binat, NULL, 4917 proto, 4918 src_os, dst_host, dst_port, dsth, src_port, 4919 uid, gid, rcv, icmp_type, anchor_call); 4920 } 4921 4922 if (osrch && src_host->addr.type == PF_ADDR_DYNIFTL) { 4923 free(src_host); 4924 src_host = osrch; 4925 } 4926 if (odsth && dst_host->addr.type == PF_ADDR_DYNIFTL) { 4927 free(dst_host); 4928 dst_host = odsth; 4929 } 4930 )))))))))); 4931 4932 if (!keeprule) { 4933 FREE_LIST(struct node_if, interfaces); 4934 FREE_LIST(struct node_proto, protos); 4935 FREE_LIST(struct node_host, src_hosts); 4936 FREE_LIST(struct node_port, src_ports); 4937 FREE_LIST(struct node_os, src_oses); 4938 FREE_LIST(struct node_host, dst_hosts); 4939 FREE_LIST(struct node_port, dst_ports); 4940 FREE_LIST(struct node_uid, uids); 4941 FREE_LIST(struct node_gid, gids); 4942 FREE_LIST(struct node_icmp, icmp_types); 4943 if (nat && nat->rdr) 4944 FREE_LIST(struct node_host, nat->rdr->host); 4945 if (rdr && rdr->rdr) 4946 FREE_LIST(struct node_host, rdr->rdr->host); 4947 4948 } 4949 4950 if (!added) 4951 yyerror("rule expands to no valid combination"); 4952} 4953 4954int 4955expand_skip_interface(struct node_if *interfaces) 4956{ 4957 int errs = 0; 4958 4959 if (!interfaces || (!interfaces->next && !interfaces->not && 4960 !strcmp(interfaces->ifname, "none"))) { 4961 if (pf->opts & PF_OPT_VERBOSE) 4962 printf("set skip on none\n"); 4963 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4964 return (errs); 4965 } 4966 4967 if (pf->opts & PF_OPT_VERBOSE) 4968 printf("set skip on {"); 4969 LOOP_THROUGH(struct node_if, interface, interfaces, 4970 if (pf->opts & PF_OPT_VERBOSE) 4971 printf(" %s", interface->ifname); 4972 if (interface->not) { 4973 yyerror("skip on ! <interface> is not supported"); 4974 errs++; 4975 } else if (interface->use_rdomain) { 4976 yyerror("skip on rdomain <num> is not supported"); 4977 errs++; 4978 } else 4979 errs += pfctl_set_interface_flags(pf, 4980 interface->ifname, PFI_IFLAG_SKIP, 1); 4981 ); 4982 if (pf->opts & PF_OPT_VERBOSE) 4983 printf(" }\n"); 4984 4985 FREE_LIST(struct node_if, interfaces); 4986 4987 if (errs) 4988 return (1); 4989 else 4990 return (0); 4991} 4992 4993void 4994freehostlist(struct node_host *h) 4995{ 4996 struct node_host *n; 4997 4998 for (n = h; n != NULL; n = n->next) 4999 if (n->ifname) 5000 free(n->ifname); 5001 FREE_LIST(struct node_host, h); 5002} 5003 5004#undef FREE_LIST 5005#undef LOOP_THROUGH 5006 5007int 5008kw_cmp(const void *k, const void *e) 5009{ 5010 return (strcmp(k, ((const struct keywords *)e)->k_name)); 5011} 5012 5013int 5014lookup(char *s) 5015{ 5016 /* this has to be sorted always */ 5017 static const struct keywords keywords[] = { 5018 { "af-to", AFTO}, 5019 { "all", ALL}, 5020 { "allow-opts", ALLOWOPTS}, 5021 { "anchor", ANCHOR}, 5022 { "antispoof", ANTISPOOF}, 5023 { "any", ANY}, 5024 { "bandwidth", BANDWIDTH}, 5025 { "binat-to", BINATTO}, 5026 { "bitmask", BITMASK}, 5027 { "block", BLOCK}, 5028 { "block-policy", BLOCKPOLICY}, 5029 { "burst", BURST}, 5030 { "code", CODE}, 5031 { "debug", DEBUG}, 5032 { "default", DEFAULT}, 5033 { "divert-packet", DIVERTPACKET}, 5034 { "divert-reply", DIVERTREPLY}, 