parse.y revision 127024
1126361Smlaier/* $FreeBSD: head/contrib/pf/pfctl/parse.y 127024 2004-03-15 13:41:17Z mlaier $ */ 2126353Smlaier/* $OpenBSD: parse.y,v 1.415 2003/09/01 15:07:40 henning Exp $ */ 3126353Smlaier 4126353Smlaier/* 5126353Smlaier * Copyright (c) 2001 Markus Friedl. All rights reserved. 6126353Smlaier * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 7126353Smlaier * 8126353Smlaier * Redistribution and use in source and binary forms, with or without 9126353Smlaier * modification, are permitted provided that the following conditions 10126353Smlaier * are met: 11126353Smlaier * 1. Redistributions of source code must retain the above copyright 12126353Smlaier * notice, this list of conditions and the following disclaimer. 13126353Smlaier * 2. Redistributions in binary form must reproduce the above copyright 14126353Smlaier * notice, this list of conditions and the following disclaimer in the 15126353Smlaier * documentation and/or other materials provided with the distribution. 16126353Smlaier * 17126353Smlaier * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18126353Smlaier * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19126353Smlaier * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20126353Smlaier * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21126353Smlaier * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22126353Smlaier * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23126353Smlaier * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24126353Smlaier * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25126353Smlaier * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26126353Smlaier * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27126353Smlaier */ 28126353Smlaier%{ 29126353Smlaier#include <sys/types.h> 30126353Smlaier#include <sys/socket.h> 31126353Smlaier#include <net/if.h> 32126353Smlaier#include <netinet/in.h> 33126353Smlaier#include <netinet/in_systm.h> 34126353Smlaier#include <netinet/ip.h> 35126353Smlaier#include <netinet/ip_icmp.h> 36126353Smlaier#include <netinet/icmp6.h> 37126353Smlaier#include <net/pfvar.h> 38126353Smlaier#include <arpa/inet.h> 39126353Smlaier#include <altq/altq.h> 40126353Smlaier#include <altq/altq_cbq.h> 41126353Smlaier#include <altq/altq_priq.h> 42126353Smlaier#include <altq/altq_hfsc.h> 43126353Smlaier 44126353Smlaier#include <stdio.h> 45126353Smlaier#include <stdlib.h> 46126353Smlaier#include <netdb.h> 47126353Smlaier#include <stdarg.h> 48126353Smlaier#include <errno.h> 49126353Smlaier#include <string.h> 50126353Smlaier#include <ctype.h> 51126353Smlaier#include <err.h> 52127024Smlaier#include <limits.h> 53126353Smlaier#include <pwd.h> 54126353Smlaier#include <grp.h> 55126353Smlaier#include <md5.h> 56126353Smlaier 57126353Smlaier#include "pfctl_parser.h" 58126353Smlaier#include "pfctl.h" 59126353Smlaier 60127024Smlaier#ifdef __FreeBSD__ 61126361Smlaier#define HTONL(x) (x) = htonl((__uint32_t)(x)) 62126361Smlaier#endif 63126361Smlaier 64126353Smlaierstatic struct pfctl *pf = NULL; 65126353Smlaierstatic FILE *fin = NULL; 66126353Smlaierstatic int debug = 0; 67126353Smlaierstatic int lineno = 1; 68126353Smlaierstatic int errors = 0; 69126353Smlaierstatic int rulestate = 0; 70126353Smlaierstatic u_int16_t returnicmpdefault = 71126353Smlaier (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 72126353Smlaierstatic u_int16_t returnicmp6default = 73126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 74126353Smlaierstatic int blockpolicy = PFRULE_DROP; 75126353Smlaierstatic int require_order = 1; 76126353Smlaier 77126353Smlaierenum { 78126353Smlaier PFCTL_STATE_NONE, 79126353Smlaier PFCTL_STATE_OPTION, 80126353Smlaier PFCTL_STATE_SCRUB, 81126353Smlaier PFCTL_STATE_QUEUE, 82126353Smlaier PFCTL_STATE_NAT, 83126353Smlaier PFCTL_STATE_FILTER 84126353Smlaier}; 85126353Smlaier 86126353Smlaierstruct node_proto { 87126353Smlaier u_int8_t proto; 88126353Smlaier struct node_proto *next; 89126353Smlaier struct node_proto *tail; 90126353Smlaier}; 91126353Smlaier 92126353Smlaierstruct node_port { 93126353Smlaier u_int16_t port[2]; 94126353Smlaier u_int8_t op; 95126353Smlaier struct node_port *next; 96126353Smlaier struct node_port *tail; 97126353Smlaier}; 98126353Smlaier 99126353Smlaierstruct node_uid { 100126353Smlaier uid_t uid[2]; 101126353Smlaier u_int8_t op; 102126353Smlaier struct node_uid *next; 103126353Smlaier struct node_uid *tail; 104126353Smlaier}; 105126353Smlaier 106126353Smlaierstruct node_gid { 107126353Smlaier gid_t gid[2]; 108126353Smlaier u_int8_t op; 109126353Smlaier struct node_gid *next; 110126353Smlaier struct node_gid *tail; 111126353Smlaier}; 112126353Smlaier 113126353Smlaierstruct node_icmp { 114126353Smlaier u_int8_t code; 115126353Smlaier u_int8_t type; 116126353Smlaier u_int8_t proto; 117126353Smlaier struct node_icmp *next; 118126353Smlaier struct node_icmp *tail; 119126353Smlaier}; 120126353Smlaier 121126353Smlaierenum { PF_STATE_OPT_MAX=0, PF_STATE_OPT_TIMEOUT=1 }; 122126353Smlaierstruct node_state_opt { 123126353Smlaier int type; 124126353Smlaier union { 125126353Smlaier u_int32_t max_states; 126126353Smlaier struct { 127126353Smlaier int number; 128126353Smlaier u_int32_t seconds; 129126353Smlaier } timeout; 130126353Smlaier } data; 131126353Smlaier struct node_state_opt *next; 132126353Smlaier struct node_state_opt *tail; 133126353Smlaier}; 134126353Smlaier 135126353Smlaierstruct peer { 136126353Smlaier struct node_host *host; 137126353Smlaier struct node_port *port; 138126353Smlaier}; 139126353Smlaier 140126353Smlaierstruct node_queue { 141126353Smlaier char queue[PF_QNAME_SIZE]; 142126353Smlaier char parent[PF_QNAME_SIZE]; 143126353Smlaier char ifname[IFNAMSIZ]; 144126353Smlaier int scheduler; 145126353Smlaier struct node_queue *next; 146126353Smlaier struct node_queue *tail; 147126353Smlaier} *queues = NULL; 148126353Smlaier 149126353Smlaierstruct node_qassign { 150126353Smlaier char *qname; 151126353Smlaier char *pqname; 152126353Smlaier}; 153126353Smlaier 154126353Smlaierstruct filter_opts { 155126353Smlaier int marker; 156126353Smlaier#define FOM_FLAGS 0x01 157126353Smlaier#define FOM_ICMP 0x02 158126353Smlaier#define FOM_TOS 0x04 159126353Smlaier#define FOM_KEEP 0x08 160126353Smlaier struct node_uid *uid; 161126353Smlaier struct node_gid *gid; 162126353Smlaier struct { 163126353Smlaier u_int8_t b1; 164126353Smlaier u_int8_t b2; 165126353Smlaier u_int16_t w; 166126353Smlaier u_int16_t w2; 167126353Smlaier } flags; 168126353Smlaier struct node_icmp *icmpspec; 169126353Smlaier u_int32_t tos; 170126353Smlaier struct { 171126353Smlaier int action; 172126353Smlaier struct node_state_opt *options; 173126353Smlaier } keep; 174126353Smlaier int fragment; 175126353Smlaier int allowopts; 176126353Smlaier char *label; 177126353Smlaier struct node_qassign queues; 178126353Smlaier char *tag; 179126353Smlaier char *match_tag; 180126353Smlaier u_int8_t match_tag_not; 181126353Smlaier} filter_opts; 182126353Smlaier 183126353Smlaierstruct antispoof_opts { 184126353Smlaier char *label; 185126353Smlaier} antispoof_opts; 186126353Smlaier 187126353Smlaierstruct scrub_opts { 188126353Smlaier int marker; 189126353Smlaier#define SOM_MINTTL 0x01 190126353Smlaier#define SOM_MAXMSS 0x02 191126353Smlaier#define SOM_FRAGCACHE 0x04 192126353Smlaier int nodf; 193126353Smlaier int minttl; 194126353Smlaier int maxmss; 195126353Smlaier int fragcache; 196126353Smlaier int randomid; 197126353Smlaier int reassemble_tcp; 198126353Smlaier} scrub_opts; 199126353Smlaier 200126353Smlaierstruct queue_opts { 201126353Smlaier int marker; 202126353Smlaier#define QOM_BWSPEC 0x01 203126353Smlaier#define QOM_SCHEDULER 0x02 204126353Smlaier#define QOM_PRIORITY 0x04 205126353Smlaier#define QOM_TBRSIZE 0x08 206126353Smlaier#define QOM_QLIMIT 0x10 207126353Smlaier struct node_queue_bw queue_bwspec; 208126353Smlaier struct node_queue_opt scheduler; 209126353Smlaier int priority; 210126353Smlaier int tbrsize; 211126353Smlaier int qlimit; 212126353Smlaier} queue_opts; 213126353Smlaier 214126353Smlaierstruct table_opts { 215126353Smlaier int flags; 216126353Smlaier int init_addr; 217126353Smlaier struct node_tinithead init_nodes; 218126353Smlaier} table_opts; 219126353Smlaier 220126353Smlaierstruct node_hfsc_opts hfsc_opts; 221126353Smlaier 222126353Smlaierint yyerror(const char *, ...); 223126353Smlaierint disallow_table(struct node_host *, const char *); 224126353Smlaierint rule_consistent(struct pf_rule *); 225126353Smlaierint filter_consistent(struct pf_rule *); 226126353Smlaierint nat_consistent(struct pf_rule *); 227126353Smlaierint rdr_consistent(struct pf_rule *); 228126353Smlaierint process_tabledef(char *, struct table_opts *); 229126353Smlaierint yyparse(void); 230126353Smlaiervoid expand_label_str(char *, const char *, const char *); 231126353Smlaiervoid expand_label_if(const char *, char *, const char *); 232126353Smlaiervoid expand_label_addr(const char *, char *, u_int8_t, struct node_host *); 233126353Smlaiervoid expand_label_port(const char *, char *, struct node_port *); 234126353Smlaiervoid expand_label_proto(const char *, char *, u_int8_t); 235126353Smlaiervoid expand_label_nr(const char *, char *); 236126353Smlaiervoid expand_label(char *, const char *, u_int8_t, struct node_host *, 237126353Smlaier struct node_port *, struct node_host *, struct node_port *, 238126353Smlaier u_int8_t); 239126353Smlaiervoid expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 240126353Smlaier struct node_proto *, struct node_os*, struct node_host *, 241126353Smlaier struct node_port *, struct node_host *, struct node_port *, 242126353Smlaier struct node_uid *, struct node_gid *, struct node_icmp *); 243126353Smlaierint expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 244126353Smlaier struct node_queue_bw bwspec, struct node_queue_opt *); 245126353Smlaierint expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 246126353Smlaier struct node_queue_bw, struct node_queue_opt *); 247126353Smlaier 248126353Smlaierint check_rulestate(int); 249126353Smlaierint kw_cmp(const void *, const void *); 250126353Smlaierint lookup(char *); 251126353Smlaierint lgetc(FILE *); 252126353Smlaierint lungetc(int); 253126353Smlaierint findeol(void); 254126353Smlaierint yylex(void); 255126353Smlaierint atoul(char *, u_long *); 256126353Smlaierint getservice(char *); 257126353Smlaierint rule_label(struct pf_rule *, char *); 258126353Smlaier 259126353SmlaierTAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 260126353Smlaierstruct sym { 261126353Smlaier TAILQ_ENTRY(sym) entries; 262126353Smlaier int used; 263126353Smlaier int persist; 264126353Smlaier char *nam; 265126353Smlaier char *val; 266126353Smlaier}; 267126353Smlaier 268126353Smlaier 269126353Smlaierint symset(const char *, const char *, int); 270126353Smlaierchar *symget(const char *); 271126353Smlaier 272126353Smlaiervoid decide_address_family(struct node_host *, sa_family_t *); 273126353Smlaiervoid remove_invalid_hosts(struct node_host **, sa_family_t *); 274126353Smlaierint invalid_redirect(struct node_host *, sa_family_t); 275126353Smlaieru_int16_t parseicmpspec(char *, sa_family_t); 276126353Smlaier 277126353SmlaierTAILQ_HEAD(loadanchorshead, loadanchors) loadanchorshead = 278126353Smlaier TAILQ_HEAD_INITIALIZER(loadanchorshead); 279126353Smlaierstruct loadanchors { 280126353Smlaier TAILQ_ENTRY(loadanchors) entries; 281126353Smlaier char *anchorname; 282126353Smlaier char *rulesetname; 283126353Smlaier char *filename; 284126353Smlaier}; 285126353Smlaier 286126353Smlaiertypedef struct { 287126353Smlaier union { 288126353Smlaier u_int32_t number; 289126353Smlaier int i; 290126353Smlaier char *string; 291126353Smlaier struct { 292126353Smlaier u_int8_t b1; 293126353Smlaier u_int8_t b2; 294126353Smlaier u_int16_t w; 295126353Smlaier u_int16_t w2; 296126353Smlaier } b; 297126353Smlaier struct range { 298126353Smlaier int a; 299126353Smlaier int b; 300126353Smlaier int t; 301126353Smlaier } range; 302126353Smlaier struct node_if *interface; 303126353Smlaier struct node_proto *proto; 304126353Smlaier struct node_icmp *icmp; 305126353Smlaier struct node_host *host; 306126353Smlaier struct node_os *os; 307126353Smlaier struct node_port *port; 308126353Smlaier struct node_uid *uid; 309126353Smlaier struct node_gid *gid; 310126353Smlaier struct node_state_opt *state_opt; 311126353Smlaier struct peer peer; 312126353Smlaier struct { 313126353Smlaier struct peer src, dst; 314126353Smlaier struct node_os *src_os; 315126353Smlaier } fromto; 316126353Smlaier struct pf_poolhashkey *hashkey; 317126353Smlaier struct { 318126353Smlaier struct node_host *host; 319126353Smlaier u_int8_t rt; 320126353Smlaier u_int8_t pool_opts; 321126353Smlaier sa_family_t af; 322126353Smlaier struct pf_poolhashkey *key; 323126353Smlaier } route; 324126353Smlaier struct redirection { 325126353Smlaier struct node_host *host; 326126353Smlaier struct range rport; 327126353Smlaier } *redirection; 328126353Smlaier struct { 329126353Smlaier int type; 330126353Smlaier struct pf_poolhashkey *key; 331126353Smlaier } pooltype; 332126353Smlaier struct { 333126353Smlaier int action; 334126353Smlaier struct node_state_opt *options; 335126353Smlaier } keep_state; 336126353Smlaier struct { 337126353Smlaier u_int8_t log; 338126353Smlaier u_int8_t quick; 339126353Smlaier } logquick; 340126353Smlaier struct node_queue *queue; 341126353Smlaier struct node_queue_opt queue_options; 342126353Smlaier struct node_queue_bw queue_bwspec; 343126353Smlaier struct node_qassign qassign; 344126353Smlaier struct filter_opts filter_opts; 345126353Smlaier struct antispoof_opts antispoof_opts; 346126353Smlaier struct queue_opts queue_opts; 347126353Smlaier struct scrub_opts scrub_opts; 348126353Smlaier struct table_opts table_opts; 349126353Smlaier struct node_hfsc_opts hfsc_opts; 350126353Smlaier } v; 351126353Smlaier int lineno; 352126353Smlaier} YYSTYPE; 353126353Smlaier 354126353Smlaier#define PREPARE_ANCHOR_RULE(r, a) \ 355126353Smlaier do { \ 356126353Smlaier memset(&(r), 0, sizeof(r)); \ 357126353Smlaier if (strlcpy(r.anchorname, (a), \ 358126353Smlaier sizeof(r.anchorname)) >= \ 359126353Smlaier sizeof(r.anchorname)) { \ 360126353Smlaier yyerror("anchor name '%s' too long", \ 361126353Smlaier (a)); \ 362126353Smlaier YYERROR; \ 363126353Smlaier } \ 364126353Smlaier } while (0) 365126353Smlaier 366126353Smlaier%} 367126353Smlaier 368126353Smlaier%token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS 369126353Smlaier%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 370126353Smlaier%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 371126353Smlaier%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 372126353Smlaier%token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 373126353Smlaier%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 374126353Smlaier%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 375126353Smlaier%token REQUIREORDER SYNPROXY FINGERPRINTS 376126353Smlaier%token ANTISPOOF FOR 377126353Smlaier%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT 378126353Smlaier%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 379126353Smlaier%token QUEUE PRIORITY QLIMIT 380126353Smlaier%token LOAD 381126353Smlaier%token TAGGED TAG 382126353Smlaier%token <v.string> STRING 383126353Smlaier%token <v.i> PORTBINARY 384126353Smlaier%type <v.interface> interface if_list if_item_not if_item 385126353Smlaier%type <v.number> number icmptype icmp6type uid gid 386126353Smlaier%type <v.number> tos not yesno natpass 387126353Smlaier%type <v.i> no dir log af fragcache 388126353Smlaier%type <v.i> staticport unaryop 389126353Smlaier%type <v.b> action nataction flags flag blockspec 390126353Smlaier%type <v.range> port rport 391126353Smlaier%type <v.hashkey> hashkey 392126353Smlaier%type <v.pooltype> pooltype 393126353Smlaier%type <v.proto> proto proto_list proto_item 394126353Smlaier%type <v.icmp> icmpspec 395126353Smlaier%type <v.icmp> icmp_list icmp_item 396126353Smlaier%type <v.icmp> icmp6_list icmp6_item 397126353Smlaier%type <v.fromto> fromto 398126353Smlaier%type <v.peer> ipportspec from to 399126353Smlaier%type <v.host> ipspec xhost host dynaddr host_list 400126353Smlaier%type <v.host> redir_host_list redirspec 401126353Smlaier%type <v.host> route_host route_host_list routespec 402126353Smlaier%type <v.os> os xos os_list 403126353Smlaier%type <v.port> portspec port_list port_item 404126353Smlaier%type <v.uid> uids uid_list uid_item 405126353Smlaier%type <v.gid> gids gid_list gid_item 406126353Smlaier%type <v.route> route 407126353Smlaier%type <v.redirection> redirection redirpool 408126353Smlaier%type <v.string> label string tag 409126353Smlaier%type <v.keep_state> keep 410126353Smlaier%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 411126353Smlaier%type <v.logquick> logquick 412126353Smlaier%type <v.interface> antispoof_ifspc antispoof_iflst 413126353Smlaier%type <v.qassign> qname 414126353Smlaier%type <v.queue> qassign qassign_list qassign_item 415126353Smlaier%type <v.queue_options> scheduler 416126353Smlaier%type <v.number> cbqflags_list cbqflags_item 417126353Smlaier%type <v.number> priqflags_list priqflags_item 418126353Smlaier%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 419126353Smlaier%type <v.queue_bwspec> bandwidth 420126353Smlaier%type <v.filter_opts> filter_opts filter_opt filter_opts_l 421126353Smlaier%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 422126353Smlaier%type <v.queue_opts> queue_opts queue_opt queue_opts_l 423126353Smlaier%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 424126353Smlaier%type <v.table_opts> table_opts table_opt table_opts_l 425126353Smlaier%% 426126353Smlaier 427126353Smlaierruleset : /* empty */ 428126353Smlaier | ruleset '\n' 429126353Smlaier | ruleset option '\n' 430126353Smlaier | ruleset scrubrule '\n' 431126353Smlaier | ruleset natrule '\n' 432126353Smlaier | ruleset binatrule '\n' 433126353Smlaier | ruleset pfrule '\n' 434126353Smlaier | ruleset anchorrule '\n' 435126353Smlaier | ruleset loadrule '\n' 436126353Smlaier | ruleset altqif '\n' 437126353Smlaier | ruleset queuespec '\n' 438126353Smlaier | ruleset varset '\n' 439126353Smlaier | ruleset antispoof '\n' 440126353Smlaier | ruleset tabledef '\n' 441126353Smlaier | ruleset error '\n' { errors++; } 442126353Smlaier ; 443126353Smlaier 444126353Smlaieroption : SET OPTIMIZATION STRING { 445126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 446126353Smlaier YYERROR; 447126353Smlaier if (pfctl_set_optimization(pf, $3) != 0) { 448126353Smlaier yyerror("unknown optimization %s", $3); 449126353Smlaier YYERROR; 450126353Smlaier } 451126353Smlaier } 452126353Smlaier | SET TIMEOUT timeout_spec 453126353Smlaier | SET TIMEOUT '{' timeout_list '}' 454126353Smlaier | SET LIMIT limit_spec 455126353Smlaier | SET LIMIT '{' limit_list '}' 456126353Smlaier | SET LOGINTERFACE STRING { 457126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 458126353Smlaier YYERROR; 459126353Smlaier if ((ifa_exists($3) == NULL) && strcmp($3, "none")) { 460126353Smlaier yyerror("interface %s doesn't exist", $3); 461126353Smlaier YYERROR; 462126353Smlaier } 463126353Smlaier if (pfctl_set_logif(pf, $3) != 0) { 464126353Smlaier yyerror("error setting loginterface %s", $3); 465126353Smlaier YYERROR; 466126353Smlaier } 467126353Smlaier } 468126353Smlaier | SET BLOCKPOLICY DROP { 469126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 470126353Smlaier printf("set block-policy drop\n"); 471126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 472126353Smlaier YYERROR; 473126353Smlaier blockpolicy = PFRULE_DROP; 474126353Smlaier } 475126353Smlaier | SET BLOCKPOLICY RETURN { 476126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 477126353Smlaier printf("set block-policy return\n"); 478126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 479126353Smlaier YYERROR; 480126353Smlaier blockpolicy = PFRULE_RETURN; 481126353Smlaier } 482126353Smlaier | SET REQUIREORDER yesno { 483126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 484126353Smlaier printf("set require-order %s\n", 485126353Smlaier $3 == 1 ? "yes" : "no"); 486126353Smlaier require_order = $3; 487126353Smlaier } 488126353Smlaier | SET FINGERPRINTS STRING { 489126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 490126353Smlaier printf("fingerprints %s\n", $3); 491126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 492126353Smlaier YYERROR; 493126353Smlaier if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) { 494126353Smlaier yyerror("error loading fingerprints %s", $3); 495126353Smlaier YYERROR; 496126353Smlaier } 497126353Smlaier } 498126353Smlaier ; 499126353Smlaier 500126353Smlaierstring : string STRING { 501126353Smlaier if (asprintf(&$$, "%s %s", $1, $2) == -1) 502126353Smlaier err(1, "string: asprintf"); 503126353Smlaier free($1); 504126353Smlaier free($2); 505126353Smlaier } 506126353Smlaier | STRING 507126353Smlaier ; 508126353Smlaier 509126353Smlaiervarset : STRING '=' string { 510126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 511126353Smlaier printf("%s = \"%s\"\n", $1, $3); 512126353Smlaier if (symset($1, $3, 0) == -1) 513126353Smlaier