5035 { "divert-to", DIVERTTO}, 5036 { "drop", DROP}, 5037 { "dup-to", DUPTO}, 5038 { "file", FILENAME}, 5039 { "fingerprints", FINGERPRINTS}, 5040 { "flags", FLAGS}, 5041 { "floating", FLOATING}, 5042 { "flows", FLOWS}, 5043 { "flush", FLUSH}, 5044 { "for", FOR}, 5045 { "fragment", FRAGMENT}, 5046 { "from", FROM}, 5047 { "global", GLOBAL}, 5048 { "group", GROUP}, 5049 { "hostid", HOSTID}, 5050 { "icmp-type", ICMPTYPE}, 5051 { "icmp6-type", ICMP6TYPE}, 5052 { "if-bound", IFBOUND}, 5053 { "in", IN}, 5054 { "include", INCLUDE}, 5055 { "inet", INET}, 5056 { "inet6", INET6}, 5057 { "keep", KEEP}, 5058 { "label", LABEL}, 5059 { "least-states", LEASTSTATES}, 5060 { "limit", LIMIT}, 5061 { "load", LOAD}, 5062 { "log", LOG}, 5063 { "loginterface", LOGINTERFACE}, 5064 { "match", MATCH}, 5065 { "matches", MATCHES}, 5066 { "max", MAXIMUM}, 5067 { "max-mss", MAXMSS}, 5068 { "max-src-conn", MAXSRCCONN}, 5069 { "max-src-conn-rate", MAXSRCCONNRATE}, 5070 { "max-src-nodes", MAXSRCNODES}, 5071 { "max-src-states", MAXSRCSTATES}, 5072 { "min", MINIMUM}, 5073 { "min-ttl", MINTTL}, 5074 { "modulate", MODULATE}, 5075 { "nat-to", NATTO}, 5076 { "no", NO}, 5077 { "no-df", NODF}, 5078 { "no-route", NOROUTE}, 5079 { "no-sync", NOSYNC}, 5080 { "on", ON}, 5081 { "once", ONCE}, 5082 { "optimization", OPTIMIZATION}, 5083 { "os", OS}, 5084 { "out", OUT}, 5085 { "overload", OVERLOAD}, 5086 { "parent", PARENT}, 5087 { "pass", PASS}, 5088 { "pflow", PFLOW}, 5089 { "port", PORT}, 5090 { "prio", PRIO}, 5091 { "probability", PROBABILITY}, 5092 { "proto", PROTO}, 5093 { "qlimit", QLIMIT}, 5094 { "quantum", QUANTUM}, 5095 { "queue", QUEUE}, 5096 { "quick", QUICK}, 5097 { "random", RANDOM}, 5098 { "random-id", RANDOMID}, 5099 { "rdomain", RDOMAIN}, 5100 { "rdr-to", RDRTO}, 5101 { "reassemble", REASSEMBLE}, 5102 { "received-on", RECEIVEDON}, 5103 { "reply-to", REPLYTO}, 5104 { "return", RETURN}, 5105 { "return-icmp", RETURNICMP}, 5106 { "return-icmp6", RETURNICMP6}, 5107 { "return-rst", RETURNRST}, 5108 { "round-robin", ROUNDROBIN}, 5109 { "route", ROUTE}, 5110 { "route-to", ROUTETO}, 5111 { "rtable", RTABLE}, 5112 { "rule", RULE}, 5113 { "ruleset-optimization", RULESET_OPTIMIZATION}, 5114 { "scrub", SCRUB}, 5115 { "set", SET}, 5116 { "skip", SKIP}, 5117 { "sloppy", SLOPPY}, 5118 { "source-hash", SOURCEHASH}, 5119 { "source-track", SOURCETRACK}, 5120 { "state", STATE}, 5121 { "state-defaults", STATEDEFAULTS}, 5122 { "state-policy", STATEPOLICY}, 5123 { "static-port", STATICPORT}, 5124 { "sticky-address", STICKYADDRESS}, 5125 { "synproxy", SYNPROXY}, 5126 { "table", TABLE}, 5127 { "tag", TAG}, 5128 { "tagged", TAGGED}, 5129 { "timeout", TIMEOUT}, 5130 { "to", TO}, 5131 { "tos", TOS}, 5132 { "ttl", TTL}, 5133 { "urpf-failed", URPFFAILED}, 5134 { "user", USER}, 5135 { "weight", WEIGHT}, 5136 }; 5137 const struct keywords *p; 5138 5139 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5140 sizeof(keywords[0]), kw_cmp); 5141 5142 if (p) { 5143 if (debug > 1) 5144 fprintf(stderr, "%s: %d\n", s, p->k_val); 5145 return (p->k_val); 5146 } else { 5147 if (debug > 1) 5148 fprintf(stderr, "string: %s\n", s); 5149 return (STRING); 5150 } 5151} 5152 5153#define MAXPUSHBACK 128 5154 5155u_char *parsebuf; 5156int parseindex; 5157u_char pushback_buffer[MAXPUSHBACK]; 5158int pushback_index = 0; 5159 5160int 5161lgetc(int quotec) 5162{ 5163 int c, next; 5164 5165 if (parsebuf) { 5166 /* Read character from the parsebuffer instead of input. */ 5167 if (parseindex >= 0) { 5168 c = parsebuf[parseindex++]; 5169 if (c != '\0') 5170 return (c); 5171 parsebuf = NULL; 5172 } else 5173 parseindex++; 5174 } 5175 5176 if (pushback_index) 5177 return (pushback_buffer[--pushback_index]); 5178 5179 if (quotec) { 5180 if ((c = getc(file->stream)) == EOF) { 5181 yyerror("reached end of file while parsing quoted string"); 5182 if (popfile() == EOF) 5183 return (EOF); 5184 return (quotec); 5185 } 5186 return (c); 5187 } 5188 5189 while ((c = getc(file->stream)) == '\\') { 5190 next = getc(file->stream); 5191 if (next != '\n') { 5192 c = next; 5193 break; 5194 } 5195 yylval.lineno = file->lineno; 5196 file->lineno++; 5197 } 5198 5199 while (c == EOF) { 5200 if (popfile() == EOF) 5201 return (EOF); 5202 c = getc(file->stream); 5203 } 5204 return (c); 5205} 5206 5207int 5208lungetc(int c) 5209{ 5210 if (c == EOF) 5211 return (EOF); 5212 if (parsebuf) { 5213 parseindex--; 5214 if (parseindex >= 0) 5215 return (c); 5216 } 5217 if (pushback_index < MAXPUSHBACK-1) 5218 return (pushback_buffer[pushback_index++] = c); 5219 else 5220 return (EOF); 5221} 5222 5223int 5224findeol(void) 5225{ 5226 int c; 5227 5228 parsebuf = NULL; 5229 5230 /* skip to either EOF or the first real EOL */ 5231 while (1) { 5232 if (pushback_index) 5233 c = pushback_buffer[--pushback_index]; 5234 else 5235 c = lgetc(0); 5236 if (c == '\n') { 5237 file->lineno++; 5238 break; 5239 } 5240 if (c == EOF) 5241 break; 5242 } 5243 return (ERROR); 5244} 5245 5246int 5247yylex(void) 5248{ 5249 u_char buf[8096]; 5250 u_char *p, *val; 5251 int quotec, next, c; 5252 int token; 5253 5254top: 5255 p = buf; 5256 while ((c = lgetc(0)) == ' ' || c == '\t') 5257 ; /* nothing */ 5258 5259 yylval.lineno = file->lineno; 5260 if (c == '#') 5261 while ((c = lgetc(0)) != '\n' && c != EOF) 5262 ; /* nothing */ 5263 if (c == '$' && parsebuf == NULL) { 5264 while (1) { 5265 if ((c = lgetc(0)) == EOF) 5266 return (0); 5267 5268 if (p + 1 >= buf + sizeof(buf) - 1) { 5269 yyerror("string too long"); 5270 return (findeol()); 5271 } 5272 if (isalnum(c) || c == '_') { 5273 *p++ = c; 5274 continue; 5275 } 5276 *p = '\0'; 5277 lungetc(c); 5278 break; 5279 } 5280 val = symget(buf); 5281 if (val == NULL) { 5282 yyerror("macro '%s' not defined", buf); 5283 return (findeol()); 5284 } 5285 parsebuf = val; 5286 parseindex = 0; 5287 goto top; 5288 } 5289 5290 switch (c) { 5291 case '\'': 5292 case '"': 5293 quotec = c; 5294 while (1) { 5295 if ((c = lgetc(quotec)) == EOF) 5296 return (0); 5297 if (c == '\n') { 5298 file->lineno++; 5299 continue; 5300 } else if (c == '\\') { 5301 if ((next = lgetc(quotec)) == EOF) 5302 return (0); 5303 if (next == quotec || c == ' ' || c == '\t') 5304 c = next; 5305 else if (next == '\n') { 5306 file->lineno++; 5307 continue; 