err(1, "cannot store variable %s", $1); 514126353Smlaier } 515126353Smlaier ; 516126353Smlaier 517126353Smlaieranchorrule : ANCHOR string dir interface af proto fromto { 518126353Smlaier struct pf_rule r; 519126353Smlaier 520126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 521126353Smlaier YYERROR; 522126353Smlaier 523126353Smlaier PREPARE_ANCHOR_RULE(r, $2); 524126353Smlaier r.direction = $3; 525126353Smlaier r.af = $5; 526126353Smlaier 527126353Smlaier decide_address_family($7.src.host, &r.af); 528126353Smlaier decide_address_family($7.dst.host, &r.af); 529126353Smlaier 530126353Smlaier expand_rule(&r, $4, NULL, $6, $7.src_os, 531126353Smlaier $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 532126353Smlaier 0, 0, 0); 533126353Smlaier } 534126353Smlaier | NATANCHOR string interface af proto fromto { 535126353Smlaier struct pf_rule r; 536126353Smlaier 537126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 538126353Smlaier YYERROR; 539126353Smlaier 540126353Smlaier PREPARE_ANCHOR_RULE(r, $2); 541126353Smlaier r.action = PF_NAT; 542126353Smlaier r.af = $4; 543126353Smlaier 544126353Smlaier decide_address_family($6.src.host, &r.af); 545126353Smlaier decide_address_family($6.dst.host, &r.af); 546126353Smlaier 547126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 548126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 549126353Smlaier 0, 0, 0); 550126353Smlaier } 551126353Smlaier | RDRANCHOR string interface af proto fromto { 552126353Smlaier struct pf_rule r; 553126353Smlaier 554126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 555126353Smlaier YYERROR; 556126353Smlaier 557126353Smlaier PREPARE_ANCHOR_RULE(r, $2); 558126353Smlaier r.action = PF_RDR; 559126353Smlaier r.af = $4; 560126353Smlaier 561126353Smlaier decide_address_family($6.src.host, &r.af); 562126353Smlaier decide_address_family($6.dst.host, &r.af); 563126353Smlaier 564126353Smlaier if ($6.src.port != NULL) { 565126353Smlaier yyerror("source port parameter not supported" 566126353Smlaier " in rdr-anchor"); 567126353Smlaier YYERROR; 568126353Smlaier } 569126353Smlaier if ($6.dst.port != NULL) { 570126353Smlaier if ($6.dst.port->next != NULL) { 571126353Smlaier yyerror("destination port list " 572126353Smlaier "expansion not supported in " 573126353Smlaier "rdr-anchor"); 574126353Smlaier YYERROR; 575126353Smlaier } else if ($6.dst.port->op != PF_OP_EQ) { 576126353Smlaier yyerror("destination port operators" 577126353Smlaier " not supported in rdr-anchor"); 578126353Smlaier YYERROR; 579126353Smlaier } 580126353Smlaier r.dst.port[0] = $6.dst.port->port[0]; 581126353Smlaier r.dst.port[1] = $6.dst.port->port[1]; 582126353Smlaier r.dst.port_op = $6.dst.port->op; 583126353Smlaier } 584126353Smlaier 585126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 586126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 587126353Smlaier 0, 0, 0); 588126353Smlaier } 589126353Smlaier | BINATANCHOR string interface af proto fromto { 590126353Smlaier struct pf_rule r; 591126353Smlaier 592126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 593126353Smlaier YYERROR; 594126353Smlaier 595126353Smlaier PREPARE_ANCHOR_RULE(r, $2); 596126353Smlaier r.action = PF_BINAT; 597126353Smlaier r.af = $4; 598126353Smlaier if ($5 != NULL) { 599126353Smlaier if ($5->next != NULL) { 600126353Smlaier yyerror("proto list expansion" 601126353Smlaier " not supported in binat-anchor"); 602126353Smlaier YYERROR; 603126353Smlaier } 604126353Smlaier r.proto = $5->proto; 605126353Smlaier free($5); 606126353Smlaier } 607126353Smlaier 608126353Smlaier if ($6.src.host != NULL || $6.src.port != NULL || 609126353Smlaier $6.dst.host != NULL || $6.dst.port != NULL) { 610126353Smlaier yyerror("fromto parameter not supported" 611126353Smlaier " in binat-anchor"); 612126353Smlaier YYERROR; 613126353Smlaier } 614126353Smlaier 615126353Smlaier decide_address_family($6.src.host, &r.af); 616126353Smlaier decide_address_family($6.dst.host, &r.af); 617126353Smlaier 618126353Smlaier pfctl_add_rule(pf, &r); 619126353Smlaier } 620126353Smlaier ; 621126353Smlaier 622126353Smlaierloadrule : LOAD ANCHOR string FROM string { 623126353Smlaier char *t; 624126353Smlaier struct loadanchors *loadanchor; 625126353Smlaier 626126353Smlaier t = strsep(&$3, ":"); 627126353Smlaier if (*t == '\0' || *$3 == '\0') { 628126353Smlaier yyerror("anchor '%s' invalid\n", $3); 629126353Smlaier YYERROR; 630126353Smlaier } 631126353Smlaier if (strlen(t) >= PF_ANCHOR_NAME_SIZE) { 632126353Smlaier yyerror("anchorname %s too long, max %u\n", 633126353Smlaier t, PF_ANCHOR_NAME_SIZE - 1); 634126353Smlaier YYERROR; 635126353Smlaier } 636126353Smlaier if (strlen($3) >= PF_RULESET_NAME_SIZE) { 637126353Smlaier yyerror("rulesetname %s too long, max %u\n", 638126353Smlaier $3, PF_RULESET_NAME_SIZE - 1); 639126353Smlaier YYERROR; 640126353Smlaier } 641126353Smlaier 642126353Smlaier loadanchor = calloc(1, sizeof(struct loadanchors)); 643126353Smlaier if (loadanchor == NULL) 644126353Smlaier err(1, "loadrule: calloc"); 645126353Smlaier if ((loadanchor->anchorname = strdup(t)) == NULL) 646126353Smlaier err(1, "loadrule: strdup"); 647126353Smlaier if ((loadanchor->rulesetname = strdup($3)) == NULL) 648126353Smlaier err(1, "loadrule: strdup"); 649126353Smlaier if ((loadanchor->filename = strdup($5)) == NULL) 650126353Smlaier err(1, "loadrule: strdup"); 651126353Smlaier 652126353Smlaier TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 653126353Smlaier entries); 654126353Smlaier 655126353Smlaier free(t); /* not $3 */ 656126353Smlaier free($5); 657126353Smlaier }; 658126353Smlaier 659126353Smlaierscrubrule : SCRUB dir logquick interface af proto fromto scrub_opts 660126353Smlaier { 661126353Smlaier struct pf_rule r; 662126353Smlaier 663126353Smlaier if (check_rulestate(PFCTL_STATE_SCRUB)) 664126353Smlaier YYERROR; 665126353Smlaier 666126353Smlaier memset(&r, 0, sizeof(r)); 667126353Smlaier 668126353Smlaier r.action = PF_SCRUB; 669126353Smlaier r.direction = $2; 670126353Smlaier 671126353Smlaier r.log = $3.log; 672126353Smlaier if ($3.quick) { 673126353Smlaier yyerror("scrub rules do not support 'quick'"); 674126353Smlaier YYERROR; 675126353Smlaier } 676126353Smlaier 677126353Smlaier if ($4) { 678126353Smlaier if ($4->not) { 679126353Smlaier yyerror("scrub rules do not support " 680126353Smlaier "'! <if>'"); 681126353Smlaier YYERROR; 682126353Smlaier } 683126353Smlaier } 684126353Smlaier r.af = $5; 685126353Smlaier if ($8.nodf) 686126353Smlaier r.rule_flag |= PFRULE_NODF; 687126353Smlaier if ($8.randomid) 688126353Smlaier r.rule_flag |= PFRULE_RANDOMID; 689126353Smlaier if ($8.reassemble_tcp) { 690126353Smlaier if (r.direction != PF_INOUT) { 691126353Smlaier yyerror("reassemble tcp rules can not " 692126353Smlaier "specify direction"); 693126353Smlaier YYERROR; 694126353Smlaier } 695126353Smlaier r.rule_flag |= PFRULE_REASSEMBLE_TCP; 696126353Smlaier } 697126353Smlaier if ($8.minttl) 698126353Smlaier r.min_ttl = $8.minttl; 699126353Smlaier if ($8.maxmss) 700126353Smlaier r.max_mss = $8.maxmss; 701126353Smlaier if ($8.fragcache) 702126353Smlaier r.rule_flag |= $8.fragcache; 703126353Smlaier 704126353Smlaier expand_rule(&r, $4, NULL, $6, $7.src_os, 705126353Smlaier $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 706126353Smlaier NULL, NULL, NULL); 707126353Smlaier } 708126353Smlaier ; 709126353Smlaier 710126353Smlaierscrub_opts : { 711126353Smlaier bzero(&scrub_opts, sizeof scrub_opts); 712126353Smlaier } 713126353Smlaier scrub_opts_l 714126353Smlaier { $$ = scrub_opts; } 715126353Smlaier | /* empty */ { 716126353Smlaier bzero(&scrub_opts, sizeof scrub_opts); 717126353Smlaier $$ = scrub_opts; 718126353Smlaier } 719126353Smlaier ; 720126353Smlaier 721126353Smlaierscrub_opts_l : scrub_opts_l scrub_opt 722126353Smlaier | scrub_opt 723126353Smlaier ; 724126353Smlaier 725126353Smlaierscrub_opt : NODF { 726126353Smlaier if (scrub_opts.nodf) { 727126353Smlaier yyerror("no-df cannot be respecified"); 728126353Smlaier YYERROR; 729126353Smlaier } 730126353Smlaier scrub_opts.nodf = 1; 731126353Smlaier } 732126353Smlaier | MINTTL number { 733126353Smlaier if (scrub_opts.marker & SOM_MINTTL) { 734126353Smlaier yyerror("min-ttl cannot be respecified"); 735126353Smlaier YYERROR; 736126353Smlaier } 737126353Smlaier if ($2 > 255) { 738126353Smlaier yyerror("illegal min-ttl value %d", $2); 739126353Smlaier YYERROR; 740126353Smlaier } 741126353Smlaier scrub_opts.marker |= SOM_MINTTL; 742126353Smlaier scrub_opts.minttl = $2; 743126353Smlaier } 744126353Smlaier | MAXMSS number { 745126353Smlaier if (scrub_opts.marker & SOM_MAXMSS) { 746126353Smlaier yyerror("max-mss cannot be respecified"); 747126353Smlaier YYERROR; 748126353Smlaier } 749126353Smlaier if ($2 > 65535) { 750126353Smlaier yyerror("illegal max-mss value %d", $2); 751126353Smlaier YYERROR; 752126353Smlaier } 753126353Smlaier scrub_opts.marker |= SOM_MAXMSS; 754126353Smlaier scrub_opts.maxmss = $2; 755126353Smlaier } 756126353Smlaier | fragcache { 757126353Smlaier if (scrub_opts.marker & SOM_FRAGCACHE) { 758126353Smlaier yyerror("fragcache cannot be respecified"); 759126353Smlaier YYERROR; 760126353Smlaier } 761126353Smlaier scrub_opts.marker |= SOM_FRAGCACHE; 762126353Smlaier scrub_opts.fragcache = $1; 763126353Smlaier } 764126353Smlaier | REASSEMBLE STRING { 765126353Smlaier if (strcasecmp($2, "tcp") != 0) 766126353Smlaier YYERROR; 767126353Smlaier if (scrub_opts.reassemble_tcp) { 768126353Smlaier yyerror("reassemble tcp cannot be respecified"); 769126353Smlaier YYERROR; 770126353Smlaier } 771126353Smlaier scrub_opts.reassemble_tcp = 1; 772126353Smlaier } 773126353Smlaier | RANDOMID { 774126353Smlaier if (scrub_opts.randomid) { 775126353Smlaier yyerror("random-id cannot be respecified"); 776126353Smlaier YYERROR; 777126353Smlaier } 778126353Smlaier scrub_opts.randomid = 1; 779126353Smlaier } 780126353Smlaier ; 781126353Smlaier 782126353Smlaierfragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 783126353Smlaier | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 784126353Smlaier | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 785126353Smlaier ; 786126353Smlaier 787126353Smlaierantispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 788126353Smlaier struct pf_rule r; 789126353Smlaier struct node_host *h = NULL; 790126353Smlaier struct node_if *i, *j; 791126353Smlaier 792126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 793126353Smlaier YYERROR; 794126353Smlaier 795126353Smlaier for (i = $3; i; i = i->next) { 796126353Smlaier bzero(&r, sizeof(r)); 797126353Smlaier 798126353Smlaier r.action = PF_DROP; 799126353Smlaier r.direction = PF_IN; 800126353Smlaier r.log = $2.log; 801126353Smlaier r.quick = $2.quick; 802126353Smlaier r.af = $4; 803126353Smlaier if (rule_label(&r, $5.label)) 804126353Smlaier YYERROR; 805126353Smlaier j = calloc(1, sizeof(struct node_if)); 806126353Smlaier if (j == NULL) 807126353Smlaier err(1, "antispoof: calloc"); 808126353Smlaier if (strlcpy(j->ifname, i->ifname, 809126353Smlaier sizeof(j->ifname)) >= sizeof(j->ifname)) { 810126353Smlaier free(j); 811126353Smlaier yyerror("interface name too long"); 812126353Smlaier YYERROR; 813126353Smlaier } 814126353Smlaier j->not = 1; 815126353Smlaier h = ifa_lookup(j->ifname, PFCTL_IFLOOKUP_NET); 816126353Smlaier 817126353Smlaier expand_rule(&r, j, NULL, NULL, NULL, h, NULL, 818126353Smlaier NULL, NULL, NULL, NULL, NULL); 819126353Smlaier 820126353Smlaier if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 821126353Smlaier bzero(&r, sizeof(r)); 822126353Smlaier 823126353Smlaier r.action = PF_DROP; 824126353Smlaier r.direction = PF_IN; 825126353Smlaier r.log = $2.log; 826126353Smlaier r.quick = $2.quick; 827126353Smlaier r.af = $4; 828126353Smlaier if (rule_label(&r, $5.label)) 829126353Smlaier YYERROR; 830126353Smlaier h = ifa_lookup(i->ifname, 831126353Smlaier PFCTL_IFLOOKUP_HOST); 832126353Smlaier expand_rule(&r, NULL, NULL, NULL, NULL, 833126353Smlaier h, NULL, NULL, NULL, NULL, NULL, 834126353Smlaier NULL); 835126353Smlaier } 836126353Smlaier } 837126353Smlaier free($5.label); 838126353Smlaier } 839126353Smlaier ; 840126353Smlaier 841126353Smlaierantispoof_ifspc : FOR if_item { $$ = $2; } 842126353Smlaier | FOR '{' antispoof_iflst '}' { $$ = $3; } 843126353Smlaier ; 844126353Smlaier 845126353Smlaierantispoof_iflst : if_item { $$ = $1; } 846126353Smlaier | antispoof_iflst comma if_item { 847126353Smlaier $1->tail->next = $3; 848126353Smlaier $1->tail = $3; 849126353Smlaier $$ = $1; 850126353Smlaier } 851126353Smlaier ; 852126353Smlaier 853126353Smlaierantispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 854126353Smlaier antispoof_opts_l 855126353Smlaier { $$ = antispoof_opts; } 856126353Smlaier | /* empty */ { 857126353Smlaier bzero(&antispoof_opts, sizeof antispoof_opts); 858126353Smlaier $$ = antispoof_opts; 859126353Smlaier } 860126353Smlaier ; 861126353Smlaier 862126353Smlaierantispoof_opts_l : antispoof_opts_l antispoof_opt 863126353Smlaier | antispoof_opt 864126353Smlaier ; 865126353Smlaier 866126353Smlaierantispoof_opt : label { 867126353Smlaier if (antispoof_opts.label) { 868126353Smlaier yyerror("label cannot be redefined"); 869126353Smlaier YYERROR; 870126353Smlaier } 871126353Smlaier antispoof_opts.label = $1; 872126353Smlaier } 873126353Smlaier ; 874126353Smlaier 875126353Smlaiernot : '!' { $$ = 1; } 876126353Smlaier | /* empty */ { $$ = 0; } 877126353Smlaier 878126353Smlaiertabledef : TABLE '<' STRING '>' table_opts { 879126353Smlaier struct node_host *h, *nh; 880126353Smlaier struct node_tinit *ti, *nti; 881126353Smlaier 882126353Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 883126353Smlaier yyerror("table name too long, max %d chars", 884126353Smlaier PF_TABLE_NAME_SIZE - 1); 885126353Smlaier YYERROR; 886126353Smlaier } 887126353Smlaier if (pf->loadopt & PFCTL_FLAG_TABLE) 888126353Smlaier if (process_tabledef($3, &$5)) 889126353Smlaier YYERROR; 890126353Smlaier for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 891126353Smlaier ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 892126353Smlaier if (ti->file) 893126353Smlaier free(ti->file); 894126353Smlaier for (h = ti->host; h != NULL; h = nh) { 895126353Smlaier nh = h->next; 896126353Smlaier free(h); 897126353Smlaier } 898126353Smlaier nti = SIMPLEQ_NEXT(ti, entries); 899126353Smlaier free (ti); 900126353Smlaier } 901126353Smlaier } 902126353Smlaier ; 903126353Smlaier 904126353Smlaiertable_opts : { 905126353Smlaier bzero(&table_opts, sizeof table_opts); 906126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 907126353Smlaier } 908126353Smlaier table_opts_l 909126353Smlaier { $$ = table_opts; } 910126353Smlaier | /* empty */ 911126353Smlaier { 912126353Smlaier bzero(&table_opts, sizeof table_opts); 913126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 914126353Smlaier $$ = table_opts; 915126353Smlaier } 916126353Smlaier ; 917126353Smlaier 918126353Smlaiertable_opts_l : table_opts_l table_opt 919126353Smlaier | table_opt 920126353Smlaier ; 921126353Smlaier 922126353Smlaiertable_opt : STRING { 923126353Smlaier if (!strcmp($1, "const")) 924126353Smlaier table_opts.flags |= PFR_TFLAG_CONST; 925126353Smlaier else if (!strcmp($1, "persist")) 926126353Smlaier table_opts.flags |= PFR_TFLAG_PERSIST; 927126353Smlaier else 928126353Smlaier YYERROR; 929126353Smlaier } 930126353Smlaier | '{' '}' { table_opts.init_addr = 1; } 931126353Smlaier | '{' host_list '}' { 932126353Smlaier struct node_host *n; 933126353Smlaier struct node_tinit *ti; 934126353Smlaier 935126353Smlaier for (n = $2; n != NULL; n = n->next) { 936126353Smlaier switch(n->addr.type) { 937126353Smlaier case PF_ADDR_ADDRMASK: 938126353Smlaier continue; /* ok */ 939126353Smlaier case PF_ADDR_DYNIFTL: 940126353Smlaier yyerror("dynamic addresses are not " 941126353Smlaier "permitted inside tables"); 942126353Smlaier break; 943126353Smlaier case PF_ADDR_TABLE: 944126353Smlaier yyerror("tables cannot contain tables"); 945126353Smlaier break; 946126353Smlaier case PF_ADDR_NOROUTE: 947126353Smlaier yyerror("\"no-route\" is not permitted " 948126353Smlaier "inside tables"); 949126353Smlaier break; 950126353Smlaier default: 951126353Smlaier yyerror("unknown address type %d", 952126353Smlaier n->addr.type); 953126353Smlaier } 954126353Smlaier YYERROR; 955126353Smlaier } 956126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 957126353Smlaier err(1, "table_opt: calloc"); 958126353Smlaier ti->host = $2; 959126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 960126353Smlaier entries); 961126353Smlaier table_opts.init_addr = 1; 962126353Smlaier } 963126353Smlaier | FILENAME STRING { 964126353Smlaier struct node_tinit *ti; 965126353Smlaier 966126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 967126353Smlaier err(1, "table_opt: calloc"); 968126353Smlaier ti->file = $2; 969126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 970126353Smlaier entries); 971126353Smlaier table_opts.init_addr = 1; 972126353Smlaier } 973126353Smlaier ; 974126353Smlaier 975126353Smlaieraltqif : ALTQ interface queue_opts QUEUE qassign { 976126353Smlaier struct pf_altq a; 977126353Smlaier 978126353Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) 979126353Smlaier YYERROR; 980126353Smlaier 981126353Smlaier memset(&a, 0, sizeof(a)); 982126353Smlaier if ($3.scheduler.qtype == ALTQT_NONE) { 983126353Smlaier yyerror("no scheduler specified!"); 984126353Smlaier YYERROR; 985126353Smlaier } 986126353Smlaier a.scheduler = $3.scheduler.qtype; 987126353Smlaier a.qlimit = $3.qlimit; 988126353Smlaier a.tbrsize = $3.tbrsize; 989126353Smlaier if ($5 == NULL) { 990126353Smlaier yyerror("no child queues specified"); 991126353Smlaier YYERROR; 992126353Smlaier } 993126353Smlaier if (expand_altq(&a, $2, $5, $3.queue_bwspec, 994126353Smlaier &$3.scheduler)) 995126353Smlaier YYERROR; 996126353Smlaier } 997126353Smlaier ; 998126353Smlaier 999126353Smlaierqueuespec : QUEUE STRING interface queue_opts qassign { 1000126353Smlaier struct pf_altq a; 1001126353Smlaier 1002126353Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) 1003126353Smlaier YYERROR; 1004126353Smlaier 1005126353Smlaier memset(&a, 0, sizeof(a)); 1006126353Smlaier 1007126353Smlaier if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1008126353Smlaier sizeof(a.qname)) { 1009126353Smlaier yyerror("queue name too long (max " 1010126353Smlaier "%d chars)", PF_QNAME_SIZE-1); 1011126353Smlaier YYERROR; 1012126353Smlaier } 1013126353Smlaier if ($4.tbrsize) { 1014126353Smlaier yyerror("cannot specify tbrsize for queue"); 1015126353Smlaier YYERROR; 1016126353Smlaier } 1017126353Smlaier if ($4.priority > 255) { 1018126353Smlaier yyerror("priority out of range: max 255"); 1019126353Smlaier YYERROR; 1020126353Smlaier } 1021126353Smlaier a.priority = $4.priority; 1022126353Smlaier a.qlimit = $4.qlimit; 1023126353Smlaier a.scheduler = $4.scheduler.qtype; 1024126353Smlaier if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1025126353Smlaier &$4.scheduler)) { 1026126353Smlaier yyerror("errors in queue definition"); 1027126353Smlaier YYERROR; 1028126353Smlaier } 1029126353Smlaier } 1030126353Smlaier ; 1031126353Smlaier 1032126353Smlaierqueue_opts : { 1033126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1034126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1035126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1036126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1037126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1038126353Smlaier } 1039126353Smlaier queue_opts_l 1040126353Smlaier { $$ = queue_opts; } 1041126353Smlaier | /* empty */ { 1042126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1043126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1044126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1045126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1046126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1047126353Smlaier $$ = queue_opts; 1048126353Smlaier } 1049126353Smlaier ; 1050126353Smlaier 1051126353Smlaierqueue_opts_l : queue_opts_l queue_opt 1052126353Smlaier | queue_opt 1053126353Smlaier ; 1054126353Smlaier 1055126353Smlaierqueue_opt : BANDWIDTH bandwidth { 1056126353Smlaier if (queue_opts.marker & QOM_BWSPEC) { 1057126353Smlaier yyerror("bandwidth cannot be respecified"); 1058126353Smlaier YYERROR; 1059126353Smlaier } 1060126353Smlaier queue_opts.marker |= QOM_BWSPEC; 1061126353Smlaier queue_opts.queue_bwspec = $2; 1062126353Smlaier } 1063126353Smlaier | PRIORITY number { 1064126353Smlaier if (queue_opts.marker & QOM_PRIORITY) { 1065126353Smlaier yyerror("priority cannot be respecified"); 1066126353Smlaier YYERROR; 1067126353Smlaier } 1068126353Smlaier if ($2 > 255) { 1069126353Smlaier yyerror("priority out of range: max 255"); 1070126353Smlaier YYERROR; 1071126353Smlaier } 1072126353Smlaier queue_opts.marker |= QOM_PRIORITY; 1073126353Smlaier queue_opts.priority = $2; 1074126353Smlaier } 1075126353Smlaier | QLIMIT number { 1076126353Smlaier if (queue_opts.marker & QOM_QLIMIT) { 1077126353Smlaier yyerror("qlimit cannot be respecified"); 1078126353Smlaier YYERROR; 1079126353Smlaier } 1080126353Smlaier if ($2 > 65535) { 1081126353Smlaier yyerror("qlimit out of range: max 65535"); 1082126353Smlaier YYERROR; 1083126353Smlaier } 1084126353Smlaier queue_opts.marker |= QOM_QLIMIT; 1085126353Smlaier queue_opts.qlimit = $2; 1086126353Smlaier } 1087126353Smlaier | scheduler { 1088126353Smlaier if (queue_opts.marker & QOM_SCHEDULER) { 1089126353Smlaier yyerror("scheduler cannot be respecified"); 1090126353Smlaier YYERROR; 1091126353Smlaier } 1092126353Smlaier queue_opts.marker |= QOM_SCHEDULER; 1093126353Smlaier queue_opts.scheduler = $1; 1094126353Smlaier } 1095126353Smlaier | TBRSIZE number { 1096126353Smlaier if (queue_opts.marker & QOM_TBRSIZE) { 1097126353Smlaier yyerror("tbrsize cannot be respecified"); 1098126353Smlaier YYERROR; 1099126353Smlaier } 1100126353Smlaier if ($2 > 65535) { 1101126353Smlaier yyerror("tbrsize too big: max 65535"); 1102126353Smlaier YYERROR; 1103126353Smlaier } 1104126353Smlaier queue_opts.marker |= QOM_TBRSIZE; 1105126353Smlaier queue_opts.tbrsize = $2; 1106126353Smlaier } 1107126353Smlaier ; 1108126353Smlaier 1109126353Smlaierbandwidth : STRING { 1110126353Smlaier double bps; 1111126353Smlaier char *cp; 1112126353Smlaier 1113126353Smlaier $$.bw_percent = 0; 1114126353Smlaier 1115126353Smlaier bps = strtod($1, &cp); 1116126353Smlaier if (cp != NULL) { 1117126353Smlaier if (!strcmp(cp, "b")) 1118126353Smlaier ; /* nothing */ 1119126353Smlaier else if (!strcmp(cp, "Kb")) 1120126353Smlaier bps *= 1000; 1121126353Smlaier else if (!strcmp(cp, "Mb")) 1122126353Smlaier bps *= 1000 * 1000; 1123126353Smlaier else if (!strcmp(cp, "Gb")) 1124126353Smlaier bps *= 1000 * 1000 * 1000; 1125126353Smlaier else if (!strcmp(cp, "%")) { 1126126353Smlaier if (bps < 0 || bps > 100) { 1127126353Smlaier yyerror("bandwidth spec " 1128126353Smlaier "out of range"); 1129126353Smlaier YYERROR; 1130126353Smlaier } 1131126353Smlaier $$.bw_percent = bps; 1132126353Smlaier bps = 0; 1133126353Smlaier } else { 1134126353Smlaier yyerror("unknown unit %s", cp); 1135126353Smlaier YYERROR; 1136126353Smlaier } 1137126353Smlaier } 1138126353Smlaier $$.bw_absolute = (u_int32_t)bps; 1139126353Smlaier } 1140126353Smlaier 1141126353Smlaierscheduler : CBQ { 1142126353Smlaier $$.qtype = ALTQT_CBQ; 1143126353Smlaier $$.data.cbq_opts.flags = 0; 1144126353Smlaier } 1145126353Smlaier | CBQ '(' cbqflags_list ')' { 1146126353Smlaier $$.qtype = ALTQT_CBQ; 1147126353Smlaier $$.data.cbq_opts.flags = $3; 1148126353Smlaier } 1149126353Smlaier | PRIQ { 1150126353Smlaier $$.qtype = ALTQT_PRIQ; 1151126353Smlaier $$.data.priq_opts.flags = 0; 1152126353Smlaier } 1153126353Smlaier | PRIQ '(' priqflags_list ')' { 1154126353Smlaier $$.qtype = ALTQT_PRIQ; 1155126353Smlaier $$.data.priq_opts.flags = $3; 1156126353Smlaier } 1157126353Smlaier | HFSC { 1158126353Smlaier $$.qtype = ALTQT_HFSC; 1159126353Smlaier bzero(&$$.data.hfsc_opts, 1160126353Smlaier sizeof(struct node_hfsc_opts)); 1161126353Smlaier } 1162126353Smlaier | HFSC '(' hfsc_opts ')' { 1163126353Smlaier $$.qtype = ALTQT_HFSC; 1164126353Smlaier $$.data.hfsc_opts = $3; 1165126353Smlaier } 1166126353Smlaier ; 1167126353Smlaier 1168126353Smlaiercbqflags_list : cbqflags_item { $$ |= $1; } 1169126353Smlaier | cbqflags_list comma cbqflags_item { $$ |= $3; } 1170126353Smlaier ; 1171126353Smlaier 1172126353Smlaiercbqflags_item : STRING { 1173126353Smlaier if (!strcmp($1, "default")) 1174126353Smlaier $$ = CBQCLF_DEFCLASS; 1175126353Smlaier else if (!strcmp($1, "borrow")) 1176126353Smlaier $$ = CBQCLF_BORROW; 1177126353Smlaier else if (!strcmp($1, "red")) 1178126353Smlaier $$ = CBQCLF_RED; 1179126353Smlaier else if (!strcmp($1, "ecn")) 1180126353Smlaier $$ = CBQCLF_RED|CBQCLF_ECN; 1181126353Smlaier else if (!strcmp($1, "rio")) 1182126353Smlaier $$ = CBQCLF_RIO; 1183126353Smlaier else { 1184126353Smlaier yyerror("unknown cbq flag \"%s\"", $1); 1185126353Smlaier YYERROR; 1186126353Smlaier } 1187126353Smlaier } 1188126353Smlaier ; 1189126353Smlaier 1190126353Smlaierpriqflags_list : priqflags_item { $$ |= $1; } 1191126353Smlaier | priqflags_list comma priqflags_item { $$ |= $3; } 1192126353Smlaier ; 1193126353Smlaier 1194126353Smlaierpriqflags_item : STRING { 1195126353Smlaier if (!strcmp($1, "default")) 1196126353Smlaier $$ = PRCF_DEFAULTCLASS; 1197126353Smlaier else if (!strcmp($1, "red")) 1198126353Smlaier $$ = PRCF_RED; 1199126353Smlaier else if (!strcmp($1, "ecn")) 1200126353Smlaier $$ = PRCF_RED|PRCF_ECN; 1201126353Smlaier else if (!strcmp($1, "rio")) 1202126353Smlaier $$ = PRCF_RIO; 1203126353Smlaier else { 1204126353Smlaier yyerror("unknown priq flag \"%s\"", $1); 1205126353Smlaier YYERROR; 1206126353Smlaier } 1207126353Smlaier } 1208126353Smlaier ; 1209126353Smlaier 1210126353Smlaierhfsc_opts : { 1211126353Smlaier bzero(&hfsc_opts, 1212126353Smlaier sizeof(struct node_hfsc_opts)); 1213126353Smlaier } 1214126353Smlaier hfscopts_list { 1215126353Smlaier $$ = hfsc_opts; 1216126353Smlaier } 1217126353Smlaier ; 1218126353Smlaier 1219126353Smlaierhfscopts_list : hfscopts_item 1220126353Smlaier | hfscopts_list comma hfscopts_item 1221126353Smlaier ; 1222126353Smlaier 1223126353Smlaierhfscopts_item : LINKSHARE bandwidth { 1224126353Smlaier if (hfsc_opts.linkshare.used) { 1225126353Smlaier yyerror("linkshare already specified"); 1226126353Smlaier YYERROR; 1227126353Smlaier } 1228126353Smlaier hfsc_opts.linkshare.m2 = $2; 1229126353Smlaier hfsc_opts.linkshare.used = 1; 1230126353Smlaier } 1231126353Smlaier | LINKSHARE '(' bandwidth number bandwidth ')' { 1232126353Smlaier if (hfsc_opts.linkshare.used) { 1233126353Smlaier yyerror("linkshare already specified"); 1234126353Smlaier YYERROR; 1235126353Smlaier } 1236126353Smlaier hfsc_opts.linkshare.m1 = $3; 1237126353Smlaier hfsc_opts.linkshare.d = $4; 1238126353Smlaier hfsc_opts.linkshare.m2 = $5; 1239126353Smlaier hfsc_opts.linkshare.used = 1; 1240126353Smlaier } 1241126353Smlaier | REALTIME bandwidth { 1242126353Smlaier if (hfsc_opts.realtime.used) { 1243126353Smlaier yyerror("realtime already specified"); 1244126353Smlaier YYERROR; 1245126353Smlaier } 1246126353Smlaier hfsc_opts.realtime.m2 = $2; 1247126353Smlaier hfsc_opts.realtime.used = 1; 1248126353Smlaier } 1249126353Smlaier | REALTIME '(' bandwidth number bandwidth ')' { 1250126353Smlaier if (hfsc_opts.realtime.used) { 1251126353Smlaier yyerror("realtime already specified"); 1252126353Smlaier YYERROR; 1253126353Smlaier } 1254126353Smlaier hfsc_opts.realtime.m1 = $3; 1255126353Smlaier hfsc_opts.realtime.d = $4; 1256126353Smlaier hfsc_opts.realtime.m2 = $5; 1257126353Smlaier hfsc_opts.realtime.used = 1; 1258126353Smlaier } 1259126353Smlaier | UPPERLIMIT bandwidth { 1260126353Smlaier if (hfsc_opts.upperlimit.used) { 1261126353Smlaier yyerror("upperlimit already specified"); 1262126353Smlaier YYERROR; 1263126353Smlaier } 1264126353Smlaier hfsc_opts.upperlimit.m2 = $2; 1265126353Smlaier hfsc_opts.upperlimit.used = 1; 1266126353Smlaier } 1267126353Smlaier | UPPERLIMIT '(' bandwidth number bandwidth ')' { 1268126353Smlaier if (hfsc_opts.upperlimit.used) { 1269126353Smlaier yyerror("upperlimit already specified"); 1270126353Smlaier YYERROR; 1271126353Smlaier } 1272126353Smlaier hfsc_opts.upperlimit.m1 = $3; 1273126353Smlaier hfsc_opts.upperlimit.d = $4; 1274126353Smlaier hfsc_opts.upperlimit.m2 = $5; 1275126353Smlaier hfsc_opts.upperlimit.used = 1; 1276126353Smlaier } 1277126353Smlaier | STRING { 1278126353Smlaier if (!strcmp($1, "default")) 1279126353Smlaier hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1280126353Smlaier else if (!strcmp($1, "red")) 1281126353Smlaier hfsc_opts.flags |= HFCF_RED; 1282126353Smlaier else if (!strcmp($1, "ecn")) 1283126353Smlaier hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1284126353Smlaier else if (!strcmp($1, "rio")) 1285126353Smlaier hfsc_opts.flags |= HFCF_RIO; 1286126353Smlaier else { 1287126353Smlaier yyerror("unknown hfsc flag \"%s\"", $1); 1288126353Smlaier YYERROR; 1289126353Smlaier } 1290126353Smlaier } 1291126353Smlaier ; 1292126353Smlaier 1293126353Smlaierqassign : /* empty */ { $$ = NULL; } 1294126353Smlaier | qassign_item { $$ = $1; } 1295126353Smlaier | '{' qassign_list '}' { $$ = $2; } 1296126353Smlaier ; 1297126353Smlaier 1298126353Smlaierqassign_list : qassign_item { $$ = $1; } 1299126353Smlaier | qassign_list comma qassign_item { 1300126353Smlaier $1->tail->next = $3; 1301126353Smlaier $1->tail = $3; 1302126353Smlaier $$ = $1; 1303126353Smlaier } 1304126353Smlaier ; 1305126353Smlaier 1306126353Smlaierqassign_item : STRING { 1307126353Smlaier $$ = calloc(1, sizeof(struct node_queue)); 1308126353Smlaier if ($$ == NULL) 1309126353Smlaier err(1, "qassign_item: calloc"); 1310126353Smlaier if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1311126353Smlaier sizeof($$->queue)) { 1312126353Smlaier free($$); 1313126353Smlaier yyerror("queue name '%s' too long (max " 1314126353Smlaier "%d chars)", $1, sizeof($$->queue)-1); 1315126353Smlaier YYERROR; 1316126353Smlaier } 1317126353Smlaier $$->next = NULL; 1318126353Smlaier $$->tail = $$; 1319126353Smlaier } 1320126353Smlaier ; 1321126353Smlaier 1322126353Smlaierpfrule : action dir logquick interface route af proto fromto 1323126353Smlaier filter_opts 1324126353Smlaier { 1325126353Smlaier struct pf_rule r; 1326126353Smlaier struct node_state_opt *o; 1327126353Smlaier struct node_proto *proto; 1328126353Smlaier 1329126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 1330126353Smlaier YYERROR; 1331126353Smlaier 1332126353Smlaier memset(&r, 0, sizeof(r)); 1333126353Smlaier 1334126353Smlaier r.action = $1.b1; 1335126353Smlaier switch ($1.b2) { 1336126353Smlaier case PFRULE_RETURNRST: 1337126353Smlaier r.rule_flag |= PFRULE_RETURNRST; 1338126353Smlaier r.return_ttl = $1.w; 1339126353Smlaier break; 1340126353Smlaier case PFRULE_RETURNICMP: 1341126353Smlaier r.rule_flag |= PFRULE_RETURNICMP; 1342126353Smlaier r.return_icmp = $1.w; 1343126353Smlaier r.return_icmp6 = $1.w2; 1344126353Smlaier break; 1345126353Smlaier case PFRULE_RETURN: 1346126353Smlaier r.rule_flag |= PFRULE_RETURN; 1347126353Smlaier r.return_icmp = $1.w; 1348126353Smlaier r.return_icmp6 = $1.w2; 1349126353Smlaier break; 1350126353Smlaier } 1351126353Smlaier r.direction = $2; 1352126353Smlaier r.log = $3.log; 1353126353Smlaier r.quick = $3.quick; 1354126353Smlaier 1355126353Smlaier r.af = $6; 1356126353Smlaier if ($9.tag) 1357126353Smlaier if (strlcpy(r.tagname, $9.tag, 1358126353Smlaier PF_TAG_NAME_SIZE) > PF_TAG_NAME_SIZE) { 1359126353Smlaier yyerror("tag too long, max %u chars", 1360126353Smlaier PF_TAG_NAME_SIZE - 1); 1361126353Smlaier YYERROR; 1362126353Smlaier } 1363126353Smlaier if ($9.match_tag) 1364126353Smlaier if (strlcpy(r.match_tagname, $9.match_tag, 1365126353Smlaier PF_TAG_NAME_SIZE) > PF_TAG_NAME_SIZE) { 1366126353Smlaier yyerror("tag too long, max %u chars", 1367126353Smlaier PF_TAG_NAME_SIZE - 1); 1368126353Smlaier YYERROR; 1369126353Smlaier } 1370126353Smlaier r.match_tag_not = $9.match_tag_not; 1371126353Smlaier r.flags = $9.flags.b1; 1372126353Smlaier r.flagset = $9.flags.b2; 1373126353Smlaier if (rule_label(&r, $9.label)) 1374126353Smlaier YYERROR; 1375126353Smlaier free($9.label); 1376126353Smlaier if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1377126353Smlaier for (proto = $7; proto != NULL && 1378126353Smlaier proto->proto != IPPROTO_TCP; 1379126353Smlaier proto = proto->next) 1380126353Smlaier ; /* nothing */ 1381126353Smlaier if (proto == NULL && $7 != NULL) { 1382126353Smlaier if ($9.flags.b1 || $9.flags.b2) 1383126353Smlaier yyerror( 1384126353Smlaier "flags only apply to tcp"); 1385126353Smlaier if ($8.src_os) 1386126353Smlaier yyerror( 1387126353Smlaier "OS fingerprinting only " 1388126353Smlaier "apply to tcp"); 1389126353Smlaier YYERROR; 1390126353Smlaier } 1391126353Smlaier#if 0 1392126353Smlaier if (($9.flags.b1 & parse_flags("S")) == 0 && 1393126353Smlaier $8.src_os) { 1394126353Smlaier yyerror("OS fingerprinting requires " 1395126353Smlaier "the SYN TCP flag (flags S/SA)"); 1396126353Smlaier YYERROR; 1397126353Smlaier } 1398126353Smlaier#endif 1399126353Smlaier } 1400126353Smlaier 1401126353Smlaier r.tos = $9.tos; 1402126353Smlaier r.keep_state = $9.keep.action; 1403126353Smlaier o = $9.keep.options; 1404126353Smlaier while (o) { 1405126353Smlaier struct node_state_opt *p = o; 1406126353Smlaier 1407126353Smlaier switch (o->type) { 1408126353Smlaier case PF_STATE_OPT_MAX: 1409126353Smlaier if (r.max_states) { 1410126353Smlaier yyerror("state option 'max' " 1411126353Smlaier "multiple definitions"); 1412126353Smlaier YYERROR; 1413126353Smlaier } 1414126353Smlaier r.max_states = o->data.max_states; 1415126353Smlaier break; 1416126353Smlaier case PF_STATE_OPT_TIMEOUT: 1417126353Smlaier if (r.timeout[o->data.timeout.number]) { 1418126353Smlaier yyerror("state timeout %s " 1419126353Smlaier "multiple definitions", 1420126353Smlaier pf_timeouts[o->data. 1421126353Smlaier timeout.number].name); 1422126353Smlaier YYERROR; 1423126353Smlaier } 1424126353Smlaier r.timeout[o->data.timeout.number] = 1425126353Smlaier o->data.timeout.seconds; 1426126353Smlaier } 1427126353Smlaier o = o->next; 1428126353Smlaier free(p); 1429126353Smlaier } 1430126353Smlaier 1431126353Smlaier if ($9.fragment) 1432126353Smlaier r.rule_flag |= PFRULE_FRAGMENT; 1433126353Smlaier r.allow_opts = $9.allowopts; 1434126353Smlaier 1435126353Smlaier decide_address_family($8.src.host, &r.af); 1436126353Smlaier decide_address_family($8.dst.host, &r.af); 1437126353Smlaier 1438126353Smlaier if ($5.rt) { 1439126353Smlaier if (!r.direction) { 1440126353Smlaier yyerror("direction must be explicit " 1441126353Smlaier "with rules that specify routing"); 1442126353Smlaier YYERROR; 1443126353Smlaier } 1444126353Smlaier r.rt = $5.rt; 1445126353Smlaier r.rpool.opts = $5.pool_opts; 1446126353Smlaier if ($5.key != NULL) 1447126353Smlaier memcpy(&r.rpool.key, $5.key, 1448126353Smlaier sizeof(struct pf_poolhashkey)); 1449126353Smlaier } 1450126353Smlaier if (r.rt && r.rt != PF_FASTROUTE) { 1451126353Smlaier decide_address_family($5.host, &r.af); 1452126353Smlaier remove_invalid_hosts(&$5.host, &r.af); 1453126353Smlaier if ($5.host == NULL) { 1454126353Smlaier yyerror("no routing address with " 1455126353Smlaier "matching address family found."); 1456126353Smlaier YYERROR; 1457126353Smlaier } 1458126353Smlaier if (r.rpool.opts == PF_POOL_NONE && ( 1459126353Smlaier $5.host->next != NULL || 1460126353Smlaier $5.host->addr.type == PF_ADDR_TABLE)) 1461126353Smlaier r.rpool.opts = PF_POOL_ROUNDROBIN; 1462126353Smlaier if (r.rpool.opts != PF_POOL_ROUNDROBIN) 1463126353Smlaier if (disallow_table($5.host, "tables " 1464126353Smlaier "are only supported in round-robin " 1465126353Smlaier "routing pools")) 1466126353Smlaier YYERROR; 1467126353Smlaier if ($5.host->next != NULL) { 1468126353Smlaier if (r.rpool.opts != 1469126353Smlaier PF_POOL_ROUNDROBIN) { 1470126353Smlaier yyerror("r.rpool.opts must " 1471126353Smlaier "be PF_POOL_ROUNDROBIN"); 1472126353Smlaier YYERROR; 1473126353Smlaier } 1474126353Smlaier } 1475126353Smlaier } 1476126353Smlaier if ($9.queues.qname != NULL) { 1477126353Smlaier if (strlcpy(r.qname, $9.queues.qname, 1478126353Smlaier sizeof(r.qname)) >= sizeof(r.qname)) { 1479126353Smlaier yyerror("rule qname too long (max " 1480126353Smlaier "%d chars)", sizeof(r.qname)-1); 1481126353Smlaier YYERROR; 1482126353Smlaier } 1483126353Smlaier free($9.queues.qname); 1484126353Smlaier } 1485126353Smlaier if ($9.queues.pqname != NULL) { 1486126353Smlaier if (strlcpy(r.pqname, $9.queues.pqname, 1487126353Smlaier sizeof(r.pqname)) >= sizeof(r.pqname)) { 1488126353Smlaier yyerror("rule pqname too long (max " 1489126353Smlaier "%d chars)", sizeof(r.pqname)-1); 1490126353Smlaier YYERROR; 1491126353Smlaier } 1492126353Smlaier free($9.queues.pqname); 1493126353Smlaier } 1494126353Smlaier 1495126353Smlaier expand_rule(&r, $4, $5.host, $7, $8.src_os, 1496126353Smlaier $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1497126353Smlaier $9.uid, $9.gid, $9.icmpspec); 1498126353Smlaier } 1499126353Smlaier ; 1500126353Smlaier 1501126353Smlaierfilter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1502126353Smlaier filter_opts_l 1503126353Smlaier { $$ = filter_opts; } 1504126353Smlaier | /* empty */ { 1505126353Smlaier bzero(&filter_opts, sizeof filter_opts); 1506126353Smlaier $$ = filter_opts; 1507126353Smlaier } 1508126353Smlaier ; 1509126353Smlaier 1510126353Smlaierfilter_opts_l : filter_opts_l filter_opt 1511126353Smlaier | filter_opt 1512126353Smlaier ; 1513126353Smlaier 1514126353Smlaierfilter_opt : USER uids { 1515126353Smlaier if (filter_opts.uid) 1516126353Smlaier $2->tail->next = filter_opts.uid; 1517126353Smlaier filter_opts.uid = $2; 1518126353Smlaier } 1519126353Smlaier | GROUP gids { 1520126353Smlaier if (filter_opts.gid) 1521126353Smlaier $2->tail->next = filter_opts.gid; 1522126353Smlaier filter_opts.gid = $2; 1523126353Smlaier } 1524126353Smlaier | flags { 1525126353Smlaier if (filter_opts.marker & FOM_FLAGS) { 1526126353Smlaier yyerror("flags cannot be redefined"); 1527126353Smlaier YYERROR; 1528126353Smlaier } 1529126353Smlaier filter_opts.marker |= FOM_FLAGS; 1530126353Smlaier filter_opts.flags.b1 |= $1.b1; 1531126353Smlaier filter_opts.flags.b2 |= $1.b2; 1532126353Smlaier filter_opts.flags.w |= $1.w; 1533126353Smlaier filter_opts.flags.w2 |= $1.w2; 1534126353Smlaier } 1535126353Smlaier | icmpspec { 1536126353Smlaier if (filter_opts.marker & FOM_ICMP) { 1537126353Smlaier yyerror("icmp-type cannot be redefined"); 1538126353Smlaier YYERROR; 1539126353Smlaier } 1540126353Smlaier filter_opts.marker |= FOM_ICMP; 1541126353Smlaier filter_opts.icmpspec = $1; 1542126353Smlaier } 1543126353Smlaier | tos { 1544126353Smlaier if (filter_opts.marker & FOM_TOS) { 1545126353Smlaier yyerror("tos cannot be redefined"); 1546126353Smlaier YYERROR; 1547126353Smlaier } 1548126353Smlaier filter_opts.marker |= FOM_TOS; 1549126353Smlaier filter_opts.tos = $1; 1550126353Smlaier } 1551126353Smlaier | keep { 1552126353Smlaier if (filter_opts.marker & FOM_KEEP) { 1553126353Smlaier yyerror("modulate or keep cannot be redefined"); 1554126353Smlaier YYERROR; 1555126353Smlaier } 1556126353Smlaier filter_opts.marker |= FOM_KEEP; 1557126353Smlaier filter_opts.keep.action = $1.action; 1558126353Smlaier filter_opts.keep.options = $1.options; 1559126353Smlaier } 1560126353Smlaier | FRAGMENT { 1561126353Smlaier filter_opts.fragment = 1; 1562126353Smlaier } 1563126353Smlaier | ALLOWOPTS { 1564126353Smlaier filter_opts.allowopts = 1; 1565126353Smlaier } 1566126353Smlaier | label { 1567126353Smlaier if (filter_opts.label) { 1568126353Smlaier yyerror("label cannot be redefined"); 1569126353Smlaier YYERROR; 1570126353Smlaier } 1571126353Smlaier filter_opts.label = $1; 1572126353Smlaier } 1573126353Smlaier | qname { 1574126353Smlaier if (filter_opts.queues.qname) { 1575126353Smlaier yyerror("queue cannot be redefined"); 1576126353Smlaier YYERROR; 1577126353Smlaier } 1578126353Smlaier filter_opts.queues = $1; 1579126353Smlaier } 1580126353Smlaier | TAG string { 1581126353Smlaier filter_opts.tag = $2; 1582126353Smlaier } 1583126353Smlaier | not TAGGED string { 1584126353Smlaier filter_opts.match_tag = $3; 1585126353Smlaier filter_opts.match_tag_not = $1; 1586126353Smlaier } 1587126353Smlaier ; 1588126353Smlaier 1589126353Smlaieraction : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 1590126353Smlaier | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 1591126353Smlaier ; 1592126353Smlaier 1593126353Smlaierblockspec : /* empty */ { 1594126353Smlaier $$.b2 = blockpolicy; 1595126353Smlaier $$.w = returnicmpdefault; 1596126353Smlaier $$.w2 = returnicmp6default; 1597126353Smlaier } 1598126353Smlaier | DROP { 1599126353Smlaier $$.b2 = PFRULE_DROP; 1600126353Smlaier $$.w = 0; 1601126353Smlaier $$.w2 = 0; 1602126353Smlaier } 1603126353Smlaier | RETURNRST { 1604126353Smlaier $$.b2 = PFRULE_RETURNRST; 1605126353Smlaier $$.w = 0; 1606126353Smlaier $$.w2 = 0; 1607126353Smlaier } 1608126353Smlaier | RETURNRST '(' TTL number ')' { 1609126353Smlaier if ($4 > 255) { 1610126353Smlaier yyerror("illegal ttl value %d", $4); 1611126353Smlaier YYERROR; 1612126353Smlaier } 1613126353Smlaier $$.b2 = PFRULE_RETURNRST; 1614126353Smlaier $$.w = $4; 1615126353Smlaier $$.w2 = 0; 1616126353Smlaier } 1617126353Smlaier | RETURNICMP { 1618126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1619126353Smlaier $$.w = returnicmpdefault; 1620126353Smlaier $$.w2 = returnicmp6default; 1621126353Smlaier } 1622126353Smlaier | RETURNICMP6 { 1623126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1624126353Smlaier $$.w = returnicmpdefault; 1625126353Smlaier $$.w2 = returnicmp6default; 1626126353Smlaier } 1627126353Smlaier | RETURNICMP '(' STRING ')' { 1628126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1629126353Smlaier if (!($$.w = parseicmpspec($3, AF_INET))) 1630126353Smlaier YYERROR; 1631126353Smlaier $$.w2 = returnicmp6default; 1632126353Smlaier } 1633126353Smlaier | RETURNICMP6 '(' STRING ')' { 1634126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1635126353Smlaier $$.w = returnicmpdefault; 1636126353Smlaier if (!($$.w2 = parseicmpspec($3, AF_INET6))) 1637126353Smlaier YYERROR; 1638126353Smlaier } 1639126353Smlaier | RETURNICMP '(' STRING comma STRING ')' { 1640126353Smlaier $$.b2 = PFRULE_RETURNICMP; 1641126353Smlaier if (!($$.w = parseicmpspec($3, AF_INET))) 1642126353Smlaier YYERROR; 1643126353Smlaier if (!($$.w2 = parseicmpspec($5, AF_INET6))) 1644126353Smlaier YYERROR; 1645126353Smlaier } 1646126353Smlaier | RETURN { 1647126353Smlaier $$.b2 = PFRULE_RETURN; 1648126353Smlaier $$.w = returnicmpdefault; 1649126353Smlaier $$.w2 = returnicmp6default; 1650126353Smlaier } 1651126353Smlaier ; 1652126353Smlaier 1653126353Smlaierdir : /* empty */ { $$ = 0; } 1654126353Smlaier | IN { $$ = PF_IN; } 1655126353Smlaier | OUT { $$ = PF_OUT; } 1656126353Smlaier ; 1657126353Smlaier 1658126353Smlaierlogquick : /* empty */ { $$.log = 0; $$.quick = 0; } 1659126353Smlaier | log { $$.log = $1; $$.quick = 0; } 1660126353Smlaier | QUICK { $$.log = 0; $$.quick = 1; } 1661126353Smlaier | log QUICK { $$.log = $1; $$.quick = 1; } 1662126353Smlaier | QUICK log { $$.log = $2; $$.quick = 1; } 1663126353Smlaier ; 1664126353Smlaier 1665126353Smlaierlog : LOG { $$ = 1; } 1666126353Smlaier | LOGALL { $$ = 2; } 1667126353Smlaier ; 1668126353Smlaier 1669126353Smlaierinterface : /* empty */ { $$ = NULL; } 1670126353Smlaier | ON if_item_not { $$ = $2; } 1671126353Smlaier | ON '{' if_list '}' { $$ = $3; } 1672126353Smlaier ; 1673126353Smlaier 1674126353Smlaierif_list : if_item_not { $$ = $1; } 1675126353Smlaier | if_list comma if_item_not { 1676126353Smlaier $1->tail->next = $3; 1677126353Smlaier $1->tail = $3; 1678126353Smlaier $$ = $1; 1679126353Smlaier } 1680126353Smlaier ; 1681126353Smlaier 1682126353Smlaierif_item_not : not if_item { $$ = $2; $$->not = $1; } 1683126353Smlaier ; 1684126353Smlaier 1685126353Smlaierif_item : STRING { 1686126353Smlaier struct node_host *n; 1687126353Smlaier 1688126353Smlaier if ((n = ifa_exists($1)) == NULL) { 1689126353Smlaier yyerror("unknown interface %s", $1); 1690126353Smlaier YYERROR; 1691126353Smlaier } 1692126353Smlaier $$ = calloc(1, sizeof(struct node_if)); 1693126353Smlaier if ($$ == NULL) 1694126353Smlaier err(1, "if_item: calloc"); 1695126353Smlaier if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 1696126353Smlaier sizeof($$->ifname)) { 1697126353Smlaier free($$); 1698126353Smlaier yyerror("interface name too long"); 1699126353Smlaier YYERROR; 1700126353Smlaier } 1701126353Smlaier $$->ifa_flags = n->ifa_flags; 1702126353Smlaier $$->not = 0; 1703126353Smlaier $$->next = NULL; 1704126353Smlaier $$->tail = $$; 1705126353Smlaier } 1706126353Smlaier ; 1707126353Smlaier 1708126353Smlaieraf : /* empty */ { $$ = 0; } 1709126353Smlaier | INET { $$ = AF_INET; } 1710126353Smlaier | INET6 { $$ = AF_INET6; } 1711126353Smlaier 1712126353Smlaierproto : /* empty */ { $$ = NULL; } 1713126353Smlaier | PROTO proto_item { $$ = $2; } 1714126353Smlaier | PROTO '{' proto_list '}' { $$ = $3; } 1715126353Smlaier ; 1716126353Smlaier 1717126353Smlaierproto_list : proto_item { $$ = $1; } 1718126353Smlaier | proto_list comma proto_item { 1719126353Smlaier $1->tail->next = $3; 1720126353Smlaier $1->tail = $3; 1721126353Smlaier $$ = $1; 1722126353Smlaier } 1723126353Smlaier ; 1724126353Smlaier 1725126353Smlaierproto_item : STRING { 1726126353Smlaier u_int8_t pr; 1727126353Smlaier u_long ulval; 1728126353Smlaier 1729126353Smlaier if (atoul($1, &ulval) == 0) { 1730126353Smlaier if (ulval > 255) { 1731126353Smlaier yyerror("protocol outside range"); 1732126353Smlaier YYERROR; 1733126353Smlaier } 1734126353Smlaier pr = (u_int8_t)ulval; 1735126353Smlaier } else { 1736126353Smlaier struct protoent *p; 1737126353Smlaier 1738126353Smlaier p = getprotobyname($1); 1739126353Smlaier if (p == NULL) { 1740126353Smlaier yyerror("unknown protocol %s", $1); 1741126353Smlaier YYERROR; 1742126353Smlaier } 1743126353Smlaier pr = p->p_proto; 1744126353Smlaier } 1745126353Smlaier if (pr == 0) { 1746126353Smlaier yyerror("proto 0 cannot be used"); 1747126353Smlaier YYERROR; 1748126353Smlaier } 1749126353Smlaier $$ = calloc(1, sizeof(struct node_proto)); 1750126353Smlaier if ($$ == NULL) 1751126353Smlaier err(1, "proto_item: calloc"); 1752126353Smlaier $$->proto = pr; 1753126353Smlaier $$->next = NULL; 1754126353Smlaier $$->tail = $$; 1755126353Smlaier } 1756126353Smlaier ; 1757126353Smlaier 1758126353Smlaierfromto : ALL { 1759126353Smlaier $$.src.host = NULL; 1760126353Smlaier $$.src.port = NULL; 1761126353Smlaier $$.dst.host = NULL; 1762126353Smlaier $$.dst.port = NULL; 1763126353Smlaier $$.src_os = NULL; 1764126353Smlaier } 1765126353Smlaier | from os to { 1766126353Smlaier $$.src = $1; 1767126353Smlaier $$.src_os = $2; 1768126353Smlaier $$.dst = $3; 1769126353Smlaier } 1770126353Smlaier ; 1771126353Smlaier 1772126353Smlaieros : /* empty */ { $$ = NULL; } 1773126353Smlaier | OS xos { $$ = $2; } 1774126353Smlaier | OS '{' os_list '}' { $$ = $3; } 1775126353Smlaier ; 1776126353Smlaier 1777126353Smlaierxos : STRING { 1778126353Smlaier $$ = calloc(1, sizeof(struct node_os)); 1779126353Smlaier if ($$ == NULL) 1780126353Smlaier err(1, "os: calloc"); 1781126353Smlaier $$->os = $1; 1782126353Smlaier $$->tail = $$; 1783126353Smlaier } 1784126353Smlaier ; 1785126353Smlaier 1786126353Smlaieros_list : xos { $$ = $1; } 1787126353Smlaier | os_list comma xos { 1788126353Smlaier $1->tail->next = $3; 1789126353Smlaier $1->tail = $3; 1790126353Smlaier $$ = $1; 1791126353Smlaier } 1792126353Smlaier ; 1793126353Smlaier 1794126353Smlaierfrom : /* empty */ { 1795126353Smlaier $$.host = NULL; 1796126353Smlaier $$.port = NULL; 1797126353Smlaier } 1798126353Smlaier | FROM ipportspec { 1799126353Smlaier $$ = $2; 1800126353Smlaier } 1801126353Smlaier ; 1802126353Smlaier 1803126353Smlaierto : /* empty */ { 1804126353Smlaier $$.host = NULL; 1805126353Smlaier $$.port = NULL; 1806126353Smlaier } 1807126353Smlaier | TO ipportspec { 1808126353Smlaier $$ = $2; 1809126353Smlaier } 1810126353Smlaier ; 1811126353Smlaier 1812126353Smlaieripportspec : ipspec { 1813126353Smlaier $$.host = $1; 1814126353Smlaier $$.port = NULL; 1815126353Smlaier } 1816126353Smlaier | ipspec PORT portspec { 1817126353Smlaier $$.host = $1; 1818126353Smlaier $$.port = $3; 1819126353Smlaier } 1820126353Smlaier | PORT portspec { 1821126353Smlaier $$.host = NULL; 1822126353Smlaier $$.port = $2; 1823126353Smlaier } 1824126353Smlaier ; 1825126353Smlaier 1826126353Smlaieripspec : ANY { $$ = NULL; } 1827126353Smlaier | xhost { $$ = $1; } 1828126353Smlaier | '{' host_list '}' { $$ = $2; } 1829126353Smlaier ; 1830126353Smlaier 1831126353Smlaierhost_list : xhost { $$ = $1; } 1832126353Smlaier | host_list comma xhost { 1833126353Smlaier if ($3 == NULL) 1834126353Smlaier $$ = $1; 1835126353Smlaier else if ($1 == NULL) 1836126353Smlaier $$ = $3; 1837126353Smlaier else { 1838126353Smlaier $1->tail->next = $3; 1839126353Smlaier $1->tail = $3->tail; 1840126353Smlaier $$ = $1; 1841126353Smlaier } 1842126353Smlaier } 1843126353Smlaier ; 1844126353Smlaier 1845126353Smlaierxhost : not host { 1846126353Smlaier struct node_host *n; 1847126353Smlaier 1848126353Smlaier for (n = $2; n != NULL; n = n->next) 1849126353Smlaier n->not = $1; 1850126353Smlaier $$ = $2; 1851126353Smlaier } 1852126353Smlaier | NOROUTE { 1853126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 1854126353Smlaier if ($$ == NULL) 1855126353Smlaier err(1, "xhost: calloc"); 1856126353Smlaier $$->addr.type = PF_ADDR_NOROUTE; 1857126353Smlaier $$->next = NULL; 1858126353Smlaier $$->tail = $$; 1859126353Smlaier } 1860126353Smlaier ; 1861126353Smlaier 1862126353Smlaierhost : STRING { 1863126353Smlaier if (($$ = host($1)) == NULL) { 1864126353Smlaier /* error. "any" is handled elsewhere */ 1865126353Smlaier yyerror("could not parse host specification"); 1866126353Smlaier YYERROR; 1867126353Smlaier } 1868126353Smlaier 1869126353Smlaier } 1870126353Smlaier | STRING '/' number { 1871126353Smlaier char *buf; 1872126353Smlaier 1873126353Smlaier if (asprintf(&buf, "%s/%u", $1, $3) == -1) 1874126353Smlaier err(1, "host: asprintf"); 1875126353Smlaier if (($$ = host(buf)) == NULL) { 1876126353Smlaier /* error. "any" is handled elsewhere */ 1877126353Smlaier free(buf); 1878126353Smlaier yyerror("could not parse host specification"); 1879126353Smlaier YYERROR; 1880126353Smlaier } 1881126353Smlaier free(buf); 1882126353Smlaier } 1883126353Smlaier | dynaddr 1884126353Smlaier | dynaddr '/' number { 1885126353Smlaier struct node_host *n; 1886126353Smlaier 1887126353Smlaier $$ = $1; 1888126353Smlaier for (n = $1; n != NULL; n = n->next) 1889126353Smlaier set_ipmask(n, $3); 1890126353Smlaier } 1891126353Smlaier | '<' STRING '>' { 1892126353Smlaier if (strlen($2) >= PF_TABLE_NAME_SIZE) { 1893126353Smlaier yyerror("table name '%s' too long"); 1894126353Smlaier YYERROR; 1895126353Smlaier } 1896126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 1897126353Smlaier if ($$ == NULL) 1898126353Smlaier err(1, "host: calloc"); 1899126353Smlaier $$->addr.type = PF_ADDR_TABLE; 1900126353Smlaier if (strlcpy($$->addr.v.tblname, $2, 1901126353Smlaier sizeof($$->addr.v.tblname)) >= 1902126353Smlaier sizeof($$->addr.v.tblname)) 1903126353Smlaier errx(1, "host: strlcpy"); 1904126353Smlaier $$->next = NULL; 1905126353Smlaier $$->tail = $$; 1906126353Smlaier } 1907126353Smlaier ; 1908126353Smlaier 1909126353Smlaiernumber : STRING { 1910126353Smlaier u_long ulval; 1911126353Smlaier 1912126353Smlaier if (atoul($1, &ulval) == -1) { 1913126353Smlaier yyerror("%s is not a number", $1); 1914126353Smlaier YYERROR; 1915126353Smlaier } else 1916126353Smlaier $$ = ulval; 1917126353Smlaier } 1918126353Smlaier ; 1919126353Smlaier 1920126353Smlaierdynaddr : '(' STRING ')' { 1921126353Smlaier if (ifa_exists($2) == NULL) { 1922126353Smlaier yyerror("interface %s does not exist", $2); 1923126353Smlaier YYERROR; 1924126353Smlaier } 1925126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 1926126353Smlaier if ($$ == NULL) 1927126353Smlaier err(1, "address: calloc"); 1928126353Smlaier $$->af = 0; 1929126353Smlaier set_ipmask($$, 128); 1930126353Smlaier $$->addr.type = PF_ADDR_DYNIFTL; 1931126353Smlaier if (strlcpy($$->addr.v.ifname, $2, 1932126353Smlaier sizeof($$->addr.v.ifname)) >= 1933126353Smlaier sizeof($$->addr.v.ifname)) { 1934126353Smlaier free($$); 1935126353Smlaier yyerror("interface name too long"); 1936126353Smlaier YYERROR; 1937126353Smlaier } 1938126353Smlaier $$->next = NULL; 1939126353Smlaier $$->tail = $$; 1940126353Smlaier } 1941126353Smlaier ; 1942126353Smlaier 1943126353Smlaierportspec : port_item { $$ = $1; } 1944126353Smlaier | '{' port_list '}' { $$ = $2; } 1945126353Smlaier ; 1946126353Smlaier 1947126353Smlaierport_list : port_item { $$ = $1; } 1948126353Smlaier | port_list comma port_item { 1949126353Smlaier $1->tail->next = $3; 1950126353Smlaier $1->tail = $3; 1951126353Smlaier $$ = $1; 1952126353Smlaier } 1953126353Smlaier ; 1954126353Smlaier 1955126353Smlaierport_item : port { 1956126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 1957126353Smlaier if ($$ == NULL) 1958126353Smlaier err(1, "port_item: calloc"); 1959126353Smlaier $$->port[0] = $1.a; 1960126353Smlaier $$->port[1] = $1.b; 1961126353Smlaier if ($1.t) 1962126353Smlaier $$->op = PF_OP_RRG; 1963126353Smlaier else 1964126353Smlaier $$->op = PF_OP_EQ; 1965126353Smlaier $$->next = NULL; 1966126353Smlaier $$->tail = $$; 1967126353Smlaier } 1968126353Smlaier | unaryop port { 1969126353Smlaier if ($2.t) { 1970126353Smlaier yyerror("':' cannot be used with an other " 1971126353Smlaier "port operator"); 1972126353Smlaier YYERROR; 1973126353Smlaier } 1974126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 1975126353Smlaier if ($$ == NULL) 1976126353Smlaier err(1, "port_item: calloc"); 1977126353Smlaier $$->port[0] = $2.a; 1978126353Smlaier $$->port[1] = $2.b; 1979126353Smlaier $$->op = $1; 1980126353Smlaier $$->next = NULL; 1981126353Smlaier $$->tail = $$; 1982126353Smlaier } 1983126353Smlaier | port PORTBINARY port { 1984126353Smlaier if ($1.t || $3.t) { 1985126353Smlaier yyerror("':' cannot be used with an other " 1986126353Smlaier "port operator"); 1987126353Smlaier YYERROR; 1988126353Smlaier } 1989126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 1990126353Smlaier if ($$ == NULL) 1991126353Smlaier err(1, "port_item: calloc"); 1992126353Smlaier $$->port[0] = $1.a; 1993126353Smlaier $$->port[1] = $3.a; 1994126353Smlaier $$->op = $2; 1995126353Smlaier $$->next = NULL; 1996126353Smlaier $$->tail = $$; 1997126353Smlaier } 1998126353Smlaier ; 1999126353Smlaier 2000126353Smlaierport : STRING { 2001126353Smlaier char *p = strchr($1, ':'); 2002126353Smlaier struct servent *s = NULL; 2003126353Smlaier u_long ulval; 2004126353Smlaier 2005126353Smlaier if (p == NULL) { 2006126353Smlaier if (atoul($1, &ulval) == 0) { 2007126353Smlaier if (ulval > 65535) { 2008126353Smlaier yyerror("illegal port value %d", 2009126353Smlaier ulval); 2010126353Smlaier YYERROR; 2011126353Smlaier } 2012126353Smlaier $$.a = htons(ulval); 2013126353Smlaier } else { 2014126353Smlaier s = getservbyname($1, "tcp"); 2015126353Smlaier if (s == NULL) 2016126353Smlaier s = getservbyname($1, "udp"); 2017126353Smlaier if (s == NULL) { 2018126353Smlaier yyerror("unknown port %s", $1); 2019126353Smlaier YYERROR; 2020126353Smlaier } 2021126353Smlaier $$.a = s->s_port; 2022126353Smlaier } 2023126353Smlaier $$.b = 0; 2024126353Smlaier $$.t = 0; 2025126353Smlaier } else { 2026126353Smlaier int port[2]; 2027126353Smlaier 2028126353Smlaier *p++ = 0; 2029126353Smlaier if ((port[0] = getservice($1)) == -1 || 2030126353Smlaier (port[1] = getservice(p)) == -1) 2031126353Smlaier YYERROR; 2032126353Smlaier $$.a = port[0]; 2033126353Smlaier $$.b = port[1]; 2034126353Smlaier $$.t = PF_OP_RRG; 2035126353Smlaier } 2036126353Smlaier } 2037126353Smlaier ; 2038126353Smlaier 2039126353Smlaieruids : uid_item { $$ = $1; } 2040126353Smlaier | '{' uid_list '}' { $$ = $2; } 2041126353Smlaier ; 2042126353Smlaier 2043126353Smlaieruid_list : uid_item { $$ = $1; } 2044126353Smlaier | uid_list comma uid_item { 2045126353Smlaier $1->tail->next = $3; 2046126353Smlaier $1->tail = $3; 2047126353Smlaier $$ = $1; 2048126353Smlaier } 2049126353Smlaier ; 2050126353Smlaier 2051126353Smlaieruid_item : uid { 2052126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2053126353Smlaier if ($$ == NULL) 2054126353Smlaier err(1, "uid_item: calloc"); 2055126353Smlaier $$->uid[0] = $1; 2056126353Smlaier $$->uid[1] = $1; 2057126353Smlaier $$->op = PF_OP_EQ; 2058126353Smlaier $$->next = NULL; 2059126353Smlaier $$->tail = $$; 2060126353Smlaier } 2061126353Smlaier | unaryop uid { 2062126353Smlaier if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2063126353Smlaier yyerror("user unknown requires operator = or " 2064126353Smlaier "!="); 2065126353Smlaier YYERROR; 2066126353Smlaier } 2067126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2068126353Smlaier if ($$ == NULL) 2069126353Smlaier err(1, "uid_item: calloc"); 2070126353Smlaier $$->uid[0] = $2; 2071126353Smlaier $$->uid[1] = $2; 2072126353Smlaier $$->op = $1; 2073126353Smlaier $$->next = NULL; 2074126353Smlaier $$->tail = $$; 2075126353Smlaier } 2076126353Smlaier | uid PORTBINARY uid { 2077126353Smlaier if ($1 == UID_MAX || $3 == UID_MAX) { 2078126353Smlaier yyerror("user unknown requires operator = or " 2079126353Smlaier "!="); 2080126353Smlaier YYERROR; 2081126353Smlaier } 2082126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2083126353Smlaier if ($$ == NULL) 2084126353Smlaier err(1, "uid_item: calloc"); 2085126353Smlaier $$->uid[0] = $1; 2086126353Smlaier $$->uid[1] = $3; 2087126353Smlaier $$->op = $2; 2088126353Smlaier $$->next = NULL; 2089126353Smlaier $$->tail = $$; 2090126353Smlaier } 2091126353Smlaier ; 2092126353Smlaier 2093126353Smlaieruid : STRING { 2094126353Smlaier u_long ulval; 2095126353Smlaier 2096126353Smlaier if (atoul($1, &ulval) == -1) { 2097126353Smlaier if (!strcmp($1, "unknown")) 2098126353Smlaier $$ = UID_MAX; 2099126353Smlaier else { 2100126353Smlaier struct passwd *pw; 2101126353Smlaier 2102126353Smlaier if ((pw = getpwnam($1)) == NULL) { 2103126353Smlaier yyerror("unknown user %s", $1); 2104126353Smlaier YYERROR; 2105126353Smlaier } 2106126353Smlaier $$ = pw->pw_uid; 2107126353Smlaier } 2108126353Smlaier } else { 2109126353Smlaier if (ulval >= UID_MAX) { 2110126353Smlaier yyerror("illegal uid value %lu", ulval); 2111126353Smlaier YYERROR; 2112126353Smlaier } 2113126353Smlaier $$ = ulval; 2114126353Smlaier } 2115126353Smlaier } 2116126353Smlaier ; 2117126353Smlaier 2118126353Smlaiergids : gid_item { $$ = $1; } 2119126353Smlaier | '{' gid_list '}' { $$ = $2; } 2120126353Smlaier ; 2121126353Smlaier 2122126353Smlaiergid_list : gid_item { $$ = $1; } 2123126353Smlaier | gid_list comma gid_item { 2124126353Smlaier $1->tail->next = $3; 2125126353Smlaier $1->tail = $3; 2126126353Smlaier $$ = $1; 2127126353Smlaier } 2128126353Smlaier ; 2129126353Smlaier 2130126353Smlaiergid_item : gid { 2131126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2132126353Smlaier if ($$ == NULL) 2133126353Smlaier err(1, "gid_item: calloc"); 2134126353Smlaier $$->gid[0] = $1; 2135126353Smlaier $$->gid[1] = $1; 2136126353Smlaier $$->op = PF_OP_EQ; 2137126353Smlaier $$->next = NULL; 2138126353Smlaier $$->tail = $$; 2139126353Smlaier } 2140126353Smlaier | unaryop gid { 2141126353Smlaier if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2142126353Smlaier yyerror("group unknown requires operator = or " 2143126353Smlaier "!="); 2144126353Smlaier YYERROR; 2145126353Smlaier } 2146126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2147126353Smlaier if ($$ == NULL) 2148126353Smlaier err(1, "gid_item: calloc"); 2149126353Smlaier $$->gid[0] = $2; 2150126353Smlaier $$->gid[1] = $2; 2151126353Smlaier $$->op = $1; 2152126353Smlaier $$->next = NULL; 2153126353Smlaier $$->tail = $$; 2154126353Smlaier } 2155126353Smlaier | gid PORTBINARY gid { 2156126353Smlaier if ($1 == GID_MAX || $3 == GID_MAX) { 2157126353Smlaier yyerror("group unknown requires operator = or " 2158126353Smlaier "!="); 2159126353Smlaier YYERROR; 2160126353Smlaier } 2161126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2162126353Smlaier if ($$ == NULL) 2163126353Smlaier err(1, "gid_item: calloc"); 2164126353Smlaier $$->gid[0] = $1; 2165126353Smlaier $$->gid[1] = $3; 2166126353Smlaier $$->op = $2; 2167126353Smlaier $$->next = NULL; 2168126353Smlaier $$->tail = $$; 2169126353Smlaier } 2170126353Smlaier ; 2171126353Smlaier 2172126353Smlaiergid : STRING { 2173126353Smlaier u_long ulval; 2174126353Smlaier 2175126353Smlaier if (atoul($1, &ulval) == -1) { 2176126353Smlaier if (!strcmp($1, "unknown")) 2177126353Smlaier $$ = GID_MAX; 2178126353Smlaier else { 2179126353Smlaier struct group *grp; 2180126353Smlaier 2181126353Smlaier if ((grp = getgrnam($1)) == NULL) { 2182126353Smlaier yyerror("unknown group %s", $1); 2183126353Smlaier YYERROR; 2184126353Smlaier } 2185126353Smlaier $$ = grp->gr_gid; 2186126353Smlaier } 2187126353Smlaier } else { 2188126353Smlaier if (ulval >= GID_MAX) { 2189126353Smlaier yyerror("illegal gid value %lu", ulval); 2190126353Smlaier YYERROR; 2191126353Smlaier } 2192126353Smlaier $$ = ulval; 2193126353Smlaier } 2194126353Smlaier } 2195126353Smlaier ; 2196126353Smlaier 2197126353Smlaierflag : STRING { 2198126353Smlaier int f; 2199126353Smlaier 2200126353Smlaier if ((f = parse_flags($1)) < 0) { 2201126353Smlaier yyerror("bad flags %s", $1); 2202126353Smlaier YYERROR; 2203126353Smlaier } 2204126353Smlaier $$.b1 = f; 2205126353Smlaier } 2206126353Smlaier ; 2207126353Smlaier 2208126353Smlaierflags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2209126353Smlaier | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2210126353Smlaier ; 2211126353Smlaier 2212126353Smlaiericmpspec : ICMPTYPE icmp_item { $$ = $2; } 2213126353Smlaier | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2214126353Smlaier | ICMP6TYPE icmp6_item { $$ = $2; } 2215126353Smlaier | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2216126353Smlaier ; 2217126353Smlaier 2218126353Smlaiericmp_list : icmp_item { $$ = $1; } 2219126353Smlaier | icmp_list comma icmp_item { 2220126353Smlaier $1->tail->next = $3; 2221126353Smlaier $1->tail = $3; 2222126353Smlaier $$ = $1; 2223126353Smlaier } 2224126353Smlaier ; 2225126353Smlaier 2226126353Smlaiericmp6_list : icmp6_item { $$ = $1; } 2227126353Smlaier | icmp6_list comma icmp6_item { 2228126353Smlaier $1->tail->next = $3; 2229126353Smlaier $1->tail = $3; 2230126353Smlaier $$ = $1; 2231126353Smlaier } 2232126353Smlaier ; 2233126353Smlaier 2234126353Smlaiericmp_item : icmptype { 2235126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2236126353Smlaier if ($$ == NULL) 2237126353Smlaier err(1, "icmp_item: calloc"); 2238126353Smlaier $$->type = $1; 2239126353Smlaier $$->code = 0; 2240126353Smlaier $$->proto = IPPROTO_ICMP; 2241126353Smlaier $$->next = NULL; 2242126353Smlaier $$->tail = $$; 2243126353Smlaier } 2244126353Smlaier | icmptype CODE STRING { 2245126353Smlaier const struct icmpcodeent *p; 2246126353Smlaier u_long ulval; 2247126353Smlaier 2248126353Smlaier if (atoul($3, &ulval) == 0) { 2249126353Smlaier if (ulval > 255) { 2250126353Smlaier yyerror("illegal icmp-code %d", ulval); 2251126353Smlaier YYERROR; 2252126353Smlaier } 2253126353Smlaier } else { 2254126353Smlaier if ((p = geticmpcodebyname($1-1, $3, 2255126353Smlaier