5308 } else 5309 lungetc(next); 5310 } else if (c == quotec) { 5311 *p = '\0'; 5312 break; 5313 } else if (c == '\0') { 5314 yyerror("syntax error"); 5315 return (findeol()); 5316 } 5317 if (p + 1 >= buf + sizeof(buf) - 1) { 5318 yyerror("string too long"); 5319 return (findeol()); 5320 } 5321 *p++ = c; 5322 } 5323 yylval.v.string = strdup(buf); 5324 if (yylval.v.string == NULL) 5325 err(1, "yylex: strdup"); 5326 return (STRING); 5327 case '!': 5328 next = lgetc(0); 5329 if (next == '=') 5330 return (NE); 5331 lungetc(next); 5332 break; 5333 case '<': 5334 next = lgetc(0); 5335 if (next == '>') { 5336 yylval.v.i = PF_OP_XRG; 5337 return (PORTBINARY); 5338 } else if (next == '=') 5339 return (LE); 5340 lungetc(next); 5341 break; 5342 case '>': 5343 next = lgetc(0); 5344 if (next == '<') { 5345 yylval.v.i = PF_OP_IRG; 5346 return (PORTBINARY); 5347 } else if (next == '=') 5348 return (GE); 5349 lungetc(next); 5350 break; 5351 } 5352 5353#define allowed_to_end_number(x) \ 5354 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5355 5356 if (c == '-' || isdigit(c)) { 5357 do { 5358 *p++ = c; 5359 if ((unsigned)(p-buf) >= sizeof(buf)) { 5360 yyerror("string too long"); 5361 return (findeol()); 5362 } 5363 } while ((c = lgetc(0)) != EOF && isdigit(c)); 5364 lungetc(c); 5365 if (p == buf + 1 && buf[0] == '-') 5366 goto nodigits; 5367 if (c == EOF || allowed_to_end_number(c)) { 5368 const char *errstr = NULL; 5369 5370 *p = '\0'; 5371 yylval.v.number = strtonum(buf, LLONG_MIN, 5372 LLONG_MAX, &errstr); 5373 if (errstr) { 5374 yyerror("\"%s\" invalid number: %s", 5375 buf, errstr); 5376 return (findeol()); 5377 } 5378 return (NUMBER); 5379 } else { 5380nodigits: 5381 while (p > buf + 1) 5382 lungetc(*--p); 5383 c = *--p; 5384 if (c == '-') 5385 return (c); 5386 } 5387 } 5388 5389#define allowed_in_string(x) \ 5390 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5391 x != '{' && x != '}' && x != '<' && x != '>' && \ 5392 x != '!' && x != '=' && x != '/' && x != '#' && \ 5393 x != ',')) 5394 5395 if (isalnum(c) || c == ':' || c == '_') { 5396 do { 5397 *p++ = c; 5398 if ((unsigned)(p-buf) >= sizeof(buf)) { 5399 yyerror("string too long"); 5400 return (findeol()); 5401 } 5402 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 5403 lungetc(c); 5404 *p = '\0'; 5405 if ((token = lookup(buf)) == STRING) 5406 if ((yylval.v.string = strdup(buf)) == NULL) 5407 err(1, "yylex: strdup"); 5408 return (token); 5409 } 5410 if (c == '\n') { 5411 yylval.lineno = file->lineno; 5412 file->lineno++; 5413 } 5414 if (c == EOF) 5415 return (0); 5416 return (c); 5417} 5418 5419int 5420check_file_secrecy(int fd, const char *fname) 5421{ 5422 struct stat st; 5423 5424 if (fstat(fd, &st)) { 5425 warn("cannot stat %s", fname); 5426 return (-1); 5427 } 5428 if (st.st_uid != 0 && st.st_uid != getuid()) { 5429 warnx("%s: owner not root or current user", fname); 5430 return (-1); 5431 } 5432 if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) { 5433 warnx("%s: group writable or world read/writable", fname); 5434 return (-1); 5435 } 5436 return (0); 5437} 5438 5439struct file * 5440pushfile(const char *name, int secret) 5441{ 5442 struct file *nfile; 5443 5444 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 5445 (nfile->name = strdup(name)) == NULL) { 5446 if (nfile) 5447 free(nfile); 5448 warn("malloc"); 5449 return (NULL); 5450 } 5451 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 5452 nfile->stream = stdin; 5453 free(nfile->name); 5454 if ((nfile->name = strdup("stdin")) == NULL) { 5455 warn("strdup"); 5456 free(nfile); 5457 return (NULL); 5458 } 5459 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 5460 warn("%s", nfile->name); 5461 free(nfile->name); 5462 free(nfile); 5463 return (NULL); 5464 } else if (secret && 5465 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 5466 fclose(nfile->stream); 5467 free(nfile->name); 5468 free(nfile); 5469 return (NULL); 5470 } 5471 nfile->lineno = 1; 5472 TAILQ_INSERT_TAIL(&files, nfile, entry); 5473 return (nfile); 5474} 5475 5476int 5477popfile(void) 5478{ 5479 struct file *prev; 5480 5481 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 5482 prev->errors += file->errors; 5483 TAILQ_REMOVE(&files, file, entry); 5484 fclose(file->stream); 5485 free(file->name); 5486 free(file); 5487 file = prev; 5488 return (0); 5489 } 5490 return (EOF); 5491} 5492 5493int 5494parse_config(char *filename, struct pfctl *xpf) 5495{ 5496 int errors = 0; 5497 struct sym *sym; 5498 5499 pf = xpf; 5500 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5501 returnicmp6default = 5502 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5503 blockpolicy = PFRULE_DROP; 5504 5505 if ((file = pushfile(filename, 0)) == NULL) { 5506 warn("cannot open the main config file!"); 5507 return (-1); 5508 } 5509 5510 yyparse(); 5511 errors = file->errors; 5512 popfile(); 5513 5514 /* Free macros and check which have not been used. */ 5515 while ((sym = TAILQ_FIRST(&symhead))) { 5516 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5517 fprintf(stderr, "warning: macro '%s' not " 5518 "used\n", sym->nam); 5519 free(sym->nam); 5520 free(sym->val); 5521 TAILQ_REMOVE(&symhead, sym, entry); 5522 free(sym); 5523 } 5524 5525 return (errors ? -1 : 0); 5526} 5527 5528int 5529symset(const char *nam, const char *val, int persist) 5530{ 5531 struct sym *sym; 5532 5533 TAILQ_FOREACH(sym, &symhead, entry) { 5534 if (strcmp(nam, sym->nam) == 0) 5535 break; 5536 } 5537 5538 if (sym != NULL) { 5539 if (sym->persist == 1) 5540 return (0); 5541 else { 5542 free(sym->nam); 5543 free(sym->val); 5544 TAILQ_REMOVE(&symhead, sym, entry); 5545 free(sym); 5546 } 5547 } 5548 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5549 return (-1); 5550 5551 sym->nam = strdup(nam); 5552 if (sym->nam == NULL) { 5553 free(sym); 5554 return (-1); 5555 } 5556 sym->val = strdup(val); 5557 if (sym->val == NULL) { 5558 free(sym->nam); 5559 free(sym); 5560 return (-1); 5561 } 5562 sym->used = 0; 5563 sym->persist = persist; 5564 TAILQ_INSERT_TAIL(&symhead, sym, entry); 5565 return (0); 5566} 5567 5568int 5569pfctl_cmdline_symset(char *s) 5570{ 5571 char *sym, *val; 5572 int ret; 5573 5574 if ((val = strrchr(s, '=')) == NULL) 5575 return (-1); 5576 5577 