AF_INET)) == NULL) { 2256126353Smlaier yyerror("unknown icmp-code %s", $3); 2257126353Smlaier YYERROR; 2258126353Smlaier } 2259126353Smlaier ulval = p->code; 2260126353Smlaier } 2261126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2262126353Smlaier if ($$ == NULL) 2263126353Smlaier err(1, "icmp_item: calloc"); 2264126353Smlaier $$->type = $1; 2265126353Smlaier $$->code = ulval + 1; 2266126353Smlaier $$->proto = IPPROTO_ICMP; 2267126353Smlaier $$->next = NULL; 2268126353Smlaier $$->tail = $$; 2269126353Smlaier } 2270126353Smlaier ; 2271126353Smlaier 2272126353Smlaiericmp6_item : icmp6type { 2273126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2274126353Smlaier if ($$ == NULL) 2275126353Smlaier err(1, "icmp_item: calloc"); 2276126353Smlaier $$->type = $1; 2277126353Smlaier $$->code = 0; 2278126353Smlaier $$->proto = IPPROTO_ICMPV6; 2279126353Smlaier $$->next = NULL; 2280126353Smlaier $$->tail = $$; 2281126353Smlaier } 2282126353Smlaier | icmp6type CODE STRING { 2283126353Smlaier const struct icmpcodeent *p; 2284126353Smlaier u_long ulval; 2285126353Smlaier 2286126353Smlaier if (atoul($3, &ulval) == 0) { 2287126353Smlaier if (ulval > 255) { 2288126353Smlaier yyerror("illegal icmp6-code %ld", 2289126353Smlaier ulval); 2290126353Smlaier YYERROR; 2291126353Smlaier } 2292126353Smlaier } else { 2293126353Smlaier if ((p = geticmpcodebyname($1-1, $3, 2294126353Smlaier AF_INET6)) == NULL) { 2295126353Smlaier yyerror("unknown icmp6-code %s", $3); 2296126353Smlaier YYERROR; 2297126353Smlaier } 2298126353Smlaier ulval = p->code; 2299126353Smlaier } 2300126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2301126353Smlaier if ($$ == NULL) 2302126353Smlaier err(1, "icmp_item: calloc"); 2303126353Smlaier $$->type = $1; 2304126353Smlaier $$->code = ulval + 1; 2305126353Smlaier $$->proto = IPPROTO_ICMPV6; 2306126353Smlaier $$->next = NULL; 2307126353Smlaier $$->tail = $$; 2308126353Smlaier } 2309126353Smlaier ; 2310126353Smlaier 2311126353Smlaiericmptype : STRING { 2312126353Smlaier const struct icmptypeent *p; 2313126353Smlaier u_long ulval; 2314126353Smlaier 2315126353Smlaier if (atoul($1, &ulval) == 0) { 2316126353Smlaier if (ulval > 255) { 2317126353Smlaier yyerror("illegal icmp-type %d", ulval); 2318126353Smlaier YYERROR; 2319126353Smlaier } 2320126353Smlaier $$ = ulval + 1; 2321126353Smlaier } else { 2322126353Smlaier if ((p = geticmptypebyname($1, AF_INET)) == 2323126353Smlaier NULL) { 2324126353Smlaier yyerror("unknown icmp-type %s", $1); 2325126353Smlaier YYERROR; 2326126353Smlaier } 2327126353Smlaier $$ = p->type + 1; 2328126353Smlaier } 2329126353Smlaier } 2330126353Smlaier ; 2331126353Smlaier 2332126353Smlaiericmp6type : STRING { 2333126353Smlaier const struct icmptypeent *p; 2334126353Smlaier u_long ulval; 2335126353Smlaier 2336126353Smlaier if (atoul($1, &ulval) == 0) { 2337126353Smlaier if (ulval > 255) { 2338126353Smlaier yyerror("illegal icmp6-type %d", ulval); 2339126353Smlaier YYERROR; 2340126353Smlaier } 2341126353Smlaier $$ = ulval + 1; 2342126353Smlaier } else { 2343126353Smlaier if ((p = geticmptypebyname($1, AF_INET6)) == 2344126353Smlaier NULL) { 2345126353Smlaier yyerror("unknown icmp6-type %s", $1); 2346126353Smlaier YYERROR; 2347126353Smlaier } 2348126353Smlaier $$ = p->type + 1; 2349126353Smlaier } 2350126353Smlaier } 2351126353Smlaier ; 2352126353Smlaier 2353126353Smlaiertos : TOS STRING { 2354126353Smlaier if (!strcmp($2, "lowdelay")) 2355126353Smlaier $$ = IPTOS_LOWDELAY; 2356126353Smlaier else if (!strcmp($2, "throughput")) 2357126353Smlaier $$ = IPTOS_THROUGHPUT; 2358126353Smlaier else if (!strcmp($2, "reliability")) 2359126353Smlaier $$ = IPTOS_RELIABILITY; 2360126353Smlaier else if ($2[0] == '0' && $2[1] == 'x') 2361126353Smlaier $$ = strtoul($2, NULL, 16); 2362126353Smlaier else 2363126353Smlaier $$ = strtoul($2, NULL, 10); 2364126353Smlaier if (!$$ || $$ > 255) { 2365126353Smlaier yyerror("illegal tos value %s", $2); 2366126353Smlaier YYERROR; 2367126353Smlaier } 2368126353Smlaier } 2369126353Smlaier ; 2370126353Smlaier 2371126353Smlaierkeep : KEEP STATE state_opt_spec { 2372126353Smlaier $$.action = PF_STATE_NORMAL; 2373126353Smlaier $$.options = $3; 2374126353Smlaier } 2375126353Smlaier | MODULATE STATE state_opt_spec { 2376126353Smlaier $$.action = PF_STATE_MODULATE; 2377126353Smlaier $$.options = $3; 2378126353Smlaier } 2379126353Smlaier | SYNPROXY STATE state_opt_spec { 2380126353Smlaier $$.action = PF_STATE_SYNPROXY; 2381126353Smlaier $$.options = $3; 2382126353Smlaier } 2383126353Smlaier ; 2384126353Smlaier 2385126353Smlaierstate_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2386126353Smlaier | /* empty */ { $$ = NULL; } 2387126353Smlaier ; 2388126353Smlaier 2389126353Smlaierstate_opt_list : state_opt_item { $$ = $1; } 2390126353Smlaier | state_opt_list comma state_opt_item { 2391126353Smlaier $1->tail->next = $3; 2392126353Smlaier $1->tail = $3; 2393126353Smlaier $$ = $1; 2394126353Smlaier } 2395126353Smlaier ; 2396126353Smlaier 2397126353Smlaierstate_opt_item : MAXIMUM number { 2398126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2399126353Smlaier if ($$ == NULL) 2400126353Smlaier err(1, "state_opt_item: calloc"); 2401126353Smlaier $$->type = PF_STATE_OPT_MAX; 2402126353Smlaier $$->data.max_states = $2; 2403126353Smlaier $$->next = NULL; 2404126353Smlaier $$->tail = $$; 2405126353Smlaier } 2406126353Smlaier | STRING number { 2407126353Smlaier int i; 2408126353Smlaier 2409126353Smlaier for (i = 0; pf_timeouts[i].name && 2410126353Smlaier strcmp(pf_timeouts[i].name, $1); ++i) 2411126353Smlaier ; /* nothing */ 2412126353Smlaier if (!pf_timeouts[i].name) { 2413126353Smlaier yyerror("illegal timeout name %s", $1); 2414126353Smlaier YYERROR; 2415126353Smlaier } 2416126353Smlaier if (strchr(pf_timeouts[i].name, '.') == NULL) { 2417126353Smlaier yyerror("illegal state timeout %s", $1); 2418126353Smlaier YYERROR; 2419126353Smlaier } 2420126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 2421126353Smlaier if ($$ == NULL) 2422126353Smlaier err(1, "state_opt_item: calloc"); 2423126353Smlaier $$->type = PF_STATE_OPT_TIMEOUT; 2424126353Smlaier $$->data.timeout.number = pf_timeouts[i].timeout; 2425126353Smlaier $$->data.timeout.seconds = $2; 2426126353Smlaier $$->next = NULL; 2427126353Smlaier $$->tail = $$; 2428126353Smlaier } 2429126353Smlaier ; 2430126353Smlaier 2431126353Smlaierlabel : LABEL STRING { 2432126353Smlaier if (($$ = strdup($2)) == NULL) 2433126353Smlaier err(1, "rule label strdup() failed"); 2434126353Smlaier } 2435126353Smlaier ; 2436126353Smlaier 2437126353Smlaierqname : QUEUE STRING { 2438126353Smlaier if (($$.qname = strdup($2)) == NULL) 2439126353Smlaier err(1, "qname strdup() failed"); 2440126353Smlaier } 2441126353Smlaier | QUEUE '(' STRING ')' { 2442126353Smlaier if (($$.qname = strdup($3)) == NULL) 2443126353Smlaier err(1, "qname strdup() failed"); 2444126353Smlaier } 2445126353Smlaier | QUEUE '(' STRING comma STRING ')' { 2446126353Smlaier if (($$.qname = strdup($3)) == NULL || 2447126353Smlaier ($$.pqname = strdup($5)) == NULL) 2448126353Smlaier err(1, "qname strdup() failed"); 2449126353Smlaier } 2450126353Smlaier ; 2451126353Smlaier 2452126353Smlaierno : /* empty */ { $$ = 0; } 2453126353Smlaier | NO { $$ = 1; } 2454126353Smlaier ; 2455126353Smlaier 2456126353Smlaierrport : STRING { 2457126353Smlaier char *p = strchr($1, ':'); 2458126353Smlaier 2459126353Smlaier if (p == NULL) { 2460126353Smlaier if (($$.a = getservice($1)) == -1) 2461126353Smlaier YYERROR; 2462126353Smlaier $$.b = $$.t = 0; 2463126353Smlaier } else if (!strcmp(p+1, "*")) { 2464126353Smlaier *p = 0; 2465126353Smlaier if (($$.a = getservice($1)) == -1) 2466126353Smlaier YYERROR; 2467126353Smlaier $$.b = 0; 2468126353Smlaier $$.t = 1; 2469126353Smlaier } else { 2470126353Smlaier *p++ = 0; 2471126353Smlaier if (($$.a = getservice($1)) == -1 || 2472126353Smlaier ($$.b = getservice(p)) == -1) 2473126353Smlaier YYERROR; 2474126353Smlaier if ($$.a == $$.b) 2475126353Smlaier $$.b = 0; 2476126353Smlaier $$.t = 0; 2477126353Smlaier } 2478126353Smlaier } 2479126353Smlaier ; 2480126353Smlaier 2481126353Smlaierredirspec : host { $$ = $1; } 2482126353Smlaier | '{' redir_host_list '}' { $$ = $2; } 2483126353Smlaier ; 2484126353Smlaier 2485126353Smlaierredir_host_list : host { $$ = $1; } 2486126353Smlaier | redir_host_list comma host { 2487126353Smlaier $1->tail->next = $3; 2488126353Smlaier $1->tail = $3->tail; 2489126353Smlaier $$ = $1; 2490126353Smlaier } 2491126353Smlaier ; 2492126353Smlaier 2493126353Smlaierredirpool : /* empty */ { $$ = NULL; } 2494126353Smlaier | ARROW redirspec { 2495126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 2496126353Smlaier if ($$ == NULL) 2497126353Smlaier err(1, "redirection: calloc"); 2498126353Smlaier $$->host = $2; 2499126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 2500126353Smlaier } 2501126353Smlaier | ARROW redirspec PORT rport { 2502126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 2503126353Smlaier if ($$ == NULL) 2504126353Smlaier err(1, "redirection: calloc"); 2505126353Smlaier $$->host = $2; 2506126353Smlaier $$->rport = $4; 2507126353Smlaier } 2508126353Smlaier ; 2509126353Smlaier 2510126353Smlaierhashkey : /* empty */ 2511126353Smlaier { 2512126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2513126353Smlaier if ($$ == NULL) 2514126353Smlaier err(1, "hashkey: calloc"); 2515126353Smlaier $$->key32[0] = arc4random(); 2516126353Smlaier $$->key32[1] = arc4random(); 2517126353Smlaier $$->key32[2] = arc4random(); 2518126353Smlaier $$->key32[3] = arc4random(); 2519126353Smlaier } 2520126353Smlaier | string 2521126353Smlaier { 2522126353Smlaier if (!strncmp($1, "0x", 2)) { 2523126353Smlaier if (strlen($1) != 34) { 2524126353Smlaier yyerror("hex key must be 128 bits " 2525126353Smlaier "(32 hex digits) long"); 2526126353Smlaier YYERROR; 2527126353Smlaier } 2528126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2529126353Smlaier if ($$ == NULL) 2530126353Smlaier err(1, "hashkey: calloc"); 2531126353Smlaier 2532126353Smlaier if (sscanf($1, "0x%8x%8x%8x%8x", 2533126353Smlaier &$$->key32[0], &$$->key32[1], 2534126353Smlaier &$$->key32[2], &$$->key32[3]) != 4) { 2535126353Smlaier free($$); 2536126353Smlaier yyerror("invalid hex key"); 2537126353Smlaier YYERROR; 2538126353Smlaier } 2539126353Smlaier } else { 2540126353Smlaier MD5_CTX context; 2541126353Smlaier 2542126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2543126353Smlaier if ($$ == NULL) 2544126353Smlaier err(1, "hashkey: calloc"); 2545126353Smlaier MD5Init(&context); 2546126353Smlaier MD5Update(&context, (unsigned char *)$1, 2547126353Smlaier strlen($1)); 2548126353Smlaier MD5Final((unsigned char *)$$, &context); 2549126353Smlaier HTONL($$->key32[0]); 2550126353Smlaier HTONL($$->key32[1]); 2551126353Smlaier HTONL($$->key32[2]); 2552126353Smlaier HTONL($$->key32[3]); 2553126353Smlaier } 2554126353Smlaier } 2555126353Smlaier ; 2556126353Smlaier 2557126353Smlaierpooltype : /* empty */ 2558126353Smlaier { 2559126353Smlaier $$.type = PF_POOL_NONE; 2560126353Smlaier $$.key = NULL; 2561126353Smlaier } 2562126353Smlaier | BITMASK 2563126353Smlaier { 2564126353Smlaier $$.type = PF_POOL_BITMASK; 2565126353Smlaier $$.key = NULL; 2566126353Smlaier } 2567126353Smlaier | RANDOM 2568126353Smlaier { 2569126353Smlaier $$.type = PF_POOL_RANDOM; 2570126353Smlaier $$.key = NULL; 2571126353Smlaier } 2572126353Smlaier | SOURCEHASH hashkey 2573126353Smlaier { 2574126353Smlaier $$.type = PF_POOL_SRCHASH; 2575126353Smlaier $$.key = $2; 2576126353Smlaier } 2577126353Smlaier | ROUNDROBIN 2578126353Smlaier { 2579126353Smlaier $$.type = PF_POOL_ROUNDROBIN; 2580126353Smlaier $$.key = NULL; 2581126353Smlaier } 2582126353Smlaier ; 2583126353Smlaier 2584126353Smlaierstaticport : /* empty */ { $$ = 0; } 2585126353Smlaier | STATICPORT { $$ = 1; } 2586126353Smlaier ; 2587126353Smlaier 2588126353Smlaierredirection : /* empty */ { $$ = NULL; } 2589126353Smlaier | ARROW host { 2590126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 2591126353Smlaier if ($$ == NULL) 2592126353Smlaier err(1, "redirection: calloc"); 2593126353Smlaier $$->host = $2; 2594126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 2595126353Smlaier } 2596126353Smlaier | ARROW host PORT rport { 2597126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 2598126353Smlaier if ($$ == NULL) 2599126353Smlaier err(1, "redirection: calloc"); 2600126353Smlaier $$->host = $2; 2601126353Smlaier $$->rport = $4; 2602126353Smlaier } 2603126353Smlaier ; 2604126353Smlaier 2605126353Smlaiernatpass : /* empty */ { $$ = 0; } 2606126353Smlaier | PASS { $$ = 1; } 2607126353Smlaier ; 2608126353Smlaier 2609126353Smlaiernataction : no NAT natpass { 2610126353Smlaier $$.b2 = $$.w = 0; 2611126353Smlaier if ($1) 2612126353Smlaier $$.b1 = PF_NONAT; 2613126353Smlaier else 2614126353Smlaier $$.b1 = PF_NAT; 2615126353Smlaier $$.b2 = $3; 2616126353Smlaier } 2617126353Smlaier | no RDR natpass { 2618126353Smlaier $$.b2 = $$.w = 0; 2619126353Smlaier if ($1) 2620126353Smlaier $$.b1 = PF_NORDR; 2621126353Smlaier else 2622126353Smlaier $$.b1 = PF_RDR; 2623126353Smlaier $$.b2 = $3; 2624126353Smlaier } 2625126353Smlaier ; 2626126353Smlaier 2627126353Smlaiernatrule : nataction interface af proto fromto tag redirpool pooltype 2628126353Smlaier staticport 2629126353Smlaier { 2630126353Smlaier struct pf_rule r; 2631126353Smlaier 2632126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 2633126353Smlaier YYERROR; 2634126353Smlaier 2635126353Smlaier memset(&r, 0, sizeof(r)); 2636126353Smlaier 2637126353Smlaier r.action = $1.b1; 2638126353Smlaier r.natpass = $1.b2; 2639126353Smlaier r.af = $3; 2640126353Smlaier 2641126353Smlaier if (!r.af) { 2642126353Smlaier if ($5.src.host && $5.src.host->af && 2643126353Smlaier !$5.src.host->ifindex) 2644126353Smlaier r.af = $5.src.host->af; 2645126353Smlaier else if ($5.dst.host && $5.dst.host->af && 2646126353Smlaier !$5.dst.host->ifindex) 2647126353Smlaier r.af = $5.dst.host->af; 2648126353Smlaier } 2649126353Smlaier 2650126353Smlaier if ($6 != NULL) 2651126353Smlaier if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) > 2652126353Smlaier PF_TAG_NAME_SIZE) { 2653126353Smlaier yyerror("tag too long, max %u chars", 2654126353Smlaier PF_TAG_NAME_SIZE - 1); 2655126353Smlaier YYERROR; 2656126353Smlaier } 2657126353Smlaier 2658126353Smlaier if (r.action == PF_NONAT || r.action == PF_NORDR) { 2659126353Smlaier if ($7 != NULL) { 2660126353Smlaier yyerror("translation rule with 'no' " 2661126353Smlaier "does not need '->'"); 2662126353Smlaier YYERROR; 2663126353Smlaier } 2664126353Smlaier } else { 2665126353Smlaier if ($7 == NULL || $7->host == NULL) { 2666126353Smlaier yyerror("translation rule requires '-> " 2667126353Smlaier "address'"); 2668126353Smlaier YYERROR; 2669126353Smlaier } 2670126353Smlaier if (!r.af && ! $7->host->ifindex) 2671126353Smlaier r.af = $7->host->af; 2672126353Smlaier 2673126353Smlaier remove_invalid_hosts(&$7->host, &r.af); 2674126353Smlaier if (invalid_redirect($7->host, r.af)) 2675126353Smlaier YYERROR; 2676126353Smlaier if (check_netmask($7->host, r.af)) 2677126353Smlaier YYERROR; 2678126353Smlaier 2679126353Smlaier r.rpool.proxy_port[0] = ntohs($7->rport.a); 2680126353Smlaier 2681126353Smlaier switch (r.action) { 2682126353Smlaier case PF_RDR: 2683126353Smlaier if (!$7->rport.b && $7->rport.t && 2684126353Smlaier $5.dst.port != NULL) { 2685126353Smlaier r.rpool.proxy_port[1] = 2686126353Smlaier ntohs($7->rport.a) + 2687126353Smlaier (ntohs($5.dst.port->port[1]) - 2688126353Smlaier ntohs($5.dst.port->port[0])); 2689126353Smlaier } else 2690126353Smlaier r.rpool.proxy_port[1] = 2691126353Smlaier ntohs($7->rport.b); 2692126353Smlaier break; 2693126353Smlaier case PF_NAT: 2694126353Smlaier r.rpool.proxy_port[1] = ntohs($7->rport.b); 2695126353Smlaier if (!r.rpool.proxy_port[0] && 2696126353Smlaier !r.rpool.proxy_port[1]) { 2697126353Smlaier r.rpool.proxy_port[0] = 2698126353Smlaier PF_NAT_PROXY_PORT_LOW; 2699126353Smlaier r.rpool.proxy_port[1] = 2700126353Smlaier PF_NAT_PROXY_PORT_HIGH; 2701126353Smlaier } else if (!r.rpool.proxy_port[1]) 2702126353Smlaier r.rpool.proxy_port[1] = 2703126353Smlaier r.rpool.proxy_port[0]; 2704126353Smlaier break; 2705126353Smlaier default: 2706126353Smlaier break; 2707126353Smlaier } 2708126353Smlaier 2709126353Smlaier r.rpool.opts = $8.type; 2710126353Smlaier if (r.rpool.opts == PF_POOL_NONE) 2711126353Smlaier r.rpool.opts = PF_POOL_ROUNDROBIN; 2712126353Smlaier if (r.rpool.opts != PF_POOL_ROUNDROBIN) 2713126353Smlaier if (disallow_table($7->host, "tables " 2714126353Smlaier "are only supported in round-robin " 2715126353Smlaier "redirection pools")) 2716126353Smlaier YYERROR; 2717126353Smlaier if ($7->host->next) { 2718126353Smlaier if (r.rpool.opts != 2719126353Smlaier PF_POOL_ROUNDROBIN) { 2720126353Smlaier yyerror("only round-robin " 2721126353Smlaier "valid for multiple " 2722126353Smlaier "redirection addresses"); 2723126353Smlaier YYERROR; 2724126353Smlaier } 2725126353Smlaier } else { 2726126353Smlaier if ((r.af == AF_INET && 2727126353Smlaier unmask(&$7->host->addr.v.a.mask, 2728126353Smlaier r.af) == 32) || 2729126353Smlaier (r.af == AF_INET6 && 2730126353Smlaier unmask(&$7->host->addr.v.a.mask, 2731126353Smlaier r.af) == 128)) { 2732126353Smlaier r.rpool.opts = PF_POOL_NONE; 2733126353Smlaier } 2734126353Smlaier } 2735126353Smlaier } 2736126353Smlaier 2737126353Smlaier if ($8.key != NULL) 2738126353Smlaier memcpy(&r.rpool.key, $8.key, 2739126353Smlaier sizeof(struct pf_poolhashkey)); 2740126353Smlaier 2741126747Smlaier if ($9 != 0) { 2742126353Smlaier if (r.action != PF_NAT) { 2743126353Smlaier yyerror("the 'static-port' option is " 2744126353Smlaier "only valid with nat rules"); 2745126353Smlaier YYERROR; 2746126353Smlaier } 2747126353Smlaier if (r.rpool.proxy_port[0] != 2748126353Smlaier PF_NAT_PROXY_PORT_LOW && 2749126353Smlaier r.rpool.proxy_port[1] != 2750126353Smlaier PF_NAT_PROXY_PORT_HIGH) { 2751126353Smlaier yyerror("the 'static-port' option can't" 2752126353Smlaier " be used when specifying a port" 2753126353Smlaier " range"); 2754126353Smlaier YYERROR; 2755126353Smlaier } 2756126353Smlaier r.rpool.proxy_port[0] = 0; 2757126353Smlaier r.rpool.proxy_port[1] = 0; 2758126353Smlaier } 2759126353Smlaier 2760126353Smlaier expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4, 2761126353Smlaier $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 2762126353Smlaier $5.dst.port, 0, 0, 0); 2763126353Smlaier free($7); 2764126353Smlaier } 2765126353Smlaier ; 2766126353Smlaier 2767126353Smlaierbinatrule : no BINAT natpass interface af proto FROM host TO ipspec tag 2768126353Smlaier redirection 2769126353Smlaier { 2770126353Smlaier struct pf_rule binat; 2771126353Smlaier struct pf_pooladdr *pa; 2772126353Smlaier 2773126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 2774126353Smlaier YYERROR; 2775126353Smlaier 2776126353Smlaier memset(&binat, 0, sizeof(binat)); 2777126353Smlaier 2778126353Smlaier if ($1) 2779126353Smlaier binat.action = PF_NOBINAT; 2780126353Smlaier else 2781126353Smlaier binat.action = PF_BINAT; 2782126353Smlaier binat.natpass = $3; 2783126353Smlaier binat.af = $5; 2784126353Smlaier if (!binat.af && $8 != NULL && $8->af) 2785126353Smlaier binat.af = $8->af; 2786126353Smlaier if (!binat.af && $10 != NULL && $10->af) 2787126353Smlaier binat.af = $10->af; 2788126353Smlaier if (!binat.af && $12 != NULL && $12->host) 2789126353Smlaier binat.af = $12->host->af; 2790126353Smlaier if (!binat.af) { 2791126353Smlaier yyerror("address family (inet/inet6) " 2792126353Smlaier "undefined"); 2793126353Smlaier YYERROR; 2794126353Smlaier } 2795126353Smlaier 2796126353Smlaier if ($4 != NULL) { 2797126353Smlaier memcpy(binat.ifname, $4->ifname, 2798126353Smlaier sizeof(binat.ifname)); 2799126353Smlaier free($4); 2800126353Smlaier } 2801126353Smlaier if ($11 != NULL) 2802126353Smlaier if (strlcpy(binat.tagname, $11, 2803126353Smlaier PF_TAG_NAME_SIZE) > PF_TAG_NAME_SIZE) { 2804126353Smlaier yyerror("tag too long, max %u chars", 2805126353Smlaier PF_TAG_NAME_SIZE - 1); 2806126353Smlaier YYERROR; 2807126353Smlaier } 2808126353Smlaier 2809126353Smlaier if ($6 != NULL) { 2810126353Smlaier binat.proto = $6->proto; 2811126353Smlaier free($6); 2812126353Smlaier } 2813126353Smlaier 2814126353Smlaier if ($8 != NULL && disallow_table($8, "invalid use of " 2815126353Smlaier "table <%s> as the source address of a binat rule")) 2816126353Smlaier YYERROR; 2817126353Smlaier if ($12 != NULL && $12->host != NULL && disallow_table( 2818126353Smlaier $12->host, "invalid use of table <%s> as the " 2819126353Smlaier "redirect address of a binat rule")) 2820126353Smlaier YYERROR; 2821126353Smlaier 2822126353Smlaier if ($8 != NULL) { 2823126353Smlaier if ($8->next) { 2824126353Smlaier yyerror("multiple binat ip addresses"); 2825126353Smlaier YYERROR; 2826126353Smlaier } 2827126353Smlaier if ($8->addr.type == PF_ADDR_DYNIFTL) 2828126353Smlaier $8->af = binat.af; 2829126353Smlaier if ($8->af != binat.af) { 2830126353Smlaier yyerror("binat ip versions must match"); 2831126353Smlaier YYERROR; 2832126353Smlaier } 2833126353Smlaier if (check_netmask($8, binat.af)) 2834126353Smlaier YYERROR; 