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5578 err(1, "pfctl_cmdline_symset: malloc"); 5579 5580 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5581 5582 ret = symset(sym, val + 1, 1); 5583 free(sym); 5584 5585 return (ret); 5586} 5587 5588char * 5589symget(const char *nam) 5590{ 5591 struct sym *sym; 5592 5593 TAILQ_FOREACH(sym, &symhead, entry) { 5594 if (strcmp(nam, sym->nam) == 0) { 5595 sym->used = 1; 5596 return (sym->val); 5597 } 5598 } 5599 return (NULL); 5600} 5601 5602void 5603mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5604{ 5605 struct pf_rule *r; 5606 5607 while ((r = TAILQ_FIRST(src->rules.active.ptr)) != NULL) { 5608 TAILQ_REMOVE(src->rules.active.ptr, r, entries); 5609 TAILQ_INSERT_TAIL(dst->rules.active.ptr, r, entries); 5610 dst->anchor->match++; 5611 } 5612 src->anchor->match = 0; 5613 while ((r = TAILQ_FIRST(src->rules.inactive.ptr)) != NULL) { 5614 TAILQ_REMOVE(src->rules.inactive.ptr, r, entries); 5615 TAILQ_INSERT_TAIL(dst->rules.inactive.ptr, r, entries); 5616 } 5617} 5618 5619void 5620decide_address_family(struct node_host *n, sa_family_t *af) 5621{ 5622 if (*af != 0 || n == NULL) 5623 return; 5624 *af = n->af; 5625 while ((n = n->next) != NULL) { 5626 if (n->af != *af) { 5627 *af = 0; 5628 return; 5629 } 5630 } 5631} 5632 5633int 5634invalid_redirect(struct node_host *nh, sa_family_t af) 5635{ 5636 if (!af) { 5637 struct node_host *n; 5638 5639 /* tables and dyniftl are ok without an address family */ 5640 for (n = nh; n != NULL; n = n->next) { 5641 if (n->addr.type != PF_ADDR_TABLE && 5642 n->addr.type != PF_ADDR_DYNIFTL) { 5643 yyerror("address family not given and " 5644 "translation address expands to multiple " 5645 "address families"); 5646 return (1); 5647 } 5648 } 5649 } 5650 if (nh == NULL) { 5651 yyerror("no translation address with matching address family " 5652 "found."); 5653 return (1); 5654 } 5655 return (0); 5656} 5657 5658int 5659atoul(char *s, u_long *ulvalp) 5660{ 5661 u_long ulval; 5662 char *ep; 5663 5664 errno = 0; 5665 ulval = strtoul(s, &ep, 0); 5666 if (s[0] == '\0' || *ep != '\0') 5667 return (-1); 5668 if (errno == ERANGE && ulval == ULONG_MAX) 5669 return (-1); 5670 *ulvalp = ulval; 5671 return (0); 5672} 5673 5674int 5675getservice(char *n) 5676{ 5677 struct servent *s; 5678 u_long ulval; 5679 5680 if (atoul(n, &ulval) == 0) { 5681 if (ulval > 65535) { 5682 yyerror("illegal port value %lu", ulval); 5683 return (-1); 5684 } 5685 return (htons(ulval)); 5686 } else { 5687 s = getservbyname(n, "tcp"); 5688 if (s == NULL) 5689 s = getservbyname(n, "udp"); 5690 if (s == NULL) { 5691 yyerror("unknown port %s", n); 5692 return (-1); 5693 } 5694 return (s->s_port); 5695 } 5696} 5697 5698int 5699rule_label(struct pf_rule *r, char *s) 5700{ 5701 if (s) { 5702 if (strlcpy(r->label, s, sizeof(r->label)) >= 5703 sizeof(r->label)) { 5704 yyerror("rule label too long (max %d chars)", 5705 sizeof(r->label)-1); 5706 return (-1); 5707 } 5708 } 5709 return (0); 5710} 5711 5712u_int16_t 5713parseicmpspec(char *w, sa_family_t af) 5714{ 5715 const struct icmpcodeent *p; 5716 u_long ulval; 5717 u_int8_t icmptype; 