2835126353Smlaier memcpy(&binat.src.addr, &$8->addr, 2836126353Smlaier sizeof(binat.src.addr)); 2837126353Smlaier free($8); 2838126353Smlaier } 2839126353Smlaier if ($10 != NULL) { 2840126353Smlaier if ($10->next) { 2841126353Smlaier yyerror("multiple binat ip addresses"); 2842126353Smlaier YYERROR; 2843126353Smlaier } 2844126353Smlaier if ($10->af != binat.af && $10->af) { 2845126353Smlaier yyerror("binat ip versions must match"); 2846126353Smlaier YYERROR; 2847126353Smlaier } 2848126353Smlaier if (check_netmask($10, binat.af)) 2849126353Smlaier YYERROR; 2850126353Smlaier memcpy(&binat.dst.addr, &$10->addr, 2851126353Smlaier sizeof(binat.dst.addr)); 2852126353Smlaier binat.dst.not = $10->not; 2853126353Smlaier free($10); 2854126353Smlaier } 2855126353Smlaier 2856126353Smlaier if (binat.action == PF_NOBINAT) { 2857126353Smlaier if ($12 != NULL) { 2858126353Smlaier yyerror("'no binat' rule does not need" 2859126353Smlaier " '->'"); 2860126353Smlaier YYERROR; 2861126353Smlaier } 2862126353Smlaier } else { 2863126353Smlaier if ($12 == NULL || $12->host == NULL) { 2864126353Smlaier yyerror("'binat' rule requires" 2865126353Smlaier " '-> address'"); 2866126353Smlaier YYERROR; 2867126353Smlaier } 2868126353Smlaier 2869126353Smlaier remove_invalid_hosts(&$12->host, &binat.af); 2870126353Smlaier if (invalid_redirect($12->host, binat.af)) 2871126353Smlaier YYERROR; 2872126353Smlaier if ($12->host->next != NULL) { 2873126353Smlaier yyerror("binat rule must redirect to " 2874126353Smlaier "a single address"); 2875126353Smlaier YYERROR; 2876126353Smlaier } 2877126353Smlaier if (check_netmask($12->host, binat.af)) 2878126353Smlaier YYERROR; 2879126353Smlaier 2880126353Smlaier if (!PF_AZERO(&binat.src.addr.v.a.mask, 2881126353Smlaier binat.af) && 2882126353Smlaier !PF_AEQ(&binat.src.addr.v.a.mask, 2883126353Smlaier &$12->host->addr.v.a.mask, binat.af)) { 2884126353Smlaier yyerror("'binat' source mask and " 2885126353Smlaier "redirect mask must be the same"); 2886126353Smlaier YYERROR; 2887126353Smlaier } 2888126353Smlaier 2889126353Smlaier TAILQ_INIT(&binat.rpool.list); 2890126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 2891126353Smlaier if (pa == NULL) 2892126353Smlaier err(1, "binat: calloc"); 2893126353Smlaier pa->addr = $12->host->addr; 2894126353Smlaier pa->ifname[0] = 0; 2895126353Smlaier TAILQ_INSERT_TAIL(&binat.rpool.list, 2896126353Smlaier pa, entries); 2897126353Smlaier 2898126353Smlaier free($12); 2899126353Smlaier } 2900126353Smlaier 2901126353Smlaier pfctl_add_rule(pf, &binat); 2902126353Smlaier } 2903126353Smlaier ; 2904126353Smlaier 2905126353Smlaiertag : /* empty */ { $$ = NULL; } 2906126353Smlaier | TAG STRING { $$ = $2; } 2907126353Smlaier 2908126353Smlaierroute_host : STRING { 2909126353Smlaier struct node_host *n; 2910126353Smlaier 2911126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2912126353Smlaier if ($$ == NULL) 2913126353Smlaier err(1, "route_host: calloc"); 2914126353Smlaier if (($$->ifname = strdup($1)) == NULL) 2915126353Smlaier err(1, "routeto: strdup"); 2916126353Smlaier if ((n = ifa_exists($$->ifname)) == NULL) { 2917126353Smlaier yyerror("routeto: unknown interface %s", 2918126353Smlaier $$->ifname); 2919126353Smlaier YYERROR; 2920126353Smlaier } 2921126353Smlaier set_ipmask($$, 128); 2922126353Smlaier $$->next = NULL; 2923126353Smlaier $$->tail = $$; 2924126353Smlaier } 2925126353Smlaier | '(' STRING host ')' { 2926126353Smlaier struct node_host *n; 2927126353Smlaier 2928126353Smlaier $$ = $3; 2929126353Smlaier if (($$->ifname = strdup($2)) == NULL) 2930126353Smlaier err(1, "routeto: strdup"); 2931126353Smlaier if ((n = ifa_exists($$->ifname)) == NULL) { 2932126353Smlaier yyerror("routeto: unknown interface %s", 2933126353Smlaier $$->ifname); 2934126353Smlaier YYERROR; 2935126353Smlaier } 2936126353Smlaier } 2937126353Smlaier ; 2938126353Smlaier 2939126353Smlaierroute_host_list : route_host { $$ = $1; } 2940126353Smlaier | route_host_list comma route_host { 2941126353Smlaier if ($1->af == 0) 2942126353Smlaier $1->af = $3->af; 2943126353Smlaier if ($1->af != $3->af) { 2944126353Smlaier yyerror("all pool addresses must be in the " 2945126353Smlaier "same address family"); 2946126353Smlaier YYERROR; 2947126353Smlaier } 2948126353Smlaier $1->tail->next = $3; 2949126353Smlaier $1->tail = $3->tail; 2950126353Smlaier $$ = $1; 2951126353Smlaier } 2952126353Smlaier ; 2953126353Smlaier 2954126353Smlaierroutespec : route_host { $$ = $1; } 2955126353Smlaier | '{' route_host_list '}' { $$ = $2; } 2956126353Smlaier ; 2957126353Smlaier 2958126353Smlaierroute : /* empty */ { 2959126353Smlaier $$.host = NULL; 2960126353Smlaier $$.rt = 0; 2961126353Smlaier $$.pool_opts = 0; 2962126353Smlaier } 2963126353Smlaier | FASTROUTE { 2964126353Smlaier $$.host = NULL; 2965126353Smlaier $$.rt = PF_FASTROUTE; 2966126353Smlaier $$.pool_opts = 0; 2967126353Smlaier } 2968126353Smlaier | ROUTETO routespec pooltype { 2969126353Smlaier $$.host = $2; 2970126353Smlaier $$.rt = PF_ROUTETO; 2971126353Smlaier $$.pool_opts = $3.type; 2972126353Smlaier if ($3.key != NULL) 2973126353Smlaier $$.key = $3.key; 2974126353Smlaier } 2975126353Smlaier | REPLYTO routespec pooltype { 2976126353Smlaier $$.host = $2; 2977126353Smlaier $$.rt = PF_REPLYTO; 2978126353Smlaier $$.pool_opts = $3.type; 2979126353Smlaier if ($3.key != NULL) 2980126353Smlaier $$.key = $3.key; 2981126353Smlaier } 2982126353Smlaier | DUPTO routespec pooltype { 2983126353Smlaier $$.host = $2; 2984126353Smlaier $$.rt = PF_DUPTO; 2985126353Smlaier $$.pool_opts = $3.type; 2986126353Smlaier if ($3.key != NULL) 2987126353Smlaier $$.key = $3.key; 2988126353Smlaier } 2989126353Smlaier ; 2990126353Smlaier 2991126353Smlaiertimeout_spec : STRING number 2992126353Smlaier { 2993126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 2994126353Smlaier YYERROR; 2995126353Smlaier if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 2996126353Smlaier yyerror("unknown timeout %s", $1); 2997126353Smlaier YYERROR; 2998126353Smlaier } 2999126353Smlaier } 3000126353Smlaier ; 3001126353Smlaier 3002126353Smlaiertimeout_list : timeout_list comma timeout_spec 3003126353Smlaier | timeout_spec 3004126353Smlaier ; 3005126353Smlaier 3006126353Smlaierlimit_spec : STRING number 3007126353Smlaier { 3008126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 3009126353Smlaier YYERROR; 3010126353Smlaier if (pfctl_set_limit(pf, $1, $2) != 0) { 3011126353Smlaier yyerror("unable to set limit %s %u", $1, $2); 3012126353Smlaier YYERROR; 3013126353Smlaier } 3014126353Smlaier } 3015126353Smlaier 3016126353Smlaierlimit_list : limit_list comma limit_spec 3017126353Smlaier | limit_spec 3018126353Smlaier ; 3019126353Smlaier 3020126353Smlaiercomma : ',' 3021126353Smlaier | /* empty */ 3022126353Smlaier ; 3023126353Smlaier 3024126353Smlaieryesno : NO { $$ = 0; } 3025126353Smlaier | STRING { 3026126353Smlaier if (!strcmp($1, "yes")) 3027126353Smlaier $$ = 1; 3028126353Smlaier else 3029126353Smlaier YYERROR; 3030126353Smlaier } 3031126353Smlaier 3032126353Smlaierunaryop : '=' { $$ = PF_OP_EQ; } 3033126353Smlaier | '!' '=' { $$ = PF_OP_NE; } 3034126353Smlaier | '<' '=' { $$ = PF_OP_LE; } 3035126353Smlaier | '<' { $$ = PF_OP_LT; } 3036126353Smlaier | '>' '=' { $$ = PF_OP_GE; } 3037126353Smlaier | '>' { $$ = PF_OP_GT; } 3038126353Smlaier ; 3039126353Smlaier 3040126353Smlaier%% 3041126353Smlaier 3042126353Smlaierint 3043126353Smlaieryyerror(const char *fmt, ...) 3044126353Smlaier{ 3045126353Smlaier va_list ap; 3046126353Smlaier extern char *infile; 3047126353Smlaier 3048126353Smlaier errors = 1; 3049126353Smlaier va_start(ap, fmt); 3050126353Smlaier fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3051126353Smlaier vfprintf(stderr, fmt, ap); 3052126353Smlaier fprintf(stderr, "\n"); 3053126353Smlaier va_end(ap); 3054126353Smlaier return (0); 3055126353Smlaier} 3056126353Smlaier 3057126353Smlaierint 3058126353Smlaierdisallow_table(struct node_host *h, const char *fmt) 3059126353Smlaier{ 3060126353Smlaier for (; h != NULL; h = h->next) 3061126353Smlaier if (h->addr.type == PF_ADDR_TABLE) { 3062126353Smlaier yyerror(fmt, h->addr.v.tblname); 3063126353Smlaier return (1); 3064126353Smlaier } 3065126353Smlaier return (0); 3066126353Smlaier} 3067126353Smlaier 3068126353Smlaierint 3069126353Smlaierrule_consistent(struct pf_rule *r) 3070126353Smlaier{ 3071126353Smlaier int problems = 0; 3072126353Smlaier 3073126353Smlaier switch (r->action) { 3074126353Smlaier case PF_PASS: 3075126353Smlaier case PF_DROP: 3076126353Smlaier case PF_SCRUB: 3077126353Smlaier problems = filter_consistent(r); 3078126353Smlaier break; 3079126353Smlaier case PF_NAT: 3080126353Smlaier case PF_NONAT: 3081126353Smlaier problems = nat_consistent(r); 3082126353Smlaier break; 3083126353Smlaier case PF_RDR: 3084126353Smlaier case PF_NORDR: 3085126353Smlaier problems = rdr_consistent(r); 3086126353Smlaier break; 3087126353Smlaier case PF_BINAT: 3088126353Smlaier case PF_NOBINAT: 3089126353Smlaier default: 3090126353Smlaier break; 3091126353Smlaier } 3092126353Smlaier return (problems); 3093126353Smlaier} 3094126353Smlaier 3095126353Smlaierint 3096126353Smlaierfilter_consistent(struct pf_rule *r) 3097126353Smlaier{ 3098126353Smlaier int problems = 0; 3099126353Smlaier 3100126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3101126353Smlaier (r->src.port_op || r->dst.port_op)) { 3102126353Smlaier yyerror("port only applies to tcp/udp"); 3103126353Smlaier problems++; 3104126353Smlaier } 3105126353Smlaier if (r->src.port_op == PF_OP_RRG || r->dst.port_op == PF_OP_RRG) { 3106126353Smlaier yyerror("the ':' port operator only applies to rdr"); 3107126353Smlaier problems++; 3108126353Smlaier } 3109126353Smlaier if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3110126353Smlaier (r->type || r->code)) { 3111126353Smlaier yyerror("icmp-type/code only applies to icmp"); 3112126353Smlaier problems++; 3113126353Smlaier } 3114126353Smlaier if (!r->af && (r->type || r->code)) { 3115126353Smlaier yyerror("must indicate address family with icmp-type/code"); 3116126353Smlaier problems++; 3117126353Smlaier } 3118126353Smlaier if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3119126353Smlaier (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3120126353Smlaier yyerror("proto %s doesn't match address family %s", 3121126353Smlaier r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3122126353Smlaier r->af == AF_INET ? "inet" : "inet6"); 3123126353Smlaier problems++; 3124126353Smlaier } 3125126353Smlaier if ((r->keep_state == PF_STATE_MODULATE || r->keep_state == 3126126353Smlaier PF_STATE_SYNPROXY) && r->proto && r->proto != IPPROTO_TCP) { 3127126353Smlaier yyerror("modulate/synproxy state can only be applied to " 3128126353Smlaier "TCP rules"); 3129126353Smlaier problems++; 3130126353Smlaier } 3131126353Smlaier if (r->allow_opts && r->action != PF_PASS) { 3132126353Smlaier yyerror("allow-opts can only be specified for pass rules"); 3133126353Smlaier problems++; 3134126353Smlaier } 3135126353Smlaier if (!r->af && (r->src.addr.type == PF_ADDR_DYNIFTL || 3136126353Smlaier r->dst.addr.type == PF_ADDR_DYNIFTL)) { 3137126353Smlaier yyerror("dynamic addresses require address family " 3138126353Smlaier "(inet/inet6)"); 3139126353Smlaier problems++; 3140126353Smlaier } 3141126353Smlaier if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3142126353Smlaier r->dst.port_op || r->flagset || r->type || r->code)) { 3143126353Smlaier yyerror("fragments can be filtered only on IP header fields"); 3144126353Smlaier problems++; 3145126353Smlaier } 3146126353Smlaier if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3147126353Smlaier yyerror("return-rst can only be applied to TCP rules"); 3148126353Smlaier problems++; 3149126353Smlaier } 3150126353Smlaier if (r->action == PF_DROP && r->keep_state) { 3151126353Smlaier yyerror("keep state on block rules doesn't make sense"); 3152126353Smlaier problems++; 3153126353Smlaier } 3154126353Smlaier if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state && 3155126353Smlaier r->action == PF_PASS) { 3156126353Smlaier yyerror("tags cannot be used without keep state"); 3157126353Smlaier problems++; 3158126353Smlaier } 3159126353Smlaier return (-problems); 3160126353Smlaier} 3161126353Smlaier 3162126353Smlaierint 3163126353Smlaiernat_consistent(struct pf_rule *r) 3164126353Smlaier{ 3165126353Smlaier int problems = 0; 3166126353Smlaier struct pf_pooladdr *pa; 3167126353Smlaier 3168126353Smlaier if (r->src.port_op == PF_OP_RRG || r->dst.port_op == PF_OP_RRG) { 3169126353Smlaier yyerror("the ':' port operator only applies to rdr"); 3170126353Smlaier problems++; 3171126353Smlaier } 3172126353Smlaier if (!r->af) { 3173126353Smlaier TAILQ_FOREACH(pa, &r->rpool.list, entries) { 3174126353Smlaier if (pa->addr.type == PF_ADDR_DYNIFTL) { 3175126353Smlaier yyerror("dynamic addresses require " 3176126353Smlaier "address family (inet/inet6)"); 3177126353Smlaier problems++; 3178126353Smlaier break; 3179126353Smlaier } 3180126353Smlaier } 3181126353Smlaier } 3182126353Smlaier return (-problems); 3183126353Smlaier} 3184126353Smlaier 3185126353Smlaierint 3186126353Smlaierrdr_consistent(struct pf_rule *r) 3187126353Smlaier{ 3188126353Smlaier int problems = 0; 3189126353Smlaier struct pf_pooladdr *pa; 3190126353Smlaier 3191126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3192126353Smlaier if (r->src.port_op) { 3193126353Smlaier yyerror("src port only applies to tcp/udp"); 3194126353Smlaier problems++; 3195126353Smlaier } 3196126353Smlaier if (r->dst.port_op) { 3197126353Smlaier yyerror("dst port only applies to tcp/udp"); 3198126353Smlaier problems++; 3199126353Smlaier } 3200126353Smlaier if (r->rpool.proxy_port[0]) { 3201126353Smlaier yyerror("rpool port only applies to tcp/udp"); 3202126353Smlaier problems++; 3203126353Smlaier } 3204126353Smlaier } 3205126353Smlaier if (r->dst.port_op && 3206126353Smlaier r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3207126353Smlaier yyerror("invalid port operator for rdr destination port"); 3208126353Smlaier problems++; 3209126353Smlaier } 3210126353Smlaier if (r->src.port_op == PF_OP_RRG) { 3211126353Smlaier yyerror("the ':' port operator only applies to rdr " 3212126353Smlaier "destination port"); 3213126353Smlaier problems++; 3214126353Smlaier } 3215126353Smlaier if (!r->af) { 3216126353Smlaier if (r->src.addr.type == PF_ADDR_DYNIFTL || 3217126353Smlaier r->dst.addr.type == PF_ADDR_DYNIFTL) { 3218126353Smlaier yyerror("dynamic addresses require address family " 3219126353Smlaier "(inet/inet6)"); 3220126353Smlaier problems++; 3221126353Smlaier } else { 3222126353Smlaier TAILQ_FOREACH(pa, &r->rpool.list, entries) { 3223126353Smlaier if (pa->addr.type == PF_ADDR_DYNIFTL) { 3224126353Smlaier yyerror("dynamic addresses require " 3225126353Smlaier "address family (inet/inet6)"); 3226126353Smlaier problems++; 3227126353Smlaier break; 3228126353Smlaier } 3229126353Smlaier } 3230126353Smlaier } 3231126353Smlaier } 3232126353Smlaier return (-problems); 3233126353Smlaier} 3234126353Smlaier 3235126353Smlaierint 3236126353Smlaierprocess_tabledef(char *name, struct table_opts *opts) 3237126353Smlaier{ 3238126353Smlaier struct pfr_buffer ab; 3239126353Smlaier struct node_tinit *ti; 3240126353Smlaier 3241126353Smlaier bzero(&ab, sizeof(ab)); 3242126353Smlaier ab.pfrb_type = PFRB_ADDRS; 3243126353Smlaier SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3244126353Smlaier if (ti->file) 3245126353Smlaier if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3246126353Smlaier if (errno) 3247126353Smlaier yyerror("cannot load \"%s\": %s", 3248126353Smlaier ti->file, strerror(errno)); 3249126353Smlaier else 3250126353Smlaier yyerror("file \"%s\" contains bad data", 3251126353Smlaier ti->file); 3252126353Smlaier goto _error; 3253126353Smlaier } 3254126353Smlaier if (ti->host) 3255126353Smlaier if (append_addr_host(&ab, ti->host, 0, 0)) { 3256126353Smlaier yyerror("cannot create address buffer: %s", 3257126353Smlaier strerror(errno)); 3258126353Smlaier goto _error; 3259126353Smlaier } 3260126353Smlaier } 3261126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 3262126353Smlaier print_tabledef(name, opts->flags, opts->init_addr, 3263126353Smlaier &opts->init_nodes); 3264126353Smlaier if (!(pf->opts & PF_OPT_NOACTION) && 3265126353Smlaier pfctl_define_table(name, opts->flags, opts->init_addr, 3266126353Smlaier pf->anchor, pf->ruleset, &ab, pf->tticket)) { 3267126353Smlaier yyerror("cannot define table %s: %s", name, 3268126353Smlaier pfr_strerror(errno)); 3269126353Smlaier goto _error; 3270126353Smlaier } 3271126353Smlaier pf->tdirty = 1; 3272126353Smlaier pfr_buf_clear(&ab); 3273126353Smlaier return (0); 3274126353Smlaier_error: 3275126353Smlaier pfr_buf_clear(&ab); 3276126353Smlaier return (-1); 3277126353Smlaier} 3278126353Smlaier 3279126353Smlaierstruct keywords { 3280126353Smlaier const char *k_name; 3281126353Smlaier int k_val; 3282126353Smlaier}; 3283126353Smlaier 3284126353Smlaier/* macro gore, but you should've seen the prior indentation nightmare... */ 3285126353Smlaier 3286126353Smlaier#define FREE_LIST(T,r) \ 3287126353Smlaier do { \ 3288126353Smlaier T *p, *node = r; \ 3289126353Smlaier while (node != NULL) { \ 3290126353Smlaier p = node; \ 3291126353Smlaier node = node->next; \ 3292126353Smlaier free(p); \ 3293126353Smlaier } \ 3294126353Smlaier } while (0) 3295126353Smlaier 3296126353Smlaier#define LOOP_THROUGH(T,n,r,C) \ 3297126353Smlaier do { \ 3298126353Smlaier T *n; \ 3299126353Smlaier if (r == NULL) { \ 3300126353Smlaier r = calloc(1, sizeof(T)); \ 3301126353Smlaier if (r == NULL) \ 3302126353Smlaier err(1, "LOOP: calloc"); \ 3303126353Smlaier r->next = NULL; \ 3304126353Smlaier } \ 3305126353Smlaier n = r; \ 3306126353Smlaier while (n != NULL) { \ 3307126353Smlaier do { \ 3308126353Smlaier C; \ 3309126353Smlaier } while (0); \ 3310126353Smlaier n = n->next; \ 3311126353Smlaier } \ 3312126353Smlaier } while (0) 3313126353Smlaier 3314126353Smlaiervoid 3315126353Smlaierexpand_label_str(char *label, const char *srch, const char *repl) 3316126353Smlaier{ 3317126353Smlaier char tmp[PF_RULE_LABEL_SIZE] = ""; 3318126353Smlaier char *p, *q; 3319126353Smlaier 3320126353Smlaier p = q = label; 3321126353Smlaier while ((q = strstr(p, srch)) != NULL) { 3322126353Smlaier *q = '\0'; 3323126353Smlaier if ((strlcat(tmp, p, sizeof(tmp)) >= sizeof(tmp)) || 3324126353Smlaier (strlcat(tmp, repl, sizeof(tmp)) >= sizeof(tmp))) 3325126353Smlaier err(1, "expand_label: label too long"); 3326126353Smlaier q += strlen(srch); 3327126353Smlaier p = q; 3328126353Smlaier } 3329126353Smlaier if (strlcat(tmp, p, sizeof(tmp)) >= sizeof(tmp)) 3330126353Smlaier err(1, "expand_label: label too long"); 3331126353Smlaier strlcpy(label, tmp, PF_RULE_LABEL_SIZE); /* always fits */ 3332126353Smlaier} 3333126353Smlaier 3334126353Smlaiervoid 3335126353Smlaierexpand_label_if(const char *name, char *label, const char *ifname) 3336126353Smlaier{ 3337126353Smlaier if (strstr(label, name) != NULL) { 3338126353Smlaier if (!*ifname) 3339126353Smlaier expand_label_str(label, name, "any"); 3340126353Smlaier else 3341126353Smlaier expand_label_str(label, name, ifname); 3342126353Smlaier } 3343126353Smlaier} 3344126353Smlaier 3345126353Smlaiervoid 3346126353Smlaierexpand_label_addr(const char *name, char *label, sa_family_t af, 3347126353Smlaier struct node_host *h) 3348126353Smlaier{ 3349126353Smlaier char tmp[64], tmp_not[66]; 3350126353Smlaier 3351126353Smlaier if (strstr(label, name) != NULL) { 3352126353Smlaier switch (h->addr.type) { 3353126353Smlaier case PF_ADDR_DYNIFTL: 3354126353Smlaier snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 3355126353Smlaier break; 3356126353Smlaier case PF_ADDR_TABLE: 3357126353Smlaier snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 3358126353Smlaier break; 3359126353Smlaier case PF_ADDR_NOROUTE: 3360126353Smlaier snprintf(tmp, sizeof(tmp), "no-route"); 3361126353Smlaier break; 3362126353Smlaier case PF_ADDR_ADDRMASK: 3363126353Smlaier if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 3364126353Smlaier PF_AZERO(&h->addr.v.a.mask, af))) 3365126353Smlaier snprintf(tmp, sizeof(tmp), "any"); 3366126353Smlaier else { 3367126353Smlaier char a[48]; 3368126353Smlaier int bits; 3369126353Smlaier 3370126353Smlaier if (inet_ntop(af, &h->addr.v.a.addr, a, 3371126353Smlaier sizeof(a)) == NULL) 3372126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 3373126353Smlaier else { 3374126353Smlaier bits = unmask(&h->addr.v.a.mask, af); 3375126353Smlaier if ((af == AF_INET && bits < 32) || 3376126353Smlaier (af == AF_INET6 && bits < 128)) 3377126353Smlaier snprintf(tmp, sizeof(tmp), 3378126353Smlaier "%s/%d", a, bits); 3379126353Smlaier else 3380126353Smlaier snprintf(tmp, sizeof(tmp), 3381126353Smlaier "%s", a); 3382126353Smlaier } 3383126353Smlaier } 3384126353Smlaier break; 3385126353Smlaier default: 3386126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 3387126353Smlaier break; 3388126353Smlaier } 3389126353Smlaier 3390126353Smlaier if (h->not) { 3391126353Smlaier snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 3392126353Smlaier expand_label_str(label, name, tmp_not); 3393126353Smlaier } else 3394126353Smlaier expand_label_str(label, name, tmp); 3395126353Smlaier } 3396126353Smlaier} 3397126353Smlaier 3398126353Smlaiervoid 3399126353Smlaierexpand_label_port(const char *name, char *label, struct node_port *port) 3400126353Smlaier{ 3401126353Smlaier char a1[6], a2[6], op[13] = ""; 3402126353Smlaier 3403126353Smlaier if (strstr(label, name) != NULL) { 3404126353Smlaier snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 3405126353Smlaier snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 3406126353Smlaier if (!port->op) 3407126353Smlaier ; 3408126353Smlaier else if (port->op == PF_OP_IRG) 3409126353Smlaier snprintf(op, sizeof(op), "%s><%s", a1, a2); 3410126353Smlaier else if (port->op == PF_OP_XRG) 3411126353Smlaier snprintf(op, sizeof(op), "%s<>%s", a1, a2); 3412126353Smlaier else if (port->op == PF_OP_EQ) 3413126353Smlaier snprintf(op, sizeof(op), "%s", a1); 3414126353Smlaier else if (port->op == PF_OP_NE) 3415126353Smlaier snprintf(op, sizeof(op), "!=%s", a1); 3416126353Smlaier else if (port->op == PF_OP_LT) 3417126353Smlaier snprintf(op, sizeof(op), "<%s", a1); 3418126353Smlaier else if (port->op == PF_OP_LE) 3419126353Smlaier snprintf(op, sizeof(op), "<=%s", a1); 3420126353Smlaier else if (port->op == PF_OP_GT) 3421126353Smlaier snprintf(op, sizeof(op), ">%s", a1); 3422126353Smlaier else if (port->op == PF_OP_GE) 3423126353Smlaier snprintf(op, sizeof(op), ">=%s", a1); 3424126353Smlaier expand_label_str(label, name, op); 3425126353Smlaier } 3426126353Smlaier} 3427126353Smlaier 3428126353Smlaiervoid 3429126353Smlaierexpand_label_proto(const char *name, char *label, u_int8_t proto) 3430126353Smlaier{ 3431126353Smlaier struct protoent *pe; 3432126353Smlaier char n[4]; 3433126353Smlaier 3434126353Smlaier if (strstr(label, name) != NULL) { 3435126353Smlaier pe = getprotobynumber(proto); 3436126353Smlaier if (pe != NULL) 3437126353Smlaier expand_label_str(label, name, pe->p_name); 3438126353Smlaier else { 3439126353Smlaier snprintf(n, sizeof(n), "%u", proto); 3440126353Smlaier expand_label_str(label, name, n); 3441126353Smlaier } 3442126353Smlaier } 3443126353Smlaier} 3444126353Smlaier 3445126353Smlaiervoid 3446126353Smlaierexpand_label_nr(const char *name, char *label) 3447126353Smlaier{ 3448126353Smlaier char n[11]; 3449126353Smlaier 3450126353Smlaier if (strstr(label, name) != NULL) { 3451126353Smlaier snprintf(n, sizeof(n), "%u", pf->rule_nr); 3452126353Smlaier expand_label_str(label, name, n); 3453126353Smlaier } 3454126353Smlaier} 3455126353Smlaier 3456126353Smlaiervoid 3457126353Smlaierexpand_label(char *label, const char *ifname, sa_family_t af, 3458126353Smlaier struct node_host *src_host, struct node_port *src_port, 3459126353Smlaier struct node_host *dst_host, struct node_port *dst_port, 3460126353Smlaier u_int8_t proto) 3461126353Smlaier{ 3462126353Smlaier expand_label_if("$if", label, ifname); 3463126353Smlaier expand_label_addr("$srcaddr", label, af, src_host); 3464126353Smlaier expand_label_addr("$dstaddr", label, af, dst_host); 3465126353Smlaier expand_label_port("$srcport", label, src_port); 3466126353Smlaier expand_label_port("$dstport", label, dst_port); 3467126353Smlaier expand_label_proto("$proto", label, proto); 3468126353Smlaier expand_label_nr("$nr", label); 3469126353Smlaier} 3470126353Smlaier 3471126353Smlaierint 3472126353Smlaierexpand_altq(struct pf_altq *a, struct node_if *interfaces, 3473126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 3474126353Smlaier struct node_queue_opt *opts) 3475126353Smlaier{ 3476126353Smlaier struct pf_altq pa, pb; 3477126353Smlaier char qname[PF_QNAME_SIZE]; 3478126353Smlaier struct node_queue *n; 3479126353Smlaier struct node_queue_bw bw; 3480126353Smlaier int errs = 0; 3481126353Smlaier 3482126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3483126353Smlaier FREE_LIST(struct node_if, interfaces); 3484126353Smlaier FREE_LIST(struct node_queue, nqueues); 3485126353Smlaier return (0); 3486126353Smlaier } 3487126353Smlaier 3488126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 3489126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 3490126353Smlaier if (strlcpy(pa.ifname, interface->ifname, 3491126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 3492126353Smlaier errx(1, "expand_altq: strlcpy"); 3493126353Smlaier 3494126353Smlaier if (interface->not) { 3495126353Smlaier yyerror("altq on ! <interface> is not supported"); 3496126353Smlaier errs++; 3497126353Smlaier } else { 3498126353Smlaier if (eval_pfaltq(pf, &pa, &bwspec, opts)) 3499126353Smlaier errs++; 3500126353Smlaier else 3501126353Smlaier if (pfctl_add_altq(pf, &pa)) 3502126353Smlaier errs++; 3503126353Smlaier 3504126353Smlaier if (pf->opts & PF_OPT_VERBOSE) { 3505126353Smlaier print_altq(&pf->paltq->altq, 0, 3506126353Smlaier &bwspec, opts); 3507126353Smlaier if (nqueues && nqueues->tail) { 3508126353Smlaier printf("queue { "); 3509126353Smlaier LOOP_THROUGH(struct node_queue, queue, 3510126353Smlaier nqueues, 3511126353Smlaier printf("%s ", 3512126353Smlaier queue->queue); 3513126353Smlaier ); 3514126353Smlaier printf("}"); 3515126353Smlaier } 3516126353Smlaier printf("\n"); 3517126353Smlaier } 3518126353Smlaier 3519126353Smlaier if (pa.scheduler == ALTQT_CBQ || 3520126353Smlaier pa.scheduler == ALTQT_HFSC) { 3521126353Smlaier /* now create a root queue */ 3522126353Smlaier memset(&pb, 0, sizeof(struct pf_altq)); 3523126353Smlaier if (strlcpy(qname, "root_", sizeof(qname)) >= 3524126353Smlaier sizeof(qname)) 3525126353Smlaier errx(1, "expand_altq: strlcpy"); 3526126353Smlaier if (strlcat(qname, interface->ifname, 3527126353Smlaier sizeof(qname)) >= sizeof(qname)) 3528126353Smlaier errx(1, "expand_altq: strlcat"); 3529126353Smlaier if (strlcpy(pb.qname, qname, 3530126353Smlaier sizeof(pb.qname)) >= sizeof(pb.qname)) 3531126353Smlaier errx(1, "expand_altq: strlcpy"); 3532126353Smlaier if (strlcpy(pb.ifname, interface->ifname, 3533126353Smlaier sizeof(pb.ifname)) >= sizeof(pb.ifname)) 3534126353Smlaier errx(1, "expand_altq: strlcpy"); 3535126353Smlaier pb.qlimit = pa.qlimit; 3536126353Smlaier pb.scheduler = pa.scheduler; 3537126353Smlaier bw.bw_absolute = pa.ifbandwidth; 3538126353Smlaier bw.bw_percent = 0; 3539126353Smlaier if (eval_pfqueue(pf, &pb, &bw, opts)) 3540126353Smlaier errs++; 3541126353Smlaier else 3542126353Smlaier if (pfctl_add_altq(pf, &pb)) 3543126353Smlaier errs++; 3544126353Smlaier } 3545126353Smlaier 3546126353Smlaier LOOP_THROUGH(struct node_queue, queue, nqueues, 3547126353Smlaier n = calloc(1, sizeof(struct node_queue)); 3548126353Smlaier if (n == NULL) 3549126353Smlaier err(1, "expand_altq: calloc"); 3550126353Smlaier if (pa.scheduler == ALTQT_CBQ || 3551126353Smlaier pa.scheduler == ALTQT_HFSC) 3552126353Smlaier if (strlcpy(n->parent, qname, 3553126353Smlaier sizeof(n->parent)) >= 3554126353Smlaier sizeof(n->parent)) 3555126353Smlaier errx(1, "expand_altq: strlcpy"); 3556126353Smlaier if (strlcpy(n->queue, queue->queue, 3557126353Smlaier sizeof(n->queue)) >= sizeof(n->queue)) 3558126353Smlaier errx(1, "expand_altq: strlcpy"); 3559126353Smlaier if (strlcpy(n->ifname, interface->ifname, 3560126353Smlaier sizeof(n->ifname)) >= sizeof(n->ifname)) 3561126353Smlaier errx(1, "expand_altq: strlcpy"); 3562126353Smlaier n->scheduler = pa.scheduler; 3563126353Smlaier n->next = NULL; 3564126353Smlaier n->tail = n; 3565126353Smlaier if (queues == NULL) 3566126353Smlaier queues = n; 3567126353Smlaier else { 3568126353Smlaier queues->tail->next = n; 3569126353Smlaier queues->tail = n; 3570126353Smlaier } 3571126353Smlaier ); 3572126353Smlaier } 3573126353Smlaier ); 3574126353Smlaier FREE_LIST(struct node_if, interfaces); 3575126353Smlaier FREE_LIST(struct node_queue, nqueues); 3576126353Smlaier 3577126353Smlaier return (errs); 3578126353Smlaier} 3579126353Smlaier 3580126353Smlaierint 3581126353Smlaierexpand_queue(struct pf_altq *a, struct node_if *interfaces, 3582126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 3583126353Smlaier struct node_queue_opt *opts) 3584126353Smlaier{ 3585126353Smlaier struct node_queue *n, *nq; 3586126353Smlaier struct pf_altq pa; 3587126353Smlaier u_int8_t found = 0; 3588126353Smlaier u_int8_t errs = 0; 3589126353Smlaier 3590126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3591126353Smlaier FREE_LIST(struct node_queue, nqueues); 3592126353Smlaier return (0); 3593126353Smlaier } 3594126353Smlaier 3595126353Smlaier if (queues == NULL) { 3596126353Smlaier yyerror("queue %s has no parent", a->qname); 3597126353Smlaier FREE_LIST(struct node_queue, nqueues); 3598126353Smlaier return (1); 3599126353Smlaier } 3600126353Smlaier 3601126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 3602126353Smlaier LOOP_THROUGH(struct node_queue, tqueue, queues, 3603126353Smlaier if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 3604126353Smlaier (interface->ifname[0] == 0 || 3605126353Smlaier (!interface->not && !strncmp(interface->ifname, 3606126353Smlaier tqueue->ifname, IFNAMSIZ)) || 3607126353Smlaier (interface->not && strncmp(interface->ifname, 3608126353Smlaier tqueue->ifname, IFNAMSIZ)))) { 3609126353Smlaier /* found ourself in queues */ 3610126353Smlaier found++; 3611126353Smlaier 3612126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 3613126353Smlaier 3614126353Smlaier if (pa.scheduler != ALTQT_NONE && 3615126353Smlaier pa.scheduler != tqueue->scheduler) { 3616126353Smlaier yyerror("exactly one scheduler type " 3617126353Smlaier "per interface allowed"); 3618126353Smlaier return (1); 3619126353Smlaier } 3620126353Smlaier pa.scheduler = tqueue->scheduler; 3621126353Smlaier 3622126353Smlaier /* scheduler dependent error checking */ 3623126353Smlaier switch (pa.scheduler) { 3624126353Smlaier case ALTQT_PRIQ: 3625126353Smlaier if (nqueues != NULL) { 3626126353Smlaier yyerror("priq queues cannot " 3627126353Smlaier "have child queues"); 3628126353Smlaier return (1); 3629126353Smlaier } 3630126353Smlaier if (bwspec.bw_absolute > 0 || 3631126353Smlaier bwspec.bw_percent < 100) { 3632126353Smlaier yyerror("priq doesn't take " 3633126353Smlaier "bandwidth"); 3634126353Smlaier return (1); 3635126353Smlaier } 3636126353Smlaier break; 3637126353Smlaier default: 3638126353Smlaier break; 3639126353Smlaier } 3640126353Smlaier 3641126353Smlaier if (strlcpy(pa.ifname, tqueue->ifname, 3642126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 3643126353Smlaier errx(1, "expand_queue: strlcpy"); 3644126353Smlaier if (strlcpy(pa.parent, tqueue->parent, 3645126353Smlaier sizeof(pa.parent)) >= sizeof(pa.parent)) 3646126353Smlaier errx(1, "expand_queue: strlcpy"); 3647126353Smlaier 3648126353Smlaier if (eval_pfqueue(pf, &pa, &bwspec, opts)) 3649126353Smlaier errs++; 3650126353Smlaier else 3651126353Smlaier if (pfctl_add_altq(pf, &pa)) 3652126353Smlaier errs++; 3653126353Smlaier 3654126353Smlaier for (nq = nqueues; nq != NULL; nq = nq->next) { 3655126353Smlaier if (!strcmp(a->qname, nq->queue)) { 3656126353Smlaier yyerror("queue cannot have " 3657126353Smlaier "itself as child"); 3658126353Smlaier errs++; 3659126353Smlaier continue; 3660126353Smlaier } 3661126353Smlaier n = calloc(1, 3662126353Smlaier sizeof(struct node_queue)); 3663126353Smlaier if (n == NULL) 3664126353Smlaier err(1, "expand_queue: calloc"); 3665126353Smlaier if (strlcpy(n->parent, a->qname, 3666126353Smlaier sizeof(n->parent)) >= 3667126353Smlaier sizeof(n->parent)) 3668126353Smlaier errx(1, "expand_queue strlcpy"); 3669126353Smlaier if (strlcpy(n->queue, nq->queue, 3670126353Smlaier sizeof(n->queue)) >= 3671126353Smlaier sizeof(n->queue)) 3672126353Smlaier errx(1, "expand_queue strlcpy"); 3673126353Smlaier if (strlcpy(n->ifname, tqueue->ifname, 3674126353Smlaier sizeof(n->ifname)) >= 3675126353Smlaier sizeof(n->ifname)) 3676126353Smlaier errx(1, "expand_queue strlcpy"); 3677126353Smlaier n->scheduler = tqueue->scheduler; 3678126353Smlaier n->next = NULL; 3679126353Smlaier n->tail = n; 3680126353Smlaier if (queues == NULL) 3681126353Smlaier queues = n; 3682126353Smlaier else { 3683126353Smlaier queues->tail->next = n; 3684126353Smlaier queues->tail = n; 3685126353Smlaier } 3686126353Smlaier } 3687126353Smlaier if ((pf->opts & PF_OPT_VERBOSE) && ( 3688126353Smlaier (found == 1 && interface->ifname[0] == 0) || 3689126353Smlaier (found > 0 && interface->ifname[0] != 0))) { 3690126353Smlaier print_queue(&pf->paltq->altq, 0, 3691126353Smlaier &bwspec, interface->ifname[0] != 0, 3692126353Smlaier opts); 3693126353Smlaier if (nqueues && nqueues->tail) { 3694126353Smlaier printf("{ "); 3695126353Smlaier LOOP_THROUGH(struct node_queue, 3696126353Smlaier queue, nqueues, 3697126353Smlaier printf("%s ", 3698126353Smlaier queue->queue); 3699126353Smlaier ); 3700126353Smlaier printf("}"); 3701126353Smlaier } 3702126353Smlaier printf("\n"); 3703126353Smlaier } 3704126353Smlaier } 3705126353Smlaier ); 3706126353Smlaier ); 3707126353Smlaier 3708126353Smlaier FREE_LIST(struct node_queue, nqueues); 3709126353Smlaier FREE_LIST(struct node_if, interfaces); 3710126353Smlaier 3711126353Smlaier if (!found) { 3712126353Smlaier yyerror("queue %s has no parent", a->qname); 3713126353Smlaier errs++; 3714126353Smlaier } 3715126353Smlaier 3716126353Smlaier if (errs) 3717126353Smlaier return (1); 3718126353Smlaier else 3719126353Smlaier return (0); 3720126353Smlaier} 3721126353Smlaier 3722126353Smlaiervoid 3723126353Smlaierexpand_rule(struct pf_rule *r, 3724126353Smlaier struct node_if *interfaces, struct node_host *rpool_hosts, 3725126353Smlaier struct node_proto *protos, struct node_os *src_oses, 3726126353Smlaier struct node_host *src_hosts, struct node_port *src_ports, 3727126353Smlaier struct node_host *dst_hosts, struct node_port *dst_ports, 3728126353Smlaier struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types) 3729126353Smlaier{ 3730126353Smlaier sa_family_t af = r->af; 3731126353Smlaier int added = 0, error = 0; 3732126353Smlaier char ifname[IF_NAMESIZE]; 3733126353Smlaier char label[PF_RULE_LABEL_SIZE]; 3734126353Smlaier struct pf_pooladdr *pa; 3735126353Smlaier struct node_host *h; 3736126353Smlaier u_int8_t flags, flagset; 3737126353Smlaier 3738126353Smlaier if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 3739126353Smlaier errx(1, "expand_rule: strlcpy"); 3740126353Smlaier flags = r->flags; 3741126353Smlaier flagset = r->flagset; 3742126353Smlaier 3743126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 3744126353Smlaier LOOP_THROUGH(struct node_proto, proto, protos, 3745126353Smlaier LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 3746126353Smlaier LOOP_THROUGH(struct node_host, src_host, src_hosts, 3747126353Smlaier LOOP_THROUGH(struct node_port, src_port, src_ports, 3748126353Smlaier LOOP_THROUGH(struct node_os, src_os, src_oses, 3749126353Smlaier LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 3750126353Smlaier LOOP_THROUGH(struct node_port, dst_port, dst_ports, 3751126353Smlaier LOOP_THROUGH(struct node_uid, uid, uids, 3752126353Smlaier LOOP_THROUGH(struct node_gid, gid, gids, 3753126353Smlaier 3754126353Smlaier r->af = af; 3755126353Smlaier /* for link-local IPv6 address, interface must match up */ 3756126353Smlaier if ((r->af && src_host->af && r->af != src_host->af) || 3757126353Smlaier (r->af && dst_host->af && r->af != dst_host->af) || 3758126353Smlaier (src_host->af && dst_host->af && 3759126353Smlaier src_host->af != dst_host->af) || 3760126353Smlaier (src_host->ifindex && dst_host->ifindex && 3761126353Smlaier src_host->ifindex != dst_host->ifindex) || 3762126353Smlaier (src_host->ifindex && if_nametoindex(interface->ifname) && 3763126353Smlaier src_host->ifindex != if_nametoindex(interface->ifname)) || 3764126353Smlaier (dst_host->ifindex && if_nametoindex(interface->ifname) && 3765126353Smlaier dst_host->ifindex != if_nametoindex(interface->ifname))) 3766126353Smlaier continue; 3767126353Smlaier if (!r->af && src_host->af) 3768126353Smlaier r->af = src_host->af; 3769126353Smlaier else if (!r->af && dst_host->af) 3770126353Smlaier r->af = dst_host->af; 3771126353Smlaier 3772126353Smlaier if (if_indextoname(src_host->ifindex, ifname)) 3773126353Smlaier memcpy(r->ifname, ifname, sizeof(r->ifname)); 3774126353Smlaier else if (if_indextoname(dst_host->ifindex, ifname)) 3775126353Smlaier memcpy(r->ifname, ifname, sizeof(r->ifname)); 3776126353Smlaier else 3777126353Smlaier memcpy(r->ifname, interface->ifname, sizeof(r->ifname)); 3778126353Smlaier 3779126353Smlaier if (strlcpy(r->label, label, sizeof(r->label)) >= 3780126353Smlaier sizeof(r->label)) 3781126353Smlaier errx(1, "expand_rule: strlcpy"); 3782126353Smlaier expand_label(r->label, r->ifname, r->af, src_host, src_port, 3783126353Smlaier dst_host, dst_port, proto->proto); 3784126353Smlaier 3785126353Smlaier error += check_netmask(src_host, r->af); 3786126353Smlaier error += check_netmask(dst_host, r->af); 3787126353Smlaier 3788126353Smlaier r->ifnot = interface->not; 3789126353Smlaier r->proto = proto->proto; 3790126353Smlaier r->src.addr = src_host->addr; 3791126353Smlaier r->src.not = src_host->not; 3792126353Smlaier r->src.port[0] = src_port->port[0]; 3793126353Smlaier r->src.port[1] = src_port->port[1]; 3794126353Smlaier r->src.port_op = src_port->op; 3795126353Smlaier r->dst.addr = dst_host->addr; 3796126353Smlaier r->dst.not = dst_host->not; 3797126353Smlaier r->dst.port[0] = dst_port->port[0]; 3798126353Smlaier r->dst.port[1] = dst_port->port[1]; 3799126353Smlaier r->dst.port_op = dst_port->op; 3800126353Smlaier r->uid.op = uid->op; 3801126353Smlaier r->uid.uid[0] = uid->uid[0]; 3802126353Smlaier r->uid.uid[1] = uid->uid[1]; 3803126353Smlaier r->gid.op = gid->op; 3804126353Smlaier r->gid.gid[0] = gid->gid[0]; 3805126353Smlaier r->gid.gid[1] = gid->gid[1]; 3806126353Smlaier r->type = icmp_type->type; 3807126353Smlaier r->code = icmp_type->code; 3808126353Smlaier 3809126353Smlaier if (r->proto && r->proto != IPPROTO_TCP) { 3810126353Smlaier r->flags = 0; 3811126353Smlaier r->flagset = 0; 3812126353Smlaier } else { 3813126353Smlaier r->flags = flags; 3814126353Smlaier r->flagset = flagset; 3815126353Smlaier } 3816126353Smlaier if (icmp_type->proto && r->proto != icmp_type->proto) { 3817126353Smlaier yyerror("icmp-type mismatch"); 3818126353Smlaier error++; 3819126353Smlaier } 3820126353Smlaier 3821126353Smlaier if (src_os && src_os->os) { 3822126353Smlaier r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 3823126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && 3824126353Smlaier r->os_fingerprint == PF_OSFP_NOMATCH) 3825126353Smlaier fprintf(stderr, 3826126353Smlaier "warning: unknown '%s' OS fingerprint\n", 3827126353Smlaier src_os->os); 3828126353Smlaier } else { 3829126353Smlaier r->os_fingerprint = PF_OSFP_ANY; 3830126353Smlaier } 3831126353Smlaier 3832126353Smlaier TAILQ_INIT(&r->rpool.list); 3833126353Smlaier for (h = rpool_hosts; h != NULL; h = h->next) { 3834126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 3835126353Smlaier if (pa == NULL) 3836126353Smlaier err(1, "expand_rule: calloc"); 3837126353Smlaier pa->addr = h->addr; 3838126353Smlaier if (h->ifname != NULL) { 3839126353Smlaier if (strlcpy(pa->ifname, h->ifname, 3840126353Smlaier sizeof(pa->ifname)) >= 3841126353Smlaier sizeof(pa->ifname)) 3842126353Smlaier errx(1, "expand_rule: strlcpy"); 3843126353Smlaier } else 3844126353Smlaier pa->ifname[0] = 0; 3845126353Smlaier TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 3846126353Smlaier } 3847126353Smlaier 3848126353Smlaier if (rule_consistent(r) < 0 || error) 3849126353Smlaier yyerror("skipping rule due to errors"); 3850126353Smlaier else { 3851126353Smlaier r->nr = pf->rule_nr++; 3852126353Smlaier pfctl_add_rule(pf, r); 3853126353Smlaier added++; 3854126353Smlaier } 3855126353Smlaier 3856126353Smlaier )))))))))); 3857126353Smlaier 3858126353Smlaier FREE_LIST(struct node_if, interfaces); 3859126353Smlaier FREE_LIST(struct node_proto, protos); 3860126353Smlaier FREE_LIST(struct node_host, src_hosts); 3861126353Smlaier FREE_LIST(struct node_port, src_ports); 3862126353Smlaier FREE_LIST(struct node_os, src_oses); 3863126353Smlaier FREE_LIST(struct node_host, dst_hosts); 3864126353Smlaier FREE_LIST(struct node_port, dst_ports); 3865126353Smlaier FREE_LIST(struct node_uid, uids); 3866126353Smlaier FREE_LIST(struct node_gid, gids); 3867126353Smlaier FREE_LIST(struct node_icmp, icmp_types); 3868126353Smlaier FREE_LIST(struct node_host, rpool_hosts); 3869126353Smlaier 3870126353Smlaier if (!added) 3871126353Smlaier yyerror("rule expands to no valid combination"); 3872126353Smlaier} 3873126353Smlaier 3874126353Smlaier#undef FREE_LIST 3875126353Smlaier#undef LOOP_THROUGH 3876126353Smlaier 3877126353Smlaierint 3878126353Smlaiercheck_rulestate(int desired_state) 3879126353Smlaier{ 3880126353Smlaier if (require_order && (rulestate > desired_state)) { 3881126353Smlaier yyerror("Rules must be in order: options, normalization, " 3882126353Smlaier "queueing, translation, filtering"); 3883126353Smlaier return (1); 3884126353Smlaier } 3885126353Smlaier rulestate = desired_state; 3886126353Smlaier return (0); 3887126353Smlaier} 3888126353Smlaier 3889126353Smlaierint 3890126353Smlaierkw_cmp(const void *k, const void *e) 3891126353Smlaier{ 3892126353Smlaier return (strcmp(k, ((const