5718 5719 if (af == AF_INET) 5720 icmptype = returnicmpdefault >> 8; 5721 else 5722 icmptype = returnicmp6default >> 8; 5723 5724 if (atoul(w, &ulval) == -1) { 5725 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5726 yyerror("unknown icmp code %s", w); 5727 return (0); 5728 } 5729 ulval = p->code; 5730 } 5731 if (ulval > 255) { 5732 yyerror("invalid icmp code %lu", ulval); 5733 return (0); 5734 } 5735 return (icmptype << 8 | ulval); 5736} 5737 5738int 5739parseport(char *port, struct range *r, int extensions) 5740{ 5741 char *p = strchr(port, ':'); 5742 5743 if (p == NULL) { 5744 if ((r->a = getservice(port)) == -1) 5745 return (-1); 5746 r->b = 0; 5747 r->t = PF_OP_NONE; 5748 return (0); 5749 } 5750 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 5751 *p = 0; 5752 if ((r->a = getservice(port)) == -1) 5753 return (-1); 5754 r->b = 0; 5755 r->t = PF_OP_IRG; 5756 return (0); 5757 } 5758 if ((extensions & PPORT_RANGE)) { 5759 *p++ = 0; 5760 if ((r->a = getservice(port)) == -1 || 5761 (r->b = getservice(p)) == -1) 5762 return (-1); 5763 if (r->a == r->b) { 5764 r->b = 0; 5765 r->t = PF_OP_NONE; 5766 } else 5767 r->t = PF_OP_RRG; 5768 return (0); 5769 } 5770 return (-1); 5771} 5772 5773int 5774pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5775{ 5776 struct loadanchors *la; 5777 5778 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5779 if (pf->opts & PF_OPT_VERBOSE) 5780 fprintf(stderr, "\nLoading anchor %s from %s\n", 5781 la->anchorname, la->filename); 5782 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 5783 la->anchorname, trans) == -1) 5784 return (-1); 5785 } 5786 5787 return (0); 5788} 5789 5790int 5791kw_casecmp(const void *k, const void *e) 5792{ 5793 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 5794} 5795 5796int 5797map_tos(char *s, int *val) 5798{ 5799 /* DiffServ Codepoints and other TOS mappings */ 5800 const struct keywords toswords[] = { 5801 { "af11", IPTOS_DSCP_AF11 }, 5802 { "af12", IPTOS_DSCP_AF12 }, 5803 { "af13", IPTOS_DSCP_AF13 }, 5804 { "af21", IPTOS_DSCP_AF21 }, 5805 { "af22", IPTOS_DSCP_AF22 }, 5806 { "af23", IPTOS_DSCP_AF23 }, 5807 { "af31", IPTOS_DSCP_AF31 }, 5808 { "af32", IPTOS_DSCP_AF32 }, 5809 { "af33", IPTOS_DSCP_AF33 }, 5810 { "af41", IPTOS_DSCP_AF41 }, 5811 { "af42", IPTOS_DSCP_AF42 }, 5812 { "af43", IPTOS_DSCP_AF43 }, 5813 { "critical", IPTOS_PREC_CRITIC_ECP }, 5814 { "cs0", IPTOS_DSCP_CS0 }, 5815 { "cs1", IPTOS_DSCP_CS1 }, 5816 { "cs2", IPTOS_DSCP_CS2 }, 5817 { "cs3", IPTOS_DSCP_CS3 }, 5818 { "cs4", IPTOS_DSCP_CS4 }, 5819 { "cs5", IPTOS_DSCP_CS5 }, 5820 { "cs6", IPTOS_DSCP_CS6 }, 5821 { "cs7", IPTOS_DSCP_CS7 }, 5822 { "ef", IPTOS_DSCP_EF }, 5823 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 5824 { "lowdelay", IPTOS_LOWDELAY }, 5825 { "netcontrol", IPTOS_PREC_NETCONTROL }, 5826 { "reliability", IPTOS_RELIABILITY }, 5827 { "throughput", IPTOS_THROUGHPUT } 5828 }; 5829 const struct keywords *p; 5830 5831 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 5832 sizeof(toswords[0]), kw_casecmp); 5833 5834 if (p) { 5835 *val = p->k_val; 5836 return (1); 5837 } 5838 return (0); 5839} 5840