struct keywords *)e)->k_name)); 3893126353Smlaier} 3894126353Smlaier 3895126353Smlaierint 3896126353Smlaierlookup(char *s) 3897126353Smlaier{ 3898126353Smlaier /* this has to be sorted always */ 3899126353Smlaier static const struct keywords keywords[] = { 3900126353Smlaier { "all", ALL}, 3901126353Smlaier { "allow-opts", ALLOWOPTS}, 3902126353Smlaier { "altq", ALTQ}, 3903126353Smlaier { "anchor", ANCHOR}, 3904126353Smlaier { "antispoof", ANTISPOOF}, 3905126353Smlaier { "any", ANY}, 3906126353Smlaier { "bandwidth", BANDWIDTH}, 3907126353Smlaier { "binat", BINAT}, 3908126353Smlaier { "binat-anchor", BINATANCHOR}, 3909126353Smlaier { "bitmask", BITMASK}, 3910126353Smlaier { "block", BLOCK}, 3911126353Smlaier { "block-policy", BLOCKPOLICY}, 3912126353Smlaier { "cbq", CBQ}, 3913126353Smlaier { "code", CODE}, 3914126353Smlaier { "crop", FRAGCROP}, 3915126353Smlaier { "drop", DROP}, 3916126353Smlaier { "drop-ovl", FRAGDROP}, 3917126353Smlaier { "dup-to", DUPTO}, 3918126353Smlaier { "fastroute", FASTROUTE}, 3919126353Smlaier { "file", FILENAME}, 3920126353Smlaier { "fingerprints", FINGERPRINTS}, 3921126353Smlaier { "flags", FLAGS}, 3922126353Smlaier { "for", FOR}, 3923126353Smlaier { "fragment", FRAGMENT}, 3924126353Smlaier { "from", FROM}, 3925126353Smlaier { "group", GROUP}, 3926126353Smlaier { "hfsc", HFSC}, 3927126353Smlaier { "icmp-type", ICMPTYPE}, 3928126353Smlaier { "icmp6-type", ICMP6TYPE}, 3929126353Smlaier { "in", IN}, 3930126353Smlaier { "inet", INET}, 3931126353Smlaier { "inet6", INET6}, 3932126353Smlaier { "keep", KEEP}, 3933126353Smlaier { "label", LABEL}, 3934126353Smlaier { "limit", LIMIT}, 3935126353Smlaier { "linkshare", LINKSHARE}, 3936126353Smlaier { "load", LOAD}, 3937126353Smlaier { "log", LOG}, 3938126353Smlaier { "log-all", LOGALL}, 3939126353Smlaier { "loginterface", LOGINTERFACE}, 3940126353Smlaier { "max", MAXIMUM}, 3941126353Smlaier { "max-mss", MAXMSS}, 3942126353Smlaier { "min-ttl", MINTTL}, 3943126353Smlaier { "modulate", MODULATE}, 3944126353Smlaier { "nat", NAT}, 3945126353Smlaier { "nat-anchor", NATANCHOR}, 3946126353Smlaier { "no", NO}, 3947126353Smlaier { "no-df", NODF}, 3948126353Smlaier { "no-route", NOROUTE}, 3949126353Smlaier { "on", ON}, 3950126353Smlaier { "optimization", OPTIMIZATION}, 3951126353Smlaier { "os", OS}, 3952126353Smlaier { "out", OUT}, 3953126353Smlaier { "pass", PASS}, 3954126353Smlaier { "port", PORT}, 3955126353Smlaier { "priority", PRIORITY}, 3956126353Smlaier { "priq", PRIQ}, 3957126353Smlaier { "proto", PROTO}, 3958126353Smlaier { "qlimit", QLIMIT}, 3959126353Smlaier { "queue", QUEUE}, 3960126353Smlaier { "quick", QUICK}, 3961126353Smlaier { "random", RANDOM}, 3962126353Smlaier { "random-id", RANDOMID}, 3963126353Smlaier { "rdr", RDR}, 3964126353Smlaier { "rdr-anchor", RDRANCHOR}, 3965126353Smlaier { "realtime", REALTIME}, 3966126353Smlaier { "reassemble", REASSEMBLE}, 3967126353Smlaier { "reply-to", REPLYTO}, 3968126353Smlaier { "require-order", REQUIREORDER}, 3969126353Smlaier { "return", RETURN}, 3970126353Smlaier { "return-icmp", RETURNICMP}, 3971126353Smlaier { "return-icmp6", RETURNICMP6}, 3972126353Smlaier { "return-rst", RETURNRST}, 3973126353Smlaier { "round-robin", ROUNDROBIN}, 3974126353Smlaier { "route-to", ROUTETO}, 3975126353Smlaier { "scrub", SCRUB}, 3976126353Smlaier { "set", SET}, 3977126353Smlaier { "source-hash", SOURCEHASH}, 3978126353Smlaier { "state", STATE}, 3979126353Smlaier { "static-port", STATICPORT}, 3980126353Smlaier { "synproxy", SYNPROXY}, 3981126353Smlaier { "table", TABLE}, 3982126353Smlaier { "tag", TAG}, 3983126353Smlaier { "tagged", TAGGED}, 3984126353Smlaier { "tbrsize", TBRSIZE}, 3985126353Smlaier { "timeout", TIMEOUT}, 3986126353Smlaier { "to", TO}, 3987126353Smlaier { "tos", TOS}, 3988126353Smlaier { "ttl", TTL}, 3989126353Smlaier { "upperlimit", UPPERLIMIT}, 3990126353Smlaier { "user", USER}, 3991126353Smlaier }; 3992126353Smlaier const struct keywords *p; 3993126353Smlaier 3994126353Smlaier p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 3995126353Smlaier sizeof(keywords[0]), kw_cmp); 3996126353Smlaier 3997126353Smlaier if (p) { 3998126353Smlaier if (debug > 1) 3999126353Smlaier fprintf(stderr, "%s: %d\n", s, p->k_val); 4000126353Smlaier return (p->k_val); 4001126353Smlaier } else { 4002126353Smlaier if (debug > 1) 4003126353Smlaier fprintf(stderr, "string: %s\n", s); 4004126353Smlaier return (STRING); 4005126353Smlaier } 4006126353Smlaier} 4007126353Smlaier 4008126353Smlaier#define MAXPUSHBACK 128 4009126353Smlaier 4010126353Smlaierchar *parsebuf; 4011126353Smlaierint parseindex; 4012126353Smlaierchar pushback_buffer[MAXPUSHBACK]; 4013126353Smlaierint pushback_index = 0; 4014126353Smlaier 4015126353Smlaierint 4016126353Smlaierlgetc(FILE *f) 4017126353Smlaier{ 4018126353Smlaier int c, next; 4019126353Smlaier 4020126353Smlaier if (parsebuf) { 4021126353Smlaier /* Read character from the parsebuffer instead of input. */ 4022126353Smlaier if (parseindex >= 0) { 4023126353Smlaier c = parsebuf[parseindex++]; 4024126353Smlaier if (c != '\0') 4025126353Smlaier return (c); 4026126353Smlaier parsebuf = NULL; 4027126353Smlaier } else 4028126353Smlaier parseindex++; 4029126353Smlaier } 4030126353Smlaier 4031126353Smlaier if (pushback_index) 4032126353Smlaier return (pushback_buffer[--pushback_index]); 4033126353Smlaier 4034126353Smlaier while ((c = getc(f)) == '\\') { 4035126353Smlaier next = getc(f); 4036126353Smlaier if (next != '\n') { 4037126353Smlaier if (isspace(next)) 4038126353Smlaier yyerror("whitespace after \\"); 4039126353Smlaier ungetc(next, f); 4040126353Smlaier break; 4041126353Smlaier } 4042126353Smlaier yylval.lineno = lineno; 4043126353Smlaier lineno++; 4044126353Smlaier } 4045126353Smlaier if (c == '\t' || c == ' ') { 4046126353Smlaier /* Compress blanks to a single space. */ 4047126353Smlaier do { 4048126353Smlaier c = getc(f); 4049126353Smlaier } while (c == '\t' || c == ' '); 4050126353Smlaier ungetc(c, f); 4051126353Smlaier c = ' '; 4052126353Smlaier } 4053126353Smlaier 4054126353Smlaier return (c); 4055126353Smlaier} 4056126353Smlaier 4057126353Smlaierint 4058126353Smlaierlungetc(int c) 4059126353Smlaier{ 4060126353Smlaier if (c == EOF) 4061126353Smlaier return (EOF); 4062126353Smlaier if (parsebuf) { 4063126353Smlaier parseindex--; 4064126353Smlaier if (parseindex >= 0) 4065126353Smlaier return (c); 4066126353Smlaier } 4067126353Smlaier if (pushback_index < MAXPUSHBACK-1) 4068126353Smlaier return (pushback_buffer[pushback_index++] = c); 4069126353Smlaier else 4070126353Smlaier return (EOF); 4071126353Smlaier} 4072126353Smlaier 4073126353Smlaierint 4074126353Smlaierfindeol(void) 4075126353Smlaier{ 4076126353Smlaier int c; 4077126353Smlaier 4078126353Smlaier parsebuf = NULL; 4079126353Smlaier pushback_index = 0; 4080126353Smlaier 4081126353Smlaier /* skip to either EOF or the first real EOL */ 4082126353Smlaier while (1) { 4083126353Smlaier c = lgetc(fin); 4084126353Smlaier if (c == '\n') { 4085126353Smlaier lineno++; 4086126353Smlaier break; 4087126353Smlaier } 4088126353Smlaier if (c == EOF) 4089126353Smlaier break; 4090126353Smlaier } 4091126353Smlaier return (ERROR); 4092126353Smlaier} 4093126353Smlaier 4094126353Smlaierint 4095126353Smlaieryylex(void) 4096126353Smlaier{ 4097126353Smlaier char buf[8096]; 4098126353Smlaier char *p, *val; 4099126353Smlaier int endc, c, next; 4100126353Smlaier int token; 4101126353Smlaier 4102126353Smlaiertop: 4103126353Smlaier p = buf; 4104126353Smlaier while ((c = lgetc(fin)) == ' ') 4105126353Smlaier ; /* nothing */ 4106126353Smlaier 4107126353Smlaier yylval.lineno = lineno; 4108126353Smlaier if (c == '#') 4109126353Smlaier while ((c = lgetc(fin)) != '\n' && c != EOF) 4110126353Smlaier ; /* nothing */ 4111126353Smlaier if (c == '$' && parsebuf == NULL) { 4112126353Smlaier while (1) { 4113126353Smlaier if ((c = lgetc(fin)) == EOF) 4114126353Smlaier return (0); 4115126353Smlaier 4116126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 4117126353Smlaier yyerror("string too long"); 4118126353Smlaier return (findeol()); 4119126353Smlaier } 4120126353Smlaier if (isalnum(c) || c == '_') { 4121126353Smlaier *p++ = (char)c; 4122126353Smlaier continue; 4123126353Smlaier } 4124126353Smlaier *p = '\0'; 4125126353Smlaier lungetc(c); 4126126353Smlaier break; 4127126353Smlaier } 4128126353Smlaier val = symget(buf); 4129126353Smlaier if (val == NULL) { 4130126353Smlaier yyerror("macro '%s' not defined", buf); 4131126353Smlaier return (findeol()); 4132126353Smlaier } 4133126353Smlaier parsebuf = val; 4134126353Smlaier parseindex = 0; 4135126353Smlaier goto top; 4136126353Smlaier } 4137126353Smlaier 4138126353Smlaier switch (c) { 4139126353Smlaier case '\'': 4140126353Smlaier case '"': 4141126353Smlaier endc = c; 4142126353Smlaier while (1) { 4143126353Smlaier if ((c = lgetc(fin)) == EOF) 4144126353Smlaier return (0); 4145126353Smlaier if (c == endc) { 4146126353Smlaier *p = '\0'; 4147126353Smlaier break; 4148126353Smlaier } 4149126353Smlaier if (c == '\n') { 4150126353Smlaier lineno++; 4151126353Smlaier continue; 4152126353Smlaier } 4153126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 4154126353Smlaier yyerror("string too long"); 4155126353Smlaier return (findeol()); 4156126353Smlaier } 4157126353Smlaier *p++ = (char)c; 4158126353Smlaier } 4159126353Smlaier yylval.v.string = strdup(buf); 4160126353Smlaier if (yylval.v.string == NULL) 4161126353Smlaier err(1, "yylex: strdup"); 4162126353Smlaier return (STRING); 4163126353Smlaier case '<': 4164126353Smlaier next = lgetc(fin); 4165126353Smlaier if (next == '>') { 4166126353Smlaier yylval.v.i = PF_OP_XRG; 4167126353Smlaier return (PORTBINARY); 4168126353Smlaier } 4169126353Smlaier lungetc(next); 4170126353Smlaier break; 4171126353Smlaier case '>': 4172126353Smlaier next = lgetc(fin); 4173126353Smlaier if (next == '<') { 4174126353Smlaier yylval.v.i = PF_OP_IRG; 4175126353Smlaier return (PORTBINARY); 4176126353Smlaier } 4177126353Smlaier lungetc(next); 4178126353Smlaier break; 4179126353Smlaier case '-': 4180126353Smlaier next = lgetc(fin); 4181126353Smlaier if (next == '>') 4182126353Smlaier return (ARROW); 4183126353Smlaier lungetc(next); 4184126353Smlaier break; 4185126353Smlaier } 4186126353Smlaier 4187126353Smlaier#define allowed_in_string(x) \ 4188126353Smlaier (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4189126353Smlaier x != '{' && x != '}' && x != '<' && x != '>' && \ 4190126353Smlaier x != '!' && x != '=' && x != '/' && x != '#' && \ 4191126353Smlaier x != ',')) 4192126353Smlaier 4193126353Smlaier if (isalnum(c) || c == ':' || c == '_') { 4194126353Smlaier do { 4195126353Smlaier *p++ = c; 4196126353Smlaier if ((unsigned)(p-buf) >= sizeof(buf)) { 4197126353Smlaier yyerror("string too long"); 4198126353Smlaier return (findeol()); 4199126353Smlaier } 4200126353Smlaier } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4201126353Smlaier lungetc(c); 4202126353Smlaier *p = '\0'; 4203126353Smlaier token = lookup(buf); 4204126353Smlaier yylval.v.string = strdup(buf); 4205126353Smlaier if (yylval.v.string == NULL) 4206126353Smlaier err(1, "yylex: strdup"); 4207126353Smlaier return (token); 4208126353Smlaier } 4209126353Smlaier if (c == '\n') { 4210126353Smlaier yylval.lineno = lineno; 4211126353Smlaier lineno++; 4212126353Smlaier } 4213126353Smlaier if (c == EOF) 4214126353Smlaier return (0); 4215126353Smlaier return (c); 4216126353Smlaier} 4217126353Smlaier 4218126353Smlaierint 4219126353Smlaierparse_rules(FILE *input, struct pfctl *xpf) 4220126353Smlaier{ 4221126353Smlaier struct sym *sym; 4222126353Smlaier 4223126353Smlaier fin = input; 4224126353Smlaier pf = xpf; 4225126353Smlaier lineno = 1; 4226126353Smlaier errors = 0; 4227126353Smlaier rulestate = PFCTL_STATE_NONE; 4228126353Smlaier returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4229126353Smlaier returnicmp6default = 4230126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4231126353Smlaier blockpolicy = PFRULE_DROP; 4232126353Smlaier require_order = 1; 4233126353Smlaier 4234126353Smlaier yyparse(); 4235126353Smlaier 4236126353Smlaier /* Free macros and check which have not been used. */ 4237126353Smlaier TAILQ_FOREACH(sym, &symhead, entries) { 4238126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 4239126353Smlaier fprintf(stderr, "warning: macro '%s' not " 4240126353Smlaier "used\n", sym->nam); 4241126353Smlaier free(sym->nam); 4242126353Smlaier free(sym->val); 4243126353Smlaier TAILQ_REMOVE(&symhead, sym, entries); 4244126353Smlaier } 4245126353Smlaier 4246126353Smlaier return (errors ? -1 : 0); 4247126353Smlaier} 4248126353Smlaier 4249126353Smlaier/* 4250126353Smlaier * Over-designed efficiency is a French and German concept, so how about 4251126353Smlaier * we wait until they discover this ugliness and make it all fancy. 4252126353Smlaier */ 4253126353Smlaierint 4254126353Smlaiersymset(const char *nam, const char *val, int persist) 4255126353Smlaier{ 4256126353Smlaier struct sym *sym; 4257126353Smlaier 4258126353Smlaier for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 4259126353Smlaier sym = TAILQ_NEXT(sym, entries)) 4260126353Smlaier ; /* nothing */ 4261126353Smlaier 4262126353Smlaier if (sym != NULL) { 4263126353Smlaier if (sym->persist == 1) 4264126353Smlaier return (0); 4265126353Smlaier else { 4266126353Smlaier free(sym->nam); 4267126353Smlaier free(sym->val); 4268126353Smlaier TAILQ_REMOVE(&symhead, sym, entries); 4269126353Smlaier free(sym); 4270126353Smlaier } 4271126353Smlaier } 4272126353Smlaier if ((sym = calloc(1, sizeof(*sym))) == NULL) 4273126353Smlaier return (-1); 4274126353Smlaier 4275126353Smlaier sym->nam = strdup(nam); 4276126353Smlaier if (sym->nam == NULL) { 4277126353Smlaier free(sym); 4278126353Smlaier return (-1); 4279126353Smlaier } 4280126353Smlaier sym->val = strdup(val); 4281126353Smlaier if (sym->val == NULL) { 4282126353Smlaier free(sym->nam); 4283126353Smlaier free(sym); 4284126353Smlaier return (-1); 4285126353Smlaier } 4286126353Smlaier sym->used = 0; 4287126353Smlaier sym->persist = persist; 4288126353Smlaier TAILQ_INSERT_TAIL(&symhead, sym, entries); 4289126353Smlaier return (0); 4290126353Smlaier} 4291126353Smlaier 4292126353Smlaierint 4293126353Smlaierpfctl_cmdline_symset(char *s) 4294126353Smlaier{ 4295126353Smlaier char *sym, *val; 4296126353Smlaier int ret; 4297126353Smlaier 4298126353Smlaier if ((val = strrchr(s, '=')) == NULL) 4299126353Smlaier return (-1); 4300126353Smlaier 4301126353Smlaier if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 4302126353Smlaier err(1, "pfctl_cmdline_symset: malloc"); 4303126353Smlaier 4304126353Smlaier strlcpy(sym, s, strlen(s) - strlen(val) + 1); 4305126353Smlaier 4306126353Smlaier ret = symset(sym, val + 1, 1); 4307126353Smlaier free(sym); 4308126353Smlaier 4309126353Smlaier return (ret); 4310126353Smlaier} 4311126353Smlaier 4312126353Smlaierchar * 4313126353Smlaiersymget(const char *nam) 4314126353Smlaier{ 4315126353Smlaier struct sym *sym; 4316126353Smlaier 4317126353Smlaier TAILQ_FOREACH(sym, &symhead, entries) 4318126353Smlaier if (strcmp(nam, sym->nam) == 0) { 4319126353Smlaier sym->used = 1; 4320126353Smlaier return (sym->val); 4321126353Smlaier } 4322126353Smlaier return (NULL); 4323126353Smlaier} 4324126353Smlaier 4325126353Smlaiervoid 4326126353Smlaierdecide_address_family(struct node_host *n, sa_family_t *af) 4327126353Smlaier{ 4328126353Smlaier sa_family_t target_af = 0; 4329126353Smlaier 4330126353Smlaier while (!*af && n != NULL) { 4331126353Smlaier if (n->af) { 4332126353Smlaier if (target_af == 0) 4333126353Smlaier target_af = n->af; 4334126353Smlaier if (target_af != n->af) 4335126353Smlaier return; 4336126353Smlaier } 4337126353Smlaier n = n->next; 4338126353Smlaier } 4339126353Smlaier if (!*af && target_af) 4340126353Smlaier *af = target_af; 4341126353Smlaier} 4342126353Smlaier 4343126353Smlaiervoid 4344126353Smlaierremove_invalid_hosts(struct node_host **nh, sa_family_t *af) 4345126353Smlaier{ 4346126353Smlaier struct node_host *n = *nh, *prev = NULL; 4347126353Smlaier 4348126353Smlaier while (n != NULL) { 4349126353Smlaier if (*af && n->af && n->af != *af) { 4350126353Smlaier /* unlink and free n */ 4351126353Smlaier struct node_host *next = n->next; 4352126353Smlaier 4353126353Smlaier /* adjust tail pointer */ 4354126353Smlaier if (n == (*nh)->tail) 4355126353Smlaier (*nh)->tail = prev; 4356126353Smlaier /* adjust previous node's next pointer */ 4357126353Smlaier if (prev == NULL) 4358126353Smlaier *nh = next; 4359126353Smlaier else 4360126353Smlaier prev->next = next; 4361126353Smlaier /* free node */ 4362126353Smlaier if (n->ifname != NULL) 4363126353Smlaier free(n->ifname); 4364126353Smlaier free(n); 4365126353Smlaier n = next; 4366126353Smlaier } else { 4367126353Smlaier if (n->af && !*af) 4368126353Smlaier *af = n->af; 4369126353Smlaier prev = n; 4370126353Smlaier n = n->next; 4371126353Smlaier } 4372126353Smlaier } 4373126353Smlaier} 4374126353Smlaier 4375126353Smlaierint 4376126353Smlaierinvalid_redirect(struct node_host *nh, sa_family_t af) 4377126353Smlaier{ 4378126353Smlaier if (!af) { 4379126353Smlaier struct node_host *n; 4380126353Smlaier 4381126353Smlaier /* only tables are ok without an address family */ 4382126353Smlaier for (n = nh; n != NULL; n = n->next) { 4383126353Smlaier if (n->addr.type != PF_ADDR_TABLE) { 4384126353Smlaier yyerror("address family not given and " 4385126353Smlaier "translation address expands to multiple " 4386126353Smlaier "address families"); 4387126353Smlaier return (1); 4388126353Smlaier } 4389126353Smlaier } 4390126353Smlaier } 4391126353Smlaier if (nh == NULL) { 4392126353Smlaier yyerror("no translation address with matching address family " 4393126353Smlaier "found."); 4394126353Smlaier return (1); 4395126353Smlaier } 4396126353Smlaier return (0); 4397126353Smlaier} 4398126353Smlaier 4399126353Smlaierint 4400126353Smlaieratoul(char *s, u_long *ulvalp) 4401126353Smlaier{ 4402126353Smlaier u_long ulval; 4403126353Smlaier char *ep; 4404126353Smlaier 4405126353Smlaier errno = 0; 4406126353Smlaier ulval = strtoul(s, &ep, 0); 4407126353Smlaier if (s[0] == '\0' || *ep != '\0') 4408126353Smlaier return (-1); 4409126353Smlaier if (errno == ERANGE && ulval == ULONG_MAX) 4410126353Smlaier return (-1); 4411126353Smlaier *ulvalp = ulval; 4412126353Smlaier return (0); 4413126353Smlaier} 4414126353Smlaier 4415126353Smlaierint 4416126353Smlaiergetservice(char *n) 4417126353Smlaier{ 4418126353Smlaier struct servent *s; 4419126353Smlaier u_long ulval; 4420126353Smlaier 4421126353Smlaier if (atoul(n, &ulval) == 0) { 4422126353Smlaier if (ulval > 65535) { 4423126353Smlaier yyerror("illegal port value %d", ulval); 4424126353Smlaier return (-1); 4425126353Smlaier } 4426126353Smlaier return (htons(ulval)); 4427126353Smlaier } else { 4428126353Smlaier s = getservbyname(n, "tcp"); 4429126353Smlaier if (s == NULL) 4430126353Smlaier s = getservbyname(n, "udp"); 4431126353Smlaier if (s == NULL) { 4432126353Smlaier yyerror("unknown port %s", n); 4433126353Smlaier return (-1); 4434126353Smlaier } 4435126353Smlaier return (s->s_port); 4436126353Smlaier } 4437126353Smlaier} 4438126353Smlaier 4439126353Smlaierint 4440126353Smlaierrule_label(struct pf_rule *r, char *s) 4441126353Smlaier{ 4442126353Smlaier if (s) { 4443126353Smlaier if (strlcpy(r->label, s, sizeof(r->label)) >= 4444126353Smlaier sizeof(r->label)) { 4445126353Smlaier yyerror("rule label too long (max %d chars)", 4446126353Smlaier sizeof(r->label)-1); 4447126353Smlaier return (-1); 4448126353Smlaier } 4449126353Smlaier } 4450126353Smlaier return (0); 4451126353Smlaier} 4452126353Smlaier 4453126353Smlaieru_int16_t 4454126353Smlaierparseicmpspec(char *w, sa_family_t af) 4455126353Smlaier{ 4456126353Smlaier const struct icmpcodeent *p; 4457126353Smlaier u_long ulval; 4458126353Smlaier u_int8_t icmptype; 4459126353Smlaier 4460126353Smlaier if (af == AF_INET) 4461126353Smlaier icmptype = returnicmpdefault >> 8; 4462126353Smlaier else 4463126353Smlaier icmptype = returnicmp6default >> 8; 4464126353Smlaier 4465126353Smlaier if (atoul(w, &ulval) == -1) { 4466126353Smlaier if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 4467126353Smlaier yyerror("unknown icmp code %s", w); 4468126353Smlaier return (0); 4469126353Smlaier } 4470126353Smlaier ulval = p->code; 4471126353Smlaier } 4472126353Smlaier if (ulval > 255) { 4473126353Smlaier yyerror("invalid icmp code %ld", ulval); 4474126353Smlaier return (0); 4475126353Smlaier } 4476126353Smlaier return (icmptype << 8 | ulval); 4477126353Smlaier} 4478126353Smlaier 4479126353Smlaierint 4480126353Smlaierpfctl_load_anchors(int dev, int opts) 4481126353Smlaier{ 4482126353Smlaier struct loadanchors *la; 4483126353Smlaier 4484126353Smlaier TAILQ_FOREACH(la, &loadanchorshead, entries) { 4485126353Smlaier if (opts & PF_OPT_VERBOSE) 4486126353Smlaier fprintf(stderr, "\nLoading anchor %s:%s from %s\n", 4487126353Smlaier la->anchorname, la->rulesetname, la->filename); 4488126353Smlaier if (pfctl_rules(dev, la->filename, opts, la->anchorname, 4489126353Smlaier la->rulesetname) == -1) 4490126353Smlaier return (-1); 4491126353Smlaier } 4492126353Smlaier 4493126353Smlaier return (0); 4494126353Smlaier} 4495126353Smlaier 4496